@@ -11,7 +11,7 @@
 import threading
 import time
 
-from gcm import icons, inventory, store
+from gcm import icons, inventory, state, store
 
 
 class CommandQueue:
@@ -196,6 +196,19 @@ def _expire_craft_request(req_id, reason):
     store.stock.record_auto_result(req_id, "failed", reason)
 
 
+def craft_request_error(label, internal, amount, kind, variant):
+    """Why a craft request can't be queued as given, or None."""
+    if not label or not internal:
+        return "missing label/internal"
+    if isinstance(amount, bool) or not isinstance(amount, (int, float)) or amount <= 0:
+        return "amount must be a positive number"
+    if kind not in ("item", "fluid"):
+        return "kind must be item or fluid"
+    if variant is not None and not isinstance(variant, str):
+        return "variant must be a string"
+    return None
+
+
 def queue_craft(user_id, label, mod, internal, damage, amount, kind, variant=None,
                 variant_name=None, source="manual", target_key=None):
     """Queues a craft request for craft_monitor.lua and writes its history
@@ -260,6 +273,73 @@ def queue_craft(user_id, label, mod, internal, damage, amount, kind, variant=Non
 )
 
 
+def output_identity(job):
+    """{mod, internal, damage} of what the job on this CPU is making, the
+    form craft_monitor.lua compares against the CPU's finalOutput() - or
+    None when that isn't reported."""
+    if not job.get("final_output_internal"):
+        return None
+    return {
+        "mod": job.get("final_output_mod"),
+        "internal": job.get("final_output_internal"),
+        "damage": job.get("final_output_damage"),
+    }
+
+
+def same_output(a, b):
+    """Whether two output identities name the same item."""
+    return all(a.get(key) == b.get(key) for key in ("mod", "internal", "damage"))
+
+
+def request_cancel(user_id, cpu_name, shown_output=None):
+    """Queues cancelling the job on a busy CPU. Returns (id, None), or
+    (None, (error message, HTTP status)) when it can't be cancelled.
+    shown_output is what the user saw the job making (output_identity's
+    form), if known: when the CPU has moved on to another job since, the
+    one they meant to cancel is gone, and nothing is queued."""
+    if not cpu_name:
+        return None, ("missing cpu_name", 400)
+
+    # Can only cancel a CPU that's actually busy right now - same
+    # reasoning as craft-request's own "only a busy CPU can be pinned"
+    # check, and it doesn't make sense to queue a cancel for something
+    # with nothing running on it.
+    with state.crafts_lock:
+        jobs = state.crafts.get("jobs", [])
+    job = next((j for j in jobs if j.get("name") == cpu_name), None)
+    if job is None:
+        return None, ("unknown cpu_name", 404)
+    if not job.get("busy"):
+        return None, ("CPU is not currently busy - nothing to cancel", 400)
+
+    # A CPU runs one job after another, so the cancel names the job too:
+    # what it's making, as the user saw it and as the latest status
+    # report has it. If those already differ, the job the user meant to
+    # cancel is gone. Lua checks it once more against the CPU itself
+    # right before cancelling. None when the CPU has no Crafting Monitor
+    # to report its output - then only the CPU name is known.
+    expected_output = output_identity(job)
+    if isinstance(shown_output, dict) and expected_output and not same_output(expected_output, shown_output):
+        return None, ("a different job is now running on this CPU - not cancelled", 409)
+
+    created_at = time.time()
+    req_id = cancel_requests.add(
+        {
+            "user_id": user_id,
+            "cpu_name": cpu_name,
+            "expected_output": expected_output,
+            # status: pending -> resolved
+            "success": None,
+            "reason": None,
+            "created_at": created_at,
+        },
+        lambda req_id: store.requests.record_cancel(
+            req_id, user_id, cpu_name, created_at, job.get("final_output"), job.get("final_output_icon")
+        ),
+    )
+    return req_id, None
+
+
 def reset():
     craft_requests.reset()
     cancel_requests.reset()
@@ -578,6 +578,16 @@ def _mark_missing(root, items):
             node["missing_below"] = below
 
 
+def rules_for_user(user_id):
+    """The stock rules a plan for this user warns about taking an item
+    below, as plan()'s rules: the user's own alerts and the base's
+    enabled keep-in-stock targets."""
+    rules = [(a["key"], a["below"], "below your alert") for a in store.stock.alerts_for_user(user_id)]
+    rules += [(t["key"], t["keep_at_least"], "below its keep-at-least target")
+              for t in store.stock.targets() if t["enabled"]]
+    return rules
+
+
 def cached_plan(patterns, stock, stock_version, key, amount, choices=None, rules=None, describe=None):
     """plan(), reusing one of the last few if nothing it depends on has
     changed: the pattern list, the stock (stock_version says when it
 
@@ -8,11 +8,10 @@
     submitting or cancelling a craft additionally requires the
     operator or admin role."""
 
-import time
 
 from flask import Blueprint, g, jsonify, request
 
-from gcm import auth, commands, state, stock, store, tracking
+from gcm import auth, commands, stock, store, tracking
 
 
 bp = Blueprint("craft_requests", __name__)
@@ -34,15 +33,9 @@ def craft_request_post():
     variant = payload.get("variant") or None
     variant_name = payload.get("variant_name") or None
 
-    if not label or not internal:
-        return jsonify({"error": "missing label/internal"}), 400
-    if not isinstance(amount, (int, float)) or amount <= 0:
-        return jsonify({"error": "amount must be a positive number"}), 400
-    if kind not in ("item", "fluid"):
-        return jsonify({"error": "kind must be item or fluid"}), 400
-
-    if variant is not None and not isinstance(variant, str):
-        return jsonify({"error": "variant must be a string"}), 400
+    error = commands.craft_request_error(label, internal, amount, kind, variant)
+    if error:
+        return jsonify({"error": error}), 400
 
     req_id = commands.queue_craft(
         user_id, label, mod, internal, damage, amount, kind, variant, variant_name
@@ -145,50 +138,10 @@ def craft_cancel_post():
     user_id = g.user["id"]
 
     payload = request.get_json(silent=True) or {}
-    cpu_name = payload.get("cpu_name")
-    if not cpu_name:
-        return jsonify({"error": "missing cpu_name"}), 400
-
-    # Can only cancel a CPU that's actually busy right now - same
-    # reasoning as craft-request's own "only a busy CPU can be pinned"
-    # check, and it doesn't make sense to queue a cancel for something
-    # with nothing running on it.
-    with state.crafts_lock:
-        jobs = state.crafts.get("jobs", [])
-    job = next((j for j in jobs if j.get("name") == cpu_name), None)
-    if job is None:
-        return jsonify({"error": "unknown cpu_name"}), 404
-    if not job.get("busy"):
-        return jsonify({"error": "CPU is not currently busy - nothing to cancel"}), 400
-
-    # A CPU runs one job after another, so the cancel names the job too:
-    # what it's making, as the browser showed it and as the latest status
-    # report has it. If those already differ, the job the user meant to
-    # cancel is gone. Lua checks it once more against the CPU itself
-    # right before cancelling. None when the CPU has no Crafting Monitor
-    # to report its output - then only the CPU name is known.
-    expected_output = tracking.output_identity(job)
-    shown = payload.get("expected_output")
-    if isinstance(shown, dict) and expected_output and not tracking.same_output(
-        expected_output, shown
-    ):
-        return jsonify({"error": "a different job is now running on this CPU - not cancelled"}), 409
-
-    created_at = time.time()
-    req_id = commands.cancel_requests.add(
-        {
-            "user_id": user_id,
-            "cpu_name": cpu_name,
-            "expected_output": expected_output,
-            # status: pending -> resolved
-            "success": None,
-            "reason": None,
-            "created_at": created_at,
-        },
-        lambda req_id: store.requests.record_cancel(
-            req_id, user_id, cpu_name, created_at, job.get("final_output"), job.get("final_output_icon")
-        ),
-    )
+    req_id, error = commands.request_cancel(user_id, payload.get("cpu_name"), payload.get("expected_output"))
+    if error:
+        message, status = error
+        return jsonify({"error": message}), status
     return jsonify({"ok": True, "id": req_id})
 
 
 
@@ -470,10 +470,7 @@ def network_plan_get():
     if (path is not None or reveal) and request.args.get("version") != version:
         return jsonify({"stale": True})
 
-    user_id = g.user["id"]
-    rules = [(a["key"], a["below"], "below your alert") for a in store.stock.alerts_for_user(user_id)]
-    rules += [(t["key"], t["keep_at_least"], "below its keep-at-least target")
-              for t in store.stock.targets() if t["enabled"]]
+    rules = planner.rules_for_user(g.user["id"])
     result = planner.cached_plan(pattern_list, stock_levels, stock_version, key, amount, choices, rules,
                                  describe=inventory.describe)
     if result is None:
 
@@ -4,135 +4,38 @@
 
 from flask import Blueprint, g, jsonify, request
 
-from gcm import auth, state, stock, store
+from gcm import auth, stock, store
 
 
 bp = Blueprint("stock", __name__)
 
 
-def _item_from(payload):
-    """The item a rule is about, from a request body, or an error
-    message."""
-    item = {
-        "label": payload.get("label"),
-        "mod": payload.get("mod") or None,
-        "internal": payload.get("internal"),
-        "damage": payload.get("damage"),
-        "kind": payload.get("kind") or "item",
-        "variant": payload.get("variant") or None,
-    }
-    if not item["label"] or not item["internal"]:
-        return None, "missing label/internal"
-    if item["kind"] not in ("item", "fluid", "essentia"):
-        return None, "kind must be item, fluid or essentia"
-    if item["damage"] is not None and (isinstance(item["damage"], bool) or not isinstance(item["damage"], int)):
-        return None, "damage must be a whole number"
-    if item["variant"] is not None and not isinstance(item["variant"], str):
-        return None, "variant must be a string"
-    return item, None
-
-
-def _key(item):
-    return store.items.item_key(item["mod"], item["internal"], item["damage"], item["kind"], item["variant"])
-
-
-def _positive(value):
-    return not isinstance(value, bool) and isinstance(value, (int, float)) and value > 0
-
-
-def _network_item(key):
-    with state.network_lock:
-        return next((it for it in state.network["items"] if store.items.key_of(it) == key), None)
-
-
 @bp.route("/api/stock/rules", methods=["GET"])
 @auth.viewer_required
 def stock_rules_get():
     """Every keep-in-stock target, and the signed-in user's own alerts,
     each with the item's amount in the latest scan (null before any)."""
-    with state.network_lock:
-        items = state.network["items"]
-        scanned = state.network["updated_at"] is not None or bool(items)
-    sizes = stock.current_sizes(items)
-    names = stock.variant_names(items)
-    with state.crafts_lock:
-        jobs = list(state.crafts["jobs"])
-    pending = stock.pending_auto_requests()
-
-    def with_item(rule):
-        current = sizes.get(rule["key"], 0) if scanned else None
-        return {
-            "key": rule["key"],
-            "label": rule["label"],
-            "mod": rule["mod"],
-            "internal": rule["internal"],
-            "damage": rule["damage"],
-            "kind": rule["kind"],
-            "variant": rule["variant"],
-            "icon": stock.rule_icon(rule, names),
-            "current": current,
-        }
-
-    targets = []
-    for t in store.stock.targets():
-        row = with_item(t)
-        low = row["current"] is not None and row["current"] < t["keep_at_least"]
-        # Only while low: a CPU making the item for some other reason
-        # isn't this target's doing.
-        cpu = stock.busy_cpu_making(t, jobs) if low else None
-        if t["key"] in pending:
-            status = "requested"
-        elif cpu:
-            status = "crafting"
-        elif not t["enabled"]:
-            status = "off"
-        elif low and t["last_status"] in ("failed", "waiting"):
-            status = t["last_status"]
-        else:
-            status = "low" if low else "ok"
-        targets.append({
-            **row,
-            "keep_at_least": t["keep_at_least"],
-            "refill_to": t["refill_to"],
-            "enabled": t["enabled"],
-            "status": status,
-            "reason": t["last_reason"] if status in ("failed", "waiting") else None,
-            "cpu": cpu,
-            "last_requested_at": t["last_requested_at"],
-            "last_status": t["last_status"],
-            "last_reason": t["last_reason"],
-        })
-
-    alerts = []
-    user = auth.session_user()
-    if user:
-        for a in store.stock.alerts_for_user(user["id"]):
-            row = with_item(a)
-            alerts.append({**row, "below": a["below"], "low": row["current"] is not None and row["current"] < a["below"]})
-    return jsonify({"targets": targets, "alerts": alerts})
+    return jsonify(stock.rules(auth.session_user()))
 
 
 @bp.route("/api/stock/alert", methods=["POST"])
 @auth.login_required
 def stock_alert_set():
     payload = request.get_json(silent=True) or {}
-    item, error = _item_from(payload)
+    item, error = stock.item_from(payload)
+    error = error or stock.set_alert(g.user["id"], item, payload.get("below"))
     if error:
         return jsonify({"error": error}), 400
-    below = payload.get("below")
-    if not _positive(below):
-        return jsonify({"error": "below must be a positive number"}), 400
-    store.stock.set_alert(g.user["id"], item, below)
     return jsonify({"ok": True})
 
 
 @bp.route("/api/stock/alert/delete", methods=["POST"])
 @auth.login_required
 def stock_alert_delete():
-    item, error = _item_from(request.get_json(silent=True) or {})
+    item, error = stock.item_from(request.get_json(silent=True) or {})
     if error:
         return jsonify({"error": error}), 400
-    store.stock.delete_alert(g.user["id"], _key(item))
+    store.stock.delete_alert(g.user["id"], stock.rule_key(item))
     return jsonify({"ok": True})
 
 
@@ -141,32 +44,21 @@ def stock_alert_delete():
 @auth.operator_required
 def stock_target_set():
     payload = request.get_json(silent=True) or {}
-    item, error = _item_from(payload)
+    item, error = stock.item_from(payload)
+    error = error or stock.set_target(
+        g.user["id"], item, payload.get("keep_at_least"), payload.get("refill_to"), payload.get("enabled", True)
+    )
     if error:
         return jsonify({"error": error}), 400
-    keep, refill = payload.get("keep_at_least"), payload.get("refill_to")
-    if not _positive(keep) or not _positive(refill):
-        return jsonify({"error": "keep_at_least and refill_to must be positive numbers"}), 400
-    if refill <= keep:
-        return jsonify({"error": "refill_to must be more than keep_at_least"}), 400
-    enabled = payload.get("enabled", True)
-    if not isinstance(enabled, bool):
-        return jsonify({"error": "enabled must be true or false"}), 400
-    # The game can only make what it has a pattern for, and the last
-    # scan is the only place that says.
-    network_item = _network_item(_key(item))
-    if not (network_item and network_item.get("isCraftable")):
-        return jsonify({"error": "only items the network can craft can be kept in stock"}), 400
-    store.stock.set_target(g.user["id"], item, keep, refill, enabled)
     return jsonify({"ok": True})
 
 
 @bp.route("/api/stock/target/delete", methods=["POST"])
 @auth.login_required
 @auth.operator_required
 def stock_target_delete():
-    item, error = _item_from(request.get_json(silent=True) or {})
+    item, error = stock.item_from(request.get_json(silent=True) or {})
     if error:
         return jsonify({"error": error}), 400
-    store.stock.delete_target(_key(item))
+    store.stock.delete_target(stock.rule_key(item))
     return jsonify({"ok": True})