diff --git a/CHANGELOG.md b/CHANGELOG.md
index c77f9bde..f2155d41 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,25 @@ and this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 
 ## [Unreleased]
 
+### Added
+
+- **Work orders can be made, changed and deleted:** `workorder.show`, `workorder.create`, `workorder.set` and
+  `workorder.delete`, light writes, audited. A new work order is `pending` and done once unless told otherwise;
+  `--due now` sets the do-it-now flag and no due date; times are taken as generalized time or ISO 8601; the repeat
+  interval is in minutes; a status a person sets is `pending` or `onhold`.
+- **`template.list` and `template.show`:** the notification templates the vault holds now, read-only: subject, body,
+  `$TOKEN$` markers, and whether DirXMLDev can read the body.
+- `Operate.Engine` has `add` and `delete` (default: refused), implemented for a vault.
+
+### Fixed
+
+- **`workorder.list` finds work orders where the Work Order driver keeps them.** It searched under the driver set,
+  but work orders live in the container the `idv.workorder.container` GCV names (a slash DN, now resolved a level at a
+  time, from the driver's own values, the GCV objects linked to it as NOVLWOBASE installs them, or the set's), or the Work
+  Order driver object, NetIQ's suggestion. `--base` still overrides.
+- A body or document that does not parse no longer prints `[Fatal Error]` to stderr; the failure is still reported
+  to the caller.
+
 ## [0.65.0] - 2026-11-03
 
 ### Fixed
diff --git a/docs/commands.md b/docs/commands.md
index 14a3686c..8858ef54 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -2006,7 +2006,7 @@ More: [console-gaps.md](console-gaps.md#13-as-built-l1-the-low-set).
 
 ### `workorder.list`
 
-The Work Order driver's `DirXML-WorkOrder` objects: status, due date, description, newest due date first. Read-only.
+The Work Order driver's `DirXML-WorkOrder` objects: status, due date ("now" when it is to be done at once), description, newest due date first. Read-only. Without `--base`, the container each Work Order driver uses: the `idv.workorder.container` GCV (the driver's own, a GCV object linked to it as NOVLWOBASE installs it, or the set's; a slash DN, found a level at a time), else the Work Order driver object itself, NetIQ's suggested container; with no Work Order driver, the driver set.
 
 ```
 bin/idm workorder.list --env <name> [--base <dn>] [--limit <n>] [--json]
@@ -2015,7 +2015,7 @@ bin/idm workorder.list --env <name> [--base <dn>] [--limit <n>] [--json]
 | Argument | Required | Values |
 |---|---|---|
 | `--env` | yes | an environment in `environments.properties` |
-| `--base` | no | the search base; default: the driver set |
+| `--base` | no | the search base; default: the Work Order container (above) |
 | `--limit` | no | the most objects listed; default: 200 |
 | `--json` | no | the result as JSON |
 
@@ -2025,6 +2025,133 @@ bin/idm workorder.list --env test
 
 More: [console-gaps.md](console-gaps.md#13-as-built-l1-the-low-set).
 
+### `workorder.show`
+
+One work order: every field, whether it is to be done now, and the driver's processing log. Read-only.
+
+```
+bin/idm workorder.show --env <name> --dn <work order> [--json]
+```
+
+| Argument | Required | Values |
+|---|---|---|
+| `--env` | yes | an environment in `environments.properties` |
+| `--dn` | yes | the work order |
+| `--json` | no | the result as JSON |
+
+```bash
+bin/idm workorder.show --env test --dn "cn=New hire jdoe,cn=Work Orders,cn=driverset1,o=system"
+```
+
+### `workorder.create`
+
+A new work order in the Work Order container (or `--container`), `pending` and done once unless the options say otherwise, as Identity Console makes one. Writes to the vault, as `vault.email-server set` does: `--confirm <env>` or `IDM_AGENT_ALLOW_WRITE=1`, `--yes` on a `stg` or `prd` tier, `--confirm <env>` on a `prd` tier. Audited.
+
+```
+bin/idm workorder.create --env <name> --name <name> [--container <dn>] [fields] [--yes] [--confirm <env>] [--json]
+```
+
+| Argument | Required | Values |
+|---|---|---|
+| `--env` | yes | an environment in `environments.properties` |
+| `--name` | yes | the work order's name |
+| `--container` | no | where it goes; default: the Work Order container, refused when there are several |
+| `--status` | no | `pending` (a new one's default) or `onhold`; the driver sets `configured` or `error` |
+| `--due` | no | when it is done: `now` (the do-it-now flag, no due date), or a time as `20261231235900Z`, `2026-12-31T23:59:00Z` or `2026-12-31` |
+| `--repeat-minutes` | no | repeat it every this many minutes; `0`, a new one's default, for once |
+| `--delete-date` | no | when the driver deletes it, a time as for `--due` |
+| `--delete-on-error` | no | `true` to delete it on the delete date even after an error |
+| `--dependent` | no | a work order it waits for; repeat for several |
+| `--type`, `--number`, `--contact`, `--description` | no | the work order's type (passed to the WorkToDo object), number, contact and description |
+| `--content`, `--content-file` | no | what the work order does, as text or from a file |
+
+```bash
+bin/idm workorder.create --env test --name "New hire jdoe" --due 2026-12-01T08:00:00Z --content-file jdoe.xml --confirm test
+```
+
+The Work Order driver polls its container and runs a work order when it is due: it adds a `DirXML-WorkToDo` object with
+the content, description, type and the work order's DN (NOVLWOBASE names it `DO-<work order>`, in the same container),
+then sets the status to `configured` (or `error`), adds a line to the log and writes the time it ran as the due date. One
+that repeats gets its next due date and stays `pending`. Under NOVLWOBASE a work order runs again only once whatever
+consumes its WorkToDo has removed it; until then the add fails (-606) and the status becomes `error`.
+
+### `workorder.set`
+
+A work order's fields changed; an empty value (`--description=`) clears one. Takes the fields of `workorder.create`. Writes to the vault, gated as `workorder.create`. Audited.
+
+```
+bin/idm workorder.set --env <name> --dn <work order> [fields] [--yes] [--confirm <env>] [--json]
+```
+
+| Argument | Required | Values |
+|---|---|---|
+| `--env` | yes | an environment in `environments.properties` |
+| `--dn` | yes | the work order |
+| `--status` | no | `pending` (a new one's default) or `onhold`; the driver sets `configured` or `error` |
+| `--due` | no | when it is done: `now` (the do-it-now flag, no due date), or a time as `20261231235900Z`, `2026-12-31T23:59:00Z` or `2026-12-31` |
+| `--repeat-minutes` | no | repeat it every this many minutes; `0`, a new one's default, for once |
+| `--delete-date` | no | when the driver deletes it, a time as for `--due` |
+| `--delete-on-error` | no | `true` to delete it on the delete date even after an error |
+| `--dependent` | no | a work order it waits for; repeat for several |
+| `--type`, `--number`, `--contact`, `--description` | no | the work order's type (passed to the WorkToDo object), number, contact and description |
+| `--content`, `--content-file` | no | what the work order does, as text or from a file |
+
+```bash
+bin/idm workorder.set --env test --dn "cn=New hire jdoe,cn=Work Orders,cn=driverset1,o=system" --status onhold --confirm test
+```
+
+### `workorder.delete`
+
+A work order deleted. Writes to the vault, gated as `workorder.create`. Audited.
+
+```
+bin/idm workorder.delete --env <name> --dn <work order> [--yes] [--confirm <env>] [--json]
+```
+
+| Argument | Required | Values |
+|---|---|---|
+| `--env` | yes | an environment in `environments.properties` |
+| `--dn` | yes | the work order |
+
+```bash
+bin/idm workorder.delete --env test --dn "cn=New hire jdoe,cn=Work Orders,cn=driverset1,o=system" --confirm test
+```
+
+### `template.list`
+
+The notification templates the vault holds now (`notfMergeTemplate` in the collection under `cn=Security`): name, subject, and whether a package installed it. Read-only: templates are tree content (`templates/`), changed by `vault.deploy`.
+
+```
+bin/idm template.list --env <name> [--json]
+```
+
+| Argument | Required | Values |
+|---|---|---|
+| `--env` | yes | an environment in `environments.properties` |
+| `--json` | no | the result as JSON |
+
+```bash
+bin/idm template.list --env test
+```
+
+### `template.show`
+
+One template as the vault holds it: the subject, the body, the `$TOKEN$` markers the two use, and whether the body is XML DirXMLDev can read (one it cannot would be read as no body, and a deploy would not keep it). Read-only.
+
+```
+bin/idm template.show --env <name> --name <template> [--json]
+```
+
+| Argument | Required | Values |
+|---|---|---|
+| `--env` | yes | an environment in `environments.properties` |
+| `--name` | yes | the template's name |
+| `--json` | no | the result as JSON |
+
+```bash
+bin/idm template.show --env test --name "Password Expiration Notification"
+```
+
 ### `vault.email-server`
 
 The notification collection's SMTP settings; the password is reported as set or not, never shown. `set` writes the settings given (an empty value, `--host=` or `--host ""`, clears that setting) and the password from the environment's secrets file (`--password-key`) or one line on stdin (`--stdin`). Show is read-only. `set` writes to the vault: needs `--confirm <env>` or `IDM_AGENT_ALLOW_WRITE=1`, `--yes` on a `stg` or `prd` tier, and `--confirm <env>` on a `prd` tier. Audited.
diff --git a/docs/console-gaps.md b/docs/console-gaps.md
index a71fc90c..0767186e 100644
--- a/docs/console-gaps.md
+++ b/docs/console-gaps.md
@@ -332,4 +332,22 @@ projects with policies, read locally only; lab projects with templates):
   date and description. Listed, not modelled: they are the Work Order driver's runtime records, not
   configuration, so the note's "tree objects" idea was dropped. **Excluded objects**: this schema has no
   attribute for them and the console's route could not be grounded on a lab object; left out.
-
+  **Written too (2026-11-02):** `workorder.show`, `workorder.create`, `workorder.set`, `workorder.delete`. Grounded on the
+  class's schema (status, repeat interval and count, number, contact and type are strings; the due, delete and creation
+  dates generalized time; do it now, delete on error and send to publisher booleans; dependents DNs), Identity
+  Console 26.1.2's work order page (a new one is `pending` with repeat interval `0`; the interval is in minutes; "do it
+  now" is the flag with no due date; a person sets `pending` or `onhold`) and NOVLWOBASE 2.1.1 (the container is the
+  set GCV `idv.workorder.container`, `type="dn" dn-space="dirxml" dn-type="slash"`, which the driver's placement
+  policy joins with `\` and the name; NetIQ suggests the driver object itself). `workorder.list` now looks there by
+  default: under the driver set it found none where the container was elsewhere. `template.list` and `template.show`
+  read the live templates; the canonical form a deploy writes was checked against a lab's 351 templates: every body
+  parses, and only whitespace between elements changes, never the text inside one.
+  **Shown live (idm-ig4, 2026-11-02),** with a Work Order driver built like Designer's WorkOrder configuration and
+  NOVLWOBASE 2.1.1: `workorder.list` found the container from the driver's slash GCV, the value the shim read too. The
+  filter ignores `DirXML-WorkOrder` on the subscriber channel (so the package's create policy, which names
+  `DirXML-nwoType`, not in the schema, never applies); the shim polls the container on the publisher channel. A work
+  order made by `workorder.create --due now` ran on the first poll: a `DirXML-WorkToDo` `DO-<name>` in the container with
+  its content, description, type and DN, then status `configured`, a log line, and the processing time as due date (the
+  do-it-now flag stays). Run again by `workorder.set`, it failed with -606: the WorkToDo of the last run was still there,
+  and the driver set `error`. With that removed, `--repeat-minutes 1` moved the due date on by a minute and kept it
+  `pending`. `workorder.show` and `workorder.delete` worked as documented.
\ No newline at end of file
diff --git a/docs/operate.md b/docs/operate.md
index 12cc1814..dfe69f94 100644
--- a/docs/operate.md
+++ b/docs/operate.md
@@ -67,7 +67,9 @@ Remote Loader lifecycle (the RL process is outside the vault), `--delete-driver`
 | `driverset.servers [add\|remove]` | `DirXML-ServerList` on the set and, through `GetDriverSet`, the driver set the connected server reports running; `add`/`remove --server DN` go to that server (its URL from the environment's `servers=` mapping) and call `SetDriverSet` / `ClearDriverSet` | show is read-only; add/remove are heavy writes, audited, refused when the server runs another set; never clear a set's only server |
 | `engine.metrics` | the console's user and driver metrics: users, users with an association, of those the enabled ones (the licensing count, `(&(objectClass=User)(DirXML-Associations=*)(!(loginDisabled=true)))`), and each driver's associations by state — counts only, nothing read beyond the DNs; `--base` narrows the search | read-only; `getUserDriverMetrics`, `computeDriverDistribution` |
 | `driver.rights` | eDirectory's effective privileges of the driver object (the identity the engine's policies act as, through its security equivalences) on an object: `[Entry Rights]`, `[All Attributes Rights]` and the attributes named (LDAP names) | read-only; the console's `privileges` |
-| `workorder.list` | the Work Order driver's `DirXML-WorkOrder` objects under a base (the driver set by default): status, due date, description, the content in the JSON | read-only; runtime data, so listed rather than modelled in the tree |
+| `workorder.list` / `workorder.show` | the Work Order driver's `DirXML-WorkOrder` objects in its container (the `idv.workorder.container` GCV, a slash DN resolved a level at a time; else the driver object; or `--base`): status, due date or "now", every field and the driver's log | read-only; runtime data, so listed rather than modelled in the tree |
+| `workorder.create` / `workorder.set` / `workorder.delete` | a work order made (`pending`, repeat 0, as Identity Console makes one), changed (an empty value clears a field; `--due now` is the do-it-now flag and no due date) or deleted | light write, audited; the fields are checked: a status a person sets (`pending`, `onhold`), generalized times, whole minutes, dependents that exist |
+| `template.list` / `template.show` | the notification templates the vault holds now: name, subject, package; one's body, `$TOKEN$` markers, and whether DirXMLDev can read the body | read-only; templates are tree content, changed by `vault.deploy` |
 | `vault.email-server [set]` | the notification collection's SMTP settings (`notfSMTPEmailHost`, `notfSMTPPort`, `notfSMTPEmailFrom`, `notfSMTPEmailUserName`, `notfSMTPUseTLS`, `notfSMTPTimeout`, `notfSMTPMailProtocol`, `notfSMTPAuthMechanisms`); the password (`notfSMTPMailPassword`) is reported as set or not, never shown, and written from the secrets file (`--password-key`) or stdin | show is read-only; set is a light write, audited; the console's `emailServerOptions` (its test send has no engine operation behind it and is not offered) |
 | `driver.migrate --direction vault` | the console's `migrateFromNDS`: an LDAP search (`--base`, `--filter`, `--class`, `--max`) finds the vault objects, then each goes down the running driver's subscriber channel as a `<sync class-name src-dn>` command, which makes the engine read the object and send its add or modify to the shim; `--dry-run` lists them | heavy write, audited; `--direction app` (the default with `--xds`) is the old `MigrateApp` |
 | `driver.log-level [set]` | Designer's log level page: `DirXML-DriverTraceLevel` holds the choice (0 errors, 1 errors and warnings, 2 last log time only, 3 off, 5 specific events), `DirXML-LogEvents` the event ids the engine logs (set through `SetLogEvents`, since the attribute is engine-written: 0 → 4 5 38, 1 → 3 4 5 35 38 39, 2 → -1, 3 cleared), `DirXML-LogLimit` the most entries kept, `DirXML-LogEventsType`; a driver without its own values uses the driver set's, `--inherit` puts a driver back to that | show is read-only; set is a light write, audited; the console's `logLevelPage` |
diff --git a/src/main/java/com/pointblue/dirxml/dev/Cli.java b/src/main/java/com/pointblue/dirxml/dev/Cli.java
index bd4e06e5..b1d56714 100644
--- a/src/main/java/com/pointblue/dirxml/dev/Cli.java
+++ b/src/main/java/com/pointblue/dirxml/dev/Cli.java
@@ -198,7 +198,7 @@ public static void main(String[] args) {
             if (args.length >= 1 && args[0].startsWith("viewer.")) {
                 System.exit(com.pointblue.dirxml.dev.operate.ViewerCli.run(args));
             }
-            if (args.length >= 1 && (args[0].startsWith("driver.") || args[0].startsWith("driverset.") || args[0].startsWith("engine.") || args[0].startsWith("job.") || args[0].startsWith("rbe.") || args[0].startsWith("workorder.") || args[0].equals("object.inspect") || args[0].equals("vault.email-server") || args[0].equals("trace.view"))) {
+            if (args.length >= 1 && (args[0].startsWith("driver.") || args[0].startsWith("driverset.") || args[0].startsWith("engine.") || args[0].startsWith("job.") || args[0].startsWith("rbe.") || args[0].startsWith("workorder.") || args[0].startsWith("template.") || args[0].equals("object.inspect") || args[0].equals("vault.email-server") || args[0].equals("trace.view"))) {
                 System.exit(com.pointblue.dirxml.dev.operate.OperateCli.run(args));
             }
             if (args.length >= 1 && com.pointblue.dirxml.dev.promote.PromoteCli.handles(args[0])) {
@@ -636,6 +636,8 @@ static String usageText() {
         sb.append("  driver.health [clear] --env E --driver D [--yes]   the Driver Health job's last state per server, the health configuration, the set's health jobs; clear removes the recorded status\n");
         sb.append("  job.list --env E [--driver D] | job.status --env E --job J [--driver D] | job.start|abort --env E --job J [--driver D] [--yes]   the set's jobs with the engine's state; start or abort one\n");
         sb.append("  driverset.activation --env E [apply --file F --yes] | driverset.servers --env E [add|remove --server DN --yes] | engine.metrics --env E | driver.rights --env E --driver D --dn O | workorder.list --env E   the low console gaps (docs/console-gaps.md §13)\n");
+        sb.append("  workorder.show --env E --dn DN | workorder.create --env E --name N [fields] | workorder.set --env E --dn DN [fields] | workorder.delete --env E --dn DN   work orders (docs/commands.md)\n");
+        sb.append("  template.list --env E | template.show --env E --name N   the notification templates the vault holds now, read-only\n");
         sb.append("  vault.email-server [set] --env E [--host H] [--port N] [--from A] [--user U] [--tls true|false] [--timeout N] [--protocol P] [--auth M] [--password-key K|--stdin]   the notification collection's SMTP settings (the password never shown); set writes them\n");
         sb.append("  rbe.list --env E | rbe.members --env E --policy P   the entitlement policies of the set: priority, members, grants; one policy's computed members\n");
         sb.append("  engine.version --env E\n");
diff --git a/src/main/java/com/pointblue/dirxml/dev/operate/Operate.java b/src/main/java/com/pointblue/dirxml/dev/operate/Operate.java
index 196232b7..fa63979d 100644
--- a/src/main/java/com/pointblue/dirxml/dev/operate/Operate.java
+++ b/src/main/java/com/pointblue/dirxml/dev/operate/Operate.java
@@ -127,6 +127,16 @@ default Vault.Entry read(String dn, String... attrs) {
 
         void replace(String dn, String attr, List<byte[]> values);
 
+        /** A new object with its classes and attributes (the work order commands); refused where not implemented. */
+        default void add(String dn, List<String> objectClasses, Map<String, List<byte[]>> attrs) {
+            throw new UnsupportedOperationException("add " + dn);
+        }
+
+        /** An object deleted (the work order commands); refused where not implemented. */
+        default void delete(String dn) {
+            throw new UnsupportedOperationException("delete " + dn);
+        }
+
         CachePage viewCache(String dn, int position, int count);
 
         void deleteCacheEntries(String dn, int p2, int p3, String p4, int priority);
@@ -286,6 +296,14 @@ public void replace(String dn, String attr, List<byte[]> values) {
                 v.replace(dn, attr, values);
             }
 
+            public void add(String dn, List<String> objectClasses, Map<String, List<byte[]>> attrs) {
+                v.add(dn, objectClasses, attrs);
+            }
+
+            public void delete(String dn) {
+                v.delete(dn);
+            }
+
             public CachePage viewCache(String dn, int position, int count) {
                 Vault.CachePage p = v.viewCache(dn, position, count);
                 return new CachePage(p.xds, p.nextToken);
@@ -2538,33 +2556,206 @@ public static Result driverRights(Engine engine, Environments.Environment env, S
         return r;
     }
 
-    /** The work orders ({@code DirXML-WorkOrder}, the Work Order driver's objects) under a base, newest due first. Read-only. */
-    public static Result workOrders(Engine engine, Environments.Environment env, String base, int limit) {
-        String b = base == null || base.isBlank() ? env.driverSetDn : base;
-        List<Vault.Entry> found;
+    // ---- G14: work orders ----------------------------------------------------------------------------
+
+    /** The Work Order driver's shim class. */
+    public static final String WORK_ORDER_SHIM = "com.novell.nds.dirxml.driver.workorder.WorkOrderDriverShim";
+    /** The GCV naming the container work orders live in (NOVLWOBASE: a dn GCV, dn-space dirxml, dn-type slash). */
+    public static final String WORK_ORDER_CONTAINER_GCV = "idv.workorder.container";
+    /** The statuses a person sets; the driver sets "configured" or "error" when it processes one (Identity Console 26.1.2 knows no other). */
+    public static final List<String> WORK_ORDER_STATUSES = List.of("pending", "onhold");
+
+    /**
+     * The fields a work order command takes, by option name, with the attribute each lands in and its kind: "text",
+     * "time" (generalized time; "now" for a due date means do it now), "minutes", "bool" or "dns" (several DNs).
+     * Grounded on the class's schema and Identity Console's work order page (26.1.2): the repeat interval is in minutes,
+     * a new work order is "pending" with a repeat interval of 0, and "do it now" is the flag with no due date.
+     */
+    public static final String[][] WORK_ORDER_FIELDS = {
+        { "description", "description", "text" }, { "status", "DirXML-nwoStatus", "text" }, { "due", "DirXML-DueDate", "time" },
+        { "repeat-minutes", "DirXML-nwoRepeatInterval", "minutes" }, { "delete-date", "DirXML-nwoDeleteDueDate", "time" },
+        { "delete-on-error", "DirXML-nwoDeleteOnError", "bool" }, { "dependent", "DirXML-nwoDependentWorkOrder", "dns" },
+        { "type", "DirXML-woType", "text" }, { "number", "DirXML-nwoWorkOrderNumber", "text" }, { "contact", "DirXML-nwoContactName", "text" },
+        { "content", "DirXML-nwoContent", "text" },
+    };
+
+    /** The Work Order drivers of the set: {@code DirXML-Driver} objects whose shim is {@link #WORK_ORDER_SHIM}. */
+    static List<Vault.Entry> workOrderDrivers(Engine engine, Environments.Environment env) {
         try {
-            found = engine.search(b, "(objectClass=DirXML-WorkOrder)", javax.naming.directory.SearchControls.SUBTREE_SCOPE);
+            return engine.search(env.driverSetDn, "(DirXML-JavaModule=" + WORK_ORDER_SHIM + ")", javax.naming.directory.SearchControls.ONELEVEL_SCOPE);
         } catch (RuntimeException e) {
-            return Result.refused("search " + b + ": " + e.getMessage());
+            return List.of();
+        }
+    }
+
+    /**
+     * Where work orders live: the {@link #WORK_ORDER_CONTAINER_GCV} GCV's value from each Work Order driver's configuration
+     * values, else the driver set's, resolved from its slash form to an LDAP DN; failing that, the Work Order driver
+     * objects themselves (NetIQ's suggested container). Empty when the set has no Work Order driver.
+     */
+    public static List<String> workOrderContainers(Engine engine, Environments.Environment env) {
+        List<String> out = new ArrayList<>();
+        Vault.Entry set = engine.read(env.driverSetDn);
+        String setValue = set == null ? null : containerGcv(engine, set);
+        for (Vault.Entry d : workOrderDrivers(engine, env)) {
+            Vault.Entry full = engine.read(d.dn);
+            String value = full == null ? null : containerGcv(engine, full);
+            String dn = value != null && !value.isBlank() ? value : setValue;
+            String resolved = dn == null || dn.isBlank() ? null : ldapDnOf(engine, dn);
+            String c = resolved != null ? resolved : d.dn;
+            if (out.stream().noneMatch(x -> x.equalsIgnoreCase(c))) {
+                out.add(c);
+            }
+        }
+        return out;
+    }
+
+    /**
+     * The container GCV on a driver or driver set: its own {@code DirXML-ConfigValues}, then the GCV objects it links
+     * (policy set 14), where a package install such as NOVLWOBASE's keeps it.
+     */
+    static String containerGcv(Engine engine, Vault.Entry e) {
+        String own = gcvValue(e.string("DirXML-ConfigValues"), WORK_ORDER_CONTAINER_GCV);
+        if (own != null && !own.isBlank()) {
+            return own;
+        }
+        for (String link : e.strings("DirXML-Policies")) {
+            int last = link.lastIndexOf('#');
+            int mid = last < 0 ? -1 : link.lastIndexOf('#', last - 1);
+            if (mid < 0 || !link.substring(last + 1).trim().equals("14")) {
+                continue;
+            }
+            Vault.Entry g = engine.read(link.substring(0, mid));
+            String v = g == null ? null : gcvValue(g.string("DirXML-ConfigValues"), WORK_ORDER_CONTAINER_GCV);
+            if (v != null && !v.isBlank()) {
+                return v;
+            }
+        }
+        return null;
+    }
+
+    /** The value of the GCV {@code name} in a {@code <configuration-values>} document; null when it is not there. */
+    static String gcvValue(String configValues, String name) {
+        if (configValues == null || configValues.isBlank()) {
+            return null;
+        }
+        try {
+            org.w3c.dom.NodeList defs = com.pointblue.dirxml.dev.xml.CanonicalXml.parse(configValues).getElementsByTagName("definition");
+            for (int i = 0; i < defs.getLength(); i++) {
+                org.w3c.dom.Element d = (org.w3c.dom.Element) defs.item(i);
+                if (name.equals(d.getAttribute("name"))) {
+                    org.w3c.dom.NodeList v = d.getElementsByTagName("value");
+                    return v.getLength() == 0 ? null : v.item(0).getTextContent().trim();
+                }
+            }
+        } catch (RuntimeException e) {
+            return null;
+        }
+        return null;
+    }
+
+    /**
+     * An LDAP DN for a DN in either form: an LDAP DN as it is; a slash DN ({@code data\WorkOrders}, {@code \TREE\data\WorkOrders})
+     * looked up a level at a time, as slash names carry no attribute types. Null when a level is not found.
+     */
+    public static String ldapDnOf(Engine engine, String dn) {
+        String d = dn.trim();
+        if (!d.contains("\\") && d.contains("=")) {
+            return d;
+        }
+        List<String> parts = new ArrayList<>(List.of(d.replaceAll("^\\\\+", "").split("\\\\")));
+        parts.removeIf(String::isBlank);
+        for (int skip = 0; skip <= 1 && skip < parts.size(); skip++) {
+            // a leading part may be the tree's name, which no LDAP DN carries
+            String base = "";
+            boolean found = true;
+            for (String part : parts.subList(skip, parts.size())) {
+                String value = ldapEscape(part);
+                List<Vault.Entry> hits;
+                try {
+                    hits = engine.search(base, "(|(o=" + value + ")(ou=" + value + ")(cn=" + value + ")(dc=" + value + ")(c=" + value + ")(l=" + value + "))",
+                        javax.naming.directory.SearchControls.ONELEVEL_SCOPE);
+                } catch (RuntimeException e) {
+                    hits = List.of();
+                }
+                Vault.Entry hit = hits.stream().filter(h -> rdnValue(h.dn).equalsIgnoreCase(part)).findFirst().orElse(null);
+                if (hit == null) {
+                    found = false;
+                    break;
+                }
+                base = hit.dn;
+            }
+            if (found && !base.isEmpty()) {
+                return base;
+            }
+        }
+        return null;
+    }
+
+    private static String rdnValue(String dn) {
+        String first = dn.split("(?<!\\\\),", 2)[0];
+        return first.substring(first.indexOf('=') + 1).replace("\\", "");
+    }
+
+    /** RFC 4515 escaping of a filter value. */
+    static String ldapEscape(String s) {
+        StringBuilder b = new StringBuilder();
+        for (char c : s.toCharArray()) {
+            switch (c) {
+                case '*' -> b.append("\\2a");
+                case '(' -> b.append("\\28");
+                case ')' -> b.append("\\29");
+                case '\\' -> b.append("\\5c");
+                case '\0' -> b.append("\\00");
+                default -> b.append(c);
+            }
+        }
+        return b.toString();
+    }
+
+    /**
+     * The work orders ({@code DirXML-WorkOrder}) under a base, newest due first. Read-only. Without a base, the
+     * containers the Work Order drivers use ({@link #workOrderContainers}); with no Work Order driver, the driver set.
+     */
+    public static Result workOrders(Engine engine, Environments.Environment env, String base, int limit) {
+        List<String> bases = base != null && !base.isBlank() ? List.of(base) : workOrderContainers(engine, env);
+        if (bases.isEmpty()) {
+            bases = List.of(env.driverSetDn);
+        }
+        List<Vault.Entry> found = new ArrayList<>();
+        for (String b : bases) {
+            try {
+                for (Vault.Entry e : engine.search(b, "(objectClass=DirXML-WorkOrder)", javax.naming.directory.SearchControls.SUBTREE_SCOPE)) {
+                    if (found.stream().noneMatch(x -> x.dn.equalsIgnoreCase(e.dn))) {
+                        found.add(e);
+                    }
+                }
+            } catch (RuntimeException e) {
+                return Result.refused("search " + b + ": " + e.getMessage());
+            }
         }
-        found = new ArrayList<>(found);
         found.sort(java.util.Comparator.comparing((Vault.Entry e) -> e.string("DirXML-DueDate") == null ? "" : e.string("DirXML-DueDate")).reversed());
+        String where = String.join(", ", bases);
         StringBuilder t = new StringBuilder();
-        t.append(found.size()).append(" work order(s) under ").append(b).append('\n');
+        t.append(found.size()).append(" work order(s) under ").append(where).append('\n');
         t.append(String.format("%-36s %-10s %-20s %s", "work order", "status", "due", "description")).append('\n');
-        StringBuilder j = new StringBuilder("{\"ok\":true,\"base\":").append(q(b)).append(",\"total\":").append(found.size()).append(",\"workOrders\":[");
+        StringBuilder j = new StringBuilder("{\"ok\":true,\"base\":").append(q(bases.get(0))).append(",\"bases\":[");
+        for (int i = 0; i < bases.size(); i++) {
+            j.append(i > 0 ? "," : "").append(q(bases.get(i)));
+        }
+        j.append("],\"total\":").append(found.size()).append(",\"workOrders\":[");
         int n = 0;
         for (Vault.Entry e : found) {
             if (n >= limit) {
                 break;
             }
-            String name = e.dn.substring(e.dn.indexOf('=') + 1, e.dn.indexOf(','));
+            String name = rdnValue(e.dn);
             String status = e.string("DirXML-nwoStatus");
+            boolean now = "TRUE".equalsIgnoreCase(e.string("DirXML-nwoDoItNowFlag"));
             String due = e.string("DirXML-DueDate");
             String desc = e.string("Description");
-            t.append(String.format("%-36s %-10s %-20s %s", name, status == null ? "-" : status, due == null ? "-" : due, desc == null ? "" : desc)).append('\n');
-            j.append(n++ > 0 ? "," : "").append("{\"name\":").append(q(name)).append(",\"dn\":").append(q(e.dn)).append(",\"status\":").append(q(status == null ? "" : status))
-             .append(",\"due\":").append(q(due == null ? "" : due)).append(",\"description\":").append(q(desc == null ? "" : desc)).append(",\"content\":").append(q(e.string("DirXML-nwoContent") == null ? "" : e.string("DirXML-nwoContent"))).append("}");
+            t.append(String.format("%-36s %-10s %-20s %s", name, status == null ? "-" : status, due != null ? due : now ? "now" : "-", desc == null ? "" : desc)).append('\n');
+            j.append(n++ > 0 ? "," : "").append(workOrderJson(e));
         }
         j.append("]}");
         Result r = new Result();
@@ -2574,6 +2765,261 @@ public static Result workOrders(Engine engine, Environments.Environment env, Str
         return r;
     }
 
+    /** One work order as JSON: its name, DN and every field, plus what the driver writes (log, creation, creator). */
+    static String workOrderJson(Vault.Entry e) {
+        StringBuilder j = new StringBuilder("{\"name\":").append(q(rdnValue(e.dn))).append(",\"dn\":").append(q(e.dn));
+        for (String[] f : WORK_ORDER_FIELDS) {
+            if (f[2].equals("dns")) {
+                j.append(",").append(q(f[0])).append(":[");
+                List<String> v = e.strings(f[1]);
+                for (int i = 0; i < v.size(); i++) {
+                    j.append(i > 0 ? "," : "").append(q(v.get(i)));
+                }
+                j.append("]");
+            } else {
+                String v = e.string(f[1]);
+                j.append(",").append(q(f[0])).append(":").append(v == null ? "null" : f[2].equals("bool") ? String.valueOf("TRUE".equalsIgnoreCase(v)) : q(v));
+            }
+        }
+        j.append(",\"now\":").append("TRUE".equalsIgnoreCase(e.string("DirXML-nwoDoItNowFlag")));
+        j.append(",\"created\":").append(e.string("DirXML-nwoCreationDate") == null ? "null" : q(e.string("DirXML-nwoCreationDate")));
+        j.append(",\"creator\":").append(e.string("DirXML-CreatorName") == null ? "null" : q(e.string("DirXML-CreatorName")));
+        j.append(",\"log\":[");
+        List<String> log = e.strings("DirXML-nwoProcessLog");
+        for (int i = 0; i < log.size(); i++) {
+            j.append(i > 0 ? "," : "").append(q(log.get(i)));
+        }
+        return j.append("]}").toString();
+    }
+
+    /** One work order: every field, the driver's log, and where it lives. Read-only. */
+    public static Result workOrderShow(Engine engine, Environments.Environment env, String dn) {
+        if (dn == null || dn.isBlank()) {
+            return Result.refused("--dn names the work order");
+        }
+        Vault.Entry e = engine.read(dn);
+        if (e == null || e.strings("objectClass").stream().noneMatch(c -> c.equalsIgnoreCase("DirXML-WorkOrder"))) {
+            return Result.refused(dn + " is not a work order");
+        }
+        StringBuilder t = new StringBuilder(e.dn).append('\n');
+        for (String[] f : WORK_ORDER_FIELDS) {
+            List<String> v = e.strings(f[1]);
+            t.append(String.format("  %-16s %s", f[0], v.isEmpty() ? "-" : String.join("; ", v))).append('\n');
+        }
+        t.append(String.format("  %-16s %s", "do it now", "TRUE".equalsIgnoreCase(e.string("DirXML-nwoDoItNowFlag")) ? "yes" : "no")).append('\n');
+        for (String l : e.strings("DirXML-nwoProcessLog")) {
+            t.append("  log  ").append(l).append('\n');
+        }
+        Result r = new Result();
+        r.ok = true;
+        r.text = t.toString();
+        r.json = "{\"ok\":true,\"workOrder\":" + workOrderJson(e) + "}";
+        return r;
+    }
+
+    /**
+     * The attribute changes for work order fields given by option name (an empty value clears one; {@code due=now} sets
+     * "do it now" and clears the due date), checked: a status a person may set, generalized times, a whole number of
+     * minutes, a boolean, DNs that exist. Throws IllegalArgumentException on a bad value.
+     */
+    static Map<String, List<byte[]>> workOrderChanges(Engine engine, Map<String, String> fields, List<String> dependents) {
+        Map<String, List<byte[]>> m = new LinkedHashMap<>();
+        for (String[] f : WORK_ORDER_FIELDS) {
+            if (f[2].equals("dns")) {
+                if (dependents != null) {
+                    List<byte[]> v = new ArrayList<>();
+                    for (String d : dependents) {
+                        if (engine.read(d) == null) {
+                            throw new IllegalArgumentException("dependent work order " + d + " was not found");
+                        }
+                        v.add(d.getBytes(StandardCharsets.UTF_8));
+                    }
+                    m.put(f[1], v);
+                }
+                continue;
+            }
+            if (!fields.containsKey(f[0])) {
+                continue;
+            }
+            String v = fields.get(f[0]) == null ? "" : fields.get(f[0]).trim();
+            if (v.isEmpty()) {
+                m.put(f[1], List.of());
+                continue;
+            }
+            switch (f[2]) {
+                case "time" -> {
+                    if (f[0].equals("due") && v.equalsIgnoreCase("now")) {
+                        m.put("DirXML-DueDate", List.of());
+                        m.put("DirXML-nwoDoItNowFlag", List.of("TRUE".getBytes(StandardCharsets.UTF_8)));
+                        continue;
+                    }
+                    v = generalizedTime(v, f[0]);
+                    if (f[0].equals("due")) {
+                        m.put("DirXML-nwoDoItNowFlag", List.of());
+                    }
+                }
+                case "minutes" -> {
+                    try {
+                        if (Integer.parseInt(v) < 0) {
+                            throw new NumberFormatException();
+                        }
+                    } catch (NumberFormatException e) {
+                        throw new IllegalArgumentException("--" + f[0] + " is a whole number of minutes, 0 for no repeat");
+                    }
+                }
+                case "bool" -> {
+                    if (!v.equalsIgnoreCase("true") && !v.equalsIgnoreCase("false")) {
+                        throw new IllegalArgumentException("--" + f[0] + " is true or false");
+                    }
+                    v = v.toUpperCase(java.util.Locale.ROOT);
+                }
+                default -> {
+                    if (f[0].equals("status") && !WORK_ORDER_STATUSES.contains(v)) {
+                        throw new IllegalArgumentException("--status is pending or onhold (the driver sets configured or error)");
+                    }
+                }
+            }
+            m.put(f[1], List.of(v.getBytes(StandardCharsets.UTF_8)));
+        }
+        return m;
+    }
+
+    /** A time as generalized time ({@code 20261231235900Z}), from that or from ISO 8601 ({@code 2026-12-31T23:59:00Z}, an offset, or a bare date). */
+    static String generalizedTime(String v, String field) {
+        if (v.matches("\\d{14}Z")) {
+            return v;
+        }
+        java.time.format.DateTimeFormatter out = java.time.format.DateTimeFormatter.ofPattern("yyyyMMddHHmmss'Z'").withZone(java.time.ZoneOffset.UTC);
+        try {
+            return out.format(java.time.OffsetDateTime.parse(v).toInstant());
+        } catch (java.time.format.DateTimeParseException e) {
+            // not an offset date-time: an instant or a bare date
+        }
+        try {
+            return out.format(java.time.Instant.parse(v));
+        } catch (java.time.format.DateTimeParseException e) {
+            // a bare date, at midnight UTC
+        }
+        try {
+            return out.format(java.time.LocalDate.parse(v).atStartOfDay(java.time.ZoneOffset.UTC).toInstant());
+        } catch (java.time.format.DateTimeParseException e) {
+            throw new IllegalArgumentException("--" + field + " is a time: 20261231235900Z, 2026-12-31T23:59:00Z or 2026-12-31" + (field.equals("due") ? ", or now" : ""));
+        }
+    }
+
+    /**
+     * A new work order {@code name} in {@code container} (the Work Order driver's container when null; refused when
+     * there are several): "pending" and no repeat unless given, as Identity Console makes one. Light write, audited.
+     */
+    public static Result workOrderCreate(Engine engine, Environments.Environment env, String container, String name, Map<String, String> fields,
+            List<String> dependents, boolean yes, String confirm, Path tree) throws IOException {
+        if (name == null || name.isBlank()) {
+            return Result.refused("--name names the new work order");
+        }
+        String refusal = gate(env, OpClass.LIGHT, yes, confirm);
+        if (refusal != null) {
+            return Result.refused(refusal);
+        }
+        String c = container;
+        if (c == null || c.isBlank()) {
+            List<String> found = workOrderContainers(engine, env);
+            if (found.size() != 1) {
+                return Result.refused(found.isEmpty() ? "no Work Order driver in " + env.driverSetDn + ": give --container"
+                    : "several work order containers (" + String.join(", ", found) + "): give --container");
+            }
+            c = found.get(0);
+        }
+        String dn = "cn=" + com.pointblue.dirxml.dev.deploy.VaultMapping.escapeRdn(name.trim()) + "," + c;
+        if (engine.read(dn) != null) {
+            return Result.refused(dn + " already exists");
+        }
+        Map<String, String> withDefaults = new LinkedHashMap<>(fields);
+        withDefaults.putIfAbsent("status", "pending");
+        withDefaults.putIfAbsent("repeat-minutes", "0");
+        Map<String, List<byte[]>> attrs;
+        try {
+            attrs = workOrderChanges(engine, withDefaults, dependents);
+        } catch (IllegalArgumentException e) {
+            return Result.refused(e.getMessage());
+        }
+        attrs.values().removeIf(List::isEmpty);
+        attrs.put("cn", List.of(name.trim().getBytes(StandardCharsets.UTF_8)));
+        String error = null;
+        try {
+            engine.add(dn, List.of("Top", "DirXML-WorkOrder"), attrs);
+        } catch (RuntimeException e) {
+            error = e.getMessage();
+        }
+        return workOrderAudited(env, tree, "workorder.create " + dn, error, dn);
+    }
+
+    /** Work order fields changed (an empty value clears one). Light write, audited. */
+    public static Result workOrderSet(Engine engine, Environments.Environment env, String dn, Map<String, String> fields, List<String> dependents,
+            boolean yes, String confirm, Path tree) throws IOException {
+        if (fields.isEmpty() && dependents == null) {
+            return Result.refused("nothing to set: give a field (--status, --due, --repeat-minutes, --delete-date, …)");
+        }
+        String refusal = gate(env, OpClass.LIGHT, yes, confirm);
+        if (refusal != null) {
+            return Result.refused(refusal);
+        }
+        Vault.Entry e = dn == null ? null : engine.read(dn);
+        if (e == null || e.strings("objectClass").stream().noneMatch(c -> c.equalsIgnoreCase("DirXML-WorkOrder"))) {
+            return Result.refused(dn + " is not a work order");
+        }
+        Map<String, List<byte[]>> changes;
+        try {
+            changes = workOrderChanges(engine, fields, dependents);
+        } catch (IllegalArgumentException x) {
+            return Result.refused(x.getMessage());
+        }
+        String error = null;
+        List<String> done = new ArrayList<>();
+        try {
+            for (Map.Entry<String, List<byte[]>> c : changes.entrySet()) {
+                if (c.getValue().isEmpty() && e.strings(c.getKey()).isEmpty()) {
+                    continue;   // clearing what is not there
+                }
+                engine.replace(dn, c.getKey(), c.getValue());
+                done.add(c.getKey());
+            }
+        } catch (RuntimeException x) {
+            error = x.getMessage();
+        }
+        return workOrderAudited(env, tree, "workorder.set " + dn + " " + String.join(", ", done), error, dn);
+    }
+
+    /** A work order deleted. Light write, audited. */
+    public static Result workOrderDelete(Engine engine, Environments.Environment env, String dn, boolean yes, String confirm, Path tree) throws IOException {
+        String refusal = gate(env, OpClass.LIGHT, yes, confirm);
+        if (refusal != null) {
+            return Result.refused(refusal);
+        }
+        Vault.Entry e = dn == null ? null : engine.read(dn);
+        if (e == null || e.strings("objectClass").stream().noneMatch(c -> c.equalsIgnoreCase("DirXML-WorkOrder"))) {
+            return Result.refused(dn + " is not a work order");
+        }
+        String error = null;
+        try {
+            engine.delete(dn);
+        } catch (RuntimeException x) {
+            error = x.getMessage();
+        }
+        return workOrderAudited(env, tree, "workorder.delete " + dn, error, dn);
+    }
+
+    private static Result workOrderAudited(Environments.Environment env, Path tree, String what, String error, String dn) throws IOException {
+        DeployLog.Record rec = DeployLog.record(env.name, "operate");
+        rec.outcome = error == null ? "ok" : "failed";
+        rec.detail = what + (error != null ? " — " + error : "");
+        DeployLog.append(tree, rec);
+        Result r = new Result();
+        r.ok = error == null;
+        r.text = (error == null ? "ok       " + what : "FAILED   " + what + ": " + error) + "\n";
+        r.json = "{\"ok\":" + r.ok + ",\"dn\":" + q(dn) + (error != null ? ",\"error\":" + q(error) : "") + "}";
+        return r;
+    }
+
     // ---- G8: the e-mail server ----------------------------------------------------------------------
 
     /** The notification collection's SMTP attributes, in the order shown ({@code notfSMTPMailPassword} is never read back). */
@@ -2666,6 +3112,98 @@ public static Result emailServerSet(Engine engine, Environments.Environment env,
         return r;
     }
 
+    // ---- G8: the notification templates, read live ----------------------------------------------------
+
+    /**
+     * The notification collection's templates ({@code notfMergeTemplate}): name, subject, and whether a package installed
+     * it. Read-only: templates are tree content (templates/, deployed by vault.deploy); this shows what the vault holds now.
+     */
+    public static Result templateList(Engine engine, Environments.Environment env) {
+        Vault.Entry c = emailCollection(engine);
+        if (c == null) {
+            return Result.refused("no notification collection under cn=Security (notfTemplateCollection)");
+        }
+        List<Vault.Entry> found;
+        try {
+            found = new ArrayList<>(engine.search(c.dn, "(objectClass=notfMergeTemplate)", javax.naming.directory.SearchControls.ONELEVEL_SCOPE));
+        } catch (RuntimeException e) {
+            return Result.refused("search " + c.dn + ": " + e.getMessage());
+        }
+        found.sort(java.util.Comparator.comparing((Vault.Entry e) -> rdnValue(e.dn), String.CASE_INSENSITIVE_ORDER));
+        StringBuilder t = new StringBuilder().append(found.size()).append(" template(s) in ").append(c.dn).append('\n');
+        StringBuilder j = new StringBuilder("{\"ok\":true,\"collection\":").append(q(c.dn)).append(",\"total\":").append(found.size()).append(",\"templates\":[");
+        int n = 0;
+        for (Vault.Entry e : found) {
+            String subject = e.string("notfMergeTemplateSubject");
+            boolean packaged = e.string("DirXML-pkgGUID") != null;
+            t.append(String.format("  %-60s %s%s", rdnValue(e.dn), subject == null ? "-" : subject, packaged ? "  (package)" : "")).append('\n');
+            j.append(n++ > 0 ? "," : "").append("{\"name\":").append(q(rdnValue(e.dn))).append(",\"dn\":").append(q(e.dn))
+             .append(",\"subject\":").append(subject == null ? "null" : q(subject)).append(",\"packaged\":").append(packaged).append("}");
+        }
+        j.append("]}");
+        Result r = new Result();
+        r.ok = true;
+        r.text = t.toString();
+        r.json = j.toString();
+        return r;
+    }
+
+    /**
+     * One template: its subject, its body as the vault holds it, the {@code $TOKEN$} markers the body uses, and whether
+     * the body is XML core can read (a body it cannot read would be read as none, and a deploy would not keep it).
+     */
+    public static Result templateShow(Engine engine, Environments.Environment env, String name) {
+        Vault.Entry c = emailCollection(engine);
+        if (c == null) {
+            return Result.refused("no notification collection under cn=Security (notfTemplateCollection)");
+        }
+        if (name == null || name.isBlank()) {
+            return Result.refused("--name names the template");
+        }
+        String dn = "cn=" + com.pointblue.dirxml.dev.deploy.VaultMapping.escapeRdn(name) + "," + c.dn;
+        Vault.Entry e = engine.read(dn);
+        if (e == null) {
+            return Result.refused("no template named " + name + " in " + c.dn);
+        }
+        String subject = e.string("notfMergeTemplateSubject");
+        byte[] raw = e.bytes("notfMergeTemplateData");
+        String body = raw == null ? null : new String(raw, StandardCharsets.UTF_8);
+        boolean readable = false;
+        if (body != null) {
+            try {
+                com.pointblue.dirxml.dev.xml.CanonicalXml.parse(body);
+                readable = true;
+            } catch (RuntimeException x) {
+                readable = false;
+            }
+        }
+        java.util.Set<String> tokens = new java.util.LinkedHashSet<>();
+        java.util.regex.Matcher m = java.util.regex.Pattern.compile("\\$([A-Za-z0-9_.]+)\\$").matcher((subject == null ? "" : subject) + " " + (body == null ? "" : body));
+        while (m.find()) {
+            tokens.add(m.group(1));
+        }
+        StringBuilder t = new StringBuilder(dn).append('\n');
+        t.append("  subject  ").append(subject == null ? "-" : subject).append('\n');
+        t.append("  tokens   ").append(tokens.isEmpty() ? "-" : String.join(", ", tokens)).append('\n');
+        t.append("  body     ").append(body == null ? "none" : body.length() + " characters" + (readable ? "" : ", NOT XML core can read")).append('\n');
+        if (body != null) {
+            t.append(body).append(body.endsWith("\n") ? "" : "\n");
+        }
+        StringBuilder j = new StringBuilder("{\"ok\":true,\"name\":").append(q(name)).append(",\"dn\":").append(q(dn))
+            .append(",\"subject\":").append(subject == null ? "null" : q(subject)).append(",\"body\":").append(body == null ? "null" : q(body))
+            .append(",\"readable\":").append(readable).append(",\"packaged\":").append(e.string("DirXML-pkgGUID") != null).append(",\"tokens\":[");
+        int n = 0;
+        for (String tok : tokens) {
+            j.append(n++ > 0 ? "," : "").append(q(tok));
+        }
+        j.append("]}");
+        Result r = new Result();
+        r.ok = true;
+        r.text = t.toString();
+        r.json = j.toString();
+        return r;
+    }
+
     // ---- G5: migrate into the application --------------------------------------------------------
 
     /**
diff --git a/src/main/java/com/pointblue/dirxml/dev/operate/OperateCli.java b/src/main/java/com/pointblue/dirxml/dev/operate/OperateCli.java
index 00d32425..f49607c1 100644
--- a/src/main/java/com/pointblue/dirxml/dev/operate/OperateCli.java
+++ b/src/main/java/com/pointblue/dirxml/dev/operate/OperateCli.java
@@ -56,6 +56,12 @@ private OperateCli() {
         Map.entry("engine.stats", takes("", "env driver")),
         Map.entry("driver.rights", takes("", "env driver dn attr")),
         Map.entry("workorder.list", takes("", "env base limit")),
+        Map.entry("workorder.show", takes("", "env dn")),
+        Map.entry("workorder.create", takes("yes", "env container name description status due repeat-minutes delete-date delete-on-error dependent type number contact content content-file confirm tree")),
+        Map.entry("workorder.set", takes("yes", "env dn description status due repeat-minutes delete-date delete-on-error dependent type number contact content content-file confirm tree")),
+        Map.entry("workorder.delete", takes("yes", "env dn confirm tree")),
+        Map.entry("template.list", takes("", "env")),
+        Map.entry("template.show", takes("", "env name")),
         Map.entry("driver.status", takes("", "env driver tree")),
         Map.entry("driver.start", takes("yes", "env driver wait confirm tree")),
         Map.entry("driver.stop", takes("yes", "env driver wait confirm tree")),
@@ -377,6 +383,42 @@ public static int run(String[] argv) throws Exception {
                     result = Operate.workOrders(engine, env, first(opts, "base"), a.intOpt("limit", 200));
                     break;
 
+                case "workorder.show":
+                    result = Operate.workOrderShow(engine, env, first(opts, "dn"));
+                    break;
+
+                case "workorder.create":
+                case "workorder.set": {
+                    Map<String, String> fields = new LinkedHashMap<>();
+                    for (String[] f : Operate.WORK_ORDER_FIELDS) {
+                        if (!f[2].equals("dns") && opts.containsKey(f[0])) {
+                            fields.put(f[0], first(opts, f[0]) == null ? "" : first(opts, f[0]));
+                        }
+                    }
+                    if (opts.containsKey("content-file")) {
+                        fields.put("content", java.nio.file.Files.readString(java.nio.file.Path.of(first(opts, "content-file")), java.nio.charset.StandardCharsets.UTF_8));
+                    }
+                    // --dependent repeats; one empty --dependent clears them
+                    List<String> dependents = opts.containsKey("dependent")
+                        ? opts.get("dependent").stream().filter(d -> d != null && !d.isBlank()).toList() : null;
+                    result = cmd.equals("workorder.create")
+                        ? Operate.workOrderCreate(engine, env, first(opts, "container"), first(opts, "name"), fields, dependents, yes, confirm, tree)
+                        : Operate.workOrderSet(engine, env, first(opts, "dn"), fields, dependents, yes, confirm, tree);
+                    break;
+                }
+
+                case "workorder.delete":
+                    result = Operate.workOrderDelete(engine, env, first(opts, "dn"), yes, confirm, tree);
+                    break;
+
+                case "template.list":
+                    result = Operate.templateList(engine, env);
+                    break;
+
+                case "template.show":
+                    result = Operate.templateShow(engine, env, first(opts, "name"));
+                    break;
+
                 case "driver.status": {
                     if (driver == null) {
                         System.err.println("usage: driver.status --env E --driver D [--json] [--tree DIR]");
@@ -849,7 +891,15 @@ private static void usage() {
         System.err.println("  driverset.servers [add|remove --server DN --yes] --env E   the servers of the set and what this connection's server runs; add/remove associate a server (SetDriverSet / ClearDriverSet, at that server)");
         System.err.println("  engine.metrics --env E [--base DN] [--json]        users, users with an association, enabled ones (the licensing count), and each driver's associations by state");
         System.err.println("  driver.rights --env E --driver D --dn <object> [--attr A…]   eDirectory's effective rights of the driver object on an object: entry, all attributes, named attributes");
-        System.err.println("  workorder.list --env E [--base DN] [--limit N]    the Work Order driver's DirXML-WorkOrder objects: status, due date, description");
+        System.err.println("  workorder.list --env E [--base DN] [--limit N]    the work orders: in the Work Order driver's container (idv.workorder.container), or under --base");
+        System.err.println("  workorder.show --env E --dn DN                     one work order: every field and the driver's log");
+        System.err.println("  workorder.create --env E --name N [--container DN] [--status pending|onhold] [--due TIME|now] [--repeat-minutes N]");
+        System.err.println("                   [--delete-date TIME] [--delete-on-error true|false] [--dependent DN…] [--type T] [--number N]");
+        System.err.println("                   [--contact C] [--description D] [--content TEXT | --content-file F] --yes   a new work order (light write)");
+        System.err.println("  workorder.set --env E --dn DN [the fields above; an empty value clears one] --yes   change a work order (light write)");
+        System.err.println("  workorder.delete --env E --dn DN --yes             delete a work order (light write)");
+        System.err.println("  template.list --env E                              the notification templates the vault holds now");
+        System.err.println("  template.show --env E --name N                     one template: subject, body, tokens, whether core can read it");
         System.err.println("  vault.email-server [set] --env E [--host H] [--port N] [--from A] [--user U] [--tls true|false] [--timeout N] [--protocol P] [--auth M] [--password-key K|--stdin]   the notification collection's SMTP settings; set writes them");
         System.err.println("  driver.migrate --env E --driver D --direction vault --base DN --filter F --class C [--max N] [--dry-run] --yes   send vault objects into the application (one <sync> per object through the running driver)");
         System.err.println("  driver.log-level [set] --env E [--driver D] [--level errors|errors-and-warnings|last-log-time|off|specific-events] [--events id,…] [--limit N] [--events-type N] [--inherit]   the log level of a driver or the driver set; set writes it live, --inherit makes a driver use the set's");
diff --git a/src/main/java/com/pointblue/dirxml/dev/xml/CanonicalXml.java b/src/main/java/com/pointblue/dirxml/dev/xml/CanonicalXml.java
index c324530e..918ae5e0 100644
--- a/src/main/java/com/pointblue/dirxml/dev/xml/CanonicalXml.java
+++ b/src/main/java/com/pointblue/dirxml/dev/xml/CanonicalXml.java
@@ -97,6 +97,8 @@ public static Document parse(String xml) {
 
             DocumentBuilder builder = factory.newDocumentBuilder();
             builder.setEntityResolver((publicId, systemId) -> new InputSource(new StringReader("")));
+            // the failure is thrown to the caller; the default handler would also print "[Fatal Error]" to stderr
+            builder.setErrorHandler(new org.xml.sax.helpers.DefaultHandler());
 
             return builder.parse(new InputSource(new StringReader(xml)));
         } catch (ParserConfigurationException | SAXException | IOException e) {
diff --git a/src/test/java/com/pointblue/dirxml/dev/operate/OperateTest.java b/src/test/java/com/pointblue/dirxml/dev/operate/OperateTest.java
index d0203da0..7ac0b242 100644
--- a/src/test/java/com/pointblue/dirxml/dev/operate/OperateTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/operate/OperateTest.java
@@ -298,6 +298,22 @@ public List<Vault.Entry> children(String base) {
             return childrenOf.getOrDefault(base, List.of());
         }
 
+        final List<String> deletedDns = new ArrayList<>();
+
+        @Override
+        public void add(String dn, List<String> objectClasses, Map<String, List<byte[]>> attrs) {
+            Vault.Entry e = newEntry(dn);
+            put(e, "objectClass", objectClasses);
+            e.attrs.putAll(attrs);
+            entries.put(dn, e);
+        }
+
+        @Override
+        public void delete(String dn) {
+            deletedDns.add(dn);
+            entries.remove(dn);
+        }
+
         public void replace(String dn, String attr, List<byte[]> values) {
             Vault.Entry e = entries.get(dn);
             if (values.isEmpty()) {
@@ -1109,4 +1125,120 @@ public void workOrdersAreListedNewestDueFirst() throws Exception {
         assertTrue(r.text(), r.text().indexOf("wo2") < r.text().indexOf("wo1"));
         assertTrue(r.text(), r.text().contains("new hire"));
     }
+
+    // ---- G14 work orders, G8 templates read live -------------------------------------------------
+
+    private static final String WO_DRIVER = "cn=Work Orders," + DS_DN;
+    private static final String WO_CONTAINER = "ou=WorkOrders,o=data";
+
+    /** A Work Order driver whose container GCV is in slash form, and the levels it resolves through. */
+    private static FakeEngine workOrderVault(String gcv) {
+        FakeEngine fake = new FakeEngine();
+        Vault.Entry drv = FakeEngine.entry(WO_DRIVER, "Work Orders", List.of("Top", "DirXML-Driver"));
+        FakeEngine.put(drv, "DirXML-JavaModule", List.of(Operate.WORK_ORDER_SHIM));
+        if (gcv != null) {
+            FakeEngine.put(drv, "DirXML-ConfigValues", List.of("<configuration-values><definitions><definition dn-space=\"dirxml\" dn-type=\"slash\" name=\"idv.workorder.container\" type=\"dn\"><value>" + gcv + "</value></definition></definitions></configuration-values>"));
+        }
+        fake.entries.put(WO_DRIVER, drv);
+        fake.entries.put(DS_DN, FakeEngine.entry(DS_DN, "driverset1", List.of("Top", "DirXML-DriverSet")));
+        fake.searches.put("(DirXML-JavaModule=" + Operate.WORK_ORDER_SHIM + ")", List.of(drv));
+        Vault.Entry data = FakeEngine.entry("o=data", null, List.of("Top", "Organization"));
+        Vault.Entry wo = FakeEngine.entry(WO_CONTAINER, null, List.of("Top", "organizationalUnit"));
+        fake.entries.put(WO_CONTAINER, wo);
+        fake.searches.put("(|(o=data)(ou=data)(cn=data)(dc=data)(c=data)(l=data))", List.of(data));
+        fake.searches.put("(|(o=WorkOrders)(ou=WorkOrders)(cn=WorkOrders)(dc=WorkOrders)(c=WorkOrders)(l=WorkOrders))", List.of(wo));
+        return fake;
+    }
+
+    @Test
+    public void theWorkOrderContainerComesFromTheGcvInSlashForm() throws Exception {
+        Environments.Environment env = env("dev", Environments.Tier.DEV);
+        assertEquals(List.of(WO_CONTAINER), Operate.workOrderContainers(workOrderVault("data\\WorkOrders"), env));
+        assertEquals("a leading tree name is skipped", List.of(WO_CONTAINER), Operate.workOrderContainers(workOrderVault("\\TREE\\data\\WorkOrders"), env));
+        assertEquals("an LDAP DN is taken as it is", List.of("ou=x,o=data"), Operate.workOrderContainers(workOrderVault("ou=x,o=data"), env));
+        assertEquals("no GCV: the driver itself, NetIQ's suggested container", List.of(WO_DRIVER), Operate.workOrderContainers(workOrderVault(null), env));
+        assertEquals("no Work Order driver", List.of(), Operate.workOrderContainers(new FakeEngine(), env));
+
+        // NOVLWOBASE installs the GCV in a GCV object linked to the driver (policy set 14), not in the driver's own values
+        FakeEngine linked = workOrderVault(null);
+        String gcvs = "cn=NOVLWOBASE-GCVs," + WO_DRIVER;
+        Vault.Entry g = FakeEngine.entry(gcvs, "NOVLWOBASE-GCVs", List.of("Top", "DirXML-GlobalConfigDef"));
+        FakeEngine.put(g, "DirXML-ConfigValues", List.of("<configuration-values><definitions><definition name=\"idv.workorder.container\" type=\"dn\">"
+            + "<value>data\\WorkOrders</value></definition></definitions></configuration-values>"));
+        linked.entries.put(gcvs, g);
+        FakeEngine.put(linked.entries.get(WO_DRIVER), "DirXML-Policies", List.of(gcvs + "#0#14"));
+        assertEquals("from the linked GCV object", List.of(WO_CONTAINER), Operate.workOrderContainers(linked, env));
+    }
+
+    @Test
+    public void aWorkOrderIsCreatedChangedAndDeleted() throws Exception {
+        Path tree = Files.createTempDirectory("wo-tree");
+        Environments.Environment env = env("dev", Environments.Tier.DEV);
+        FakeEngine fake = workOrderVault("data\\WorkOrders");
+        Map<String, String> fields = new LinkedHashMap<>(Map.of("due", "2026-12-31T23:59:00Z", "description", "new hire", "content", "<add-user/>"));
+        Operate.Result made = Operate.workOrderCreate(fake, env, null, "wo1", fields, null, true, null, tree);
+        assertTrue(made.text(), made.ok);
+        Vault.Entry wo = fake.entries.get("cn=wo1," + WO_CONTAINER);
+        assertEquals("pending, as a new one is", "pending", wo.string("DirXML-nwoStatus"));
+        assertEquals("no repeat unless given", "0", wo.string("DirXML-nwoRepeatInterval"));
+        assertEquals("20261231235900Z", wo.string("DirXML-DueDate"));
+        assertNull(wo.string("DirXML-nwoDoItNowFlag"));
+        assertEquals("<add-user/>", wo.string("DirXML-nwoContent"));
+        assertTrue(wo.hasClass("DirXML-WorkOrder"));
+        assertFalse("not twice", Operate.workOrderCreate(fake, env, null, "wo1", fields, null, true, null, tree).ok);
+
+        assertFalse(Operate.workOrderCreate(fake, env, null, "bad", Map.of("status", "configured"), null, true, null, tree).ok);
+        assertFalse(Operate.workOrderCreate(fake, env, null, "bad", Map.of("repeat-minutes", "-5"), null, true, null, tree).ok);
+        assertFalse(Operate.workOrderCreate(fake, env, null, "bad", Map.of("due", "next tuesday"), null, true, null, tree).ok);
+        assertFalse(Operate.workOrderCreate(fake, env, null, "bad", Map.of(), List.of("cn=nope," + WO_CONTAINER), true, null, tree).ok);
+
+        // do it now: the flag, and no due date; a dependent; a cleared description
+        Operate.Result set = Operate.workOrderSet(fake, env, "cn=wo1," + WO_CONTAINER,
+            new LinkedHashMap<>(Map.of("due", "now", "description", "", "status", "onhold", "repeat-minutes", "1440")), List.of(WO_CONTAINER), true, null, tree);
+        assertTrue(set.text(), set.ok);
+        assertNull(wo.string("DirXML-DueDate"));
+        assertEquals("TRUE", wo.string("DirXML-nwoDoItNowFlag"));
+        assertNull(wo.string("description"));
+        assertEquals("onhold", wo.string("DirXML-nwoStatus"));
+        assertEquals("1440", wo.string("DirXML-nwoRepeatInterval"));
+        assertEquals(List.of(WO_CONTAINER), wo.strings("DirXML-nwoDependentWorkOrder"));
+
+        fake.searches.put("(objectClass=DirXML-WorkOrder)", List.of(wo));
+        Operate.Result list = Operate.workOrders(fake, env, null, 200);
+        assertTrue(list.text(), list.text().startsWith("1 work order(s) under " + WO_CONTAINER));
+        assertTrue(list.json(), list.json().contains("\"now\":true") && list.json().contains("\"status\":\"onhold\""));
+        assertTrue(Operate.workOrderShow(fake, env, "cn=wo1," + WO_CONTAINER).text().contains("1440"));
+        assertFalse(Operate.workOrderShow(fake, env, WO_DRIVER).ok);
+
+        assertTrue(Operate.workOrderDelete(fake, env, "cn=wo1," + WO_CONTAINER, true, null, tree).ok);
+        assertEquals(List.of("cn=wo1," + WO_CONTAINER), fake.deletedDns);
+        String log = Files.readString(DeployLog.file(tree, "dev"));
+        assertTrue(log, log.contains("workorder.create") && log.contains("workorder.set") && log.contains("workorder.delete"));
+    }
+
+    @Test
+    public void templatesAreListedAndShownAsTheVaultHoldsThem() throws Exception {
+        FakeEngine fake = new FakeEngine();
+        String coll = "cn=Default Notification Collection,cn=Security";
+        Vault.Entry c = FakeEngine.entry(coll, "Default Notification Collection", List.of("Top", "notfTemplateCollection"));
+        fake.searches.put("(objectClass=notfTemplateCollection)", List.of(c));
+        Vault.Entry t = FakeEngine.entry("cn=Welcome," + coll, "Welcome", List.of("Top", "notfMergeTemplate"));
+        FakeEngine.put(t, "notfMergeTemplateSubject", List.of("Hello $FirstName$"));
+        FakeEngine.put(t, "notfMergeTemplateData", List.of("<html xmlns:form=\"http://www.novell.com/dirxml/workflow/form\"><form:token-descriptions/><body><p>Dear <b>$FirstName$</b>,<br/>see $URL$</p></body></html>"));
+        FakeEngine.put(t, "DirXML-pkgGUID", List.of("ABC"));
+        Vault.Entry broken = FakeEngine.entry("cn=Broken," + coll, "Broken", List.of("Top", "notfMergeTemplate"));
+        FakeEngine.put(broken, "notfMergeTemplateData", List.of("<p>not closed"));
+        fake.entries.put(t.dn, t);
+        fake.entries.put(broken.dn, broken);
+        fake.searches.put("(objectClass=notfMergeTemplate)", List.of(t, broken));
+        Environments.Environment env = env("dev", Environments.Tier.DEV);
+        Operate.Result list = Operate.templateList(fake, env);
+        assertTrue(list.text(), list.ok && list.text().startsWith("2 template(s)"));
+        assertTrue(list.json(), list.json().contains("\"packaged\":true"));
+        Operate.Result show = Operate.templateShow(fake, env, "Welcome");
+        assertTrue(show.json(), show.json().contains("\"tokens\":[\"FirstName\",\"URL\"]") && show.json().contains("\"readable\":true"));
+        assertTrue(Operate.templateShow(fake, env, "Broken").json().contains("\"readable\":false"));
+        assertFalse(Operate.templateShow(fake, env, "Nope").ok);
+    }
+
 }
diff --git a/src/test/java/com/pointblue/dirxml/dev/xml/CanonicalXmlTest.java b/src/test/java/com/pointblue/dirxml/dev/xml/CanonicalXmlTest.java
index 5f677aef..3130555b 100644
--- a/src/test/java/com/pointblue/dirxml/dev/xml/CanonicalXmlTest.java
+++ b/src/test/java/com/pointblue/dirxml/dev/xml/CanonicalXmlTest.java
@@ -182,4 +182,14 @@ public void novellDomProducesTheSameCanonicalOutputAsTheJdkDom() {
 
         assertEquals(CanonicalXml.serialize(jdkDoc), CanonicalXml.serialize(novellDoc));
     }
+
+    @Test
+    public void theCanonicalFormKeepsATemplatesText() {
+        // what a deploy writes: element-only whitespace re-indented, the text inside an element as it was
+        String body = "<?xml version=\"1.0\" encoding=\"UTF-8\"?><html xmlns:form=\"http://www.novell.com/dirxml/workflow/form\">\n\t<form:token-descriptions/>\n\t<body>\n"
+            + "\t\t<p>Hi <b>$Name$</b><i>!</i><br/>\n\t\t\tLine two &amp; more\n\t\t</p>\n\t\t<pre>  kept\n    as is</pre>\n\t</body>\n</html>";
+        String out = CanonicalXml.canonicalize(body);
+        assertTrue(out, out.contains("<p>Hi <b>$Name$</b><i>!</i><br/>\n\t\t\tLine two &amp; more\n\t\t</p>"));
+        assertTrue(out, out.contains("<pre>  kept\n    as is</pre>"));
+    }
 }