diff --git a/docs/API.md b/docs/API.md
new file mode 100644
index 00000000..1d74a080
--- /dev/null
+++ b/docs/API.md
@@ -0,0 +1,164 @@
+# Task API (since 2.2, in progress)
+
+A REST API shaped like ClickUp API v2, for scripts and agents with a personal token (spec 213). **Audit status: re-verification pending.** The read endpoints are in; writes arrive before 2.2.0 is tagged, along with the OpenAPI document.
+
+## Read endpoints
+
+Paths after `api.prefix`. *Level* is the least a token needs; the person's access and where still apply.
+
+| Endpoint | Level | Notes |
+|---|---|---|
+| `GET /v2/user`, `GET /v2/team` | My tasks | A team lists no members |
+| `GET /v2/team/{team_id}/space`, `GET /v2/space/{id}` | My tasks | Spaces where reaches and whose plan holds the module |
+| `GET /v2/space/{id}/folder` | My tasks | Always `{"folders": []}`: every board is a folderless list |
+| `GET /v2/space/{id}/list`, `GET /v2/list/{id}` | My tasks | `task_count` counts only what the token may read; columns are `statuses` (first `open`, last `closed`, the rest `custom`) |
+| `GET /v2/list/{id}/task`, `GET /v2/team/{team_id}/task` | My tasks (its own) | 100 per page from `page=0`, `last_page`; `archived`, `subtasks`, `include_closed`, `statuses[]`, `assignees[]`, `tags[]`, `due_date_gt`/`_lt`, `date_created_*`, `date_updated_*`, `date_done_*`, `order_by` (`id`, `created`, `updated`, `due_date`), `reverse`, `include_markdown_description`; on a team also `space_ids[]`, `list_ids[]` |
+| `GET /v2/task/{id}` | My tasks (its own) | `include_subtasks`, `include_markdown_description` |
+| `GET /v2/task/{id}/comment` | My tasks (its own) | 25 per page, newest first; `start` and `start_id` of the oldest one shown give the next page |
+| `GET /v2/task/{id}/member` | Read | Everyone attached to the task |
+| `GET /v2/space/{id}/tag` | Read | Tags of the open tasks the token reaches |
+| `GET /v2/list/{id}/field` | Read | Custom fields a provider sync imported; none otherwise |
+| `GET /v2/team/{team_id}/time_entries` | My tasks | The host's time store answers; `start_date`, `end_date`, `assignee`, `task_id` |
+
+A malformed filter value is 400 `INPUT_002`. Unknown query parameters are ignored on reads. Each list answers in the same number of queries whatever the page holds (8 for a list's tasks, measured at 25 and 100 tasks), the tag filter included.
+
+**Cost per board.** A team's lists and tasks ask the host's access decision once per board the team reaches (`BOARD_ACCESS_CHECK`, in Beacon a voter), and the plan gate once per space. The bundle's own queries stay the same with 1 board or 10; the host's checks grow with the boards.
+
+**Time entries.** Without `task_id`, the bundle checks only the team: the host's time hook must keep to what the token's level and where reach, and to the people whose time the person may see. With `task_id`, the task goes through the guard first.
+
+**What a page shows of other tasks.** Subtasks, dependencies and links are shown only when the token may open the other task too. For *My tasks*, the checklist items of its own tasks are shown whoever created them, as it manages those checklists.
+
+## Write endpoints
+
+Every write goes through the services the UI uses: its plan limits, events (notifications, mentions, activity), history and validation. Each answers like ClickUp; a field nothing read is listed in `warnings` (`unknown`, or `not_supported` for a ClickUp field with no equivalent here) and is never saved.
+
+| Endpoint | Level | Notes |
+|---|---|---|
+| `POST /v2/list/{id}/task` | Tasks | `name`, `description` / `markdown_content`, `status` (a column's name), `priority` (1 urgent to 4 low), `due_date`, `start_date`, `time_estimate`, `tags`, `assignees`, `parent` (same board). Asks the host's plan limit |
+| `PUT /v2/task/{id}` | My tasks (own: `status`, dates, `description` only) | `name`, `priority`, `time_estimate`, `assignees` and `watchers` (`add`, `rem`), `archived` need Tasks. A status change moves the task as the board does: the done column completes it, leaving it reopens it within the host's limit |
+| `DELETE /v2/task/{id}` | Tasks | Erases the task and its subtasks; tracked time is kept, detached. The board's manage decision is needed. A task that follows a provider: 409 `TASK_002` |
+| `POST /v2/task/{id}/comment` | My tasks (own) | `comment_text`. Mentions work as in the UI's comment box: each candidate written `@Label` in the text is mentioned, so `TASK_COMMENT`, `TASK_MENTION` and the host's notifications follow |
+| `POST`, `DELETE /v2/task/{id}/tag/{name}` | Tasks | The task form's rules: a name of 1 to 64 characters, at most 20 tags. `PUT /v2/task/{id}` does not take `tags` (a warning) |
+| `POST /v2/task/{id}/field/{field_id}` | Tasks | Always 409 `FIELD_001`: custom fields are a provider's, read-only |
+| `POST /v2/task/{id}/dependency`, `DELETE` with `?depends_on=` or `?dependency_of=` | Tasks | Within a board (`LINK_002`); no cycle or duplicate (`LINK_001`) |
+| `POST`, `DELETE /v2/task/{id}/link/{links_to}` | Tasks | A `Related` relation |
+| `POST /v2/task/{id}/checklist`, `PUT`, `DELETE /v2/checklist/{id}` | My tasks (own) | A checklist with no item is not stored. Deleting archives its items |
+| `POST /v2/checklist/{id}/checklist_item`, `PUT`, `DELETE …/checklist_item/{item}` | My tasks (own) | An item is a subtask tagged `checklist:<name>`, counted against the plan's active tasks. `resolved` moves it to the done column or back to the first. *My tasks* assigns an item only to its own person. Deleting archives it. Items are edited under the parent task's right, whoever created them; any editor who tags a subtask `checklist:<name>` makes it an item, visible to a *My tasks* token of the parent |
+
+| `POST /v2/task/{id}/attachment` | Tasks | Multipart, field `attachment`. The host stores it through `TaskApiAttachmentsInterface`, with all its upload checks (content sniffing, plan storage, sizes); its refusal is the answer. The file's bytes are part of an idempotency key's request |
+| `POST /v2/team/{team_id}/time_entries` | My tasks (own task) | `start` and `duration` (1 minute to 7 days) in milliseconds, `tid`, `description`. The token's own person's time only: another `assignee` is 403 `TOKEN_001`. Without `tid`, the host's time store decides; `ManualTaskApiTimeEntries` needs a task |
+| `DELETE /v2/team/{team_id}/time_entries/{id}` | — | Always 403 `TIME_002`, before anything is looked up: tracked time is never deleted through the API |
+
+### Management (Full)
+
+Every management write needs a *Full* token and the board's manage decision (`BoardAccessCheckEvent::ACTION_MANAGE`; in Beacon `project.tasks.manage`, `organization.tasks.manage`, or a personal board's owner); a new board needs the host's create check for the space's tenant and the board plan limit.
+
+| Endpoint | Notes |
+|---|---|
+| `POST /v2/space/{id}/list` | `name`, `content` / `markdown_content`. The token must reach the whole tenant (naming one board of it is not enough). The board gets the default columns, as from the UI |
+| `PUT /v2/list/{id}` | `name`, `content`; the slug stays. `status`, `priority`, `assignee`, `due_date` are warned about |
+| `DELETE /v2/list/{id}` | Erases every task, tracked time kept and detached, then the columns and the board. Works within a time budget: 200 `{}` when done, otherwise 202 `{"status": "in_progress"}` with `Retry-After`; call again until 200. A 202 is not kept for an idempotency key. A board that follows a provider: 409 `LIST_002`. Two deletes of one board at the same time may both pick the same tasks, so `TASK_ERASED` (with its file refs) and `BOARD_DELETED` can come twice: a host's listeners must delete files idempotently |
+| `POST /v2/list/{id}/status` | **Not in ClickUp's API.** A column at the end: `status` (its name), `color` (hex) |
+| `PUT /v2/list/{id}/status/{status_id}` | **Not in ClickUp's API.** Renames or recolours a column; what is not given stays |
+| `PUT /v2/list/{id}/status/order` | **Not in ClickUp's API.** `order` lists every column id once |
+| `DELETE /v2/list/{id}/status/{status_id}` | **Not in ClickUp's API.** Its tasks move to the first remaining column (completed or reopened as the board's last column says, within the host's limit); the last column stays (409 `LIST_001`) |
+
+Tags exist on tasks only: there is no space tag to create, rename or delete. Board members are not managed through the API.
+
+**Time store.** `api.hooks.time_entries` lists and logs time; it has no delete. A host without its own may use `Nowo\TaskBoardBundle\Api\Hook\ManualTaskApiTimeEntries`: the bundle's manual entries, logged through `TaskTimeLogger` as the task page logs them, and listed for the token's own person on tasks the token may open (at most 500).
+
+**Before any write.** A host must listen to `TaskBoardEvents::API_WRITE` (else 503 `AUDIT_001`), and, with `api.quota_listener_required` (the default), to `QUOTA_CHECK` for creates (else 403 `PLAN_002`). A refused limit is 403 `PLAN_002` with the host's reason.
+
+**Several changes in one request are not one transaction.** They are saved one service at a time, as the UI's separate forms are, and each service's events go out after its save. Everything that can be refused is asked first (people, status, dates, limits), so a refusal changes nothing; a database failure between two saves can leave the first one saved. A client retrying with the same `Idempotency-Key` gets a fresh run after such a failure, since errors are not kept. **Known narrow race:** the limit is asked once before the first save, and the restore and the move ask it again as they save; if another write fills the limit in between, the restore is saved and the move then answers 500. Retrying the same request completes it.
+
+### Idempotency
+
+Any write may carry `Idempotency-Key` (1 to 255 characters, else 400 `IDEMP_003`):
+
+- **Scope:** the token. The same key from another token is another key.
+- **Expiry:** 24 hours from the first attempt.
+- **Retry of the same request** (method, path and body; JSON compared with its keys sorted): the first answer, its status and body, with `Idempotency-Replayed: true`. The write does not run again.
+- **Same key, different request:** 409 `IDEMP_002`. While the first attempt runs: 409 `IDEMP_001`; a claim left for 5 minutes by a process that died is taken over.
+- **Refusals and errors are not kept:** a retry is decided afresh.
+- **A replay is checked again:** the pipeline, and whether the token still reaches what the write touched (a board that is gone leaves its tenant), else 404.
+- **What a replay does not do:** it does not ask the level or the plan again (the first request did, and a replay writes nothing); it does ask the pipeline (token, rate limit) and the reach.
+- **Storage:** the bundle's table `task_board_api_idempotency` (hashes of the token id and key, never either; the answer, which can hold task text). Expired rows go on each claim and with `nowo:task-board:api:purge-idempotency`. `forget()` clears one token's answers: text from a task may sit in other tokens' answers for up to 24 hours. On revoking a token or erasing its person, call `TaskApiIdempotencyStoreInterface::forget()` with the scope `sha256('nowo-task-board-api|' . $tokenId)`. A host may replace the store with `api.hooks.idempotency_store`; the table is then not mapped. A store that fails refuses keyed writes with 503 `IDEMP_004`.
+
+## Differences from ClickUp (so far)
+
+- Ids are strings: the bundle's UUIDs, and the host's ids for people.
+- Dates are Unix milliseconds as strings, at the precision the database keeps (seconds).
+- No folders, group assignees, points, task URL or custom task id (`null` or empty).
+- Checklists are subtasks tagged `checklist:<name>`; a checklist's id encodes its task and name.
+- Tags have no colours (`tag_fg`, `tag_bg` are null).
+- `GET /v2/task/{id}/member` lists the task's members, not everyone who can open it.
+- Dependencies stay within a board; `Related` and `Duplicates` read as `linked_tasks`.
+- Task order defaults to `created` ascending; `reverse=true` flips it.
+- `priority: null` reads as normal: every task has a priority.
+- Deleting a checklist or an item archives it.
+- ClickUp's structured comment fields (`notify_all`, `assignee`, `group_assignee`) are not read; mentions come from the text, as in the UI.
+- A task without a column, on a board that has columns, goes to the first column on any update (the task form does the same). Tasks get a column when created, so this concerns only rows made outside the bundle.
+
+## Off by default
+
+With `api.enabled: false` a host gets no route, service, listener, parameter or table.
+
+## What a host provides
+
+The bundle stores no tokens. `api.hooks.authenticator` is required with `enabled: true`; every other hook has a default, and every default denies.
+
+| `api.hooks.*` | Interface in `Nowo\TaskBoardBundle\Api\Hook` | Without it |
+|---|---|---|
+| `authenticator` | `TaskApiAuthenticatorInterface` | The container does not build |
+| `rate_limiter` | `TaskApiRateLimiterInterface` | Every request 429 |
+| `plan_gate` | `TaskApiPlanGateInterface` | 403 `PLAN_001` |
+| `workspace` | `TaskApiWorkspaceInterface` | No teams or spaces, every board 404 |
+| `users` | `TaskApiUsersInterface` | Nobody is known |
+| `time_entries` | `TaskApiTimeEntriesInterface` (list and log; tracked time is never deleted through the API) | 403 `TIME_001` |
+| `attachments` | `TaskApiAttachmentsInterface` | 403 `FILE_001` |
+| `idempotency_store` | `TaskApiIdempotencyStoreInterface` | The bundle's store, when writes arrive |
+
+A listener on `TaskBoardEvents::API_WRITE` (`TaskApiWriteEvent`) audits each write.
+
+## Firewall
+
+The API must sit behind a **stateless firewall** whose security user is the token's user, as the access checkers read the security token. `security: false` answers 500 `SERVER_001` on every request. For a bad token the firewall lets the request through with no user, and adds no redirecting `access_control` on the path: the bundle answers, so all refusals share one shape.
+
+```yaml
+nowo_task_board:
+    api:
+        enabled: true
+        prefix: /api/tasks
+        host_decides_access: true   # only with security.resource_scoping: false, when your listeners decide access
+        hooks:
+            authenticator: App\Api\TaskApiAuthenticator
+```
+
+The build refuses `security.allow_unauthenticated: true`, and `security.resource_scoping: false` without `host_decides_access: true`: both would open every board to every token.
+
+## Access
+
+Each request: level ∩ the person's access ∩ where. In this order, and the first failure answers:
+
+| Check | Answer |
+|---|---|
+| Out of reach: missing, outside where, no space for its tenant, no view access, for My tasks not its own | 404 `ACCESS_001`, always the same |
+| The tasks module is not in the plan | 403 `PLAN_001` |
+| The level may not | 403 `TOKEN_001` |
+| The person may not | 403 `ACCESS_002` |
+
+Levels are not a chain: *Read* changes nothing, while *My tasks* works on its own tasks. See `TaskApiCapability`.
+
+**Where.** `TaskApiWhere::limitedTo($tenantKeys, $boardIds)`: each entry grants on its own. A named tenant reaches all its boards; a named board is reached even when its tenant is not listed. Nothing else widens: the person's access, the workspace hook and the tenant check apply to it too.
+
+**Tenancy.** With `tenancy.enabled`, a board is reached only when the bundle's tenant resolver opens its tenant for the person (the slug being the key), as the UI asks of the tenant in its URL, whatever the workspace hook answers. A board without a tenant is not served then, as in the UI.
+
+**Notes for hosts.** The security-user check compares ids, not classes: a firewall user of another class with the same id would pass, so use one user class for the API's firewall. An `access_control` refusal on the API's path answers 403 `ACCESS_002`, not 401: add none there. A token whose user the access checker refuses answers 401 like a bad token and counts as a failed token.
+
+## Errors
+
+`{"err": "...", "ECODE": "..."}`, with `OAUTH_017` (401, no header), `OAUTH_019` (401, token not valid, one answer for every reason), `API_001` (404, the instance switch), `RATE_001` and `RATE_002` (429), and `SERVER_001` (500, no detail). Answers carry `X-RateLimit-Limit`, `-Remaining`, `-Reset` (Unix seconds) and `Cache-Control: no-store, private`. The credential is read only from the `Authorization` header, with or without `Bearer`, and never logged.
+
+## Known differences from the UI
+
+Task text is returned raw. A description or comment that embeds a host file (in Beacon, a `beacon-file:` image) shows an API reader the image's alt text and its UUID, which the UI hides from a viewer who may not open the file. The file's bytes stay behind the host's download check. Wiki and document references are not resolved in task text, so they show nothing more.
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 5ba2d088..bc602096 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -86,6 +86,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+Target: 2.2.0, spec 213 (Task API). Audit status: re-verification pending. Opt-in: with `api.enabled: false` (the default) no route, service, listener, parameter or table changes, and the UI's output stays as it was. See [API](API.md).
+
+### Added
+
+- **Task API, management (Full).** Create, rename and delete boards (deleting erases the tasks with time kept, in slices answered 202; a provider-linked board is 409 `LIST_002`), and columns as statuses on four paths of this API's own (`/v2/list/{id}/status…`). Needs the board's manage decision, or the create check and the board plan limit.
+- **Task API, files and time.** `POST /v2/task/{id}/attachment` through the host's `TaskApiAttachmentsInterface`; `POST /v2/team/{id}/time_entries` through `TaskApiTimeEntriesInterface`, for the token's own person; `DELETE` of a time entry always 403 `TIME_002`. `Api\Hook\ManualTaskApiTimeEntries` as a time store over the bundle's manual entries.
+- **Task API, write endpoints.** Tasks (create, update, delete with time kept), comments, tags, dependencies, links and checklists, through the UI's services. Read writes nothing; My tasks works only on its own tasks and their checklists; custom fields answer 409 `FIELD_001`; a task that follows a provider is not deleted (409 `TASK_002`). Writes need an `API_WRITE` listener (503 `AUDIT_001`) and, for creates, a `QUOTA_CHECK` listener (403 `PLAN_002`). `Idempotency-Key` on every write, 24 hours per token, in `task_board_api_idempotency` or the host's store; `nowo:task-board:api:purge-idempotency`.
+- **Task API, read endpoints.** Spaces, folders (none), lists, tasks with ClickUp's filters and 100 per page, a task, comments, members, tags, imported custom fields and time entries (through the host's time hook). Lists hold and count only what the token may read; each list answers in a fixed number of queries. See [API](API.md).
+- **Task API, skeleton (`api.*`).** `GET /v2/user`, `GET /v2/team` under `api.prefix`; the request pipeline (failed-token limit, authenticator, security user, rate limit), `Api\Security\TaskApiGuard` (level ∩ access ∩ where), `Api\TaskApiCapability`, one `{err, ECODE}` shape. Hooks in `Api\Hook`, where every default denies; event `TaskBoardEvents::API_WRITE`. The build refuses `security.allow_unauthenticated` and, without `api.host_decides_access`, `security.resource_scoping: false`.
+- `Service\TaskManager::restore()` and `archive()`, with their history; `restore()` asks the host's limit and throws `TaskReopenRefusedException` when it refuses.
+- `Service\TaskBoardEraser::eraseTask()`: one task and its subtasks, leaf-first through Doctrine, tracked time kept and detached. Needs the board's manage decision; a task that follows a provider, or has a subtask that does, is refused with `TaskLinkedToProviderException`. The files a sync stored for the subtree, kept after an unlink, are named in each `TaskErasedEvent` and their rows removed, so the host can delete them (audit IA-M1).
+- `Service\TaskBoardEditor::update()`: name and description of a board, the slug unchanged, `TaskBoardEvents::BOARD_UPDATED` (`BoardUpdatedEvent`).
+- `Service\TaskCommentPolicy`: who may write, edit and delete a comment.
+- `Validation\TaskConstraints`: the rules of the fields a write takes.
+- `Service\TaskDependencyManager::findBetween()`, `Dto\TaskFormData::fromTask()`.
+
+### Changed
+
+- `TaskBoardManageController` asks `TaskCommentPolicy` and `TaskManager::restore()`, and the write forms take their rules from `TaskConstraints`. Their output does not change: `tests/Functional/Characterization` pins it. Its `$syncLimits` argument stays in place but is deprecated and ignored: `TaskManager` holds the same limit (audit IA-I1).
+
 ## [2.1.1] - 2026-11-07
 
 Target: 2.1.1. Reported by Beacon on 2.0.2. No schema, configuration or permission change. Audit HZ (2026-11-07): Pass (good) / Low. See [UPGRADING](UPGRADING.md#to-211).
diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index 2d3ff911..39da4755 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -6,6 +6,7 @@
 - [Database](#database)
 - [Routes](#routes)
   - [Why a route loader instead of `#[Route]` attributes (REQ-SF-004)](#why-a-route-loader-instead-of-route-attributes-req-sf-004)
+- [Task API (since 2.2)](#task-api-since-22)
 - [Security](#security)
   - [Firewall](#firewall)
   - [Access checker](#access-checker)
@@ -143,6 +144,10 @@ from this configuration, not declared with `#[Route]` attributes on `TaskBoardMa
 
 Route names, paths, methods and the prefix are unchanged by 1.21.
 
+## Task API (since 2.2)
+
+Off by default. `api.enabled`, `api.prefix`, `api.host_decides_access`, `api.quota_listener_required`, `api.max_body_bytes` and `api.hooks.*`: see [API](API.md).
+
 ## Security
 
 ### Firewall
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 5346359b..759d50e3 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -12,6 +12,7 @@
 - [Task types, tag colours and descriptions (since 1.28.0)](#task-types-tag-colours-and-descriptions-since-1280)
 - [Task numbers and calendar (since 2.1)](#task-numbers-and-calendar-since-21)
 - [UiKit migration (2.0.0)](#uikit-migration-200)
+- [Shared write rules (2.2, re-verification pending)](#shared-write-rules-22-re-verification-pending)
 - [Logging and personal data](#logging-and-personal-data)
 - [Personal data in synced tasks (RGPD / LOPDGDD)](#personal-data-in-synced-tasks-rgpd--lopdgdd)
 - [Dependencies](#dependencies)
@@ -27,6 +28,7 @@
 | **Task forms** | Symfony forms for board/task creation and updates (title, description, links, members). |
 | **Configuration** | `nowo_task_board` YAML (routes, table prefix, access checker, team resolver). |
 | **Provider sync (since 1.23, opt-in)** | Server-side calls to a task provider's API with the host's token, file downloads from the provider's attachment hosts, remote text stored as Markdown. |
+| **Task API (since 2.2, opt-in)** | Stateless routes under `api.prefix`, off by default. Token authentication is the host's; `Api\Security\TaskApiRequestListener` and `TaskApiGuard` fail closed. Audit IA: a token whose user the access checker refuses counts as a failed token (L1); with tenancy the guard asks the bundle's tenant resolver too (L2); the security-user check compares ids, not classes, and an `access_control` refusal reads as 403 (I2, I3, documented in [API](API.md)). `TaskManager::archive()` dispatches no domain event, as no UI archive exists; the API's write audit is `API_WRITE` (I5). Writes (2.2, S4): the guard's capability table per write, `API_WRITE` required, the plan limit refused when no `QUOTA_CHECK` listener answers, idempotency keys scoped to the token with hashes only and a replay checked again; the kept answers hold task text for 24 hours (`forget()` on revocation or erasure). Audit status: re-verification pending. |
 | **TimeTrack bridge** | Optional. When TimeTrack is installed, task provider exposes trackable tasks; access gated by `TaskAccessGuard`. |
 
 ## Threats and mitigations
@@ -164,6 +166,10 @@ Both opt-in.
 - **Avatars.** Pictures now pass UiKit's `AvatarUrlPolicy`: https without userinfo, or a same-origin path.
 - **Subtask nodes.** Titles reach `tree` as text, escaped by the partial, and in `data-*` attributes through `nowo_ui_safe_attrs`.
 
+## Shared write rules (2.2, re-verification pending)
+
+Spec 213 gives the comment rules, the restore limit and the field constraints one home (`TaskCommentPolicy`, `TaskManager::restore()`, `TaskConstraints`), so a write path other than the forms cannot apply different ones. `TaskBoardEraser::eraseTask()` asks the board's manage decision itself, erases leaf-first so the `PreRemove` that keeps time runs for every subtask (`parent_id` is `ON DELETE CASCADE`, which would skip it), and refuses a task that follows a provider. After an unlink, the files a sync stored for the subtree are named in `TaskErasedEvent::$attachmentRefs` and their rows removed, on every database (audit IA-M1): the host deletes them, as for `deleteBoard()`. `tests/Functional/Characterization` pins the UI's output.
+
 ## Logging and personal data
 
 REQ-OBS-001 (since 1.21): every successful board / task write logs one `info` line, an invalid CSRF token one `warning`,
diff --git a/docs/UPGRADING.md b/docs/UPGRADING.md
index 4c469b9c..f2ffebd9 100644
--- a/docs/UPGRADING.md
+++ b/docs/UPGRADING.md
@@ -155,6 +155,14 @@ Hosting FrankenPHP with **kernel not reset** between requests: see [FRANKENPHP-W
 
 ## Unreleased
 
+Target: 2.2.0, spec 213. Audit status: re-verification pending. No schema or configuration change is needed, and the UI's output stays as it was. The Task API is off unless you set `api.enabled: true`: see [API](API.md).
+
+**Board deletes through the API.** `DELETE /v2/list/{id}` erases in slices (202 until done). Two deletes of one board at the same time may both erase the same tasks' rows, so `TASK_ERASED`, with its stored-file refs, and `BOARD_DELETED` can be dispatched twice: make the listeners that delete files or write audit rows idempotent.
+
+**Schema change with `api.enabled: true` only** (and no `api.hooks.idempotency_store`): the table `task_board_api_idempotency`. Generate it with `doctrine:migrations:diff`; it holds keys for 24 hours, so it needs no data migration. A host with the API off changes nothing.
+
+`TaskBoardManageController`'s `$syncLimits` argument is deprecated and ignored, kept in its place so positional arguments do not move: a restore asks the limit given to `TaskManager` (`$limits`), which the container wires from the same `sync.limit_checker`. A host that builds either by hand passes the limit to `TaskManager`.
+
 ## To 2.1.1
 
 From **2.1.0**:
diff --git a/docs/USAGE.md b/docs/USAGE.md
index 84153184..2226431b 100644
--- a/docs/USAGE.md
+++ b/docs/USAGE.md
@@ -30,6 +30,7 @@
   - [No inline styles](#no-inline-styles)
 - [Look and feel: ClickUp-like views, theming and icons (since 1.12)](#look-and-feel-clickup-like-views-theming-and-icons-since-112)
   - [Theming with design tokens](#theming-with-design-tokens)
+- [Task API (since 2.2)](#task-api-since-22)
 - [Host hooks (since 2.0.0)](#host-hooks-since-200)
   - [Icons](#icons)
   - [Inline new task](#inline-new-task)
@@ -76,6 +77,10 @@ Authenticated users open the manage UI (default `/tools/task-board`):
 | Log time | `task_time` | Since 1.15: minutes, day and note (POST + CSRF) |
 | Remove time entry | `task_time_remove` | Since 1.15 (POST + CSRF) |
 
+### Deleting and renaming outside the UI (since 2.2)
+
+The UI has no delete task or rename board. A host calling the services can: `TaskBoardEraser::eraseTask($task, $actor)` deletes a task and its subtasks and keeps tracked time, detached (a task that follows a provider is refused); `TaskBoardEditor::update($board, $name, $description, $actor)` keeps the slug and dispatches `BOARD_UPDATED`. Check access first with `TaskBoardResourceAccessChecker`, and validate with `Validation\TaskConstraints`, the rules the forms use.
+
 ## TimeTrack integration (optional)
 
 When TimeTrack is installed and configured with `nowo_task_board.task_provider`:
@@ -232,6 +237,10 @@ Overrides and demos must not reintroduce raw `<form>` / `<input>` / `<select>` /
 {{ form_end(advanceForm) }}
 ```
 
+## Task API (since 2.2)
+
+A REST API shaped like ClickUp's, off by default: see [API](API.md).
+
 ## Host hooks (since 2.0.0)
 
 ```yaml
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
index bf2e7e16..e850a0a6 100644
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -6,8 +6,9 @@
          cacheDirectory=".phpunit.cache"
 >
     <php>
-        <!-- The functional suite boots one kernel per configuration and renders every page -->
-        <ini name="memory_limit" value="512M"/>
+        <!-- The functional suite boots one kernel per configuration and renders every page; the HTML coverage report needs
+             more on top (spec 213 went past 512M while writing it). -->
+        <ini name="memory_limit" value="1G"/>
         <!-- REQ-SF-005: fail on direct Symfony deprecations -->
         <env name="SYMFONY_DEPRECATIONS_HELPER" value="max[direct]=0"/>
         <!-- WebTestCase kernel (tests/Functional): the bundle on SQLite in memory, or TASK_BOARD_TEST_DATABASE_URL -->
diff --git a/src/Api/Command/TaskApiPurgeIdempotencyCommand.php b/src/Api/Command/TaskApiPurgeIdempotencyCommand.php
new file mode 100644
index 00000000..cfae7b1a
--- /dev/null
+++ b/src/Api/Command/TaskApiPurgeIdempotencyCommand.php
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Command;
+
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiIdempotencyStoreInterface;
+use Psr\Clock\ClockInterface;
+use Symfony\Component\Clock\NativeClock;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+/**
+ * Since 2.2.0 (spec 213): deletes the kept answers of expired idempotency keys (they hold task text). Claims also purge,
+ * so this is for an API that receives no writes for a while.
+ */
+#[AsCommand(name: 'nowo:task-board:api:purge-idempotency', description: 'Delete the expired idempotency answers of the Task API')]
+final class TaskApiPurgeIdempotencyCommand extends Command
+{
+    public function __construct(
+        private readonly TaskApiIdempotencyStoreInterface $store,
+        private readonly ClockInterface $clock = new NativeClock(),
+    ) {
+        parent::__construct();
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $output->writeln($this->store->purgeExpired($this->clock->now()) . ' expired answers deleted.');
+
+        return Command::SUCCESS;
+    }
+}
diff --git a/src/Api/Controller/TaskApiIdentityController.php b/src/Api/Controller/TaskApiIdentityController.php
new file mode 100644
index 00000000..ac82ebe8
--- /dev/null
+++ b/src/Api/Controller/TaskApiIdentityController.php
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Controller;
+
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiReadOperations;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiIdentitySerializer;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTeam;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+
+use function array_map;
+
+/**
+ * Since 2.2.0 (spec 213): `GET /v2/user` and `GET /v2/team`. Thin: every check is in the operation.
+ */
+final readonly class TaskApiIdentityController
+{
+    public function __construct(
+        private TaskApiReadOperations $operations,
+        private TaskApiIdentitySerializer $serializer,
+    ) {
+    }
+
+    public function user(Request $request): JsonResponse
+    {
+        return new JsonResponse(['user' => $this->serializer->user($this->operations->me($this->principal($request)))]);
+    }
+
+    public function teams(Request $request): JsonResponse
+    {
+        $teams = $this->operations->teams($this->principal($request));
+
+        return new JsonResponse(['teams' => array_map(fn (TaskApiTeam $team): array => $this->serializer->team($team), $teams)]);
+    }
+
+    private function principal(Request $request): TaskApiPrincipal
+    {
+        return TaskApiRequestListener::principalOf($request);
+    }
+}
diff --git a/src/Api/Controller/TaskApiManagementController.php b/src/Api/Controller/TaskApiManagementController.php
new file mode 100644
index 00000000..cfffe56d
--- /dev/null
+++ b/src/Api/Controller/TaskApiManagementController.php
@@ -0,0 +1,124 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Controller;
+
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiBoardOperations;
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiReadOperations;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiIdempotencyListener;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer;
+use Nowo\TaskBoardBundle\Api\TaskApiInput;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Since 2.2.0 (spec 213): boards and columns (Full management). Each answers the board as `GET /v2/list/{id}` does, with
+ * `warnings` for the fields nothing read.
+ */
+final readonly class TaskApiManagementController
+{
+    public function __construct(
+        private TaskApiBoardOperations $boards,
+        private TaskApiReadOperations $reads,
+        private TaskApiReadSerializer $serializer,
+        private int $maxBodyBytes,
+    ) {
+    }
+
+    public function createBoard(Request $request, string $spaceId): JsonResponse
+    {
+        $input = $this->input($request, TaskApiBoardOperations::NOT_SUPPORTED);
+
+        return $this->board($request, $this->boards->createBoard($this->principal($request), $spaceId, $input), $input);
+    }
+
+    public function updateBoard(Request $request, string $listId): JsonResponse
+    {
+        $input = $this->input($request, TaskApiBoardOperations::NOT_SUPPORTED);
+
+        return $this->board($request, $this->boards->updateBoard($this->principal($request), $listId, $input), $input);
+    }
+
+    /**
+     * 200 `{}` when the board is gone; 202 while tasks remain, with `Retry-After`: call `DELETE` again.
+     */
+    public function deleteBoard(Request $request, string $listId): JsonResponse
+    {
+        $input = $this->input($request);
+        if ($this->boards->deleteBoard($this->principal($request), $listId)) {
+            return $this->answer([], $input);
+        }
+        $response = $this->answer(['status' => 'in_progress'], $input);
+        $response->setStatusCode(Response::HTTP_ACCEPTED);
+        $response->headers->set('Retry-After', '1');
+
+        return $response;
+    }
+
+    public function createColumn(Request $request, string $listId): JsonResponse
+    {
+        $input = $this->input($request, ['orderindex', 'type']);
+
+        return $this->board($request, $this->boards->createColumn($this->principal($request), $listId, $input), $input);
+    }
+
+    public function updateColumn(Request $request, string $listId, string $statusId): JsonResponse
+    {
+        $input = $this->input($request, ['orderindex', 'type']);
+
+        return $this->board($request, $this->boards->updateColumn($this->principal($request), $listId, $statusId, $input), $input);
+    }
+
+    public function deleteColumn(Request $request, string $listId, string $statusId): JsonResponse
+    {
+        $input = $this->input($request);
+
+        return $this->board($request, $this->boards->deleteColumn($this->principal($request), $listId, $statusId), $input);
+    }
+
+    public function reorderColumns(Request $request, string $listId): JsonResponse
+    {
+        $input = $this->input($request);
+
+        return $this->board($request, $this->boards->reorderColumns($this->principal($request), $listId, $input), $input);
+    }
+
+    private function board(Request $request, TaskBoard $board, TaskApiInput $input): JsonResponse
+    {
+        TaskApiIdempotencyListener::target($request, $board);
+        $list = $this->reads->board($this->principal($request), $board->getId());
+
+        return $this->answer($this->serializer->board($list->boards[0], $list->space, $list->taskCounts[$board->getId()] ?? 0), $input);
+    }
+
+    /**
+     * @param array<string, mixed> $data
+     */
+    private function answer(array $data, TaskApiInput $input): JsonResponse
+    {
+        $warnings = $input->warnings();
+        if ($warnings !== []) {
+            $data['warnings'] = $warnings;
+        }
+
+        return new JsonResponse($data === [] ? (object) [] : $data);
+    }
+
+    /**
+     * @param list<string> $notSupported
+     */
+    private function input(Request $request, array $notSupported = []): TaskApiInput
+    {
+        return TaskApiInput::fromRequest($request, $this->maxBodyBytes, $notSupported);
+    }
+
+    private function principal(Request $request): TaskApiPrincipal
+    {
+        return TaskApiRequestListener::principalOf($request);
+    }
+}
diff --git a/src/Api/Controller/TaskApiReadController.php b/src/Api/Controller/TaskApiReadController.php
new file mode 100644
index 00000000..9bbe3b56
--- /dev/null
+++ b/src/Api/Controller/TaskApiReadController.php
@@ -0,0 +1,147 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Controller;
+
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiReadOperations;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskFilter;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncField;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+
+use function array_filter;
+use function array_map;
+use function array_values;
+use function explode;
+use function is_string;
+
+/**
+ * Since 2.2.0 (spec 213): the read endpoints. Thin: parse the request, call one operation, serialize.
+ */
+final readonly class TaskApiReadController
+{
+    public function __construct(
+        private TaskApiReadOperations $operations,
+        private TaskApiReadSerializer $serializer,
+    ) {
+    }
+
+    public function spaces(Request $request, string $teamId): JsonResponse
+    {
+        $spaces = $this->operations->spaces(TaskApiRequestListener::principalOf($request), $teamId);
+
+        return new JsonResponse(['spaces' => array_map(fn (TaskApiSpace $space): array => $this->serializer->space($space), $spaces)]);
+    }
+
+    public function space(Request $request, string $spaceId): JsonResponse
+    {
+        return new JsonResponse($this->serializer->space($this->operations->space(TaskApiRequestListener::principalOf($request), $spaceId)));
+    }
+
+    /** No folders: every board is a folderless list. */
+    public function folders(Request $request, string $spaceId): JsonResponse
+    {
+        $this->operations->space(TaskApiRequestListener::principalOf($request), $spaceId);
+
+        return new JsonResponse(['folders' => []]);
+    }
+
+    public function lists(Request $request, string $spaceId): JsonResponse
+    {
+        $list = $this->operations->boards(TaskApiRequestListener::principalOf($request), $spaceId);
+
+        return new JsonResponse(['lists' => array_map(fn (TaskBoard $board): array => $this->serializer->board($board, $list->space, $list->taskCounts[$board->getId()] ?? 0), $list->boards)]);
+    }
+
+    public function list(Request $request, string $listId): JsonResponse
+    {
+        $list = $this->operations->board(TaskApiRequestListener::principalOf($request), $listId);
+
+        return new JsonResponse($this->serializer->board($list->boards[0], $list->space, $list->taskCounts[$listId] ?? 0));
+    }
+
+    public function listTasks(Request $request, string $listId): JsonResponse
+    {
+        return new JsonResponse($this->serializer->taskPage($this->operations->tasks(TaskApiRequestListener::principalOf($request), $listId, TaskApiTaskFilter::fromQuery($request->query->all()))));
+    }
+
+    public function teamTasks(Request $request, string $teamId): JsonResponse
+    {
+        return new JsonResponse($this->serializer->taskPage($this->operations->teamTasks(TaskApiRequestListener::principalOf($request), $teamId, TaskApiTaskFilter::fromQuery($request->query->all()))));
+    }
+
+    public function task(Request $request, string $taskId): JsonResponse
+    {
+        $query = $request->query->all();
+        $page  = $this->operations->task(TaskApiRequestListener::principalOf($request), $taskId, TaskApiTaskFilter::flag($query, 'include_markdown_description'));
+        $task  = $this->serializer->task($page->tasks[0], $page);
+        if (TaskApiTaskFilter::flag($query, 'include_subtasks')) {
+            $task['subtasks'] = array_map(static fn ($subtask): array => ['id' => $subtask->getId(), 'name' => $subtask->getTitle()], $page->subtasks[$taskId] ?? []);
+        }
+
+        return new JsonResponse($task);
+    }
+
+    public function comments(Request $request, string $taskId): JsonResponse
+    {
+        $query   = $request->query->all();
+        $start   = isset($query['start']) ? TaskApiTaskFilter::milliseconds($query['start'], 'start') : null;
+        $startId = is_string($query['start_id'] ?? null) ? $query['start_id'] : null;
+        $page    = $this->operations->comments(TaskApiRequestListener::principalOf($request), $taskId, $start, $startId);
+
+        return new JsonResponse(['comments' => array_map(fn (TaskComment $comment): array => $this->serializer->comment($comment, $page->authors[$comment->getId()] ?? null), $page->comments)]);
+    }
+
+    public function members(Request $request, string $taskId): JsonResponse
+    {
+        $members = $this->operations->members(TaskApiRequestListener::principalOf($request), $taskId);
+
+        return new JsonResponse(['members' => array_map(fn (TaskApiUser $user): ?array => $this->serializer->user($user), $members)]);
+    }
+
+    public function tags(Request $request, string $spaceId): JsonResponse
+    {
+        $tags = $this->operations->spaceTags(TaskApiRequestListener::principalOf($request), $spaceId);
+
+        return new JsonResponse(['tags' => array_map(static fn (string $tag): array => ['name' => $tag, 'tag_fg' => null, 'tag_bg' => null], $tags)]);
+    }
+
+    public function fields(Request $request, string $listId): JsonResponse
+    {
+        $fields = $this->operations->boardFields(TaskApiRequestListener::principalOf($request), $listId);
+
+        return new JsonResponse(['fields' => array_map(fn (TaskSyncField $field): array => $this->serializer->field($field), $fields)]);
+    }
+
+    /**
+     * `start_date` and `end_date` in Unix milliseconds, `assignee` a comma-separated list of ids, `task_id`.
+     */
+    public function timeEntries(Request $request, string $teamId): JsonResponse
+    {
+        $query    = $request->query->all();
+        $assignee = $query['assignee'] ?? '';
+        if (!is_string($assignee)) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid assignee');
+        }
+        $taskId = $query['task_id'] ?? null;
+        $page   = $this->operations->timeEntries(TaskApiRequestListener::principalOf($request), new TaskApiTimeQuery(
+            teamId: $teamId,
+            from: isset($query['start_date']) ? TaskApiTaskFilter::milliseconds($query['start_date'], 'start_date') : null,
+            to: isset($query['end_date']) ? TaskApiTaskFilter::milliseconds($query['end_date'], 'end_date') : null,
+            assigneeIds: array_values(array_filter(explode(',', $assignee), static fn (string $id): bool => $id !== '')),
+            taskId: is_string($taskId) && $taskId !== '' ? $taskId : null,
+        ));
+
+        return new JsonResponse(['data' => array_map(fn (TaskApiTimeEntry $entry): array => $this->serializer->timeEntry($entry, $teamId), $page->entries)]);
+    }
+}
diff --git a/src/Api/Controller/TaskApiWriteController.php b/src/Api/Controller/TaskApiWriteController.php
new file mode 100644
index 00000000..234429f3
--- /dev/null
+++ b/src/Api/Controller/TaskApiWriteController.php
@@ -0,0 +1,278 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Controller;
+
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiChecklistOperations;
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiReadOperations;
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiTaskOperations;
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiTimeOperations;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiIdempotencyListener;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer;
+use Nowo\TaskBoardBundle\Api\TaskApiInput;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Enum\TaskDependencyType;
+use Psr\Clock\ClockInterface;
+use Symfony\Component\Clock\NativeClock;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+
+use function is_string;
+use function pathinfo;
+
+use const PATHINFO_EXTENSION;
+
+/**
+ * Since 2.2.0 (spec 213): the write endpoints. Thin: parse the body, call one operation, answer as ClickUp does, with
+ * `warnings` for the fields nothing read.
+ */
+final readonly class TaskApiWriteController
+{
+    public function __construct(
+        private TaskApiTaskOperations $tasks,
+        private TaskApiChecklistOperations $checklists,
+        private TaskApiReadOperations $reads,
+        private TaskApiReadSerializer $serializer,
+        private TaskApiTimeOperations $time,
+        private int $maxBodyBytes,
+        private ClockInterface $clock = new NativeClock(),
+    ) {
+    }
+
+    public function createTask(Request $request, string $listId): JsonResponse
+    {
+        $input = $this->input($request, TaskApiTaskOperations::NOT_SUPPORTED);
+        $task  = $this->tasks->createTask($this->principal($request), $listId, $input);
+
+        return $this->taskAnswer($request, $task, $input);
+    }
+
+    public function updateTask(Request $request, string $taskId): JsonResponse
+    {
+        $input = $this->input($request, TaskApiTaskOperations::NOT_SUPPORTED);
+        $task  = $this->tasks->updateTask($this->principal($request), $taskId, $input);
+
+        return $this->taskAnswer($request, $task, $input);
+    }
+
+    public function deleteTask(Request $request, string $taskId): JsonResponse
+    {
+        // A body is read for its warnings only: nothing in it is saved.
+        $input = $this->input($request);
+        TaskApiIdempotencyListener::target($request, $this->tasks->deleteTask($this->principal($request), $taskId));
+
+        return $this->answer([], $input);
+    }
+
+    public function addComment(Request $request, string $taskId): JsonResponse
+    {
+        $input   = $this->input($request, ['notify_all', 'assignee', 'group_assignee']);
+        $comment = $this->tasks->addComment($this->principal($request), $taskId, $input);
+        TaskApiIdempotencyListener::target($request, $comment->getTask()->getBoard());
+
+        return $this->answer(['id' => $comment->getId(), 'hist_id' => $comment->getId(), 'date' => $comment->getCreatedAt()->format('Uv')], $input);
+    }
+
+    public function addAttachment(Request $request, string $taskId): JsonResponse
+    {
+        // The form fields besides the file are read for their warnings only.
+        /** @var array<string, mixed> $fields */
+        $fields              = $request->request->all();
+        $input               = new TaskApiInput($fields, ['filename', 'custom_task_ids', 'team_id']);
+        $file                = $request->files->get('attachment');
+        [$task, $attachment] = $this->tasks->addAttachment($this->principal($request), $taskId, $file instanceof UploadedFile ? $file : null);
+        $extension           = pathinfo($attachment->title, PATHINFO_EXTENSION);
+        TaskApiIdempotencyListener::target($request, $task->getBoard());
+
+        return $this->answer([
+            'id'              => $attachment->id,
+            'version'         => '0',
+            'date'            => (string) $this->clock->now()->format('Uv'),
+            'title'           => $attachment->title,
+            'extension'       => $extension,
+            'thumbnail_small' => null,
+            'thumbnail_large' => null,
+            'url'             => $attachment->url,
+        ], $input);
+    }
+
+    public function logTime(Request $request, string $teamId): JsonResponse
+    {
+        $input          = $this->input($request, TaskApiTimeOperations::NOT_SUPPORTED);
+        [$task, $entry] = $this->time->logTime($this->principal($request), $teamId, $input);
+        TaskApiIdempotencyListener::target($request, $task?->getBoard());
+
+        return $this->answer(['data' => $this->serializer->timeEntry($entry, $teamId)], $input);
+    }
+
+    /** Tracked time is never deleted through the API (owner, Q-O7): refused before anything is read or looked up. */
+    public function deleteTime(): JsonResponse
+    {
+        throw new TaskApiRefusal(403, 'TIME_002', 'Time entries are not deleted through the API');
+    }
+
+    public function addTag(Request $request, string $taskId, string $tagName): JsonResponse
+    {
+        $input = $this->input($request);
+
+        return $this->empty($request, $this->tasks->tag($this->principal($request), $taskId, $tagName, true), $input);
+    }
+
+    public function removeTag(Request $request, string $taskId, string $tagName): JsonResponse
+    {
+        $input = $this->input($request);
+
+        return $this->empty($request, $this->tasks->tag($this->principal($request), $taskId, $tagName, false), $input);
+    }
+
+    public function setField(Request $request, string $taskId): JsonResponse
+    {
+        $this->tasks->setField($this->principal($request), $taskId);
+    }
+
+    public function addDependency(Request $request, string $taskId): JsonResponse
+    {
+        $input          = $this->input($request);
+        [$other, $type] = $this->dependencyOf($input->string('depends_on'), $input->string('dependency_of'));
+
+        return $this->empty($request, $this->tasks->relate($this->principal($request), $taskId, $other, $type), $input);
+    }
+
+    public function removeDependency(Request $request, string $taskId): JsonResponse
+    {
+        $query          = new TaskApiInput($request->query->all());
+        [$other, $type] = $this->dependencyOf($query->string('depends_on'), $query->string('dependency_of'));
+
+        $input = $this->input($request);
+
+        return $this->empty($request, $this->tasks->unrelate($this->principal($request), $taskId, $other, [TaskDependencyType::Blocks, TaskDependencyType::BlockedBy], $type === TaskDependencyType::BlockedBy), $input);
+    }
+
+    public function addLink(Request $request, string $taskId, string $linksTo): JsonResponse
+    {
+        $task = $this->tasks->relate($this->principal($request), $taskId, $linksTo, TaskDependencyType::Related);
+
+        return $this->taskAnswer($request, $task, $this->input($request));
+    }
+
+    public function removeLink(Request $request, string $taskId, string $linksTo): JsonResponse
+    {
+        $task = $this->tasks->unrelate($this->principal($request), $taskId, $linksTo, [TaskDependencyType::Related, TaskDependencyType::Duplicates], null);
+
+        return $this->taskAnswer($request, $task, $this->input($request));
+    }
+
+    public function createChecklist(Request $request, string $taskId): JsonResponse
+    {
+        $input         = $this->input($request);
+        [$task, $name] = $this->checklists->createChecklist($this->principal($request), $taskId, $input);
+
+        return $this->checklistAnswer($request, $task, $name, $input);
+    }
+
+    public function updateChecklist(Request $request, string $checklistId): JsonResponse
+    {
+        $input  = $this->input($request, ['position']);
+        [$task] = $this->checklists->updateChecklist($this->principal($request), $checklistId, $input);
+
+        return $this->empty($request, $task, $input);
+    }
+
+    public function deleteChecklist(Request $request, string $checklistId): JsonResponse
+    {
+        $input = $this->input($request);
+
+        return $this->empty($request, $this->checklists->deleteChecklist($this->principal($request), $checklistId), $input);
+    }
+
+    public function createItem(Request $request, string $checklistId): JsonResponse
+    {
+        $input         = $this->input($request);
+        [$task, $name] = $this->checklists->createItem($this->principal($request), $checklistId, $input);
+
+        return $this->checklistAnswer($request, $task, $name, $input);
+    }
+
+    public function updateItem(Request $request, string $checklistId, string $itemId): JsonResponse
+    {
+        $input         = $this->input($request, ['parent']);
+        [$task, $name] = $this->checklists->updateItem($this->principal($request), $checklistId, $itemId, $input);
+
+        return $this->checklistAnswer($request, $task, $name, $input);
+    }
+
+    public function deleteItem(Request $request, string $checklistId, string $itemId): JsonResponse
+    {
+        $input = $this->input($request);
+
+        return $this->empty($request, $this->checklists->deleteItem($this->principal($request), $checklistId, $itemId), $input);
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     *
+     * @return array{0: string, 1: TaskDependencyType}
+     */
+    private function dependencyOf(?string $dependsOn, ?string $dependencyOf): array
+    {
+        return match (true) {
+            is_string($dependsOn) && $dependencyOf === null => [$dependsOn, TaskDependencyType::BlockedBy],
+            is_string($dependencyOf) && $dependsOn === null => [$dependencyOf, TaskDependencyType::Blocks],
+            default                                         => throw new TaskApiRefusal(400, 'INPUT_002', 'Give one of depends_on and dependency_of'),
+        };
+    }
+
+    private function taskAnswer(Request $request, Task $task, TaskApiInput $input): JsonResponse
+    {
+        TaskApiIdempotencyListener::target($request, $task->getBoard());
+        $page = $this->reads->task($this->principal($request), $task->getId());
+
+        return $this->answer($this->serializer->task($page->tasks[0], $page), $input);
+    }
+
+    private function checklistAnswer(Request $request, Task $task, string $name, TaskApiInput $input): JsonResponse
+    {
+        TaskApiIdempotencyListener::target($request, $task->getBoard());
+        $page = $this->reads->task($this->principal($request), $task->getId());
+
+        return $this->answer(['checklist' => $this->serializer->checklist($page->tasks[0], $page, $name)], $input);
+    }
+
+    private function empty(Request $request, Task $task, ?TaskApiInput $input = null): JsonResponse
+    {
+        TaskApiIdempotencyListener::target($request, $task->getBoard());
+
+        return $this->answer([], $input);
+    }
+
+    /**
+     * @param array<string, mixed> $data
+     */
+    private function answer(array $data, ?TaskApiInput $input): JsonResponse
+    {
+        $warnings = $input?->warnings() ?? [];
+        if ($warnings !== []) {
+            $data['warnings'] = $warnings;
+        }
+
+        return new JsonResponse($data === [] ? (object) [] : $data);
+    }
+
+    /**
+     * @param list<string> $notSupported
+     */
+    private function input(Request $request, array $notSupported = []): TaskApiInput
+    {
+        return TaskApiInput::fromRequest($request, $this->maxBodyBytes, $notSupported);
+    }
+
+    private function principal(Request $request): TaskApiPrincipal
+    {
+        return TaskApiRequestListener::principalOf($request);
+    }
+}
diff --git a/src/Api/Doctrine/JsonTextFunction.php b/src/Api/Doctrine/JsonTextFunction.php
new file mode 100644
index 00000000..9e81f7c5
--- /dev/null
+++ b/src/Api/Doctrine/JsonTextFunction.php
@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Doctrine;
+
+use Doctrine\DBAL\Platforms\AbstractMySQLPlatform;
+use Doctrine\DBAL\Platforms\PostgreSQLPlatform;
+use Doctrine\ORM\Query\AST\Functions\FunctionNode;
+use Doctrine\ORM\Query\AST\Node;
+use Doctrine\ORM\Query\Parser;
+use Doctrine\ORM\Query\SqlWalker;
+use Doctrine\ORM\Query\TokenType;
+
+/**
+ * Since 2.2.0 (spec 213, audit IA-L3): `NOWO_TB_JSON_TEXT(t.tags)`, a JSON column as text, so the tag filter runs in SQL with
+ * `LIKE` on every database: PostgreSQL's `json` has no `LIKE`, MySQL's `JSON` compares as text once cast. Registered only
+ * with `api.enabled`.
+ */
+final class JsonTextFunction extends FunctionNode
+{
+    public const NAME = 'NOWO_TB_JSON_TEXT';
+
+    private Node|string $field = '';
+
+    public function parse(Parser $parser): void
+    {
+        $parser->match(TokenType::T_IDENTIFIER);
+        $parser->match(TokenType::T_OPEN_PARENTHESIS);
+        $this->field = $parser->ArithmeticPrimary();
+        $parser->match(TokenType::T_CLOSE_PARENTHESIS);
+    }
+
+    public function getSql(SqlWalker $sqlWalker): string
+    {
+        $field    = $sqlWalker->walkArithmeticPrimary($this->field);
+        $platform = $sqlWalker->getConnection()->getDatabasePlatform();
+
+        return match (true) {
+            $platform instanceof PostgreSQLPlatform    => 'CAST(' . $field . ' AS TEXT)',
+            $platform instanceof AbstractMySQLPlatform => 'CAST(' . $field . ' AS CHAR)',
+            default                                    => $field,
+        };
+    }
+}
diff --git a/src/Api/Entity/TaskApiIdempotencyRecord.php b/src/Api/Entity/TaskApiIdempotencyRecord.php
new file mode 100644
index 00000000..e24ab91f
--- /dev/null
+++ b/src/Api/Entity/TaskApiIdempotencyRecord.php
@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Entity;
+
+use DateTimeImmutable;
+use Doctrine\ORM\Mapping as ORM;
+use Nowo\TaskBoardBundle\Api\Idempotency\DoctrineTaskApiIdempotencyStore;
+
+/**
+ * Since 2.2.0 (spec 213): the first answer of a write sent with an `Idempotency-Key`, kept 24 hours. Mapped only with
+ * `api.enabled` and the bundle's own store. It holds hashes, never the token or the key; the answer may hold task text, so a
+ * host forgets a token's rows when it revokes the token or erases its person.
+ *
+ * @internal the table of {@see DoctrineTaskApiIdempotencyStore}, which writes it with DBAL
+ */
+#[ORM\Entity]
+#[ORM\Table(name: 'task_board_api_idempotency')]
+#[ORM\Index(name: 'task_board_api_idempotency_expires_idx', columns: ['expires_at'])]
+class TaskApiIdempotencyRecord
+{
+    public function __construct(
+        #[ORM\Id]
+        #[ORM\Column(type: 'string', length: 64)]
+        public string $scope,
+        #[ORM\Id]
+        #[ORM\Column(name: 'key_hash', type: 'string', length: 64)]
+        public string $keyHash,
+        #[ORM\Column(type: 'string', length: 64)]
+        public string $fingerprint,
+        #[ORM\Column(name: 'created_at', type: 'datetime_immutable')]
+        public DateTimeImmutable $createdAt,
+        #[ORM\Column(name: 'expires_at', type: 'datetime_immutable')]
+        public DateTimeImmutable $expiresAt,
+        #[ORM\Column(type: 'smallint', nullable: true)]
+        public ?int $status = null,
+        #[ORM\Column(type: 'text', nullable: true)]
+        public ?string $body = null,
+        #[ORM\Column(name: 'tenant_key', type: 'string', length: 191, nullable: true)]
+        public ?string $tenantKey = null,
+        #[ORM\Column(name: 'board_id', type: 'string', length: 36, nullable: true)]
+        public ?string $boardId = null,
+    ) {
+    }
+}
diff --git a/src/Api/Hook/DenyingTaskApiAttachments.php b/src/Api/Hook/DenyingTaskApiAttachments.php
new file mode 100644
index 00000000..358601ce
--- /dev/null
+++ b/src/Api/Hook/DenyingTaskApiAttachments.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiAttachment;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+
+/**
+ * Since 2.2.0 (spec 213): the default: no uploads, until the host sets `api.hooks.attachments`.
+ */
+final readonly class DenyingTaskApiAttachments implements TaskApiAttachmentsInterface
+{
+    public function store(TaskApiPrincipal $principal, Task $task, UploadedFile $file): TaskApiAttachment
+    {
+        throw new TaskApiRefusal(403, 'FILE_001', 'Attachments are not available');
+    }
+}
diff --git a/src/Api/Hook/DenyingTaskApiPlanGate.php b/src/Api/Hook/DenyingTaskApiPlanGate.php
new file mode 100644
index 00000000..47980b9e
--- /dev/null
+++ b/src/Api/Hook/DenyingTaskApiPlanGate.php
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+/**
+ * Since 2.2.0 (spec 213): the default gate: no plan holds the module until the host sets `api.hooks.plan_gate`.
+ */
+final readonly class DenyingTaskApiPlanGate implements TaskApiPlanGateInterface
+{
+    public function allowsTasks(object $user, ?string $tenantKey): bool
+    {
+        return false;
+    }
+}
diff --git a/src/Api/Hook/DenyingTaskApiRateLimiter.php b/src/Api/Hook/DenyingTaskApiRateLimiter.php
new file mode 100644
index 00000000..20e4ac7d
--- /dev/null
+++ b/src/Api/Hook/DenyingTaskApiRateLimiter.php
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiRateLimitState;
+
+/**
+ * Since 2.2.0 (spec 213): the default limiter: nothing passes until the host sets `api.hooks.rate_limiter`.
+ */
+final readonly class DenyingTaskApiRateLimiter implements TaskApiRateLimiterInterface
+{
+    public function consume(TaskApiPrincipal $principal): TaskApiRateLimitState
+    {
+        return new TaskApiRateLimitState(false, 0, 0, 0);
+    }
+
+    public function failedTokenState(string $clientIp): TaskApiRateLimitState
+    {
+        return new TaskApiRateLimitState(false, 0, 0, 0);
+    }
+
+    public function registerFailedToken(string $clientIp): void
+    {
+    }
+}
diff --git a/src/Api/Hook/DenyingTaskApiTimeEntries.php b/src/Api/Hook/DenyingTaskApiTimeEntries.php
new file mode 100644
index 00000000..03bcca46
--- /dev/null
+++ b/src/Api/Hook/DenyingTaskApiTimeEntries.php
@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiNewTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimePage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Entity\Task;
+
+/**
+ * Since 2.2.0 (spec 213): the default time store: none, until the host sets `api.hooks.time_entries`.
+ */
+final readonly class DenyingTaskApiTimeEntries implements TaskApiTimeEntriesInterface
+{
+    public function list(TaskApiPrincipal $principal, TaskApiTimeQuery $query): TaskApiTimePage
+    {
+        throw $this->refusal();
+    }
+
+    public function log(TaskApiPrincipal $principal, ?Task $task, TaskApiNewTimeEntry $entry): TaskApiTimeEntry
+    {
+        throw $this->refusal();
+    }
+
+    private function refusal(): TaskApiRefusal
+    {
+        return new TaskApiRefusal(403, 'TIME_001', 'Time entries are not available');
+    }
+}
diff --git a/src/Api/Hook/EmptyTaskApiUsers.php b/src/Api/Hook/EmptyTaskApiUsers.php
new file mode 100644
index 00000000..eb3e1f16
--- /dev/null
+++ b/src/Api/Hook/EmptyTaskApiUsers.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+
+/**
+ * Since 2.2.0 (spec 213): the default: nobody is known, until the host sets `api.hooks.users`.
+ */
+final readonly class EmptyTaskApiUsers implements TaskApiUsersInterface
+{
+    public function apiId(object $user): string
+    {
+        throw TaskApiRefusal::notFound();
+    }
+
+    public function find(string $apiId): ?object
+    {
+        return null;
+    }
+
+    public function profiles(array $users, TaskApiPrincipal $viewer): array
+    {
+        return [];
+    }
+}
diff --git a/src/Api/Hook/EmptyTaskApiWorkspace.php b/src/Api/Hook/EmptyTaskApiWorkspace.php
new file mode 100644
index 00000000..ee98bfb0
--- /dev/null
+++ b/src/Api/Hook/EmptyTaskApiWorkspace.php
@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+
+/**
+ * Since 2.2.0 (spec 213): the default workspace: nothing to reach, until the host sets `api.hooks.workspace`.
+ */
+final readonly class EmptyTaskApiWorkspace implements TaskApiWorkspaceInterface
+{
+    public function teams(TaskApiPrincipal $principal): array
+    {
+        return [];
+    }
+
+    public function spaces(TaskApiPrincipal $principal, string $teamId): array
+    {
+        return [];
+    }
+
+    public function space(TaskApiPrincipal $principal, string $spaceId): ?TaskApiSpace
+    {
+        return null;
+    }
+
+    public function spaceOfTenant(TaskApiPrincipal $principal, ?string $tenantKey): ?TaskApiSpace
+    {
+        return null;
+    }
+}
diff --git a/src/Api/Hook/ManualTaskApiTimeEntries.php b/src/Api/Hook/ManualTaskApiTimeEntries.php
new file mode 100644
index 00000000..c91f5baa
--- /dev/null
+++ b/src/Api/Hook/ManualTaskApiTimeEntries.php
@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Doctrine\ORM\EntityManagerInterface;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiNewTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimePage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Service\TaskTimeLogger;
+
+/**
+ * Since 2.2.0 (spec 213): a time store over the bundle's own manual entries, through {@see TaskTimeLogger} as the task page
+ * logs them. For a host without its own time store: `api.hooks.time_entries: Nowo\TaskBoardBundle\Api\Hook\ManualTaskApiTimeEntries`.
+ * It lists the token's own person's entries on tasks the token may open, and logs on a task only.
+ */
+final readonly class ManualTaskApiTimeEntries implements TaskApiTimeEntriesInterface
+{
+    /** The most entries one list answers. */
+    public const LIMIT = 500;
+
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private TaskTimeLogger $logger,
+        private TaskApiGuard $guard,
+        private TaskApiUsersInterface $users,
+    ) {
+    }
+
+    public function list(TaskApiPrincipal $principal, TaskApiTimeQuery $query): TaskApiTimePage
+    {
+        $qb = $this->entityManager->createQueryBuilder()
+            ->select('e', 't')
+            ->from(TaskTimeEntry::class, 'e')
+            ->join('e.task', 't')
+            ->where('e.user = :user')
+            ->setParameter('user', $principal->user)
+            ->orderBy('e.loggedAt', 'DESC')
+            ->setMaxResults(self::LIMIT);
+        if ($query->taskId !== null) {
+            $qb->andWhere('t.id = :task')->setParameter('task', $query->taskId);
+        }
+        if ($query->from !== null) {
+            $qb->andWhere('e.loggedAt >= :from')->setParameter('from', $query->from);
+        }
+        if ($query->to !== null) {
+            $qb->andWhere('e.loggedAt <= :to')->setParameter('to', $query->to);
+        }
+        $apiId   = $this->users->apiId($principal->user);
+        $entries = [];
+        /** @var list<TaskTimeEntry> $rows */
+        $rows = $qb->getQuery()->getResult();
+        foreach ($rows as $entry) {
+            $task = $entry->getTask();
+            if ($task instanceof Task && $this->guard->canSeeTask($principal, $task)) {
+                $entries[] = $this->entry($entry, $apiId);
+            }
+        }
+
+        return new TaskApiTimePage($entries);
+    }
+
+    public function log(TaskApiPrincipal $principal, ?Task $task, TaskApiNewTimeEntry $entry): TaskApiTimeEntry
+    {
+        if (!$task instanceof Task) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid tid: manual time is logged on a task');
+        }
+
+        return $this->entry($this->logger->log($task, $principal->user, max(1, intdiv($entry->durationSeconds, 60)), $entry->start, $entry->description), $this->users->apiId($principal->user));
+    }
+
+    private function entry(TaskTimeEntry $entry, string $apiId): TaskApiTimeEntry
+    {
+        return new TaskApiTimeEntry($entry->getId(), $apiId, $entry->getLoggedAt(), $entry->getMinutes() * 60, $entry->getTask()?->getId(), $entry->getDescription());
+    }
+}
diff --git a/src/Api/Hook/TaskApiAttachmentsInterface.php b/src/Api/Hook/TaskApiAttachmentsInterface.php
new file mode 100644
index 00000000..74417987
--- /dev/null
+++ b/src/Api/Hook/TaskApiAttachmentsInterface.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiAttachment;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+
+/**
+ * Since 2.2.0 (spec 213): stores a file for a task. All upload checks live here: content sniffing, plan storage, sizes
+ * (FR-014). Default: {@see DenyingTaskApiAttachments}, 403 `FILE_001`.
+ */
+interface TaskApiAttachmentsInterface
+{
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function store(TaskApiPrincipal $principal, Task $task, UploadedFile $file): TaskApiAttachment;
+}
diff --git a/src/Api/Hook/TaskApiAuthenticatorInterface.php b/src/Api/Hook/TaskApiAuthenticatorInterface.php
new file mode 100644
index 00000000..4e035936
--- /dev/null
+++ b/src/Api/Hook/TaskApiAuthenticatorInterface.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiAuthFailure;
+use Nowo\TaskBoardBundle\Api\TaskApiCredential;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Symfony\Component\HttpFoundation\Request;
+
+/**
+ * Since 2.2.0 (spec 213): who a request is. The bundle stores no tokens. Called once per request, so a revoked or expired
+ * token, a disabled or erased account or a removed membership stops working at once. Required with `api.enabled`.
+ *
+ * {@see TaskApiCredential::fromRequest()} reads the credential. The API must sit behind a stateless
+ * firewall whose security user is the principal's user, as access checkers read the security token: otherwise it answers 500.
+ */
+interface TaskApiAuthenticatorInterface
+{
+    public function authenticate(Request $request): TaskApiPrincipal|TaskApiAuthFailure;
+}
diff --git a/src/Api/Hook/TaskApiIdempotencyStoreInterface.php b/src/Api/Hook/TaskApiIdempotencyStoreInterface.php
new file mode 100644
index 00000000..5309440b
--- /dev/null
+++ b/src/Api/Hook/TaskApiIdempotencyStoreInterface.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiIdempotencyClaim;
+
+/**
+ * Since 2.2.0 (spec 213): where the first answer of a write with an `Idempotency-Key` is kept (FR-015). The first caller of
+ * a key wins, atomically. `$scope` is a hash of the token id and `$keyHash` of the key: no secret ever reaches a store.
+ */
+interface TaskApiIdempotencyStoreInterface
+{
+    public function claim(string $scope, string $keyHash, string $fingerprint, DateTimeImmutable $expiresAt): TaskApiIdempotencyClaim;
+
+    public function complete(string $scope, string $keyHash, int $status, string $body, ?string $tenantKey, ?string $boardId): void;
+
+    public function release(string $scope, string $keyHash): void;
+
+    /** A token revoked or an account erased: its stored answers hold task text. */
+    public function forget(string $scope): void;
+
+    public function purgeExpired(DateTimeImmutable $now): int;
+}
diff --git a/src/Api/Hook/TaskApiPlanGateInterface.php b/src/Api/Hook/TaskApiPlanGateInterface.php
new file mode 100644
index 00000000..a3d8f3bf
--- /dev/null
+++ b/src/Api/Hook/TaskApiPlanGateInterface.php
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+/**
+ * Since 2.2.0 (spec 213): whether a plan holds the tasks module (FR-009). Default: {@see DenyingTaskApiPlanGate}, 403 `PLAN_001`.
+ */
+interface TaskApiPlanGateInterface
+{
+    /**
+     * The module on the account owning `$tenantKey`; null: on any account of the user (`GET /v2/user`, `/v2/team`).
+     */
+    public function allowsTasks(object $user, ?string $tenantKey): bool;
+}
diff --git a/src/Api/Hook/TaskApiRateLimiterInterface.php b/src/Api/Hook/TaskApiRateLimiterInterface.php
new file mode 100644
index 00000000..32aa46c0
--- /dev/null
+++ b/src/Api/Hook/TaskApiRateLimiterInterface.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiRateLimitState;
+
+/**
+ * Since 2.2.0 (spec 213): the limits on the API: per token, and failed tokens per IP (FR-006).
+ * Default: {@see DenyingTaskApiRateLimiter}, every request 429.
+ */
+interface TaskApiRateLimiterInterface
+{
+    /** Counts one request of the token. */
+    public function consume(TaskApiPrincipal $principal): TaskApiRateLimitState;
+
+    /** Whether the IP may try a token; it counts nothing. */
+    public function failedTokenState(string $clientIp): TaskApiRateLimitState;
+
+    public function registerFailedToken(string $clientIp): void;
+}
diff --git a/src/Api/Hook/TaskApiTimeEntriesInterface.php b/src/Api/Hook/TaskApiTimeEntriesInterface.php
new file mode 100644
index 00000000..83dbec75
--- /dev/null
+++ b/src/Api/Hook/TaskApiTimeEntriesInterface.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiNewTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimePage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Entity\Task;
+
+/**
+ * Since 2.2.0 (spec 213): the time store. There is no delete: `DELETE .../time_entries/{id}` always answers 403 and tracked
+ * time is never removed through the API (owner rule). Default: {@see DenyingTaskApiTimeEntries}, 403 `TIME_001`.
+ */
+interface TaskApiTimeEntriesInterface
+{
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function list(TaskApiPrincipal $principal, TaskApiTimeQuery $query): TaskApiTimePage;
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function log(TaskApiPrincipal $principal, ?Task $task, TaskApiNewTimeEntry $entry): TaskApiTimeEntry;
+}
diff --git a/src/Api/Hook/TaskApiUsersInterface.php b/src/Api/Hook/TaskApiUsersInterface.php
new file mode 100644
index 00000000..000ac23c
--- /dev/null
+++ b/src/Api/Hook/TaskApiUsersInterface.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+
+/**
+ * Since 2.2.0 (spec 213): how people read in the API. Ids are strings the host chooses. Default: {@see EmptyTaskApiUsers}.
+ */
+interface TaskApiUsersInterface
+{
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function apiId(object $user): string;
+
+    public function find(string $apiId): ?object;
+
+    /**
+     * What `$viewer` may see of each person, in one call per page (FR-010). A person left out is not shown.
+     *
+     * @param list<object> $users
+     *
+     * @return array<string, TaskApiUser> by API id
+     */
+    public function profiles(array $users, TaskApiPrincipal $viewer): array;
+}
diff --git a/src/Api/Hook/TaskApiWorkspaceInterface.php b/src/Api/Hook/TaskApiWorkspaceInterface.php
new file mode 100644
index 00000000..df483ce6
--- /dev/null
+++ b/src/Api/Hook/TaskApiWorkspaceInterface.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTeam;
+
+/**
+ * Since 2.2.0 (spec 213): how the host's accounts and tenants read as ClickUp's teams and spaces, for one person. A tenant
+ * the host does not answer for is out of reach. Default: {@see EmptyTaskApiWorkspace}, so every board answers 404.
+ */
+interface TaskApiWorkspaceInterface
+{
+    /**
+     * @return list<TaskApiTeam>
+     */
+    public function teams(TaskApiPrincipal $principal): array;
+
+    /**
+     * @return list<TaskApiSpace>
+     */
+    public function spaces(TaskApiPrincipal $principal, string $teamId): array;
+
+    public function space(TaskApiPrincipal $principal, string $spaceId): ?TaskApiSpace;
+
+    public function spaceOfTenant(TaskApiPrincipal $principal, ?string $tenantKey): ?TaskApiSpace;
+}
diff --git a/src/Api/Idempotency/DoctrineTaskApiIdempotencyStore.php b/src/Api/Idempotency/DoctrineTaskApiIdempotencyStore.php
new file mode 100644
index 00000000..66736f0e
--- /dev/null
+++ b/src/Api/Idempotency/DoctrineTaskApiIdempotencyStore.php
@@ -0,0 +1,102 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Idempotency;
+
+use DateTimeImmutable;
+use Doctrine\DBAL\Exception\UniqueConstraintViolationException;
+use Doctrine\DBAL\Types\Types;
+use Doctrine\ORM\EntityManagerInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiIdempotencyStoreInterface;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiIdempotencyClaim;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiIdempotencyOutcome;
+use Psr\Clock\ClockInterface;
+use Symfony\Component\Clock\NativeClock;
+
+use function is_numeric;
+use function is_string;
+
+/**
+ * Since 2.2.0 (spec 213): the bundle's idempotency store, one row per token and key in `task_board_api_idempotency`. The
+ * primary key makes the first claim win. A claim left unfinished for {@see self::ABANDONED_SECONDS} (a process that died)
+ * is taken over. Expired rows go on each claim, and with `nowo:task-board:api:purge-idempotency`.
+ */
+final readonly class DoctrineTaskApiIdempotencyStore implements TaskApiIdempotencyStoreInterface
+{
+    public const TABLE = 'task_board_api_idempotency';
+
+    public const ABANDONED_SECONDS = 300;
+
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private ClockInterface $clock = new NativeClock(),
+    ) {
+    }
+
+    public function claim(string $scope, string $keyHash, string $fingerprint, DateTimeImmutable $expiresAt): TaskApiIdempotencyClaim
+    {
+        $now = $this->clock->now();
+        $this->purgeExpired($now);
+        $connection = $this->entityManager->getConnection();
+        try {
+            $connection->insert(self::TABLE, [
+                'scope'       => $scope,
+                'key_hash'    => $keyHash,
+                'fingerprint' => $fingerprint,
+                'created_at'  => $now,
+                'expires_at'  => $expiresAt,
+            ], ['created_at' => Types::DATETIME_IMMUTABLE, 'expires_at' => Types::DATETIME_IMMUTABLE]);
+
+            return new TaskApiIdempotencyClaim(TaskApiIdempotencyOutcome::Claimed);
+        } catch (UniqueConstraintViolationException) {
+        }
+
+        /** @var array{fingerprint: string, status: mixed, body: mixed, tenant_key: mixed, board_id: mixed, created_at: string}|false $row */
+        $row = $connection->fetchAssociative('SELECT fingerprint, status, body, tenant_key, board_id, created_at FROM ' . self::TABLE . ' WHERE scope = ? AND key_hash = ?', [$scope, $keyHash]);
+        if ($row !== false && $row['fingerprint'] !== $fingerprint) {
+            return new TaskApiIdempotencyClaim(TaskApiIdempotencyOutcome::Mismatch);
+        }
+        if ($row === false || !is_numeric($row['status'])) {
+            // No row: purged by another request in between, so the client's next try decides. A recent claim still runs.
+            if ($row === false || $now->getTimestamp() - (new DateTimeImmutable($row['created_at']))->getTimestamp() < self::ABANDONED_SECONDS) {
+                return new TaskApiIdempotencyClaim(TaskApiIdempotencyOutcome::InFlight);
+            }
+            $taken = $connection->executeStatement(
+                'UPDATE ' . self::TABLE . ' SET created_at = ? WHERE scope = ? AND key_hash = ? AND status IS NULL AND created_at = ?',
+                [$now, $scope, $keyHash, $row['created_at']],
+                [Types::DATETIME_IMMUTABLE, Types::STRING, Types::STRING, Types::STRING],
+            );
+
+            return new TaskApiIdempotencyClaim($taken === 1 ? TaskApiIdempotencyOutcome::Claimed : TaskApiIdempotencyOutcome::InFlight);
+        }
+
+        return new TaskApiIdempotencyClaim(
+            TaskApiIdempotencyOutcome::Completed,
+            (int) $row['status'],
+            is_string($row['body']) ? $row['body'] : '',
+            is_string($row['tenant_key']) ? $row['tenant_key'] : null,
+            is_string($row['board_id']) ? $row['board_id'] : null,
+        );
+    }
+
+    public function complete(string $scope, string $keyHash, int $status, string $body, ?string $tenantKey, ?string $boardId): void
+    {
+        $this->entityManager->getConnection()->update(self::TABLE, ['status' => $status, 'body' => $body, 'tenant_key' => $tenantKey, 'board_id' => $boardId], ['scope' => $scope, 'key_hash' => $keyHash]);
+    }
+
+    public function release(string $scope, string $keyHash): void
+    {
+        $this->entityManager->getConnection()->executeStatement('DELETE FROM ' . self::TABLE . ' WHERE scope = ? AND key_hash = ? AND status IS NULL', [$scope, $keyHash]);
+    }
+
+    public function forget(string $scope): void
+    {
+        $this->entityManager->getConnection()->delete(self::TABLE, ['scope' => $scope]);
+    }
+
+    public function purgeExpired(DateTimeImmutable $now): int
+    {
+        return (int) $this->entityManager->getConnection()->executeStatement('DELETE FROM ' . self::TABLE . ' WHERE expires_at < ?', [$now], [Types::DATETIME_IMMUTABLE]);
+    }
+}
diff --git a/src/Api/Operation/TaskApiAudit.php b/src/Api/Operation/TaskApiAudit.php
new file mode 100644
index 00000000..84921d63
--- /dev/null
+++ b/src/Api/Operation/TaskApiAudit.php
@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Operation;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Event\TaskApiWriteEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Event\TaskBoardQuotaCheckEvent;
+use Nowo\TaskBoardBundle\Service\TaskBoardQuota;
+use Psr\Log\LoggerInterface;
+use Psr\Log\NullLogger;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+use Throwable;
+
+/**
+ * Since 2.2.0 (spec 213): what every write through the API owes before and after it. Before: someone must be listening to
+ * `API_WRITE` (503 `AUDIT_001`), and a create must find the host's plan limits (403 `PLAN_002`). After: one `API_WRITE` and
+ * the UI's log line. Nothing here writes.
+ */
+final readonly class TaskApiAudit
+{
+    public function __construct(
+        private EventDispatcherInterface $dispatcher,
+        private TaskBoardQuota $quota,
+        private bool $quotaListenerRequired = true,
+        private LoggerInterface $logger = new NullLogger(),
+    ) {
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function requireListener(): void
+    {
+        if (!$this->dispatcher->hasListeners(TaskBoardEvents::API_WRITE)) {
+            $this->logger->error('TaskBoard API: no listener audits API_WRITE; writes are refused.', ['bundle' => 'nowo_task_board']);
+
+            throw new TaskApiRefusal(503, 'AUDIT_001', 'Writes are not available');
+        }
+    }
+
+    /**
+     * The host's plan limit on `$count` new tasks of the board, as the UI asks it.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function requireTaskQuota(TaskBoard $board, int $count, object $actor): void
+    {
+        $this->requireQuota(TaskBoardQuotaCheckEvent::ACTION_TASK_CREATE, $board->getTenantKey(), $board, $actor, $count);
+    }
+
+    /**
+     * The host's plan limit on one more board of the tenant, as the UI's New board asks it.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function requireQuota(string $action, ?string $tenantKey, ?TaskBoard $board, object $actor, int $count = 1): void
+    {
+        if ($this->quotaListenerRequired && !$this->dispatcher->hasListeners(TaskBoardEvents::QUOTA_CHECK)) {
+            throw new TaskApiRefusal(403, 'PLAN_002', 'No plan limit answers for this board');
+        }
+        $refusal = $this->quota->refusal($action, $tenantKey, $board, $count, $actor);
+        if ($refusal !== null) {
+            throw new TaskApiRefusal(403, 'PLAN_002', $refusal);
+        }
+    }
+
+    /**
+     * @param array<string, string> $targetIds
+     * @param list<string> $changedFields
+     */
+    public function written(TaskApiPrincipal $principal, string $operation, ?TaskBoard $board, ?string $taskId, array $targetIds = [], array $changedFields = []): void
+    {
+        $this->logger->info('TaskBoard write: {action}', ['bundle' => 'nowo_task_board', 'action' => 'api_' . $operation, 'board_id' => $board?->getId(), 'task_id' => $taskId]);
+        try {
+            $this->dispatcher->dispatch(new TaskApiWriteEvent($principal, $operation, $board?->getTenantKey(), $board?->getId(), $taskId, $targetIds, $changedFields), TaskBoardEvents::API_WRITE);
+        } catch (Throwable $failure) {
+            // The write is saved: the client gets its answer, and the host's failure is logged by class only.
+            $this->logger->error('TaskBoard API: the API_WRITE listener failed.', ['bundle' => 'nowo_task_board', 'exception_class' => $failure::class]);
+        }
+    }
+}
diff --git a/src/Api/Operation/TaskApiBoardOperations.php b/src/Api/Operation/TaskApiBoardOperations.php
new file mode 100644
index 00000000..1f77db90
--- /dev/null
+++ b/src/Api/Operation/TaskApiBoardOperations.php
@@ -0,0 +1,254 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Operation;
+
+use Nowo\TaskBoardBundle\Api\Repository\TaskApiQueryRepository;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiInput;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Dto\BoardColumnFormData;
+use Nowo\TaskBoardBundle\Dto\TaskBoardFormData;
+use Nowo\TaskBoardBundle\Entity\BoardColumn;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Event\TaskBoardQuotaCheckEvent;
+use Nowo\TaskBoardBundle\Exception\TaskReopenRefusedException;
+use Nowo\TaskBoardBundle\Security\TaskBoardAccessCheckerInterface;
+use Nowo\TaskBoardBundle\Security\TenantAwareTaskBoardAccessCheckerInterface;
+use Nowo\TaskBoardBundle\Service\BoardColumnManager;
+use Nowo\TaskBoardBundle\Service\TaskBoardCreator;
+use Nowo\TaskBoardBundle\Service\TaskBoardEditor;
+use Nowo\TaskBoardBundle\Service\TaskBoardEraser;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\Validator\ValidatorInterface;
+
+use function array_map;
+use function array_unique;
+use function count;
+use function sort;
+use function trim;
+
+/**
+ * Since 2.2.0 (spec 213, Full management): boards and their columns, through the services the UI uses. Columns are not in
+ * ClickUp's API: they are statuses here, with four documented paths of their own (owner, Q-O2). Every operation needs the
+ * board's manage decision (`canManageBoard`), or the create check for a new board, and a `Full` token.
+ */
+final readonly class TaskApiBoardOperations
+{
+    /** ClickUp's list fields with no equivalent on a board. */
+    public const NOT_SUPPORTED = ['due_date', 'due_date_time', 'priority', 'assignee', 'status', 'unset_status'];
+
+    public function __construct(
+        private TaskApiGuard $guard,
+        private TaskApiAudit $audit,
+        private TaskBoardAccessCheckerInterface $accessChecker,
+        private TaskBoardCreator $creator,
+        private TaskBoardEditor $editor,
+        private TaskBoardEraser $eraser,
+        private BoardColumnManager $columns,
+        private TaskApiQueryRepository $queries,
+        private ValidatorInterface $validator,
+        /** The tasks one `DELETE` erases per batch; the eraser stops at its time budget either way. */
+        private int $eraseBatchSize = 200,
+    ) {
+    }
+
+    /**
+     * `POST /v2/space/{space_id}/list`: a board in the space's tenant, which the token must reach as a whole.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function createBoard(TaskApiPrincipal $principal, string $spaceId, TaskApiInput $input): TaskBoard
+    {
+        $this->audit->requireListener();
+        $space = $this->guard->space($principal, $spaceId, TaskApiCapability::ManageBoards);
+        if (!$principal->where->reachesTenant($space->tenantKey)) {
+            throw TaskApiRefusal::notFound();
+        }
+        $allowed = $this->accessChecker instanceof TenantAwareTaskBoardAccessCheckerInterface
+            ? $this->accessChecker->canCreateBoard($principal->user, $space->tenantKey)
+            : $this->accessChecker->canCreateBoard($principal->user);
+        if (!$allowed) {
+            throw TaskApiRefusal::permissionRefused();
+        }
+        $data = new TaskBoardFormData(name: $this->text($input->string('name', true), TaskConstraints::boardName(), 'name'), description: $this->description($input));
+        $this->audit->requireQuota(TaskBoardQuotaCheckEvent::ACTION_BOARD_CREATE, $space->tenantKey, null, $principal->user);
+
+        $board = $this->creator->create($data, $principal->user, $space->tenantKey);
+        $this->audit->written($principal, 'board.create', $board, null);
+
+        return $board;
+    }
+
+    /**
+     * `PUT /v2/list/{id}`: name and description; the slug stays.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function updateBoard(TaskApiPrincipal $principal, string $boardId, TaskApiInput $input): TaskBoard
+    {
+        $this->audit->requireListener();
+        $board       = $this->guard->board($principal, $boardId, TaskApiCapability::ManageBoards);
+        $name        = $input->has('name') ? $this->text($input->string('name', true), TaskConstraints::boardName(), 'name') : $board->getName();
+        $description = $input->hasAny('content', 'markdown_content') ? $this->description($input) : $board->getDescription();
+        $this->editor->update($board, $name, $description, $principal->user);
+        $this->audit->written($principal, 'board.update', $board, null);
+
+        return $board;
+    }
+
+    /**
+     * `DELETE /v2/list/{id}`: every task erased, tracked time kept, then the board. One call works within the eraser's time
+     * budget; false when the client must call again (202). A board linked to a provider is refused: unlink it first.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function deleteBoard(TaskApiPrincipal $principal, string $boardId): bool
+    {
+        $this->audit->requireListener();
+        $board = $this->guard->board($principal, $boardId, TaskApiCapability::ManageBoards);
+        if ($this->queries->hasConnection($board->getId())) {
+            throw new TaskApiRefusal(409, 'LIST_002', 'The board follows a provider: unlink it first');
+        }
+        $done = $this->eraser->deleteBoard($board, $principal->user, $this->eraseBatchSize)->done;
+        $this->audit->written($principal, $done ? 'board.delete' : 'board.delete_progress', $board, null);
+
+        return $done;
+    }
+
+    /**
+     * `POST /v2/list/{id}/status`: a column at the end. `status` is its name, `color` a hex colour.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function createColumn(TaskApiPrincipal $principal, string $boardId, TaskApiInput $input): TaskBoard
+    {
+        $this->audit->requireListener();
+        $board  = $this->guard->board($principal, $boardId, TaskApiCapability::ManageBoards);
+        $column = $this->columns->add($board, $this->columnData($input, new BoardColumnFormData()));
+        $this->audit->written($principal, 'column.create', $board, null, ['column' => $column->getId()]);
+
+        return $board;
+    }
+
+    /**
+     * `PUT /v2/list/{id}/status/{status_id}`.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function updateColumn(TaskApiPrincipal $principal, string $boardId, string $columnId, TaskApiInput $input): TaskBoard
+    {
+        $this->audit->requireListener();
+        $board  = $this->guard->board($principal, $boardId, TaskApiCapability::ManageBoards);
+        $column = $this->column($board, $columnId);
+        $this->columns->update($column, $this->columnData($input, new BoardColumnFormData($column->getName(), $column->getColor(), $column->getIcon())));
+        $this->audit->written($principal, 'column.update', $board, null, ['column' => $columnId]);
+
+        return $board;
+    }
+
+    /**
+     * `DELETE /v2/list/{id}/status/{status_id}`: its tasks go to the first remaining column; the last column stays (409).
+     *
+     * @throws TaskApiRefusal
+     */
+    public function deleteColumn(TaskApiPrincipal $principal, string $boardId, string $columnId): TaskBoard
+    {
+        $this->audit->requireListener();
+        $board  = $this->guard->board($principal, $boardId, TaskApiCapability::ManageBoards);
+        $column = $this->column($board, $columnId);
+        try {
+            if (!$this->columns->delete($column)) {
+                throw new TaskApiRefusal(409, 'LIST_001', 'A board keeps at least one column');
+            }
+        } catch (TaskReopenRefusedException) {
+            throw new TaskApiRefusal(403, 'PLAN_002', 'The limit of active tasks is reached');
+        }
+        $this->audit->written($principal, 'column.delete', $board, null, ['column' => $columnId]);
+
+        return $board;
+    }
+
+    /**
+     * `PUT /v2/list/{id}/status/order`: `order` lists every column id once.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function reorderColumns(TaskApiPrincipal $principal, string $boardId, TaskApiInput $input): TaskBoard
+    {
+        $this->audit->requireListener();
+        $board = $this->guard->board($principal, $boardId, TaskApiCapability::ManageBoards);
+        $order = $input->strings('order');
+        $given = array_unique($order);
+        $known = array_map(static fn (BoardColumn $column): string => $column->getId(), $board->getColumns()->toArray());
+        sort($given);
+        sort($known);
+        if (count($given) !== count($order) || $given !== $known) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid order: list every column once');
+        }
+        $this->columns->reorder($board, $order);
+        $this->audit->written($principal, 'column.reorder', $board, null);
+
+        return $board;
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function column(TaskBoard $board, string $columnId): BoardColumn
+    {
+        foreach ($board->getColumns() as $column) {
+            if ($column->getId() === $columnId) {
+                return $column;
+            }
+        }
+
+        throw TaskApiRefusal::notFound();
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function columnData(TaskApiInput $input, BoardColumnFormData $data): BoardColumnFormData
+    {
+        if ($input->has('status') || $data->name === '') {
+            $data->name = $this->text($input->string('status', true), TaskConstraints::columnName(), 'status');
+        }
+        if ($input->has('color')) {
+            $color = $input->string('color');
+            if ($color !== null && $this->validator->validate($color, TaskConstraints::columnColor())->count() > 0) {
+                throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid color');
+            }
+            $data->color = $color;
+        }
+
+        return $data;
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function description(TaskApiInput $input): ?string
+    {
+        return $input->has('markdown_content') ? $input->string('markdown_content') : $input->string('content');
+    }
+
+    /**
+     * @param list<Constraint> $constraints
+     *
+     * @throws TaskApiRefusal
+     */
+    private function text(?string $value, array $constraints, string $field): string
+    {
+        $value = trim((string) $value);
+        if ($this->validator->validate($value, $constraints)->count() > 0) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid ' . $field);
+        }
+
+        return $value;
+    }
+}
diff --git a/src/Api/Operation/TaskApiChecklistOperations.php b/src/Api/Operation/TaskApiChecklistOperations.php
new file mode 100644
index 00000000..1517df6a
--- /dev/null
+++ b/src/Api/Operation/TaskApiChecklistOperations.php
@@ -0,0 +1,294 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Operation;
+
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiUsersInterface;
+use Nowo\TaskBoardBundle\Api\Repository\TaskApiQueryRepository;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiInput;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Dto\TaskFormData;
+use Nowo\TaskBoardBundle\Dto\TaskMemberFormData;
+use Nowo\TaskBoardBundle\Entity\BoardColumn;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Exception\TaskReopenRefusedException;
+use Nowo\TaskBoardBundle\Service\TaskManager;
+use Nowo\TaskBoardBundle\Service\TaskMemberAssigner;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\Validator\ValidatorInterface;
+
+use function array_filter;
+use function array_values;
+use function base64_decode;
+use function count;
+use function explode;
+use function in_array;
+use function is_string;
+use function str_pad;
+use function str_starts_with;
+use function strlen;
+use function strtr;
+use function substr;
+use function trim;
+
+/**
+ * Since 2.2.0 (spec 213, owner Q-O4): ClickUp's checklists, as the import keeps them: each item is a subtask tagged
+ * `checklist:<name>`, and a checklist is its task plus that name. A *My tasks* token manages the checklists of its own tasks,
+ * items included, though it creates no other task. A checklist with no item does not persist. Deleting an item or a checklist
+ * archives the subtasks: nothing tracked on them is lost.
+ */
+final readonly class TaskApiChecklistOperations
+{
+    public const TAG_PREFIX = 'checklist:';
+
+    public function __construct(
+        private TaskApiGuard $guard,
+        private TaskApiAudit $audit,
+        private TaskApiUsersInterface $users,
+        private TaskManager $tasks,
+        private TaskMemberAssigner $members,
+        private TaskApiQueryRepository $queries,
+        private ValidatorInterface $validator,
+    ) {
+    }
+
+    /**
+     * `POST /v2/task/{id}/checklist`: nothing is stored until it has an item. Returns the task and the name.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return array{0: Task, 1: string}
+     */
+    public function createChecklist(TaskApiPrincipal $principal, string $taskId, TaskApiInput $input): array
+    {
+        $this->audit->requireListener();
+        $task = $this->guard->task($principal, $taskId, TaskApiCapability::WorkOnTask);
+
+        return [$task, $this->name($input->string('name', true))];
+    }
+
+    /**
+     * `POST /v2/checklist/{id}/checklist_item`: a subtask of the task, counted against the host's limit like any task.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return array{0: Task, 1: string}
+     */
+    public function createItem(TaskApiPrincipal $principal, string $checklistId, TaskApiInput $input): array
+    {
+        $this->audit->requireListener();
+        [$task, $name] = $this->checklist($principal, $checklistId);
+        $title         = trim((string) $input->string('name', true));
+        $this->validate($title, 'name', TaskConstraints::taskTitle());
+        $assignee = $this->assignee($principal, $task, $input);
+        $this->audit->requireTaskQuota($task->getBoard(), 1, $principal->user);
+
+        $item = $this->tasks->create($task->getBoard(), new TaskFormData(title: $title, tags: [self::TAG_PREFIX . $name]), $principal->user, $task);
+        if ($assignee !== null) {
+            $this->members->assign($item, new TaskMemberFormData($assignee, TaskMemberRole::Assignee), $principal->user);
+        }
+        $this->audit->written($principal, 'checklist_item.create', $task->getBoard(), $task->getId(), ['item' => $item->getId()]);
+
+        return [$task, $name];
+    }
+
+    /**
+     * `PUT /v2/checklist/{id}`: renames it (its items' tag). `position` is not supported.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return array{0: Task, 1: string}
+     */
+    public function updateChecklist(TaskApiPrincipal $principal, string $checklistId, TaskApiInput $input): array
+    {
+        $this->audit->requireListener();
+        [$task, $name] = $this->checklist($principal, $checklistId);
+        if (!$input->has('name')) {
+            return [$task, $name];
+        }
+        $renamed = $this->name($input->string('name', true));
+        foreach ($this->items($task, $name) as $item) {
+            $data       = TaskFormData::fromTask($item);
+            $data->tags = [...array_values(array_filter($item->getTags(), static fn (string $tag): bool => $tag !== self::TAG_PREFIX . $name)), self::TAG_PREFIX . $renamed];
+            $this->tasks->update($item, $data, $principal->user);
+        }
+        $this->audit->written($principal, 'checklist.update', $task->getBoard(), $task->getId(), [], ['name']);
+
+        return [$task, $renamed];
+    }
+
+    /**
+     * `DELETE /v2/checklist/{id}`: its items are archived.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function deleteChecklist(TaskApiPrincipal $principal, string $checklistId): Task
+    {
+        $this->audit->requireListener();
+        [$task, $name] = $this->checklist($principal, $checklistId);
+        foreach ($this->items($task, $name) as $item) {
+            $this->tasks->archive($item, $principal->user);
+        }
+        $this->audit->written($principal, 'checklist.delete', $task->getBoard(), $task->getId());
+
+        return $task;
+    }
+
+    /**
+     * `PUT /v2/checklist/{id}/checklist_item/{item}`: `name`, `resolved` (done or back to the first column), `assignee`.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return array{0: Task, 1: string}
+     */
+    public function updateItem(TaskApiPrincipal $principal, string $checklistId, string $itemId, TaskApiInput $input): array
+    {
+        $this->audit->requireListener();
+        [$task, $name] = $this->checklist($principal, $checklistId);
+        $item          = $this->item($task, $name, $itemId);
+        $data          = TaskFormData::fromTask($item);
+        if ($input->has('name')) {
+            $data->title = trim((string) $input->string('name', true));
+            $this->validate($data->title, 'name', TaskConstraints::taskTitle());
+        }
+        $resolved = $input->bool('resolved');
+        $assignee = $input->has('assignee') ? $this->assignee($principal, $task, $input) : null;
+
+        try {
+            if ($resolved === true && !$item->isCompleted()) {
+                $this->tasks->moveToDone($item, $principal->user);
+            } elseif ($resolved === false && $item->isCompleted()) {
+                $first = $item->getBoard()->getColumns()->first();
+                if ($first instanceof BoardColumn) {
+                    $this->tasks->moveToColumn($item, $first->getId(), $principal->user);
+                }
+            }
+        } catch (TaskReopenRefusedException) {
+            throw new TaskApiRefusal(403, 'PLAN_002', 'The limit of active tasks is reached');
+        }
+        $data->columnId = $item->getColumn()?->getId();
+        if ($data->title !== $item->getTitle()) {
+            $this->tasks->update($item, $data, $principal->user);
+        }
+        if ($assignee !== null) {
+            $this->members->assign($item, new TaskMemberFormData($assignee, TaskMemberRole::Assignee), $principal->user);
+        }
+        $this->audit->written($principal, 'checklist_item.update', $task->getBoard(), $task->getId(), ['item' => $item->getId()]);
+
+        return [$task, $name];
+    }
+
+    /**
+     * `DELETE /v2/checklist/{id}/checklist_item/{item}`: archived.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function deleteItem(TaskApiPrincipal $principal, string $checklistId, string $itemId): Task
+    {
+        $this->audit->requireListener();
+        [$task, $name] = $this->checklist($principal, $checklistId);
+        $item          = $this->item($task, $name, $itemId);
+        $this->tasks->archive($item, $principal->user);
+        $this->audit->written($principal, 'checklist_item.delete', $task->getBoard(), $task->getId(), ['item' => $item->getId()]);
+
+        return $task;
+    }
+
+    /**
+     * The task and the name a checklist id stands for, through the guard: the task's checklists are worked on like the task.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return array{0: Task, 1: string}
+     */
+    private function checklist(TaskApiPrincipal $principal, string $checklistId): array
+    {
+        if (!str_starts_with($checklistId, 'cl_')) {
+            throw TaskApiRefusal::notFound();
+        }
+        $encoded = strtr(substr($checklistId, 3), '-_', '+/');
+        $decoded = base64_decode(str_pad($encoded, strlen($encoded) + (4 - strlen($encoded) % 4) % 4, '='), true);
+        $parts   = is_string($decoded) ? explode('|', $decoded, 2) : [];
+        if (count($parts) !== 2 || $parts[1] === '') {
+            throw TaskApiRefusal::notFound();
+        }
+
+        return [$this->guard->task($principal, $parts[0], TaskApiCapability::WorkOnTask), $parts[1]];
+    }
+
+    /**
+     * @return list<Task>
+     */
+    private function items(Task $task, string $name): array
+    {
+        return array_values(array_filter($this->queries->subtasksOf([$task->getId()]), static fn (Task $item): bool => in_array(self::TAG_PREFIX . $name, $item->getTags(), true)));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function item(Task $task, string $name, string $itemId): Task
+    {
+        foreach ($this->items($task, $name) as $item) {
+            if ($item->getId() === $itemId) {
+                return $item;
+            }
+        }
+
+        throw TaskApiRefusal::notFound();
+    }
+
+    /**
+     * A *My tasks* token assigns an item to its own person only.
+     *
+     * @throws TaskApiRefusal
+     */
+    private function assignee(TaskApiPrincipal $principal, Task $task, TaskApiInput $input): ?object
+    {
+        $apiId = $input->string('assignee');
+        if ($apiId === null) {
+            return null;
+        }
+        $user    = $this->users->find($apiId);
+        $allowed = $this->members->assignableUsers($task->getBoard());
+        if ($user === null || ($allowed !== null && !in_array($user, $allowed, true))) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid assignee');
+        }
+        if ($principal->level === TaskApiLevel::MyTasks && $apiId !== $this->users->apiId($principal->user)) {
+            throw TaskApiRefusal::levelRefused();
+        }
+
+        return $user;
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function name(?string $name): string
+    {
+        $name = trim((string) $name);
+        // The name lives in a tag, after its prefix.
+        $this->validate($name, 'name', TaskConstraints::tagName());
+
+        return $name;
+    }
+
+    /**
+     * @param list<Constraint> $constraints
+     *
+     * @throws TaskApiRefusal
+     */
+    private function validate(string $value, string $field, array $constraints): void
+    {
+        if ($this->validator->validate($value, $constraints)->count() > 0) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid ' . $field);
+        }
+    }
+}
diff --git a/src/Api/Operation/TaskApiReadOperations.php b/src/Api/Operation/TaskApiReadOperations.php
new file mode 100644
index 00000000..00901871
--- /dev/null
+++ b/src/Api/Operation/TaskApiReadOperations.php
@@ -0,0 +1,402 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Operation;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiPlanGateInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiTimeEntriesInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiUsersInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiWorkspaceInterface;
+use Nowo\TaskBoardBundle\Api\Repository\TaskApiQueryRepository;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiBoardList;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiCommentPage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskFilter;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskPage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTeam;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimePage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncField;
+
+use function array_filter;
+use function array_map;
+use function array_values;
+use function in_array;
+use function spl_object_id;
+use function str_starts_with;
+
+/**
+ * Since 2.2.0 (spec 213): what the API reads, without HTTP: each method takes the principal and applies every check, so
+ * an in-process caller gets exactly what a request would.
+ */
+final readonly class TaskApiReadOperations
+{
+    /** Comments per page, as ClickUp. */
+    public const COMMENTS_PER_PAGE = 25;
+
+    public function __construct(
+        private TaskApiPlanGateInterface $planGate,
+        private TaskApiWorkspaceInterface $workspace,
+        private TaskApiUsersInterface $users,
+        private TaskApiGuard $guard,
+        private TaskApiQueryRepository $queries,
+        private TaskApiTimeEntriesInterface $timeEntries,
+    ) {
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function me(TaskApiPrincipal $principal): TaskApiUser
+    {
+        $this->requireIdentity($principal);
+
+        return $this->users->profiles([$principal->user], $principal)[$this->users->apiId($principal->user)] ?? throw TaskApiRefusal::notFound();
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     *
+     * @return list<TaskApiTeam>
+     */
+    public function teams(TaskApiPrincipal $principal): array
+    {
+        $this->requireIdentity($principal);
+
+        return $this->workspace->teams($principal);
+    }
+
+    /**
+     * The spaces of one of the token's teams that where reaches and whose plan holds the module.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return list<TaskApiSpace>
+     */
+    public function spaces(TaskApiPrincipal $principal, string $teamId): array
+    {
+        $this->requireTeam($principal, $teamId);
+
+        return array_values(array_filter($this->workspace->spaces($principal, $teamId), fn (TaskApiSpace $space): bool => $this->guard->lists($principal, $space)));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function space(TaskApiPrincipal $principal, string $spaceId): TaskApiSpace
+    {
+        return $this->guard->space($principal, $spaceId, TaskApiCapability::ReadOwn);
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function boards(TaskApiPrincipal $principal, string $spaceId): TaskApiBoardList
+    {
+        $space  = $this->guard->space($principal, $spaceId, TaskApiCapability::ReadOwn);
+        $boards = $this->guard->visibleBoards($principal, $space->tenantKey);
+
+        return new TaskApiBoardList($space, $boards, $this->queries->countByBoard($this->ids($boards), $this->owner($principal)));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function board(TaskApiPrincipal $principal, string $boardId): TaskApiBoardList
+    {
+        $board = $this->guard->board($principal, $boardId, TaskApiCapability::ReadOwn);
+
+        return new TaskApiBoardList($this->spaceOf($principal, $board), [$board], $this->queries->countByBoard([$board->getId()], $this->owner($principal)));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function tasks(TaskApiPrincipal $principal, string $boardId, TaskApiTaskFilter $filter): TaskApiTaskPage
+    {
+        $board = $this->guard->board($principal, $boardId, TaskApiCapability::ReadOwn);
+
+        return $this->page($principal, [$board], $filter);
+    }
+
+    /**
+     * Tasks across the boards of a team the token reaches; `space_ids[]` and `list_ids[]` narrow them.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function teamTasks(TaskApiPrincipal $principal, string $teamId, TaskApiTaskFilter $filter): TaskApiTaskPage
+    {
+        $boards = [];
+        foreach ($this->spaces($principal, $teamId) as $space) {
+            if ($filter->spaceIds !== [] && !in_array($space->id, $filter->spaceIds, true)) {
+                continue;
+            }
+            foreach ($this->guard->visibleBoards($principal, $space->tenantKey) as $board) {
+                if ($filter->listIds === [] || in_array($board->getId(), $filter->listIds, true)) {
+                    $boards[] = $board;
+                }
+            }
+        }
+
+        return $this->page($principal, $boards, $filter);
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function task(TaskApiPrincipal $principal, string $taskId, bool $markdown = false): TaskApiTaskPage
+    {
+        $task = $this->guard->task($principal, $taskId, TaskApiCapability::ReadOwn);
+
+        return $this->context($principal, $this->queries->load([$task->getId()]), true, $markdown);
+    }
+
+    /**
+     * Newest first, 25 per page; `$start` and `$startId` name the oldest comment of the previous page.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function comments(TaskApiPrincipal $principal, string $taskId, ?DateTimeImmutable $start, ?string $startId): TaskApiCommentPage
+    {
+        $task     = $this->guard->task($principal, $taskId, TaskApiCapability::ReadOwn);
+        $comments = $this->queries->comments($task, $start, $startId, self::COMMENTS_PER_PAGE);
+        $authors  = [];
+        $profiles = $this->profiles($principal, array_values(array_filter(array_map(static fn (TaskComment $comment): ?object => $comment->getAuthor(), $comments))));
+        foreach ($comments as $comment) {
+            $author = $comment->getAuthor();
+            $id     = $author === null ? null : $profiles['ids'][spl_object_id($author)] ?? null;
+            if ($id !== null && isset($profiles['profiles'][$id])) {
+                $authors[$comment->getId()] = $profiles['profiles'][$id];
+            }
+        }
+
+        return new TaskApiCommentPage($comments, $authors);
+    }
+
+    /**
+     * Everyone attached to the task, once, as the viewer may see them.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return list<TaskApiUser>
+     */
+    public function members(TaskApiPrincipal $principal, string $taskId): array
+    {
+        $task  = $this->guard->task($principal, $taskId, TaskApiCapability::ReadEverything);
+        $users = [];
+        foreach ($task->getMembers() as $member) {
+            $users[spl_object_id($member->getUser())] = $member->getUser();
+        }
+
+        return array_values($this->profiles($principal, array_values($users))['profiles']);
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     *
+     * @return list<string>
+     */
+    public function spaceTags(TaskApiPrincipal $principal, string $spaceId): array
+    {
+        $space = $this->guard->space($principal, $spaceId, TaskApiCapability::ReadEverything);
+
+        return $this->queries->tagsOf($this->ids($this->guard->visibleBoards($principal, $space->tenantKey)));
+    }
+
+    /**
+     * The fields a provider sync imported for the board; none without one.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return list<TaskSyncField>
+     */
+    public function boardFields(TaskApiPrincipal $principal, string $boardId): array
+    {
+        return $this->queries->fieldsOf($this->guard->board($principal, $boardId, TaskApiCapability::ReadEverything)->getId());
+    }
+
+    /**
+     * The host's time store decides whose time the token sees; a named task must be within reach first.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function timeEntries(TaskApiPrincipal $principal, TaskApiTimeQuery $query): TaskApiTimePage
+    {
+        $this->requireTeam($principal, $query->teamId);
+        if ($query->taskId !== null) {
+            $this->guard->task($principal, $query->taskId, TaskApiCapability::ReadOwn);
+        }
+
+        return $this->timeEntries->list($principal, $query);
+    }
+
+    /**
+     * @param list<TaskBoard> $boards already checked
+     *
+     * @throws TaskApiRefusal
+     */
+    private function page(TaskApiPrincipal $principal, array $boards, TaskApiTaskFilter $filter): TaskApiTaskPage
+    {
+        $assignees = [];
+        foreach ($filter->assigneeIds as $apiId) {
+            $user = $this->users->find($apiId);
+            if ($user !== null) {
+                $assignees[] = $user;
+            }
+        }
+        $result = $this->queries->taskPage($this->ids($boards), $filter, $assignees, $this->owner($principal));
+
+        return $this->context($principal, $result['tasks'], $result['lastPage'], $filter->markdown);
+    }
+
+    /**
+     * Everything the tasks are shown with, in a fixed number of queries and one call to each hook.
+     *
+     * @param list<Task> $tasks
+     */
+    private function context(TaskApiPrincipal $principal, array $tasks, bool $lastPage, bool $markdown): TaskApiTaskPage
+    {
+        $ids      = array_map(static fn (Task $task): string => $task->getId(), $tasks);
+        $subtasks = [];
+        foreach ($this->queries->subtasksOf($ids) as $subtask) {
+            // Audit IA-M2: only the subtasks the token may open; a checklist item of a task it reaches is part of that task
+            // (owner: My tasks manages the checklists of its own tasks).
+            if ($this->isChecklistItem($subtask) || $this->guard->canSeeTask($principal, $subtask)) {
+                $subtasks[(string) $subtask->getParent()?->getId()][] = $subtask;
+            }
+        }
+        // Audit IA-I7: a relation is shown only when the token may open the other task too.
+        $dependencies = array_values(array_filter($this->queries->dependenciesOf($ids), function (TaskDependency $dependency) use ($principal, $ids): bool {
+            foreach ([$dependency->getSourceTask(), $dependency->getTargetTask()] as $end) {
+                if (!in_array($end->getId(), $ids, true) && !$this->guard->canSeeTask($principal, $end)) {
+                    return false;
+                }
+            }
+
+            return true;
+        }));
+        $spaces = [];
+        $users  = [];
+        foreach ($tasks as $task) {
+            $board = $task->getBoard();
+            $spaces[$board->getId()] ??= $this->spaceOf($principal, $board);
+            $creator = $task->getCreator();
+            if ($creator !== null) {
+                $users[spl_object_id($creator)] = $creator;
+            }
+            foreach ([$task, ...$subtasks[$task->getId()] ?? []] as $shown) {
+                foreach ($shown->getMembers() as $member) {
+                    $users[spl_object_id($member->getUser())] = $member->getUser();
+                }
+            }
+        }
+        $profiles = $this->profiles($principal, array_values($users));
+
+        return new TaskApiTaskPage(
+            tasks: $tasks,
+            lastPage: $lastPage,
+            spaces: $spaces,
+            profiles: $profiles['profiles'],
+            userIds: $profiles['ids'],
+            dependencies: $dependencies,
+            subtasks: $subtasks,
+            manualMinutes: $this->queries->manualMinutesOf($ids),
+            fieldValues: $this->queries->fieldValuesOf($ids),
+            markdown: $markdown,
+        );
+    }
+
+    /**
+     * @param list<object> $users
+     *
+     * @return array{profiles: array<string, TaskApiUser>, ids: array<int, string>}
+     */
+    private function profiles(TaskApiPrincipal $principal, array $users): array
+    {
+        if ($users === []) {
+            return ['profiles' => [], 'ids' => []];
+        }
+        $profiles = $this->users->profiles($users, $principal);
+        $ids      = [];
+        foreach ($users as $user) {
+            try {
+                $ids[spl_object_id($user)] = $this->users->apiId($user);
+            } catch (TaskApiRefusal) {
+                // A person the host does not know is not shown.
+            }
+        }
+
+        return ['profiles' => $profiles, 'ids' => $ids];
+    }
+
+    private function isChecklistItem(Task $task): bool
+    {
+        foreach ($task->getTags() as $tag) {
+            if (str_starts_with($tag, 'checklist:')) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private function spaceOf(TaskApiPrincipal $principal, TaskBoard $board): TaskApiSpace
+    {
+        // The guard already asked the host for this tenant: a board without a space is out of reach.
+        return $this->workspace->spaceOfTenant($principal, $board->getTenantKey()) ?? throw TaskApiRefusal::notFound();
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function requireTeam(TaskApiPrincipal $principal, string $teamId): void
+    {
+        $this->requireIdentity($principal);
+        foreach ($this->workspace->teams($principal) as $team) {
+            if ($team->id === $teamId) {
+                return;
+            }
+        }
+
+        throw TaskApiRefusal::notFound();
+    }
+
+    /**
+     * Every level may read who it is, so only the plan is asked.
+     *
+     * @throws TaskApiRefusal
+     */
+    private function requireIdentity(TaskApiPrincipal $principal): void
+    {
+        if (!$this->planGate->allowsTasks($principal->user, null)) {
+            throw TaskApiRefusal::planRefused();
+        }
+    }
+
+    private function owner(TaskApiPrincipal $principal): ?object
+    {
+        return $principal->level === TaskApiLevel::MyTasks ? $principal->user : null;
+    }
+
+    /**
+     * @param list<TaskBoard> $boards
+     *
+     * @return list<string>
+     */
+    private function ids(array $boards): array
+    {
+        return array_map(static fn (TaskBoard $board): string => $board->getId(), $boards);
+    }
+}
diff --git a/src/Api/Operation/TaskApiTaskOperations.php b/src/Api/Operation/TaskApiTaskOperations.php
new file mode 100644
index 00000000..93f58f6f
--- /dev/null
+++ b/src/Api/Operation/TaskApiTaskOperations.php
@@ -0,0 +1,468 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Operation;
+
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiAttachmentsInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiUsersInterface;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiInput;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiAttachment;
+use Nowo\TaskBoardBundle\Comment\TaskMentionCandidatesResolverInterface;
+use Nowo\TaskBoardBundle\Dto\TaskFormData;
+use Nowo\TaskBoardBundle\Dto\TaskMemberFormData;
+use Nowo\TaskBoardBundle\Entity\BoardColumn;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Enum\TaskDependencyType;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Enum\TaskPriority;
+use Nowo\TaskBoardBundle\Exception\InvalidTaskDependencyException;
+use Nowo\TaskBoardBundle\Exception\TaskLinkedToProviderException;
+use Nowo\TaskBoardBundle\Service\TaskBoardEraser;
+use Nowo\TaskBoardBundle\Service\TaskCommentManager;
+use Nowo\TaskBoardBundle\Service\TaskDependencyManager;
+use Nowo\TaskBoardBundle\Service\TaskManager;
+use Nowo\TaskBoardBundle\Service\TaskMemberAssigner;
+use Nowo\TaskBoardBundle\Sync\Hook\LimitRefusal;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\Validator\ValidatorInterface;
+
+use function array_filter;
+use function array_key_last;
+use function array_map;
+use function array_unique;
+use function array_values;
+use function count;
+use function in_array;
+use function intdiv;
+use function mb_strtolower;
+use function str_contains;
+use function trim;
+
+/**
+ * Since 2.2.0 (spec 213): the task writes of the API, through the services the UI uses (FR-011), without HTTP. Each method
+ * checks the token through the guard, validates with the forms' rules, checks everything it can before the first write, and
+ * ends with one `API_WRITE`.
+ *
+ * A write that changes several things saves each with its own service, as the UI's separate forms do. What can be refused
+ * is asked first (assignable people, status, dates, limits), so a refusal changes nothing; a failure of the database between
+ * two saves can leave the first one.
+ */
+final readonly class TaskApiTaskOperations
+{
+    /** What a *My tasks* token may change on its own task (owner, FR-012). */
+    public const OWN_TASK_FIELDS = ['status', 'description', 'markdown_content', 'due_date', 'due_date_time', 'start_date', 'start_date_time'];
+
+    /** ClickUp's task fields Beacon has no equivalent for: warned, never saved. */
+    public const NOT_SUPPORTED = ['tags', 'points', 'group_assignees', 'custom_item_id', 'custom_fields', 'notify_all', 'links_to', 'check_required_custom_fields', 'parent', 'due_date_time', 'start_date_time', 'custom_task_ids', 'team_id'];
+
+    /** The task form's tag field takes at most 20. */
+    public const MAX_TAGS = 20;
+
+    private const PRIORITIES = [1 => TaskPriority::Urgent, 2 => TaskPriority::High, 3 => TaskPriority::Normal, 4 => TaskPriority::Low];
+
+    public function __construct(
+        private TaskApiGuard $guard,
+        private TaskApiAudit $audit,
+        private TaskApiUsersInterface $users,
+        private TaskManager $tasks,
+        private TaskMemberAssigner $members,
+        private TaskBoardEraser $eraser,
+        private TaskDependencyManager $dependencies,
+        private ValidatorInterface $validator,
+        private TaskCommentManager $comments,
+        private TaskMentionCandidatesResolverInterface $mentionCandidates,
+        private TaskApiAttachmentsInterface $attachments,
+    ) {
+    }
+
+    /**
+     * `POST /v2/list/{id}/task`: a task, or a subtask with `parent`.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function createTask(TaskApiPrincipal $principal, string $boardId, TaskApiInput $input): Task
+    {
+        $this->audit->requireListener();
+        $board    = $this->guard->board($principal, $boardId, TaskApiCapability::EditTasks);
+        $parent   = null;
+        $parentId = $input->string('parent');
+        if ($parentId !== null) {
+            $parent = $this->guard->task($principal, $parentId, TaskApiCapability::EditTasks);
+            if ($parent->getBoard()->getId() !== $board->getId()) {
+                throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid parent');
+            }
+        }
+
+        $data           = new TaskFormData(title: $this->title($input->string('name', true)));
+        $data->columnId = $this->columnOf($board, $input->string('status'))?->getId();
+        $this->applyFields($data, $input);
+        $data->tags = $this->tags($input->strings('tags'));
+        $assignees  = $this->assignable($board, $input->strings('assignees'));
+        $this->audit->requireTaskQuota($board, 1, $principal->user);
+
+        $task = $this->tasks->create($board, $data, $principal->user, $parent);
+        foreach ($assignees as $user) {
+            $this->members->assign($task, new TaskMemberFormData($user, TaskMemberRole::Assignee), $principal->user);
+        }
+        $this->audit->written($principal, 'task.create', $board, $task->getId(), $parent !== null ? ['parent' => $parent->getId()] : []);
+
+        return $task;
+    }
+
+    /**
+     * `PUT /v2/task/{id}`. A *My tasks* token changes only status, dates and description; any other field is 403 `TOKEN_001`.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function updateTask(TaskApiPrincipal $principal, string $taskId, TaskApiInput $input): Task
+    {
+        $this->audit->requireListener();
+        $ownFieldsOnly = !$input->hasAny('name', 'priority', 'time_estimate', 'assignees', 'watchers', 'archived');
+        $task          = $this->guard->task($principal, $taskId, $ownFieldsOnly ? TaskApiCapability::WorkOnTask : TaskApiCapability::EditTasks);
+        $board         = $task->getBoard();
+
+        // Everything that can be refused, before the first save.
+        $data = TaskFormData::fromTask($task);
+        // The column moves only through moveToColumn(), with completion, the reopen limit and their events.
+        $data->columnId = $task->getColumn()?->getId();
+        if ($input->has('name')) {
+            $data->title = $this->title($input->string('name', true));
+        }
+        $this->applyFields($data, $input);
+        $status    = $input->has('status') ? $this->columnOf($board, $input->string('status', true)) : null;
+        $assignees = $input->addRemove('assignees');
+        $watchers  = $input->addRemove('watchers');
+        $add       = [
+            TaskMemberRole::Assignee->value => $this->assignable($board, $assignees['add']),
+            TaskMemberRole::Watcher->value  => $this->assignable($board, $watchers['add']),
+        ];
+        $archived = $input->bool('archived');
+        // Audit IA-L6: every limit before the first save. A restored task that was open, and a done one leaving the done
+        // column, each add an active task.
+        $columns  = $board->getColumns()->toArray();
+        $last     = $columns === [] ? null : $columns[array_key_last($columns)];
+        $reopens  = $status instanceof BoardColumn && $task->isCompleted() && $last instanceof BoardColumn && $status->getId() !== $last->getId();
+        $restores = $archived === false && $task->isArchived() && !$task->isCompleted();
+        if ($this->tasks->activeTaskRefusal($board, (int) $reopens + (int) $restores) instanceof LimitRefusal) {
+            throw new TaskApiRefusal(403, 'PLAN_002', 'The limit of active tasks is reached');
+        }
+
+        // Both ask the limit again; it was asked above for both together.
+        $changed = [];
+        if ($archived === false && $this->tasks->restore($task, $principal->user)) {
+            $changed[] = 'archived';
+        }
+        if ($status instanceof BoardColumn && $this->tasks->moveToColumn($task, $status->getId(), $principal->user)) {
+            $changed[] = 'status';
+        }
+        // The column is where the move left it: update() must never move the task (it would skip completion and its events).
+        $data->columnId = $task->getColumn()?->getId();
+        if ($data != TaskFormData::fromTask($task)) {
+            $this->tasks->update($task, $data, $principal->user);
+            $changed[] = 'fields';
+        }
+        foreach ([TaskMemberRole::Assignee, TaskMemberRole::Watcher] as $role) {
+            foreach ($add[$role->value] as $user) {
+                $this->members->assign($task, new TaskMemberFormData($user, $role), $principal->user);
+                $changed[] = $role->value . 's';
+            }
+            foreach (($role === TaskMemberRole::Assignee ? $assignees : $watchers)['rem'] as $apiId) {
+                foreach ($task->getMembers() as $member) {
+                    if ($member->getMemberRole() === $role && $this->users->apiId($member->getUser()) === $apiId) {
+                        $this->members->unassign($task, $member->getId(), $principal->user);
+                        $changed[] = $role->value . 's';
+                    }
+                }
+            }
+        }
+        if ($archived === true && $this->tasks->archive($task, $principal->user)) {
+            $changed[] = 'archived';
+        }
+        $this->audit->written($principal, 'task.update', $board, $task->getId(), [], array_values(array_unique($changed)));
+
+        return $task;
+    }
+
+    /**
+     * `DELETE /v2/task/{id}`: erased with its subtasks, tracked time kept (owner, Q-O5).
+     *
+     * @throws TaskApiRefusal
+     */
+    public function deleteTask(TaskApiPrincipal $principal, string $taskId): TaskBoard
+    {
+        $this->audit->requireListener();
+        $task  = $this->guard->task($principal, $taskId, TaskApiCapability::DeleteTask);
+        $board = $task->getBoard();
+        try {
+            $this->eraser->eraseTask($task, $principal->user);
+        } catch (TaskLinkedToProviderException) {
+            throw new TaskApiRefusal(409, 'TASK_002', 'The task follows a provider: unlink its board first');
+        }
+        $this->audit->written($principal, 'task.delete', $board, $taskId);
+
+        return $board;
+    }
+
+    /**
+     * `POST /v2/task/{id}/comment`. Mentions work as in the UI's box: each candidate written "@Label" in the text is mentioned,
+     * so `TASK_MENTION` and the host's notifications follow. ClickUp's structured mention fields are not read.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function addComment(TaskApiPrincipal $principal, string $taskId, TaskApiInput $input): TaskComment
+    {
+        $this->audit->requireListener();
+        $task = $this->guard->task($principal, $taskId, TaskApiCapability::Comment);
+        $body = (string) $input->string('comment_text', true);
+        $this->validate($body, TaskConstraints::commentBody(), 'comment_text');
+        $mentioned = [];
+        foreach ($this->mentionCandidates->candidates($task) as $candidate) {
+            if (str_contains($body, '@' . $candidate->label)) {
+                $mentioned[] = $candidate->id;
+            }
+        }
+        $comment = $this->comments->add($task, $principal->user, $body, $mentioned);
+        $this->audit->written($principal, 'comment.create', $task->getBoard(), $taskId, ['comment' => $comment->getId()]);
+
+        return $comment;
+    }
+
+    /**
+     * `POST /v2/task/{id}/attachment` (multipart, field `attachment`): stored by the host, with all its upload checks (FR-014).
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return array{0: Task, 1: TaskApiAttachment}
+     */
+    public function addAttachment(TaskApiPrincipal $principal, string $taskId, ?UploadedFile $file): array
+    {
+        $this->audit->requireListener();
+        $task = $this->guard->task($principal, $taskId, TaskApiCapability::EditTasks);
+        if (!$file instanceof UploadedFile || !$file->isValid()) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid attachment');
+        }
+        $attachment = $this->attachments->store($principal, $task, $file);
+        $this->audit->written($principal, 'attachment.create', $task->getBoard(), $taskId, ['attachment' => $attachment->id]);
+
+        return [$task, $attachment];
+    }
+
+    /**
+     * `POST` and `DELETE /v2/task/{id}/tag/{name}`.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function tag(TaskApiPrincipal $principal, string $taskId, string $name, bool $add): Task
+    {
+        $this->audit->requireListener();
+        $task       = $this->guard->task($principal, $taskId, TaskApiCapability::EditTasks);
+        $name       = trim($name);
+        $data       = TaskFormData::fromTask($task);
+        $data->tags = $add
+            ? $this->tags([...$task->getTags(), $name])
+            : array_values(array_filter($task->getTags(), static fn (string $tag): bool => mb_strtolower($tag) !== mb_strtolower($name)));
+        $this->tasks->update($task, $data, $principal->user);
+        $this->audit->written($principal, $add ? 'tag.add' : 'tag.remove', $task->getBoard(), $taskId, [], ['tags']);
+
+        return $task;
+    }
+
+    /**
+     * `POST /v2/task/{id}/field/{field_id}`: custom fields are a provider's, read-only here (owner, Q-O3).
+     *
+     * @throws TaskApiRefusal
+     */
+    public function setField(TaskApiPrincipal $principal, string $taskId): never
+    {
+        $this->audit->requireListener();
+        $this->guard->task($principal, $taskId, TaskApiCapability::EditTasks);
+
+        throw new TaskApiRefusal(409, 'FIELD_001', 'Custom fields are read-only: a provider sync owns them');
+    }
+
+    /**
+     * `POST /v2/task/{id}/dependency` (`depends_on` or `dependency_of`) and `POST /v2/task/{id}/link/{links_to}`.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function relate(TaskApiPrincipal $principal, string $taskId, string $otherId, TaskDependencyType $type): Task
+    {
+        $this->audit->requireListener();
+        $task  = $this->guard->task($principal, $taskId, TaskApiCapability::EditTasks);
+        $other = $this->guard->task($principal, $otherId, TaskApiCapability::ReadOwn);
+        try {
+            $this->dependencies->add($task, $other, $type, $principal->user);
+        } catch (InvalidTaskDependencyException $invalid) {
+            throw $invalid->reason === InvalidTaskDependencyException::REASON_OTHER_BOARD ? new TaskApiRefusal(400, 'LINK_002', 'Dependencies stay within a board') : new TaskApiRefusal(400, 'LINK_001', 'This dependency is not allowed');
+        }
+        $this->audit->written($principal, $type === TaskDependencyType::Related ? 'link.add' : 'dependency.add', $task->getBoard(), $taskId, ['other' => $other->getId()]);
+
+        return $task;
+    }
+
+    /**
+     * `DELETE /v2/task/{id}/dependency` and `DELETE /v2/task/{id}/link/{links_to}`: the relations of these types between
+     * the two tasks.
+     *
+     * @param list<TaskDependencyType> $types
+     *
+     * @throws TaskApiRefusal
+     */
+    public function unrelate(TaskApiPrincipal $principal, string $taskId, string $otherId, array $types, ?bool $taskWaits): Task
+    {
+        $this->audit->requireListener();
+        $task    = $this->guard->task($principal, $taskId, TaskApiCapability::EditTasks);
+        $other   = $this->guard->task($principal, $otherId, TaskApiCapability::ReadOwn);
+        $removed = 0;
+        foreach ($this->dependencies->findBetween($task, $other) as $dependency) {
+            $type = $dependency->getDependencyType();
+            if (!in_array($type, $types, true) || ($taskWaits !== null && $this->waits($task, $dependency->getSourceTask()->getId() === $task->getId(), $type) !== $taskWaits)) {
+                continue;
+            }
+            $this->dependencies->remove($task, $dependency->getId(), $principal->user);
+            ++$removed;
+        }
+        if ($removed === 0) {
+            throw TaskApiRefusal::notFound();
+        }
+        $this->audit->written($principal, in_array(TaskDependencyType::Related, $types, true) ? 'link.remove' : 'dependency.remove', $task->getBoard(), $taskId, ['other' => $other->getId()]);
+
+        return $task;
+    }
+
+    /** Whether, in this relation, the task waits on the other one (ClickUp's `depends_on`). */
+    private function waits(Task $task, bool $taskIsSource, TaskDependencyType $type): bool
+    {
+        return $taskIsSource ? $type === TaskDependencyType::BlockedBy : $type === TaskDependencyType::Blocks;
+    }
+
+    /**
+     * Description, priority, dates and estimate, as the task form takes them.
+     *
+     * @throws TaskApiRefusal
+     */
+    private function applyFields(TaskFormData $data, TaskApiInput $input): void
+    {
+        foreach (['markdown_content', 'description'] as $field) {
+            if ($input->has($field)) {
+                $data->description = $input->string($field);
+
+                break;
+            }
+        }
+        if ($input->has('priority')) {
+            $priority       = $input->int('priority');
+            $data->priority = $priority === null ? TaskPriority::Normal : (self::PRIORITIES[$priority] ?? throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid priority'));
+        }
+        if ($input->has('due_date')) {
+            $data->dueAt = $input->date('due_date');
+        }
+        if ($input->has('start_date')) {
+            $data->startAt = $input->date('start_date');
+        }
+        if ($input->has('time_estimate')) {
+            $estimate               = $input->int('time_estimate');
+            $data->estimatedMinutes = $estimate === null ? null : intdiv($estimate, 60000);
+        }
+        if (TaskConstraints::startsAfterDue($data->startAt, $data->dueAt)) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid start_date: after the due date');
+        }
+    }
+
+    /**
+     * A board's column by its name, case aside (ClickUp's status).
+     *
+     * @throws TaskApiRefusal
+     */
+    private function columnOf(TaskBoard $board, ?string $status): ?BoardColumn
+    {
+        if ($status === null) {
+            return null;
+        }
+        foreach ($board->getColumns() as $column) {
+            if (mb_strtolower($column->getName()) === mb_strtolower($status)) {
+                return $column;
+            }
+        }
+
+        throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid status');
+    }
+
+    /**
+     * The people named, each one the board's assignee rule allows.
+     *
+     * @param list<string> $apiIds
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return list<object>
+     */
+    private function assignable(TaskBoard $board, array $apiIds): array
+    {
+        $allowed = $this->members->assignableUsers($board);
+        $users   = [];
+        foreach ($apiIds as $apiId) {
+            $user = $this->users->find($apiId);
+            if ($user === null || ($allowed !== null && !in_array($user, $allowed, true))) {
+                throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid assignee');
+            }
+            $users[] = $user;
+        }
+
+        return $users;
+    }
+
+    /**
+     * The task form's rules for tags: each a valid name, at most {@see self::MAX_TAGS}.
+     *
+     * @param list<string> $tags
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return list<string>
+     */
+    private function tags(array $tags): array
+    {
+        $tags = array_values(array_unique(array_map('trim', $tags)));
+        foreach ($tags as $tag) {
+            $this->validate($tag, TaskConstraints::tagName(), 'tags');
+        }
+        if (count($tags) > self::MAX_TAGS) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid tags: at most ' . self::MAX_TAGS);
+        }
+
+        return $tags;
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function title(?string $name): string
+    {
+        $title = trim((string) $name);
+        $this->validate($title, TaskConstraints::taskTitle(), 'name');
+
+        return $title;
+    }
+
+    /**
+     * @param list<Constraint> $constraints
+     *
+     * @throws TaskApiRefusal
+     */
+    private function validate(mixed $value, array $constraints, string $field): void
+    {
+        if ($this->validator->validate($value, $constraints)->count() > 0) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid ' . $field);
+        }
+    }
+}
diff --git a/src/Api/Operation/TaskApiTimeOperations.php b/src/Api/Operation/TaskApiTimeOperations.php
new file mode 100644
index 00000000..3e72274a
--- /dev/null
+++ b/src/Api/Operation/TaskApiTimeOperations.php
@@ -0,0 +1,96 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Operation;
+
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiPlanGateInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiTimeEntriesInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiUsersInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiWorkspaceInterface;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiInput;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiNewTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
+
+use function intdiv;
+use function mb_strlen;
+
+/**
+ * Since 2.2.0 (spec 213): time through the host's time store. A token logs its own person's time only. Deleting time is
+ * never offered (owner, Q-O7): `DELETE …/time_entries/{id}` is refused before anything is looked up.
+ */
+final readonly class TaskApiTimeOperations
+{
+    /** ClickUp's time entry fields with no equivalent here. */
+    public const NOT_SUPPORTED = ['billable', 'tags', 'stop', 'end', 'created_with', 'custom_task_ids', 'team_id'];
+
+    public function __construct(
+        private TaskApiGuard $guard,
+        private TaskApiAudit $audit,
+        private TaskApiPlanGateInterface $planGate,
+        private TaskApiWorkspaceInterface $workspace,
+        private TaskApiUsersInterface $users,
+        private TaskApiTimeEntriesInterface $timeEntries,
+    ) {
+    }
+
+    /**
+     * `POST /v2/team/{team_id}/time_entries`: `start` and `duration` in milliseconds, `tid` (a task), `description`.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return array{0: ?Task, 1: TaskApiTimeEntry}
+     */
+    public function logTime(TaskApiPrincipal $principal, string $teamId, TaskApiInput $input): array
+    {
+        $this->audit->requireListener();
+        if (!$this->planGate->allowsTasks($principal->user, null)) {
+            throw TaskApiRefusal::planRefused();
+        }
+        $this->requireTeam($principal, $teamId);
+        $taskId = $input->string('tid');
+        $task   = $taskId === null ? null : $this->guard->task($principal, $taskId, TaskApiCapability::WorkOnTask);
+        if ($task === null) {
+            $this->guard->requireLevel($principal, TaskApiCapability::WorkOnTask);
+        }
+        $assignee = $input->string('assignee');
+        if ($assignee !== null && $assignee !== $this->users->apiId($principal->user)) {
+            // A token logs its own person's time, never someone else's.
+            throw TaskApiRefusal::levelRefused();
+        }
+        $start    = $input->date('start') ?? throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid start');
+        $duration = $input->int('duration') ?? throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid duration');
+        if ($duration < 60000 || $duration > TaskConstraints::MAX_MINUTES * 60000) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid duration');
+        }
+        $description = $input->string('description');
+        if ($description !== null && mb_strlen($description) > TaskConstraints::NOTE_MAX) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid description');
+        }
+
+        $entry = $this->timeEntries->log($principal, $task, new TaskApiNewTimeEntry($teamId, $start, intdiv($duration, 1000), $description));
+        $this->audit->written($principal, 'time.log', $task?->getBoard(), $task?->getId(), ['entry' => $entry->id]);
+
+        return [$task, $entry];
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function requireTeam(TaskApiPrincipal $principal, string $teamId): void
+    {
+        foreach ($this->workspace->teams($principal) as $team) {
+            if ($team->id === $teamId) {
+                return;
+            }
+        }
+
+        throw TaskApiRefusal::notFound();
+    }
+}
diff --git a/src/Api/Repository/TaskApiQueryRepository.php b/src/Api/Repository/TaskApiQueryRepository.php
new file mode 100644
index 00000000..49306b52
--- /dev/null
+++ b/src/Api/Repository/TaskApiQueryRepository.php
@@ -0,0 +1,435 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Repository;
+
+use DateTimeImmutable;
+use Doctrine\DBAL\Platforms\AbstractMySQLPlatform;
+use Doctrine\ORM\EntityManagerInterface;
+use Doctrine\ORM\QueryBuilder;
+use Nowo\TaskBoardBundle\Api\Doctrine\JsonTextFunction;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskFilter;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Entity\TaskMember;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskBoardConnection;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncField;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncFieldValue;
+
+use function array_map;
+use function array_slice;
+use function array_values;
+use function count;
+use function implode;
+use function is_array;
+use function is_string;
+use function json_encode;
+use function mb_strtolower;
+use function strtr;
+
+use const JSON_UNESCAPED_SLASHES;
+use const JSON_UNESCAPED_UNICODE;
+
+/**
+ * Since 2.2.0 (spec 213): what the read API needs from the database, in a fixed number of queries per page whatever its
+ * size (FR-010). Filters run in SQL, so `last_page` and every count are those of what the token may read.
+ */
+final readonly class TaskApiQueryRepository
+{
+    private const ORDER_FIELDS = ['id' => 't.id', 'created' => 't.createdAt', 'updated' => 't.updatedAt', 'due_date' => 't.dueAt'];
+
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private bool $syncEnabled = false,
+    ) {
+    }
+
+    /**
+     * One page of tasks of the given boards, with what serializing them needs.
+     *
+     * @param list<string> $boardIds boards already checked
+     * @param list<object> $assignees users the `assignees[]` filter names
+     * @param object|null $owner My tasks: only the tasks it created or is assigned
+     *
+     * @return array{tasks: list<Task>, lastPage: bool}
+     */
+    public function taskPage(array $boardIds, TaskApiTaskFilter $filter, array $assignees, ?object $owner): array
+    {
+        if ($boardIds === [] || ($filter->assigneeIds !== [] && $assignees === [])) {
+            return ['tasks' => [], 'lastPage' => true];
+        }
+        $qb        = $this->filtered($boardIds, $filter, $assignees, $owner);
+        $direction = $filter->reverse ? 'DESC' : 'ASC';
+        $qb->orderBy(self::ORDER_FIELDS[$filter->orderBy], $direction)->addOrderBy('t.id', $direction);
+        $offset = $filter->page * TaskApiTaskFilter::PAGE_SIZE;
+
+        /** @var list<array{id: string}> $rows */
+        $rows = $qb->select('t.id AS id')->setFirstResult($offset)->setMaxResults(TaskApiTaskFilter::PAGE_SIZE + 1)->getQuery()->getArrayResult();
+        $ids  = array_map(static fn (array $row): string => (string) $row['id'], $rows);
+
+        $lastPage = count($ids) <= TaskApiTaskFilter::PAGE_SIZE;
+        $ids      = array_slice($ids, 0, TaskApiTaskFilter::PAGE_SIZE);
+
+        return ['tasks' => $this->load($ids), 'lastPage' => $lastPage];
+    }
+
+    /**
+     * Open (not archived) tasks per board, as the token may count them.
+     *
+     * @param list<string> $boardIds
+     *
+     * @return array<string, int>
+     */
+    public function countByBoard(array $boardIds, ?object $owner): array
+    {
+        if ($boardIds === []) {
+            return [];
+        }
+        $qb = $this->entityManager->createQueryBuilder()
+            ->select('IDENTITY(t.board) AS board', 'COUNT(t.id) AS tasks')
+            ->from(Task::class, 't')
+            ->where('t.board IN (:boards)')
+            ->andWhere('t.archivedAt IS NULL')
+            ->setParameter('boards', $boardIds)
+            ->groupBy('t.board');
+        $this->onlyOwn($qb, $owner);
+        $counts = [];
+        /** @var list<array{board: string, tasks: int|string}> $rows */
+        $rows = $qb->getQuery()->getArrayResult();
+        foreach ($rows as $row) {
+            $counts[(string) $row['board']] = (int) $row['tasks'];
+        }
+
+        return $counts;
+    }
+
+    /**
+     * The tags used on the open tasks of the boards, sorted.
+     *
+     * @param list<string> $boardIds
+     *
+     * @return list<string>
+     */
+    public function tagsOf(array $boardIds): array
+    {
+        if ($boardIds === []) {
+            return [];
+        }
+        /** @var list<array{tags: mixed}> $rows */
+        $rows = $this->entityManager->createQueryBuilder()
+            ->select('t.tags AS tags')
+            ->from(Task::class, 't')
+            ->where('t.board IN (:boards)')
+            ->andWhere('t.archivedAt IS NULL')
+            ->setParameter('boards', $boardIds)
+            ->getQuery()
+            ->getArrayResult();
+        $tags = [];
+        foreach ($rows as $row) {
+            foreach (is_array($row['tags']) ? $row['tags'] : [] as $tag) {
+                if (is_string($tag) && $tag !== '') {
+                    $tags[mb_strtolower($tag)] = $tag;
+                }
+            }
+        }
+        ksort($tags);
+
+        return array_values($tags);
+    }
+
+    /**
+     * The dependencies touching the tasks, in one query.
+     *
+     * @param list<string> $taskIds
+     *
+     * @return list<TaskDependency>
+     */
+    public function dependenciesOf(array $taskIds): array
+    {
+        if ($taskIds === []) {
+            return [];
+        }
+        /** @var list<TaskDependency> $dependencies */
+        $dependencies = $this->entityManager->createQueryBuilder()
+            // Both ends with their members: whether the token may open the other end is asked of each (audit IA-I7).
+            ->select('d', 's', 'sm', 'su', 'e', 'em', 'eu')
+            ->from(TaskDependency::class, 'd')
+            ->join('d.sourceTask', 's')
+            ->leftJoin('s.members', 'sm')
+            ->leftJoin('sm.user', 'su')
+            ->join('d.targetTask', 'e')
+            ->leftJoin('e.members', 'em')
+            ->leftJoin('em.user', 'eu')
+            ->where('d.sourceTask IN (:tasks) OR d.targetTask IN (:tasks)')
+            ->setParameter('tasks', $taskIds)
+            ->getQuery()
+            ->getResult();
+
+        return $dependencies;
+    }
+
+    /**
+     * The subtasks of the tasks (checklist items among them), with their members.
+     *
+     * @param list<string> $taskIds
+     *
+     * @return list<Task>
+     */
+    public function subtasksOf(array $taskIds): array
+    {
+        if ($taskIds === []) {
+            return [];
+        }
+        /** @var list<Task> $subtasks */
+        $subtasks = $this->entityManager->createQueryBuilder()
+            ->select('t', 'm', 'u')
+            ->from(Task::class, 't')
+            ->leftJoin('t.members', 'm')
+            ->leftJoin('m.user', 'u')
+            ->where('t.parent IN (:parents)')
+            ->andWhere('t.archivedAt IS NULL')
+            ->setParameter('parents', $taskIds)
+            ->orderBy('t.position', 'ASC')
+            ->addOrderBy('t.id', 'ASC')
+            ->getQuery()
+            ->getResult();
+
+        return $subtasks;
+    }
+
+    /**
+     * Minutes logged by hand per task, in one query (the timers' time is on the task).
+     *
+     * @param list<string> $taskIds
+     *
+     * @return array<string, int>
+     */
+    public function manualMinutesOf(array $taskIds): array
+    {
+        if ($taskIds === []) {
+            return [];
+        }
+        /** @var list<array{task: string, minutes: int|string}> $rows */
+        $rows = $this->entityManager->createQueryBuilder()
+            ->select('IDENTITY(e.task) AS task', 'SUM(e.minutes) AS minutes')
+            ->from(TaskTimeEntry::class, 'e')
+            ->where('e.task IN (:tasks)')
+            ->setParameter('tasks', $taskIds)
+            ->groupBy('e.task')
+            ->getQuery()
+            ->getArrayResult();
+        $minutes = [];
+        foreach ($rows as $row) {
+            $minutes[(string) $row['task']] = (int) $row['minutes'];
+        }
+
+        return $minutes;
+    }
+
+    /**
+     * A page of a task's comments, newest first, older than (`$before`, `$beforeId`) when given. Deleted ones are left out.
+     *
+     * @return list<TaskComment>
+     */
+    public function comments(Task $task, ?DateTimeImmutable $before, ?string $beforeId, int $limit): array
+    {
+        $qb = $this->entityManager->createQueryBuilder()
+            ->select('c', 'a')
+            ->from(TaskComment::class, 'c')
+            ->leftJoin('c.author', 'a')
+            ->where('c.task = :task')
+            ->andWhere('c.deletedAt IS NULL')
+            ->setParameter('task', $task)
+            ->orderBy('c.createdAt', 'DESC')
+            ->addOrderBy('c.id', 'DESC')
+            ->setMaxResults($limit);
+        if ($before instanceof DateTimeImmutable) {
+            $qb->andWhere($beforeId !== null ? 'c.createdAt < :before OR (c.createdAt = :before AND c.id < :beforeId)' : 'c.createdAt < :before')
+                ->setParameter('before', $before);
+            if ($beforeId !== null) {
+                $qb->setParameter('beforeId', $beforeId);
+            }
+        }
+        /** @var list<TaskComment> $comments */
+        $comments = $qb->getQuery()->getResult();
+
+        return $comments;
+    }
+
+    /**
+     * Whether the board follows a provider (never without `sync.enabled`).
+     */
+    public function hasConnection(string $boardId): bool
+    {
+        if (!$this->syncEnabled) {
+            return false;
+        }
+
+        return (int) $this->entityManager->createQueryBuilder()
+            ->select('COUNT(c.id)')
+            ->from(TaskBoardConnection::class, 'c')
+            ->where('c.board = :board')
+            ->setParameter('board', $boardId)
+            ->getQuery()
+            ->getSingleScalarResult() > 0;
+    }
+
+    /**
+     * The imported custom fields of a board (none without `sync.enabled`).
+     *
+     * @return list<TaskSyncField>
+     */
+    public function fieldsOf(string $boardId): array
+    {
+        if (!$this->syncEnabled) {
+            return [];
+        }
+        /** @var list<TaskSyncField> $fields */
+        $fields = $this->entityManager->createQueryBuilder()
+            ->select('f')
+            ->from(TaskSyncField::class, 'f')
+            ->where('f.board = :board')
+            ->setParameter('board', $boardId)
+            ->orderBy('f.position', 'ASC')
+            ->getQuery()
+            ->getResult();
+
+        return $fields;
+    }
+
+    /**
+     * The imported field values of the tasks, erased ones left out, by task id.
+     *
+     * @param list<string> $taskIds
+     *
+     * @return array<string, list<TaskSyncFieldValue>>
+     */
+    public function fieldValuesOf(array $taskIds): array
+    {
+        if (!$this->syncEnabled || $taskIds === []) {
+            return [];
+        }
+        /** @var list<TaskSyncFieldValue> $values */
+        $values = $this->entityManager->createQueryBuilder()
+            ->select('v', 'f')
+            ->from(TaskSyncFieldValue::class, 'v')
+            ->join('v.field', 'f')
+            ->where('v.task IN (:tasks)')
+            ->setParameter('tasks', $taskIds)
+            ->orderBy('f.position', 'ASC')
+            ->getQuery()
+            ->getResult();
+        $byTask = [];
+        foreach ($values as $value) {
+            if (!$value->isErased()) {
+                $byTask[$value->getTask()->getId()][] = $value;
+            }
+        }
+
+        return $byTask;
+    }
+
+    /**
+     * The tasks, in the order of `$ids`, with their creator, column, members and members' users.
+     *
+     * @param list<string> $ids
+     *
+     * @return list<Task>
+     */
+    public function load(array $ids): array
+    {
+        if ($ids === []) {
+            return [];
+        }
+        /** @var list<Task> $tasks */
+        $tasks = $this->entityManager->createQueryBuilder()
+            // The boards' columns too: each task shows its status among them, one query for all boards (audit IA-I8).
+            ->select('t', 'c', 'col', 'm', 'u', 'b', 'bc')
+            ->from(Task::class, 't')
+            ->join('t.board', 'b')
+            ->leftJoin('b.columns', 'bc')
+            ->leftJoin('t.creator', 'c')
+            ->leftJoin('t.column', 'col')
+            ->leftJoin('t.members', 'm')
+            ->leftJoin('m.user', 'u')
+            ->where('t.id IN (:ids)')
+            ->setParameter('ids', $ids)
+            ->getQuery()
+            ->getResult();
+        $byId = [];
+        foreach ($tasks as $task) {
+            $byId[$task->getId()] = $task;
+        }
+
+        $ordered = [];
+        foreach ($ids as $id) {
+            if (isset($byId[$id])) {
+                $ordered[] = $byId[$id];
+            }
+        }
+
+        return $ordered;
+    }
+
+    /**
+     * @param list<string> $boardIds
+     * @param list<object> $assignees
+     */
+    private function filtered(array $boardIds, TaskApiTaskFilter $filter, array $assignees, ?object $owner): QueryBuilder
+    {
+        $qb = $this->entityManager->createQueryBuilder()
+            ->from(Task::class, 't')
+            ->where('t.board IN (:boards)')
+            ->setParameter('boards', $boardIds);
+        $qb->andWhere($filter->archived ? 't.archivedAt IS NOT NULL' : 't.archivedAt IS NULL');
+        if (!$filter->subtasks) {
+            $qb->andWhere('t.parent IS NULL');
+        }
+        if (!$filter->includeClosed) {
+            $qb->andWhere('t.completedAt IS NULL');
+        }
+        if ($filter->tags !== []) {
+            // Audit IA-L3: in SQL, so the page and `last_page` cost what any filter costs. Tags are stored as a JSON list of
+            // strings: a quoted name matches one element exactly (case aside for ASCII).
+            $any = [];
+            // MySQL keeps JSON normalised (unicode and slashes unescaped); the others keep Doctrine's encoding.
+            $flags = $this->entityManager->getConnection()->getDatabasePlatform() instanceof AbstractMySQLPlatform ? JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES : 0;
+            foreach (array_values($filter->tags) as $index => $tag) {
+                $any[] = 'LOWER(' . JsonTextFunction::NAME . "(t.tags)) LIKE :tag{$index} ESCAPE '!'";
+                $qb->setParameter('tag' . $index, '%' . strtr(mb_strtolower((string) json_encode($tag, $flags)), ['!' => '!!', '%' => '!%', '_' => '!_']) . '%');
+            }
+            $qb->andWhere(implode(' OR ', $any));
+        }
+        if ($filter->statuses !== []) {
+            $qb->join('t.column', 'statusColumn')->andWhere('LOWER(statusColumn.name) IN (:statuses)')->setParameter('statuses', $filter->statuses);
+        }
+        if ($assignees !== []) {
+            $qb->andWhere('EXISTS (SELECT am.id FROM ' . TaskMember::class . ' am WHERE am.task = t AND am.memberRole = :assigneeRole AND am.user IN (:assignees))')
+                ->setParameter('assignees', $assignees)
+                ->setParameter('assigneeRole', TaskMemberRole::Assignee);
+        }
+        $columns = ['due_date' => 't.dueAt', 'date_created' => 't.createdAt', 'date_updated' => 't.updatedAt', 'date_done' => 't.completedAt'];
+        foreach ($filter->dates as $name => $date) {
+            $field = $columns[substr($name, 0, -3)];
+            $qb->andWhere($field . (str_ends_with($name, '_gt') ? ' > :' : ' < :') . $name)->setParameter($name, $date);
+        }
+        $this->onlyOwn($qb, $owner);
+
+        return $qb;
+    }
+
+    /** My tasks: created by the person, or assigned to them. Watching does not count. */
+    private function onlyOwn(QueryBuilder $qb, ?object $owner): void
+    {
+        if ($owner === null) {
+            return;
+        }
+        $qb->andWhere('t.creator = :owner OR EXISTS (SELECT om.id FROM ' . TaskMember::class . ' om WHERE om.task = t AND om.memberRole = :ownerRole AND om.user = :owner)')
+            ->setParameter('owner', $owner)
+            ->setParameter('ownerRole', TaskMemberRole::Assignee);
+    }
+}
diff --git a/src/Api/Security/TaskApiGuard.php b/src/Api/Security/TaskApiGuard.php
new file mode 100644
index 00000000..5f0b5808
--- /dev/null
+++ b/src/Api/Security/TaskApiGuard.php
@@ -0,0 +1,267 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Security;
+
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiPlanGateInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiWorkspaceInterface;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Repository\TaskBoardRepositoryInterface;
+use Nowo\TaskBoardBundle\Repository\TaskRepositoryInterface;
+use Nowo\TaskBoardBundle\Security\TaskBoardResourceAccessChecker;
+use Nowo\TaskBoardBundle\Service\TaskCommentPolicy;
+use Nowo\TaskBoardBundle\Tenancy\TaskBoardTenant;
+use Nowo\TaskBoardBundle\Tenancy\TaskBoardTenantContext;
+use Stringable;
+
+use function array_filter;
+use function array_map;
+use function array_values;
+use function is_scalar;
+use function method_exists;
+
+/**
+ * Since 2.2.0 (spec 213): every id-based target of the API goes through here, on every request: level ∩ the person's access
+ * ∩ where, deny by default. In this order, and the first failure answers:
+ *
+ * 1. out of reach (missing, outside where, no space for its tenant, no view access, for My tasks not its own): 404, always the same;
+ * 2. the tasks module not in the plan: 403 `PLAN_001`;
+ * 3. the level may not: 403 `TOKEN_001`;
+ * 4. the person may not: 403 `ACCESS_002`.
+ */
+final readonly class TaskApiGuard
+{
+    public function __construct(
+        private TaskBoardRepositoryInterface $boards,
+        private TaskRepositoryInterface $tasks,
+        private TaskBoardResourceAccessChecker $access,
+        private TaskCommentPolicy $comments,
+        private TaskApiWorkspaceInterface $workspace,
+        private TaskApiPlanGateInterface $planGate,
+        // Audit IA-L2: with tenancy, the tenant check the UI makes through TaskBoardTenantContext::owns().
+        private ?TaskBoardTenantContext $tenantContext = null,
+    ) {
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function board(TaskApiPrincipal $principal, string $boardId, TaskApiCapability $capability): TaskBoard
+    {
+        $board = $this->boards->findById($boardId);
+        if (!$board instanceof TaskBoard || !$this->reachesBoard($principal, $board)) {
+            throw TaskApiRefusal::notFound();
+        }
+        $this->requirePlanAndLevel($principal, $board->getTenantKey(), $capability);
+
+        $allowed = match ($capability) {
+            TaskApiCapability::ReadOwn, TaskApiCapability::ReadEverything => true,
+            TaskApiCapability::EditTasks                                  => $this->access->canEditBoard($principal->user, $board),
+            TaskApiCapability::ManageBoards                               => $this->access->canManageBoard($principal->user, $board),
+            default                                                       => false, // asked of a task, not of a board
+        };
+        if (!$allowed) {
+            throw TaskApiRefusal::permissionRefused();
+        }
+
+        return $board;
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function task(TaskApiPrincipal $principal, string $taskId, TaskApiCapability $capability): Task
+    {
+        $task = $this->tasks->findById($taskId);
+        if (
+            !$task instanceof Task
+            || !$this->reachesBoard($principal, $task->getBoard())
+            || !$this->access->canViewTask($principal->user, $task)
+            || ($principal->level === TaskApiLevel::MyTasks && !$this->isOwn($principal->user, $task))
+        ) {
+            throw TaskApiRefusal::notFound();
+        }
+        $this->requirePlanAndLevel($principal, $task->getBoard()->getTenantKey(), $capability);
+
+        $allowed = match ($capability) {
+            TaskApiCapability::ReadOwn, TaskApiCapability::ReadEverything  => true,
+            TaskApiCapability::WorkOnTask, TaskApiCapability::EditTasks    => $this->access->canEditTask($principal->user, $task),
+            TaskApiCapability::Comment                                     => $this->comments->mayComment($principal->user, $task),
+            TaskApiCapability::DeleteTask, TaskApiCapability::ManageBoards => $this->access->canManageBoard($principal->user, $task->getBoard()),
+        };
+        if (!$allowed) {
+            throw TaskApiRefusal::permissionRefused();
+        }
+
+        return $task;
+    }
+
+    /**
+     * Whether the token may open this task, without a word when it may not: for what a page shows of other tasks.
+     */
+    public function canSeeTask(TaskApiPrincipal $principal, Task $task): bool
+    {
+        return $this->reachesBoard($principal, $task->getBoard())
+            && $this->access->canViewTask($principal->user, $task)
+            && ($principal->level !== TaskApiLevel::MyTasks || $this->isOwn($principal->user, $task));
+    }
+
+    /**
+     * "My tasks" (spec): assigned to the person or created by them. Watching, reviewing or being a stakeholder does not count.
+     */
+    public function isOwn(object $user, Task $task): bool
+    {
+        if ($this->sameUser($user, $task->getCreator())) {
+            return true;
+        }
+        foreach ($task->getMembers() as $member) {
+            if ($member->getMemberRole() === TaskMemberRole::Assignee && $this->sameUser($user, $member->getUser())) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private function reachesBoard(TaskApiPrincipal $principal, TaskBoard $board): bool
+    {
+        return $principal->where->reachesBoard($board)
+            && $this->ownsTenant($principal->user, $board->getTenantKey())
+            && $this->workspace->spaceOfTenant($principal, $board->getTenantKey()) !== null
+            && $this->access->canViewBoard($principal->user, $board);
+    }
+
+    /**
+     * A space the token reaches: the host answers for it, and where names its tenant or one of its boards. Reads only.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function space(TaskApiPrincipal $principal, string $spaceId, TaskApiCapability $capability): TaskApiSpace
+    {
+        $space = $this->workspace->space($principal, $spaceId);
+        if (!$space instanceof TaskApiSpace || !$this->touches($principal, $space)) {
+            throw TaskApiRefusal::notFound();
+        }
+        $this->requirePlanAndLevel($principal, $space->tenantKey, $capability);
+
+        return $space;
+    }
+
+    /**
+     * Whether a space of the host may be listed for the token: where names its tenant or one of its boards, and its plan holds
+     * the module. A list leaves the others out, without a word.
+     */
+    public function lists(TaskApiPrincipal $principal, TaskApiSpace $space): bool
+    {
+        return $this->touches($principal, $space) && $this->planGate->allowsTasks($principal->user, $space->tenantKey);
+    }
+
+    /**
+     * The active boards of a tenant the token reaches and the person may view, in the host's order.
+     *
+     * @return list<TaskBoard>
+     */
+    public function visibleBoards(TaskApiPrincipal $principal, ?string $tenantKey): array
+    {
+        $visible = [];
+        foreach ($this->boardsOfTenant($tenantKey) as $board) {
+            if ($principal->where->reachesBoard($board) && $this->ownsTenant($principal->user, $tenantKey) && $this->access->canViewBoard($principal->user, $board)) {
+                $visible[] = $board;
+            }
+        }
+
+        return $visible;
+    }
+
+    /**
+     * Whether an answer kept for this token may be given again: what the write touched is still within reach. A board that
+     * is gone leaves its tenant, which where and the tenant check must still reach. A write that touched no board needs nothing more.
+     */
+    public function mayReplay(TaskApiPrincipal $principal, ?string $tenantKey, ?string $boardId): bool
+    {
+        if ($tenantKey === null && $boardId === null) {
+            return true; // the write touched no board (time logged without a task): the token is all there is to check
+        }
+        $board = $boardId === null ? null : $this->boards->findById($boardId);
+        if ($board instanceof TaskBoard) {
+            return $this->reachesBoard($principal, $board);
+        }
+
+        return ($principal->where->reachesTenant($tenantKey) || ($boardId !== null && $principal->where->namesBoard($boardId)))
+            && $this->ownsTenant($principal->user, $tenantKey);
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function requireLevel(TaskApiPrincipal $principal, TaskApiCapability $capability): void
+    {
+        if (!$capability->allows($principal->level)) {
+            throw TaskApiRefusal::levelRefused();
+        }
+    }
+
+    private function touches(TaskApiPrincipal $principal, TaskApiSpace $space): bool
+    {
+        return $this->ownsTenant($principal->user, $space->tenantKey) && $principal->where->touchesTenant($space->tenantKey, array_map(static fn (TaskBoard $board): string => $board->getId(), $this->boardsOfTenant($space->tenantKey)));
+    }
+
+    /**
+     * @return list<TaskBoard>
+     */
+    private function boardsOfTenant(?string $tenantKey): array
+    {
+        if ($tenantKey !== null) {
+            return $this->boards->findActiveByTenant($tenantKey);
+        }
+
+        return array_values(array_filter($this->boards->findAllActive(), static fn (TaskBoard $board): bool => $board->getTenantKey() === null));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function requirePlanAndLevel(TaskApiPrincipal $principal, ?string $tenantKey, TaskApiCapability $capability): void
+    {
+        if (!$this->planGate->allowsTasks($principal->user, $tenantKey)) {
+            throw TaskApiRefusal::planRefused();
+        }
+        $this->requireLevel($principal, $capability);
+    }
+
+    /**
+     * With tenancy, the bundle's own answer on the tenant, whatever the host's workspace says: the resolver must open the
+     * tenant whose slug is its key for this person, as the UI asks of the tenant in its URL. A board without a tenant is not
+     * served under tenancy, as in the UI.
+     */
+    private function ownsTenant(object $user, ?string $tenantKey): bool
+    {
+        if ($this->tenantContext?->isEnabled() !== true) {
+            return true;
+        }
+
+        return $tenantKey !== null && $this->tenantContext->tenantOfKey($tenantKey, $user) instanceof TaskBoardTenant;
+    }
+
+    private function sameUser(object $user, ?object $other): bool
+    {
+        if ($other === null) {
+            return false; // an erased account is nobody
+        }
+        if ($user === $other) {
+            return true;
+        }
+        $id      = method_exists($user, 'getId') ? $user->getId() : null;
+        $otherId = method_exists($other, 'getId') ? $other->getId() : null;
+
+        return (is_scalar($id) || $id instanceof Stringable) && (is_scalar($otherId) || $otherId instanceof Stringable) && (string) $id === (string) $otherId;
+    }
+}
diff --git a/src/Api/Security/TaskApiIdempotencyListener.php b/src/Api/Security/TaskApiIdempotencyListener.php
new file mode 100644
index 00000000..1a127965
--- /dev/null
+++ b/src/Api/Security/TaskApiIdempotencyListener.php
@@ -0,0 +1,205 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Security;
+
+use JsonException;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiIdempotencyStoreInterface;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiIdempotencyOutcome;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Psr\Clock\ClockInterface;
+use Psr\Log\LoggerInterface;
+use Psr\Log\NullLogger;
+use Symfony\Component\Clock\NativeClock;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
+use Symfony\Component\HttpKernel\Event\ResponseEvent;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Throwable;
+
+use function array_is_list;
+use function hash;
+use function hash_file;
+use function http_build_query;
+use function in_array;
+use function is_array;
+use function json_decode;
+use function json_encode;
+use function ksort;
+use function strlen;
+
+use const JSON_THROW_ON_ERROR;
+use const JSON_UNESCAPED_SLASHES;
+use const JSON_UNESCAPED_UNICODE;
+
+/**
+ * Since 2.2.0 (spec 213, FR-015): a write sent with `Idempotency-Key` and retried within 24 hours gets its first successful
+ * answer again, without running twice. Keys are scoped to the token. The same key with another request is 409 `IDEMP_002`;
+ * while the first one runs, 409 `IDEMP_001`. A refusal or an error is not kept, so a retry is decided afresh. A replay goes
+ * through the whole pipeline first, and answers 404 once the token no longer reaches what the write touched.
+ */
+final readonly class TaskApiIdempotencyListener implements EventSubscriberInterface
+{
+    public const HEADER = 'Idempotency-Key';
+
+    public const TTL_SECONDS = 86400;
+
+    private const CLAIM = '_nowo_task_board_api_idempotency';
+
+    private const TARGET = '_nowo_task_board_api_target';
+
+    private const WRITES = ['POST', 'PUT', 'PATCH', 'DELETE'];
+
+    public function __construct(
+        private TaskApiIdempotencyStoreInterface $store,
+        private TaskApiGuard $guard,
+        private ClockInterface $clock = new NativeClock(),
+        private LoggerInterface $logger = new NullLogger(),
+    ) {
+    }
+
+    public static function getSubscribedEvents(): array
+    {
+        return [
+            KernelEvents::CONTROLLER => ['onController', -8],
+            // Before the pipeline's own response listener: the rate headers are added to a replay too.
+            KernelEvents::RESPONSE => ['onResponse', 8],
+        ];
+    }
+
+    /**
+     * What the write touched, for a replay's access check: the controller tells it once the operation ran.
+     */
+    public static function target(Request $request, ?TaskBoard $board): void
+    {
+        $request->attributes->set(self::TARGET, [$board?->getTenantKey(), $board?->getId()]);
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function onController(ControllerEvent $event): void
+    {
+        $request = $event->getRequest();
+        if (!$event->isMainRequest() || !$request->attributes->getBoolean(TaskApiRequestListener::ROUTE_FLAG) || !in_array($request->getMethod(), self::WRITES, true) || !$request->headers->has(self::HEADER)) {
+            return;
+        }
+        $key = (string) $request->headers->get(self::HEADER);
+        if ($key === '' || strlen($key) > 255) {
+            throw new TaskApiRefusal(400, 'IDEMP_003', 'Invalid Idempotency-Key');
+        }
+        $principal = TaskApiRequestListener::principalOf($request);
+        $scope     = hash('sha256', 'nowo-task-board-api|' . $principal->tokenId);
+        $keyHash   = hash('sha256', $key);
+
+        try {
+            $claim = $this->store->claim($scope, $keyHash, $this->fingerprint($request), $this->clock->now()->modify('+' . self::TTL_SECONDS . ' seconds'));
+        } catch (Throwable $failure) {
+            $this->logger->error('TaskBoard API: the idempotency store failed.', ['bundle' => 'nowo_task_board', 'exception_class' => $failure::class]);
+
+            throw new TaskApiRefusal(503, 'IDEMP_004', 'Idempotency is not available');
+        }
+
+        match ($claim->outcome) {
+            TaskApiIdempotencyOutcome::Claimed   => $request->attributes->set(self::CLAIM, [$scope, $keyHash]),
+            TaskApiIdempotencyOutcome::InFlight  => throw new TaskApiRefusal(409, 'IDEMP_001', 'A request with this key is still running'),
+            TaskApiIdempotencyOutcome::Mismatch  => throw new TaskApiRefusal(409, 'IDEMP_002', 'This key was used for another request'),
+            TaskApiIdempotencyOutcome::Completed => $this->replay($event, $claim->status ?? 200, (string) $claim->body, $claim->tenantKey, $claim->boardId),
+        };
+    }
+
+    public function onResponse(ResponseEvent $event): void
+    {
+        $request = $event->getRequest();
+        $claim   = $request->attributes->get(self::CLAIM);
+        if (!$event->isMainRequest() || !is_array($claim)) {
+            return;
+        }
+        [$scope, $keyHash] = $claim;
+        $response          = $event->getResponse();
+        try {
+            // A 202 (a board deleted in slices) is not an answer to keep: the next call carries on.
+            if ($response->isSuccessful() && $response->getStatusCode() !== Response::HTTP_ACCEPTED) {
+                $target                = $request->attributes->get(self::TARGET);
+                [$tenantKey, $boardId] = is_array($target) ? $target : [null, null];
+                $this->store->complete($scope, $keyHash, $response->getStatusCode(), (string) $response->getContent(), $tenantKey, $boardId);
+            } else {
+                $this->store->release($scope, $keyHash);
+            }
+        } catch (Throwable $failure) {
+            // The write is done; a retry of the same key then answers 409 until the claim is taken over.
+            $this->logger->error('TaskBoard API: the idempotency store failed to keep an answer.', ['bundle' => 'nowo_task_board', 'exception_class' => $failure::class]);
+        }
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function replay(ControllerEvent $event, int $status, string $body, ?string $tenantKey, ?string $boardId): void
+    {
+        if (!$this->guard->mayReplay(TaskApiRequestListener::principalOf($event->getRequest()), $tenantKey, $boardId)) {
+            throw TaskApiRefusal::notFound();
+        }
+        $event->setController(static fn (): Response => new Response($body, $status, ['Content-Type' => 'application/json', 'Idempotency-Replayed' => 'true']));
+    }
+
+    /** Method, path, query and the body with its keys sorted, so that the same JSON written another way is the same request. */
+    private function fingerprint(Request $request): string
+    {
+        $content = (string) $request->getContent();
+        try {
+            $decoded = json_decode($content, true, 64, JSON_THROW_ON_ERROR);
+            $content = (string) json_encode($this->sorted($decoded), JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
+        } catch (JsonException) {
+            // Not JSON: compared as sent.
+        }
+
+        // An upload is part of the request: its bytes, its name and its type (audit IA-L7) count too.
+        foreach ($this->files($request->files->all()) as $name => $file) {
+            $content .= "\n" . $name . ':' . (string) hash_file('sha256', $file->getPathname()) . ':' . hash('sha256', $file->getClientOriginalName() . "\0" . (string) $file->getClientMimeType());
+        }
+        // Audit IA-L5: the query too, sorted, so `?depends_on=B` and `?dependency_of=C` are two requests.
+        $query = $this->sorted($request->query->all());
+
+        return hash('sha256', $request->getMethod() . "\n" . $request->getPathInfo() . "\n" . http_build_query(is_array($query) ? $query : []) . "\n" . $content);
+    }
+
+    /**
+     * @param array<array-key, mixed> $files
+     *
+     * @return array<string, UploadedFile>
+     */
+    private function files(array $files, string $prefix = ''): array
+    {
+        $flat = [];
+        foreach ($files as $name => $file) {
+            if ($file instanceof UploadedFile) {
+                $flat[$prefix . $name] = $file;
+            } elseif (is_array($file)) {
+                $flat += $this->files($file, $prefix . $name . '.');
+            }
+        }
+
+        return $flat;
+    }
+
+    private function sorted(mixed $value): mixed
+    {
+        if (!is_array($value)) {
+            return $value;
+        }
+        if (!array_is_list($value)) {
+            ksort($value);
+        }
+        foreach ($value as $key => $item) {
+            $value[$key] = $this->sorted($item);
+        }
+
+        return $value;
+    }
+}
diff --git a/src/Api/Security/TaskApiRequestListener.php b/src/Api/Security/TaskApiRequestListener.php
new file mode 100644
index 00000000..4e107113
--- /dev/null
+++ b/src/Api/Security/TaskApiRequestListener.php
@@ -0,0 +1,229 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Security;
+
+use LogicException;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiAuthenticatorInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiRateLimiterInterface;
+use Nowo\TaskBoardBundle\Api\TaskApiAuthFailure;
+use Nowo\TaskBoardBundle\Api\TaskApiCredential;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiRateLimitState;
+use Nowo\TaskBoardBundle\Security\TaskBoardAccessCheckerInterface;
+use Psr\Log\LoggerInterface;
+use Psr\Log\NullLogger;
+use Stringable;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Event\ExceptionEvent;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\HttpKernel\Event\ResponseEvent;
+use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Throwable;
+
+use function in_array;
+use function is_scalar;
+use function method_exists;
+use function str_starts_with;
+
+/**
+ * Since 2.2.0 (spec 213): what every API request goes through before its controller, on the API's routes only, and the way
+ * every answer leaves. Below the firewall, so the security user is set. It fails closed: anything it cannot establish is a
+ * refusal, and the credential is never logged or echoed.
+ */
+final readonly class TaskApiRequestListener implements EventSubscriberInterface
+{
+    /** Route default marking the API's routes. */
+    public const ROUTE_FLAG = '_nowo_task_board_api';
+
+    private const PRINCIPAL = '_nowo_task_board_api_principal';
+
+    private const RATE_LIMIT = '_nowo_task_board_api_rate_limit';
+
+    public function __construct(
+        private TaskApiAuthenticatorInterface $authenticator,
+        private TaskApiRateLimiterInterface $rateLimiter,
+        private TaskBoardAccessCheckerInterface $accessChecker,
+        private TokenStorageInterface $tokenStorage,
+        private string $prefix,
+        private LoggerInterface $logger = new NullLogger(),
+    ) {
+    }
+
+    public static function getSubscribedEvents(): array
+    {
+        return [
+            // The firewall is at 8.
+            KernelEvents::REQUEST  => ['onRequest', 7],
+            KernelEvents::RESPONSE => 'onResponse',
+            // Before the firewall's own (1) and the kernel's error page.
+            KernelEvents::EXCEPTION => ['onException', 16],
+        ];
+    }
+
+    public static function principalOf(Request $request): TaskApiPrincipal
+    {
+        $principal = $request->attributes->get(self::PRINCIPAL);
+
+        return $principal instanceof TaskApiPrincipal ? $principal : throw new LogicException('Not an authenticated API request.');
+    }
+
+    public function onRequest(RequestEvent $event): void
+    {
+        $request = $event->getRequest();
+        if (!$event->isMainRequest() || !$request->attributes->getBoolean(self::ROUTE_FLAG)) {
+            return;
+        }
+
+        try {
+            $request->attributes->set(self::PRINCIPAL, $this->enter($request));
+        } catch (TaskApiRefusal $refusal) {
+            $event->setResponse($this->answer($refusal));
+        }
+    }
+
+    public function onResponse(ResponseEvent $event): void
+    {
+        $request = $event->getRequest();
+        if (!$event->isMainRequest() || !$this->isApiRequest($request)) {
+            return;
+        }
+        $response = $event->getResponse();
+        $response->headers->set('Cache-Control', 'no-store, private');
+        $state = $request->attributes->get(self::RATE_LIMIT);
+        if ($state instanceof TaskApiRateLimitState) {
+            $response->headers->set('X-RateLimit-Limit', (string) $state->limit);
+            $response->headers->set('X-RateLimit-Remaining', (string) $state->remaining);
+            $response->headers->set('X-RateLimit-Reset', (string) $state->resetAt);
+        }
+    }
+
+    public function onException(ExceptionEvent $event): void
+    {
+        if (!$event->isMainRequest() || !$this->isApiRequest($event->getRequest())) {
+            return;
+        }
+        $event->setResponse($this->answer($this->refusalFor($event->getThrowable())));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function enter(Request $request): TaskApiPrincipal
+    {
+        $clientIp = (string) $request->getClientIp();
+        $blocked  = $this->rateLimiter->failedTokenState($clientIp);
+        if (!$blocked->accepted) {
+            $request->attributes->set(self::RATE_LIMIT, $blocked);
+
+            throw new TaskApiRefusal(Response::HTTP_TOO_MANY_REQUESTS, 'RATE_002', 'Too many failed tokens');
+        }
+        if (TaskApiCredential::fromRequest($request) === null) {
+            throw new TaskApiRefusal(Response::HTTP_UNAUTHORIZED, 'OAUTH_017', 'Authorization header required');
+        }
+
+        $principal = $this->authenticator->authenticate($request);
+        if ($principal === TaskApiAuthFailure::ApiDisabled) {
+            throw new TaskApiRefusal(Response::HTTP_NOT_FOUND, 'API_001', 'Not found');
+        }
+        if ($principal === TaskApiAuthFailure::Invalid) {
+            $this->rateLimiter->registerFailedToken($clientIp);
+
+            throw $this->invalidToken();
+        }
+        $this->requireSecurityUser($principal);
+        if (!$this->accessChecker->canAccess($principal->user)) {
+            // Audit IA-L1: the same answer as a bad token, and counted as one, so it cannot drive the host's
+            // authenticator without limit.
+            $this->rateLimiter->registerFailedToken($clientIp);
+
+            throw $this->invalidToken();
+        }
+
+        $state = $this->rateLimiter->consume($principal);
+        $request->attributes->set(self::RATE_LIMIT, $state);
+        if (!$state->accepted) {
+            throw new TaskApiRefusal(Response::HTTP_TOO_MANY_REQUESTS, 'RATE_001', 'Rate limit reached');
+        }
+
+        return $principal;
+    }
+
+    /**
+     * Access checkers read the security token, so a principal the firewall does not stand behind would be judged as someone
+     * else, or as nobody.
+     *
+     * @throws TaskApiRefusal
+     */
+    private function requireSecurityUser(TaskApiPrincipal $principal): void
+    {
+        $securityUser = $this->tokenStorage->getToken()?->getUser();
+        if ($securityUser === $principal->user || ($securityUser !== null && $this->idOf($securityUser) !== null && $this->idOf($securityUser) === $this->idOf($principal->user))) {
+            return;
+        }
+        $this->logger->error('TaskBoard API: the security user is not the token\'s user. The API must sit behind a stateless firewall that authenticates the token.', ['bundle' => 'nowo_task_board']);
+
+        throw $this->serverError();
+    }
+
+    private function idOf(object $user): ?string
+    {
+        $id = method_exists($user, 'getId') ? $user->getId() : null;
+
+        return is_scalar($id) || $id instanceof Stringable ? (string) $id : null;
+    }
+
+    private function isApiRequest(Request $request): bool
+    {
+        if ($request->attributes->getBoolean(self::ROUTE_FLAG)) {
+            return true;
+        }
+
+        // No route matched: an unknown path under the prefix answers like the rest of the API.
+        return !$request->attributes->has('_route') && str_starts_with($request->getPathInfo() . '/', $this->prefix . '/');
+    }
+
+    private function refusalFor(Throwable $throwable): TaskApiRefusal
+    {
+        if ($throwable instanceof TaskApiRefusal) {
+            return $throwable;
+        }
+        if ($throwable instanceof HttpExceptionInterface && in_array($throwable->getStatusCode(), [Response::HTTP_NOT_FOUND, Response::HTTP_METHOD_NOT_ALLOWED], true)) {
+            return TaskApiRefusal::notFound();
+        }
+        if ($throwable instanceof AccessDeniedException) {
+            return TaskApiRefusal::permissionRefused();
+        }
+        if ($throwable instanceof AuthenticationException) {
+            return $this->invalidToken();
+        }
+        // The class only: a message may hold user data.
+        $this->logger->error('TaskBoard API: unexpected error.', ['bundle' => 'nowo_task_board', 'exception_class' => $throwable::class]);
+
+        return $this->serverError();
+    }
+
+    private function invalidToken(): TaskApiRefusal
+    {
+        return new TaskApiRefusal(Response::HTTP_UNAUTHORIZED, 'OAUTH_019', 'Token not valid');
+    }
+
+    private function serverError(): TaskApiRefusal
+    {
+        return new TaskApiRefusal(Response::HTTP_INTERNAL_SERVER_ERROR, 'SERVER_001', 'Server error');
+    }
+
+    private function answer(TaskApiRefusal $refusal): JsonResponse
+    {
+        return new JsonResponse(['err' => $refusal->getMessage(), 'ECODE' => $refusal->ecode], $refusal->status);
+    }
+}
diff --git a/src/Api/Serializer/TaskApiIdentitySerializer.php b/src/Api/Serializer/TaskApiIdentitySerializer.php
new file mode 100644
index 00000000..a8a26c8d
--- /dev/null
+++ b/src/Api/Serializer/TaskApiIdentitySerializer.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Serializer;
+
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTeam;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+
+/**
+ * Since 2.2.0 (spec 213): identity in ClickUp's field names. A team lists no members in v1: a documented difference.
+ */
+final class TaskApiIdentitySerializer
+{
+    /**
+     * @return array<string, string|null>
+     */
+    public function user(TaskApiUser $user): array
+    {
+        return [
+            'id'             => $user->id,
+            'username'       => $user->username,
+            'email'          => $user->email,
+            'color'          => $user->color,
+            'profilePicture' => $user->profilePicture,
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function team(TaskApiTeam $team): array
+    {
+        return [
+            'id'      => $team->id,
+            'name'    => $team->name,
+            'color'   => $team->color,
+            'avatar'  => $team->avatar,
+            'members' => [],
+        ];
+    }
+}
diff --git a/src/Api/Serializer/TaskApiReadSerializer.php b/src/Api/Serializer/TaskApiReadSerializer.php
new file mode 100644
index 00000000..56be6b93
--- /dev/null
+++ b/src/Api/Serializer/TaskApiReadSerializer.php
@@ -0,0 +1,413 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Serializer;
+
+use DateTimeInterface;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskPage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+use Nowo\TaskBoardBundle\Entity\BoardColumn;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Enum\TaskDependencyType;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Enum\TaskPriority;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncField;
+
+use function array_key_last;
+use function array_map;
+use function array_values;
+use function base64_encode;
+use function count;
+use function in_array;
+use function rtrim;
+use function str_starts_with;
+use function strtr;
+use function substr;
+use function usort;
+
+/**
+ * Since 2.2.0 (spec 213): what the read API answers, in ClickUp API v2's field names. Dates are Unix milliseconds as strings,
+ * ids are the bundle's and the host's strings. Fields Beacon has no equivalent for are null or empty (docs/API.md).
+ */
+final class TaskApiReadSerializer
+{
+    /** ClickUp's priorities: id, name, colour. */
+    private const PRIORITIES = [
+        'urgent' => ['1', '#f50000'],
+        'high'   => ['2', '#f8ae00'],
+        'normal' => ['3', '#6fddff'],
+        'low'    => ['4', '#d8d8d8'],
+    ];
+
+    private const CHECKLIST_TAG = 'checklist:';
+
+    /** A board is a folderless list: its folder is hidden, as ClickUp shows those. */
+    private const HIDDEN_FOLDER = ['id' => null, 'name' => 'hidden', 'hidden' => true, 'access' => true];
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function space(TaskApiSpace $space): array
+    {
+        return [
+            'id'                 => $space->id,
+            'name'               => $space->name,
+            'private'            => false,
+            'archived'           => false,
+            'statuses'           => [],
+            'multiple_assignees' => true,
+            'features'           => [
+                'due_dates'          => ['enabled' => true],
+                'time_tracking'      => ['enabled' => true],
+                'tags'               => ['enabled' => true],
+                'time_estimates'     => ['enabled' => true],
+                'checklists'         => ['enabled' => true],
+                'dependency_warning' => ['enabled' => true],
+            ],
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function board(TaskBoard $board, TaskApiSpace $space, int $taskCount): array
+    {
+        return [
+            'id'                => $board->getId(),
+            'name'              => $board->getName(),
+            'orderindex'        => 0,
+            'content'           => (string) $board->getDescription(),
+            'status'            => null,
+            'priority'          => null,
+            'assignee'          => null,
+            'task_count'        => $taskCount,
+            'due_date'          => null,
+            'start_date'        => null,
+            'folder'            => self::HIDDEN_FOLDER,
+            'space'             => ['id' => $space->id, 'name' => $space->name, 'access' => true],
+            'archived'          => $board->isArchived(),
+            'override_statuses' => true,
+            'statuses'          => $this->statuses($board),
+        ];
+    }
+
+    /**
+     * The board's columns as statuses: the first is `open`, the last `closed` (its tasks are done), the rest `custom`.
+     *
+     * @return list<array<string, mixed>>
+     */
+    public function statuses(TaskBoard $board): array
+    {
+        $columns = $this->ordered($board);
+
+        return array_map(fn (BoardColumn $column): array => $this->status($column, $columns), $columns);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function task(Task $task, TaskApiTaskPage $page): array
+    {
+        $board       = $task->getBoard();
+        $space       = $page->spaces[$board->getId()];
+        $columns     = $this->ordered($board);
+        $column      = $task->getColumn();
+        $spent       = $task->getTotalTimeSeconds() * 1000 + ($page->manualMinutes[$task->getId()] ?? 0) * 60000;
+        $description = (string) $task->getDescription();
+
+        $data = [
+            'id'               => $task->getId(),
+            'custom_id'        => null,
+            'name'             => $task->getTitle(),
+            'text_content'     => $description,
+            'description'      => $description,
+            'status'           => $column instanceof BoardColumn ? $this->status($column, $columns) : null,
+            'orderindex'       => (string) $task->getPosition(),
+            'date_created'     => $this->ms($task->getCreatedAt()),
+            'date_updated'     => $this->ms($task->getUpdatedAt()),
+            'date_closed'      => $this->ms($task->getCompletedAt()),
+            'date_done'        => $this->ms($task->getCompletedAt()),
+            'archived'         => $task->isArchived(),
+            'creator'          => $this->user($page->profileOf($task->getCreator())),
+            'assignees'        => $this->members($task, $page, TaskMemberRole::Assignee),
+            'group_assignees'  => [],
+            'watchers'         => $this->members($task, $page, TaskMemberRole::Watcher),
+            'checklists'       => $this->checklists($task, $page),
+            'tags'             => array_map(static fn (string $tag): array => ['name' => $tag, 'tag_fg' => null, 'tag_bg' => null], $task->getTags()),
+            'parent'           => $task->getParent()?->getId(),
+            'top_level_parent' => null,
+            'priority'         => $this->priority($task->getPriority()),
+            'due_date'         => $this->ms($task->getDueAt()),
+            'start_date'       => $this->ms($task->getStartAt()),
+            'points'           => null,
+            'time_estimate'    => $task->getEstimatedMinutes() === null ? null : (string) ($task->getEstimatedMinutes() * 60000),
+            'time_spent'       => $spent,
+            'custom_fields'    => $this->fieldValues($task, $page),
+            'dependencies'     => $this->dependencies($task, $page, false),
+            'linked_tasks'     => $this->dependencies($task, $page, true),
+            'team_id'          => $space->teamId,
+            'url'              => null,
+            'list'             => ['id' => $board->getId(), 'name' => $board->getName(), 'access' => true],
+            'project'          => self::HIDDEN_FOLDER,
+            'folder'           => self::HIDDEN_FOLDER,
+            'space'            => ['id' => $space->id],
+        ];
+        if ($page->markdown) {
+            $data['markdown_description'] = $description;
+        }
+
+        return $data;
+    }
+
+    /**
+     * A page of tasks: `{tasks, last_page}`.
+     *
+     * @return array<string, mixed>
+     */
+    public function taskPage(TaskApiTaskPage $page): array
+    {
+        return ['tasks' => array_map(fn (Task $task): array => $this->task($task, $page), $page->tasks), 'last_page' => $page->lastPage];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function comment(TaskComment $comment, ?TaskApiUser $author): array
+    {
+        return [
+            'id'           => $comment->getId(),
+            'comment'      => [['text' => $comment->getBody()]],
+            'comment_text' => $comment->getBody(),
+            'user'         => $this->user($author),
+            'resolved'     => false,
+            'assignee'     => null,
+            'assigned_by'  => null,
+            'reactions'    => [],
+            'date'         => $this->ms($comment->getCreatedAt()),
+            'reply_count'  => 0,
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function field(TaskSyncField $field): array
+    {
+        return [
+            'id'               => $field->getId(),
+            'name'             => $field->getName(),
+            'type'             => $field->getRemoteType(),
+            'type_config'      => $field->getConfig() + ($field->getChoices() !== [] ? ['options' => $field->getChoices()] : []),
+            'date_created'     => $this->ms($field->getUpdatedAt()),
+            'hide_from_guests' => false,
+            'required'         => false,
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function timeEntry(TaskApiTimeEntry $entry, string $teamId): array
+    {
+        return [
+            'id'          => $entry->id,
+            'task'        => $entry->taskId === null ? null : ['id' => $entry->taskId],
+            'wid'         => $teamId,
+            'user'        => ['id' => $entry->userApiId],
+            'billable'    => false,
+            'start'       => $this->ms($entry->start),
+            'end'         => (string) ((int) $this->ms($entry->start) + $entry->durationSeconds * 1000),
+            'duration'    => (string) ($entry->durationSeconds * 1000),
+            'description' => (string) $entry->description,
+        ];
+    }
+
+    /**
+     * @return array<string, string|null>|null
+     */
+    public function user(?TaskApiUser $user): ?array
+    {
+        return $user === null ? null : [
+            'id'             => $user->id,
+            'username'       => $user->username,
+            'email'          => $user->email,
+            'color'          => $user->color,
+            'profilePicture' => $user->profilePicture,
+        ];
+    }
+
+    /**
+     * @param list<BoardColumn> $columns
+     *
+     * @return array<string, mixed>
+     */
+    private function status(BoardColumn $column, array $columns): array
+    {
+        $index = 0;
+        foreach ($columns as $position => $candidate) {
+            if ($candidate === $column) {
+                $index = $position;
+            }
+        }
+        $type = match (true) {
+            $index === array_key_last($columns) => 'closed',
+            $index === 0                        => 'open',
+            default                             => 'custom',
+        };
+
+        return ['id' => $column->getId(), 'status' => $column->getName(), 'color' => $column->getColor(), 'orderindex' => $index, 'type' => $type];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function priority(TaskPriority $priority): array
+    {
+        [$id, $color] = self::PRIORITIES[$priority->value];
+
+        return ['id' => $id, 'priority' => $priority->value, 'color' => $color, 'orderindex' => $id];
+    }
+
+    /**
+     * @return list<array<string, string|null>>
+     */
+    private function members(Task $task, TaskApiTaskPage $page, TaskMemberRole $role): array
+    {
+        $members = [];
+        foreach ($task->getMembers() as $member) {
+            $profile = $member->getMemberRole() === $role ? $this->user($page->profileOf($member->getUser())) : null;
+            if ($profile !== null) {
+                $members[] = $profile;
+            }
+        }
+
+        return $members;
+    }
+
+    /**
+     * Checklist items are subtasks tagged `checklist:<name>` (as a provider sync imports them): one checklist per name.
+     *
+     * @return list<array<string, mixed>>
+     */
+    private function checklists(Task $task, TaskApiTaskPage $page): array
+    {
+        $checklists = [];
+        foreach ($page->subtasks[$task->getId()] ?? [] as $item) {
+            foreach ($item->getTags() as $tag) {
+                if (str_starts_with($tag, self::CHECKLIST_TAG)) {
+                    $checklists[substr($tag, 10)][] = $item;
+                }
+            }
+        }
+        $answer = [];
+        foreach ($checklists as $name => $items) {
+            $resolved = count(array_filter($items, static fn (Task $item): bool => $item->isCompleted()));
+            $answer[] = [
+                'id'         => self::checklistId($task->getId(), (string) $name),
+                'task_id'    => $task->getId(),
+                'name'       => (string) $name,
+                'orderindex' => (string) count($answer),
+                'resolved'   => $resolved,
+                'unresolved' => count($items) - $resolved,
+                'items'      => array_map(fn (Task $item): array => [
+                    'id'         => $item->getId(),
+                    'name'       => $item->getTitle(),
+                    'orderindex' => $item->getPosition(),
+                    'assignee'   => $this->members($item, $page, TaskMemberRole::Assignee)[0] ?? null,
+                    'resolved'   => $item->isCompleted(),
+                    'parent'     => null,
+                    'children'   => [],
+                ], $items),
+            ];
+        }
+
+        return $answer;
+    }
+
+    /**
+     * One checklist of the task by its name; one with no item yet is empty (it is not stored until it has one).
+     *
+     * @return array<string, mixed>
+     */
+    public function checklist(Task $task, TaskApiTaskPage $page, string $name): array
+    {
+        foreach ($this->checklists($task, $page) as $checklist) {
+            if ($checklist['name'] === $name) {
+                return $checklist;
+            }
+        }
+
+        return ['id' => self::checklistId($task->getId(), $name), 'task_id' => $task->getId(), 'name' => $name, 'orderindex' => '0', 'resolved' => 0, 'unresolved' => 0, 'items' => []];
+    }
+
+    /** A checklist has no row of its own: its id names the task and the checklist's name. */
+    public static function checklistId(string $taskId, string $name): string
+    {
+        return 'cl_' . rtrim(strtr(base64_encode($taskId . '|' . $name), '+/', '-_'), '=');
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    private function fieldValues(Task $task, TaskApiTaskPage $page): array
+    {
+        return array_map(static fn ($value): array => [
+            'id'    => $value->getField()->getId(),
+            'name'  => $value->getField()->getName(),
+            'type'  => $value->getField()->getRemoteType(),
+            'value' => $value->getValue(),
+        ], $page->fieldValues[$task->getId()] ?? []);
+    }
+
+    /**
+     * ClickUp's dependencies (`task_id` waits on `depends_on`) or, for `$linked`, its links (related, duplicates).
+     *
+     * @return list<array<string, mixed>>
+     */
+    private function dependencies(Task $task, TaskApiTaskPage $page, bool $linked): array
+    {
+        $answer = [];
+        foreach ($page->dependencies as $dependency) {
+            $source = $dependency->getSourceTask()->getId();
+            $target = $dependency->getTargetTask()->getId();
+            if ($source !== $task->getId() && $target !== $task->getId()) {
+                continue;
+            }
+            $type = $dependency->getDependencyType();
+            if ($linked !== in_array($type, [TaskDependencyType::Related, TaskDependencyType::Duplicates], true)) {
+                continue;
+            }
+            if ($linked) {
+                $answer[] = ['task_id' => $task->getId(), 'link_id' => $source === $task->getId() ? $target : $source, 'date_created' => $this->ms($dependency->getCreatedAt())];
+                continue;
+            }
+            [$waiting, $on] = $type === TaskDependencyType::Blocks ? [$target, $source] : [$source, $target];
+            $answer[]       = ['task_id' => $waiting, 'depends_on' => $on, 'type' => $waiting === $task->getId() ? 1 : 0, 'date_created' => $this->ms($dependency->getCreatedAt())];
+        }
+
+        return $answer;
+    }
+
+    /**
+     * The board's columns by position: a reorder within the same request leaves the loaded collection in its old order.
+     *
+     * @return list<BoardColumn>
+     */
+    private function ordered(TaskBoard $board): array
+    {
+        $columns = array_values($board->getColumns()->toArray());
+        usort($columns, static fn (BoardColumn $a, BoardColumn $b): int => $a->getPosition() <=> $b->getPosition());
+
+        return $columns;
+    }
+
+    private function ms(?DateTimeInterface $date): ?string
+    {
+        return $date?->format('Uv');
+    }
+}
diff --git a/src/Api/TaskApiAuthFailure.php b/src/Api/TaskApiAuthFailure.php
new file mode 100644
index 00000000..6c809788
--- /dev/null
+++ b/src/Api/TaskApiAuthFailure.php
@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+/**
+ * Since 2.2.0 (spec 213): why a request has no principal. `Invalid` is one answer for unknown, revoked, expired, disabled,
+ * erased: a client learns nothing about which. `ApiDisabled`: the host's instance switch.
+ */
+enum TaskApiAuthFailure
+{
+    case Invalid;
+    case ApiDisabled;
+}
diff --git a/src/Api/TaskApiCapability.php b/src/Api/TaskApiCapability.php
new file mode 100644
index 00000000..3124eb0f
--- /dev/null
+++ b/src/Api/TaskApiCapability.php
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+use function in_array;
+
+/**
+ * Since 2.2.0 (spec 213): what an operation asks of the token. Anything a level does not list here is denied.
+ */
+enum TaskApiCapability
+{
+    /** Boards, spaces, identity, and the tasks a level may read: for My tasks, its own. */
+    case ReadOwn;
+
+    /** Every task, comment, member and time entry the person sees. */
+    case ReadEverything;
+
+    /** On a task within reach: status, dates, description, checklists, own time. */
+    case WorkOnTask;
+
+    /** Comment on a task within reach. */
+    case Comment;
+
+    /** Create, edit, assign and move any task, tags, links, files. */
+    case EditTasks;
+
+    /** Delete a task. */
+    case DeleteTask;
+
+    /** Boards and columns: create, edit, delete. */
+    case ManageBoards;
+
+    public function allows(TaskApiLevel $level): bool
+    {
+        return match ($level) {
+            TaskApiLevel::MyTasks => in_array($this, [self::ReadOwn, self::WorkOnTask, self::Comment], true),
+            TaskApiLevel::Read    => in_array($this, [self::ReadOwn, self::ReadEverything], true),
+            TaskApiLevel::Tasks   => $this !== self::ManageBoards,
+            TaskApiLevel::Full    => true,
+        };
+    }
+}
diff --git a/src/Api/TaskApiCredential.php b/src/Api/TaskApiCredential.php
new file mode 100644
index 00000000..362d0bb0
--- /dev/null
+++ b/src/Api/TaskApiCredential.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+use Symfony\Component\HttpFoundation\Request;
+
+use function is_string;
+use function preg_replace;
+use function trim;
+
+/**
+ * Since 2.2.0 (spec 213): the credential of a request. The `Authorization` header only, with or without `Bearer`; never
+ * the query string, where it would reach logs (FR-002).
+ */
+final class TaskApiCredential
+{
+    public static function fromRequest(Request $request): ?string
+    {
+        $header = $request->headers->get('Authorization');
+        if (!is_string($header)) {
+            return null;
+        }
+        $credential = trim((string) preg_replace('/^Bearer(\s+|$)/i', '', trim($header)));
+
+        return $credential === '' ? null : $credential;
+    }
+}
diff --git a/src/Api/TaskApiInput.php b/src/Api/TaskApiInput.php
new file mode 100644
index 00000000..3e652e9a
--- /dev/null
+++ b/src/Api/TaskApiInput.php
@@ -0,0 +1,202 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+use DateTimeImmutable;
+use JsonException;
+use Symfony\Component\HttpFoundation\Request;
+
+use function array_diff_key;
+use function array_is_list;
+use function array_key_exists;
+use function array_keys;
+use function array_map;
+use function in_array;
+use function intdiv;
+use function is_array;
+use function is_bool;
+use function is_int;
+use function is_string;
+use function json_decode;
+use function sort;
+use function strlen;
+use function trim;
+
+use const JSON_BIGINT_AS_STRING;
+use const JSON_THROW_ON_ERROR;
+
+/**
+ * Since 2.2.0 (spec 213): a write's JSON body. Each field an operation reads is marked; what nobody read is listed in the
+ * answer's `warnings`, as `unknown`, or as `not_supported` for ClickUp fields Beacon has no equivalent for. A value of the
+ * wrong type is a 400 naming the field, never a silent default.
+ */
+final class TaskApiInput
+{
+    /** @var array<string, true> */
+    private array $read = [];
+
+    /**
+     * @param array<string, mixed> $fields
+     * @param list<string> $notSupported ClickUp fields this operation knows and ignores
+     */
+    public function __construct(private readonly array $fields, private readonly array $notSupported = [])
+    {
+    }
+
+    /**
+     * @param list<string> $notSupported
+     *
+     * @throws TaskApiRefusal
+     */
+    public static function fromRequest(Request $request, int $maxBytes, array $notSupported = []): self
+    {
+        $content = (string) $request->getContent();
+        if (strlen($content) > $maxBytes) {
+            throw new TaskApiRefusal(400, 'INPUT_001', 'Body too large');
+        }
+        if (trim($content) === '') {
+            return new self([], $notSupported);
+        }
+        try {
+            $decoded = json_decode($content, true, 32, JSON_THROW_ON_ERROR | JSON_BIGINT_AS_STRING);
+        } catch (JsonException) {
+            throw new TaskApiRefusal(400, 'INPUT_001', 'Malformed JSON');
+        }
+        if (!is_array($decoded) || ($decoded !== [] && array_is_list($decoded))) {
+            throw new TaskApiRefusal(400, 'INPUT_001', 'The body must be a JSON object');
+        }
+
+        /* @var array<string, mixed> $decoded */
+        return new self($decoded, $notSupported);
+    }
+
+    public function has(string $name): bool
+    {
+        return array_key_exists($name, $this->fields);
+    }
+
+    /** Whether the body sets any of these fields. */
+    public function hasAny(string ...$names): bool
+    {
+        foreach ($names as $name) {
+            if ($this->has($name)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function string(string $name, bool $required = false): ?string
+    {
+        $value = $this->take($name);
+        if ($value === null) {
+            return $required ? throw self::invalid($name) : null;
+        }
+
+        return is_string($value) ? $value : throw self::invalid($name);
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function bool(string $name): ?bool
+    {
+        $value = $this->take($name);
+
+        return $value === null || is_bool($value) ? $value : throw self::invalid($name);
+    }
+
+    /**
+     * An integer, given as a number or as a string of digits (ClickUp sends both).
+     *
+     * @throws TaskApiRefusal
+     */
+    public function int(string $name): ?int
+    {
+        $value = $this->take($name);
+        if ($value === null || is_int($value)) {
+            return $value;
+        }
+        if (is_string($value) && preg_match('/^-?\d{1,15}$/D', $value) === 1) {
+            return (int) $value;
+        }
+
+        throw self::invalid($name);
+    }
+
+    /**
+     * Unix milliseconds; null when absent or null (a date being cleared: ask {@see self::has()}).
+     *
+     * @throws TaskApiRefusal
+     */
+    public function date(string $name): ?DateTimeImmutable
+    {
+        $ms = $this->int($name);
+
+        return $ms === null ? null : new DateTimeImmutable('@' . intdiv($ms, 1000));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     *
+     * @return list<string>
+     */
+    public function strings(string $name): array
+    {
+        $value = $this->take($name) ?? [];
+        if (!is_array($value) || !array_is_list($value)) {
+            throw self::invalid($name);
+        }
+
+        return array_map(static fn (mixed $item): string => is_string($item) || is_int($item) ? (string) $item : throw self::invalid($name), $value);
+    }
+
+    /**
+     * ClickUp's `{"add": [...], "rem": [...]}`.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return array{add: list<string>, rem: list<string>}
+     */
+    public function addRemove(string $name): array
+    {
+        $value = $this->take($name) ?? [];
+        if (!is_array($value) || array_diff_key($value, ['add' => 0, 'rem' => 0]) !== []) {
+            throw self::invalid($name);
+        }
+        $inner = new self(['add' => $value['add'] ?? [], 'rem' => $value['rem'] ?? []]);
+
+        return ['add' => $inner->strings('add'), 'rem' => $inner->strings('rem')];
+    }
+
+    /**
+     * Fields nobody read, sorted.
+     *
+     * @return list<array{field: string, reason: string}>
+     */
+    public function warnings(): array
+    {
+        $fields = array_keys(array_diff_key($this->fields, $this->read));
+        sort($fields);
+
+        return array_map(fn (string $field): array => ['field' => $field, 'reason' => in_array($field, $this->notSupported, true) ? 'not_supported' : 'unknown'], $fields);
+    }
+
+    private function take(string $name): mixed
+    {
+        $this->read[$name] = true;
+
+        return $this->fields[$name] ?? null;
+    }
+
+    private static function invalid(string $name): TaskApiRefusal
+    {
+        return new TaskApiRefusal(400, 'INPUT_002', 'Invalid ' . $name);
+    }
+}
diff --git a/src/Api/TaskApiLevel.php b/src/Api/TaskApiLevel.php
new file mode 100644
index 00000000..e373e56e
--- /dev/null
+++ b/src/Api/TaskApiLevel.php
@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+/**
+ * Since 2.2.0 (spec 213): what a token may do. Not a chain: **Read** changes nothing and **My tasks** writes on its own
+ * tasks, so ask {@see TaskApiCapability::allows()}, never compare levels.
+ */
+enum TaskApiLevel: string
+{
+    case MyTasks = 'my_tasks';
+    case Read    = 'read';
+    case Tasks   = 'tasks';
+    case Full    = 'full';
+}
diff --git a/src/Api/TaskApiPrincipal.php b/src/Api/TaskApiPrincipal.php
new file mode 100644
index 00000000..25f47e86
--- /dev/null
+++ b/src/Api/TaskApiPrincipal.php
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+/**
+ * Since 2.2.0 (spec 213): who a request is, as the host's authenticator answers it, for this request only. It holds no
+ * secret: `$tokenId` is an opaque id.
+ */
+final readonly class TaskApiPrincipal
+{
+    public function __construct(
+        public object $user,
+        public TaskApiLevel $level,
+        public TaskApiWhere $where,
+        public string $tokenId,
+        public string $tokenName,
+    ) {
+    }
+}
diff --git a/src/Api/TaskApiRefusal.php b/src/Api/TaskApiRefusal.php
new file mode 100644
index 00000000..2576d09f
--- /dev/null
+++ b/src/Api/TaskApiRefusal.php
@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+use RuntimeException;
+
+/**
+ * Since 2.2.0 (spec 213): a request refused, with what the client sees: `{"err": message, "ECODE": ecode}`. The message
+ * goes to the client as it is, so it names no id or person.
+ */
+final class TaskApiRefusal extends RuntimeException
+{
+    public function __construct(public readonly int $status, public readonly string $ecode, string $message)
+    {
+        parent::__construct($message);
+    }
+
+    public static function notFound(): self
+    {
+        return new self(404, 'ACCESS_001', 'Not found');
+    }
+
+    public static function levelRefused(): self
+    {
+        return new self(403, 'TOKEN_001', 'This token may not do this');
+    }
+
+    public static function permissionRefused(): self
+    {
+        return new self(403, 'ACCESS_002', 'You may not do this');
+    }
+
+    public static function planRefused(): self
+    {
+        return new self(403, 'PLAN_001', 'The tasks module is not in this plan');
+    }
+}
diff --git a/src/Api/TaskApiWhere.php b/src/Api/TaskApiWhere.php
new file mode 100644
index 00000000..d0783a4c
--- /dev/null
+++ b/src/Api/TaskApiWhere.php
@@ -0,0 +1,96 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+
+use function in_array;
+
+/**
+ * Since 2.2.0 (spec 213): where a token reaches, as plain data the host builds on each request. Everything the person
+ * can reach, minus some tenants (an organization that forbids tokens), or a list of tenants and boards. The bundle does not
+ * know projects or organizations: the host turns them into tenant keys.
+ */
+final readonly class TaskApiWhere
+{
+    /**
+     * @param list<string> $exceptTenantKeys
+     * @param list<string> $tenantKeys
+     * @param list<string> $boardIds
+     */
+    private function __construct(
+        private bool $everything,
+        private array $exceptTenantKeys,
+        private array $tenantKeys,
+        private array $boardIds,
+    ) {
+    }
+
+    /**
+     * @param list<string> $exceptTenantKeys tenants the host removes
+     */
+    public static function everything(array $exceptTenantKeys = []): self
+    {
+        return new self(true, $exceptTenantKeys, [], []);
+    }
+
+    /**
+     * Each entry grants on its own: a named tenant reaches all its boards, and a named board is reached even when its tenant
+     * is not listed (audit IA-I4, as intended: a token for one board of a project names the board, not the project). The
+     * person's access, the host's workspace and the tenant check still apply to it.
+     *
+     * @param list<string> $tenantKeys
+     * @param list<string> $boardIds
+     */
+    public static function limitedTo(array $tenantKeys, array $boardIds): self
+    {
+        return new self(false, [], $tenantKeys, $boardIds);
+    }
+
+    public function reachesBoard(TaskBoard $board): bool
+    {
+        return $this->reachesTenant($board->getTenantKey()) || (!$this->everything && in_array($board->getId(), $this->boardIds, true));
+    }
+
+    /** Whether the board's id is named, whatever its tenant (a board that no longer exists, for a replay). */
+    public function namesBoard(string $boardId): bool
+    {
+        return !$this->everything && in_array($boardId, $this->boardIds, true);
+    }
+
+    /**
+     * The whole tenant: creating a board there needs this. A board without a tenant is reached only by everything.
+     */
+    public function reachesTenant(?string $tenantKey): bool
+    {
+        if ($this->everything) {
+            return $tenantKey === null || !in_array($tenantKey, $this->exceptTenantKeys, true);
+        }
+
+        return $tenantKey !== null && in_array($tenantKey, $this->tenantKeys, true);
+    }
+
+    /**
+     * Whether a space may be listed: the whole tenant, or one of the given boards of it.
+     *
+     * @param list<string> $boardIdsOfTenant
+     */
+    public function touchesTenant(?string $tenantKey, array $boardIdsOfTenant): bool
+    {
+        if ($this->reachesTenant($tenantKey)) {
+            return true;
+        }
+        if ($this->everything) {
+            return false;
+        }
+        foreach ($boardIdsOfTenant as $boardId) {
+            if (in_array($boardId, $this->boardIds, true)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
diff --git a/src/Api/Value/TaskApiAttachment.php b/src/Api/Value/TaskApiAttachment.php
new file mode 100644
index 00000000..5f8da556
--- /dev/null
+++ b/src/Api/Value/TaskApiAttachment.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): a file the host stored for a task.
+ */
+final readonly class TaskApiAttachment
+{
+    public function __construct(
+        public string $id,
+        public string $title,
+        public string $url,
+        public int $size,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiBoardList.php b/src/Api/Value/TaskApiBoardList.php
new file mode 100644
index 00000000..a3dcdf9d
--- /dev/null
+++ b/src/Api/Value/TaskApiBoardList.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+
+/**
+ * Since 2.2.0 (spec 213): boards of a space with the tasks the token may count in each.
+ */
+final readonly class TaskApiBoardList
+{
+    /**
+     * @param list<TaskBoard> $boards
+     * @param array<string, int> $taskCounts by board id
+     */
+    public function __construct(
+        public TaskApiSpace $space,
+        public array $boards,
+        public array $taskCounts,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiCommentPage.php b/src/Api/Value/TaskApiCommentPage.php
new file mode 100644
index 00000000..1dd37486
--- /dev/null
+++ b/src/Api/Value/TaskApiCommentPage.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+
+/**
+ * Since 2.2.0 (spec 213): a page of comments, newest first, with their authors as the viewer may see them.
+ */
+final readonly class TaskApiCommentPage
+{
+    /**
+     * @param list<TaskComment> $comments
+     * @param array<string, TaskApiUser> $authors by comment id
+     */
+    public function __construct(
+        public array $comments,
+        public array $authors,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiIdempotencyClaim.php b/src/Api/Value/TaskApiIdempotencyClaim.php
new file mode 100644
index 00000000..049b6fe7
--- /dev/null
+++ b/src/Api/Value/TaskApiIdempotencyClaim.php
@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): the answer to a claim; the first answer's data with {@see TaskApiIdempotencyOutcome::Completed}.
+ */
+final readonly class TaskApiIdempotencyClaim
+{
+    public function __construct(
+        public TaskApiIdempotencyOutcome $outcome,
+        public ?int $status = null,
+        public ?string $body = null,
+        public ?string $tenantKey = null,
+        public ?string $boardId = null,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiIdempotencyOutcome.php b/src/Api/Value/TaskApiIdempotencyOutcome.php
new file mode 100644
index 00000000..549023e8
--- /dev/null
+++ b/src/Api/Value/TaskApiIdempotencyOutcome.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): what an idempotency store answers for a key.
+ */
+enum TaskApiIdempotencyOutcome
+{
+    /** The caller goes ahead and then completes or releases the claim. */
+    case Claimed;
+
+    /** The first attempt finished: `$status` and `$body` are its answer. */
+    case Completed;
+
+    /** The first attempt is still running. */
+    case InFlight;
+
+    /** The key was used for a different request. */
+    case Mismatch;
+}
diff --git a/src/Api/Value/TaskApiNewTimeEntry.php b/src/Api/Value/TaskApiNewTimeEntry.php
new file mode 100644
index 00000000..972cf56d
--- /dev/null
+++ b/src/Api/Value/TaskApiNewTimeEntry.php
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use DateTimeImmutable;
+
+/**
+ * Since 2.2.0 (spec 213): a time entry to log (`POST /v2/team/{team_id}/time_entries`).
+ */
+final readonly class TaskApiNewTimeEntry
+{
+    public function __construct(
+        public string $teamId,
+        public DateTimeImmutable $start,
+        public int $durationSeconds,
+        public ?string $description = null,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiRateLimitState.php b/src/Api/Value/TaskApiRateLimitState.php
new file mode 100644
index 00000000..1579fc02
--- /dev/null
+++ b/src/Api/Value/TaskApiRateLimitState.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): a host's answer on a rate limit. `$resetAt`: when the window resets, Unix seconds.
+ */
+final readonly class TaskApiRateLimitState
+{
+    public function __construct(
+        public bool $accepted,
+        public int $limit,
+        public int $remaining,
+        public int $resetAt,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiSpace.php b/src/Api/Value/TaskApiSpace.php
new file mode 100644
index 00000000..f6ac5cdc
--- /dev/null
+++ b/src/Api/Value/TaskApiSpace.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): a ClickUp space: a host's tenant of boards. `$tenantKey` null: boards without a tenant.
+ */
+final readonly class TaskApiSpace
+{
+    public function __construct(
+        public string $id,
+        public string $name,
+        public string $teamId,
+        public ?string $tenantKey,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiTaskFilter.php b/src/Api/Value/TaskApiTaskFilter.php
new file mode 100644
index 00000000..6d8faab0
--- /dev/null
+++ b/src/Api/Value/TaskApiTaskFilter.php
@@ -0,0 +1,151 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+
+use function array_filter;
+use function array_map;
+use function array_values;
+use function ctype_digit;
+use function in_array;
+use function intdiv;
+use function is_array;
+use function is_string;
+use function mb_strtolower;
+use function preg_match;
+use function strtolower;
+
+/**
+ * Since 2.2.0 (spec 213): the filters of `GET /v2/list/{id}/task` and `GET /v2/team/{id}/task`, in ClickUp's names. Parameters
+ * it does not know are ignored on reads; a malformed value is a 400, never a silent "no filter".
+ */
+final readonly class TaskApiTaskFilter
+{
+    public const PAGE_SIZE = 100;
+
+    public const ORDERS = ['id', 'created', 'updated', 'due_date'];
+
+    /**
+     * @param list<string> $statuses lower-case column names
+     * @param list<string> $assigneeIds API ids
+     * @param list<string> $tags
+     * @param array<string, DateTimeImmutable> $dates `due_date_gt` and the like
+     * @param list<string> $spaceIds team endpoint only
+     * @param list<string> $listIds team endpoint only
+     */
+    public function __construct(
+        public int $page = 0,
+        public string $orderBy = 'created',
+        public bool $reverse = false,
+        public bool $subtasks = false,
+        public bool $includeClosed = false,
+        public bool $archived = false,
+        public array $statuses = [],
+        public array $assigneeIds = [],
+        public array $tags = [],
+        public array $dates = [],
+        public bool $markdown = false,
+        public array $spaceIds = [],
+        public array $listIds = [],
+    ) {
+    }
+
+    /**
+     * @param array<string, mixed> $query the request's query, as PHP parses `statuses[]=a&statuses[]=b`
+     *
+     * @throws TaskApiRefusal
+     */
+    public static function fromQuery(array $query): self
+    {
+        $page = $query['page'] ?? '0';
+        if (!is_string($page) || !ctype_digit($page) || (int) $page > 100000) {
+            throw self::invalid('page');
+        }
+        $orderBy = $query['order_by'] ?? 'created';
+        if (!is_string($orderBy) || !in_array($orderBy, self::ORDERS, true)) {
+            throw self::invalid('order_by');
+        }
+        $dates = [];
+        foreach (['due_date', 'date_created', 'date_updated', 'date_done'] as $field) {
+            foreach (['gt', 'lt'] as $side) {
+                $name = $field . '_' . $side;
+                if (isset($query[$name])) {
+                    $dates[$name] = self::milliseconds($query[$name], $name);
+                }
+            }
+        }
+
+        return new self(
+            page: (int) $page,
+            orderBy: $orderBy,
+            reverse: self::flag($query, 'reverse'),
+            subtasks: self::flag($query, 'subtasks'),
+            includeClosed: self::flag($query, 'include_closed'),
+            archived: self::flag($query, 'archived'),
+            statuses: array_map(static fn (string $status): string => mb_strtolower($status), self::list($query, 'statuses')),
+            assigneeIds: self::list($query, 'assignees'),
+            tags: array_map(static fn (string $tag): string => mb_strtolower($tag), self::list($query, 'tags')),
+            dates: $dates,
+            markdown: self::flag($query, 'include_markdown_description'),
+            spaceIds: self::list($query, 'space_ids'),
+            listIds: self::list($query, 'list_ids'),
+        );
+    }
+
+    /**
+     * @param array<string, mixed> $query
+     */
+    public static function flag(array $query, string $name): bool
+    {
+        $value = $query[$name] ?? null;
+        if ($value === null) {
+            return false;
+        }
+        if (!is_string($value) || !in_array(strtolower($value), ['true', 'false', '1', '0'], true)) {
+            throw self::invalid($name);
+        }
+
+        return in_array(strtolower($value), ['true', '1'], true);
+    }
+
+    /**
+     * Unix milliseconds, as ClickUp sends dates.
+     *
+     * @throws TaskApiRefusal
+     */
+    public static function milliseconds(mixed $value, string $name): DateTimeImmutable
+    {
+        if (!is_string($value) || preg_match('/^-?\d{1,15}$/D', $value) !== 1) {
+            throw self::invalid($name);
+        }
+
+        return new DateTimeImmutable('@' . intdiv((int) $value, 1000));
+    }
+
+    /**
+     * @param array<string, mixed> $query
+     *
+     * @return list<string>
+     */
+    private static function list(array $query, string $name): array
+    {
+        $value = $query[$name] ?? [];
+        if (is_string($value)) {
+            $value = [$value];
+        }
+        if (!is_array($value)) {
+            throw self::invalid($name);
+        }
+
+        return array_values(array_filter($value, static fn (mixed $item): bool => is_string($item) && $item !== ''));
+    }
+
+    private static function invalid(string $name): TaskApiRefusal
+    {
+        return new TaskApiRefusal(400, 'INPUT_002', 'Invalid ' . $name);
+    }
+}
diff --git a/src/Api/Value/TaskApiTaskPage.php b/src/Api/Value/TaskApiTaskPage.php
new file mode 100644
index 00000000..018a7a13
--- /dev/null
+++ b/src/Api/Value/TaskApiTaskPage.php
@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncFieldValue;
+
+/**
+ * Since 2.2.0 (spec 213): tasks a token may read, with everything needed to show them, loaded in a fixed number of queries.
+ */
+final readonly class TaskApiTaskPage
+{
+    /**
+     * @param list<Task> $tasks
+     * @param array<string, TaskApiSpace> $spaces by board id
+     * @param array<string, TaskApiUser> $profiles by API id, as the viewer may see them
+     * @param array<int, string> $userIds API id by `spl_object_id()` of each user shown
+     * @param list<TaskDependency> $dependencies
+     * @param array<string, list<Task>> $subtasks by parent id
+     * @param array<string, int> $manualMinutes by task id
+     * @param array<string, list<TaskSyncFieldValue>> $fieldValues by task id
+     */
+    public function __construct(
+        public array $tasks,
+        public bool $lastPage,
+        public array $spaces,
+        public array $profiles,
+        public array $userIds,
+        public array $dependencies,
+        public array $subtasks,
+        public array $manualMinutes,
+        public array $fieldValues,
+        public bool $markdown,
+    ) {
+    }
+
+    /** The profile of a user shown on the page, or null when the host leaves them out. */
+    public function profileOf(?object $user): ?TaskApiUser
+    {
+        if ($user === null) {
+            return null;
+        }
+        $id = $this->userIds[spl_object_id($user)] ?? null;
+
+        return $id === null ? null : ($this->profiles[$id] ?? null);
+    }
+}
diff --git a/src/Api/Value/TaskApiTeam.php b/src/Api/Value/TaskApiTeam.php
new file mode 100644
index 00000000..f851a9cc
--- /dev/null
+++ b/src/Api/Value/TaskApiTeam.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): a ClickUp workspace: the host's account, personal or an organization.
+ */
+final readonly class TaskApiTeam
+{
+    public function __construct(
+        public string $id,
+        public string $name,
+        public ?string $color = null,
+        public ?string $avatar = null,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiTimeEntry.php b/src/Api/Value/TaskApiTimeEntry.php
new file mode 100644
index 00000000..997d65a5
--- /dev/null
+++ b/src/Api/Value/TaskApiTimeEntry.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use DateTimeImmutable;
+
+/**
+ * Since 2.2.0 (spec 213): a time entry as the host's time store answers it.
+ */
+final readonly class TaskApiTimeEntry
+{
+    public function __construct(
+        public string $id,
+        public string $userApiId,
+        public DateTimeImmutable $start,
+        public int $durationSeconds,
+        public ?string $taskId = null,
+        public ?string $description = null,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiTimePage.php b/src/Api/Value/TaskApiTimePage.php
new file mode 100644
index 00000000..a7e0d11f
--- /dev/null
+++ b/src/Api/Value/TaskApiTimePage.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): the entries of one filter.
+ */
+final readonly class TaskApiTimePage
+{
+    /**
+     * @param list<TaskApiTimeEntry> $entries
+     */
+    public function __construct(public array $entries)
+    {
+    }
+}
diff --git a/src/Api/Value/TaskApiTimeQuery.php b/src/Api/Value/TaskApiTimeQuery.php
new file mode 100644
index 00000000..25cd617f
--- /dev/null
+++ b/src/Api/Value/TaskApiTimeQuery.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use DateTimeImmutable;
+
+/**
+ * Since 2.2.0 (spec 213): a filter on the time entries of a team (`GET /v2/team/{team_id}/time_entries`).
+ */
+final readonly class TaskApiTimeQuery
+{
+    /**
+     * @param list<string> $assigneeIds API ids; empty: the token's own
+     */
+    public function __construct(
+        public string $teamId,
+        public ?DateTimeImmutable $from = null,
+        public ?DateTimeImmutable $to = null,
+        public array $assigneeIds = [],
+        public ?string $taskId = null,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiUser.php b/src/Api/Value/TaskApiUser.php
new file mode 100644
index 00000000..fd98cf10
--- /dev/null
+++ b/src/Api/Value/TaskApiUser.php
@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): a person as a viewer may see them. A field the viewer may not see is null.
+ */
+final readonly class TaskApiUser
+{
+    public function __construct(
+        public string $id,
+        public string $username,
+        public ?string $email = null,
+        public ?string $color = null,
+        public ?string $profilePicture = null,
+    ) {
+    }
+}
diff --git a/src/Controller/TaskBoardManageController.php b/src/Controller/TaskBoardManageController.php
index 2a4de892..3903611c 100644
--- a/src/Controller/TaskBoardManageController.php
+++ b/src/Controller/TaskBoardManageController.php
@@ -80,6 +80,7 @@
 use Nowo\TaskBoardBundle\Service\TaskBoardQuota;
 use Nowo\TaskBoardBundle\Service\TaskCalendarBuilder;
 use Nowo\TaskBoardBundle\Service\TaskCommentManager;
+use Nowo\TaskBoardBundle\Service\TaskCommentPolicy;
 use Nowo\TaskBoardBundle\Service\TaskDependencyManager;
 use Nowo\TaskBoardBundle\Service\TaskGanttBuilder;
 use Nowo\TaskBoardBundle\Service\TaskLinkAttacher;
@@ -91,7 +92,6 @@
 use Nowo\TaskBoardBundle\Support\TaskTree;
 use Nowo\TaskBoardBundle\Support\UserIdResolver;
 use Nowo\TaskBoardBundle\Support\UserLabel;
-use Nowo\TaskBoardBundle\Sync\Hook\LimitRefusal;
 use Nowo\TaskBoardBundle\Sync\Hook\SyncLimitCheckerInterface;
 use Nowo\TaskBoardBundle\Tenancy\FirstBoardProvisionerInterface;
 use Nowo\TaskBoardBundle\Tenancy\TaskBoardTenant;
@@ -164,6 +164,7 @@ final class TaskBoardManageController extends AbstractController
      * @param list<string> $columnIcons `board.column_icons` (since 1.11)
      * @param int $maxTasks `board.max_tasks` (since 1.21): the most tasks a board, list, Gantt or task page loads
      */
+    // @phpstan-ignore constructor.unusedParameter ($syncLimits: deprecated, kept for positional callers, audit IA-I1)
     public function __construct(
         private readonly TaskBoardAccessCheckerInterface $accessChecker,
         private readonly TaskBoardRepositoryInterface $boardRepository,
@@ -204,8 +205,9 @@ public function __construct(
         // invalid board create (`board.create_dialog_header`).
         private readonly ?TaskBoardDefaultViewResolverInterface $defaultViewResolver = null,
         private readonly ?string $createDialogHeader = null,
-        // Since 1.27.0 (audit GW-L8): the host's limit of active tasks, asked when a task is restored (with `sync.enabled`).
-        private readonly ?SyncLimitCheckerInterface $syncLimits = null,
+        // Since 1.27.0, deprecated since 2.2.0 and ignored (audit IA-I1): kept in its place so positional arguments do not
+        // move. A restore asks `TaskManager`'s limit, which the container wires from the same `sync.limit_checker`.
+        ?SyncLimitCheckerInterface $syncLimits = null,
         // Since 1.30.0 (spec 211).
         private readonly ?BoardScopeProviderInterface $scopeProvider = null,
         /** @var array<string, mixed> */
@@ -764,13 +766,13 @@ public function restoreTask(string $taskId, Request $request): RedirectResponse
         $task = $this->findTask($taskId, $user, true);
         $this->denyUnlessValidCsrfForm($request, $this->csrfActionForm('task_board_task_restore'));
         // Since 1.29.0: a completed task is not an active task, so restoring it adds nothing to the limit.
-        if ($task->isArchived() && $this->syncLimits?->check($task->getBoard(), $task->isCompleted() ? 0 : 1, 0) instanceof LimitRefusal) {
+        try {
+            if ($this->taskManager->restore($task, $user)) {
+                $this->logWrite('task_restore', ['task_id' => $taskId]);
+                $this->addFlash('success', 'task_board.flash.task_restored');
+            }
+        } catch (TaskReopenRefusedException) {
             $this->addFlash('error', 'task_board.flash.task_restore_refused');
-        } elseif ($task->isArchived()) {
-            $task->restore();
-            $this->taskManager->recordRestored($task, $user);
-            $this->logWrite('task_restore', ['task_id' => $taskId]);
-            $this->addFlash('success', 'task_board.flash.task_restored');
         }
 
         return $this->redirectToRoute($this->routes['list']['name'], ['boardId' => $task->getBoard()->getId()]);
@@ -1367,7 +1369,7 @@ public function editComment(string $taskId, string $commentId, Request $request)
         $task    = $this->findTask($taskId, $user);
         $manager = $this->commentManager ?? throw new NotFoundHttpException('Comments are not available.');
         $comment = $this->findComment($task, $commentId);
-        if (!TaskCommentManager::isAuthor($comment, $user) || !$this->canComment($user, $task)) {
+        if (!$this->commentPolicy()->mayEdit($user, $task, $comment)) {
             throw $this->createAccessDeniedException('Only the author edits a comment.');
         }
 
@@ -1438,15 +1440,19 @@ private function findComment(Task $task, string $commentId): TaskComment
         return $comment;
     }
 
+    private function commentPolicy(): TaskCommentPolicy
+    {
+        return new TaskCommentPolicy($this->resourceAccessChecker, $this->readersCanComment);
+    }
+
     private function canComment(UserInterface $user, Task $task): bool
     {
-        return $this->commentManager instanceof TaskCommentManager
-            && ($this->readersCanComment || $this->resourceAccessChecker->canEditTask($user, $task));
+        return $this->commentManager instanceof TaskCommentManager && $this->commentPolicy()->mayComment($user, $task);
     }
 
     private function canDeleteComment(UserInterface $user, Task $task, TaskComment $comment): bool
     {
-        return TaskCommentManager::isAuthor($comment, $user) || $this->resourceAccessChecker->canEditTask($user, $task);
+        return $this->commentPolicy()->mayDelete($user, $task, $comment);
     }
 
     /**
diff --git a/src/DependencyInjection/Configuration.php b/src/DependencyInjection/Configuration.php
index e8da85f4..816140c8 100644
--- a/src/DependencyInjection/Configuration.php
+++ b/src/DependencyInjection/Configuration.php
@@ -108,6 +108,44 @@ public function getConfigTreeBuilder(): TreeBuilder
                     ->setDeprecated('nowo-tech/task-board-bundle', '1.7', 'The "%node%" option at path "%path%" is deprecated and has no effect; configure the firewall and access_control in your security.yaml instead.')
                     ->defaultValue('main')
                 ->end()
+                ->arrayNode('api')
+                    ->info('Since 2.2.0 (spec 213): a REST API shaped like ClickUp API v2. Off: no route, service, listener or table. See docs/API.md.')
+                    ->addDefaultsIfNotSet()
+                    ->children()
+                        ->booleanNode('enabled')->defaultFalse()->end()
+                        ->scalarNode('prefix')
+                            ->defaultValue('/api/tasks')
+                            ->info('Base path of the API. Not affected by route_prefix or the tenant copies.')
+                            ->validate()
+                                ->ifTrue(static fn (mixed $prefix): bool => !is_string($prefix) || preg_match('#^(/[A-Za-z0-9._-]+)+$#D', $prefix) !== 1)
+                                ->thenInvalid('api.prefix must be a path such as /api/tasks, without a trailing slash.')
+                            ->end()
+                        ->end()
+                        ->booleanNode('host_decides_access')
+                            ->defaultFalse()
+                            ->info('With security.resource_scoping: false every board is open unless a listener denies it. true says the host has those listeners: without it the API refuses to build.')
+                        ->end()
+                        ->booleanNode('quota_listener_required')
+                            ->defaultTrue()
+                            ->info('Board and task creates through the API are refused unless a listener answers QUOTA_CHECK. false: a host with no plan limits.')
+                        ->end()
+                        ->integerNode('max_body_bytes')->defaultValue(1048576)->min(1024)->info('The largest JSON body.')->end()
+                        ->arrayNode('hooks')
+                            ->info('Service ids. Without them every default denies.')
+                            ->addDefaultsIfNotSet()
+                            ->children()
+                                ->scalarNode('authenticator')->defaultNull()->info('Required with enabled: Api\\Hook\\TaskApiAuthenticatorInterface.')->end()
+                                ->scalarNode('rate_limiter')->defaultNull()->info('Api\\Hook\\TaskApiRateLimiterInterface. null: every request 429.')->end()
+                                ->scalarNode('plan_gate')->defaultNull()->info('Api\\Hook\\TaskApiPlanGateInterface. null: 403 PLAN_001.')->end()
+                                ->scalarNode('workspace')->defaultNull()->info('Api\\Hook\\TaskApiWorkspaceInterface. null: every board 404.')->end()
+                                ->scalarNode('users')->defaultNull()->info('Api\\Hook\\TaskApiUsersInterface. null: nobody is known.')->end()
+                                ->scalarNode('time_entries')->defaultNull()->info('Api\\Hook\\TaskApiTimeEntriesInterface. null: 403 TIME_001.')->end()
+                                ->scalarNode('attachments')->defaultNull()->info('Api\\Hook\\TaskApiAttachmentsInterface. null: 403 FILE_001.')->end()
+                                ->scalarNode('idempotency_store')->defaultNull()->info('Api\\Hook\\TaskApiIdempotencyStoreInterface.')->end()
+                            ->end()
+                        ->end()
+                    ->end()
+                ->end()
                 ->arrayNode('security')
                     ->addDefaultsIfNotSet()
                     ->children()
diff --git a/src/DependencyInjection/TaskBoardExtension.php b/src/DependencyInjection/TaskBoardExtension.php
index dd1959b1..15db44c4 100644
--- a/src/DependencyInjection/TaskBoardExtension.php
+++ b/src/DependencyInjection/TaskBoardExtension.php
@@ -6,6 +6,24 @@
 
 use LogicException;
 use Nowo\OutboundUrlGuardBundle\Guard\OutboundUrlGuard;
+use Nowo\TaskBoardBundle\Api\Doctrine\JsonTextFunction;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiAttachments;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiPlanGate;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiRateLimiter;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiTimeEntries;
+use Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiUsers;
+use Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiWorkspace;
+use Nowo\TaskBoardBundle\Api\Hook\ManualTaskApiTimeEntries;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiAttachmentsInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiAuthenticatorInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiIdempotencyStoreInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiPlanGateInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiRateLimiterInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiTimeEntriesInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiUsersInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiWorkspaceInterface;
+use Nowo\TaskBoardBundle\Api\Idempotency\DoctrineTaskApiIdempotencyStore;
+use Nowo\TaskBoardBundle\Api\Repository\TaskApiQueryRepository;
 use Nowo\TaskBoardBundle\Assignee\TaskAssigneeProviderInterface;
 use Nowo\TaskBoardBundle\Bridge\TimeTrack\ImportedTimeAggregatorListener;
 use Nowo\TaskBoardBundle\Bridge\TimeTrack\TaskBoardTaskProvider;
@@ -224,6 +242,53 @@ public function load(array $configs, ContainerBuilder $container): void
         $this->registerTaskNumbersAndCalendar($container, $loader, $config, $emName);
         $this->registerBoardCreation($container, $config['board']);
         $this->registerHostHooks($container, $config);
+        $this->registerApi($container, $loader, $config, $emName);
+    }
+
+    /**
+     * Since 2.2.0 (spec 213): `api.*`. With `enabled: false` nothing is registered: no route, service, listener or parameter.
+     *
+     * @param array<string, mixed> $config
+     */
+    private function registerApi(ContainerBuilder $container, YamlFileLoader $loader, array $config, string $emName): void
+    {
+        $api = $config['api'];
+        if (!$api['enabled']) {
+            return;
+        }
+        if (!is_string($api['hooks']['authenticator']) || $api['hooks']['authenticator'] === '') {
+            throw new LogicException('nowo_task_board.api.enabled needs api.hooks.authenticator: the service id of a Nowo\\TaskBoardBundle\\Api\\Hook\\TaskApiAuthenticatorInterface (the host keeps the tokens).');
+        }
+        if ($config['security']['allow_unauthenticated']) {
+            throw new LogicException('nowo_task_board.api.enabled cannot be used with security.allow_unauthenticated: every board would be open to every token.');
+        }
+        if (!$config['security']['resource_scoping'] && !$api['host_decides_access']) {
+            throw new LogicException('nowo_task_board.api.enabled with security.resource_scoping: false opens every board to every token unless listeners deny it. Set api.host_decides_access: true if yours do.');
+        }
+
+        $container->setParameter('nowo_task_board.api.prefix', $api['prefix']);
+        $container->setParameter('nowo_task_board.api.quota_listener_required', $api['quota_listener_required']);
+        $container->setParameter('nowo_task_board.api.max_body_bytes', $api['max_body_bytes']);
+        $loader->load('services_api.yaml');
+        $container->setAlias(TaskApiAuthenticatorInterface::class, $api['hooks']['authenticator']);
+        $container->setAlias(TaskApiRateLimiterInterface::class, $this->serviceOr($api['hooks']['rate_limiter'], DenyingTaskApiRateLimiter::class));
+        $container->setAlias(TaskApiPlanGateInterface::class, $this->serviceOr($api['hooks']['plan_gate'], DenyingTaskApiPlanGate::class));
+        $container->setAlias(TaskApiWorkspaceInterface::class, $this->serviceOr($api['hooks']['workspace'], EmptyTaskApiWorkspace::class));
+        $container->setAlias(TaskApiUsersInterface::class, $this->serviceOr($api['hooks']['users'], EmptyTaskApiUsers::class));
+        $container->setAlias(TaskApiTimeEntriesInterface::class, $this->serviceOr($api['hooks']['time_entries'], DenyingTaskApiTimeEntries::class));
+        $container->setAlias(TaskApiAttachmentsInterface::class, $this->serviceOr($api['hooks']['attachments'], DenyingTaskApiAttachments::class));
+        if (is_string($api['hooks']['idempotency_store']) && $api['hooks']['idempotency_store'] !== '') {
+            $container->setAlias(TaskApiIdempotencyStoreInterface::class, $api['hooks']['idempotency_store']);
+        } else {
+            // Since 2.2.0: the bundle's own store, on the bundle's entity manager; its table is mapped in prepend().
+            $container->setDefinition(DoctrineTaskApiIdempotencyStore::class, (new Definition(DoctrineTaskApiIdempotencyStore::class))
+                ->setAutowired(true)
+                ->setArgument('$entityManager', new Reference(sprintf('doctrine.orm.%s_entity_manager', $emName))));
+            $container->setAlias(TaskApiIdempotencyStoreInterface::class, DoctrineTaskApiIdempotencyStore::class);
+        }
+        $container->getDefinition(TaskBoardRouteLoader::class)->setArgument('$apiPrefix', $api['prefix']);
+        $container->getDefinition(TaskApiQueryRepository::class)->setArgument('$entityManager', new Reference(sprintf('doctrine.orm.%s_entity_manager', $emName)));
+        $container->getDefinition(ManualTaskApiTimeEntries::class)->setArgument('$entityManager', new Reference(sprintf('doctrine.orm.%s_entity_manager', $emName)));
     }
 
     /**
@@ -417,9 +482,6 @@ private function registerSyncPeople(ContainerBuilder $container, array $sync): v
             ->setArgument('$fullSyncRereadsDetails', (bool) $sync['full_sync_rereads_details']);
         $container->getDefinition(SyncCustomFieldWriter::class)
             ->setArgument('$excludeTypes', $sync['custom_fields']['exclude_types']);
-        // Audit GW-L8: restoring a task by hand asks the host's limit too.
-        $container->getDefinition(TaskBoardManageController::class)
-            ->setArgument('$syncLimits', new Reference(SyncLimitCheckerInterface::class));
         $container->getDefinition(SyncTaskDetailsWriter::class)
             ->setArgument('$maxStatusCalls', (int) $sync['status_history']['max_calls_per_run']);
         $container->getDefinition(TaskBoardTwigExtension::class)
@@ -509,6 +571,19 @@ private function registerTimeTrackIntegration(ContainerBuilder $container, YamlF
         }
     }
 
+    /** Since 2.2.0: whether a host set `api.hooks.idempotency_store` (then the bundle's table is not mapped). */
+    private function apiStoreReplaced(ContainerBuilder $container): bool
+    {
+        foreach ($container->getExtensionConfig(Configuration::ALIAS) as $config) {
+            $store = is_array($config['api'] ?? null) && is_array($config['api']['hooks'] ?? null) ? ($config['api']['hooks']['idempotency_store'] ?? null) : null;
+            if (is_string($store) && $store !== '') {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     private function syncEnabled(ContainerBuilder $container): bool
     {
         return $this->optionEnabled($container, 'sync');
@@ -575,6 +650,28 @@ public function prepend(ContainerBuilder $container): void
             ]);
         }
 
+        // Since 2.2.0 (spec 213, audit IA-L3): the JSON-as-text function of the API's tag filter, only with api.enabled.
+        if ($container->hasExtension('doctrine') && $this->optionEnabled($container, 'api')) {
+            $container->prependExtensionConfig('doctrine', ['orm' => ['dql' => ['string_functions' => [JsonTextFunction::NAME => JsonTextFunction::class]]]]);
+        }
+
+        // Since 2.2.0 (spec 213): the idempotency table, only with api.enabled and the bundle's own store.
+        if ($container->hasExtension('doctrine') && $this->optionEnabled($container, 'api') && !$this->apiStoreReplaced($container)) {
+            $container->prependExtensionConfig('doctrine', [
+                'orm' => [
+                    'mappings' => [
+                        'TaskBoardApi' => [
+                            'type'      => 'attribute',
+                            'is_bundle' => false,
+                            'dir'       => __DIR__ . '/../Api/Entity',
+                            'prefix'    => 'Nowo\\TaskBoardBundle\\Api\\Entity',
+                            'alias'     => 'TaskBoardApi',
+                        ],
+                    ],
+                ],
+            ]);
+        }
+
         // Since 2.1.0 (spec 214): the counter and the ledger are mapped only with task_numbers.enabled.
         if ($container->hasExtension('doctrine') && $this->optionEnabled($container, 'task_numbers')) {
             $container->prependExtensionConfig('doctrine', [
diff --git a/src/Dto/TaskFormData.php b/src/Dto/TaskFormData.php
index 5a0b2124..ba534f31 100644
--- a/src/Dto/TaskFormData.php
+++ b/src/Dto/TaskFormData.php
@@ -5,6 +5,7 @@
 namespace Nowo\TaskBoardBundle\Dto;
 
 use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Entity\Task;
 use Nowo\TaskBoardBundle\Enum\TaskPriority;
 
 /**
@@ -27,4 +28,22 @@ public function __construct(
         public ?DateTimeImmutable $startAt = null,
     ) {
     }
+
+    /**
+     * Since 2.2.0 (spec 213): the task as it stands, for a write that changes only some fields.
+     */
+    public static function fromTask(Task $task): self
+    {
+        return new self(
+            title: $task->getTitle(),
+            description: $task->getDescription(),
+            priority: $task->getPriority(),
+            columnId: $task->getColumn()?->getId(),
+            estimatedMinutes: $task->getEstimatedMinutes(),
+            dueAt: $task->getDueAt(),
+            tags: $task->getTags(),
+            color: $task->getColor(),
+            startAt: $task->getStartAt(),
+        );
+    }
 }
diff --git a/src/Event/BoardUpdatedEvent.php b/src/Event/BoardUpdatedEvent.php
new file mode 100644
index 00000000..9f601368
--- /dev/null
+++ b/src/Event/BoardUpdatedEvent.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Event;
+
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Symfony\Contracts\EventDispatcher\Event;
+
+/**
+ * Since 2.2.0 (spec 213): a board was renamed or its description changed ({@see TaskBoardEvents::BOARD_UPDATED}).
+ */
+final class BoardUpdatedEvent extends Event
+{
+    /**
+     * @param list<string> $changed the fields that changed: `name`, `description`
+     */
+    public function __construct(
+        public readonly TaskBoard $board,
+        public readonly object $actor,
+        public readonly array $changed,
+    ) {
+    }
+}
diff --git a/src/Event/TaskApiWriteEvent.php b/src/Event/TaskApiWriteEvent.php
new file mode 100644
index 00000000..5c84633d
--- /dev/null
+++ b/src/Event/TaskApiWriteEvent.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Event;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Symfony\Contracts\EventDispatcher\Event;
+
+/**
+ * Since 2.2.0 (spec 213): one successful write through the API, after it was saved ({@see TaskBoardEvents::API_WRITE}), for
+ * the host's audit (FR-005). It holds ids and field names, never values, free text or a secret.
+ */
+final class TaskApiWriteEvent extends Event
+{
+    /**
+     * @param string $operation e.g. `task.update`, `board.delete`
+     * @param array<string, string> $targetIds other ids touched
+     * @param list<string> $changedFields field names only
+     */
+    public function __construct(
+        public readonly TaskApiPrincipal $principal,
+        public readonly string $operation,
+        public readonly ?string $tenantKey,
+        public readonly ?string $boardId,
+        public readonly ?string $taskId,
+        public readonly array $targetIds = [],
+        public readonly array $changedFields = [],
+    ) {
+    }
+}
diff --git a/src/Event/TaskBoardEvents.php b/src/Event/TaskBoardEvents.php
index 5c504700..6921e9d7 100644
--- a/src/Event/TaskBoardEvents.php
+++ b/src/Event/TaskBoardEvents.php
@@ -127,6 +127,12 @@ final class TaskBoardEvents
     /** Since 2.0.0: {@see TaskBoardQuotaCheckEvent}, before a board or tasks are written. */
     public const QUOTA_CHECK = 'nowo_task_board.quota_check';
 
+    /** Since 2.2.0 (spec 213): {@see BoardUpdatedEvent}. */
+    public const BOARD_UPDATED = 'nowo_task_board.board_updated';
+
+    /** Since 2.2.0 (spec 213): {@see TaskApiWriteEvent}, one per write through the API. */
+    public const API_WRITE = 'nowo_task_board.api_write';
+
     /** Since 1.28.0: {@see UnmatchedColumnsResolvedEvent}. */
     public const SYNC_UNMATCHED_COLUMNS_RESOLVED = 'nowo_task_board.sync_unmatched_columns_resolved';
 }
diff --git a/src/Exception/TaskLinkedToProviderException.php b/src/Exception/TaskLinkedToProviderException.php
new file mode 100644
index 00000000..9088fd98
--- /dev/null
+++ b/src/Exception/TaskLinkedToProviderException.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Exception;
+
+use RuntimeException;
+
+/**
+ * Since 2.2.0 (spec 213): a task that follows a provider, or has a subtask that does, is not erased on its own: the next
+ * sync would bring it back. Unlink the board first.
+ */
+final class TaskLinkedToProviderException extends RuntimeException
+{
+    public static function forTask(string $taskId): self
+    {
+        return new self('Task ' . $taskId . ' follows a provider.');
+    }
+}
diff --git a/src/Form/BoardColumnFormType.php b/src/Form/BoardColumnFormType.php
index aeb47708..837a30cc 100644
--- a/src/Form/BoardColumnFormType.php
+++ b/src/Form/BoardColumnFormType.php
@@ -8,14 +8,12 @@
 use Nowo\FormKitBundle\Form\FormOptionsTrait;
 use Nowo\TaskBoardBundle\Dto\BoardColumnFormData;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
 use Symfony\Component\Form\Extension\Core\Type\ColorType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
-use Symfony\Component\Validator\Constraints\Length;
-use Symfony\Component\Validator\Constraints\NotBlank;
-use Symfony\Component\Validator\Constraints\Regex;
 
 use function strpos;
 use function substr;
@@ -28,7 +26,7 @@ final class BoardColumnFormType extends AbstractType
 {
     use FormOptionsTrait;
 
-    public const COLOR_PATTERN = '/^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/D';
+    public const COLOR_PATTERN = TaskConstraints::COLOR_PATTERN;
 
     public function buildForm(FormBuilderInterface $builder, array $options): void
     {
@@ -36,14 +34,13 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
             // Since 1.21: an empty or missing name is a NotBlank error, not a TypeError on the DTO (string).
             'empty_data'  => '',
             'label'       => 'task_board.form.column.name',
-            'constraints' => [new NotBlank(), new Length(max: 128)],
+            'constraints' => TaskConstraints::columnName(),
             'attr'        => ['maxlength' => 128],
         ]);
         $this->addWithDefaults($builder, 'color', ColorType::class, [
-            'label'    => 'task_board.form.column.color',
-            'required' => false,
-            // Rendered inside style="…": hex colours only (#rgb, #rgba, #rrggbb, #rrggbbaa).
-            'constraints' => [new Regex(pattern: self::COLOR_PATTERN)],
+            'label'       => 'task_board.form.column.color',
+            'required'    => false,
+            'constraints' => TaskConstraints::columnColor(),
         ]);
 
         // Since 1.11: an icon picked from `board.column_icons` (no field when the list is empty).
diff --git a/src/Form/TaskBoardFormType.php b/src/Form/TaskBoardFormType.php
index ed8f0f90..e7b22565 100644
--- a/src/Form/TaskBoardFormType.php
+++ b/src/Form/TaskBoardFormType.php
@@ -8,8 +8,8 @@
 use Nowo\FormKitBundle\Form\FormOptionsTrait;
 use Nowo\TaskBoardBundle\Board\BoardScope;
 use Nowo\TaskBoardBundle\Dto\TaskBoardFormData;
-use Nowo\TaskBoardBundle\Support\BoardIcon;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
 use Symfony\Component\Form\Extension\Core\Type\FormType;
@@ -20,9 +20,7 @@
 use Symfony\Component\Form\FormInterface;
 use Symfony\Component\Form\FormView;
 use Symfony\Component\OptionsResolver\OptionsResolver;
-use Symfony\Component\Validator\Constraints\Length;
 use Symfony\Component\Validator\Constraints\NotBlank;
-use Symfony\Component\Validator\Constraints\Regex;
 
 use function array_filter;
 use function array_values;
@@ -48,17 +46,14 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
                 'help'        => 'task_board.form.board.icon_help',
                 'required'    => false,
                 'empty_data'  => null,
-                'constraints' => [
-                    new Length(max: BoardIcon::MAX_BYTES, countUnit: Length::COUNT_BYTES, maxMessage: $options['icon_too_long_message']),
-                    new Regex(pattern: BoardIcon::PATTERN, message: $options['icon_invalid_message']),
-                ],
+                'constraints' => TaskConstraints::boardIcon($options['icon_too_long_message'], $options['icon_invalid_message']),
             ] + $options['icon_form_options']);
         }
         $this->addText($builder, 'name', [
             // Since 1.21: an empty or missing name is a NotBlank error, not a TypeError on the DTO (string).
             'empty_data'  => '',
             'label'       => 'task_board.form.board.name',
-            'constraints' => [new NotBlank(), new Length(max: 255)],
+            'constraints' => TaskConstraints::boardName(),
             'attr'        => ['maxlength' => 255],
         ]);
         $this->addText($builder, 'slug', [
@@ -67,7 +62,7 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
             // Since 1.14.1: an empty slug is '' (the board creator derives it from the name), not null.
             'empty_data'  => '',
             'help'        => 'task_board.form.board.slug_help',
-            'constraints' => [new Length(max: 255)],
+            'constraints' => TaskConstraints::boardSlug(),
             'attr'        => ['maxlength' => 255],
         ]);
         // Since 1.30.0 (spec 211): `board.description_form_type` replaces the widget with no Twig override.
diff --git a/src/Form/TaskCommentFormType.php b/src/Form/TaskCommentFormType.php
index 9aba8346..c834e3e7 100644
--- a/src/Form/TaskCommentFormType.php
+++ b/src/Form/TaskCommentFormType.php
@@ -9,14 +9,13 @@
 use Nowo\TaskBoardBundle\Dto\TaskCommentFormData;
 use Nowo\TaskBoardBundle\Entity\TaskComment;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Override;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\HiddenType;
 use Symfony\Component\Form\Extension\Core\Type\TextareaType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
-use Symfony\Component\Validator\Constraints\Length;
-use Symfony\Component\Validator\Constraints\NotBlank;
 
 /**
  * Since 1.16: a task comment — the text (the `nowo-task-board-mention` controller offers @mentions while typing) and
@@ -43,7 +42,7 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
                 'label'       => 'task_board.comment.body',
                 'label_attr'  => ['class' => 'nowo-task-sr-only'],
                 'empty_data'  => '',
-                'constraints' => [new NotBlank(), new Length(max: TaskComment::MAX_LENGTH)],
+                'constraints' => TaskConstraints::commentBody(),
                 'attr'        => [
                     'class'                             => 'form-control nowo-task-comment__input',
                     'rows'                              => 3,
diff --git a/src/Form/TaskFormType.php b/src/Form/TaskFormType.php
index 2a49f457..55fcf469 100644
--- a/src/Form/TaskFormType.php
+++ b/src/Form/TaskFormType.php
@@ -4,7 +4,6 @@
 
 namespace Nowo\TaskBoardBundle\Form;
 
-use DateTimeInterface;
 use Nowo\FormKitBundle\Attribute\FormKitConfig;
 use Nowo\FormKitBundle\Form\FormOptionsTrait;
 use Nowo\TagInputBundle\Form\TagType;
@@ -14,6 +13,7 @@
 use Nowo\TaskBoardBundle\Form\DataTransformer\MinutesToDurationTransformer;
 use Nowo\TaskBoardBundle\Form\DataTransformer\TagsToStringTransformer;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Nowo\TiptapEditorBundle\Form\TiptapEditorType;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\ColorType;
@@ -26,9 +26,6 @@
 use Symfony\Component\Form\FormInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 use Symfony\Component\Validator\Constraints\Callback;
-use Symfony\Component\Validator\Constraints\Length;
-use Symfony\Component\Validator\Constraints\NotBlank;
-use Symfony\Component\Validator\Constraints\Regex;
 use Symfony\Component\Validator\Context\ExecutionContextInterface;
 
 use function class_exists;
@@ -41,10 +38,10 @@ final class TaskFormType extends AbstractType
 {
     use FormOptionsTrait;
     /** Since 1.15: the longest title (task_board_tasks.title is VARCHAR(255)). */
-    public const TITLE_MAX = 255;
+    public const TITLE_MAX = TaskConstraints::TITLE_MAX;
 
     /** Since 1.14: a task colour is #rrggbb (the column holds 7 characters). */
-    public const COLOR_PATTERN = '/^#[0-9a-fA-F]{6}$/D';
+    public const COLOR_PATTERN = TaskConstraints::TASK_COLOR_PATTERN;
 
     public function buildForm(FormBuilderInterface $builder, array $options): void
     {
@@ -54,10 +51,9 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
 
         $this->addText($builder, 'title', [
             // Since 1.21: an empty or missing title is a NotBlank error, not a TypeError on the DTO (string).
-            'empty_data' => '',
-            'label'      => 'task_board.form.task.title',
-            // Since 1.15: the column is VARCHAR(255) — a longer title is a form error, not a database error.
-            'constraints' => [new NotBlank(), new Length(max: self::TITLE_MAX)],
+            'empty_data'  => '',
+            'label'       => 'task_board.form.task.title',
+            'constraints' => TaskConstraints::taskTitle(),
             'attr'        => ['maxlength' => self::TITLE_MAX],
         ]);
 
@@ -116,7 +112,7 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
                 'constraints'     => [new Callback(static function (mixed $startAt, ExecutionContextInterface $context): void {
                     $form  = $context->getObject();
                     $dueAt = $form instanceof FormInterface ? $form->getParent()?->get('dueAt')->getData() : null;
-                    if ($startAt instanceof DateTimeInterface && $dueAt instanceof DateTimeInterface && $startAt > $dueAt) {
+                    if (TaskConstraints::startsAfterDue($startAt, $dueAt)) {
                         $context->buildViolation('task_board.form.task.start_after_due')
                             ->setTranslationDomain('NowoTaskBoardBundle')
                             ->addViolation();
@@ -153,7 +149,7 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
             $this->addWithDefaults($builder, 'color', HiddenType::class, [
                 'label'       => 'task_board.form.task.color',
                 'required'    => false,
-                'constraints' => [new Regex(pattern: self::COLOR_PATTERN)],
+                'constraints' => TaskConstraints::taskColor(),
             ]);
             $this->addWithDefaults($builder, 'customColor', ColorType::class, [
                 'label'    => 'task_board.form.task.custom_color',
diff --git a/src/Form/TaskLinkFormType.php b/src/Form/TaskLinkFormType.php
index 90514732..d8a6a392 100644
--- a/src/Form/TaskLinkFormType.php
+++ b/src/Form/TaskLinkFormType.php
@@ -9,13 +9,11 @@
 use Nowo\TaskBoardBundle\Dto\TaskLinkFormData;
 use Nowo\TaskBoardBundle\Enum\TaskLinkType;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\EnumType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
-use Symfony\Component\Validator\Constraints\Length;
-use Symfony\Component\Validator\Constraints\NotBlank;
-use Symfony\Component\Validator\Constraints\Url;
 
 /**
  * @extends AbstractType<TaskLinkFormData>
@@ -38,24 +36,19 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
             // Since 1.21: an empty or missing URL is a NotBlank error, not a TypeError on the DTO (string).
             'empty_data'  => '',
             'label'       => 'task_board.form.link.url',
-            'constraints' => [
-                new NotBlank(),
-                // Rendered as href: only http(s) — rejects javascript:, data:, vbscript:…
-                new Url(protocols: ['http', 'https'], requireTld: false),
-                new Length(max: 2048),
-            ],
-            'attr' => ['maxlength' => 2048],
+            'constraints' => TaskConstraints::linkUrl(),
+            'attr'        => ['maxlength' => 2048],
         ]);
         $this->addText($builder, 'label', [
             'label'       => 'task_board.form.link.label',
             'required'    => false,
-            'constraints' => [new Length(max: 255)],
+            'constraints' => TaskConstraints::linkLabel(),
             'attr'        => ['maxlength' => 255],
         ]);
         $this->addText($builder, 'externalId', [
             'label'       => 'task_board.form.link.external_id',
             'required'    => false,
-            'constraints' => [new Length(max: 128)],
+            'constraints' => TaskConstraints::linkExternalId(),
             'attr'        => ['maxlength' => 128],
             'help'        => 'task_board.form.link.external_id_help',
         ]);
diff --git a/src/Form/TaskTimeEntryFormType.php b/src/Form/TaskTimeEntryFormType.php
index 4de4e24d..cbaeb539 100644
--- a/src/Form/TaskTimeEntryFormType.php
+++ b/src/Form/TaskTimeEntryFormType.php
@@ -8,6 +8,7 @@
 use Nowo\FormKitBundle\Form\FormOptionsTrait;
 use Nowo\TaskBoardBundle\Dto\TaskTimeEntryFormData;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Override;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\DateType;
@@ -15,9 +16,6 @@
 use Symfony\Component\Form\Extension\Core\Type\TextType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
-use Symfony\Component\Validator\Constraints\Length;
-use Symfony\Component\Validator\Constraints\NotNull;
-use Symfony\Component\Validator\Constraints\Range;
 
 /**
  * Since 1.15: the "Log time" dialog of the task detail — minutes spent, the day and an optional note.
@@ -30,7 +28,7 @@ final class TaskTimeEntryFormType extends AbstractType
     use FormOptionsTrait;
 
     /** At most a week of work in one entry. */
-    public const MAX_MINUTES = 10080;
+    public const MAX_MINUTES = TaskConstraints::MAX_MINUTES;
 
     /**
      * @param FormBuilderInterface<mixed> $builder
@@ -43,21 +41,21 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
             ->add('minutes', IntegerType::class, [
                 'label'       => 'task_board.time.form.minutes',
                 'help'        => 'task_board.time.form.minutes_help',
-                'constraints' => [new NotNull(), new Range(min: 1, max: self::MAX_MINUTES)],
+                'constraints' => TaskConstraints::timeMinutes(),
                 'attr'        => ['class' => 'form-control', 'min' => 1, 'max' => self::MAX_MINUTES, 'inputmode' => 'numeric'],
             ])
             ->add('loggedAt', DateType::class, [
                 'label'           => 'task_board.time.form.date',
                 'widget'          => 'single_text',
                 'input'           => 'datetime_immutable',
-                'constraints'     => [new NotNull()],
+                'constraints'     => TaskConstraints::timeLoggedAt(),
                 'invalid_message' => 'task_board.form.task.due_invalid',
                 'attr'            => ['class' => 'form-control'],
             ])
             ->add('note', TextType::class, [
                 'label'       => 'task_board.time.form.note',
                 'required'    => false,
-                'constraints' => [new Length(max: 512)],
+                'constraints' => TaskConstraints::timeNote(),
                 'attr'        => ['class' => 'form-control', 'maxlength' => 512],
             ]);
     }
diff --git a/src/Resources/config/services.yaml b/src/Resources/config/services.yaml
index 71516f49..50d5df09 100644
--- a/src/Resources/config/services.yaml
+++ b/src/Resources/config/services.yaml
@@ -15,6 +15,9 @@ services:
             - '../../Dto/'
             - '../../Event/'
             - '../../Enum/'
+            - '../../Validation/'
+            # Since 2.2.0 (spec 213): loaded only with `api.enabled` (services_api.yaml).
+            - '../../Api/'
             - '../../Exception/'
             - '../../ValueObject/'
             - '../../Import/Dto/'
@@ -176,6 +179,11 @@ services:
         arguments:
             $defaultColumns: '%nowo_task_board.board.default_columns%'
 
+    # Since 2.2.0 (spec 213): the rules of comments, for every write path.
+    Nowo\TaskBoardBundle\Service\TaskCommentPolicy:
+        arguments:
+            $readersCanComment: '%nowo_task_board.comments.readers_can_comment%'
+
     # Since 1.25: the erase cursor is signed with the application secret (audit FP-L3).
     Nowo\TaskBoardBundle\Service\TaskBoardEraser:
         arguments:
diff --git a/src/Resources/config/services_api.yaml b/src/Resources/config/services_api.yaml
new file mode 100644
index 00000000..575e2f1c
--- /dev/null
+++ b/src/Resources/config/services_api.yaml
@@ -0,0 +1,74 @@
+# Since 2.2.0 (spec 213): the Task API, loaded only with `api.enabled: true`.
+services:
+    _defaults:
+        autowire: true
+        autoconfigure: true
+        public: false
+
+    Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiRateLimiter: ~
+    Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiPlanGate: ~
+    Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiTimeEntries: ~
+    Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiWorkspace: ~
+    Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiUsers: ~
+    Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiAttachments: ~
+
+    Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener:
+        arguments:
+            $prefix: '%nowo_task_board.api.prefix%'
+
+    Nowo\TaskBoardBundle\Api\Serializer\TaskApiIdentitySerializer: ~
+    Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer: ~
+
+    Nowo\TaskBoardBundle\Api\Repository\TaskApiQueryRepository:
+        arguments:
+            $syncEnabled: '%nowo_task_board.sync.enabled%'
+
+    # Public: any in-process caller reaches the operations and the guard without HTTP.
+    Nowo\TaskBoardBundle\Api\Security\TaskApiGuard:
+        public: true
+
+    Nowo\TaskBoardBundle\Api\Operation\TaskApiReadOperations:
+        public: true
+
+    Nowo\TaskBoardBundle\Api\Controller\TaskApiIdentityController:
+        public: true
+        tags: ['controller.service_arguments']
+
+    Nowo\TaskBoardBundle\Api\Controller\TaskApiReadController:
+        public: true
+        tags: ['controller.service_arguments']
+
+    Nowo\TaskBoardBundle\Api\Controller\TaskApiWriteController:
+        public: true
+        tags: ['controller.service_arguments']
+        arguments:
+            $maxBodyBytes: '%nowo_task_board.api.max_body_bytes%'
+
+    Nowo\TaskBoardBundle\Api\Operation\TaskApiAudit:
+        arguments:
+            $quotaListenerRequired: '%nowo_task_board.api.quota_listener_required%'
+
+    Nowo\TaskBoardBundle\Api\Operation\TaskApiTaskOperations:
+        public: true
+
+    Nowo\TaskBoardBundle\Api\Operation\TaskApiChecklistOperations:
+        public: true
+
+    Nowo\TaskBoardBundle\Api\Operation\TaskApiTimeOperations:
+        public: true
+
+    Nowo\TaskBoardBundle\Api\Operation\TaskApiBoardOperations:
+        public: true
+
+    Nowo\TaskBoardBundle\Api\Controller\TaskApiManagementController:
+        public: true
+        tags: ['controller.service_arguments']
+        arguments:
+            $maxBodyBytes: '%nowo_task_board.api.max_body_bytes%'
+
+    # Since 2.2.0: selectable as `api.hooks.time_entries` by a host without its own time store.
+    Nowo\TaskBoardBundle\Api\Hook\ManualTaskApiTimeEntries: ~
+
+    Nowo\TaskBoardBundle\Api\Security\TaskApiIdempotencyListener: ~
+
+    Nowo\TaskBoardBundle\Api\Command\TaskApiPurgeIdempotencyCommand: ~
diff --git a/src/Routing/TaskBoardRouteLoader.php b/src/Routing/TaskBoardRouteLoader.php
index 35eaca1e..25b15cef 100644
--- a/src/Routing/TaskBoardRouteLoader.php
+++ b/src/Routing/TaskBoardRouteLoader.php
@@ -4,6 +4,11 @@
 
 namespace Nowo\TaskBoardBundle\Routing;
 
+use Nowo\TaskBoardBundle\Api\Controller\TaskApiIdentityController;
+use Nowo\TaskBoardBundle\Api\Controller\TaskApiManagementController;
+use Nowo\TaskBoardBundle\Api\Controller\TaskApiReadController;
+use Nowo\TaskBoardBundle\Api\Controller\TaskApiWriteController;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
 use Nowo\TaskBoardBundle\Controller\TaskBoardConnectionController;
 use Nowo\TaskBoardBundle\Controller\TaskBoardManageController;
 use Symfony\Component\Config\Loader\Loader;
@@ -21,6 +26,55 @@
  */
 final class TaskBoardRouteLoader extends Loader
 {
+    /** Since 2.2.0 (spec 213): name => [path after `api.prefix`, controller, action, method (GET when absent)]. */
+    private const API_ROUTES = [
+        'user'          => ['/v2/user', TaskApiIdentityController::class, 'user'],
+        'team'          => ['/v2/team', TaskApiIdentityController::class, 'teams'],
+        'spaces'        => ['/v2/team/{teamId}/space', TaskApiReadController::class, 'spaces'],
+        'team_tasks'    => ['/v2/team/{teamId}/task', TaskApiReadController::class, 'teamTasks'],
+        'time_entries'  => ['/v2/team/{teamId}/time_entries', TaskApiReadController::class, 'timeEntries'],
+        'space'         => ['/v2/space/{spaceId}', TaskApiReadController::class, 'space'],
+        'folders'       => ['/v2/space/{spaceId}/folder', TaskApiReadController::class, 'folders'],
+        'lists'         => ['/v2/space/{spaceId}/list', TaskApiReadController::class, 'lists'],
+        'space_tags'    => ['/v2/space/{spaceId}/tag', TaskApiReadController::class, 'tags'],
+        'list'          => ['/v2/list/{listId}', TaskApiReadController::class, 'list'],
+        'list_tasks'    => ['/v2/list/{listId}/task', TaskApiReadController::class, 'listTasks'],
+        'list_fields'   => ['/v2/list/{listId}/field', TaskApiReadController::class, 'fields'],
+        'task'          => ['/v2/task/{taskId}', TaskApiReadController::class, 'task'],
+        'task_comments' => ['/v2/task/{taskId}/comment', TaskApiReadController::class, 'comments'],
+        'task_members'  => ['/v2/task/{taskId}/member', TaskApiReadController::class, 'members'],
+        // Since 2.2.0 (spec 213): writes.
+        'task_create'       => ['/v2/list/{listId}/task', TaskApiWriteController::class, 'createTask', 'POST'],
+        'task_update'       => ['/v2/task/{taskId}', TaskApiWriteController::class, 'updateTask', 'PUT'],
+        'task_delete'       => ['/v2/task/{taskId}', TaskApiWriteController::class, 'deleteTask', 'DELETE'],
+        'comment_create'    => ['/v2/task/{taskId}/comment', TaskApiWriteController::class, 'addComment', 'POST'],
+        'tag_add'           => ['/v2/task/{taskId}/tag/{tagName}', TaskApiWriteController::class, 'addTag', 'POST'],
+        'tag_remove'        => ['/v2/task/{taskId}/tag/{tagName}', TaskApiWriteController::class, 'removeTag', 'DELETE'],
+        'field_set'         => ['/v2/task/{taskId}/field/{fieldId}', TaskApiWriteController::class, 'setField', 'POST'],
+        'dependency_add'    => ['/v2/task/{taskId}/dependency', TaskApiWriteController::class, 'addDependency', 'POST'],
+        'dependency_remove' => ['/v2/task/{taskId}/dependency', TaskApiWriteController::class, 'removeDependency', 'DELETE'],
+        'link_add'          => ['/v2/task/{taskId}/link/{linksTo}', TaskApiWriteController::class, 'addLink', 'POST'],
+        'link_remove'       => ['/v2/task/{taskId}/link/{linksTo}', TaskApiWriteController::class, 'removeLink', 'DELETE'],
+        'checklist_create'  => ['/v2/task/{taskId}/checklist', TaskApiWriteController::class, 'createChecklist', 'POST'],
+        'checklist_update'  => ['/v2/checklist/{checklistId}', TaskApiWriteController::class, 'updateChecklist', 'PUT'],
+        'checklist_delete'  => ['/v2/checklist/{checklistId}', TaskApiWriteController::class, 'deleteChecklist', 'DELETE'],
+        'item_create'       => ['/v2/checklist/{checklistId}/checklist_item', TaskApiWriteController::class, 'createItem', 'POST'],
+        'item_update'       => ['/v2/checklist/{checklistId}/checklist_item/{itemId}', TaskApiWriteController::class, 'updateItem', 'PUT'],
+        'item_delete'       => ['/v2/checklist/{checklistId}/checklist_item/{itemId}', TaskApiWriteController::class, 'deleteItem', 'DELETE'],
+        'attachment_create' => ['/v2/task/{taskId}/attachment', TaskApiWriteController::class, 'addAttachment', 'POST'],
+        'time_log'          => ['/v2/team/{teamId}/time_entries', TaskApiWriteController::class, 'logTime', 'POST'],
+        'time_delete'       => ['/v2/team/{teamId}/time_entries/{timerId}', TaskApiWriteController::class, 'deleteTime', 'DELETE'],
+        // Since 2.2.0 (spec 213): management. Columns are statuses, on paths of this API's own (owner, Q-O2).
+        'board_create'  => ['/v2/space/{spaceId}/list', TaskApiManagementController::class, 'createBoard', 'POST'],
+        'board_update'  => ['/v2/list/{listId}', TaskApiManagementController::class, 'updateBoard', 'PUT'],
+        'board_delete'  => ['/v2/list/{listId}', TaskApiManagementController::class, 'deleteBoard', 'DELETE'],
+        'status_create' => ['/v2/list/{listId}/status', TaskApiManagementController::class, 'createColumn', 'POST'],
+        // Before status_update: "order" is not a column id.
+        'status_order'  => ['/v2/list/{listId}/status/order', TaskApiManagementController::class, 'reorderColumns', 'PUT'],
+        'status_update' => ['/v2/list/{listId}/status/{statusId}', TaskApiManagementController::class, 'updateColumn', 'PUT'],
+        'status_delete' => ['/v2/list/{listId}/status/{statusId}', TaskApiManagementController::class, 'deleteColumn', 'DELETE'],
+    ];
+
     /** Default base path of the manage routes (routes.index.path). */
     private const DEFAULT_BASE = '/tools/task-board';
 
@@ -38,6 +92,8 @@ public function __construct(
         // Since 2.1.0 (spec 214): these routes exist only with their option, so a host's route lists stay as they are.
         private readonly bool $taskNumbersEnabled = false,
         private readonly bool $calendarEnabled = false,
+        // Since 2.2.0 (spec 213): the API's base path with `api.enabled`; null: no API route at all.
+        private readonly ?string $apiPrefix = null,
     ) {
     }
 
@@ -105,6 +161,7 @@ public function load(mixed $resource, ?string $type = null): RouteCollection
         }
 
         $this->addTenantCopies($collection);
+        $this->addApiRoutes($collection);
 
         return $collection;
     }
@@ -138,6 +195,30 @@ private function addRoute(RouteCollection $collection, string $key, string $acti
         );
     }
 
+    /**
+     * Since 2.2.0 (spec 213): stateless, one path per tenant-free resource: no `route_prefix` and no tenant copies. After the
+     * copies, which only read `routes`.
+     */
+    private function addApiRoutes(RouteCollection $collection): void
+    {
+        if ($this->apiPrefix === null) {
+            return;
+        }
+
+        foreach (self::API_ROUTES as $name => $route) {
+            [$path, $controller, $action] = $route;
+            $collection->add('nowo_task_board_api_' . $name, new Route(
+                $this->apiPrefix . $path,
+                ['_controller' => $controller . '::' . $action, TaskApiRequestListener::ROUTE_FLAG => true, '_stateless' => true],
+                ['teamId' => '[^/]+', 'spaceId' => '[^/]+', 'listId' => '[^/]+', 'taskId' => '[^/]+', 'tagName' => '[^/]+', 'fieldId' => '[^/]+', 'linksTo' => '[^/]+', 'checklistId' => '[^/]+', 'itemId' => '[^/]+', 'timerId' => '[^/]+', 'statusId' => '[^/]+'],
+                [],
+                '',
+                [],
+                [$route[3] ?? 'GET'],
+            ));
+        }
+    }
+
     /**
      * `tenancy.tenant_paths`: every manage route once more per tenant path, with `{tenantSlug}` in its path.
      */
diff --git a/src/Service/TaskBoardEditor.php b/src/Service/TaskBoardEditor.php
new file mode 100644
index 00000000..fd97f1a4
--- /dev/null
+++ b/src/Service/TaskBoardEditor.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Service;
+
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Event\BoardUpdatedEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Repository\TaskBoardRepositoryInterface;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
+
+use function array_filter;
+use function array_keys;
+
+/**
+ * Since 2.2.0 (spec 213): renames a board and edits its description, with {@see TaskBoardEvents::BOARD_UPDATED} when
+ * something changed. The slug stays, as links to the board may hold it. The caller checks access and validates.
+ */
+final readonly class TaskBoardEditor
+{
+    public function __construct(
+        private TaskBoardRepositoryInterface $boardRepository,
+        private ?EventDispatcherInterface $eventDispatcher = null,
+    ) {
+    }
+
+    public function update(TaskBoard $board, string $name, ?string $description, object $actor): void
+    {
+        $changed = array_keys(array_filter([
+            'name'        => $board->getName() !== $name,
+            'description' => $board->getDescription() !== $description,
+        ]));
+        if ($changed === []) {
+            return;
+        }
+
+        $board->setName($name)->setDescription($description);
+        $this->boardRepository->save($board);
+        $this->eventDispatcher?->dispatch(new BoardUpdatedEvent($board, $actor, $changed), TaskBoardEvents::BOARD_UPDATED);
+    }
+}
diff --git a/src/Service/TaskBoardEraser.php b/src/Service/TaskBoardEraser.php
index 6d812a63..70a425e8 100644
--- a/src/Service/TaskBoardEraser.php
+++ b/src/Service/TaskBoardEraser.php
@@ -14,9 +14,11 @@
 use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
 use Nowo\TaskBoardBundle\Event\TaskErasedEvent;
 use Nowo\TaskBoardBundle\Exception\InvalidEraseCursorException;
+use Nowo\TaskBoardBundle\Exception\TaskLinkedToProviderException;
 use Nowo\TaskBoardBundle\Security\EraseCursorSigner;
 use Nowo\TaskBoardBundle\Security\TaskBoardResourceAccessChecker;
 use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncAttachment;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncItem;
 use Nowo\TaskBoardBundle\Sync\TaskBoardSyncService;
 use Psr\Clock\ClockInterface;
 use Psr\Log\LoggerInterface;
@@ -31,6 +33,7 @@
 use function array_intersect_key;
 use function array_keys;
 use function array_map;
+use function array_merge;
 use function bin2hex;
 use function count;
 use function is_scalar;
@@ -111,6 +114,124 @@ public function deleteBoard(TaskBoard $board, object $actor, int $batchSize = 20
         return $this->erase($board, $actor, $batchSize, $cursor, true);
     }
 
+    /**
+     * Since 2.2.0 (spec 213): deletes one task and its subtasks, leaf-first through Doctrine (a database cascade on the
+     * parent would skip the `PreRemove` that keeps their time). Time is kept, detached. Returns how many were deleted.
+     *
+     * @throws AccessDeniedException when the actor may not manage the board
+     * @throws TaskLinkedToProviderException when the task or a subtask follows a provider: nothing is deleted
+     */
+    public function eraseTask(Task $task, object $actor): int
+    {
+        $board = $task->getBoard();
+        if (!$this->accessChecker->canManageBoard($actor, $board)) {
+            throw new AccessDeniedException('The task may not be erased.');
+        }
+        $levels = [[$task]];
+        while (($next = $this->subtasksOf($levels[array_key_last($levels)])) !== []) {
+            $levels[] = $next;
+        }
+        foreach ($levels as $level) {
+            $this->refuseLinked($level);
+        }
+        // Audit IA-M1: the files a sync stored outlive an unlink (GWd-M1), so the host learns of them here, or never.
+        $refs = $this->storedRefsOf(array_merge(...$levels));
+
+        $boardId = $board->getId();
+        $deleted = 0;
+        foreach (array_reverse($levels) as $level) {
+            foreach ($level as $erased) {
+                $this->eventDispatcher?->dispatch(new TaskErasedEvent($erased->getId(), $boardId, $erased->getTitle(), $refs[$erased->getId()] ?? [], count($erased->getTimeEntries())), TaskBoardEvents::TASK_ERASED);
+                $board->getTasks()->removeElement($erased);
+                $erased->getParent()?->getSubtasks()->removeElement($erased);
+                $this->entityManager->remove($erased);
+                ++$deleted;
+            }
+            $this->entityManager->flush();
+        }
+        $this->logger->info('TaskBoard task erased', ['bundle' => 'nowo_task_board', 'board_id' => $boardId, 'tasks' => $deleted]);
+
+        return $deleted;
+    }
+
+    /**
+     * @param list<Task> $tasks
+     *
+     * @return list<Task>
+     */
+    private function subtasksOf(array $tasks): array
+    {
+        /** @var list<Task> $subtasks */
+        $subtasks = $this->entityManager->createQueryBuilder()
+            ->select('t')
+            ->from(Task::class, 't')
+            ->where('t.parent IN (:parents)')
+            ->setParameter('parents', $tasks)
+            ->getQuery()
+            ->getResult();
+
+        return $subtasks;
+    }
+
+    /**
+     * The storage refs of the files a sync stored for the tasks, per task id, read and their rows removed (a database that
+     * does not enforce the foreign key would keep them, with nothing left to name them).
+     *
+     * @param list<Task> $tasks
+     *
+     * @return array<string, list<string>>
+     */
+    private function storedRefsOf(array $tasks): array
+    {
+        if (!$this->syncService instanceof TaskBoardSyncService) {
+            return [];
+        }
+        /** @var list<array{taskId: string, ref: string}> $rows */
+        $rows = $this->entityManager->createQueryBuilder()
+            ->select('IDENTITY(a.task) AS taskId', 'a.storedRef AS ref')
+            ->from(TaskSyncAttachment::class, 'a')
+            ->where('a.task IN (:tasks)')
+            ->setParameter('tasks', $tasks)
+            ->getQuery()
+            ->getArrayResult();
+        $refs = [];
+        foreach ($rows as $row) {
+            $refs[(string) $row['taskId']][] = (string) $row['ref'];
+        }
+        if ($refs !== []) {
+            $this->entityManager->createQueryBuilder()
+                ->delete(TaskSyncAttachment::class, 'a')
+                ->where('a.task IN (:tasks)')
+                ->setParameter('tasks', $tasks)
+                ->getQuery()
+                ->execute();
+        }
+
+        return $refs;
+    }
+
+    /**
+     * @param list<Task> $tasks
+     */
+    private function refuseLinked(array $tasks): void
+    {
+        if (!$this->syncService instanceof TaskBoardSyncService) {
+            return;
+        }
+        /** @var list<array{id: string}> $rows */
+        $rows = $this->entityManager->createQueryBuilder()
+            ->select('IDENTITY(i.task) AS id')
+            ->from(TaskSyncItem::class, 'i')
+            ->where('i.task IN (:tasks)')
+            ->setParameter('tasks', $tasks)
+            ->setMaxResults(1)
+            ->getQuery()
+            ->getArrayResult();
+        if (isset($rows[0])) {
+            throw TaskLinkedToProviderException::forTask((string) $rows[0]['id']);
+        }
+    }
+
     private function erase(TaskBoard $board, object $actor, int $batchSize, ?EraseCursor $cursor, bool $deleteBoard): EraseProgress
     {
         if (!$this->accessChecker->canManageBoard($actor, $board)) {
diff --git a/src/Service/TaskCommentPolicy.php b/src/Service/TaskCommentPolicy.php
new file mode 100644
index 00000000..a631ed3a
--- /dev/null
+++ b/src/Service/TaskCommentPolicy.php
@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Service;
+
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Security\TaskBoardResourceAccessChecker;
+
+/**
+ * Since 2.2.0 (spec 213): who may write, edit and delete a task's comments, for every write path. Readers comment unless
+ * `comments.readers_can_comment` is false; only the author edits; the author or an editor of the task deletes.
+ */
+final readonly class TaskCommentPolicy
+{
+    public function __construct(
+        private TaskBoardResourceAccessChecker $accessChecker,
+        private bool $readersCanComment,
+    ) {
+    }
+
+    public function mayComment(object $user, Task $task): bool
+    {
+        return $this->readersCanComment || $this->accessChecker->canEditTask($user, $task);
+    }
+
+    public function mayEdit(object $user, Task $task, TaskComment $comment): bool
+    {
+        return TaskCommentManager::isAuthor($comment, $user) && $this->mayComment($user, $task);
+    }
+
+    public function mayDelete(object $user, Task $task, TaskComment $comment): bool
+    {
+        return TaskCommentManager::isAuthor($comment, $user) || $this->accessChecker->canEditTask($user, $task);
+    }
+}
diff --git a/src/Service/TaskDependencyManager.php b/src/Service/TaskDependencyManager.php
index c658c515..60c3a56b 100644
--- a/src/Service/TaskDependencyManager.php
+++ b/src/Service/TaskDependencyManager.php
@@ -92,6 +92,23 @@ public function remove(Task $task, string $dependencyId, object $user): bool
         return false;
     }
 
+    /**
+     * Since 2.2.0 (spec 213): the dependencies joining the two tasks, in either direction.
+     *
+     * @return list<TaskDependency>
+     */
+    public function findBetween(Task $task, Task $other): array
+    {
+        $found = [];
+        foreach ([...$task->getOutgoingDependencies(), ...$task->getIncomingDependencies()] as $dependency) {
+            if ($dependency->getSourceTask()->getId() === $other->getId() || $dependency->getTargetTask()->getId() === $other->getId()) {
+                $found[] = $dependency;
+            }
+        }
+
+        return $found;
+    }
+
     /**
      * Every dependency of the given tasks, once.
      *
diff --git a/src/Service/TaskManager.php b/src/Service/TaskManager.php
index 29f2746c..8b237f1c 100644
--- a/src/Service/TaskManager.php
+++ b/src/Service/TaskManager.php
@@ -446,6 +446,53 @@ private function nextPosition(TaskBoard $board, ?BoardColumn $column): int
         return $max + 1;
     }
 
+    /**
+     * Since 2.2.0 (spec 213): makes an archived task active again, asking the host's limit when it adds an active task (a
+     * completed one adds nothing). False when the task is not archived.
+     *
+     * @throws TaskReopenRefusedException when the host's limit refuses it: nothing changes
+     */
+    public function restore(Task $task, object $user): bool
+    {
+        if (!$task->isArchived()) {
+            return false;
+        }
+        $refusal = $this->limits?->check($task->getBoard(), $task->isCompleted() ? 0 : 1, 0);
+        if ($refusal instanceof LimitRefusal) {
+            throw new TaskReopenRefusedException($refusal);
+        }
+
+        $task->restore();
+        $this->recordRestored($task, $user);
+
+        return true;
+    }
+
+    /**
+     * Since 2.2.0 (spec 213, audit IA-L6): the host's answer on `$newTasks` more active tasks on the board, asked before a write
+     * that saves in several steps, so that no step is saved before a later one is refused. Null: allowed, or no limit.
+     */
+    public function activeTaskRefusal(TaskBoard $board, int $newTasks): ?LimitRefusal
+    {
+        return $newTasks > 0 ? $this->limits?->check($board, $newTasks, 0) : null;
+    }
+
+    /**
+     * Since 2.2.0 (spec 213): archives a task by hand, with its history. False when it already is.
+     */
+    public function archive(Task $task, object $user): bool
+    {
+        if ($task->isArchived()) {
+            return false;
+        }
+
+        $task->archive();
+        $this->changeRecorder->record($task, $user, TaskChangeType::Archived, null, 'manual');
+        $this->taskRepository->save($task);
+
+        return true;
+    }
+
     /**
      * Since 1.23: records and saves a restored task.
      */
diff --git a/src/Validation/TaskConstraints.php b/src/Validation/TaskConstraints.php
new file mode 100644
index 00000000..92d9c869
--- /dev/null
+++ b/src/Validation/TaskConstraints.php
@@ -0,0 +1,155 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Validation;
+
+use DateTimeInterface;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Support\BoardIcon;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\Constraints\Length;
+use Symfony\Component\Validator\Constraints\NotBlank;
+use Symfony\Component\Validator\Constraints\NotNull;
+use Symfony\Component\Validator\Constraints\Range;
+use Symfony\Component\Validator\Constraints\Regex;
+use Symfony\Component\Validator\Constraints\Url;
+
+/**
+ * Since 2.2.0 (spec 213): the rules of the fields a write takes, in one place, so that a write that does not go through
+ * a form cannot store what the form refuses (a title over the column's size, a `javascript:` link, a colour that breaks
+ * out of `style="…"`). The form types use these and only add their labels and widgets.
+ */
+final class TaskConstraints
+{
+    /** The `task_board_tasks.title` column. */
+    public const TITLE_MAX = 255;
+
+    /** Rendered inside style="…": hex colours only (#rgb, #rgba, #rrggbb, #rrggbbaa). */
+    public const COLOR_PATTERN = '/^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/D';
+
+    /** A task colour is #rrggbb (the column holds 7 characters). */
+    public const TASK_COLOR_PATTERN = '/^#[0-9a-fA-F]{6}$/D';
+
+    /** At most a week of work in one time entry. */
+    public const MAX_MINUTES = 10080;
+
+    public const COLUMN_NAME_MAX = 128;
+
+    public const NOTE_MAX = 512;
+
+    public const URL_MAX = 2048;
+
+    public const LABEL_MAX = 255;
+
+    public const EXTERNAL_ID_MAX = 128;
+
+    public const BOARD_TEXT_MAX = 255;
+
+    public const TAG_MAX = 64;
+
+    /** @return list<Constraint> */
+    public static function taskTitle(): array
+    {
+        // Since 1.15: the column is VARCHAR(255) — a longer title is an error, not a database error.
+        return [new NotBlank(), new Length(max: self::TITLE_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function taskColor(): array
+    {
+        return [new Regex(pattern: self::TASK_COLOR_PATTERN)];
+    }
+
+    /** @return list<Constraint> */
+    public static function tagName(): array
+    {
+        return [new NotBlank(), new Length(max: self::TAG_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function boardName(): array
+    {
+        return [new NotBlank(), new Length(max: self::BOARD_TEXT_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function boardSlug(): array
+    {
+        return [new Length(max: self::BOARD_TEXT_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function boardIcon(string $tooLongMessage, string $invalidMessage): array
+    {
+        return [
+            new Length(max: BoardIcon::MAX_BYTES, countUnit: Length::COUNT_BYTES, maxMessage: $tooLongMessage),
+            new Regex(pattern: BoardIcon::PATTERN, message: $invalidMessage),
+        ];
+    }
+
+    /** @return list<Constraint> */
+    public static function columnName(): array
+    {
+        return [new NotBlank(), new Length(max: self::COLUMN_NAME_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function columnColor(): array
+    {
+        return [new Regex(pattern: self::COLOR_PATTERN)];
+    }
+
+    /** @return list<Constraint> */
+    public static function commentBody(): array
+    {
+        return [new NotBlank(), new Length(max: TaskComment::MAX_LENGTH)];
+    }
+
+    /** @return list<Constraint> */
+    public static function timeMinutes(): array
+    {
+        return [new NotNull(), new Range(min: 1, max: self::MAX_MINUTES)];
+    }
+
+    /** @return list<Constraint> */
+    public static function timeLoggedAt(): array
+    {
+        return [new NotNull()];
+    }
+
+    /** @return list<Constraint> */
+    public static function timeNote(): array
+    {
+        return [new Length(max: self::NOTE_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function linkUrl(): array
+    {
+        return [
+            new NotBlank(),
+            // Rendered as href: only http(s) — rejects javascript:, data:, vbscript:…
+            new Url(protocols: ['http', 'https'], requireTld: false),
+            new Length(max: self::URL_MAX),
+        ];
+    }
+
+    /** @return list<Constraint> */
+    public static function linkLabel(): array
+    {
+        return [new Length(max: self::LABEL_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function linkExternalId(): array
+    {
+        return [new Length(max: self::EXTERNAL_ID_MAX)];
+    }
+
+    /** The rule of a task's dates: a start after the due date is an error. Either may be absent. */
+    public static function startsAfterDue(mixed $startAt, mixed $dueAt): bool
+    {
+        return $startAt instanceof DateTimeInterface && $dueAt instanceof DateTimeInterface && $startAt > $dueAt;
+    }
+}
diff --git a/tests/Functional/Api/ApiBoardCreateCheckTest.php b/tests/Functional/Api/ApiBoardCreateCheckTest.php
new file mode 100644
index 00000000..4329ecf1
--- /dev/null
+++ b/tests/Functional/Api/ApiBoardCreateCheckTest.php
@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+
+/**
+ * Spec 213 S6: a board is created only where the host's create check allows it, as the UI's New board.
+ */
+final class ApiBoardCreateCheckTest extends ApiTestCase
+{
+    /** A checker that is not tenant-aware is asked without the tenant, as the UI asks it. */
+    public static bool $plainChecker = false;
+
+    protected function setUp(): void
+    {
+        static::$hostConfig = ['security' => self::$plainChecker ? ['access_checker' => 'app.plain_checker'] : ['create_roles' => ['ROLE_ADMIN']]];
+        parent::setUp();
+        ApiTestHost::$tenants = ['tenant-a'];
+    }
+
+    public function testAPersonWhoMayNotCreateHereIsRefused(): void
+    {
+        $this->issueToken();
+
+        $this->send('POST', '/api/tasks/v2/space/space-tenant-a/list', ['name' => 'Refused']);
+
+        $this->assertRefused(403, 'ACCESS_002');
+        self::assertSame([], $this->em->getRepository(TaskBoard::class)->findAll());
+    }
+
+    public function testACheckerThatIsNotTenantAwareIsAskedToo(): void
+    {
+        self::$plainChecker = true;
+        self::ensureKernelShutdown();
+        $this->setUp();
+        $this->issueToken();
+
+        try {
+            $this->send('POST', '/api/tasks/v2/space/space-tenant-a/list', ['name' => 'Refused']);
+        } finally {
+            self::$plainChecker = false;
+        }
+
+        $this->assertRefused(403, 'ACCESS_002');
+    }
+}
diff --git a/tests/Functional/Api/ApiFilesAndTimeTest.php b/tests/Functional/Api/ApiFilesAndTimeTest.php
new file mode 100644
index 00000000..7bbd8dac
--- /dev/null
+++ b/tests/Functional/Api/ApiFilesAndTimeTest.php
@@ -0,0 +1,188 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+
+use function file_put_contents;
+use function sys_get_temp_dir;
+use function tempnam;
+
+/**
+ * Spec 213 S5: files through the host's upload checks (FR-014), time through the host's time store, never deleted.
+ */
+final class ApiFilesAndTimeTest extends ApiTestCase
+{
+    private TaskBoard $roadmap;
+
+    private Task $own;
+
+    private Task $theirs;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ApiTestHost::$tenants = ['tenant-a'];
+        $colleague            = $this->user('colleague@example.com');
+        $this->roadmap        = $this->board('Roadmap', tenantKey: 'tenant-a');
+        $this->own            = $this->task($this->roadmap, 'Own');
+        $this->theirs         = new Task(board: $this->roadmap, title: 'Theirs', creator: $colleague);
+        $this->em->persist($this->theirs);
+        $this->em->flush();
+        $this->issueToken();
+    }
+
+    public function testAFileGoesToTheHostsStore(): void
+    {
+        $this->upload($this->own, 'notes.txt', 'hello');
+
+        self::assertResponseIsSuccessful();
+        $json = $this->json();
+        self::assertSame(['file-1', 'notes.txt', 'txt', '/files/file-1'], [$json['id'], $json['title'], $json['extension'], $json['url']]);
+        self::assertSame([[$this->own->getId(), 'notes.txt', 'hello']], ApiTestHost::$stored);
+    }
+
+    public function testExtraFormFieldsAreWarnedAbout(): void
+    {
+        $path = (string) tempnam(sys_get_temp_dir(), 'tb-api');
+        file_put_contents($path, 'x');
+        $this->client->request('POST', '/api/tasks/v2/task/' . $this->own->getId() . '/attachment', ['filename' => 'renamed.txt', 'other' => '1'], ['attachment' => new UploadedFile($path, 'x.txt', null, null, true)], ['HTTP_AUTHORIZATION' => self::TOKEN]);
+
+        self::assertSame([['field' => 'filename', 'reason' => 'not_supported'], ['field' => 'other', 'reason' => 'unknown']], $this->json()['warnings']);
+    }
+
+    public function testAFileRefusedByTheHostOrMissingIsRefused(): void
+    {
+        ApiTestHost::$refuseUploads = true;
+        $this->upload($this->own, 'big.bin', 'x');
+        $this->assertRefused(403, 'FILE_002');
+
+        $this->client->request('POST', '/api/tasks/v2/task/' . $this->own->getId() . '/attachment', [], [], ['HTTP_AUTHORIZATION' => self::TOKEN]);
+        $this->assertRefused(400, 'INPUT_002');
+    }
+
+    public function testFilesNeedTheTasksLevel(): void
+    {
+        $this->issueToken(TaskApiLevel::MyTasks);
+        $this->upload($this->own, 'a.txt', 'a');
+        $this->assertRefused(403, 'TOKEN_001');
+        $this->upload($this->theirs, 'a.txt', 'a');
+        $this->assertRefused(404, 'ACCESS_001');
+        self::assertSame([], ApiTestHost::$stored);
+    }
+
+    public function testAnUploadIsOneRequestForIdempotency(): void
+    {
+        $this->upload($this->own, 'a.txt', 'first', 'up-1');
+        $this->upload($this->own, 'a.txt', 'first', 'up-1');
+        self::assertSame('true', $this->client->getResponse()->headers->get('Idempotency-Replayed'));
+        $this->upload($this->own, 'a.txt', 'other bytes', 'up-1');
+        $this->assertRefused(409, 'IDEMP_002');
+        self::assertCount(1, ApiTestHost::$stored);
+
+        // The same bytes under another name or type are another request (audit IA-L7, the auditor's proof turned).
+        $this->upload($this->own, 'b.txt', 'first', 'up-1');
+        $this->assertRefused(409, 'IDEMP_002');
+        $path = (string) tempnam(sys_get_temp_dir(), 'tb-api');
+        file_put_contents($path, 'first');
+        $this->client->request('POST', '/api/tasks/v2/task/' . $this->own->getId() . '/attachment', [], ['attachment' => new UploadedFile($path, 'a.txt', 'text/plain', null, true)], ['HTTP_AUTHORIZATION' => self::TOKEN, 'HTTP_IDEMPOTENCY_KEY' => 'up-1']);
+        $this->assertRefused(409, 'IDEMP_002');
+        self::assertCount(1, ApiTestHost::$stored);
+
+        // A nested file counts too.
+        foreach (['one', 'two'] as $index => $bytes) {
+            $path = (string) tempnam(sys_get_temp_dir(), 'tb-api');
+            file_put_contents($path, $bytes);
+            $main = (string) tempnam(sys_get_temp_dir(), 'tb-api');
+            file_put_contents($main, 'same');
+            $this->client->request('POST', '/api/tasks/v2/task/' . $this->own->getId() . '/attachment', [], [
+                'attachment' => new UploadedFile($main, 'm.txt', null, null, true),
+                'extra'      => ['nested' => new UploadedFile($path, 'n.txt', null, null, true)],
+            ], ['HTTP_AUTHORIZATION' => self::TOKEN, 'HTTP_IDEMPOTENCY_KEY' => 'up-2']);
+            $index === 0 ? self::assertResponseIsSuccessful() : $this->assertRefused(409, 'IDEMP_002');
+        }
+    }
+
+    public function testTimeIsLoggedForTheTokensOwnPerson(): void
+    {
+        $this->send('POST', '/api/tasks/v2/team/team-1/time_entries', ['tid' => $this->own->getId(), 'start' => 1790000000000, 'duration' => 1800000, 'description' => 'Review', 'billable' => true, 'assignee' => 'uuid-' . $this->owner->getId()]);
+
+        self::assertResponseIsSuccessful();
+        self::assertSame(['entry-1', $this->own->getId(), '1800000', 'Review'], [$this->json()['data']['id'], $this->json()['data']['task']['id'], $this->json()['data']['duration'], $this->json()['data']['description']]);
+        self::assertSame([['field' => 'billable', 'reason' => 'not_supported']], $this->json()['warnings']);
+        self::assertSame(1790000000, ApiTestHost::$logged[0][1]->start->getTimestamp());
+        self::assertSame(1800, ApiTestHost::$logged[0][1]->durationSeconds);
+
+        $this->send('POST', '/api/tasks/v2/team/team-1/time_entries', ['start' => 1790000000000, 'duration' => 60000]);
+        self::assertResponseIsSuccessful('without a task, the host decides');
+        self::assertNull(ApiTestHost::$logged[1][0]);
+    }
+
+    public function testTimeWithoutATaskIsReplayedForAnyWhere(): void
+    {
+        $this->issueToken(where: TaskApiWhere::limitedTo([], [$this->roadmap->getId()]));
+        $this->send('POST', '/api/tasks/v2/team/team-1/time_entries', ['start' => 1790000000000, 'duration' => 60000], ['HTTP_IDEMPOTENCY_KEY' => 'time-1']);
+        $this->send('POST', '/api/tasks/v2/team/team-1/time_entries', ['start' => 1790000000000, 'duration' => 60000], ['HTTP_IDEMPOTENCY_KEY' => 'time-1']);
+
+        self::assertSame('true', $this->client->getResponse()->headers->get('Idempotency-Replayed'));
+        self::assertCount(1, ApiTestHost::$logged);
+    }
+
+    public function testTimeRefusals(): void
+    {
+        foreach ([
+            [['start' => 1790000000000], 400, 'INPUT_002'],
+            [['duration' => 60000], 400, 'INPUT_002'],
+            [['start' => 1790000000000, 'duration' => 59999], 400, 'INPUT_002'],
+            [['start' => 1790000000000, 'duration' => 604800001], 400, 'INPUT_002'],
+            [['start' => 1790000000000, 'duration' => 60000, 'description' => str_repeat('x', 513)], 400, 'INPUT_002'],
+            [['start' => 1790000000000, 'duration' => 60000, 'assignee' => 'uuid-999'], 403, 'TOKEN_001'],
+            [['start' => 1790000000000, 'duration' => 60000, 'tid' => 'nothing'], 404, 'ACCESS_001'],
+        ] as [$body, $status, $ecode]) {
+            $this->send('POST', '/api/tasks/v2/team/team-1/time_entries', $body);
+            $this->assertRefused($status, $ecode);
+        }
+        $this->send('POST', '/api/tasks/v2/team/team-9/time_entries', ['start' => 1790000000000, 'duration' => 60000]);
+        $this->assertRefused(404, 'ACCESS_001');
+
+        $this->issueToken(TaskApiLevel::Read);
+        $this->send('POST', '/api/tasks/v2/team/team-1/time_entries', ['start' => 1790000000000, 'duration' => 60000]);
+        $this->assertRefused(403, 'TOKEN_001');
+        $this->issueToken(TaskApiLevel::MyTasks);
+        $this->send('POST', '/api/tasks/v2/team/team-1/time_entries', ['tid' => $this->theirs->getId(), 'start' => 1790000000000, 'duration' => 60000]);
+        $this->assertRefused(404, 'ACCESS_001');
+        $this->send('POST', '/api/tasks/v2/team/team-1/time_entries', ['tid' => $this->own->getId(), 'start' => 1790000000000, 'duration' => 60000]);
+        self::assertResponseIsSuccessful('My tasks logs its time on its own task');
+
+        ApiTestHost::$planAllows = false;
+        $this->send('POST', '/api/tasks/v2/team/team-1/time_entries', ['start' => 1790000000000, 'duration' => 60000]);
+        $this->assertRefused(403, 'PLAN_001');
+        self::assertCount(1, ApiTestHost::$logged);
+    }
+
+    public function testDeletingTimeIsAlwaysRefused(): void
+    {
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level);
+            foreach (['entry-1', 'nothing'] as $entry) {
+                $this->send('DELETE', '/api/tasks/v2/team/team-1/time_entries/' . $entry);
+                $this->assertRefused(403, 'TIME_002');
+            }
+        }
+    }
+
+    private function upload(Task $task, string $name, string $content, ?string $key = null): void
+    {
+        $path = (string) tempnam(sys_get_temp_dir(), 'tb-api');
+        file_put_contents($path, $content);
+        $server = ['HTTP_AUTHORIZATION' => self::TOKEN] + ($key === null ? [] : ['HTTP_IDEMPOTENCY_KEY' => $key]);
+        $this->client->request('POST', '/api/tasks/v2/task/' . $task->getId() . '/attachment', [], ['attachment' => new UploadedFile($path, $name, null, null, true)], $server);
+    }
+}
diff --git a/tests/Functional/Api/ApiGuardTest.php b/tests/Functional/Api/ApiGuardTest.php
new file mode 100644
index 00000000..2c1b7dc4
--- /dev/null
+++ b/tests/Functional/Api/ApiGuardTest.php
@@ -0,0 +1,229 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskMember;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Event\BoardAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+
+/**
+ * Spec 213: level ∩ the person's access ∩ where, on every id-based target; every denial asserted.
+ */
+final class ApiGuardTest extends ApiTestCase
+{
+    private const TENANT = 'tenant-a';
+
+    private TaskBoard $board;
+
+    private Task $task;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ApiTestHost::$tenants = [self::TENANT];
+        $this->board          = $this->board(tenantKey: self::TENANT);
+        $this->task           = $this->task($this->board, 'Owned by the owner');
+    }
+
+    public function testAMissingTargetIsNotFound(): void
+    {
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($this->principal(), 'nothing', TaskApiCapability::ReadOwn));
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($this->principal(), 'nothing', TaskApiCapability::ReadOwn));
+    }
+
+    public function testOutsideWhereIsNotFoundWhateverTheLevel(): void
+    {
+        $other = TaskApiWhere::limitedTo(['tenant-b'], ['another-board']);
+        foreach (TaskApiLevel::cases() as $level) {
+            $principal = $this->principal($level, $other);
+            $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($principal, $this->board->getId(), TaskApiCapability::ReadOwn));
+            $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($principal, $this->task->getId(), TaskApiCapability::ReadOwn));
+        }
+    }
+
+    public function testATenantTheHostForbidsIsNotFound(): void
+    {
+        $principal = $this->principal(where: TaskApiWhere::everything([self::TENANT]));
+
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($principal, $this->board->getId(), TaskApiCapability::ReadOwn));
+    }
+
+    public function testNamingABoardOrItsTenantInWhereReachesIt(): void
+    {
+        foreach ([TaskApiWhere::limitedTo([self::TENANT], []), TaskApiWhere::limitedTo([], [$this->board->getId()])] as $where) {
+            self::assertSame($this->board->getId(), $this->guard()->board($this->principal(where: $where), $this->board->getId(), TaskApiCapability::ReadOwn)->getId());
+        }
+    }
+
+    public function testATenantWithoutASpaceIsNotFound(): void
+    {
+        ApiTestHost::$tenants = [];
+
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($this->principal(), $this->board->getId(), TaskApiCapability::ReadOwn));
+    }
+
+    public function testNoViewAccessIsNotFoundAndARemovedMemberStopsAtOnce(): void
+    {
+        $principal = $this->principal();
+        self::assertSame($this->board->getId(), $this->guard()->board($principal, $this->board->getId(), TaskApiCapability::ReadOwn)->getId());
+
+        // The next request: the host's listener no longer lets them in.
+        $this->dispatcher()->addListener(TaskBoardEvents::BOARD_ACCESS_CHECK, static function (BoardAccessCheckEvent $event): void {
+            $event->deny();
+        });
+
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($principal, $this->board->getId(), TaskApiCapability::ReadOwn));
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($principal, $this->task->getId(), TaskApiCapability::ReadOwn));
+    }
+
+    public function testATaskTheHostDeniesIsNotFound(): void
+    {
+        $this->dispatcher()->addListener(TaskBoardEvents::TASK_ACCESS_CHECK, static function (TaskAccessCheckEvent $event): void {
+            $event->deny();
+        });
+
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($this->principal(), $this->task->getId(), TaskApiCapability::ReadOwn));
+    }
+
+    public function testMyTasksSeesOnlyWhatItCreatedOrIsAssigned(): void
+    {
+        $other     = $this->user('other@example.com');
+        $principal = new TaskApiPrincipal($other, TaskApiLevel::MyTasks, TaskApiWhere::everything(), 'id', 'name');
+
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($principal, $this->task->getId(), TaskApiCapability::ReadOwn));
+
+        // Watching does not count.
+        $this->member($this->task, $other, TaskMemberRole::Watcher);
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($principal, $this->task->getId(), TaskApiCapability::ReadOwn));
+
+        $this->member($this->task, $other, TaskMemberRole::Assignee);
+        self::assertSame($this->task->getId(), $this->guard()->task($principal, $this->task->getId(), TaskApiCapability::ReadOwn)->getId());
+
+        // Their own task, created by them.
+        $mine = new Task(board: $this->board, title: 'Mine', creator: $other);
+        $this->em->persist($mine);
+        $this->em->flush();
+        self::assertSame($mine->getId(), $this->guard()->task($principal, $mine->getId(), TaskApiCapability::WorkOnTask)->getId());
+    }
+
+    public function testAReadTokenSeesAnothersTaskAndAnErasedCreatorIsNobody(): void
+    {
+        $other = $this->user('other@example.com');
+        self::assertSame($this->task->getId(), $this->guard()->task(new TaskApiPrincipal($other, TaskApiLevel::Read, TaskApiWhere::everything(), 'id', 'name'), $this->task->getId(), TaskApiCapability::ReadEverything)->getId());
+
+        self::assertFalse($this->guard()->isOwn($other, new Task(board: $this->board, title: 'Orphan', creator: null)));
+        self::assertTrue($this->guard()->isOwn($this->owner, new Task(board: $this->board, title: 'Same object', creator: $this->owner)));
+        self::assertFalse($this->guard()->isOwn(new class {}, new Task(board: $this->board, title: 'No ids', creator: $this->owner)));
+    }
+
+    public function testAPlanWithoutTheModuleIsARefusalOnlyForWhatCanBeSeen(): void
+    {
+        ApiTestHost::$planRefusesTenants = [self::TENANT];
+
+        $this->assertDenied(403, 'PLAN_001', fn () => $this->guard()->board($this->principal(), $this->board->getId(), TaskApiCapability::ReadOwn));
+        $this->assertDenied(403, 'PLAN_001', fn () => $this->guard()->task($this->principal(), $this->task->getId(), TaskApiCapability::ReadOwn));
+
+        // Out of reach comes first.
+        $outside = $this->principal(where: TaskApiWhere::limitedTo([], []));
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($outside, $this->board->getId(), TaskApiCapability::ReadOwn));
+    }
+
+    public function testALevelThatMayNotIsARefusalForWhatItCanSee(): void
+    {
+        $read = $this->principal(TaskApiLevel::Read);
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->task($read, $this->task->getId(), TaskApiCapability::WorkOnTask));
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->task($read, $this->task->getId(), TaskApiCapability::Comment));
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->board($read, $this->board->getId(), TaskApiCapability::EditTasks));
+
+        $mine = $this->principal(TaskApiLevel::MyTasks);
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->task($mine, $this->task->getId(), TaskApiCapability::EditTasks));
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->task($mine, $this->task->getId(), TaskApiCapability::ReadEverything));
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->board($mine, $this->board->getId(), TaskApiCapability::EditTasks));
+
+        $tasks = $this->principal(TaskApiLevel::Tasks);
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->board($tasks, $this->board->getId(), TaskApiCapability::ManageBoards));
+        self::assertSame($this->task->getId(), $this->guard()->task($tasks, $this->task->getId(), TaskApiCapability::DeleteTask)->getId());
+    }
+
+    public function testAReadOnlyPersonIsARefusalWhateverTheToken(): void
+    {
+        $this->dispatcher()->addListener(TaskBoardEvents::BOARD_ACCESS_CHECK, static function (BoardAccessCheckEvent $event): void {
+            if ($event->getAction() === BoardAccessCheckEvent::ACTION_VIEW) {
+                $event->grant();
+                $event->markReadOnly();
+            } else {
+                $event->deny();
+            }
+        });
+        $full = $this->principal();
+
+        self::assertSame($this->board->getId(), $this->guard()->board($full, $this->board->getId(), TaskApiCapability::ReadEverything)->getId());
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->board($full, $this->board->getId(), TaskApiCapability::EditTasks));
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->board($full, $this->board->getId(), TaskApiCapability::ManageBoards));
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->task($full, $this->task->getId(), TaskApiCapability::WorkOnTask));
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->task($full, $this->task->getId(), TaskApiCapability::EditTasks));
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->task($full, $this->task->getId(), TaskApiCapability::DeleteTask));
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->task($full, $this->task->getId(), TaskApiCapability::ManageBoards));
+        // readers_can_comment is on by default.
+        self::assertSame($this->task->getId(), $this->guard()->task($full, $this->task->getId(), TaskApiCapability::Comment)->getId());
+    }
+
+    public function testACapabilityOfATaskIsNotGrantedOnABoard(): void
+    {
+        foreach ([TaskApiCapability::WorkOnTask, TaskApiCapability::Comment, TaskApiCapability::DeleteTask] as $capability) {
+            $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->board($this->principal(), $this->board->getId(), $capability));
+        }
+    }
+
+    private function principal(TaskApiLevel $level = TaskApiLevel::Full, ?TaskApiWhere $where = null): TaskApiPrincipal
+    {
+        return new TaskApiPrincipal($this->owner, $level, $where ?? TaskApiWhere::everything(), 'id', 'name');
+    }
+
+    private function member(Task $task, AppUser $user, TaskMemberRole $role): void
+    {
+        $task->addMember(new TaskMember(task: $task, user: $user, memberRole: $role));
+        $this->em->flush();
+    }
+
+    private function assertDenied(int $status, string $ecode, callable $call): void
+    {
+        try {
+            $call();
+            self::fail('TaskApiRefusal ' . $ecode . ' expected');
+        } catch (TaskApiRefusal $refusal) {
+            self::assertSame([$status, $ecode], [$refusal->status, $refusal->ecode]);
+        }
+    }
+
+    private function guard(): TaskApiGuard
+    {
+        $guard = self::getContainer()->get(TaskApiGuard::class);
+        self::assertInstanceOf(TaskApiGuard::class, $guard);
+
+        return $guard;
+    }
+
+    private function dispatcher(): EventDispatcherInterface
+    {
+        $dispatcher = self::getContainer()->get('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+
+        return $dispatcher;
+    }
+}
diff --git a/tests/Functional/Api/ApiIdempotencyTest.php b/tests/Functional/Api/ApiIdempotencyTest.php
new file mode 100644
index 00000000..0827e833
--- /dev/null
+++ b/tests/Functional/Api/ApiIdempotencyTest.php
@@ -0,0 +1,217 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use DateTimeImmutable;
+use Doctrine\DBAL\Types\Types;
+use Nowo\TaskBoardBundle\Api\Command\TaskApiPurgeIdempotencyCommand;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiIdempotencyStoreInterface;
+use Nowo\TaskBoardBundle\Api\Idempotency\DoctrineTaskApiIdempotencyStore;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiIdempotencyOutcome;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Symfony\Component\Console\Tester\CommandTester;
+
+use function hash;
+use function str_repeat;
+
+/**
+ * Spec 213 FR-015: a write retried with the same `Idempotency-Key` within 24 hours gets its first successful answer, once.
+ */
+final class ApiIdempotencyTest extends ApiTestCase
+{
+    private TaskBoard $roadmap;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ApiTestHost::$tenants = ['tenant-a'];
+        $this->roadmap        = $this->board('Roadmap', tenantKey: 'tenant-a');
+        $this->issueToken();
+    }
+
+    public function testARetryGetsTheFirstAnswerAndWritesOnce(): void
+    {
+        $path = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+        $this->send('POST', $path, ['name' => 'Once', 'priority' => 2], ['HTTP_IDEMPOTENCY_KEY' => 'k-1']);
+        self::assertResponseIsSuccessful();
+        $first = (string) $this->client->getResponse()->getContent();
+        self::assertFalse($this->client->getResponse()->headers->has('Idempotency-Replayed'));
+
+        // The same JSON written another way is the same request.
+        $this->send('POST', $path, '{"priority": 2, "name": "Once"}', ['HTTP_IDEMPOTENCY_KEY' => 'k-1']);
+        self::assertResponseIsSuccessful();
+        self::assertSame($first, (string) $this->client->getResponse()->getContent());
+        self::assertSame('true', $this->client->getResponse()->headers->get('Idempotency-Replayed'));
+        self::assertSame('99', $this->client->getResponse()->headers->get('X-RateLimit-Remaining'), 'a replay goes through the pipeline');
+        self::assertCount(1, $this->em->getRepository(Task::class)->findAll());
+    }
+
+    public function testTheSameKeyForAnotherRequestIsAConflict(): void
+    {
+        $path = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+        $this->send('POST', $path, ['name' => 'First'], ['HTTP_IDEMPOTENCY_KEY' => 'k-2']);
+
+        $this->send('POST', $path, ['name' => 'Second'], ['HTTP_IDEMPOTENCY_KEY' => 'k-2']);
+        $this->assertRefused(409, 'IDEMP_002');
+        $task = $this->em->getRepository(Task::class)->findAll()[0];
+        $this->send('DELETE', '/api/tasks/v2/task/' . $task->getId(), null, ['HTTP_IDEMPOTENCY_KEY' => 'k-2']);
+        $this->assertRefused(409, 'IDEMP_002');
+        self::assertCount(1, $this->em->getRepository(Task::class)->findAll());
+    }
+
+    public function testKeysBelongToTheirToken(): void
+    {
+        $path = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+        $this->issueToken(token: 'bt_other_placeholder');
+        $this->send('POST', $path, ['name' => 'Mine'], ['HTTP_IDEMPOTENCY_KEY' => 'shared']);
+        $this->send('POST', $path, ['name' => 'Theirs'], ['HTTP_IDEMPOTENCY_KEY' => 'shared'], 'bt_other_placeholder');
+
+        self::assertResponseIsSuccessful();
+        self::assertCount(2, $this->em->getRepository(Task::class)->findAll());
+    }
+
+    public function testARefusalIsNotKeptSoTheRetryIsDecidedAfresh(): void
+    {
+        $path = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+        $this->send('POST', $path, ['name' => ''], ['HTTP_IDEMPOTENCY_KEY' => 'k-3']);
+        $this->assertRefused(400, 'INPUT_002');
+
+        $this->send('POST', $path, ['name' => 'Fixed'], ['HTTP_IDEMPOTENCY_KEY' => 'k-3']);
+        self::assertResponseIsSuccessful();
+    }
+
+    public function testABadKeyAndAKeyInFlight(): void
+    {
+        $path = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+        foreach (['', str_repeat('k', 256)] as $key) {
+            $this->send('POST', $path, ['name' => 'x'], ['HTTP_IDEMPOTENCY_KEY' => $key]);
+            $this->assertRefused(400, 'IDEMP_003');
+        }
+
+        $body = ['name' => 'Running'];
+        $this->store()->claim($this->scope(), hash('sha256', 'k-4'), $this->fingerprint('POST', $path, '{"name":"Running"}'), new DateTimeImmutable('+1 day'));
+        $this->send('POST', $path, $body, ['HTTP_IDEMPOTENCY_KEY' => 'k-4']);
+        $this->assertRefused(409, 'IDEMP_001');
+
+        // A claim abandoned by a process that died is taken over after five minutes.
+        $this->connectionUpdate('UPDATE ' . DoctrineTaskApiIdempotencyStore::TABLE . ' SET created_at = ? WHERE key_hash = ?', [new DateTimeImmutable('-10 minutes'), hash('sha256', 'k-4')]);
+        $this->send('POST', $path, $body, ['HTTP_IDEMPOTENCY_KEY' => 'k-4']);
+        self::assertResponseIsSuccessful();
+    }
+
+    public function testAnExpiredKeyRunsAgainAndThePurgeClearsOldAnswers(): void
+    {
+        $path = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+        $this->send('POST', $path, ['name' => 'Day one'], ['HTTP_IDEMPOTENCY_KEY' => 'k-5']);
+        $this->connectionUpdate('UPDATE ' . DoctrineTaskApiIdempotencyStore::TABLE . ' SET expires_at = ?', [new DateTimeImmutable('-1 minute')]);
+
+        $this->send('POST', $path, ['name' => 'Day one'], ['HTTP_IDEMPOTENCY_KEY' => 'k-5']);
+        self::assertFalse($this->client->getResponse()->headers->has('Idempotency-Replayed'));
+        self::assertCount(2, $this->em->getRepository(Task::class)->findAll());
+
+        $this->connectionUpdate('UPDATE ' . DoctrineTaskApiIdempotencyStore::TABLE . ' SET expires_at = ?', [new DateTimeImmutable('-1 minute')]);
+        $command = self::getContainer()->get(TaskApiPurgeIdempotencyCommand::class);
+        self::assertInstanceOf(TaskApiPurgeIdempotencyCommand::class, $command);
+        $tester = new CommandTester($command);
+        self::assertSame(0, $tester->execute([]));
+        self::assertStringContainsString('1 expired answers deleted.', $tester->getDisplay());
+    }
+
+    public function testAReplayAfterTheTokenLostItsReachIsNotFound(): void
+    {
+        $path = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+        $this->send('POST', $path, ['name' => 'Secret'], ['HTTP_IDEMPOTENCY_KEY' => 'k-6']);
+        self::assertResponseIsSuccessful();
+
+        $this->issueToken(where: TaskApiWhere::limitedTo(['tenant-b'], []));
+        $this->send('POST', $path, ['name' => 'Secret'], ['HTTP_IDEMPOTENCY_KEY' => 'k-6']);
+        $this->assertRefused(404, 'ACCESS_001');
+        self::assertStringNotContainsString('Secret', (string) $this->client->getResponse()->getContent());
+
+        // A board that is gone leaves its tenant: a token still reaching the tenant gets the answer.
+        $this->issueToken();
+        $task = $this->em->getRepository(Task::class)->findAll()[0];
+        $this->send('DELETE', '/api/tasks/v2/task/' . $task->getId(), null, ['HTTP_IDEMPOTENCY_KEY' => 'k-7']);
+        $this->send('DELETE', '/api/tasks/v2/task/' . $task->getId(), null, ['HTTP_IDEMPOTENCY_KEY' => 'k-7']);
+        self::assertSame('true', $this->client->getResponse()->headers->get('Idempotency-Replayed'));
+        $this->connectionUpdate('UPDATE ' . DoctrineTaskApiIdempotencyStore::TABLE . ' SET board_id = ?', ['gone-board']);
+        $this->send('DELETE', '/api/tasks/v2/task/' . $task->getId(), null, ['HTTP_IDEMPOTENCY_KEY' => 'k-7']);
+        self::assertResponseIsSuccessful();
+        $this->issueToken(where: TaskApiWhere::limitedTo([], ['gone-board']));
+        $this->send('DELETE', '/api/tasks/v2/task/' . $task->getId(), null, ['HTTP_IDEMPOTENCY_KEY' => 'k-7']);
+        self::assertResponseIsSuccessful('a where naming the board that is gone still reaches it');
+        $this->issueToken(where: TaskApiWhere::limitedTo([], []));
+        $this->send('DELETE', '/api/tasks/v2/task/' . $task->getId(), null, ['HTTP_IDEMPOTENCY_KEY' => 'k-7']);
+        $this->assertRefused(404, 'ACCESS_001');
+    }
+
+    public function testTheQueryIsPartOfTheRequest(): void
+    {
+        // Audit IA-L5 (the auditor's proof, turned): one key on two queries is a conflict, not a replay.
+        $a    = $this->task($this->roadmap, 'A');
+        $b    = $this->task($this->roadmap, 'B');
+        $c    = $this->task($this->roadmap, 'C');
+        $base = '/api/tasks/v2/task/' . $a->getId();
+        $this->send('POST', $base . '/dependency', ['depends_on' => $b->getId()]);
+        $this->send('POST', $base . '/dependency', ['dependency_of' => $c->getId()]);
+
+        $this->send('DELETE', $base . '/dependency?depends_on=' . $b->getId(), null, ['HTTP_IDEMPOTENCY_KEY' => 'k-q']);
+        self::assertResponseIsSuccessful();
+        $this->send('DELETE', $base . '/dependency?dependency_of=' . $c->getId(), null, ['HTTP_IDEMPOTENCY_KEY' => 'k-q']);
+
+        $this->assertRefused(409, 'IDEMP_002');
+        $this->em->clear();
+        self::assertCount(1, $this->em->getRepository(TaskDependency::class)->findAll());
+    }
+
+    public function testTheStoreClaimsOnceAndForgetsAToken(): void
+    {
+        $store = $this->store();
+        $until = new DateTimeImmutable('+1 day');
+        self::assertSame(TaskApiIdempotencyOutcome::Claimed, $store->claim('scope', 'key', 'fp', $until)->outcome);
+        self::assertSame(TaskApiIdempotencyOutcome::InFlight, $store->claim('scope', 'key', 'fp', $until)->outcome);
+        self::assertSame(TaskApiIdempotencyOutcome::Mismatch, $store->claim('scope', 'key', 'other', $until)->outcome);
+        $store->complete('scope', 'key', 201, '{"ok":true}', 'tenant', 'board');
+        $claim = $store->claim('scope', 'key', 'fp', $until);
+        self::assertSame([TaskApiIdempotencyOutcome::Completed, 201, '{"ok":true}', 'tenant', 'board'], [$claim->outcome, $claim->status, $claim->body, $claim->tenantKey, $claim->boardId]);
+        $store->release('scope', 'key');
+        self::assertSame(TaskApiIdempotencyOutcome::Completed, $store->claim('scope', 'key', 'fp', $until)->outcome, 'a completed answer is not released');
+
+        $store->forget('scope');
+        self::assertSame(TaskApiIdempotencyOutcome::Claimed, $store->claim('scope', 'key', 'fp', $until)->outcome);
+        self::assertSame(1, $store->purgeExpired(new DateTimeImmutable('+2 days')));
+    }
+
+    private function store(): TaskApiIdempotencyStoreInterface
+    {
+        $store = self::getContainer()->get(TaskApiIdempotencyStoreInterface::class);
+        self::assertInstanceOf(DoctrineTaskApiIdempotencyStore::class, $store);
+
+        return $store;
+    }
+
+    private function scope(): string
+    {
+        return hash('sha256', 'nowo-task-board-api|' . hash('sha256', 'token-id|owner@example.com|' . self::TOKEN));
+    }
+
+    private function fingerprint(string $method, string $path, string $json): string
+    {
+        return hash('sha256', $method . "\n" . $path . "\n\n" . $json);
+    }
+
+    /**
+     * @param list<mixed> $parameters
+     */
+    private function connectionUpdate(string $sql, array $parameters): void
+    {
+        $types = array_map(static fn (mixed $value): string => $value instanceof DateTimeImmutable ? Types::DATETIME_IMMUTABLE : Types::STRING, $parameters);
+        $this->em->getConnection()->executeStatement($sql, $parameters, $types);
+    }
+}
diff --git a/tests/Functional/Api/ApiManagementTest.php b/tests/Functional/Api/ApiManagementTest.php
new file mode 100644
index 00000000..14693189
--- /dev/null
+++ b/tests/Functional/Api/ApiManagementTest.php
@@ -0,0 +1,320 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use Nowo\TaskBoardBundle\Api\Controller\TaskApiManagementController;
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiAudit;
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiBoardOperations;
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiReadOperations;
+use Nowo\TaskBoardBundle\Api\Repository\TaskApiQueryRepository;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Entity\BoardColumn;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Event\BoardAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Security\TaskBoardAccessCheckerInterface;
+use Nowo\TaskBoardBundle\Security\TaskBoardResourceAccessChecker;
+use Nowo\TaskBoardBundle\Service\BoardColumnManager;
+use Nowo\TaskBoardBundle\Service\TaskBoardCreator;
+use Nowo\TaskBoardBundle\Service\TaskBoardEditor;
+use Nowo\TaskBoardBundle\Service\TaskBoardEraser;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiAuditRecorder;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\App\RecordingQuotaListener;
+use Psr\Clock\ClockInterface;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Validator\Validator\ValidatorInterface;
+
+use function array_column;
+use function array_reverse;
+use function array_slice;
+use function str_repeat;
+
+/**
+ * Spec 213 S6 (Full management): boards and columns through the UI's services; columns on this API's own status paths
+ * (owner, Q-O2); deleting a board erases its tasks and keeps their time.
+ */
+final class ApiManagementTest extends ApiTestCase
+{
+    private TaskBoard $roadmap;
+
+    /** @var list<string> */
+    private array $events = [];
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ApiTestHost::$tenants = ['tenant-a', 'tenant-b'];
+        $this->roadmap        = $this->board('Roadmap', tenantKey: 'tenant-a');
+        $this->issueToken();
+        foreach ([TaskBoardEvents::BOARD_CREATED, TaskBoardEvents::BOARD_UPDATED, TaskBoardEvents::BOARD_DELETED] as $name) {
+            $this->dispatcher()->addListener($name, function () use ($name): void {
+                $this->events[] = $name;
+            });
+        }
+    }
+
+    public function testCreateABoardInASpace(): void
+    {
+        $this->send('POST', '/api/tasks/v2/space/space-tenant-a/list', ['name' => ' Launch ', 'markdown_content' => 'The **plan**', 'priority' => 1]);
+
+        self::assertResponseIsSuccessful();
+        $json = $this->json();
+        self::assertSame(['Launch', 'The **plan**', 0], [$json['name'], $json['content'], $json['task_count']]);
+        self::assertSame(['To do', 'In progress', 'Done'], array_column($json['statuses'], 'status'), 'the default columns, as the UI makes them');
+        self::assertSame([['field' => 'priority', 'reason' => 'not_supported']], $json['warnings']);
+        self::assertSame([TaskBoardEvents::BOARD_CREATED], $this->events);
+        self::assertSame('board_create', $this->quota()->asked[0]->action);
+        self::assertSame('tenant-a', $this->em->find(TaskBoard::class, $json['id'])?->getTenantKey());
+        self::assertSame('board.create', $this->audit()->events[0]->operation);
+    }
+
+    public function testCreateRefusals(): void
+    {
+        $this->send('POST', '/api/tasks/v2/space/space-tenant-a/list', ['name' => '']);
+        $this->assertRefused(400, 'INPUT_002');
+        $this->send('POST', '/api/tasks/v2/space/space-tenant-a/list', ['name' => str_repeat('x', 256)]);
+        $this->assertRefused(400, 'INPUT_002');
+        $this->send('POST', '/api/tasks/v2/space/space-nothing/list', ['name' => 'x']);
+        $this->assertRefused(404, 'ACCESS_001');
+
+        $this->quota()->deny = ['board_create'];
+        $this->send('POST', '/api/tasks/v2/space/space-tenant-a/list', ['name' => 'Over']);
+        $this->assertRefused(403, 'PLAN_002');
+        self::assertSame('Your plan is full.', $this->json()['err']);
+        $this->quota()->deny = [];
+
+        // Where names one board of the space: it may list the space, not create in it.
+        $this->issueToken(where: TaskApiWhere::limitedTo([], [$this->roadmap->getId()]));
+        $this->send('POST', '/api/tasks/v2/space/space-tenant-a/list', ['name' => 'Outside']);
+        $this->assertRefused(404, 'ACCESS_001');
+        self::assertCount(1, $this->em->getRepository(TaskBoard::class)->findAll());
+    }
+
+    public function testUpdateABoard(): void
+    {
+        $slug = $this->roadmap->getSlug();
+        $this->send('PUT', '/api/tasks/v2/list/' . $this->roadmap->getId(), ['name' => 'Renamed', 'content' => 'Notes', 'unset_status' => true]);
+
+        self::assertSame(['Renamed', 'Notes'], [$this->json()['name'], $this->json()['content']]);
+        self::assertSame([['field' => 'unset_status', 'reason' => 'not_supported']], $this->json()['warnings']);
+        self::assertSame([TaskBoardEvents::BOARD_UPDATED], $this->events);
+        $this->send('PUT', '/api/tasks/v2/list/' . $this->roadmap->getId(), []);
+        self::assertSame('Renamed', $this->json()['name'], 'nothing given, nothing changed');
+        $this->em->clear();
+        self::assertSame($slug, $this->em->find(TaskBoard::class, $this->roadmap->getId())?->getSlug());
+    }
+
+    public function testDeleteABoardErasesItsTasksAndKeepsTheirTime(): void
+    {
+        $task  = $this->task($this->roadmap, 'Timed');
+        $entry = new TaskTimeEntry($task, $this->owner, 25, new DateTimeImmutable('2026-11-01'));
+        $task->addTimeEntry($entry);
+        $this->em->persist($entry);
+        $this->em->flush();
+
+        $this->send('DELETE', '/api/tasks/v2/list/' . $this->roadmap->getId());
+
+        self::assertSame([], $this->json());
+        $this->em->clear();
+        self::assertNull($this->em->find(TaskBoard::class, $this->roadmap->getId()));
+        self::assertSame(25, $this->em->find(TaskTimeEntry::class, $entry->getId())?->getMinutes());
+        self::assertContains(TaskBoardEvents::BOARD_DELETED, $this->events);
+        self::assertSame('board.delete', $this->audit()->events[0]->operation);
+    }
+
+    public function testABigBoardIsDeletedInSlices(): void
+    {
+        foreach (['a', 'b', 'c'] as $title) {
+            $this->task($this->roadmap, $title);
+        }
+        $clock = new class implements ClockInterface {
+            private int $now = 1_790_000_000;
+
+            public function now(): DateTimeImmutable
+            {
+                $this->now += 600;
+
+                return new DateTimeImmutable('@' . $this->now);
+            }
+        };
+        $eraser     = new TaskBoardEraser($this->service(EntityManagerInterface::class), $this->service(TaskBoardResourceAccessChecker::class), $this->dispatcher(), null, $clock, timeBudgetSeconds: 1, cursorSecret: 'test-secret');
+        $operations = new TaskApiBoardOperations(
+            $this->service(TaskApiGuard::class),
+            $this->service(TaskApiAudit::class),
+            $this->service(TaskBoardAccessCheckerInterface::class),
+            $this->service(TaskBoardCreator::class),
+            new TaskBoardEditor($this->service('Nowo\TaskBoardBundle\Repository\TaskBoardRepositoryInterface')),
+            $eraser,
+            $this->service(BoardColumnManager::class),
+            $this->service(TaskApiQueryRepository::class),
+            $this->service(ValidatorInterface::class),
+            eraseBatchSize: 1,
+        );
+        $controller = new TaskApiManagementController($operations, $this->service(TaskApiReadOperations::class), new TaskApiReadSerializer(), 1024);
+        $request    = Request::create('/', 'DELETE');
+        $request->attributes->set('_nowo_task_board_api_principal', new TaskApiPrincipal($this->owner, TaskApiLevel::Full, TaskApiWhere::everything(), 'id', 'name'));
+
+        $first = $controller->deleteBoard($request, $this->roadmap->getId());
+        self::assertSame(202, $first->getStatusCode());
+        self::assertSame('1', $first->headers->get('Retry-After'));
+        self::assertSame('{"status":"in_progress"}', $first->getContent());
+        $calls = 1;
+        while ($controller->deleteBoard($request, $this->roadmap->getId())->getStatusCode() === 202) {
+            self::assertLessThan(10, ++$calls);
+        }
+        $this->em->clear();
+        self::assertNull($this->em->find(TaskBoard::class, $this->roadmap->getId()));
+    }
+
+    public function testColumnsAsStatuses(): void
+    {
+        $task = $this->task($this->roadmap, 'Moves');
+        $base = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/status';
+        $this->send('POST', $base, ['status' => 'Review', 'color' => '#3b82f6', 'type' => 'custom']);
+        $statuses = $this->json()['statuses'];
+        self::assertSame(['To do', 'Doing', 'Done', 'Review'], array_column($statuses, 'status'));
+        self::assertSame('#3b82f6', $statuses[3]['color']);
+        self::assertSame([['field' => 'type', 'reason' => 'not_supported']], $this->json()['warnings']);
+        $review = $statuses[3]['id'];
+
+        $this->send('PUT', $base . '/' . $review, ['status' => 'Code review']);
+        self::assertSame('Code review', $this->json()['statuses'][3]['status']);
+        self::assertSame('#3b82f6', $this->json()['statuses'][3]['color'], 'what is not given stays');
+        $this->send('PUT', $base . '/' . $review, ['color' => null]);
+        self::assertNull($this->json()['statuses'][3]['color']);
+
+        $ids = array_column($statuses, 'id');
+        $this->send('PUT', $base . '/order', ['order' => array_reverse($ids)]);
+        self::assertSame(['Code review', 'Done', 'Doing', 'To do'], array_column($this->json()['statuses'], 'status'));
+        foreach ([['order' => [$ids[0]]], ['order' => [...$ids, $ids[0]]], ['order' => [$ids[0], $ids[1], $ids[2], 'nothing']], ['order' => 'x']] as $body) {
+            $this->send('PUT', $base . '/order', $body);
+            $this->assertRefused(400, 'INPUT_002');
+        }
+
+        foreach ([[[], 400, 'INPUT_002'], [['status' => ''], 400, 'INPUT_002'], [['status' => 'x', 'color' => 'red; x'], 400, 'INPUT_002']] as [$body, $status, $ecode]) {
+            $this->send('POST', $base, $body);
+            $this->assertRefused($status, $ecode);
+        }
+        $this->send('PUT', $base . '/nothing', ['status' => 'x']);
+        $this->assertRefused(404, 'ACCESS_001');
+
+        $this->send('DELETE', $base . '/' . $task->getColumn()?->getId());
+        self::assertResponseIsSuccessful();
+        foreach (array_slice(array_column($this->json()['statuses'], 'id'), 1) as $id) {
+            $this->send('DELETE', $base . '/' . $id);
+        }
+        self::assertCount(1, $this->json()['statuses']);
+        $this->send('DELETE', $base . '/' . $this->json()['statuses'][0]['id']);
+        $this->assertRefused(409, 'LIST_001');
+        $this->em->clear();
+        self::assertInstanceOf(BoardColumn::class, $this->em->find(Task::class, $task->getId())?->getColumn(), 'its tasks move to a remaining column');
+    }
+
+    public function testManagementNeedsFullAndTheBoardsManageDecision(): void
+    {
+        $endpoints = $this->endpoints();
+        foreach ([TaskApiLevel::MyTasks, TaskApiLevel::Read, TaskApiLevel::Tasks] as $level) {
+            $this->issueToken($level);
+            foreach ($endpoints as $name => $call) {
+                $call();
+                $this->assertRefused(403, 'TOKEN_001');
+            }
+        }
+
+        $this->issueToken(where: TaskApiWhere::limitedTo(['tenant-b'], []));
+        foreach ($endpoints as $name => $call) {
+            $call();
+            $this->assertRefused(404, 'ACCESS_001');
+        }
+
+        ApiTestHost::$planRefusesTenants = ['tenant-a'];
+        $this->issueToken();
+        foreach ($endpoints as $name => $call) {
+            $call();
+            $this->assertRefused(403, 'PLAN_001');
+        }
+        ApiTestHost::$planRefusesTenants = [];
+
+        foreach ($endpoints as $name => $call) {
+            $call('bt_revoked_placeholder');
+            $this->assertRefused(401, 'OAUTH_019');
+        }
+
+        // The person may view and edit tasks, not manage the board, nor create in the tenant.
+        $this->dispatcher()->addListener(TaskBoardEvents::BOARD_ACCESS_CHECK, static function (BoardAccessCheckEvent $event): void {
+            if ($event->getAction() === BoardAccessCheckEvent::ACTION_MANAGE) {
+                $event->deny();
+            }
+        });
+        foreach ($endpoints as $name => $call) {
+            if ($name === 'create board') {
+                continue;
+            }
+            $call();
+            $this->assertRefused(403, 'ACCESS_002');
+        }
+        self::assertSame([], $this->audit()->events);
+    }
+
+    /**
+     * @return array<string, callable(string=): void>
+     */
+    private function endpoints(): array
+    {
+        $board  = $this->roadmap->getId();
+        $column = $this->roadmap->getColumns()->first();
+        self::assertInstanceOf(BoardColumn::class, $column);
+        $columnId = $column->getId();
+        $ids      = array_map(static fn (BoardColumn $c): string => $c->getId(), $this->roadmap->getColumns()->toArray());
+        $send     = fn (string $method, string $path, ?array $body = null): callable => fn (string $token = self::TOKEN) => $this->send($method, '/api/tasks/v2/' . $path, $body, [], $token);
+
+        return [
+            'create board'  => $send('POST', 'space/space-tenant-a/list', ['name' => 'New']),
+            'update board'  => $send('PUT', 'list/' . $board, ['name' => 'Renamed']),
+            'delete board'  => $send('DELETE', 'list/' . $board),
+            'create column' => $send('POST', 'list/' . $board . '/status', ['status' => 'Review']),
+            'update column' => $send('PUT', 'list/' . $board . '/status/' . $columnId, ['status' => 'Renamed']),
+            'reorder'       => $send('PUT', 'list/' . $board . '/status/order', ['order' => $ids]),
+            'delete column' => $send('DELETE', 'list/' . $board . '/status/' . $columnId),
+        ];
+    }
+
+    private function audit(): ApiAuditRecorder
+    {
+        return $this->service('app.api_audit');
+    }
+
+    private function quota(): RecordingQuotaListener
+    {
+        return $this->service('app.quota_listener');
+    }
+
+    private function dispatcher(): EventDispatcherInterface
+    {
+        return $this->service('event_dispatcher');
+    }
+
+    /**
+     * @template T of object
+     *
+     * @param class-string<T>|string $id
+     *
+     * @return ($id is class-string<T> ? T : mixed)
+     */
+    private function service(string $id): mixed
+    {
+        return self::getContainer()->get($id);
+    }
+}
diff --git a/tests/Functional/Api/ApiManualTimeTest.php b/tests/Functional/Api/ApiManualTimeTest.php
new file mode 100644
index 00000000..7b347bc5
--- /dev/null
+++ b/tests/Functional/Api/ApiManualTimeTest.php
@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\Hook\ManualTaskApiTimeEntries;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+
+/**
+ * Spec 213 S5: the bundle's own manual time as the API's time store, for a host without one.
+ */
+final class ApiManualTimeTest extends ApiTestCase
+{
+    protected function setUp(): void
+    {
+        static::$api = ['host_decides_access' => true, 'hooks' => [
+            'authenticator' => 'app.api_host',
+            'rate_limiter'  => 'app.api_host',
+            'plan_gate'     => 'app.api_host',
+            'workspace'     => 'app.api_host',
+            'users'         => 'app.api_host',
+            'time_entries'  => ManualTaskApiTimeEntries::class,
+        ]];
+        parent::setUp();
+        ApiTestHost::$tenants = ['tenant-a'];
+    }
+
+    public function testLogAndListOwnManualTimeOnTasksWithinReach(): void
+    {
+        $board     = $this->board(tenantKey: 'tenant-a');
+        $task      = $this->task($board, 'Timed');
+        $colleague = $this->user('colleague@example.com');
+        $theirs    = new Task(board: $board, title: 'Theirs', creator: $colleague);
+        $this->em->persist($theirs);
+        $theirEntry = new TaskTimeEntry($task, $colleague, 30, new DateTimeImmutable('2026-11-01'));
+        $task->addTimeEntry($theirEntry);
+        $this->em->persist($theirEntry);
+        $mineElsewhere = new TaskTimeEntry($theirs, $this->owner, 15, new DateTimeImmutable('2026-11-01'));
+        $theirs->addTimeEntry($mineElsewhere);
+        $this->em->persist($mineElsewhere);
+        $this->em->flush();
+        $this->issueToken(TaskApiLevel::MyTasks);
+
+        $this->send('POST', '/api/tasks/v2/team/team-1/time_entries', ['tid' => $task->getId(), 'start' => 1790000000000, 'duration' => 5400000, 'description' => 'Deep work']);
+        self::assertResponseIsSuccessful();
+        self::assertSame('5400000', $this->json()['data']['duration']);
+        $this->em->clear();
+        self::assertSame(120, $this->em->find(Task::class, $task->getId())?->getLoggedMinutes(), "the task page's time grows");
+
+        $this->get('/api/tasks/v2/team/team-1/time_entries?start_date=1789000000000&end_date=1791000000000');
+        self::assertSame(['Deep work'], array_column($this->listOf('data'), 'description'), "only the person's own, on tasks the token opens");
+        $this->get('/api/tasks/v2/team/team-1/time_entries?task_id=' . $task->getId());
+        self::assertCount(1, $this->listOf('data'));
+
+        $this->send('POST', '/api/tasks/v2/team/team-1/time_entries', ['start' => 1790000000000, 'duration' => 60000]);
+        $this->assertRefused(400, 'INPUT_002');
+    }
+}
diff --git a/tests/Functional/Api/ApiOffHostTest.php b/tests/Functional/Api/ApiOffHostTest.php
new file mode 100644
index 00000000..639300d5
--- /dev/null
+++ b/tests/Functional/Api/ApiOffHostTest.php
@@ -0,0 +1,109 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Doctrine\ORM\Mapping\ClassMetadata;
+use Doctrine\ORM\Tools\SchemaTool;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
+use Nowo\TaskBoardBundle\Tests\Functional\FunctionalTestCase;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+use Symfony\Component\Routing\RouterInterface;
+
+use function array_filter;
+use function array_map;
+use function get_debug_type;
+use function is_array;
+use function sort;
+use function str_contains;
+
+/**
+ * Spec 213, the opt-in rule: with `api.enabled: false` a host gets no route, no service it did not have, no listener and no
+ * required schema, and the API's hooks may be set without any of that changing.
+ */
+final class ApiOffHostTest extends FunctionalTestCase
+{
+    private const API_NAMESPACE = 'Nowo\\TaskBoardBundle\\Api\\';
+
+    public function testNoRouteExists(): void
+    {
+        $routes = $this->router()->getRouteCollection()->all();
+
+        foreach ($routes as $name => $route) {
+            self::assertFalse(str_contains($name, '_api_'), $name);
+            self::assertFalse($route->hasDefault(TaskApiRequestListener::ROUTE_FLAG), $name);
+            self::assertFalse(str_contains($route->getPath(), '/v2/'), $route->getPath());
+        }
+    }
+
+    public function testThePathAnswersWhatAnUnknownPathAnswers(): void
+    {
+        $this->client->request('GET', '/api/tasks/v2/user', [], [], ['HTTP_AUTHORIZATION' => 'bt_placeholder']);
+
+        self::assertResponseStatusCodeSame(404);
+        self::assertStringNotContainsString('application/json', (string) $this->client->getResponse()->headers->get('Content-Type'));
+        self::assertFalse($this->client->getResponse()->headers->has('X-RateLimit-Limit'));
+    }
+
+    public function testNoServiceOfTheApiExists(): void
+    {
+        $container = self::getContainer();
+        foreach ($this->serviceIds($container) as $id) {
+            self::assertFalse(str_contains($id, self::API_NAMESPACE), $id);
+            self::assertFalse(str_contains($id, 'nowo_task_board.api'), $id);
+        }
+        self::assertFalse($container->has(TaskApiGuard::class));
+        self::assertFalse($container->has(TaskApiRequestListener::class));
+    }
+
+    public function testNoParameterOfTheApiExists(): void
+    {
+        self::assertFalse(self::getContainer()->hasParameter('nowo_task_board.api.prefix'));
+    }
+
+    public function testNoListenerOfTheApiIsSubscribed(): void
+    {
+        $dispatcher = self::getContainer()->get('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+        foreach ($dispatcher->getListeners() as $event => $listeners) {
+            foreach ($listeners as $listener) {
+                $class = is_array($listener) ? get_debug_type($listener[0]) : get_debug_type($listener);
+                self::assertFalse(str_contains($class, self::API_NAMESPACE), $class . ' on ' . $event);
+            }
+        }
+    }
+
+    public function testNoTableOfTheApiIsRequired(): void
+    {
+        /** @var list<ClassMetadata<object>> $metadata */
+        $metadata = $this->em->getMetadataFactory()->getAllMetadata();
+        foreach ($metadata as $class) {
+            self::assertFalse(str_contains($class->getName(), self::API_NAMESPACE), $class->getName());
+            self::assertFalse(str_contains($class->getTableName(), 'api'), $class->getTableName());
+        }
+        self::assertSame([], array_filter((new SchemaTool($this->em))->getUpdateSchemaSql($metadata), static fn (string $sql): bool => str_contains($sql, 'api')));
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function serviceIds(ContainerInterface $container): array
+    {
+        self::assertTrue(method_exists($container, 'getServiceIds'));
+        $ids = array_map('strval', $container->getServiceIds());
+        sort($ids);
+
+        return $ids;
+    }
+
+    private function router(): RouterInterface
+    {
+        $router = self::getContainer()->get('router');
+        self::assertInstanceOf(RouterInterface::class, $router);
+
+        return $router;
+    }
+}
diff --git a/tests/Functional/Api/ApiPipelineTest.php b/tests/Functional/Api/ApiPipelineTest.php
new file mode 100644
index 00000000..762a0b7b
--- /dev/null
+++ b/tests/Functional/Api/ApiPipelineTest.php
@@ -0,0 +1,299 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiKernel;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use PHPUnit\Framework\Attributes\DataProvider;
+use RuntimeException;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+use Symfony\Component\HttpFoundation\Exception\BadRequestException;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
+use Symfony\Component\HttpKernel\Exception\ServiceUnavailableHttpException;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+use Symfony\Component\Security\Core\Exception\BadCredentialsException;
+use Throwable;
+
+use function json_encode;
+
+/**
+ * Spec 213: what every API request goes through, and the way every answer leaves. Refusals share one shape.
+ */
+final class ApiPipelineTest extends ApiTestCase
+{
+    public function testAKnownTokenReadsItsIdentityWithTheRateHeaders(): void
+    {
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/user');
+
+        self::assertResponseIsSuccessful();
+        self::assertSame(['user' => [
+            'id'             => 'uuid-' . $this->owner->getId(),
+            'username'       => 'owner@example.com',
+            'email'          => 'owner@example.com',
+            'color'          => null,
+            'profilePicture' => null,
+        ]], $this->json());
+        $headers = $this->client->getResponse()->headers;
+        self::assertSame('100', $headers->get('X-RateLimit-Limit'));
+        self::assertSame('99', $headers->get('X-RateLimit-Remaining'));
+        self::assertSame('1790000000', $headers->get('X-RateLimit-Reset'));
+        self::assertStringContainsString('no-store', (string) $headers->get('Cache-Control'));
+        self::assertStringContainsString('private', (string) $headers->get('Cache-Control'));
+        self::assertSame(1, ApiTestHost::$consumed);
+    }
+
+    public function testTheBearerFormWorksToo(): void
+    {
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/user', 'Bearer ' . self::TOKEN);
+
+        self::assertResponseIsSuccessful();
+    }
+
+    public function testTeamsAnswerInClickUpsShape(): void
+    {
+        $this->issueToken(TaskApiLevel::MyTasks);
+
+        $this->get('/api/tasks/v2/team');
+
+        self::assertResponseIsSuccessful();
+        self::assertSame(['teams' => [
+            ['id' => 'team-1', 'name' => 'Personal', 'color' => '#000000', 'avatar' => 'https://example.com/a.png', 'members' => []],
+            ['id' => 'team-2', 'name' => 'Acme', 'color' => null, 'avatar' => null, 'members' => []],
+        ]], $this->json());
+    }
+
+    public function testNoCredentialIsNotAFailedToken(): void
+    {
+        $this->get('/api/tasks/v2/user', null);
+
+        $this->assertRefused(401, 'OAUTH_017');
+        self::assertSame([], ApiTestHost::$failedIps);
+    }
+
+    public function testAnEmptyHeaderIsNoCredential(): void
+    {
+        $this->get('/api/tasks/v2/user', 'Bearer   ');
+
+        $this->assertRefused(401, 'OAUTH_017');
+    }
+
+    public function testACredentialInTheQueryStringIsIgnored(): void
+    {
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/user?token=' . self::TOKEN . '&access_token=' . self::TOKEN . '&Authorization=' . self::TOKEN, null);
+
+        $this->assertRefused(401, 'OAUTH_017');
+    }
+
+    public function testAnUnknownTokenIsAFailedToken(): void
+    {
+        $this->get('/api/tasks/v2/user', 'bt_unknown');
+
+        $this->assertRefused(401, 'OAUTH_019');
+        self::assertSame(['127.0.0.1'], ApiTestHost::$failedIps);
+        self::assertSame(0, ApiTestHost::$consumed);
+    }
+
+    public function testAnIpOverTheFailedTokenLimitIsRefusedEvenWithAGoodToken(): void
+    {
+        $this->issueToken();
+        ApiTestHost::$ipLimitAccepts = false;
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(429, 'RATE_002');
+        self::assertSame('1790000060', $this->client->getResponse()->headers->get('X-RateLimit-Reset'));
+        self::assertSame(0, ApiTestHost::$consumed);
+    }
+
+    public function testATokenOverItsLimitIs429WithTheHeaders(): void
+    {
+        $this->issueToken();
+        ApiTestHost::$tokenLimitAccepts = false;
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(429, 'RATE_001');
+        self::assertSame('0', $this->client->getResponse()->headers->get('X-RateLimit-Remaining'));
+    }
+
+    public function testTheInstanceSwitchAnswers404(): void
+    {
+        $this->issueToken();
+        ApiTestHost::$apiDisabled = true;
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(404, 'API_001');
+        self::assertSame([], ApiTestHost::$failedIps);
+    }
+
+    public function testAUserTheAccessCheckerRefusesIsNotLetIn(): void
+    {
+        $this->user('guest@example.com', ['ROLE_GUEST']);
+        $this->issueToken(email: 'guest@example.com');
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(401, 'OAUTH_019');
+        self::assertSame(0, ApiTestHost::$consumed);
+    }
+
+    public function testATokenWhoseUserIsRefusedCountsAsAFailedToken(): void
+    {
+        // Audit IA-L1 (the auditor's proof, turned): the same 401 as a bad token, and throttled as one.
+        $this->user('guest@example.com', ['ROLE_GUEST']);
+        $this->issueToken(email: 'guest@example.com');
+
+        for ($i = 0; $i < 3; ++$i) {
+            $this->get('/api/tasks/v2/user');
+            $this->assertRefused(401, 'OAUTH_019');
+        }
+
+        self::assertSame(['127.0.0.1', '127.0.0.1', '127.0.0.1'], ApiTestHost::$failedIps);
+        self::assertSame(0, ApiTestHost::$consumed);
+    }
+
+    public function testAPrincipalTheFirewallDoesNotStandBehindFailsClosed(): void
+    {
+        $other = $this->user('other@example.com');
+        $this->issueToken();
+        ApiTestHost::$forcedUser = $other;
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(500, 'SERVER_001');
+        self::assertCount(1, array_filter($this->logger()->records, static fn (array $record): bool => $record['level'] === 'error' && str_contains((string) $record['message'], 'security user')));
+    }
+
+    public function testAPlanWithoutTheModuleIsRefusedOnIdentity(): void
+    {
+        $this->issueToken();
+        ApiTestHost::$planAllows = false;
+
+        foreach (['user', 'team'] as $path) {
+            $this->get('/api/tasks/v2/' . $path);
+            $this->assertRefused(403, 'PLAN_001');
+        }
+    }
+
+    public function testAPersonTheHostDoesNotProfileIsNotFound(): void
+    {
+        $this->issueToken();
+
+        ApiTestHost::$profilesEmpty = true;
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(404, 'ACCESS_001');
+    }
+
+    public function testUnknownPathsAndMethodsUnderThePrefixAnswerInTheSameShape(): void
+    {
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/nothing');
+        $this->assertRefused(404, 'ACCESS_001');
+        $this->get('/api/tasks');
+        $this->assertRefused(404, 'ACCESS_001');
+        $this->client->request('POST', '/api/tasks/v2/user', [], [], ['HTTP_AUTHORIZATION' => self::TOKEN]);
+        $this->assertRefused(404, 'ACCESS_001');
+    }
+
+    public function testAPathOutsideThePrefixIsNotTheApis(): void
+    {
+        $this->get('/api/tasksandmore');
+
+        self::assertResponseStatusCodeSame(404);
+        self::assertStringNotContainsString('application/json', (string) $this->client->getResponse()->headers->get('Content-Type'));
+    }
+
+    /**
+     * @return iterable<string, array{0: Throwable, 1: int, 2: string}>
+     */
+    public static function failures(): iterable
+    {
+        yield 'a refusal' => [new TaskApiRefusal(409, 'LIST_001', 'Last column'), 409, 'LIST_001'];
+        yield 'access denied' => [new AccessDeniedException(), 403, 'ACCESS_002'];
+        yield 'bad credentials' => [new BadCredentialsException(), 401, 'OAUTH_019'];
+        yield 'any other HTTP error' => [new ServiceUnavailableHttpException(), 500, 'SERVER_001'];
+        yield 'a bad request' => [new BadRequestException('secret detail'), 500, 'SERVER_001'];
+        yield 'a crash' => [new RuntimeException('secret detail'), 500, 'SERVER_001'];
+    }
+
+    #[DataProvider('failures')]
+    public function testAFailureInAControllerLeavesAsARefusalWithoutItsMessage(Throwable $failure, int $status, string $ecode): void
+    {
+        $this->issueToken();
+        $this->withListener(KernelEvents::CONTROLLER, static function () use ($failure): void {
+            throw $failure;
+        });
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused($status, $ecode);
+        self::assertStringNotContainsString('secret detail', (string) $this->client->getResponse()->getContent());
+    }
+
+    public function testTheCredentialReachesNoLogNoAnswerAndNoSession(): void
+    {
+        $this->issueToken();
+        $this->get('/api/tasks/v2/user');
+        $good = (string) $this->client->getResponse()->getContent();
+        $this->get('/api/tasks/v2/user', 'bt_unknown_secret_value');
+        $bad = (string) $this->client->getResponse()->getContent();
+
+        $logged = (string) json_encode($this->logger()->records);
+        foreach ([self::TOKEN, 'bt_unknown_secret_value'] as $secret) {
+            self::assertStringNotContainsString($secret, $logged);
+            self::assertStringNotContainsString($secret, $good);
+            self::assertStringNotContainsString($secret, $bad);
+        }
+        self::assertFalse($this->client->getResponse()->headers->has('Set-Cookie'), 'stateless');
+    }
+
+    public function testASubRequestDoesNotEnterThePipeline(): void
+    {
+        $this->issueToken();
+        $kernel = self::$kernel;
+        self::assertInstanceOf(ApiKernel::class, $kernel);
+        $request = Request::create('/api/tasks/v2/user');
+        $request->headers->set('Authorization', self::TOKEN);
+
+        $this->withListener(KernelEvents::CONTROLLER, static function (ControllerEvent $event) use ($kernel): void {
+            if ($event->isMainRequest()) {
+                // An API route without the pipeline has no principal, and the error is the host's page.
+                $response = $kernel->handle(Request::create('/api/tasks/v2/user'), $kernel::SUB_REQUEST);
+                self::assertSame(500, $response->getStatusCode());
+                self::assertFalse($response->headers->has('X-RateLimit-Limit'));
+            }
+        });
+
+        $response = $kernel->handle($request);
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame(1, ApiTestHost::$consumed);
+    }
+
+    private function withListener(string $event, callable $listener): void
+    {
+        $dispatcher = $this->service('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+        $dispatcher->addListener($event, $listener);
+    }
+
+    private function service(string $id): mixed
+    {
+        return self::getContainer()->get($id);
+    }
+}
diff --git a/tests/Functional/Api/ApiQueryBudgetTest.php b/tests/Functional/Api/ApiQueryBudgetTest.php
new file mode 100644
index 00000000..d026ec9f
--- /dev/null
+++ b/tests/Functional/Api/ApiQueryBudgetTest.php
@@ -0,0 +1,154 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Entity\TaskMember;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Enum\TaskDependencyType;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use PHPUnit\Framework\Attributes\DataProvider;
+use Symfony\Bridge\Doctrine\Middleware\Debug\DebugDataHolder;
+
+use function count;
+use function sprintf;
+
+use const STDERR;
+
+/**
+ * Spec 213 SC-003 and FR-010: a list costs the same number of queries with 25 tasks as with 100, each task with members,
+ * subtasks, a dependency, time and a comment. The budget counts every query of the request, the user's included.
+ */
+final class ApiQueryBudgetTest extends ApiTestCase
+{
+    /** The most queries a list endpoint may make, whatever the page holds. */
+    private const BUDGET = 12;
+
+    /**
+     * @return iterable<string, array{0: string}>
+     */
+    public static function endpoints(): iterable
+    {
+        yield 'list tasks' => ['/api/tasks/v2/list/{board}/task?subtasks=true&include_closed=true'];
+        yield 'team tasks' => ['/api/tasks/v2/team/team-1/task?subtasks=true'];
+        yield 'list tasks for my tasks' => ['my:/api/tasks/v2/list/{board}/task'];
+        yield 'lists of a space' => ['/api/tasks/v2/space/space-tenant-a/list'];
+        yield 'tags of a space' => ['/api/tasks/v2/space/space-tenant-a/tag'];
+        yield 'comments' => ['/api/tasks/v2/task/{first}/comment'];
+        yield 'list tasks by tag' => ['/api/tasks/v2/list/{board}/task?tags[]=tag-1&subtasks=true'];
+        yield 'team tasks by tag' => ['/api/tasks/v2/team/team-1/task?tags[]=tag-2'];
+    }
+
+    #[DataProvider('endpoints')]
+    public function testTheSameQueriesFor25And100Tasks(string $endpoint): void
+    {
+        $small = $this->queriesFor($endpoint, 25);
+        $large = $this->queriesFor($endpoint, 100);
+
+        self::assertSame($small, $large, 'no query per task');
+        self::assertLessThanOrEqual(self::BUDGET, $large);
+        fwrite(STDERR, sprintf("\n[budget] %s: %d queries at 25 tasks, %d at 100\n", $endpoint, $small, $large));
+    }
+
+    /**
+     * Audit IA-I8: each board a team request reaches costs its access decision (an event, in the host often a voter), not a
+     * query of the bundle's: the same queries with 1 board as with 10.
+     */
+    public function testTeamTasksCostTheSameQueriesForOneBoardOrTen(): void
+    {
+        $one = $this->teamQueriesFor(1);
+        $ten = $this->teamQueriesFor(10);
+
+        self::assertSame($one, $ten);
+        fwrite(STDERR, sprintf("\n[budget] team tasks: %d queries with 1 board, %d with 10\n", $one, $ten));
+    }
+
+    private function teamQueriesFor(int $boards): int
+    {
+        self::ensureKernelShutdown();
+        $this->setUp();
+        ApiTestHost::$tenants = ['tenant-a'];
+        for ($i = 0; $i < $boards; ++$i) {
+            $this->seed($this->board('Board ' . $i, tenantKey: 'tenant-a'), 3);
+        }
+        $this->issueToken();
+        $this->em->clear();
+
+        return $this->counted('/api/tasks/v2/team/team-1/task?subtasks=true');
+    }
+
+    private function counted(string $path): int
+    {
+        $holder = self::getContainer()->get('doctrine.debug_data_holder');
+        self::assertInstanceOf(DebugDataHolder::class, $holder);
+        $holder->reset();
+        $this->get($path);
+        self::assertResponseIsSuccessful();
+        $count = 0;
+        foreach ($holder->getData() as $queries) {
+            $count += count($queries);
+        }
+
+        return $count;
+    }
+
+    private function queriesFor(string $endpoint, int $tasks): int
+    {
+        self::ensureKernelShutdown();
+        $this->setUp();
+        ApiTestHost::$tenants = ['tenant-a'];
+        $board                = $this->board('Board', tenantKey: 'tenant-a');
+        $first                = $this->seed($board, $tasks);
+        $level                = str_starts_with($endpoint, 'my:') ? TaskApiLevel::MyTasks : TaskApiLevel::Full;
+        $this->issueToken($level);
+        $this->em->clear();
+        $path = strtr((string) preg_replace('/^my:/', '', $endpoint), ['{board}' => $board->getId(), '{first}' => $first]);
+
+        $holder = self::getContainer()->get('doctrine.debug_data_holder');
+        self::assertInstanceOf(DebugDataHolder::class, $holder);
+        $holder->reset();
+        $this->get($path);
+        self::assertResponseIsSuccessful();
+        $count = 0;
+        foreach ($holder->getData() as $queries) {
+            $count += count($queries);
+        }
+
+        return $count;
+    }
+
+    private function seed(TaskBoard $board, int $count): string
+    {
+        $colleague = $this->user('colleague-' . $count . '-' . $board->getId() . '@example.com');
+        $previous  = null;
+        $first     = null;
+        for ($i = 0; $i < $count; ++$i) {
+            $task = new Task(board: $board, title: 'Task ' . $i, creator: $this->owner, column: $board->getColumns()->get($i % 3), position: $i, tags: ['tag-' . ($i % 5)]);
+            $task->addMember(new TaskMember(task: $task, user: $colleague, memberRole: TaskMemberRole::Assignee));
+            $task->addMember(new TaskMember(task: $task, user: $this->owner, memberRole: TaskMemberRole::Watcher));
+            $this->em->persist($task);
+            $this->em->persist(new Task(board: $board, title: 'Item ' . $i, creator: $this->owner, parent: $task, tags: ['checklist:Steps']));
+            $this->em->persist(new TaskTimeEntry($task, $this->owner, 15, new DateTimeImmutable('2026-11-01')));
+            $this->em->persist(new TaskComment($task, $colleague, 'Comment ' . $i));
+            if ($previous instanceof Task) {
+                $this->em->persist(new TaskDependency($previous, $task, TaskDependencyType::Blocks));
+            }
+            $previous = $task;
+            $first ??= $task;
+        }
+        for ($i = 0; $i < $count; ++$i) {
+            $this->em->persist(new TaskComment($first, $colleague, 'On the first ' . $i));
+        }
+        $this->em->flush();
+
+        return $first->getId();
+    }
+}
diff --git a/tests/Functional/Api/ApiReadEndpointsTest.php b/tests/Functional/Api/ApiReadEndpointsTest.php
new file mode 100644
index 00000000..191889ae
--- /dev/null
+++ b/tests/Functional/Api/ApiReadEndpointsTest.php
@@ -0,0 +1,454 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Entity\TaskMember;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Enum\TaskDependencyType;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Enum\TaskPriority;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+
+use function count;
+
+/**
+ * Spec 213 S3: what each read endpoint answers, in ClickUp's shape, and its filters.
+ */
+final class ApiReadEndpointsTest extends ApiTestCase
+{
+    private TaskBoard $roadmap;
+
+    private AppUser $colleague;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ApiTestHost::$tenants = ['tenant-a', 'tenant-b'];
+        $this->colleague      = $this->user('colleague@example.com');
+        $this->roadmap        = $this->board('Roadmap', tenantKey: 'tenant-a');
+        $this->issueToken();
+    }
+
+    public function testATeamListsItsSpacesAndAnotherTeamNone(): void
+    {
+        $this->get('/api/tasks/v2/team/team-1/space');
+        self::assertResponseIsSuccessful();
+        self::assertSame(['space-tenant-a', 'space-tenant-b'], $this->idsOf('spaces'));
+
+        $this->get('/api/tasks/v2/team/team-2/space');
+        self::assertSame([], $this->listOf('spaces'));
+
+        $this->get('/api/tasks/v2/team/team-9/space');
+        $this->assertRefused(404, 'ACCESS_001');
+    }
+
+    public function testASpaceAndItsFolders(): void
+    {
+        $this->get('/api/tasks/v2/space/space-tenant-a');
+        self::assertResponseIsSuccessful();
+        self::assertSame('space-tenant-a', $this->json()['id']);
+        self::assertSame('Space tenant-a', $this->json()['name']);
+        self::assertFalse($this->json()['private']);
+
+        $this->get('/api/tasks/v2/space/space-tenant-a/folder');
+        self::assertSame(['folders' => []], $this->json());
+
+        $this->get('/api/tasks/v2/space/space-nothing');
+        $this->assertRefused(404, 'ACCESS_001');
+    }
+
+    public function testListsCountOpenTasksAndShowColumnsAsStatuses(): void
+    {
+        $this->task($this->roadmap, 'Open');
+        $this->task($this->roadmap, 'Also open');
+        $this->em->persist((new Task(board: $this->roadmap, title: 'Archived', creator: $this->owner))->archive());
+        $this->em->flush();
+        $this->board('Elsewhere', tenantKey: 'tenant-b');
+
+        $this->get('/api/tasks/v2/space/space-tenant-a/list');
+
+        self::assertResponseIsSuccessful();
+        $lists = $this->listOf('lists');
+        self::assertCount(1, $lists);
+        self::assertSame($this->roadmap->getId(), $lists[0]['id']);
+        self::assertSame(2, $lists[0]['task_count']);
+        self::assertSame(['id' => 'space-tenant-a', 'name' => 'Space tenant-a', 'access' => true], $lists[0]['space']);
+        self::assertSame(['To do' => 'open', 'Doing' => 'custom', 'Done' => 'closed'], array_column($lists[0]['statuses'], 'type', 'status'));
+
+        $this->get('/api/tasks/v2/list/' . $this->roadmap->getId());
+        self::assertSame($lists[0], $this->json());
+    }
+
+    public function testATaskInClickUpsShape(): void
+    {
+        $task = $this->task($this->roadmap, 'Ship the API', 1);
+        $task->setDescription('**Bold** text')->setPriority(TaskPriority::High)->setTags(['api', 'v2'])->setDueAt(new DateTimeImmutable('@1790000000'))->setEstimatedMinutes(90);
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Assignee));
+        $task->addMember(new TaskMember(task: $task, user: $this->owner, memberRole: TaskMemberRole::Watcher));
+        $blocker = $this->task($this->roadmap, 'Blocker');
+        $related = $this->task($this->roadmap, 'Related');
+        $this->em->persist(new TaskDependency($blocker, $task, TaskDependencyType::Blocks));
+        $this->em->persist(new TaskDependency($task, $related, TaskDependencyType::Related));
+        $item = new Task(board: $this->roadmap, title: 'Write the docs', creator: $this->owner, parent: $task, tags: ['checklist:Release']);
+        $this->em->persist($item->markCompleted());
+        $this->em->persist(new Task(board: $this->roadmap, title: 'Test it', creator: $this->owner, parent: $task, position: 1, tags: ['checklist:Release']));
+        $this->em->persist(new Task(board: $this->roadmap, title: 'A plain subtask', creator: $this->owner, parent: $task));
+        $this->em->persist(new TaskTimeEntry($task, $this->owner, 30, new DateTimeImmutable('2026-11-01')));
+        $this->em->flush();
+
+        $this->get('/api/tasks/v2/task/' . $task->getId() . '?include_markdown_description=true&include_subtasks=true');
+
+        self::assertResponseIsSuccessful();
+        $json = $this->json();
+        self::assertSame($task->getId(), $json['id']);
+        self::assertSame('Ship the API', $json['name']);
+        self::assertSame('**Bold** text', $json['description']);
+        self::assertSame('**Bold** text', $json['markdown_description']);
+        self::assertSame(['id' => $this->roadmap->getColumns()->get(1)?->getId(), 'status' => 'Doing', 'color' => null, 'orderindex' => 1, 'type' => 'custom'], $json['status']);
+        self::assertSame(['id' => '2', 'priority' => 'high', 'color' => '#f8ae00', 'orderindex' => '2'], $json['priority']);
+        self::assertSame('1790000000000', $json['due_date']);
+        self::assertSame('5400000', $json['time_estimate']);
+        self::assertSame(1800000, $json['time_spent']);
+        self::assertSame([['name' => 'api', 'tag_fg' => null, 'tag_bg' => null], ['name' => 'v2', 'tag_fg' => null, 'tag_bg' => null]], $json['tags']);
+        self::assertSame('uuid-' . $this->owner->getId(), $json['creator']['id']);
+        self::assertSame(['uuid-' . $this->colleague->getId()], array_column($json['assignees'], 'id'));
+        self::assertSame(['uuid-' . $this->owner->getId()], array_column($json['watchers'], 'id'));
+        self::assertSame([['task_id' => $task->getId(), 'depends_on' => $blocker->getId(), 'type' => 1]], array_map(static fn (array $d): array => array_diff_key($d, ['date_created' => 0]), $json['dependencies']));
+        self::assertSame([$related->getId()], array_column($json['linked_tasks'], 'link_id'));
+        self::assertCount(1, $json['checklists']);
+        self::assertSame(TaskApiReadSerializer::checklistId($task->getId(), 'Release'), $json['checklists'][0]['id']);
+        self::assertSame(['Release', 1, 1], [$json['checklists'][0]['name'], $json['checklists'][0]['resolved'], $json['checklists'][0]['unresolved']]);
+        self::assertSame(['Write the docs', 'Test it'], array_column($json['checklists'][0]['items'], 'name'));
+        self::assertCount(3, $json['subtasks']);
+        self::assertSame(['id' => $this->roadmap->getId(), 'name' => 'Roadmap', 'access' => true], $json['list']);
+        self::assertSame(['id' => 'space-tenant-a'], $json['space']);
+        self::assertSame('team-1', $json['team_id']);
+        self::assertSame([], $json['custom_fields']);
+
+        // The task it blocks sees the other side.
+        $this->get('/api/tasks/v2/task/' . $blocker->getId());
+        self::assertSame(0, $this->json()['dependencies'][0]['type']);
+        self::assertArrayNotHasKey('markdown_description', $this->json());
+    }
+
+    public function testListTasksFilters(): void
+    {
+        $done = $this->task($this->roadmap, 'Done', 2);
+        $done->markCompleted();
+        $doing = $this->task($this->roadmap, 'Doing it', 1);
+        $doing->setTags(['Urgent'])->setDueAt(new DateTimeImmutable('@1800000000'));
+        $doing->addMember(new TaskMember(task: $doing, user: $this->colleague, memberRole: TaskMemberRole::Assignee));
+        $todo = $this->task($this->roadmap, 'To do');
+        $sub  = $this->task($this->roadmap, 'Sub', parent: $todo);
+        $this->em->persist($archived = (new Task(board: $this->roadmap, title: 'Archived', creator: $this->owner))->archive());
+        $this->em->flush();
+        $base = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+
+        $this->get($base);
+        self::assertEqualsCanonicalizing([$doing->getId(), $todo->getId()], $this->idsOf('tasks'), 'open, top-level, not archived');
+        self::assertTrue($this->json()['last_page']);
+
+        $this->get($base . '?include_closed=true&subtasks=true');
+        self::assertEqualsCanonicalizing([$done->getId(), $doing->getId(), $todo->getId(), $sub->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?archived=true');
+        self::assertSame([$archived->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?statuses[]=DOING');
+        self::assertSame([$doing->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?assignees[]=uuid-' . $this->colleague->getId());
+        self::assertSame([$doing->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?assignees[]=nobody');
+        self::assertSame([], $this->idsOf('tasks'));
+
+        $this->get($base . '?tags[]=urgent');
+        self::assertSame([$doing->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?due_date_gt=1790000000000');
+        self::assertSame([$doing->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?due_date_lt=1790000000000');
+        self::assertSame([], $this->idsOf('tasks'));
+
+        $this->get($base . '?order_by=id');
+        $ids = $this->idsOf('tasks');
+        $this->get($base . '?order_by=id&reverse=true');
+        self::assertSame(array_reverse($ids), $this->idsOf('tasks'));
+
+        foreach (['page=x', 'page=-1', 'order_by=title', 'reverse=maybe', 'due_date_gt=soon', 'statuses=x&statuses[a][]=1'] as $bad) {
+            $this->get($base . '?' . $bad);
+            if ($bad === 'statuses=x&statuses[a][]=1') {
+                self::assertResponseIsSuccessful('a nested value is no status');
+                continue;
+            }
+            $this->assertRefused(400, 'INPUT_002');
+        }
+
+        $this->get($base . '?statuses=Doing');
+        self::assertSame([$doing->getId()], $this->idsOf('tasks'), 'a single value is a list of one');
+        $this->get($base . '?statuses=Doing&tags=nothing');
+        self::assertSame([], $this->idsOf('tasks'));
+        $this->get($base . '?assignees=x&tags[]=urgent&tags[]=');
+        self::assertSame([], $this->idsOf('tasks'));
+    }
+
+    public function testAHundredPerPage(): void
+    {
+        for ($i = 0; $i < 101; ++$i) {
+            $this->em->persist(new Task(board: $this->roadmap, title: 'Task ' . $i, creator: $this->owner, position: $i));
+        }
+        $this->em->flush();
+        $base = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+
+        $this->get($base);
+        self::assertCount(100, $this->listOf('tasks'));
+        self::assertFalse($this->json()['last_page']);
+        $first = $this->idsOf('tasks');
+
+        $this->get($base . '?page=1');
+        self::assertCount(1, $this->listOf('tasks'));
+        self::assertTrue($this->json()['last_page']);
+        self::assertNotContains($this->idsOf('tasks')[0], $first);
+
+        $this->get($base . '?page=1&tags[]=nothing');
+        self::assertSame([], $this->listOf('tasks'));
+    }
+
+    public function testTeamTasksAcrossBoardsNarrowedBySpaceAndList(): void
+    {
+        $here      = $this->task($this->roadmap, 'Here');
+        $elsewhere = $this->board('Elsewhere', tenantKey: 'tenant-b');
+        $there     = $this->task($elsewhere, 'There');
+
+        $this->get('/api/tasks/v2/team/team-1/task');
+        self::assertEqualsCanonicalizing([$here->getId(), $there->getId()], $this->idsOf('tasks'));
+
+        $this->get('/api/tasks/v2/team/team-1/task?space_ids[]=space-tenant-b');
+        self::assertSame([$there->getId()], $this->idsOf('tasks'));
+
+        $this->get('/api/tasks/v2/team/team-1/task?list_ids[]=' . $this->roadmap->getId());
+        self::assertSame([$here->getId()], $this->idsOf('tasks'));
+
+        $this->get('/api/tasks/v2/team/team-2/task');
+        self::assertSame([], $this->idsOf('tasks'));
+    }
+
+    public function testCommentsNewestFirstTwentyFivePerPageWithoutDeletedOnes(): void
+    {
+        $task = $this->task($this->roadmap, 'Discussed');
+        for ($i = 0; $i < 27; ++$i) {
+            $this->em->persist(new TaskComment($task, $this->colleague, 'Comment ' . $i));
+        }
+        $this->em->persist((new TaskComment($task, $this->owner, 'Gone'))->markDeleted());
+        $this->em->persist(new TaskComment($task, null, 'Erased author'));
+        $this->em->flush();
+        $base = '/api/tasks/v2/task/' . $task->getId() . '/comment';
+
+        $this->get($base);
+        $first = $this->listOf('comments');
+        self::assertCount(25, $first);
+        self::assertNotContains('Gone', array_column($first, 'comment_text'));
+        $oldest = $first[24];
+
+        $this->get($base . '?start=' . $oldest['date'] . '&start_id=' . $oldest['id']);
+        $second = $this->listOf('comments');
+        self::assertCount(3, $second);
+        self::assertSame([], array_intersect(array_column($first, 'id'), array_column($second, 'id')));
+        $all = [...$first, ...$second];
+        self::assertSame(1, count(array_filter($all, static fn (array $comment): bool => $comment['user'] === null)), 'an erased author is nobody');
+        self::assertSame([['text' => $all[0]['comment_text']]], $all[0]['comment']);
+
+        $this->get($base . '?start=' . $oldest['date']);
+        self::assertResponseIsSuccessful();
+        $this->get($base . '?start=yesterday');
+        $this->assertRefused(400, 'INPUT_002');
+    }
+
+    public function testMembersTagsFieldsAndTime(): void
+    {
+        $task = $this->task($this->roadmap, 'Staffed');
+        $task->setTags(['b', 'A', 'a']);
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Assignee));
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Watcher));
+        $this->em->flush();
+
+        $this->get('/api/tasks/v2/task/' . $task->getId() . '/member');
+        self::assertSame(['uuid-' . $this->colleague->getId()], $this->idsOf('members'));
+
+        $this->get('/api/tasks/v2/space/space-tenant-a/tag');
+        self::assertSame(['a', 'b'], array_column($this->listOf('tags'), 'name'));
+        $this->get('/api/tasks/v2/space/space-tenant-b/tag');
+        self::assertSame([], $this->listOf('tags'));
+
+        $this->get('/api/tasks/v2/list/' . $this->roadmap->getId() . '/field');
+        self::assertSame(['fields' => []], $this->json());
+
+        $this->get('/api/tasks/v2/team/team-1/time_entries?start_date=1789000000000&end_date=1791000000000&assignee=a,,b&task_id=' . $task->getId());
+        self::assertResponseIsSuccessful();
+        self::assertSame([[
+            'id'          => 'entry-1',
+            'task'        => ['id' => $task->getId()],
+            'wid'         => 'team-1',
+            'user'        => ['id' => 'uuid-' . $this->owner->getId()],
+            'billable'    => false,
+            'start'       => '1790000000000',
+            'end'         => '1790003600000',
+            'duration'    => '3600000',
+            'description' => 'Review',
+        ]], $this->listOf('data'));
+        $query = ApiTestHost::$timeQueries[0];
+        self::assertSame(['a', 'b'], $query->assigneeIds);
+        self::assertSame(1789000000, $query->from?->getTimestamp());
+        self::assertSame(1791000000, $query->to?->getTimestamp());
+
+        $this->get('/api/tasks/v2/team/team-1/time_entries');
+        self::assertNull(ApiTestHost::$timeQueries[1]->taskId);
+        self::assertNull($this->listOf('data')[0]['task']);
+        $this->get('/api/tasks/v2/team/team-1/time_entries?assignee[]=a');
+        $this->assertRefused(400, 'INPUT_002');
+        $this->get('/api/tasks/v2/team/team-1/time_entries?task_id=nothing');
+        $this->assertRefused(404, 'ACCESS_001');
+    }
+
+    public function testAProfileTheHostLeavesOutIsNotShown(): void
+    {
+        $task = $this->task($this->roadmap, 'Private people');
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Assignee));
+        $this->em->flush();
+        ApiTestHost::$profilesEmpty = true;
+
+        $this->get('/api/tasks/v2/task/' . $task->getId());
+        self::assertNull($this->json()['creator']);
+        self::assertSame([], $this->json()['assignees']);
+    }
+
+    public function testSomeoneTheHostDoesNotKnowAndAnErasedCreatorAreNobody(): void
+    {
+        $task = $this->task($this->roadmap, 'Known');
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Assignee));
+        $this->em->persist(new Task(board: $this->roadmap, title: 'Orphan', creator: null));
+        $this->em->flush();
+        ApiTestHost::$unknownEmails = ['colleague@example.com'];
+
+        $this->get('/api/tasks/v2/list/' . $this->roadmap->getId() . '/task');
+
+        $tasks = array_column($this->listOf('tasks'), null, 'name');
+        self::assertSame([], $tasks['Known']['assignees']);
+        self::assertSame('uuid-' . $this->owner->getId(), $tasks['Known']['creator']['id']);
+        self::assertNull($tasks['Orphan']['creator']);
+    }
+
+    public function testBoardsWithoutATenantFormTheirOwnSpace(): void
+    {
+        ApiTestHost::$tenants = [null];
+        $loose                = $this->board('No tenant');
+
+        $this->get('/api/tasks/v2/space/space-none/list');
+
+        self::assertSame([$loose->getId()], $this->idsOf('lists'));
+    }
+
+    public function testMyTasksSeesOnlyItsSubtasksAndTheChecklistItemsOfItsTask(): void
+    {
+        // Audit IA-M2 (the auditor's proof, turned), and the owner's exception for checklist items.
+        $own    = $this->task($this->roadmap, 'Own parent');
+        $hidden = new Task(board: $this->roadmap, title: 'Colleague secret subtask', creator: $this->colleague, parent: $own);
+        $item   = new Task(board: $this->roadmap, title: 'Colleague checklist item', creator: $this->colleague, parent: $own, tags: ['checklist:Steps']);
+        $this->em->persist($hidden);
+        $this->em->persist($item);
+        $this->em->flush();
+        $this->issueToken(TaskApiLevel::MyTasks);
+
+        $this->get('/api/tasks/v2/task/' . $hidden->getId());
+        $this->assertRefused(404, 'ACCESS_001');
+        $this->get('/api/tasks/v2/task/' . $own->getId() . '?include_subtasks=true');
+        self::assertResponseIsSuccessful();
+        self::assertStringNotContainsString('Colleague secret subtask', (string) $this->client->getResponse()->getContent());
+        self::assertSame(['Colleague checklist item'], array_column($this->json()['subtasks'], 'name'));
+        self::assertSame(['Colleague checklist item'], array_column($this->json()['checklists'][0]['items'], 'name'));
+
+        $this->issueToken(TaskApiLevel::Read);
+        $this->get('/api/tasks/v2/task/' . $own->getId() . '?include_subtasks=true');
+        self::assertCount(2, $this->json()['subtasks'], 'a Read token sees every subtask');
+    }
+
+    public function testARelationToATaskTheTokenCannotOpenIsLeftOut(): void
+    {
+        // Audit IA-I7.
+        $own    = $this->task($this->roadmap, 'Own');
+        $theirs = new Task(board: $this->roadmap, title: 'Theirs', creator: $this->colleague);
+        $mine   = $this->task($this->roadmap, 'Also mine');
+        $this->em->persist($theirs);
+        $this->em->persist(new TaskDependency($theirs, $own, TaskDependencyType::Blocks));
+        $this->em->persist(new TaskDependency($own, $mine, TaskDependencyType::Related));
+        $this->em->persist(new TaskDependency($own, $theirs, TaskDependencyType::Related));
+        $this->em->flush();
+
+        $this->issueToken(TaskApiLevel::MyTasks);
+        $this->get('/api/tasks/v2/task/' . $own->getId());
+        self::assertSame([], $this->json()['dependencies']);
+        self::assertSame([$mine->getId()], array_column($this->json()['linked_tasks'], 'link_id'));
+        self::assertStringNotContainsString($theirs->getId(), (string) $this->client->getResponse()->getContent());
+
+        $this->issueToken(TaskApiLevel::Read);
+        $this->get('/api/tasks/v2/task/' . $own->getId());
+        self::assertCount(1, $this->json()['dependencies']);
+        self::assertCount(2, $this->json()['linked_tasks']);
+    }
+
+    public function testTheTagFilterMatchesWholeTagsCaseAside(): void
+    {
+        $a = $this->task($this->roadmap, 'A');
+        $a->setTags(['Front-end', '50%_done']);
+        $b = $this->task($this->roadmap, 'B');
+        $b->setTags(['front']);
+        $c = $this->task($this->roadmap, 'C');
+        $c->setTags(['niño', 'ops/infra']);
+        $this->em->flush();
+        $base = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task?tags[]=';
+
+        $this->get($base . 'FRONT-END');
+        self::assertSame(['A'], array_column($this->listOf('tasks'), 'name'));
+        $this->get($base . 'front');
+        self::assertSame(['B'], array_column($this->listOf('tasks'), 'name'), 'no partial match');
+        $this->get($base . '50%25_done');
+        self::assertSame(['A'], array_column($this->listOf('tasks'), 'name'), 'wildcards are literal');
+        $this->get($base . '50x_done');
+        self::assertSame([], $this->listOf('tasks'));
+        $this->get($base . 'niño');
+        self::assertSame(['C'], array_column($this->listOf('tasks'), 'name'));
+        $this->get($base . 'ops/infra');
+        self::assertSame(['C'], array_column($this->listOf('tasks'), 'name'));
+        $this->get($base . 'front&tags[]=niño');
+        self::assertEqualsCanonicalizing(['B', 'C'], array_column($this->listOf('tasks'), 'name'), 'any of the tags');
+    }
+
+    public function testAMyTasksTokenCountsOnlyItsOwn(): void
+    {
+        $this->task($this->roadmap, 'Mine');
+        $theirs   = new Task(board: $this->roadmap, title: 'Theirs', creator: $this->colleague);
+        $assigned = new Task(board: $this->roadmap, title: 'Assigned to me', creator: $this->colleague);
+        $assigned->addMember(new TaskMember(task: $assigned, user: $this->owner, memberRole: TaskMemberRole::Assignee));
+        $this->em->persist($theirs);
+        $this->em->persist($assigned);
+        $this->em->flush();
+        $this->issueToken(TaskApiLevel::MyTasks);
+
+        $this->get('/api/tasks/v2/list/' . $this->roadmap->getId());
+        self::assertSame(2, $this->json()['task_count']);
+        $this->get('/api/tasks/v2/list/' . $this->roadmap->getId() . '/task');
+        self::assertEqualsCanonicalizing(['Mine', 'Assigned to me'], array_column($this->listOf('tasks'), 'name'));
+    }
+}
diff --git a/tests/Functional/Api/ApiReadMatrixTest.php b/tests/Functional/Api/ApiReadMatrixTest.php
new file mode 100644
index 00000000..b3cd9ee3
--- /dev/null
+++ b/tests/Functional/Api/ApiReadMatrixTest.php
@@ -0,0 +1,237 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Event\BoardAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+
+use function in_array;
+use function json_encode;
+use function sprintf;
+use function str_contains;
+
+/**
+ * Spec 213 SC-001, read half: every read endpoint × the four levels × own task, another's task, another project, a board
+ * outside where, a removed member, a revoked or expired token, the plan without the module. Every answer is asserted, and a
+ * list never shows what the token may not read.
+ */
+final class ApiReadMatrixTest extends ApiTestCase
+{
+    /** Endpoints that ask more than the level's own reads. */
+    private const READ_EVERYTHING = ['tags', 'fields', 'members own'];
+
+    /** Endpoints of a team: they answer with what remains, never 404 for a case of where. */
+    private const TEAM_LEVEL = ['team spaces', 'team tasks', 'time'];
+
+    private TaskBoard $roadmap;
+
+    private TaskBoard $sideBoard;
+
+    private Task $own;
+
+    private Task $others;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ApiTestHost::$tenants = ['tenant-a', 'tenant-b'];
+        $colleague            = $this->user('colleague@example.com');
+        $this->roadmap        = $this->board('Roadmap', tenantKey: 'tenant-a');
+        $this->sideBoard      = $this->board('Side', tenantKey: 'tenant-a');
+        $this->board('Other project', tenantKey: 'tenant-b');
+        $this->own    = $this->task($this->roadmap, 'Own');
+        $this->others = new Task(board: $this->roadmap, title: 'Others', creator: $colleague);
+        $this->em->persist($this->others);
+        $this->em->flush();
+    }
+
+    public function testEachLevelWithinReach(): void
+    {
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level);
+            foreach ($this->endpoints() as $name => $path) {
+                $this->get($path);
+                $mine = $level === TaskApiLevel::MyTasks;
+                match (true) {
+                    $mine && str_contains($name, 'other')                 => $this->assertRefused(404, 'ACCESS_001'),
+                    $mine && in_array($name, self::READ_EVERYTHING, true) => $this->assertRefused(403, 'TOKEN_001'),
+                    default                                               => self::assertResponseIsSuccessful($level->value . ' ' . $name),
+                };
+            }
+            // Lists hold what the level reads, and counts count only that.
+            $this->get('/api/tasks/v2/list/' . $this->roadmap->getId() . '/task');
+            self::assertSame($mine ? ['Own'] : ['Own', 'Others'], $this->sortedNames(), $level->value);
+            $this->get('/api/tasks/v2/team/team-1/task');
+            self::assertSame($mine ? ['Own'] : ['Own', 'Others'], $this->sortedNames(), $level->value);
+            $this->get('/api/tasks/v2/space/space-tenant-a/list');
+            self::assertSame($mine ? 1 : 2, $this->taskCountOf($this->roadmap), $level->value);
+        }
+    }
+
+    public function testAnotherProjectIsOutOfReachWhateverTheLevel(): void
+    {
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level, TaskApiWhere::limitedTo(['tenant-b'], []));
+            foreach ($this->endpoints() as $name => $path) {
+                $this->get($path);
+                if (in_array($name, self::TEAM_LEVEL, true)) {
+                    self::assertResponseIsSuccessful($level->value . ' ' . $name);
+                    $this->assertShowsNothingOf('tenant-a', $name);
+                    continue;
+                }
+                $this->assertRefused(404, 'ACCESS_001');
+            }
+        }
+    }
+
+    public function testABoardOutsideWhereIsOutOfReachAndItsSpaceShowsOnlyTheNamedBoard(): void
+    {
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level, TaskApiWhere::limitedTo([], [$this->sideBoard->getId()]));
+            foreach ($this->endpoints() as $name => $path) {
+                $this->get($path);
+                $onSpace = str_contains($path, '/space/');
+                match (true) {
+                    in_array($name, self::TEAM_LEVEL, true)                          => self::assertResponseIsSuccessful($name),
+                    $onSpace && $level === TaskApiLevel::MyTasks && $name === 'tags' => $this->assertRefused(403, 'TOKEN_001'),
+                    $onSpace                                                         => self::assertResponseIsSuccessful($name),
+                    default                                                          => $this->assertRefused(404, 'ACCESS_001'),
+                };
+            }
+            $this->get('/api/tasks/v2/space/space-tenant-a/list');
+            self::assertSame([$this->sideBoard->getId()], $this->idsOf('lists'));
+            $this->get('/api/tasks/v2/team/team-1/task');
+            self::assertSame([], $this->listOf('tasks'));
+            $this->get('/api/tasks/v2/team/team-1/space');
+            self::assertSame(['space-tenant-a'], $this->idsOf('spaces'));
+        }
+    }
+
+    public function testARemovedMemberReachesNothingOnTheNextRequest(): void
+    {
+        $this->issueToken();
+        $this->get('/api/tasks/v2/task/' . $this->own->getId());
+        self::assertResponseIsSuccessful();
+
+        $dispatcher = self::getContainer()->get('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+        $dispatcher->addListener(TaskBoardEvents::BOARD_ACCESS_CHECK, static function (BoardAccessCheckEvent $event): void {
+            $event->deny();
+        });
+
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level);
+            foreach ($this->endpoints() as $name => $path) {
+                $this->get($path);
+                if (in_array($name, self::TEAM_LEVEL, true) || in_array($name, ['space', 'folders', 'lists'], true) || ($name === 'tags' && $level !== TaskApiLevel::MyTasks)) {
+                    self::assertResponseIsSuccessful($name);
+                    $this->assertShowsNothingOf('Roadmap', $name);
+                    continue;
+                }
+                $name === 'tags' ? $this->assertRefused(403, 'TOKEN_001') : $this->assertRefused(404, 'ACCESS_001');
+            }
+        }
+    }
+
+    public function testARevokedOrExpiredTokenIsRefusedEverywhere(): void
+    {
+        // The host's authenticator answers Invalid for both: the bundle cannot tell them apart, nor can the client.
+        foreach ($this->endpoints() as $path) {
+            $this->get($path, 'bt_revoked_placeholder');
+            $this->assertRefused(401, 'OAUTH_019');
+        }
+    }
+
+    public function testAPlanWithoutTheModuleForTheProject(): void
+    {
+        ApiTestHost::$planRefusesTenants = ['tenant-a'];
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level);
+            foreach ($this->endpoints() as $name => $path) {
+                $this->get($path);
+                match (true) {
+                    in_array($name, self::TEAM_LEVEL, true)                          => self::assertResponseIsSuccessful($name),
+                    $level === TaskApiLevel::MyTasks && str_contains($name, 'other') => $this->assertRefused(404, 'ACCESS_001'),
+                    default                                                          => $this->assertRefused(403, 'PLAN_001'),
+                };
+            }
+            $this->get('/api/tasks/v2/team/team-1/space');
+            self::assertSame(['space-tenant-b'], $this->idsOf('spaces'));
+            $this->get('/api/tasks/v2/team/team-1/task');
+            self::assertSame([], $this->listOf('tasks'));
+        }
+    }
+
+    public function testAPlanWithoutTheModuleAnywhere(): void
+    {
+        ApiTestHost::$planAllows = false;
+        $this->issueToken();
+        foreach ($this->endpoints() as $name => $path) {
+            $this->get($path);
+            $this->assertRefused(403, 'PLAN_001');
+        }
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function endpoints(): array
+    {
+        $board = $this->roadmap->getId();
+
+        return [
+            'team spaces'    => '/api/tasks/v2/team/team-1/space',
+            'space'          => '/api/tasks/v2/space/space-tenant-a',
+            'folders'        => '/api/tasks/v2/space/space-tenant-a/folder',
+            'lists'          => '/api/tasks/v2/space/space-tenant-a/list',
+            'tags'           => '/api/tasks/v2/space/space-tenant-a/tag',
+            'list'           => '/api/tasks/v2/list/' . $board,
+            'list tasks'     => '/api/tasks/v2/list/' . $board . '/task',
+            'fields'         => '/api/tasks/v2/list/' . $board . '/field',
+            'team tasks'     => '/api/tasks/v2/team/team-1/task',
+            'task own'       => '/api/tasks/v2/task/' . $this->own->getId(),
+            'task other'     => '/api/tasks/v2/task/' . $this->others->getId(),
+            'comments own'   => '/api/tasks/v2/task/' . $this->own->getId() . '/comment',
+            'comments other' => '/api/tasks/v2/task/' . $this->others->getId() . '/comment',
+            'members own'    => '/api/tasks/v2/task/' . $this->own->getId() . '/member',
+            'members other'  => '/api/tasks/v2/task/' . $this->others->getId() . '/member',
+            'time'           => '/api/tasks/v2/team/team-1/time_entries',
+        ];
+    }
+
+    private function assertShowsNothingOf(string $needle, string $name): void
+    {
+        $body = (string) json_encode($this->json());
+        self::assertFalse(str_contains($body, $needle) || str_contains($body, $this->roadmap->getId()), sprintf('%s shows %s', $name, $needle));
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function sortedNames(): array
+    {
+        $names = array_column($this->listOf('tasks'), 'name');
+        sort($names);
+
+        return array_reverse($names);
+    }
+
+    private function taskCountOf(TaskBoard $board): int
+    {
+        foreach ($this->listOf('lists') as $list) {
+            if ($list['id'] === $board->getId()) {
+                return (int) $list['task_count'];
+            }
+        }
+
+        return -1;
+    }
+}
diff --git a/tests/Functional/Api/ApiSyncFieldsTest.php b/tests/Functional/Api/ApiSyncFieldsTest.php
new file mode 100644
index 00000000..f643e8d4
--- /dev/null
+++ b/tests/Functional/Api/ApiSyncFieldsTest.php
@@ -0,0 +1,171 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer;
+use Nowo\TaskBoardBundle\Entity\BoardColumn;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskBoardConnection;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncField;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncFieldValue;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncItem;
+use Nowo\TaskBoardBundle\Sync\Field\SyncFieldType;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiAuditRecorder;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\App\TestSyncLimitChecker;
+use Nowo\TaskBoardBundle\Tests\Functional\Sync\SyncFunctionalTestCase;
+
+/**
+ * Spec 213 (Q-O3): a board's custom fields are those a provider sync imported, read-only; an erased value is not shown.
+ */
+final class ApiSyncFieldsTest extends ApiTestCase
+{
+    protected function setUp(): void
+    {
+        static::$hostConfig = SyncFunctionalTestCase::SYNC_CONFIG;
+        parent::setUp();
+    }
+
+    public function testImportedFieldsAndValues(): void
+    {
+        ApiTestHost::$tenants = ['tenant-a'];
+        $board                = $this->board(tenantKey: 'tenant-a');
+        $task                 = $this->task($board, 'Synced');
+        $now                  = new DateTimeImmutable('@1790000000');
+        $field                = new TaskSyncField($board, 'clickup', 'cf-1', $now);
+        $field->define('Story points', SyncFieldType::Number, 'number', [], ['precision' => 0], 0, $now);
+        $choice = new TaskSyncField($board, 'clickup', 'cf-2', $now);
+        $choice->define('Stage', SyncFieldType::Text, 'drop_down', [['id' => 'o1', 'name' => 'Alpha', 'color' => null]], [], 1, $now);
+        $erased = new TaskSyncFieldValue($choice, $task, 'o1', 'Alpha', $now);
+        $erased->erase('record', $now);
+        foreach ([$field, $choice, new TaskSyncFieldValue($field, $task, 8, '8', $now), $erased] as $entity) {
+            $this->em->persist($entity);
+        }
+        $this->em->flush();
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/list/' . $board->getId() . '/field');
+        self::assertSame([
+            ['id' => $field->getId(), 'name' => 'Story points', 'type' => 'number', 'type_config' => ['precision' => 0], 'date_created' => '1790000000000', 'hide_from_guests' => false, 'required' => false],
+            ['id' => $choice->getId(), 'name' => 'Stage', 'type' => 'drop_down', 'type_config' => ['options' => [['id' => 'o1', 'name' => 'Alpha', 'color' => null]]], 'date_created' => '1790000000000', 'hide_from_guests' => false, 'required' => false],
+        ], $this->listOf('fields'));
+
+        $this->get('/api/tasks/v2/task/' . $task->getId());
+        self::assertSame([['id' => $field->getId(), 'name' => 'Story points', 'type' => 'number', 'value' => 8]], $this->json()['custom_fields']);
+    }
+
+    public function testTheHostsLimitOfActiveTasksRefusesAReopening(): void
+    {
+        // The limit TaskManager asks when a completed task leaves the done column (sync.limit_checker), as in the UI.
+        ApiTestHost::$tenants = ['tenant-a'];
+        $board                = $this->board(tenantKey: 'tenant-a');
+        $done                 = new Task(board: $board, title: 'Done', creator: $this->owner, column: $board->getColumns()->last() ?: null);
+        $item                 = new Task(board: $board, title: 'Item', creator: $this->owner, column: $board->getColumns()->last() ?: null, parent: $done, tags: ['checklist:Steps']);
+        $this->em->persist($done->markCompleted());
+        $this->em->persist($item->markCompleted());
+        $this->em->flush();
+        $this->issueToken();
+        TestSyncLimitChecker::$refuseTasks = true;
+
+        try {
+            $this->send('PUT', '/api/tasks/v2/task/' . $done->getId(), ['status' => 'To do']);
+            $this->assertRefused(403, 'PLAN_002');
+            $this->send('PUT', '/api/tasks/v2/checklist/' . TaskApiReadSerializer::checklistId($done->getId(), 'Steps') . '/checklist_item/' . $item->getId(), ['resolved' => false]);
+            $this->assertRefused(403, 'PLAN_002');
+        } finally {
+            TestSyncLimitChecker::reset();
+        }
+        $this->em->clear();
+        self::assertTrue($this->em->find(Task::class, $done->getId())?->isCompleted());
+        self::assertTrue($this->em->find(Task::class, $item->getId())?->isCompleted());
+    }
+
+    public function testEveryLimitIsAskedBeforeTheFirstSave(): void
+    {
+        // Audit IA-L6: restoring an archived done task and moving it out of the done column; the limit refuses, nothing is saved.
+        ApiTestHost::$tenants = ['tenant-a'];
+        $board                = $this->board(tenantKey: 'tenant-a');
+        $task                 = new Task(board: $board, title: 'Shelved', creator: $this->owner, column: $board->getColumns()->last() ?: null);
+        $open                 = new Task(board: $board, title: 'Shelved open', creator: $this->owner);
+        $this->em->persist($task->markCompleted()->archive());
+        $this->em->persist($open->archive());
+        $this->em->flush();
+        $this->issueToken();
+        TestSyncLimitChecker::$refuseTasks = true;
+
+        try {
+            $this->send('PUT', '/api/tasks/v2/task/' . $task->getId(), ['archived' => false, 'status' => 'To do']);
+            $this->assertRefused(403, 'PLAN_002');
+            $this->send('PUT', '/api/tasks/v2/task/' . $open->getId(), ['archived' => false, 'name' => 'Renamed']);
+            $this->assertRefused(403, 'PLAN_002');
+        } finally {
+            TestSyncLimitChecker::reset();
+        }
+        $this->em->clear();
+        self::assertTrue($this->em->find(Task::class, $task->getId())?->isArchived(), 'still archived');
+        self::assertTrue($this->em->find(Task::class, $task->getId())?->isCompleted());
+        self::assertSame('Shelved open', $this->em->find(Task::class, $open->getId())?->getTitle());
+        $audit = self::getContainer()->get('app.api_audit');
+        self::assertInstanceOf(ApiAuditRecorder::class, $audit);
+        self::assertSame([], $audit->events, 'nothing written, nothing audited');
+    }
+
+    public function testDeletingTheDoneColumnAsksTheLimitForTheTasksItReopens(): void
+    {
+        ApiTestHost::$tenants = ['tenant-a'];
+        $board                = $this->board(tenantKey: 'tenant-a');
+        $done                 = $board->getColumns()->last();
+        self::assertInstanceOf(BoardColumn::class, $done);
+        $this->em->persist((new Task(board: $board, title: 'Finished', creator: $this->owner, column: $done))->markCompleted());
+        $this->em->flush();
+        $this->issueToken();
+        $this->em->clear();
+        TestSyncLimitChecker::$refuseTasks = true;
+
+        try {
+            $this->send('DELETE', '/api/tasks/v2/list/' . $board->getId() . '/status/' . $done->getId());
+        } finally {
+            TestSyncLimitChecker::reset();
+        }
+
+        $this->assertRefused(403, 'PLAN_002');
+        $this->em->clear();
+        self::assertCount(3, $this->em->find(TaskBoard::class, $board->getId())?->getColumns() ?? []);
+    }
+
+    public function testABoardThatFollowsAProviderIsNotDeletedThroughTheApi(): void
+    {
+        ApiTestHost::$tenants = ['tenant-a'];
+        $board                = $this->board(tenantKey: 'tenant-a');
+        $this->em->persist(new TaskBoardConnection($board, 'clickup', 'list', 'conn-1', 'L1', 'Backlog'));
+        $this->em->flush();
+        $this->issueToken();
+
+        $this->send('DELETE', '/api/tasks/v2/list/' . $board->getId());
+
+        $this->assertRefused(409, 'LIST_002');
+        $this->em->clear();
+        self::assertNotNull($this->em->find(TaskBoard::class, $board->getId()));
+    }
+
+    public function testATaskThatFollowsAProviderIsNotDeletedThroughTheApi(): void
+    {
+        ApiTestHost::$tenants = ['tenant-a'];
+        $board                = $this->board(tenantKey: 'tenant-a');
+        $task                 = $this->task($board, 'Synced');
+        $connection           = new TaskBoardConnection($board, 'clickup', 'list', 'conn-1', 'L1', 'Backlog');
+        $this->em->persist($connection);
+        $this->em->persist(new TaskSyncItem($connection, $board->getId(), $task, 'remote-1', new DateTimeImmutable('@1790000000')));
+        $this->em->flush();
+        $this->issueToken();
+
+        $this->send('DELETE', '/api/tasks/v2/task/' . $task->getId());
+
+        $this->assertRefused(409, 'TASK_002');
+        self::assertCount(1, $this->em->getRepository(Task::class)->findAll());
+    }
+}
diff --git a/tests/Functional/Api/ApiTenancyTest.php b/tests/Functional/Api/ApiTenancyTest.php
new file mode 100644
index 00000000..4c63cd7f
--- /dev/null
+++ b/tests/Functional/Api/ApiTenancyTest.php
@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ScriptedTenantResolver;
+
+/**
+ * Audit IA-L2: with tenancy the guard asks the bundle's tenant resolver, as the UI does, so a host whose workspace hook is
+ * too permissive does not open another tenant's boards.
+ */
+final class ApiTenancyTest extends ApiTestCase
+{
+    protected function setUp(): void
+    {
+        static::$hostConfig = ['tenancy' => [
+            'enabled'      => true,
+            'resolver'     => 'app.tenant_resolver',
+            'tenant_paths' => [['path' => '/t/{tenantSlug}', 'name_prefix' => 't_']],
+        ]];
+        ScriptedTenantResolver::$open = ['mine'];
+        parent::setUp();
+        // A permissive workspace: it answers for every tenant the test names.
+        ApiTestHost::$tenants = ['mine', 'theirs', null];
+    }
+
+    protected function tearDown(): void
+    {
+        ScriptedTenantResolver::$open = [];
+        parent::tearDown();
+    }
+
+    public function testATenantTheResolverRefusesIsOutOfReachEvenIfTheWorkspaceAnswersForIt(): void
+    {
+        $mine      = $this->board('Mine', tenantKey: 'mine');
+        $theirs    = $this->board('Theirs', tenantKey: 'theirs');
+        $loose     = $this->board('Loose');
+        $theirTask = $this->task($theirs, 'Their task');
+        $principal = new TaskApiPrincipal($this->owner, TaskApiLevel::Full, TaskApiWhere::everything(), 'id', 'name');
+
+        self::assertSame($mine->getId(), $this->guard()->board($principal, $mine->getId(), TaskApiCapability::ReadOwn)->getId());
+        foreach ([fn () => $this->guard()->board($principal, $theirs->getId(), TaskApiCapability::ReadOwn), fn () => $this->guard()->task($principal, $theirTask->getId(), TaskApiCapability::ReadOwn), fn () => $this->guard()->board($principal, $loose->getId(), TaskApiCapability::ReadOwn)] as $call) {
+            try {
+                $call();
+                self::fail('404 expected');
+            } catch (TaskApiRefusal $refusal) {
+                self::assertSame('ACCESS_001', $refusal->ecode);
+            }
+        }
+    }
+
+    public function testSpacesAndTeamListsLeaveOutWhatTheResolverRefuses(): void
+    {
+        $mine = $this->task($this->board('Mine', tenantKey: 'mine'), 'Mine');
+        $this->task($this->board('Theirs', tenantKey: 'theirs'), 'Theirs');
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/team/team-1/space');
+        self::assertSame(['space-mine'], $this->idsOf('spaces'));
+        $this->get('/api/tasks/v2/team/team-1/task');
+        self::assertSame([$mine->getId()], $this->idsOf('tasks'));
+        foreach (['/api/tasks/v2/space/space-theirs', '/api/tasks/v2/space/space-theirs/list', '/api/tasks/v2/space/space-none'] as $path) {
+            $this->get($path);
+            $this->assertRefused(404, 'ACCESS_001');
+        }
+    }
+
+    private function guard(): TaskApiGuard
+    {
+        $guard = self::getContainer()->get(TaskApiGuard::class);
+        self::assertInstanceOf(TaskApiGuard::class, $guard);
+
+        return $guard;
+    }
+}
diff --git a/tests/Functional/Api/ApiTestCase.php b/tests/Functional/Api/ApiTestCase.php
new file mode 100644
index 00000000..c9fa719c
--- /dev/null
+++ b/tests/Functional/Api/ApiTestCase.php
@@ -0,0 +1,118 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiKernel;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\FunctionalTestCase;
+use Symfony\Component\HttpKernel\KernelInterface;
+
+use function is_string;
+use function json_decode;
+use function json_encode;
+
+/**
+ * The bundle on {@see ApiKernel}, every hook scripted through {@see ApiTestHost}.
+ */
+abstract class ApiTestCase extends FunctionalTestCase
+{
+    /** A placeholder, in the host's format. */
+    protected const TOKEN = 'bt_placeholder_token';
+
+    /** @var array<string, mixed> */
+    protected static array $api = [];
+
+    /** @var array<string, mixed> */
+    protected static array $hostConfig = [];
+
+    protected static bool $withFirewall = true;
+
+    protected static function createKernel(array $options = []): KernelInterface
+    {
+        return new ApiKernel(static::$api, static::$hostConfig, static::$withFirewall);
+    }
+
+    protected function setUp(): void
+    {
+        ApiTestHost::reset();
+        parent::setUp();
+    }
+
+    protected function tearDown(): void
+    {
+        static::$api          = [];
+        static::$hostConfig   = [];
+        static::$withFirewall = true;
+        ApiTestHost::reset();
+        parent::tearDown();
+    }
+
+    protected function issueToken(TaskApiLevel $level = TaskApiLevel::Full, ?TaskApiWhere $where = null, string $email = 'owner@example.com', string $token = self::TOKEN): void
+    {
+        ApiTestHost::$tokens[$token] = ['email' => $email, 'level' => $level, 'where' => $where ?? TaskApiWhere::everything(), 'id' => $token];
+    }
+
+    /**
+     * @param array<string, string> $server
+     */
+    protected function get(string $path, ?string $authorization = self::TOKEN, array $server = []): void
+    {
+        if ($authorization !== null) {
+            $server['HTTP_AUTHORIZATION'] = $authorization;
+        }
+        $this->client->request('GET', $path, [], [], $server);
+    }
+
+    /**
+     * A write: `$body` as JSON, or the raw string given.
+     *
+     * @param array<string, mixed>|string|null $body
+     * @param array<string, string> $headers HTTP_* server keys
+     */
+    protected function send(string $method, string $path, array|string|null $body = null, array $headers = [], string $token = self::TOKEN): void
+    {
+        $content = is_string($body) ? $body : ($body === null ? '' : (string) json_encode($body));
+        $this->client->request($method, $path, [], [], $headers + ['HTTP_AUTHORIZATION' => $token, 'CONTENT_TYPE' => 'application/json'], $content);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    protected function json(): array
+    {
+        $decoded = json_decode((string) $this->client->getResponse()->getContent(), true);
+        self::assertIsArray($decoded);
+
+        return $decoded;
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    protected function listOf(string $key): array
+    {
+        $list = $this->json()[$key] ?? null;
+        self::assertIsArray($list);
+
+        return array_values($list);
+    }
+
+    /**
+     * @return list<string>
+     */
+    protected function idsOf(string $key): array
+    {
+        return array_map(static fn (array $item): string => (string) $item['id'], $this->listOf($key));
+    }
+
+    protected function assertRefused(int $status, string $ecode): void
+    {
+        self::assertResponseStatusCodeSame($status);
+        self::assertSame($ecode, $this->json()['ECODE'] ?? null);
+        self::assertSame(['err', 'ECODE'], array_keys($this->json()));
+    }
+}
diff --git a/tests/Functional/Api/ApiWithoutFirewallTest.php b/tests/Functional/Api/ApiWithoutFirewallTest.php
new file mode 100644
index 00000000..1aa0fdef
--- /dev/null
+++ b/tests/Functional/Api/ApiWithoutFirewallTest.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+/**
+ * Spec 213: a host that left the API out of its firewall: the checkers would judge nobody, so it answers 500 and opens nothing.
+ */
+final class ApiWithoutFirewallTest extends ApiTestCase
+{
+    protected function setUp(): void
+    {
+        static::$withFirewall = false;
+        parent::setUp();
+    }
+
+    public function testNothingIsAnsweredWithoutTheSecurityUser(): void
+    {
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(500, 'SERVER_001');
+    }
+}
diff --git a/tests/Functional/Api/ApiWriteEndpointsTest.php b/tests/Functional/Api/ApiWriteEndpointsTest.php
new file mode 100644
index 00000000..22bbd5ba
--- /dev/null
+++ b/tests/Functional/Api/ApiWriteEndpointsTest.php
@@ -0,0 +1,425 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Dto\TaskFormData;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Entity\TaskMember;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Event\TaskMentionEvent;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiAuditRecorder;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+use Nowo\TaskBoardBundle\Tests\Functional\App\RecordingQuotaListener;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+
+use function str_repeat;
+
+/**
+ * Spec 213 S4: what each write does, through the services the UI uses (FR-011): their events, limits and history.
+ */
+final class ApiWriteEndpointsTest extends ApiTestCase
+{
+    private TaskBoard $roadmap;
+
+    private AppUser $colleague;
+
+    /** @var list<string> */
+    private array $events = [];
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ApiTestHost::$tenants = ['tenant-a'];
+        $this->colleague      = $this->user('colleague@example.com');
+        $this->roadmap        = $this->board('Roadmap', tenantKey: 'tenant-a');
+        $this->issueToken();
+        foreach ([TaskBoardEvents::TASK_CREATED, TaskBoardEvents::TASK_UPDATED, TaskBoardEvents::TASK_MOVED, TaskBoardEvents::TASK_COMPLETED, TaskBoardEvents::TASK_REOPENED, TaskBoardEvents::TASK_MEMBER_ADDED, TaskBoardEvents::TASK_COMMENT, TaskBoardEvents::TASK_ERASED] as $name) {
+            $this->dispatcher()->addListener($name, function () use ($name): void {
+                $this->events[] = $name;
+            });
+        }
+    }
+
+    public function testCreateATaskAsTheUiDoesAndWarnAboutWhatIsIgnored(): void
+    {
+        $this->send('POST', '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task', [
+            'name'             => '  Ship it  ',
+            'markdown_content' => '**Now**',
+            'status'           => 'doing',
+            'priority'         => 1,
+            'due_date'         => 1790000000000,
+            'start_date'       => '1789000000000',
+            'time_estimate'    => 5400000,
+            'tags'             => ['api'],
+            'assignees'        => ['uuid-' . $this->colleague->getId()],
+            'points'           => 3,
+            'mystery'          => true,
+        ]);
+
+        self::assertResponseIsSuccessful();
+        $json = $this->json();
+        self::assertSame('Ship it', $json['name']);
+        self::assertSame('**Now**', $json['description']);
+        self::assertSame('Doing', $json['status']['status']);
+        self::assertSame('urgent', $json['priority']['priority']);
+        self::assertSame('1790000000000', $json['due_date']);
+        self::assertSame('5400000', $json['time_estimate']);
+        self::assertSame(['uuid-' . $this->colleague->getId()], array_column($json['assignees'], 'id'));
+        self::assertSame([['field' => 'mystery', 'reason' => 'unknown'], ['field' => 'points', 'reason' => 'not_supported']], $json['warnings']);
+        self::assertSame([TaskBoardEvents::TASK_CREATED, TaskBoardEvents::TASK_MEMBER_ADDED], $this->events);
+        $audit = $this->audit()->events;
+        self::assertCount(1, $audit);
+        self::assertSame(['task.create', 'tenant-a', $this->roadmap->getId(), $json['id']], [$audit[0]->operation, $audit[0]->tenantKey, $audit[0]->boardId, $audit[0]->taskId]);
+        self::assertSame('task_create', $this->quota()->asked[0]->action);
+    }
+
+    public function testASubtaskOnTheSameBoardOnly(): void
+    {
+        $parent = $this->task($this->roadmap, 'Parent');
+        $this->send('POST', '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task', ['name' => 'Child', 'parent' => $parent->getId()]);
+        self::assertSame($parent->getId(), $this->json()['parent']);
+
+        $elsewhere = $this->task($this->board('Other', tenantKey: 'tenant-a'), 'Elsewhere');
+        $this->send('POST', '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task', ['name' => 'Child', 'parent' => $elsewhere->getId()]);
+        $this->assertRefused(400, 'INPUT_002');
+    }
+
+    public function testCreateRefusalsChangeNothing(): void
+    {
+        $path = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+        foreach ([
+            [['name' => ''], 400, 'INPUT_002'],
+            [['name' => str_repeat('x', 256)], 400, 'INPUT_002'],
+            [[], 400, 'INPUT_002'],
+            [['name' => 'x', 'status' => 'nowhere'], 400, 'INPUT_002'],
+            [['name' => 'x', 'priority' => 9], 400, 'INPUT_002'],
+            [['name' => 'x', 'priority' => 'high'], 400, 'INPUT_002'],
+            [['name' => 'x', 'start_date' => 1790000000000, 'due_date' => 1789000000000], 400, 'INPUT_002'],
+            [['name' => 'x', 'assignees' => ['nobody']], 400, 'INPUT_002'],
+            [['name' => 'x', 'assignees' => 'uuid-1'], 400, 'INPUT_002'],
+            [['name' => 'x', 'tags' => [['nested']]], 400, 'INPUT_002'],
+            [['name' => ['x']], 400, 'INPUT_002'],
+            [['name' => 'x', 'due_date' => 'tomorrow'], 400, 'INPUT_002'],
+            [['name' => 'x', 'tags' => [str_repeat('t', 65)]], 400, 'INPUT_002'],
+            [['name' => 'x', 'tags' => array_map(static fn (int $i): string => 't' . $i, range(1, 21))], 400, 'INPUT_002'],
+            [['name' => 'x', 'tags' => ['']], 400, 'INPUT_002'],
+            ['{oops', 400, 'INPUT_001'],
+            ['[1, 2]', 400, 'INPUT_001'],
+            ['"text"', 400, 'INPUT_001'],
+            [str_repeat(' ', 1048577), 400, 'INPUT_001'],
+        ] as [$body, $status, $ecode]) {
+            $this->send('POST', $path, $body);
+            $this->assertRefused($status, $ecode);
+        }
+        self::assertSame([], $this->em->getRepository(Task::class)->findAll());
+        self::assertSame([], $this->audit()->events);
+    }
+
+    public function testThePlanLimitRefusesAndSoDoesNoLimitAtAll(): void
+    {
+        $this->quota()->deny = ['task_create'];
+        $this->send('POST', '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task', ['name' => 'Over']);
+        $this->assertRefused(403, 'PLAN_002');
+        self::assertSame('Your plan is full.', $this->json()['err']);
+
+        $this->quota()->deny = [];
+        foreach ($this->dispatcher()->getListeners(TaskBoardEvents::QUOTA_CHECK) as $listener) {
+            $this->dispatcher()->removeListener(TaskBoardEvents::QUOTA_CHECK, $listener);
+        }
+        $this->send('POST', '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task', ['name' => 'Unchecked']);
+        $this->assertRefused(403, 'PLAN_002');
+        self::assertSame([], $this->em->getRepository(Task::class)->findAll());
+    }
+
+    public function testNoAuditMeansNoWrite(): void
+    {
+        foreach ($this->dispatcher()->getListeners(TaskBoardEvents::API_WRITE) as $listener) {
+            $this->dispatcher()->removeListener(TaskBoardEvents::API_WRITE, $listener);
+        }
+        $task = $this->task($this->roadmap, 'Untouched');
+
+        $this->send('POST', '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task', ['name' => 'Refused']);
+        $this->assertRefused(503, 'AUDIT_001');
+        $this->send('DELETE', '/api/tasks/v2/task/' . $task->getId());
+        $this->assertRefused(503, 'AUDIT_001');
+        self::assertCount(1, $this->em->getRepository(Task::class)->findAll());
+    }
+
+    public function testAFailingAuditListenerDoesNotUndoTheWrite(): void
+    {
+        $this->audit()->fail = true;
+
+        $this->send('POST', '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task', ['name' => 'Saved anyway']);
+
+        self::assertResponseIsSuccessful();
+        self::assertCount(1, $this->em->getRepository(Task::class)->findAll());
+    }
+
+    public function testUpdateMovesThroughTheColumnServiceSoCompletionFollows(): void
+    {
+        $task = $this->task($this->roadmap, 'Move me');
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Assignee));
+        $this->em->flush();
+        $this->events = [];
+
+        $this->send('PUT', '/api/tasks/v2/task/' . $task->getId(), [
+            'status'          => 'Done',
+            'name'            => 'Moved',
+            'priority'        => null,
+            'due_date'        => null,
+            'time_estimate'   => null,
+            'assignees'       => ['add' => [], 'rem' => ['uuid-' . $this->colleague->getId()]],
+            'watchers'        => ['add' => ['uuid-' . $this->owner->getId()]],
+            'group_assignees' => ['add' => []],
+        ]);
+
+        self::assertResponseIsSuccessful();
+        $json = $this->json();
+        self::assertSame(['Moved', 'Done', 'closed'], [$json['name'], $json['status']['status'], $json['status']['type']]);
+        self::assertNotNull($json['date_done'], 'the done column completes the task, as in the UI');
+        self::assertSame([], $json['assignees']);
+        self::assertSame(['uuid-' . $this->owner->getId()], array_column($json['watchers'], 'id'));
+        self::assertSame([['field' => 'group_assignees', 'reason' => 'not_supported']], $json['warnings']);
+        self::assertContains(TaskBoardEvents::TASK_COMPLETED, $this->events);
+        self::assertContains(TaskBoardEvents::TASK_MOVED, $this->events);
+        self::assertSame(['status', 'fields', 'assignees', 'watchers'], end($this->audit()->events)->changedFields);
+        $this->send('PUT', '/api/tasks/v2/task/' . $task->getId(), ['tags' => ['ignored']]);
+        self::assertSame([['field' => 'tags', 'reason' => 'not_supported']], $this->json()['warnings'], 'tags go through the tag endpoints');
+        self::assertSame([], $this->json()['tags']);
+
+        $this->events = [];
+        $this->send('PUT', '/api/tasks/v2/task/' . $task->getId(), ['status' => 'To do']);
+        self::assertContains(TaskBoardEvents::TASK_REOPENED, $this->events);
+        $this->send('PUT', '/api/tasks/v2/task/' . $task->getId(), ['status' => 'To do', 'priority' => 4]);
+        self::assertSame('low', $this->json()['priority']['priority']);
+        self::assertSame(['fields'], end($this->audit()->events)->changedFields, 'the same status is no move');
+    }
+
+    public function testArchiveAndRestore(): void
+    {
+        $task = $this->task($this->roadmap, 'Shelved');
+
+        $this->send('PUT', '/api/tasks/v2/task/' . $task->getId(), ['archived' => true]);
+        self::assertTrue($this->json()['archived']);
+        $this->send('PUT', '/api/tasks/v2/task/' . $task->getId(), ['archived' => false]);
+        self::assertFalse($this->json()['archived']);
+        foreach ([['archived' => 'yes'], ['assignees' => 'x'], ['assignees' => ['add' => [], 'swap' => []]], ['watchers' => ['add' => 'x']]] as $body) {
+            $this->send('PUT', '/api/tasks/v2/task/' . $task->getId(), $body);
+            $this->assertRefused(400, 'INPUT_002');
+        }
+    }
+
+    public function testMyTasksChangesOnlyStatusDatesAndDescriptionOfItsOwnTasks(): void
+    {
+        $own    = $this->task($this->roadmap, 'Own');
+        $theirs = new Task(board: $this->roadmap, title: 'Theirs', creator: $this->colleague);
+        $this->em->persist($theirs);
+        $this->em->flush();
+        $this->issueToken(TaskApiLevel::MyTasks);
+
+        $this->send('PUT', '/api/tasks/v2/task/' . $own->getId(), ['status' => 'Doing', 'description' => 'Mine', 'due_date' => 1790000000000, 'start_date' => null]);
+        self::assertResponseIsSuccessful();
+        self::assertSame(['Doing', 'Mine'], [$this->json()['status']['status'], $this->json()['description']]);
+
+        foreach ([['name' => 'x'], ['priority' => 1], ['time_estimate' => 1], ['assignees' => ['add' => ['uuid-' . $this->colleague->getId()]]], ['watchers' => ['add' => []]], ['archived' => true]] as $body) {
+            $this->send('PUT', '/api/tasks/v2/task/' . $own->getId(), $body);
+            $this->assertRefused(403, 'TOKEN_001');
+        }
+        $this->send('PUT', '/api/tasks/v2/task/' . $theirs->getId(), ['status' => 'Doing']);
+        $this->assertRefused(404, 'ACCESS_001');
+        $this->send('POST', '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task', ['name' => 'New']);
+        $this->assertRefused(403, 'TOKEN_001');
+    }
+
+    public function testDeleteErasesTheSubtreeAndKeepsTheTime(): void
+    {
+        $task  = $this->task($this->roadmap, 'Gone');
+        $child = $this->task($this->roadmap, 'Gone too', parent: $task);
+        $entry = new TaskTimeEntry($child, $this->owner, 45, new DateTimeImmutable('2026-11-01'));
+        $child->addTimeEntry($entry);
+        $this->em->persist($entry);
+        $this->em->flush();
+
+        $this->send('DELETE', '/api/tasks/v2/task/' . $task->getId(), ['force' => true]);
+
+        self::assertSame(['warnings' => [['field' => 'force', 'reason' => 'unknown']]], $this->json());
+        $this->em->clear();
+        self::assertSame([], $this->em->getRepository(Task::class)->findAll());
+        $kept = $this->em->find(TaskTimeEntry::class, $entry->getId());
+        self::assertSame(45, $kept?->getMinutes());
+        self::assertTrue($kept?->isDetached());
+        self::assertSame([TaskBoardEvents::TASK_ERASED, TaskBoardEvents::TASK_ERASED], $this->events);
+    }
+
+    public function testCommentsTagsAndFields(): void
+    {
+        $task = $this->task($this->roadmap, 'Talked about');
+
+        $this->send('POST', '/api/tasks/v2/task/' . $task->getId() . '/comment', ['comment_text' => 'Looks good', 'notify_all' => true]);
+        self::assertResponseIsSuccessful();
+        $comment = $this->em->getRepository(TaskComment::class)->findOneBy(['task' => $task]);
+        self::assertSame(['id' => $comment?->getId(), 'hist_id' => $comment?->getId(), 'date' => $comment?->getCreatedAt()->format('Uv'), 'warnings' => [['field' => 'notify_all', 'reason' => 'not_supported']]], $this->json());
+        self::assertContains(TaskBoardEvents::TASK_COMMENT, $this->events);
+        // Mentions as in the UI's box: "@Label" of a candidate (here a member of a task of the board).
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Watcher));
+        $this->em->flush();
+        $mentioned = [];
+        $this->dispatcher()->addListener(TaskBoardEvents::TASK_MENTION, static function (TaskMentionEvent $event) use (&$mentioned): void {
+            $mentioned = [...$mentioned, ...$event->getMentionedUsers()];
+        });
+        $this->send('POST', '/api/tasks/v2/task/' . $task->getId() . '/comment', ['comment_text' => 'Ping @colleague@example.com']);
+        self::assertSame(['colleague@example.com'], array_map(static fn (object $user): string => $user instanceof AppUser ? $user->getEmail() : '', $mentioned));
+        $this->send('POST', '/api/tasks/v2/task/' . $task->getId() . '/comment', ['comment_text' => '']);
+        $this->assertRefused(400, 'INPUT_002');
+
+        $this->send('POST', '/api/tasks/v2/task/' . $task->getId() . '/tag/Urgent');
+        self::assertSame([], $this->json());
+        $this->send('POST', '/api/tasks/v2/task/' . $task->getId() . '/tag/api');
+        $this->send('DELETE', '/api/tasks/v2/task/' . $task->getId() . '/tag/URGENT');
+        $this->em->clear();
+        self::assertSame(['api'], $this->em->find(Task::class, $task->getId())?->getTags());
+        $this->send('POST', '/api/tasks/v2/task/' . $task->getId() . '/tag/' . str_repeat('t', 65));
+        $this->assertRefused(400, 'INPUT_002');
+        // A body these endpoints do not read is warned about, never silently dropped.
+        $this->send('DELETE', '/api/tasks/v2/task/' . $task->getId() . '/tag/api', ['color' => 'red']);
+        self::assertSame(['warnings' => [['field' => 'color', 'reason' => 'unknown']]], $this->json());
+        // The task form's limit: at most 20 tags.
+        $many       = TaskFormData::fromTask($task);
+        $many->tags = array_map(static fn (int $i): string => 't' . $i, range(1, 20));
+        $this->em->find(Task::class, $task->getId())?->setTags($many->tags);
+        $this->em->flush();
+        $this->send('POST', '/api/tasks/v2/task/' . $task->getId() . '/tag/one-more');
+        $this->assertRefused(400, 'INPUT_002');
+
+        $this->send('POST', '/api/tasks/v2/task/' . $task->getId() . '/field/any', ['value' => 1]);
+        $this->assertRefused(409, 'FIELD_001');
+    }
+
+    public function testDependenciesAndLinks(): void
+    {
+        $task      = $this->task($this->roadmap, 'Task');
+        $blocker   = $this->task($this->roadmap, 'Blocker');
+        $waiting   = $this->task($this->roadmap, 'Waiting');
+        $elsewhere = $this->task($this->board('Other', tenantKey: 'tenant-a'), 'Elsewhere');
+        $base      = '/api/tasks/v2/task/' . $task->getId();
+
+        $this->send('POST', $base . '/dependency', ['depends_on' => $blocker->getId()]);
+        self::assertResponseIsSuccessful();
+        $this->send('POST', $base . '/dependency', ['dependency_of' => $waiting->getId()]);
+        $this->get('/api/tasks/v2/task/' . $task->getId());
+        self::assertEqualsCanonicalizing([[$task->getId(), $blocker->getId()], [$waiting->getId(), $task->getId()]], array_map(static fn (array $d): array => [$d['task_id'], $d['depends_on']], $this->json()['dependencies']));
+
+        $this->send('POST', $base . '/dependency', ['depends_on' => $blocker->getId()]);
+        $this->assertRefused(400, 'LINK_001');
+        $this->send('POST', '/api/tasks/v2/task/' . $blocker->getId() . '/dependency', ['depends_on' => $waiting->getId()]);
+        $this->assertRefused(400, 'LINK_001');
+        $this->send('POST', $base . '/dependency', ['depends_on' => $blocker->getId(), 'dependency_of' => $waiting->getId()]);
+        $this->assertRefused(400, 'INPUT_002');
+        $this->send('POST', $base . '/dependency', []);
+        $this->assertRefused(400, 'INPUT_002');
+        $this->send('POST', $base . '/dependency', ['depends_on' => $elsewhere->getId()]);
+        $this->assertRefused(400, 'LINK_002');
+
+        $this->send('DELETE', $base . '/dependency?dependency_of=' . $blocker->getId());
+        $this->assertRefused(404, 'ACCESS_001');
+        $this->send('DELETE', $base . '/dependency?depends_on=' . $blocker->getId());
+        self::assertResponseIsSuccessful();
+        $this->send('DELETE', $base . '/dependency?dependency_of=' . $waiting->getId());
+        self::assertResponseIsSuccessful();
+
+        $this->send('POST', $base . '/link/' . $blocker->getId());
+        self::assertSame([$blocker->getId()], array_column($this->json()['linked_tasks'], 'link_id'));
+        $this->send('DELETE', $base . '/link/' . $blocker->getId());
+        self::assertSame([], $this->json()['linked_tasks']);
+        $this->send('DELETE', $base . '/link/' . $blocker->getId());
+        $this->assertRefused(404, 'ACCESS_001');
+        self::assertSame(0, $this->em->getRepository(TaskDependency::class)->count([]));
+    }
+
+    public function testChecklistsAreTaggedSubtasks(): void
+    {
+        $task = $this->task($this->roadmap, 'Release');
+        $this->issueToken(TaskApiLevel::MyTasks);
+
+        $this->send('POST', '/api/tasks/v2/task/' . $task->getId() . '/checklist', ['name' => 'Steps']);
+        $checklist = $this->json()['checklist'];
+        self::assertSame([TaskApiReadSerializer::checklistId($task->getId(), 'Steps'), 'Steps', []], [$checklist['id'], $checklist['name'], $checklist['items']]);
+        $base = '/api/tasks/v2/checklist/' . $checklist['id'];
+
+        $this->send('POST', $base . '/checklist_item', ['name' => 'Write', 'assignee' => 'uuid-' . $this->owner->getId()]);
+        $this->send('POST', $base . '/checklist_item', ['name' => 'Test']);
+        $items = $this->json()['checklist']['items'];
+        self::assertSame(['Write', 'Test'], array_column($items, 'name'));
+        self::assertSame('uuid-' . $this->owner->getId(), $items[0]['assignee']['id']);
+        $this->send('POST', $base . '/checklist_item', ['name' => 'Theirs', 'assignee' => 'uuid-' . $this->colleague->getId()]);
+        $this->assertRefused(403, 'TOKEN_001');
+
+        $this->send('PUT', $base . '/checklist_item/' . $items[0]['id'], ['resolved' => true, 'name' => 'Written']);
+        self::assertSame([1, 1], [$this->json()['checklist']['resolved'], $this->json()['checklist']['unresolved']]);
+        self::assertSame('Written', $this->json()['checklist']['items'][0]['name']);
+        $this->send('PUT', $base . '/checklist_item/' . $items[0]['id'], ['resolved' => false]);
+        self::assertSame(0, $this->json()['checklist']['resolved']);
+
+        $this->send('PUT', $base, []);
+        self::assertSame([], $this->json(), 'no name: nothing to rename');
+        $this->send('POST', $base . '/checklist_item', ['name' => 'Nobody', 'assignee' => 'nobody']);
+        $this->assertRefused(400, 'INPUT_002');
+        $this->send('PUT', $base . '/checklist_item/' . $items[1]['id'], ['assignee' => 'uuid-' . $this->owner->getId()]);
+        self::assertSame('uuid-' . $this->owner->getId(), $this->json()['checklist']['items'][1]['assignee']['id']);
+        $this->send('PUT', $base, ['name' => 'Release steps', 'position' => 1]);
+        self::assertSame([['field' => 'position', 'reason' => 'not_supported']], $this->json()['warnings']);
+        $renamed = '/api/tasks/v2/checklist/' . TaskApiReadSerializer::checklistId($task->getId(), 'Release steps');
+        $this->send('DELETE', $renamed . '/checklist_item/' . $items[1]['id']);
+        self::assertSame([], $this->json());
+        $this->get('/api/tasks/v2/task/' . $task->getId());
+        self::assertSame(['Written'], array_column($this->json()['checklists'][0]['items'], 'name'));
+
+        $this->send('DELETE', $renamed);
+        $this->get('/api/tasks/v2/task/' . $task->getId());
+        self::assertSame([], $this->json()['checklists']);
+        $this->em->clear();
+        self::assertCount(3, $this->em->getRepository(Task::class)->findAll(), 'archived, not deleted');
+
+        foreach (['/api/tasks/v2/checklist/nothing', '/api/tasks/v2/checklist/cl_bm90aGluZw', $renamed . '/checklist_item/nothing'] as $path) {
+            $this->send('PUT', $path, ['name' => 'x']);
+            $this->assertRefused(404, 'ACCESS_001');
+        }
+        $this->send('POST', '/api/tasks/v2/task/' . $task->getId() . '/checklist', ['name' => '']);
+        $this->assertRefused(400, 'INPUT_002');
+    }
+
+    private function audit(): ApiAuditRecorder
+    {
+        $audit = self::getContainer()->get('app.api_audit');
+        self::assertInstanceOf(ApiAuditRecorder::class, $audit);
+
+        return $audit;
+    }
+
+    private function quota(): RecordingQuotaListener
+    {
+        $quota = self::getContainer()->get('app.quota_listener');
+        self::assertInstanceOf(RecordingQuotaListener::class, $quota);
+
+        return $quota;
+    }
+
+    private function dispatcher(): EventDispatcherInterface
+    {
+        $dispatcher = self::getContainer()->get('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+
+        return $dispatcher;
+    }
+}
diff --git a/tests/Functional/Api/ApiWriteMatrixTest.php b/tests/Functional/Api/ApiWriteMatrixTest.php
new file mode 100644
index 00000000..ebb65773
--- /dev/null
+++ b/tests/Functional/Api/ApiWriteMatrixTest.php
@@ -0,0 +1,220 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Event\BoardAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+
+use function array_map;
+use function in_array;
+use function is_string;
+use function sprintf;
+
+/**
+ * Spec 213 SC-001, write half: every write endpoint × the four levels × own task, another's task, another project, a board
+ * outside where, a removed member, a person who may only read, a revoked or expired token, the plan without the module.
+ * Each request gets fresh tasks, so a write never depends on the one before. Owner decisions: Read writes nothing; My tasks
+ * works only on its own tasks and their checklists.
+ */
+final class ApiWriteMatrixTest extends ApiTestCase
+{
+    /** What the endpoint asks of the level. */
+    private const WORK = 'work';
+
+    private const EDIT = 'edit';
+
+    private const DELETE = 'delete';
+
+    private const COMMENT = 'comment';
+
+    private string $boardId;
+
+    private string $sideBoardId;
+
+    private string $colleagueEmail = 'colleague@example.com';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ApiTestHost::$tenants = ['tenant-a', 'tenant-b'];
+        $this->user($this->colleagueEmail);
+        $this->boardId     = $this->board('Roadmap', tenantKey: 'tenant-a')->getId();
+        $this->sideBoardId = $this->board('Side', tenantKey: 'tenant-a')->getId();
+    }
+
+    public function testEachLevelWithinReach(): void
+    {
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level);
+            foreach ($this->endpoints() as $name => [$kind, $others, $call]) {
+                $call($this->fixtures());
+                $expected = match (true) {
+                    $level === TaskApiLevel::Read                                                           => [403, 'TOKEN_001'],
+                    $level === TaskApiLevel::MyTasks && $others                                             => [404, 'ACCESS_001'],
+                    $level === TaskApiLevel::MyTasks && !in_array($kind, [self::WORK, self::COMMENT], true) => [403, 'TOKEN_001'],
+                    default                                                                                 => null,
+                };
+                $this->assertOutcome($expected, $level->value . ' ' . $name);
+            }
+        }
+    }
+
+    public function testAnotherProjectABoardOutsideWhereAndARemovedMemberAreNotFound(): void
+    {
+        $denied = false;
+        $this->dispatcher()->addListener(TaskBoardEvents::BOARD_ACCESS_CHECK, static function (BoardAccessCheckEvent $event) use (&$denied): void {
+            if ($denied) {
+                $event->deny();
+            }
+        });
+        foreach (['another project' => TaskApiWhere::limitedTo(['tenant-b'], []), 'a board outside where' => TaskApiWhere::limitedTo([], [$this->sideBoardId]), 'a removed member' => null] as $case => $where) {
+            $denied = $where === null;
+            foreach (TaskApiLevel::cases() as $level) {
+                $this->issueToken($level, $where ?? TaskApiWhere::everything());
+                foreach ($this->endpoints() as $name => [, , $call]) {
+                    $call($this->fixtures());
+                    $this->assertOutcome([404, 'ACCESS_001'], sprintf('%s, %s, %s', $case, $level->value, $name));
+                }
+            }
+        }
+    }
+
+    public function testAPersonWhoMayOnlyReadIsRefusedWhateverTheToken(): void
+    {
+        $this->dispatcher()->addListener(TaskBoardEvents::BOARD_ACCESS_CHECK, static function (BoardAccessCheckEvent $event): void {
+            if ($event->getAction() === BoardAccessCheckEvent::ACTION_VIEW) {
+                $event->grant();
+                $event->markReadOnly();
+            } else {
+                $event->deny();
+            }
+        });
+        $this->issueToken(TaskApiLevel::Full);
+        foreach ($this->endpoints() as $name => [$kind, , $call]) {
+            $call($this->fixtures());
+            // Readers comment unless the host turns it off (comments.readers_can_comment).
+            $this->assertOutcome($kind === self::COMMENT ? null : [403, 'ACCESS_002'], 'read-only ' . $name);
+        }
+    }
+
+    public function testAPlanWithoutTheModuleAndARevokedToken(): void
+    {
+        ApiTestHost::$planRefusesTenants = ['tenant-a'];
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level);
+            foreach ($this->endpoints() as $name => [, $others, $call]) {
+                $call($this->fixtures());
+                $this->assertOutcome($level === TaskApiLevel::MyTasks && $others ? [404, 'ACCESS_001'] : [403, 'PLAN_001'], 'plan ' . $level->value . ' ' . $name);
+            }
+        }
+        ApiTestHost::$planRefusesTenants = [];
+        foreach ($this->endpoints() as $name => [, , $call]) {
+            $call($this->fixtures(), 'bt_revoked_placeholder');
+            $this->assertOutcome([401, 'OAUTH_019'], 'revoked ' . $name);
+        }
+    }
+
+    /**
+     * name => [what it asks, whether it targets another person's task, the call].
+     *
+     * @return array<string, array{0: string, 1: bool, 2: callable(array<string, string>, string=): void}>
+     */
+    private function endpoints(): array
+    {
+        $send = fn (string $method, string $path, ?array $body = null): callable => fn (array $fx, string $token = self::TOKEN) => $this->send(
+            $method,
+            '/api/tasks/v2/' . strtr($path, $fx),
+            $body === null ? null : array_map(static fn (mixed $value): mixed => is_string($value) ? strtr($value, $fx) : $value, $body),
+            [],
+            $token,
+        );
+
+        return [
+            'create task'          => [self::EDIT, false, $send('POST', 'list/{board}/task', ['name' => 'New'])],
+            'update own status'    => [self::WORK, false, $send('PUT', 'task/{own}', ['status' => 'Doing'])],
+            'update own name'      => [self::EDIT, false, $send('PUT', 'task/{own}', ['name' => 'Renamed'])],
+            'update others status' => [self::WORK, true, $send('PUT', 'task/{others}', ['status' => 'Doing'])],
+            'delete own'           => [self::DELETE, false, $send('DELETE', 'task/{own}')],
+            'comment own'          => [self::COMMENT, false, $send('POST', 'task/{own}/comment', ['comment_text' => 'Hi'])],
+            'comment others'       => [self::COMMENT, true, $send('POST', 'task/{others}/comment', ['comment_text' => 'Hi'])],
+            'tag own'              => [self::EDIT, false, $send('POST', 'task/{own}/tag/api')],
+            'field own'            => [self::EDIT, false, $send('POST', 'task/{own}/field/f1', ['value' => 1])],
+            'dependency own'       => [self::EDIT, false, $send('POST', 'task/{own}/dependency', ['depends_on' => '{blocker}'])],
+            'link own'             => [self::EDIT, false, $send('POST', 'task/{own}/link/{blocker}')],
+            'checklist own'        => [self::WORK, false, $send('POST', 'task/{own}/checklist', ['name' => 'Steps'])],
+            'checklist others'     => [self::WORK, true, $send('POST', 'task/{others}/checklist', ['name' => 'Steps'])],
+            'item create own'      => [self::WORK, false, $send('POST', 'checklist/{checklist}/checklist_item', ['name' => 'Item'])],
+            'item update own'      => [self::WORK, false, $send('PUT', 'checklist/{checklist}/checklist_item/{item}', ['resolved' => true])],
+            'item delete own'      => [self::WORK, false, $send('DELETE', 'checklist/{checklist}/checklist_item/{item}')],
+            'checklist delete own' => [self::WORK, false, $send('DELETE', 'checklist/{checklist}')],
+            'item update others'   => [self::WORK, true, $send('PUT', 'checklist/{otherChecklist}/checklist_item/{otherItem}', ['resolved' => true])],
+        ];
+    }
+
+    /**
+     * Fresh tasks for one request: the owner's, a colleague's, a blocker, and a checklist item on each task.
+     *
+     * @return array<string, string>
+     */
+    private function fixtures(): array
+    {
+        $this->em->clear();
+        $board     = $this->em->find(TaskBoard::class, $this->boardId);
+        $owner     = $this->em->getRepository(AppUser::class)->findOneBy(['email' => 'owner@example.com']);
+        $colleague = $this->em->getRepository(AppUser::class)->findOneBy(['email' => $this->colleagueEmail]);
+        self::assertInstanceOf(TaskBoard::class, $board);
+        $own       = new Task(board: $board, title: 'Own', creator: $owner);
+        $others    = new Task(board: $board, title: 'Others', creator: $colleague);
+        $blocker   = new Task(board: $board, title: 'Blocker', creator: $owner);
+        $item      = new Task(board: $board, title: 'Item', creator: $owner, parent: $own, tags: ['checklist:Steps']);
+        $otherItem = new Task(board: $board, title: 'Their item', creator: $colleague, parent: $others, tags: ['checklist:Steps']);
+        foreach ([$own, $others, $blocker, $item, $otherItem] as $task) {
+            $this->em->persist($task);
+        }
+        $this->em->flush();
+
+        return [
+            '{board}'          => $this->boardId,
+            '{own}'            => $own->getId(),
+            '{others}'         => $others->getId(),
+            '{blocker}'        => $blocker->getId(),
+            '{checklist}'      => TaskApiReadSerializer::checklistId($own->getId(), 'Steps'),
+            '{item}'           => $item->getId(),
+            '{otherChecklist}' => TaskApiReadSerializer::checklistId($others->getId(), 'Steps'),
+            '{otherItem}'      => $otherItem->getId(),
+        ];
+    }
+
+    /**
+     * @param array{0: int, 1: string}|null $expected null: the write went through (custom fields answer their own 409)
+     */
+    private function assertOutcome(?array $expected, string $message): void
+    {
+        $status = $this->client->getResponse()->getStatusCode();
+        $ecode  = $this->json()['ECODE'] ?? null;
+        if ($expected === null) {
+            self::assertTrue($status === 200 || ($status === 409 && $ecode === 'FIELD_001'), sprintf('%s: %d %s', $message, $status, (string) $ecode));
+
+            return;
+        }
+        self::assertSame($expected, [$status, $ecode], $message);
+    }
+
+    private function dispatcher(): EventDispatcherInterface
+    {
+        $dispatcher = self::getContainer()->get('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+
+        return $dispatcher;
+    }
+}
diff --git a/tests/Functional/Api/App/ApiAuditRecorder.php b/tests/Functional/Api/App/ApiAuditRecorder.php
new file mode 100644
index 00000000..c7cabfb5
--- /dev/null
+++ b/tests/Functional/Api/App/ApiAuditRecorder.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api\App;
+
+use Nowo\TaskBoardBundle\Event\TaskApiWriteEvent;
+use RuntimeException;
+
+/**
+ * The host's audit of API writes: it keeps every event, and can fail on demand.
+ */
+final class ApiAuditRecorder
+{
+    /** @var list<TaskApiWriteEvent> */
+    public array $events = [];
+
+    public bool $fail = false;
+
+    public function __invoke(TaskApiWriteEvent $event): void
+    {
+        $this->events[] = $event;
+        if ($this->fail) {
+            throw new RuntimeException('audit store down');
+        }
+    }
+}
diff --git a/tests/Functional/Api/App/ApiFirewallAuthenticator.php b/tests/Functional/Api/App/ApiFirewallAuthenticator.php
new file mode 100644
index 00000000..c5383cb1
--- /dev/null
+++ b/tests/Functional/Api/App/ApiFirewallAuthenticator.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api\App;
+
+use Nowo\TaskBoardBundle\Api\TaskApiCredential;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
+use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
+use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
+
+/**
+ * A host's stateless firewall: it sets the security user for a known token and lets anything else through with no user,
+ * so the bundle answers every refusal in one shape.
+ */
+final class ApiFirewallAuthenticator extends AbstractAuthenticator
+{
+    public function supports(Request $request): ?bool
+    {
+        return isset(ApiTestHost::$tokens[(string) TaskApiCredential::fromRequest($request)]);
+    }
+
+    public function authenticate(Request $request): Passport
+    {
+        return new SelfValidatingPassport(new UserBadge(ApiTestHost::$tokens[(string) TaskApiCredential::fromRequest($request)]['email']));
+    }
+
+    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
+    {
+        return null;
+    }
+
+    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
+    {
+        return null;
+    }
+}
diff --git a/tests/Functional/Api/App/ApiKernel.php b/tests/Functional/Api/App/ApiKernel.php
new file mode 100644
index 00000000..ace62665
--- /dev/null
+++ b/tests/Functional/Api/App/ApiKernel.php
@@ -0,0 +1,162 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api\App;
+
+use Doctrine\Bundle\DoctrineBundle\DependencyInjection\Configuration as DoctrineConfiguration;
+use Doctrine\Bundle\DoctrineBundle\DoctrineBundle;
+use Nowo\FormKitBundle\NowoFormKitBundle;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+use Nowo\TaskBoardBundle\Tests\Functional\App\FunctionalKernel;
+use Nowo\TaskBoardBundle\Tests\Functional\App\RecordingAttachmentStorage;
+use Nowo\TaskBoardBundle\Tests\Functional\App\RecordingLogger;
+use Nowo\TaskBoardBundle\Tests\Functional\App\RecordingQuotaListener;
+use Nowo\TaskBoardBundle\Tests\Functional\App\TestCredentialResolver;
+use Nowo\TaskBoardBundle\Tests\Functional\App\TestSyncLimitChecker;
+use Nowo\UiKitBundle\NowoUiKitBundle;
+use Symfony\Bundle\FrameworkBundle\FrameworkBundle;
+use Symfony\Bundle\FrameworkBundle\Kernel\MicroKernelTrait;
+use Symfony\Bundle\SecurityBundle\SecurityBundle;
+use Symfony\Bundle\TwigBundle\TwigBundle;
+use Symfony\Component\Config\Definition\ArrayNode;
+use Symfony\Component\Config\Definition\BaseNode;
+use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;
+use Symfony\Component\HttpKernel\Kernel;
+use Symfony\Component\Routing\Loader\Configurator\RoutingConfigurator;
+use Twig\Extra\TwigExtraBundle\TwigExtraBundle;
+
+use function md5;
+use function serialize;
+use function sys_get_temp_dir;
+
+use const PHP_VERSION_ID;
+
+/**
+ * Host kernel of the API tests: the bundle with `api.enabled` and a stateless firewall on the API's prefix. `$withFirewall`
+ * false: the host forgot it, and the API must fail closed.
+ */
+final class ApiKernel extends Kernel
+{
+    use MicroKernelTrait;
+
+    /**
+     * @param array<string, mixed> $api `nowo_task_board.api`, merged over a complete set of hooks
+     * @param array<string, mixed> $taskBoard the rest of `nowo_task_board`
+     */
+    public function __construct(private readonly array $api = [], private readonly array $taskBoard = [], private readonly bool $withFirewall = true)
+    {
+        parent::__construct('test', true);
+    }
+
+    public function registerBundles(): iterable
+    {
+        yield new FrameworkBundle();
+        yield new DoctrineBundle();
+        yield new TwigBundle();
+        yield new TwigExtraBundle();
+        yield new SecurityBundle();
+        yield new NowoUiKitBundle();
+        yield new NowoFormKitBundle();
+        yield new TaskBoardBundle();
+    }
+
+    public function getProjectDir(): string
+    {
+        return __DIR__ . '/../../App';
+    }
+
+    public function getCacheDir(): string
+    {
+        return sys_get_temp_dir() . '/nowo-task-board-api/' . md5(serialize([$this->api, $this->taskBoard, $this->withFirewall, FunctionalKernel::databaseUrl()])) . '/cache';
+    }
+
+    public function getLogDir(): string
+    {
+        return sys_get_temp_dir() . '/nowo-task-board-api/log';
+    }
+
+    private function configureContainer(ContainerConfigurator $container): void
+    {
+        $container->extension('framework', [
+            'secret'               => 'functional-test',
+            'test'                 => true,
+            'http_method_override' => false,
+            'csrf_protection'      => true,
+            'form'                 => ['csrf_protection' => true],
+            'session'              => ['storage_factory_id' => 'session.storage.factory.mock_file'],
+            'property_info'        => ['with_constructor_extractor' => true],
+            'router'               => ['utf8' => true],
+            'assets'               => true,
+            'default_locale'       => 'en',
+        ]);
+        $services = $container->services();
+        $services->set('logger', RecordingLogger::class)->public();
+        $services->set('app.api_host', ApiTestHost::class)->autowire()->public();
+        $services->set('app.api_firewall', ApiFirewallAuthenticator::class);
+        $services->set('app.tenant_resolver', ScriptedTenantResolver::class);
+        $services->set('app.plain_checker', PlainCreateChecker::class);
+        // The host's plan limits and its audit of API writes.
+        $services->set('app.quota_listener', RecordingQuotaListener::class)->public()
+            ->tag('kernel.event_listener', ['event' => TaskBoardEvents::QUOTA_CHECK]);
+        $services->set('app.api_audit', ApiAuditRecorder::class)->public()
+            ->tag('kernel.event_listener', ['event' => TaskBoardEvents::API_WRITE]);
+        $container->extension('doctrine', [
+            'dbal' => ['url' => FunctionalKernel::databaseUrl()],
+            'orm'  => [
+                'auto_mapping' => true,
+                'mappings'     => ['FunctionalApp' => [
+                    'type'      => 'attribute',
+                    'is_bundle' => false,
+                    'dir'       => __DIR__ . '/../../App/Entity',
+                    'prefix'    => 'Nowo\\TaskBoardBundle\\Tests\\Functional\\App\\Entity',
+                ]],
+            ] + $this->nativeLazyObjects(),
+        ]);
+        $container->extension('security', [
+            'providers' => ['app' => ['entity' => ['class' => AppUser::class, 'property' => 'email']]],
+            'firewalls' => ($this->withFirewall ? ['task_api' => ['pattern' => '^/api/', 'stateless' => true, 'provider' => 'app', 'custom_authenticators' => ['app.api_firewall']]] : [])
+                + ['main' => ['lazy' => true, 'provider' => 'app']],
+        ]);
+        $container->extension('twig', ['strict_variables' => true]);
+        // Like Beacon: no resource scoping, the host's listeners decide (one configuration, so one container, for most tests).
+        $container->extension('nowo_task_board', ['user_class' => AppUser::class, 'security' => ['resource_scoping' => false] + ($this->taskBoard['security'] ?? []), 'api' => $this->api + ['enabled' => true, 'host_decides_access' => true, 'hooks' => [
+            'authenticator' => 'app.api_host',
+            'rate_limiter'  => 'app.api_host',
+            'plan_gate'     => 'app.api_host',
+            'workspace'     => 'app.api_host',
+            'users'         => 'app.api_host',
+            'time_entries'  => 'app.api_host',
+            'attachments'   => 'app.api_host',
+        ]]] + array_diff_key($this->taskBoard, ['security' => true]));
+        if (($this->taskBoard['sync']['enabled'] ?? false) === true) {
+            // The host side of a provider sync, for the imported custom fields.
+            $services->set('app.sync_credentials', TestCredentialResolver::class)->public();
+            $services->set('app.sync_storage', RecordingAttachmentStorage::class)->public();
+            $services->set('app.sync_limits', TestSyncLimitChecker::class)->public();
+        }
+    }
+
+    /**
+     * @return array<string, bool>
+     */
+    private function nativeLazyObjects(): array
+    {
+        if (PHP_VERSION_ID < 80400) {
+            return [];
+        }
+
+        $root = (new DoctrineConfiguration(false))->getConfigTreeBuilder()->buildTree();
+        $orm  = $root instanceof ArrayNode ? ($root->getChildren()['orm'] ?? null) : null;
+        $node = $orm instanceof ArrayNode ? ($orm->getChildren()['enable_native_lazy_objects'] ?? null) : null;
+
+        return $node instanceof BaseNode && !$node->isDeprecated() ? ['enable_native_lazy_objects' => true] : [];
+    }
+
+    private function configureRoutes(RoutingConfigurator $routes): void
+    {
+        $routes->import('.', 'nowo_task_board');
+    }
+}
diff --git a/tests/Functional/Api/App/ApiTestHost.php b/tests/Functional/Api/App/ApiTestHost.php
new file mode 100644
index 00000000..a25edb8d
--- /dev/null
+++ b/tests/Functional/Api/App/ApiTestHost.php
@@ -0,0 +1,233 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api\App;
+
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiAttachmentsInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiAuthenticatorInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiPlanGateInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiRateLimiterInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiTimeEntriesInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiUsersInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiWorkspaceInterface;
+use Nowo\TaskBoardBundle\Api\TaskApiAuthFailure;
+use Nowo\TaskBoardBundle\Api\TaskApiCredential;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiAttachment;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiNewTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiRateLimitState;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTeam;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimePage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+use Symfony\Component\HttpFoundation\Request;
+
+use function array_map;
+use function count;
+use function file_get_contents;
+use function in_array;
+
+/**
+ * The host side of the API in the tests: one scriptable object behind every hook. Its state is static, as a test sets it
+ * before the kernel handles the request.
+ */
+final class ApiTestHost implements TaskApiAuthenticatorInterface, TaskApiRateLimiterInterface, TaskApiPlanGateInterface, TaskApiWorkspaceInterface, TaskApiUsersInterface, TaskApiTimeEntriesInterface, TaskApiAttachmentsInterface
+{
+    /** @var array<string, array{email: string, level: TaskApiLevel, where: TaskApiWhere, id: string}> */
+    public static array $tokens = [];
+
+    public static bool $apiDisabled = false;
+
+    public static bool $tokenLimitAccepts = true;
+
+    public static bool $ipLimitAccepts = true;
+
+    /** @var list<string> */
+    public static array $failedIps = [];
+
+    public static int $consumed = 0;
+
+    public static bool $planAllows = true;
+
+    /** @var list<string> tenants the plan refuses */
+    public static array $planRefusesTenants = [];
+
+    /** @var list<string|null> tenants the person reaches */
+    public static array $tenants = [];
+
+    public static bool $profilesEmpty = false;
+
+    /** @var list<string> people the host does not know */
+    public static array $unknownEmails = [];
+
+    /** @var list<TaskApiTimeQuery> */
+    public static array $timeQueries = [];
+
+    /** @var list<array{0: ?string, 1: TaskApiNewTimeEntry}> */
+    public static array $logged = [];
+
+    /** @var list<array{0: string, 1: string, 2: string}> */
+    public static array $stored = [];
+
+    public static bool $refuseUploads = false;
+
+    /** A principal the firewall does not stand behind. */
+    public static ?object $forcedUser = null;
+
+    public function __construct(private readonly EntityManagerInterface $entityManager)
+    {
+    }
+
+    public static function reset(): void
+    {
+        self::$tokens             = [];
+        self::$apiDisabled        = false;
+        self::$tokenLimitAccepts  = true;
+        self::$ipLimitAccepts     = true;
+        self::$failedIps          = [];
+        self::$consumed           = 0;
+        self::$planAllows         = true;
+        self::$planRefusesTenants = [];
+        self::$tenants            = [];
+        self::$forcedUser         = null;
+        self::$profilesEmpty      = false;
+        self::$timeQueries        = [];
+        self::$unknownEmails      = [];
+        self::$logged             = [];
+        self::$stored             = [];
+        self::$refuseUploads      = false;
+    }
+
+    public function authenticate(Request $request): TaskApiPrincipal|TaskApiAuthFailure
+    {
+        if (self::$apiDisabled) {
+            return TaskApiAuthFailure::ApiDisabled;
+        }
+        $token = self::$tokens[(string) TaskApiCredential::fromRequest($request)] ?? null;
+        if ($token === null) {
+            return TaskApiAuthFailure::Invalid;
+        }
+        $user = self::$forcedUser ?? $this->entityManager->getRepository(AppUser::class)->findOneBy(['email' => $token['email']]);
+        if ($user === null) {
+            return TaskApiAuthFailure::Invalid;
+        }
+
+        // An opaque id per token, never the secret.
+        return new TaskApiPrincipal($user, $token['level'], $token['where'], hash('sha256', 'token-id|' . $token['email'] . '|' . $token['id']), 'token name');
+    }
+
+    public function consume(TaskApiPrincipal $principal): TaskApiRateLimitState
+    {
+        ++self::$consumed;
+
+        return new TaskApiRateLimitState(self::$tokenLimitAccepts, 100, self::$tokenLimitAccepts ? 99 : 0, 1_790_000_000);
+    }
+
+    public function failedTokenState(string $clientIp): TaskApiRateLimitState
+    {
+        return new TaskApiRateLimitState(self::$ipLimitAccepts, 10, self::$ipLimitAccepts ? 10 : 0, 1_790_000_060);
+    }
+
+    public function registerFailedToken(string $clientIp): void
+    {
+        self::$failedIps[] = $clientIp;
+    }
+
+    public function allowsTasks(object $user, ?string $tenantKey): bool
+    {
+        return self::$planAllows && !in_array($tenantKey, self::$planRefusesTenants, true);
+    }
+
+    public function teams(TaskApiPrincipal $principal): array
+    {
+        return [new TaskApiTeam('team-1', 'Personal', '#000000', 'https://example.com/a.png'), new TaskApiTeam('team-2', 'Acme')];
+    }
+
+    /** Every tenant the person reaches is a space of team-1; team-2 has none. */
+    public function spaces(TaskApiPrincipal $principal, string $teamId): array
+    {
+        return $teamId === 'team-1' ? array_map(self::spaceOf(...), self::$tenants) : [];
+    }
+
+    public function space(TaskApiPrincipal $principal, string $spaceId): ?TaskApiSpace
+    {
+        foreach (self::$tenants as $tenant) {
+            if (self::spaceOf($tenant)->id === $spaceId) {
+                return self::spaceOf($tenant);
+            }
+        }
+
+        return null;
+    }
+
+    public function spaceOfTenant(TaskApiPrincipal $principal, ?string $tenantKey): ?TaskApiSpace
+    {
+        return in_array($tenantKey, self::$tenants, true) ? self::spaceOf($tenantKey) : null;
+    }
+
+    public static function spaceOf(?string $tenantKey): TaskApiSpace
+    {
+        return new TaskApiSpace('space-' . ($tenantKey ?? 'none'), 'Space ' . ($tenantKey ?? 'none'), 'team-1', $tenantKey);
+    }
+
+    public function list(TaskApiPrincipal $principal, TaskApiTimeQuery $query): TaskApiTimePage
+    {
+        self::$timeQueries[] = $query;
+
+        return new TaskApiTimePage([new TaskApiTimeEntry('entry-1', $this->apiId($principal->user), new DateTimeImmutable('@1790000000'), 3600, $query->taskId, 'Review')]);
+    }
+
+    public function log(TaskApiPrincipal $principal, ?Task $task, TaskApiNewTimeEntry $entry): TaskApiTimeEntry
+    {
+        self::$logged[] = [$task?->getId(), $entry];
+
+        return new TaskApiTimeEntry('entry-' . count(self::$logged), $this->apiId($principal->user), $entry->start, $entry->durationSeconds, $task?->getId(), $entry->description);
+    }
+
+    public function store(TaskApiPrincipal $principal, Task $task, UploadedFile $file): TaskApiAttachment
+    {
+        if (self::$refuseUploads) {
+            throw new TaskApiRefusal(403, 'FILE_002', 'Over the plan storage');
+        }
+        self::$stored[] = [$task->getId(), $file->getClientOriginalName(), (string) file_get_contents($file->getPathname())];
+
+        return new TaskApiAttachment('file-' . count(self::$stored), $file->getClientOriginalName(), '/files/file-' . count(self::$stored), (int) $file->getSize());
+    }
+
+    public function apiId(object $user): string
+    {
+        if ($user instanceof AppUser && in_array($user->getEmail(), self::$unknownEmails, true)) {
+            throw TaskApiRefusal::notFound();
+        }
+
+        return $user instanceof AppUser ? 'uuid-' . $user->getId() : 'unknown';
+    }
+
+    public function find(string $apiId): ?object
+    {
+        return str_starts_with($apiId, 'uuid-') ? $this->entityManager->find(AppUser::class, (int) substr($apiId, 5)) : null;
+    }
+
+    public function profiles(array $users, TaskApiPrincipal $viewer): array
+    {
+        $profiles = [];
+        foreach (self::$profilesEmpty ? [] : $users as $user) {
+            if ($user instanceof AppUser && !in_array($user->getEmail(), self::$unknownEmails, true)) {
+                $profiles[$this->apiId($user)] = new TaskApiUser($this->apiId($user), $user->getEmail(), $user->getEmail());
+            }
+        }
+
+        return $profiles;
+    }
+}
diff --git a/tests/Functional/Api/App/PlainCreateChecker.php b/tests/Functional/Api/App/PlainCreateChecker.php
new file mode 100644
index 00000000..d25139b4
--- /dev/null
+++ b/tests/Functional/Api/App/PlainCreateChecker.php
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api\App;
+
+use Nowo\TaskBoardBundle\Security\TaskBoardAccessCheckerInterface;
+
+/**
+ * A host's access checker from before tenants (not tenant-aware): it lets everyone in and refuses every create.
+ */
+final class PlainCreateChecker implements TaskBoardAccessCheckerInterface
+{
+    public function canAccess(object $user): bool
+    {
+        return true;
+    }
+
+    public function canCreateBoard(object $user): bool
+    {
+        return false;
+    }
+
+    public function canListBoards(object $user): bool
+    {
+        return true;
+    }
+}
diff --git a/tests/Functional/Api/App/ScriptedTenantResolver.php b/tests/Functional/Api/App/ScriptedTenantResolver.php
new file mode 100644
index 00000000..053f77ef
--- /dev/null
+++ b/tests/Functional/Api/App/ScriptedTenantResolver.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api\App;
+
+use Nowo\TaskBoardBundle\Tenancy\TaskBoardTenant;
+use Nowo\TaskBoardBundle\Tenancy\TaskBoardTenantResolverInterface;
+
+use function in_array;
+
+/**
+ * A host's tenant resolver: it opens only the tenants a test lists, whatever the API's workspace hook says.
+ */
+final class ScriptedTenantResolver implements TaskBoardTenantResolverInterface
+{
+    /** @var list<string> */
+    public static array $open = [];
+
+    public function resolve(string $tenantSlug, object $user): ?TaskBoardTenant
+    {
+        return in_array($tenantSlug, self::$open, true) ? new TaskBoardTenant($tenantSlug, $tenantSlug, $tenantSlug) : null;
+    }
+}
diff --git a/tests/Functional/Characterization/CapturesUiOutput.php b/tests/Functional/Characterization/CapturesUiOutput.php
new file mode 100644
index 00000000..be173c12
--- /dev/null
+++ b/tests/Functional/Characterization/CapturesUiOutput.php
@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Characterization;
+
+use Symfony\Component\HttpFoundation\Session\FlashBagAwareSessionInterface;
+
+use function array_filter;
+use function array_map;
+use function array_values;
+use function file_put_contents;
+use function getenv;
+use function is_dir;
+use function is_string;
+use function mkdir;
+use function preg_replace;
+
+/**
+ * Spec 213 S0: what a UI write answers, read back the same way before and after the code behind it moves. With
+ * TASK_BOARD_CHARACTERIZE_DIR set, each named page is also written there with its ids and dates masked, so two checkouts
+ * sharing one vendor can be compared byte by byte (no golden file in the repository: markup differs across the CI matrix).
+ */
+trait CapturesUiOutput
+{
+    /**
+     * @return array{status: int, location: ?string, flashes: array<string, list<string>>, writes: list<string>, refused: list<string>}
+     */
+    private function captured(): array
+    {
+        $response = $this->client->getResponse();
+        $session  = $this->client->getRequest()->getSession();
+        self::assertInstanceOf(FlashBagAwareSessionInterface::class, $session);
+        $records                 = $this->logger()->records;
+        $this->logger()->records = [];
+        // Read and gone, so the next request's flashes stand alone.
+        $flashes = $session->getFlashBag()->all();
+        $session->save();
+
+        return [
+            'status'   => $response->getStatusCode(),
+            'location' => $response->headers->get('Location'),
+            'flashes'  => $flashes,
+            'writes'   => $this->logged($records, 'TaskBoard write: {action}', 'action'),
+            'refused'  => $this->logged($records, 'TaskBoard write refused: {reason}', 'reason'),
+        ];
+    }
+
+    /**
+     * @param list<array{level: mixed, message: mixed, context: array<string, mixed>}> $records
+     *
+     * @return list<string>
+     */
+    private function logged(array $records, string $message, string $key): array
+    {
+        $matching = array_filter($records, static fn (array $record): bool => $record['message'] === $message);
+
+        return array_values(array_map(static fn (array $record): string => (string) $record['context'][$key], $matching));
+    }
+
+    private function dumpBody(string $name): void
+    {
+        $directory = getenv('TASK_BOARD_CHARACTERIZE_DIR');
+        if (!is_string($directory) || $directory === '') {
+            return;
+        }
+        if (!is_dir($directory)) {
+            mkdir($directory, 0o777, true);
+        }
+        $body = (string) $this->client->getResponse()->getContent();
+        $body = (string) preg_replace('/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/', '{uuid}', $body);
+        $body = (string) preg_replace('/\d{4}-\d{2}-\d{2}([ T]\d{2}:\d{2}(:\d{2})?)?/', '{date}', $body);
+        file_put_contents($directory . '/' . $name . '.html', $body);
+    }
+}
diff --git a/tests/Functional/Characterization/UiCommentsCharacterizationTest.php b/tests/Functional/Characterization/UiCommentsCharacterizationTest.php
new file mode 100644
index 00000000..538e5b1f
--- /dev/null
+++ b/tests/Functional/Characterization/UiCommentsCharacterizationTest.php
@@ -0,0 +1,282 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Characterization;
+
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Event\TaskAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Event\TaskCommentEvent;
+use Nowo\TaskBoardBundle\Event\TaskMentionEvent;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+use Nowo\TaskBoardBundle\Tests\Functional\App\PredictableCsrfTokenManager;
+use Nowo\TaskBoardBundle\Tests\Functional\FunctionalTestCase;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+
+use function json_encode;
+use function str_contains;
+
+/**
+ * Spec 213 S0: the comment routes' output, pinned before their rules move out of the controller. Must not change.
+ */
+final class UiCommentsCharacterizationTest extends FunctionalTestCase
+{
+    use CapturesUiOutput;
+
+    private const BASE = '/tools/task-board/task/';
+
+    private AppUser $reader;
+
+    private Task $work;
+
+    /** @var list<string> */
+    private array $events = [];
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->reader = $this->user('reader@example.com');
+        $this->work   = $this->task($this->board(), 'Work');
+        $dispatcher   = self::getContainer()->get('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+        // The reader may read the task and not edit it, as a host's listener decides it.
+        $readerId = $this->reader->getId();
+        $dispatcher->addListener(TaskBoardEvents::TASK_ACCESS_CHECK, static function (TaskAccessCheckEvent $event) use ($readerId): void {
+            $subject = $event->getSubject();
+            if ($subject instanceof AppUser && $subject->getId() === $readerId) {
+                $event->grant();
+                $event->markReadOnly();
+            }
+        });
+        $dispatcher->addListener(TaskBoardEvents::TASK_COMMENT, function (TaskCommentEvent $event): void {
+            $this->events[] = 'comment:' . $event->getAction();
+        });
+        $dispatcher->addListener(TaskBoardEvents::TASK_MENTION, function (TaskMentionEvent $event): void {
+            $this->events[] = 'mention';
+        });
+        $this->logger()->records = [];
+    }
+
+    public function testAReaderAddsACommentAndTheMentionedPersonIsNamed(): void
+    {
+        $this->login($this->reader);
+
+        $this->comment('Hi @owner@example.com', [['id' => (string) $this->owner->getId(), 'label' => 'owner@example.com']]);
+
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . $this->work->getId(),
+            'flashes'  => ['success' => ['Comment added.']],
+            'writes'   => ['task_comment'],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame(['comment:created', 'mention'], $this->events);
+        $stored = $this->onlyComment();
+        self::assertSame('Hi @owner@example.com', $stored->getBody());
+        self::assertSame([(string) $this->owner->getId()], $stored->getMentionedIds());
+    }
+
+    public function testAnEmptyCommentIsRefusedWithAFlash(): void
+    {
+        $this->login($this->reader);
+
+        $this->comment('');
+
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . $this->work->getId(),
+            'flashes'  => ['error' => ['The comment was not saved: write between 1 and 5000 characters.']],
+            'writes'   => [],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame([], $this->events);
+    }
+
+    public function testAForgedTokenOnACommentIs403AndLogged(): void
+    {
+        $this->login($this->reader);
+
+        $this->client->request('POST', self::BASE . $this->work->getId() . '/comment', ['task_comment' => ['body' => 'x', 'mentions' => '[]', '_token' => 'forged']]);
+
+        $captured = $this->captured();
+        self::assertSame(403, $captured['status']);
+        self::assertSame(['csrf_invalid'], $captured['refused']);
+        self::assertSame([], $captured['writes']);
+        self::assertSame([], $this->events);
+    }
+
+    public function testReadersAreRefusedWhenTheOptionIsOffAndEditorsAreNot(): void
+    {
+        self::$taskBoardConfig = ['comments' => ['readers_can_comment' => false]];
+        self::ensureKernelShutdown();
+        $this->events = [];
+        $this->setUp();
+        $this->login($this->reader);
+
+        $this->comment('Reader');
+        self::assertSame(403, $this->captured()['status']);
+
+        $this->login($this->owner);
+        $this->comment('Editor');
+        self::assertSame(['task_comment'], $this->captured()['writes']);
+        self::assertSame('Editor', $this->onlyComment()->getBody());
+    }
+
+    public function testOnlyTheAuthorEditsAndOnlyNewMentionsAreNotified(): void
+    {
+        $this->login($this->reader);
+        $mention = [['id' => (string) $this->owner->getId(), 'label' => 'owner@example.com']];
+        $this->comment('Hi @owner@example.com', $mention);
+        $this->captured();
+        $this->events = [];
+        $comment      = $this->onlyComment();
+
+        $this->client->request('POST', $this->commentUrl($comment), ['task_comment' => ['body' => 'Still @owner@example.com', 'mentions' => json_encode($mention), '_token' => PredictableCsrfTokenManager::value('task_comment')]]);
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . $this->work->getId(),
+            'flashes'  => ['success' => ['Comment updated.']],
+            'writes'   => ['task_comment_edit'],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame(['comment:edited'], $this->events);
+
+        $this->login($this->owner);
+        $this->client->request('POST', $this->commentUrl($comment), ['task_comment' => ['body' => 'Hijack', 'mentions' => '[]', '_token' => PredictableCsrfTokenManager::value('task_comment')]]);
+        self::assertSame(403, $this->captured()['status']);
+        self::assertSame('Still @owner@example.com', $this->onlyComment()->getBody());
+    }
+
+    public function testTheAuthorOrAnEditorDeletesAndNobodyElse(): void
+    {
+        $other = $this->user('other@example.com');
+        $this->login($this->owner);
+        $this->comment('By the owner');
+        $this->captured();
+        $comment      = $this->onlyComment();
+        $this->events = [];
+
+        // A reader who did not write it.
+        $this->login($this->reader);
+        $this->client->request('POST', $this->commentUrl($comment) . '/delete', ['_token' => PredictableCsrfTokenManager::value('task_board_task_comment_delete')]);
+        self::assertSame(403, $this->captured()['status']);
+        self::assertFalse($this->onlyComment()->isDeleted());
+
+        // Someone with no access at all to the task.
+        $this->login($other);
+        $this->client->request('POST', $this->commentUrl($comment) . '/delete', ['_token' => PredictableCsrfTokenManager::value('task_board_task_comment_delete')]);
+        self::assertSame(403, $this->captured()['status']);
+
+        // The author; no event is dispatched for a deletion.
+        $this->login($this->owner);
+        $this->client->request('POST', $this->commentUrl($comment) . '/delete', ['_token' => PredictableCsrfTokenManager::value('task_board_task_comment_delete')]);
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . $this->work->getId(),
+            'flashes'  => ['success' => ['Comment deleted.']],
+            'writes'   => ['task_comment_delete'],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame([], $this->events);
+        self::assertTrue($this->onlyComment()->isDeleted());
+
+        // Deleted: not found, for edit and delete alike.
+        $this->client->request('POST', $this->commentUrl($comment) . '/delete', ['_token' => PredictableCsrfTokenManager::value('task_board_task_comment_delete')]);
+        self::assertSame(404, $this->captured()['status']);
+    }
+
+    public function testAReaderDeletesTheirOwnComment(): void
+    {
+        $this->login($this->reader);
+        $this->comment('Mine');
+        $this->captured();
+
+        $this->client->request('POST', $this->commentUrl($this->onlyComment()) . '/delete', ['_token' => PredictableCsrfTokenManager::value('task_board_task_comment_delete')]);
+
+        self::assertSame(['task_comment_delete'], $this->captured()['writes']);
+        self::assertTrue($this->onlyComment()->isDeleted());
+    }
+
+    public function testAPanelWriteAnswersTheFragmentWithTheViewersControls(): void
+    {
+        $this->login($this->reader);
+
+        $this->client->xmlHttpRequest('POST', self::BASE . $this->work->getId() . '/comment', ['task_comment' => ['body' => 'From the panel', 'mentions' => '[]', '_token' => PredictableCsrfTokenManager::value('task_comment')]]);
+
+        $captured = $this->captured();
+        self::assertSame(200, $captured['status']);
+        self::assertNull($captured['location']);
+        self::assertSame(['task_comment'], $captured['writes']);
+        $this->dumpBody('comment-panel-reader');
+        $comment = $this->onlyComment();
+        $page    = (string) $this->client->getResponse()->getContent();
+        self::assertStringNotContainsString('<html', $page);
+        self::assertStringContainsString('From the panel', $page);
+        self::assertStringContainsString($this->commentUrl($comment), $page, 'the author can edit');
+        self::assertStringContainsString($this->commentUrl($comment) . '/delete', $page, 'the author can delete');
+    }
+
+    public function testTheTaskPageShowsEachViewerTheirControls(): void
+    {
+        $this->login($this->owner);
+        $this->comment('By the owner');
+        $this->captured();
+        $comment = $this->onlyComment();
+
+        $this->client->request('GET', self::BASE . $this->work->getId());
+        self::assertResponseIsSuccessful();
+        $this->dumpBody('task-page-editor');
+        $editor = (string) $this->client->getResponse()->getContent();
+        self::assertStringContainsString($this->commentUrl($comment) . '"', $editor, 'the author edits');
+        self::assertStringContainsString($this->commentUrl($comment) . '/delete', $editor);
+        self::assertStringContainsString(self::BASE . $this->work->getId() . '/comment"', $editor, 'the box');
+
+        $this->login($this->reader);
+        $this->client->request('GET', self::BASE . $this->work->getId());
+        self::assertResponseIsSuccessful();
+        $this->dumpBody('task-page-reader');
+        $reader = (string) $this->client->getResponse()->getContent();
+        self::assertFalse(str_contains($reader, $this->commentUrl($comment) . '"'), 'not the author: no edit form');
+        self::assertFalse(str_contains($reader, $this->commentUrl($comment) . '/delete'), 'not an editor: no delete');
+        self::assertStringContainsString(self::BASE . $this->work->getId() . '/comment"', $reader, 'readers comment by default');
+    }
+
+    public function testTheTaskPageHidesTheBoxFromReadersWhenTheOptionIsOff(): void
+    {
+        self::$taskBoardConfig = ['comments' => ['readers_can_comment' => false]];
+        self::ensureKernelShutdown();
+        $this->events = [];
+        $this->setUp();
+        $this->login($this->reader);
+
+        $this->client->request('GET', self::BASE . $this->work->getId());
+
+        self::assertResponseIsSuccessful();
+        $this->dumpBody('task-page-reader-option-off');
+        self::assertStringNotContainsString(self::BASE . $this->work->getId() . '/comment"', (string) $this->client->getResponse()->getContent());
+    }
+
+    /**
+     * @param list<array{id: string, label: string}> $mentions
+     */
+    private function comment(string $body, array $mentions = []): void
+    {
+        $this->client->request('POST', self::BASE . $this->work->getId() . '/comment', ['task_comment' => ['body' => $body, 'mentions' => json_encode($mentions), '_token' => PredictableCsrfTokenManager::value('task_comment')]]);
+    }
+
+    private function commentUrl(TaskComment $comment): string
+    {
+        return self::BASE . $this->work->getId() . '/comment/' . $comment->getId();
+    }
+
+    private function onlyComment(): TaskComment
+    {
+        $this->em->clear();
+        $comments = $this->em->getRepository(TaskComment::class)->findAll();
+        self::assertCount(1, $comments);
+
+        return $comments[0];
+    }
+}
diff --git a/tests/Functional/Characterization/UiFormsCharacterizationTest.php b/tests/Functional/Characterization/UiFormsCharacterizationTest.php
new file mode 100644
index 00000000..20852a6b
--- /dev/null
+++ b/tests/Functional/Characterization/UiFormsCharacterizationTest.php
@@ -0,0 +1,182 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Characterization;
+
+use Nowo\TaskBoardBundle\Dto\TaskFormData;
+use Nowo\TaskBoardBundle\Entity\BoardColumn;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskLink;
+use Nowo\TaskBoardBundle\Form\BoardColumnFormType;
+use Nowo\TaskBoardBundle\Form\TaskBoardFormType;
+use Nowo\TaskBoardBundle\Form\TaskCommentFormType;
+use Nowo\TaskBoardBundle\Form\TaskFormType;
+use Nowo\TaskBoardBundle\Form\TaskLinkFormType;
+use Nowo\TaskBoardBundle\Form\TaskTimeEntryFormType;
+use Nowo\TaskBoardBundle\Support\BoardIcon;
+use Nowo\TaskBoardBundle\Tests\Functional\App\PredictableCsrfTokenManager;
+use Nowo\TaskBoardBundle\Tests\Functional\FunctionalTestCase;
+use PHPUnit\Framework\Attributes\DataProvider;
+use Symfony\Component\Form\FormFactoryInterface;
+use Symfony\Component\Form\FormInterface;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\Constraints\Callback;
+use Symfony\Component\Validator\Constraints\Length;
+use Symfony\Component\Validator\Constraints\NotBlank;
+use Symfony\Component\Validator\Constraints\NotNull;
+use Symfony\Component\Validator\Constraints\Range;
+use Symfony\Component\Validator\Constraints\Regex;
+use Symfony\Component\Validator\Constraints\Url;
+
+use function array_keys;
+use function array_values;
+use function count;
+use function str_repeat;
+
+/**
+ * Spec 213 S0: the validation the six write forms apply, pinned before their constraints get a shared home. A form that
+ * lost or relaxed a rule would fail here, and with it a stored title over the column's size or a `javascript:` link.
+ */
+final class UiFormsCharacterizationTest extends FunctionalTestCase
+{
+    use CapturesUiOutput;
+
+    /**
+     * @return iterable<string, array{0: class-string, 1: array<string, mixed>, 2: array<string, list<array<string, mixed>>>}>
+     */
+    public static function forms(): iterable
+    {
+        yield 'task' => [TaskFormType::class, ['column_choices' => []], [
+            'title'   => [['class' => NotBlank::class], ['class' => Length::class, 'max' => 255]],
+            'startAt' => [['class' => Callback::class]],
+        ]];
+        yield 'board' => [TaskBoardFormType::class, ['icon_field' => true, 'icon_too_long_message' => 'long', 'icon_invalid_message' => 'invalid'], [
+            'name' => [['class' => NotBlank::class], ['class' => Length::class, 'max' => 255]],
+            'slug' => [['class' => Length::class, 'max' => 255]],
+            'icon' => [
+                ['class' => Length::class, 'max' => BoardIcon::MAX_BYTES, 'countUnit' => Length::COUNT_BYTES, 'maxMessage' => 'long'],
+                ['class' => Regex::class, 'pattern' => BoardIcon::PATTERN, 'message' => 'invalid'],
+            ],
+        ]];
+        yield 'column' => [BoardColumnFormType::class, [], [
+            'name'  => [['class' => NotBlank::class], ['class' => Length::class, 'max' => 128]],
+            'color' => [['class' => Regex::class, 'pattern' => BoardColumnFormType::COLOR_PATTERN]],
+        ]];
+        yield 'comment' => [TaskCommentFormType::class, [], [
+            'body' => [['class' => NotBlank::class], ['class' => Length::class, 'max' => TaskComment::MAX_LENGTH]],
+        ]];
+        yield 'time' => [TaskTimeEntryFormType::class, [], [
+            'minutes'  => [['class' => NotNull::class], ['class' => Range::class, 'min' => 1, 'max' => TaskTimeEntryFormType::MAX_MINUTES]],
+            'loggedAt' => [['class' => NotNull::class]],
+            'note'     => [['class' => Length::class, 'max' => 512]],
+        ]];
+        yield 'link' => [TaskLinkFormType::class, [], [
+            'url' => [
+                ['class' => NotBlank::class],
+                ['class' => Url::class, 'protocols' => ['http', 'https'], 'requireTld' => false],
+                ['class' => Length::class, 'max' => 2048],
+            ],
+            'label'      => [['class' => Length::class, 'max' => 255]],
+            'externalId' => [['class' => Length::class, 'max' => 128]],
+        ]];
+    }
+
+    /**
+     * @param class-string $type
+     * @param array<string, mixed> $options
+     * @param array<string, list<array<string, mixed>>> $expected
+     */
+    #[DataProvider('forms')]
+    public function testAFormKeepsItsConstraints(string $type, array $options, array $expected): void
+    {
+        $factory = self::getContainer()->get('form.factory');
+        self::assertInstanceOf(FormFactoryInterface::class, $factory);
+        $form = $factory->create($type, null, $options);
+
+        foreach ($expected as $field => $constraints) {
+            self::assertSame($constraints, $this->described($form->get($field), $constraints), $field);
+        }
+    }
+
+    public function testATitleOverTheColumnSizeIsAFlashAndNothingIsStored(): void
+    {
+        $board  = $this->board();
+        $column = $board->getColumns()->first();
+        self::assertInstanceOf(BoardColumn::class, $column);
+        $this->login($this->owner);
+        $this->logger()->records = [];
+
+        $this->client->request('POST', '/tools/task-board/board/' . $board->getId() . '/create', ['task_form' => ['title' => str_repeat('x', 256), 'columnId' => $column->getId(), '_token' => PredictableCsrfTokenManager::value('task_form')]]);
+
+        $captured = $this->captured();
+        self::assertSame(302, $captured['status']);
+        self::assertSame([], $captured['writes']);
+        self::assertCount(1, $captured['flashes']['error'] ?? []);
+        self::assertSame([], $this->em->getRepository(Task::class)->findBy(['board' => $board]));
+    }
+
+    public function testAJavascriptLinkIsNotStored(): void
+    {
+        $task = $this->task($this->board(), 'Linked');
+        $this->login($this->owner);
+        $this->logger()->records = [];
+
+        $this->client->request('POST', '/tools/task-board/task/' . $task->getId() . '/link', ['task_link_form' => ['linkType' => 'url', 'url' => 'javascript:alert(1)', '_token' => PredictableCsrfTokenManager::value('task_link_form')]]);
+
+        self::assertSame([], $this->captured()['writes']);
+        self::assertSame([], $this->em->getRepository(TaskLink::class)->findBy(['task' => $task]));
+    }
+
+    public function testAStartAfterTheDueDateIsAFormError(): void
+    {
+        $factory = self::getContainer()->get('form.factory');
+        self::assertInstanceOf(FormFactoryInterface::class, $factory);
+        $form = $factory->create(TaskFormType::class, new TaskFormData(), ['column_choices' => [], 'csrf_protection' => false, 'rich_description' => false, 'tag_input' => false]);
+
+        $form->submit(['title' => 'Dates', 'priority' => 'normal', 'startAt' => '2026-11-07', 'dueAt' => '2026-11-06']);
+
+        self::assertFalse($form->isValid());
+        self::assertSame(1, $form->get('startAt')->getErrors()->count());
+    }
+
+    public function testTheBoardPagesRenderTheirForms(): void
+    {
+        $board = $this->board();
+        $task  = $this->task($board, 'Rendered');
+        $this->login($this->owner);
+
+        foreach (['board' => '/board/' . $board->getId(), 'list' => '/board/' . $board->getId() . '/list', 'index' => '', 'task' => '/task/' . $task->getId(), 'import' => '/board/' . $board->getId() . '/import'] as $name => $path) {
+            $this->client->request('GET', '/tools/task-board' . $path);
+            self::assertResponseIsSuccessful($name);
+            $this->dumpBody('page-' . $name);
+        }
+    }
+
+    /**
+     * @param FormInterface<mixed> $field
+     * @param list<array<string, mixed>> $expected what to read of each constraint
+     *
+     * @return list<array<string, mixed>>
+     */
+    private function described(FormInterface $field, array $expected): array
+    {
+        $constraints = $field->getConfig()->getOption('constraints');
+        self::assertIsArray($constraints);
+        self::assertCount(count($expected), $constraints);
+        $described = [];
+        foreach (array_values($constraints) as $index => $constraint) {
+            self::assertInstanceOf(Constraint::class, $constraint);
+            $row = ['class' => $constraint::class];
+            foreach (array_keys($expected[$index]) as $property) {
+                if ($property !== 'class') {
+                    $row[$property] = $constraint->{$property};
+                }
+            }
+            $described[] = $row;
+        }
+
+        return $described;
+    }
+}
diff --git a/tests/Functional/Characterization/UiRestoreCharacterizationTest.php b/tests/Functional/Characterization/UiRestoreCharacterizationTest.php
new file mode 100644
index 00000000..d6a59389
--- /dev/null
+++ b/tests/Functional/Characterization/UiRestoreCharacterizationTest.php
@@ -0,0 +1,135 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Characterization;
+
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskChangeHistory;
+use Nowo\TaskBoardBundle\Enum\TaskChangeType;
+use Nowo\TaskBoardBundle\Tests\Functional\App\PredictableCsrfTokenManager;
+use Nowo\TaskBoardBundle\Tests\Functional\App\TestSyncLimitChecker;
+use Nowo\TaskBoardBundle\Tests\Functional\Sync\SyncFunctionalTestCase;
+
+/**
+ * Spec 213 S0: the restore route's output with the host's limit wired, pinned before the rule moves to the service.
+ */
+final class UiRestoreCharacterizationTest extends SyncFunctionalTestCase
+{
+    use CapturesUiOutput;
+
+    private const BASE = '/tools/task-board/';
+
+    public function testAnArchivedTaskIsRestoredAndRecorded(): void
+    {
+        $board = $this->board();
+        $task  = $this->archived($board, 'Back');
+        $this->login($this->owner);
+        $this->logger()->records = [];
+
+        $this->restore($task);
+
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . 'board/' . $board->getId() . '/list',
+            'flashes'  => ['success' => ['The task was restored.']],
+            'writes'   => ['task_restore'],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame([[1, 0]], TestSyncLimitChecker::$calls);
+        $this->em->clear();
+        $reloaded = $this->em->find(Task::class, $task->getId());
+        self::assertInstanceOf(Task::class, $reloaded);
+        self::assertFalse($reloaded->isArchived());
+        $history = $this->em->getRepository(TaskChangeHistory::class)->findBy(['task' => $reloaded, 'changeType' => TaskChangeType::Restored]);
+        self::assertCount(1, $history);
+        self::assertSame('manual', $history[0]->getNewValue());
+    }
+
+    public function testACompletedTaskAsksTheLimitForNothing(): void
+    {
+        $board = $this->board();
+        $task  = $this->archived($board, 'Done', completed: true);
+        $this->login($this->owner);
+
+        $this->restore($task);
+
+        self::assertSame([[0, 0]], TestSyncLimitChecker::$calls);
+        self::assertSame(['task_restore'], $this->captured()['writes']);
+    }
+
+    public function testARefusedRestoreChangesNothingAndSaysSo(): void
+    {
+        $board = $this->board();
+        $task  = $this->archived($board, 'Over the limit');
+        $this->login($this->owner);
+        $this->logger()->records           = [];
+        TestSyncLimitChecker::$refuseTasks = true;
+
+        $this->restore($task);
+
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . 'board/' . $board->getId() . '/list',
+            'flashes'  => ['error' => ['The task was not restored: the limit of active tasks was reached.']],
+            'writes'   => [],
+            'refused'  => [],
+        ], $this->captured());
+        $this->em->clear();
+        self::assertTrue($this->em->find(Task::class, $task->getId())?->isArchived());
+        self::assertSame([], $this->em->getRepository(TaskChangeHistory::class)->findBy(['changeType' => TaskChangeType::Restored]));
+    }
+
+    public function testATaskThatIsNotArchivedIsLeftAloneWithoutAskingTheLimit(): void
+    {
+        $board = $this->board();
+        $task  = $this->task($board, 'Active');
+        $this->login($this->owner);
+        $this->logger()->records = [];
+
+        $this->restore($task);
+
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . 'board/' . $board->getId() . '/list',
+            'flashes'  => [],
+            'writes'   => [],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame([], TestSyncLimitChecker::$calls);
+    }
+
+    public function testAForgedTokenIsRefusedBeforeAnything(): void
+    {
+        $board = $this->board();
+        $task  = $this->archived($board, 'Stays');
+        $this->login($this->owner);
+        $this->logger()->records = [];
+
+        $this->client->request('POST', self::BASE . 'task/' . $task->getId() . '/restore', ['_token' => 'forged']);
+
+        $captured = $this->captured();
+        self::assertSame(403, $captured['status']);
+        self::assertSame(['csrf_invalid'], $captured['refused']);
+        self::assertSame([], TestSyncLimitChecker::$calls);
+    }
+
+    private function archived(TaskBoard $board, string $title, bool $completed = false): Task
+    {
+        $task = new Task(board: $board, title: $title, creator: $this->owner, column: $board->getColumns()->first() ?: null);
+        if ($completed) {
+            $task->markCompleted();
+        }
+        $task->archive();
+        $this->em->persist($task);
+        $this->em->flush();
+
+        return $task;
+    }
+
+    private function restore(Task $task): void
+    {
+        $this->client->request('POST', self::BASE . 'task/' . $task->getId() . '/restore', ['_token' => PredictableCsrfTokenManager::value('task_board_task_restore')]);
+    }
+}
diff --git a/tests/Functional/SharedWriteServicesTest.php b/tests/Functional/SharedWriteServicesTest.php
new file mode 100644
index 00000000..998a0945
--- /dev/null
+++ b/tests/Functional/SharedWriteServicesTest.php
@@ -0,0 +1,212 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Dto\TaskFormData;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskChangeHistory;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Enum\TaskChangeType;
+use Nowo\TaskBoardBundle\Enum\TaskDependencyType;
+use Nowo\TaskBoardBundle\Enum\TaskPriority;
+use Nowo\TaskBoardBundle\Event\BoardAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\BoardUpdatedEvent;
+use Nowo\TaskBoardBundle\Event\TaskAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Event\TaskErasedEvent;
+use Nowo\TaskBoardBundle\Repository\TaskBoardRepositoryInterface;
+use Nowo\TaskBoardBundle\Security\TaskBoardResourceAccessChecker;
+use Nowo\TaskBoardBundle\Service\TaskBoardEditor;
+use Nowo\TaskBoardBundle\Service\TaskBoardEraser;
+use Nowo\TaskBoardBundle\Service\TaskCommentPolicy;
+use Nowo\TaskBoardBundle\Service\TaskDependencyManager;
+use Nowo\TaskBoardBundle\Service\TaskManager;
+use Nowo\TaskBoardBundle\Service\TaskTimeLogger;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+/**
+ * Since 2.2.0 (spec 213): the services other write paths share with the UI, or that the UI does not have yet.
+ */
+final class SharedWriteServicesTest extends FunctionalTestCase
+{
+    public function testEraseTaskRemovesTheSubtreeLeafFirstAndKeepsEveryMinute(): void
+    {
+        $board      = $this->board();
+        $parent     = $this->task($board, 'Parent');
+        $child      = $this->task($board, 'Child', parent: $parent);
+        $grandchild = $this->task($board, 'Grandchild', parent: $child);
+        $sibling    = $this->task($board, 'Sibling');
+        $logger     = $this->service(TaskTimeLogger::class);
+        $onChild    = $logger->log($child, $this->owner, 30, new DateTimeImmutable('2026-11-04'))->getId();
+        $onLeaf     = $logger->log($grandchild, $this->owner, 15, new DateTimeImmutable('2026-11-04'))->getId();
+        $erased     = [];
+        $this->dispatcher()->addListener(TaskBoardEvents::TASK_ERASED, static function (TaskErasedEvent $event) use (&$erased): void {
+            $erased[$event->title] = $event->manualTimeEntries;
+        });
+        $siblingId = $sibling->getId();
+
+        self::assertSame(3, $this->eraser()->eraseTask($parent, $this->owner));
+
+        self::assertSame(['Grandchild' => 1, 'Child' => 1, 'Parent' => 0], $erased);
+        $this->em->clear();
+        self::assertSame(1, $this->em->getRepository(Task::class)->count([]));
+        self::assertInstanceOf(Task::class, $this->em->find(Task::class, $siblingId));
+        foreach ([$onChild => [30, 'Child'], $onLeaf => [15, 'Grandchild']] as $id => [$minutes, $title]) {
+            $entry = $this->em->find(TaskTimeEntry::class, $id);
+            self::assertInstanceOf(TaskTimeEntry::class, $entry, 'tracked time is never deleted');
+            self::assertTrue($entry->isDetached());
+            self::assertSame($minutes, $entry->getMinutes());
+            self::assertSame($title, $entry->getTaskTitleSnapshot());
+        }
+    }
+
+    public function testEraseTaskNeedsTheBoardManageDecision(): void
+    {
+        $task = $this->task($this->board(), 'Stays');
+        $this->dispatcher()->addListener(TaskBoardEvents::BOARD_ACCESS_CHECK, static function (BoardAccessCheckEvent $event): void {
+            if ($event->getAction() === BoardAccessCheckEvent::ACTION_MANAGE) {
+                $event->deny();
+            }
+        });
+
+        try {
+            $this->eraser()->eraseTask($task, $this->owner);
+            self::fail('AccessDeniedException expected');
+        } catch (AccessDeniedException) {
+        }
+
+        $this->em->clear();
+        self::assertInstanceOf(Task::class, $this->em->find(Task::class, $task->getId()));
+    }
+
+    public function testRestoreAndArchiveRecordTheirHistoryAndAreIdempotent(): void
+    {
+        $task    = $this->task($this->board(), 'Back and forth');
+        $manager = $this->service(TaskManager::class);
+
+        self::assertFalse($manager->restore($task, $this->owner), 'not archived');
+        self::assertTrue($manager->archive($task, $this->owner));
+        self::assertTrue($task->isArchived());
+        self::assertFalse($manager->archive($task, $this->owner), 'already archived');
+        self::assertTrue($manager->restore($task, $this->owner));
+        self::assertFalse($task->isArchived());
+
+        $this->em->clear();
+        $history = $this->em->getRepository(TaskChangeHistory::class);
+        self::assertCount(1, $history->findBy(['changeType' => TaskChangeType::Archived, 'newValue' => 'manual']));
+        self::assertCount(1, $history->findBy(['changeType' => TaskChangeType::Restored, 'newValue' => 'manual']));
+    }
+
+    public function testTheCommentPolicyAnswersEachRole(): void
+    {
+        $task     = $this->task($this->board(), 'Discussed');
+        $reader   = $this->user('reader@example.com');
+        $readerId = $reader->getId();
+        $this->dispatcher()->addListener(TaskBoardEvents::TASK_ACCESS_CHECK, static function (TaskAccessCheckEvent $event) use ($readerId): void {
+            $subject = $event->getSubject();
+            if (method_exists($subject, 'getId') && $subject->getId() === $readerId) {
+                $event->grant();
+                $event->markReadOnly();
+            }
+        });
+        $checker  = $this->service(TaskBoardResourceAccessChecker::class);
+        $open     = new TaskCommentPolicy($checker, true);
+        $closed   = new TaskCommentPolicy($checker, false);
+        $byReader = new TaskComment($task, $reader, 'Mine');
+        $byOwner  = new TaskComment($task, $this->owner, 'Theirs');
+
+        self::assertTrue($open->mayComment($reader, $task));
+        self::assertFalse($closed->mayComment($reader, $task));
+        self::assertTrue($closed->mayComment($this->owner, $task), 'an editor always may');
+
+        self::assertTrue($open->mayEdit($reader, $task, $byReader));
+        self::assertFalse($closed->mayEdit($reader, $task, $byReader), 'the author, while they may comment');
+        self::assertFalse($open->mayEdit($this->owner, $task, $byReader), 'an editor does not edit someone else');
+
+        self::assertTrue($closed->mayDelete($reader, $task, $byReader), 'the author deletes');
+        self::assertFalse($open->mayDelete($reader, $task, $byOwner));
+        self::assertTrue($open->mayDelete($this->owner, $task, $byReader), 'an editor deletes');
+    }
+
+    public function testTheBoardEditorChangesWhatChangedAndKeepsTheSlug(): void
+    {
+        $board  = $this->board();
+        $slug   = $board->getSlug();
+        $events = [];
+        $editor = new TaskBoardEditor($this->service(TaskBoardRepositoryInterface::class), $this->dispatcher());
+        $this->dispatcher()->addListener(TaskBoardEvents::BOARD_UPDATED, static function (BoardUpdatedEvent $event) use (&$events): void {
+            $events[] = $event->changed;
+        });
+
+        $editor->update($board, 'Renamed', null, $this->owner);
+        $editor->update($board, 'Renamed', 'Now with text', $this->owner);
+        $editor->update($board, 'Renamed', 'Now with text', $this->owner);
+
+        self::assertSame([['name'], ['description']], $events);
+        $this->em->clear();
+        $saved = $this->service(TaskBoardRepositoryInterface::class)->findById($board->getId());
+        self::assertSame('Renamed', $saved?->getName());
+        self::assertSame('Now with text', $saved?->getDescription());
+        self::assertSame($slug, $saved?->getSlug());
+    }
+
+    public function testFindBetweenSeesBothDirectionsAndNothingElse(): void
+    {
+        $board   = $this->board();
+        $a       = $this->task($board, 'A');
+        $b       = $this->task($board, 'B');
+        $c       = $this->task($board, 'C');
+        $manager = $this->service(TaskDependencyManager::class);
+        $edge    = $manager->add($a, $b, TaskDependencyType::Blocks, $this->owner);
+
+        self::assertSame([$edge->getId()], array_map(static fn ($d): string => $d->getId(), $manager->findBetween($a, $b)));
+        self::assertSame([$edge->getId()], array_map(static fn ($d): string => $d->getId(), $manager->findBetween($b, $a)));
+        self::assertSame([], $manager->findBetween($a, $c));
+    }
+
+    public function testFormDataOfATaskIsTheTaskAsItStands(): void
+    {
+        $task = $this->task($this->board(), 'Full');
+        $due  = new DateTimeImmutable('2026-12-01');
+        $task->setDescription('Text')->setPriority(TaskPriority::High)->setEstimatedMinutes(90)->setDueAt($due)->setTags(['api'])->setColor('#a1b2c3')->setStartAt($due);
+
+        $data = TaskFormData::fromTask($task);
+
+        self::assertSame('Full', $data->title);
+        self::assertSame('Text', $data->description);
+        self::assertSame(TaskPriority::High, $data->priority);
+        self::assertSame($task->getColumn()?->getId(), $data->columnId);
+        self::assertSame(90, $data->estimatedMinutes);
+        self::assertSame($due, $data->dueAt);
+        self::assertSame(['api'], $data->tags);
+        self::assertSame('#a1b2c3', $data->color);
+        self::assertSame($due, $data->startAt);
+    }
+
+    private function eraser(): TaskBoardEraser
+    {
+        return $this->service('app.board_eraser');
+    }
+
+    private function dispatcher(): EventDispatcherInterface
+    {
+        return $this->service('event_dispatcher');
+    }
+
+    /**
+     * @template T of object
+     *
+     * @param class-string<T>|string $id
+     *
+     * @return ($id is class-string<T> ? T : mixed)
+     */
+    private function service(string $id): mixed
+    {
+        return self::getContainer()->get($id);
+    }
+}
diff --git a/tests/Functional/Sync/SyncEraseTaskRefsTest.php b/tests/Functional/Sync/SyncEraseTaskRefsTest.php
new file mode 100644
index 00000000..79b9aa81
--- /dev/null
+++ b/tests/Functional/Sync/SyncEraseTaskRefsTest.php
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Sync;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Event\TaskErasedEvent;
+use Nowo\TaskBoardBundle\Service\TaskBoardEraser;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncAttachment;
+use Nowo\TaskBoardBundle\Sync\Provider\RemoteAttachment;
+use Nowo\TaskBoardBundle\Tests\Functional\App\FixtureHttpClient;
+use Nowo\TaskBoardBundle\Tests\Functional\App\RecordingAttachmentStorage;
+use Symfony\Component\HttpClient\Response\MockResponse;
+
+use function array_keys;
+
+/**
+ * Since 2.2.0, audit IA-M1 (proof test by the auditor): a task erased after its board was unlinked still names the files the
+ * sync stored, as deleteBoard() does since GWd-M1, and leaves no row behind on any database.
+ */
+final class SyncEraseTaskRefsTest extends SyncPeopleFunctionalTestCase
+{
+    private const PDF = "%PDF-1.4\n%\xE2\xE3\xCF\xD3\n1 0 obj<<>>endobj\ntrailer<<>>\n%%EOF";
+
+    public function testEraseTaskAfterUnlinkNamesTheStoredFiles(): void
+    {
+        $board                        = $this->board();
+        FixtureHttpClient::$responder = static fn (): MockResponse => new MockResponse(self::PDF, ['http_code' => 200]);
+        $this->put($this->remote('t1', 'Has file', attachments: [new RemoteAttachment('att1', 'own.pdf', 30, 'application/pdf', 'https://t000.p.clickup-attachments.com/att1/own.pdf', new DateTimeImmutable('@1790000000'))]));
+        $this->sync($board);
+        self::assertSame(1, $this->rows(TaskSyncAttachment::class));
+
+        $this->service()->unlink($this->freshBoard($board), $this->owner);
+        $this->em->clear();
+        $this->refreshOwner();
+        self::assertSame(1, $this->rows(TaskSyncAttachment::class), 'row outlives the unlink (GWd-M1)');
+
+        $refs = [];
+        $this->dispatcher()->addListener(TaskBoardEvents::TASK_ERASED, static function (TaskErasedEvent $event) use (&$refs): void {
+            $refs = [...$refs, ...$event->attachmentRefs];
+        });
+        $eraser = self::getContainer()->get('app.board_eraser');
+        self::assertInstanceOf(TaskBoardEraser::class, $eraser);
+        $task = $this->em->getRepository(Task::class)->findOneBy(['title' => 'Has file']);
+        self::assertInstanceOf(Task::class, $task);
+        self::assertSame(1, $eraser->eraseTask($task, $this->owner));
+
+        self::assertCount(1, $refs, 'the host learns of the stored file');
+        self::assertSame(array_keys(RecordingAttachmentStorage::$files), $refs);
+        $this->em->clear();
+        self::assertSame(0, $this->rows(TaskSyncAttachment::class), 'no orphaned row, whatever the database enforces');
+
+        // Named once: a later deletion of the board has nothing more to name.
+        $later = [];
+        $this->dispatcher()->addListener(TaskBoardEvents::TASK_ERASED, static function (TaskErasedEvent $event) use (&$later): void {
+            $later = [...$later, ...$event->attachmentRefs];
+        });
+        $eraser->deleteBoard($this->freshBoard($board), $this->owner);
+        self::assertSame([], $later);
+    }
+}
diff --git a/tests/Functional/Sync/SyncEraseTaskTest.php b/tests/Functional/Sync/SyncEraseTaskTest.php
new file mode 100644
index 00000000..5d53756d
--- /dev/null
+++ b/tests/Functional/Sync/SyncEraseTaskTest.php
@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Sync;
+
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Exception\TaskLinkedToProviderException;
+use Nowo\TaskBoardBundle\Service\TaskBoardEraser;
+
+use function array_map;
+use function sort;
+
+/**
+ * Since 2.2.0 (spec 213): a task that follows a provider is not erased on its own, as the next sync would bring it back.
+ */
+final class SyncEraseTaskTest extends SyncFunctionalTestCase
+{
+    public function testASyncedTaskIsNotErasedOnItsOwnNorIsItsParent(): void
+    {
+        $board = $this->board();
+        $this->put($this->remote('s1', 'Synced', 1));
+        $this->sync($board);
+        $fresh  = $this->freshBoard($board);
+        $local  = $this->task($fresh, 'Local');
+        $parent = $this->task($fresh, 'Local parent');
+        $synced = $this->taskTitled('Synced');
+        $synced->setParent($parent);
+        $this->em->flush();
+        $eraser = self::getContainer()->get('app.board_eraser');
+        self::assertInstanceOf(TaskBoardEraser::class, $eraser);
+
+        foreach ([$synced, $parent] as $refused) {
+            try {
+                $eraser->eraseTask($refused, $this->owner);
+                self::fail('TaskLinkedToProviderException expected');
+            } catch (TaskLinkedToProviderException) {
+            }
+        }
+        self::assertSame(1, $eraser->eraseTask($local, $this->owner), 'a local task on a linked board goes');
+
+        $this->em->clear();
+        $titles = array_map(static fn (Task $task): string => $task->getTitle(), $this->em->getRepository(Task::class)->findAll());
+        sort($titles);
+        self::assertSame(['Local parent', 'Synced'], $titles);
+    }
+}
diff --git a/tests/Unit/Api/TaskApiExtensionTest.php b/tests/Unit/Api/TaskApiExtensionTest.php
new file mode 100644
index 00000000..6c93718d
--- /dev/null
+++ b/tests/Unit/Api/TaskApiExtensionTest.php
@@ -0,0 +1,151 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Unit\Api;
+
+use Doctrine\Bundle\DoctrineBundle\DependencyInjection\DoctrineExtension;
+use LogicException;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiPlanGate;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiIdempotencyStoreInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiPlanGateInterface;
+use Nowo\TaskBoardBundle\Api\Idempotency\DoctrineTaskApiIdempotencyStore;
+use Nowo\TaskBoardBundle\DependencyInjection\TaskBoardExtension;
+use Nowo\TaskBoardBundle\Routing\TaskBoardRouteLoader;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use stdClass;
+use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
+use Symfony\Component\DependencyInjection\ContainerBuilder;
+
+/**
+ * Spec 213: a host that would open boards by accident does not get a container.
+ */
+final class TaskApiExtensionTest extends TestCase
+{
+    public function testEnabledWithoutAnAuthenticatorStopsTheBuild(): void
+    {
+        $this->expectException(LogicException::class);
+        $this->expectExceptionMessage('api.hooks.authenticator');
+
+        $this->load(['api' => ['enabled' => true]]);
+    }
+
+    public function testAnEmptyAuthenticatorStopsTheBuildToo(): void
+    {
+        $this->expectException(LogicException::class);
+
+        $this->load(['api' => ['enabled' => true, 'hooks' => ['authenticator' => '']]]);
+    }
+
+    public function testEnabledWithAllowUnauthenticatedStopsTheBuild(): void
+    {
+        $this->expectException(LogicException::class);
+        $this->expectExceptionMessage('allow_unauthenticated');
+
+        $this->load(['api' => ['enabled' => true, 'hooks' => ['authenticator' => 'app.auth']], 'security' => ['allow_unauthenticated' => true]]);
+    }
+
+    public function testNoScopingNeedsTheHostToSaySoItDecides(): void
+    {
+        try {
+            $this->load(['api' => ['enabled' => true, 'hooks' => ['authenticator' => 'app.auth']], 'security' => ['resource_scoping' => false]]);
+            self::fail('LogicException expected');
+        } catch (LogicException $exception) {
+            self::assertStringContainsString('host_decides_access', $exception->getMessage());
+        }
+
+        $container = $this->load(['api' => ['enabled' => true, 'host_decides_access' => true, 'hooks' => ['authenticator' => 'app.auth']], 'security' => ['resource_scoping' => false]]);
+        self::assertSame('/api/tasks', $container->getParameter('nowo_task_board.api.prefix'));
+    }
+
+    public function testUnsetHooksAreTheDeniersAndSetOnesAreTheHosts(): void
+    {
+        $defaults = $this->load(['api' => ['enabled' => true, 'hooks' => ['authenticator' => 'app.auth']]]);
+        self::assertSame(DenyingTaskApiPlanGate::class, (string) $defaults->getAlias(TaskApiPlanGateInterface::class));
+        self::assertSame(DoctrineTaskApiIdempotencyStore::class, (string) $defaults->getAlias(TaskApiIdempotencyStoreInterface::class), 'the bundle\'s own store');
+
+        $hosts = $this->load(['api' => ['enabled' => true, 'hooks' => ['authenticator' => 'app.auth', 'plan_gate' => 'app.plan', 'idempotency_store' => 'app.store']]]);
+        self::assertSame('app.plan', (string) $hosts->getAlias(TaskApiPlanGateInterface::class));
+        self::assertSame('app.store', (string) $hosts->getAlias(TaskApiIdempotencyStoreInterface::class));
+    }
+
+    /**
+     * @return iterable<string, array{0: mixed}>
+     */
+    public static function badPrefixes(): iterable
+    {
+        yield 'no slash' => ['api/tasks'];
+        yield 'trailing slash' => ['/api/tasks/'];
+        yield 'root' => ['/'];
+        yield 'a variable' => ['/api/{tenant}'];
+        yield 'not a string' => [true];
+    }
+
+    #[DataProvider('badPrefixes')]
+    public function testABadPrefixIsAConfigurationError(mixed $prefix): void
+    {
+        $this->expectException(InvalidConfigurationException::class);
+
+        $this->load(['api' => ['prefix' => $prefix]]);
+    }
+
+    public function testOffRegistersNothingEvenWithHooksSet(): void
+    {
+        $container = $this->load(['api' => ['enabled' => false, 'hooks' => ['authenticator' => 'app.auth']]]);
+
+        self::assertFalse($container->hasParameter('nowo_task_board.api.prefix'));
+        foreach ([...array_keys($container->getDefinitions()), ...array_keys($container->getAliases())] as $id) {
+            self::assertStringNotContainsString('TaskBoardBundle\\Api\\', $id);
+        }
+    }
+
+    public function testSettingTheOptionOffEqualsNotSettingIt(): void
+    {
+        $unset = $this->load([]);
+        $off   = $this->load(['api' => ['enabled' => false, 'prefix' => '/elsewhere', 'hooks' => ['authenticator' => 'app.auth', 'rate_limiter' => 'app.limiter']]]);
+
+        self::assertSame(array_keys($unset->getDefinitions()), array_keys($off->getDefinitions()));
+        self::assertSame(array_keys($unset->getAliases()), array_keys($off->getAliases()));
+        self::assertSame($unset->getParameterBag()->all(), $off->getParameterBag()->all());
+        self::assertEquals($unset->getDefinition(TaskBoardRouteLoader::class)->getArguments(), $off->getDefinition(TaskBoardRouteLoader::class)->getArguments());
+    }
+
+    public function testTheApiTableAndItsQueryFunctionArePrependedOnlyWhenTheyAreNeeded(): void
+    {
+        $doctrine = static function (array $config): string {
+            $container = new ContainerBuilder();
+            $container->registerExtension(new DoctrineExtension());
+            $container->setParameter('kernel.debug', false);
+            $container->prependExtensionConfig('nowo_task_board', ['user_class' => stdClass::class] + $config);
+            (new TaskBoardExtension())->prepend($container);
+
+            return (string) json_encode($container->getExtensionConfig('doctrine'));
+        };
+
+        $off = $doctrine([]);
+        self::assertStringNotContainsString('TaskBoardApi', $off);
+        self::assertStringNotContainsString('NOWO_TB_JSON_TEXT', $off);
+        $on = $doctrine(['api' => ['enabled' => true]]);
+        self::assertStringContainsString('TaskBoardApi', $on);
+        self::assertStringContainsString('NOWO_TB_JSON_TEXT', $on);
+        $replaced = $doctrine(['api' => ['enabled' => true, 'hooks' => ['idempotency_store' => 'app.store']]]);
+        self::assertStringNotContainsString('TaskBoardApi', $replaced, 'a host store needs no table of the bundle');
+        self::assertStringContainsString('NOWO_TB_JSON_TEXT', $replaced);
+    }
+
+    /**
+     * @param array<string, mixed> $config
+     */
+    private function load(array $config): ContainerBuilder
+    {
+        $container = new ContainerBuilder();
+        $container->setParameter('kernel.project_dir', __DIR__);
+        $container->setParameter('kernel.bundles', ['SecurityBundle' => stdClass::class]);
+        $container->setParameter('kernel.debug', false);
+        $container->setParameter('kernel.environment', 'test');
+        (new TaskBoardExtension())->load([['user_class' => stdClass::class] + $config], $container);
+
+        return $container;
+    }
+}
diff --git a/tests/Unit/Api/TaskApiIdempotencyListenerTest.php b/tests/Unit/Api/TaskApiIdempotencyListenerTest.php
new file mode 100644
index 00000000..b9b9271a
--- /dev/null
+++ b/tests/Unit/Api/TaskApiIdempotencyListenerTest.php
@@ -0,0 +1,126 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Unit\Api;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiIdempotencyStoreInterface;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiIdempotencyListener;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiIdempotencyClaim;
+use PHPUnit\Framework\TestCase;
+use ReflectionClass;
+use RuntimeException;
+use stdClass;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
+use Symfony\Component\HttpKernel\Event\ResponseEvent;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
+
+/**
+ * Spec 213: when the store fails, a write with a key is refused before it runs, and a failure to keep an answer after the
+ * write leaves the write done.
+ */
+final class TaskApiIdempotencyListenerTest extends TestCase
+{
+    public function testAStoreThatFailsToClaimRefusesTheWrite(): void
+    {
+        $listener = new TaskApiIdempotencyListener($this->failingStore(), (new ReflectionClass(TaskApiGuard::class))->newInstanceWithoutConstructor());
+
+        try {
+            $listener->onController($this->controllerEvent());
+            self::fail('TaskApiRefusal expected');
+        } catch (TaskApiRefusal $refusal) {
+            self::assertSame([503, 'IDEMP_004'], [$refusal->status, $refusal->ecode]);
+        }
+    }
+
+    public function testAStoreThatFailsToKeepTheAnswerLeavesTheWrite(): void
+    {
+        $listener = new TaskApiIdempotencyListener($this->failingStore(), (new ReflectionClass(TaskApiGuard::class))->newInstanceWithoutConstructor());
+        $request  = $this->request();
+        $request->attributes->set('_nowo_task_board_api_idempotency', ['scope', 'key']);
+        $response = new Response('{}');
+
+        $listener->onResponse(new ResponseEvent($this->kernel(), $request, HttpKernelInterface::MAIN_REQUEST, $response));
+
+        self::assertSame('{}', $response->getContent());
+    }
+
+    public function testNothingHappensWithoutAKeyOrOnAReadOrASubRequest(): void
+    {
+        $store    = $this->failingStore();
+        $listener = new TaskApiIdempotencyListener($store, (new ReflectionClass(TaskApiGuard::class))->newInstanceWithoutConstructor());
+        $read     = $this->request('GET');
+        $listener->onController(new ControllerEvent($this->kernel(), static fn (): Response => new Response(), $read, HttpKernelInterface::MAIN_REQUEST));
+        $noKey = $this->request();
+        $noKey->headers->remove(TaskApiIdempotencyListener::HEADER);
+        $listener->onController(new ControllerEvent($this->kernel(), static fn (): Response => new Response(), $noKey, HttpKernelInterface::MAIN_REQUEST));
+        $listener->onController(new ControllerEvent($this->kernel(), static fn (): Response => new Response(), $this->request(), HttpKernelInterface::SUB_REQUEST));
+        $listener->onResponse(new ResponseEvent($this->kernel(), $this->request(), HttpKernelInterface::MAIN_REQUEST, new Response()));
+
+        self::assertSame(0, $store->calls);
+    }
+
+    private function controllerEvent(): ControllerEvent
+    {
+        return new ControllerEvent($this->kernel(), static fn (): Response => new Response(), $this->request(), HttpKernelInterface::MAIN_REQUEST);
+    }
+
+    private function request(string $method = 'POST'): Request
+    {
+        $request = Request::create('/api/tasks/v2/task/x', $method, [], [], [], [], '{}');
+        $request->attributes->set(TaskApiRequestListener::ROUTE_FLAG, true);
+        $request->attributes->set('_nowo_task_board_api_principal', new TaskApiPrincipal(new stdClass(), TaskApiLevel::Full, TaskApiWhere::everything(), 'id', 'name'));
+        $request->headers->set(TaskApiIdempotencyListener::HEADER, 'key');
+
+        return $request;
+    }
+
+    private function kernel(): HttpKernelInterface
+    {
+        return $this->createStub(HttpKernelInterface::class);
+    }
+
+    private function failingStore(): TaskApiIdempotencyStoreInterface
+    {
+        return new class implements TaskApiIdempotencyStoreInterface {
+            public int $calls = 0;
+
+            public function claim(string $scope, string $keyHash, string $fingerprint, DateTimeImmutable $expiresAt): TaskApiIdempotencyClaim
+            {
+                ++$this->calls;
+
+                throw new RuntimeException('database down');
+            }
+
+            public function complete(string $scope, string $keyHash, int $status, string $body, ?string $tenantKey, ?string $boardId): void
+            {
+                ++$this->calls;
+
+                throw new RuntimeException('database down');
+            }
+
+            public function release(string $scope, string $keyHash): void
+            {
+                ++$this->calls;
+            }
+
+            public function forget(string $scope): void
+            {
+            }
+
+            public function purgeExpired(DateTimeImmutable $now): int
+            {
+                return 0;
+            }
+        };
+    }
+}
diff --git a/tests/Unit/Api/TaskApiValuesTest.php b/tests/Unit/Api/TaskApiValuesTest.php
new file mode 100644
index 00000000..fffbf605
--- /dev/null
+++ b/tests/Unit/Api/TaskApiValuesTest.php
@@ -0,0 +1,209 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Unit\Api;
+
+use DateTimeImmutable;
+use LogicException;
+use Nowo\TaskBoardBundle\Api\Entity\TaskApiIdempotencyRecord;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiAttachments;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiPlanGate;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiRateLimiter;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiTimeEntries;
+use Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiUsers;
+use Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiWorkspace;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiTimeEntriesInterface;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiCredential;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiAttachment;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiIdempotencyClaim;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiIdempotencyOutcome;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiNewTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskFilter;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimePage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Event\TaskApiWriteEvent;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use ReflectionClass;
+use stdClass;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+use Symfony\Component\HttpFoundation\Request;
+
+use function in_array;
+
+/**
+ * Spec 213: the capability table, where, the credential, and that every default denies.
+ */
+final class TaskApiValuesTest extends TestCase
+{
+    /**
+     * The whole table of the contract: anything not listed is denied.
+     *
+     * @return iterable<string, array{0: TaskApiLevel, 1: list<TaskApiCapability>}>
+     */
+    public static function levels(): iterable
+    {
+        yield 'my tasks' => [TaskApiLevel::MyTasks, [TaskApiCapability::ReadOwn, TaskApiCapability::WorkOnTask, TaskApiCapability::Comment]];
+        yield 'read writes nothing, not even its own' => [TaskApiLevel::Read, [TaskApiCapability::ReadOwn, TaskApiCapability::ReadEverything]];
+        yield 'tasks' => [TaskApiLevel::Tasks, [TaskApiCapability::ReadOwn, TaskApiCapability::ReadEverything, TaskApiCapability::WorkOnTask, TaskApiCapability::Comment, TaskApiCapability::EditTasks, TaskApiCapability::DeleteTask]];
+        yield 'full' => [TaskApiLevel::Full, TaskApiCapability::cases()];
+    }
+
+    /**
+     * @param list<TaskApiCapability> $allowed
+     */
+    #[DataProvider('levels')]
+    public function testALevelMayExactlyWhatTheTableSays(TaskApiLevel $level, array $allowed): void
+    {
+        foreach (TaskApiCapability::cases() as $capability) {
+            self::assertSame(in_array($capability, $allowed, true), $capability->allows($level), $level->value . ' ' . $capability->name);
+        }
+    }
+
+    public function testWhereEverythingLeavesOutOnlyWhatTheHostRemoves(): void
+    {
+        $where = TaskApiWhere::everything(['forbidden']);
+
+        self::assertTrue($where->reachesBoard($this->board('open')));
+        self::assertTrue($where->reachesBoard($this->board(null)));
+        self::assertFalse($where->reachesBoard($this->board('forbidden')));
+        self::assertTrue($where->reachesTenant(null));
+        self::assertFalse($where->reachesTenant('forbidden'));
+        self::assertTrue($where->touchesTenant('open', []));
+        self::assertFalse($where->touchesTenant('forbidden', ['any-board']));
+    }
+
+    public function testWhereLimitedReachesOnlyWhatItNames(): void
+    {
+        $named = $this->board('other');
+        $where = TaskApiWhere::limitedTo(['tenant'], [$named->getId()]);
+
+        self::assertTrue($where->reachesBoard($this->board('tenant')));
+        self::assertTrue($where->reachesBoard($named));
+        self::assertFalse($where->reachesBoard($this->board('other')));
+        self::assertFalse($where->reachesBoard($this->board(null)));
+        self::assertTrue($where->reachesTenant('tenant'));
+        self::assertFalse($where->reachesTenant('other'), 'one board of it does not reach the whole tenant');
+        self::assertFalse($where->reachesTenant(null));
+        self::assertTrue($where->touchesTenant('tenant', []));
+        self::assertTrue($where->touchesTenant('other', ['unrelated', $named->getId()]));
+        self::assertFalse($where->touchesTenant('other', ['unrelated']));
+        self::assertFalse(TaskApiWhere::limitedTo([], [])->reachesBoard($named));
+    }
+
+    public function testTheCredentialIsTheHeaderAndNothingElse(): void
+    {
+        self::assertSame('bt_x', TaskApiCredential::fromRequest($this->withHeader('bt_x')));
+        self::assertSame('bt_x', TaskApiCredential::fromRequest($this->withHeader('Bearer bt_x')));
+        self::assertSame('bt_x', TaskApiCredential::fromRequest($this->withHeader('bearer   bt_x ')));
+        self::assertNull(TaskApiCredential::fromRequest($this->withHeader('Bearer ')));
+        self::assertNull(TaskApiCredential::fromRequest($this->withHeader('')));
+        self::assertNull(TaskApiCredential::fromRequest(Request::create('/?token=bt_x&access_token=bt_x&Authorization=bt_x')));
+    }
+
+    public function testEveryDefaultDenies(): void
+    {
+        $principal = new TaskApiPrincipal(new stdClass(), TaskApiLevel::Full, TaskApiWhere::everything(), 'id', 'name');
+
+        $limiter = new DenyingTaskApiRateLimiter();
+        self::assertFalse($limiter->consume($principal)->accepted);
+        self::assertFalse($limiter->failedTokenState('127.0.0.1')->accepted);
+        $limiter->registerFailedToken('127.0.0.1');
+
+        self::assertFalse((new DenyingTaskApiPlanGate())->allowsTasks(new stdClass(), null));
+        self::assertFalse((new DenyingTaskApiPlanGate())->allowsTasks(new stdClass(), 'tenant'));
+
+        $workspace = new EmptyTaskApiWorkspace();
+        self::assertSame([], $workspace->teams($principal));
+        self::assertSame([], $workspace->spaces($principal, 'team'));
+        self::assertNull($workspace->space($principal, 'space'));
+        self::assertNull($workspace->spaceOfTenant($principal, 'tenant'));
+
+        $users = new EmptyTaskApiUsers();
+        self::assertNull($users->find('id'));
+        self::assertSame([], $users->profiles([new stdClass()], $principal));
+        $this->assertRefused(404, 'ACCESS_001', static fn () => $users->apiId(new stdClass()));
+
+        $time = new DenyingTaskApiTimeEntries();
+        $this->assertRefused(403, 'TIME_001', static fn () => $time->list($principal, new TaskApiTimeQuery('team')));
+        $this->assertRefused(403, 'TIME_001', static fn () => $time->log($principal, null, new TaskApiNewTimeEntry('team', new DateTimeImmutable(), 60)));
+
+        $board = new TaskBoard('Board', 'board', null);
+        $file  = new UploadedFile(__FILE__, 'a.txt', null, null, true);
+        $this->assertRefused(403, 'FILE_001', static fn () => (new DenyingTaskApiAttachments())->store($principal, new Task(board: $board, title: 'T', creator: null), $file));
+    }
+
+    public function testTheTimeHookHasNoDelete(): void
+    {
+        self::assertFalse((new ReflectionClass(TaskApiTimeEntriesInterface::class))->hasMethod('delete'), 'owner: tracked time is never deleted through the API');
+    }
+
+    public function testValuesCarryWhatTheyAreGiven(): void
+    {
+        $start = new DateTimeImmutable('2026-11-07');
+        $entry = new TaskApiTimeEntry('id', 'user', $start, 60, 'task', 'note');
+        self::assertSame([$entry], (new TaskApiTimePage([$entry]))->entries);
+        self::assertSame('https://example.com/f', (new TaskApiAttachment('id', 'f', 'https://example.com/f', 3))->url);
+        $claim = new TaskApiIdempotencyClaim(TaskApiIdempotencyOutcome::Completed, 200, '{}', 'tenant', 'board');
+        self::assertSame(200, $claim->status);
+
+        $principal = new TaskApiPrincipal(new stdClass(), TaskApiLevel::Tasks, TaskApiWhere::everything(), 'id', 'name');
+        $event     = new TaskApiWriteEvent($principal, 'task.update', 'tenant', 'board', 'task', ['other' => 'x'], ['name']);
+        self::assertSame(['name'], $event->changedFields);
+    }
+
+    public function testAFilterValueOfTheWrongTypeIsRefused(): void
+    {
+        $this->assertRefused(400, 'INPUT_002', static fn () => TaskApiTaskFilter::fromQuery(['statuses' => 5]));
+        self::assertSame(['open'], TaskApiTaskFilter::fromQuery(['statuses' => 'Open'])->statuses);
+    }
+
+    public function testTheIdempotencyRowHoldsHashesAndTheAnswer(): void
+    {
+        $row = new TaskApiIdempotencyRecord('scope-hash', 'key-hash', 'fp', new DateTimeImmutable('@1'), new DateTimeImmutable('@86401'), 200, '{}', 'tenant', 'board');
+
+        self::assertSame(['scope-hash', 'key-hash', 200, 'board'], [$row->scope, $row->keyHash, $row->status, $row->boardId]);
+    }
+
+    public function testAControllerOutsideThePipelineHasNoPrincipal(): void
+    {
+        $this->expectException(LogicException::class);
+        TaskApiRequestListener::principalOf(Request::create('/'));
+    }
+
+    private function board(?string $tenantKey): TaskBoard
+    {
+        $board = new TaskBoard('Board', 'board', null);
+        $board->setTenantKey($tenantKey);
+
+        return $board;
+    }
+
+    private function withHeader(string $value): Request
+    {
+        $request = Request::create('/');
+        $request->headers->set('Authorization', $value);
+
+        return $request;
+    }
+
+    private function assertRefused(int $status, string $ecode, callable $call): void
+    {
+        try {
+            $call();
+            self::fail('TaskApiRefusal expected');
+        } catch (TaskApiRefusal $refusal) {
+            self::assertSame([$status, $ecode], [$refusal->status, $refusal->ecode]);
+        }
+    }
+}
diff --git a/tests/Unit/Controller/TaskBoardManageControllerSignatureTest.php b/tests/Unit/Controller/TaskBoardManageControllerSignatureTest.php
new file mode 100644
index 00000000..e1b06b0e
--- /dev/null
+++ b/tests/Unit/Controller/TaskBoardManageControllerSignatureTest.php
@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Unit\Controller;
+
+use Nowo\TaskBoardBundle\Controller\TaskBoardManageController;
+use PHPUnit\Framework\TestCase;
+use ReflectionMethod;
+use ReflectionParameter;
+
+use function array_map;
+use function array_slice;
+use function count;
+
+/**
+ * Audit IA-I1: a minor release keeps the controller's constructor as 2.1 had it, so a host passing arguments by position
+ * or by name is not broken. New arguments go at the end.
+ */
+final class TaskBoardManageControllerSignatureTest extends TestCase
+{
+    /** The constructor of 2.1.0, in order. */
+    private const SINCE_2_1 = [
+        'accessChecker', 'boardRepository', 'taskRepository', 'boardCreator', 'columnManager', 'taskManager', 'linkAttacher',
+        'memberAssigner', 'ganttBuilder', 'importOrchestrator', 'translator', 'routes', 'templates', 'userClass', 'dashboardRoute',
+        'resourceAccessChecker', 'tenantContext', 'topLevelOnly', 'columnSetManager', 'columnIcons', 'dependencyManager',
+        'timeLogger', 'weekStartResolver', 'commentManager', 'commentRepository', 'mentionCandidates', 'readersCanComment',
+        'maxTasks', 'clock', 'logger', 'avatars', 'defaultViewResolver', 'createDialogHeader', 'syncLimits', 'scopeProvider',
+        'boardFormOptions', 'quota', 'openSingleBoard', 'firstBoardProvisioner', 'pages', 'taskNumbers', 'taskNumberScope',
+        'calendarBuilder', 'calendarEnabled',
+    ];
+
+    public function testTheConstructorKeepsEveryArgumentOf21InItsPlace(): void
+    {
+        $names = array_map(static fn (ReflectionParameter $parameter): string => $parameter->getName(), (new ReflectionMethod(TaskBoardManageController::class, '__construct'))->getParameters());
+
+        self::assertSame(self::SINCE_2_1, array_slice($names, 0, count(self::SINCE_2_1)));
+    }
+}
diff --git a/tests/Unit/Validation/TaskConstraintsTest.php b/tests/Unit/Validation/TaskConstraintsTest.php
new file mode 100644
index 00000000..68c1d4b6
--- /dev/null
+++ b/tests/Unit/Validation/TaskConstraintsTest.php
@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Unit\Validation;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\Validation;
+
+use function str_repeat;
+
+/**
+ * Since 2.2.0 (spec 213): the rules outside a form refuse what the forms refuse.
+ */
+final class TaskConstraintsTest extends TestCase
+{
+    /**
+     * @return iterable<string, array{0: list<Constraint>, 1: mixed, 2: bool}>
+     */
+    public static function values(): iterable
+    {
+        yield 'title' => [TaskConstraints::taskTitle(), 'Write the spec', true];
+        yield 'title empty' => [TaskConstraints::taskTitle(), '', false];
+        yield 'title too long' => [TaskConstraints::taskTitle(), str_repeat('x', 256), false];
+        yield 'task colour' => [TaskConstraints::taskColor(), '#a1b2c3', true];
+        yield 'task colour short form' => [TaskConstraints::taskColor(), '#abc', false];
+        yield 'task colour breaking out' => [TaskConstraints::taskColor(), '#a1b2c3;x:y', false];
+        yield 'board name' => [TaskConstraints::boardName(), 'Roadmap', true];
+        yield 'board name empty' => [TaskConstraints::boardName(), '', false];
+        yield 'board slug too long' => [TaskConstraints::boardSlug(), str_repeat('x', 256), false];
+        yield 'icon' => [TaskConstraints::boardIcon('long', 'invalid'), "\u{1F680}", true];
+        yield 'icon text' => [TaskConstraints::boardIcon('long', 'invalid'), 'rocket', false];
+        yield 'column name' => [TaskConstraints::columnName(), 'Review', true];
+        yield 'column name too long' => [TaskConstraints::columnName(), str_repeat('x', 129), false];
+        yield 'column colour' => [TaskConstraints::columnColor(), '#abc', true];
+        yield 'column colour script' => [TaskConstraints::columnColor(), 'red;background:url(x)', false];
+        yield 'comment' => [TaskConstraints::commentBody(), 'Hello', true];
+        yield 'comment too long' => [TaskConstraints::commentBody(), str_repeat('x', TaskComment::MAX_LENGTH + 1), false];
+        yield 'minutes' => [TaskConstraints::timeMinutes(), 45, true];
+        yield 'minutes zero' => [TaskConstraints::timeMinutes(), 0, false];
+        yield 'minutes over a week' => [TaskConstraints::timeMinutes(), TaskConstraints::MAX_MINUTES + 1, false];
+        yield 'minutes missing' => [TaskConstraints::timeMinutes(), null, false];
+        yield 'logged at missing' => [TaskConstraints::timeLoggedAt(), null, false];
+        yield 'note too long' => [TaskConstraints::timeNote(), str_repeat('x', 513), false];
+        yield 'link' => [TaskConstraints::linkUrl(), 'https://example.com/spec', true];
+        yield 'link without a tld' => [TaskConstraints::linkUrl(), 'http://intranet/spec', true];
+        yield 'link javascript' => [TaskConstraints::linkUrl(), 'javascript:alert(1)', false];
+        yield 'link data' => [TaskConstraints::linkUrl(), 'data:text/html,x', false];
+        yield 'link label too long' => [TaskConstraints::linkLabel(), str_repeat('x', 256), false];
+        yield 'link external id too long' => [TaskConstraints::linkExternalId(), str_repeat('x', 129), false];
+    }
+
+    /**
+     * @param list<Constraint> $constraints
+     */
+    #[DataProvider('values')]
+    public function testARuleAcceptsOrRefuses(array $constraints, mixed $value, bool $valid): void
+    {
+        $violations = Validation::createValidator()->validate($value, $constraints);
+
+        self::assertSame($valid, $violations->count() === 0);
+    }
+
+    public function testAStartAfterTheDueDateIsTheOnlyDateError(): void
+    {
+        $early = new DateTimeImmutable('2026-11-06');
+        $late  = new DateTimeImmutable('2026-11-07');
+
+        self::assertTrue(TaskConstraints::startsAfterDue($late, $early));
+        self::assertFalse(TaskConstraints::startsAfterDue($early, $late));
+        self::assertFalse(TaskConstraints::startsAfterDue($early, $early));
+        self::assertFalse(TaskConstraints::startsAfterDue(null, $early));
+        self::assertFalse(TaskConstraints::startsAfterDue($early, null));
+    }
+}