diff --git a/.github/actions/cache/action.yml b/.github/actions/cache/action.yml
new file mode 100644
index 00000000..16fdfa7a
--- /dev/null
+++ b/.github/actions/cache/action.yml
@@ -0,0 +1,18 @@
+name: cache
+runs:
+  using: "composite"
+  steps:
+    - run: |
+        case ${{ runner.os }} in
+        macOS)
+          echo "path=$HOME/Library/Caches/deno/deps" >> $GITHUB_OUTPUT;;
+        *)
+          echo "path=$HOME/.cache/deno" >> $GITHUB_OUTPUT;;
+        esac
+      id: cache
+      shell: bash
+    - uses: actions/cache@v3
+      with:
+        path: ${{ steps.cache.outputs.path }}
+        restore-keys: ${{ runner.os }}-deno-
+        key: ${{ runner.os }}-deno-${{ hashFiles('deno.jsonc')}}
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 25205b98..56d55a5c 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -6,7 +6,6 @@ on:
       - main
     paths:
       - README.md
-      - .github/workflows/cd.yml
   workflow_dispatch:
 
 concurrency:
@@ -16,21 +15,20 @@ concurrency:
 jobs:
   check:
     permissions:
-      contents: read
       actions: write  # for cancel-action
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.tea.outputs.version }}
-      commence: ${{ steps.rev-parse.outputs.result == 'commence' }}
     steps:
       - uses: actions/checkout@v3
-
       - uses: teaxyz/setup@v0
         id: tea
 
-      - name: sanity
-        run: test -n "${{ steps.tea.outputs.version }}"
-        # check we’re not broken ^^
+      - name: sanity check
+        run: |
+          test -n "$(echo ${{ steps.tea.outputs.version }} | cut -f1 -d.)"
+          test -n "$(echo ${{ steps.tea.outputs.version }} | cut -f2 -d.)"
+          test -n "$(echo ${{ steps.tea.outputs.version }} | cut -f3 -d.)"
 
       - id: rev-parse
         name: did we already publish this version?
@@ -77,24 +75,17 @@ jobs:
     steps:
       - uses: actions/download-artifact@v3
         with:
-          name: tarballs
-          path: artifacts
-      - run: tar xJvf artifacts/tea-${{ needs.check.outputs.version }}.tar.xz --strip-components=1
-      - run: ls -la
+          name: srcs
+      - run: tar xJf tea-${{ needs.check.outputs.version }}.tar.xz --strip-components=1
+      - uses: ./.github/actions/cache  # avoids sporadic 500s from deno’s CDN
       - uses: teaxyz/setup@v0
       - run: deno task compile
       - run: test "$(./tea --version)" = "tea ${{ needs.check.outputs.version }}"
-      - run: tar cJf tea-${{ needs.check.outputs.version }}+${{ matrix.platform.build-id }}.tar.xz ./tea
-      - uses: actions/upload-artifact@v3
-        with:
-          name: tarballs
-          path: tea-${{ needs.check.outputs.version }}+${{ matrix.platform.build-id }}.tar.xz
-          if-no-files-found: error
-      - run: mv ./tea tea-${{ matrix.platform.build-id }}
+      - run: tar cJf tea-${{ needs.check.outputs.version }}+${{ matrix.platform.build-id }}.tar.xz tea
       - uses: actions/upload-artifact@v3
         with:
           name: binaries
-          path: tea-${{ matrix.platform.build-id }}
+          path: tea-${{ needs.check.outputs.version }}+${{ matrix.platform.build-id }}.tar.xz
           if-no-files-found: error
 
   bundle-src:
@@ -106,12 +97,15 @@ jobs:
       - uses: actions/checkout@v3
         with:
           path: ${{ env.FILENAME }}
-      - run: rm -rf ${{ env.FILENAME }}/.github .gitpod.yml
-      - run: echo "export default function() { return '${{ needs.check.outputs.version }}' }" > $FILENAME/src/hooks/useVersion.ts
+      #TODO restore this, but you’ll need to fix the use of action/cache above
+      # - name: Clean
+      #   run: rm -rf ${{ env.FILENAME }}/.github .gitpod.yml
+      - name: Stamp Version
+        run: echo "export default function() { return '${{ needs.check.outputs.version }}' }" > $FILENAME/src/hooks/useVersion.ts
       - run: tar cJf $FILENAME.tar.xz $FILENAME
       - uses: actions/upload-artifact@v3
         with:
-          name: tarballs
+          name: srcs
           path: ${{ env.FILENAME }}.tar.xz
           if-no-files-found: error
 
@@ -122,23 +116,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-
       - uses: actions/download-artifact@v3
-        with:
-          name: tarballs
-          path: artifacts
-
-      # says `no changes` every time… 🤦🏼
-      # - uses: mikepenz/release-changelog-builder-action@v3
-      #   id: build_changelog
-      #   env:
-      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
       - uses: softprops/action-gh-release@v1
         with:
           tag_name: v${{ needs.check.outputs.version }}
-          files: artifacts/*
-        # body: ${{ steps.build_changelog.outputs.changelog }}
+          files: |
+            binaries/*
+            srcs/*
           fail_on_unmatched_files: true
 
   bump-tap:
@@ -161,22 +145,33 @@ jobs:
         with:
           name: binaries
           path: binaries
-      - name: AWS credentials
-        uses: aws-actions/configure-aws-credentials@v1
+
+      - uses: aws-actions/configure-aws-credentials@v1
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: us-east-1
-      - name: Upload to S3
+
+      - name: Unpack Binaries
+        working-directory: binaries
         run: |
-          aws s3 sync binaries s3://www.tea.xyz/ \
-            --metadata-directive REPLACE \
+          for filename in *.tar.xz; do
+            tar xJf $filename
+            result="${filename#*+}"
+            result="${filename%.tar.xz}"
+            mv tea ../tea-$result
+          done
+
+      - name: Upload to S3
+        run:
+          aws s3 sync tea-* s3://www.tea.xyz/
+            --metadata-directive REPLACE
             --cache-control no-cache,must-revalidate
-      - run: find binaries -type f | sed 's/^binaries//'
-      - name: Invalidate cache
+
+      - name: Invalidate CloudFront
         run:
-          find binaries -type f |
-          sed 's/^binaries//' |
+          find . -name tea-\* |
+          sed 's/^.//' |
           xargs
           aws cloudfront create-invalidation
             --distribution-id ${{ secrets.AWS_CF_DISTRIBUTION_ID }}
@@ -195,7 +190,7 @@ jobs:
         wait-for-completion: false
 
   vx-tagger:
-    needs: [upload-binaries]
+    needs: [upload-binaries, check]
     runs-on: ubuntu-latest
     permissions:
       contents: write
diff --git a/.github/workflows/ci.md.yml b/.github/workflows/ci.md.yml
index ed3237bb..8328b97e 100644
--- a/.github/workflows/ci.md.yml
+++ b/.github/workflows/ci.md.yml
@@ -1,4 +1,4 @@
-name: CI
+name: CI·markdown-lint
 
 on:
   pull_request:
diff --git a/.github/workflows/ci.sync.yml b/.github/workflows/ci.sync.yml
new file mode 100644
index 00000000..53b55d5f
--- /dev/null
+++ b/.github/workflows/ci.sync.yml
@@ -0,0 +1,52 @@
+name: CI·sync
+
+on:
+  pull_request:
+    paths:
+      - import-map.json
+      - src/hooks/app.sync.ts
+      - src/hooks/useSync.ts
+      - .github/workflows/ci.sync.yml
+
+concurrency:
+  group: ${{ github.ref }}/sync
+  cancel-in-progress: true
+
+jobs:
+  # in situations without `git` we had a softlock problem that we're testing for here
+  test-sync-lock:
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          - runner: ubuntu-latest
+          - runner: macos-latest
+          - runner: ubuntu-latest
+            container: debian:buster-slim
+          - runner: ubuntu-latest
+            container: archlinux:latest
+    container: ${{ matrix.platform.container }}
+    name: test sync-lock (${{ matrix.platform.container || matrix.platform.runner }})
+    steps:
+      # denoland/setup requires `unzip` to be installed
+      # https://github.com/denoland/setup-deno/issues/41
+      - name: ensure `unzip`
+        run: |
+          case "${{ matrix.platform.container }}" in
+          debian:buster-slim)
+            apt-get update && apt-get install unzip;;
+          archlinux:latest)
+            pacman -Sy --noconfirm unzip;;
+          esac
+
+      - uses: actions/checkout@v3
+      - uses: ./.github/actions/cache  # avoids sporadic 500s from deno’s CDN
+      - uses: denoland/setup-deno@v1
+
+      - run: deno task --config $GITHUB_WORKSPACE/deno.jsonc compile
+        working-directory: /usr/local/bin
+
+      - run: tea -S +gnu.org/wget wget -L tea.xyz/white-paper/ | tea -S +charm.sh/glow glow -
+
+      # run again to test this work in the “update” scenario
+      - run: tea -S +gnu.org/wget wget -L tea.xyz/white-paper/ | tea -S +charm.sh/glow glow -
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f6ee1c44..f8434461 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,8 @@ jobs:
           - ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: denoland/setup-deno@v1  # using ourself to install deno could compromise the tests
+      - uses: ./.github/actions/cache  # avoids sporadic 500s from deno’s CDN
+      - uses: denoland/setup-deno@v1   # using ourself to install deno could compromise the tests
       - run: deno task test
 
   lint:
@@ -32,47 +33,12 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - uses: teaxyz/setup@v0
-      - run: tea deno lint src/*/**.ts
+      - run: deno lint src/*/**.ts
 
   typecheck:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+      - uses: ./.github/actions/cache  # avoids sporadic 500s from deno’s CDN
       - uses: teaxyz/setup@v0
-      - run: tea deno task typecheck
-
-  # in situations without `git` we had a softlock problem that we're testing for here
-  test-sync-lock:
-    runs-on: ${{ matrix.platform.runner }}
-    strategy:
-      matrix:
-        platform:
-          - runner: ubuntu-latest
-          - runner: macos-latest
-          - runner: ubuntu-latest
-            container: debian:buster-slim
-          - runner: ubuntu-latest
-            container: archlinux:latest
-    container: ${{ matrix.platform.container }}
-    name: test sync-lock (${{ matrix.platform.container || matrix.platform.runner }})
-    steps:
-      # denoland/setup requires `unzip` to be installed
-      # https://github.com/denoland/setup-deno/issues/41
-      - name: ensure `unzip`
-        run: |
-          case "${{ matrix.platform.container }}" in
-          debian:buster-slim)
-            apt-get update && apt-get install unzip;;
-          archlinux:latest)
-            pacman -Sy --noconfirm unzip;;
-          esac
-
-      - uses: actions/checkout@v3
-      - uses: denoland/setup-deno@v1
-      - run: deno task --config $GITHUB_WORKSPACE/deno.jsonc compile
-        working-directory: /usr/local/bin
-
-      - run: tea -S +gnu.org/wget wget -L tea.xyz/white-paper/ | tea -S +charm.sh/glow glow -
-
-      # run again to test this work in the “update” scenario
-      - run: tea -S +gnu.org/wget wget -L tea.xyz/white-paper/ | tea -S +charm.sh/glow glow -
+      - run: deno task typecheck
diff --git a/.github/workflows/retagger.yml b/.github/workflows/retagger.yml
index 1c321ea9..275389cd 100644
--- a/.github/workflows/retagger.yml
+++ b/.github/workflows/retagger.yml
@@ -1,6 +1,7 @@
 on:
   release:
     types:
+      - created
       - edited
 permissions:
   actions: write