diff --git a/backend/fluksio/sdk/cli.py b/backend/fluksio/sdk/cli.py
index bc18d3b..26c5f0c 100644
--- a/backend/fluksio/sdk/cli.py
+++ b/backend/fluksio/sdk/cli.py
@@ -644,8 +644,8 @@ def cmd_run(args: argparse.Namespace, rest: list[str]) -> int:
 # Status
 #
 # The home screen's top half, in a terminal: how the engine is, what each flow
-# is doing, and what failed recently. Drawn with rich, which is already here
-# under fastapi's own CLI.
+# is doing, and what failed recently. Drawn with rich, which is what the serve
+# dashboard renders this same group into.
 # ---------------------------------------------------------------------------
 
 
diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index 7158390..a25dfbf 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -21,25 +21,45 @@ classifiers = [
     "Topic :: Scientific/Engineering",
     "Topic :: System :: Distributed Computing",
 ]
+# Named because this code imports them. Four of them — python-multipart,
+# email-validator, jinja2 and httpx — also arrive inside `fastapi[standard]`,
+# so those lines look redundant and install nothing extra; they are here so a
+# direct import does not rest on somebody else's extra keeping its contents.
 dependencies = [
     "fastapi[standard]<1.0.0,>=0.114.2",
-    "python-multipart<1.0.0,>=0.0.7",
-    "email-validator<3.0.0.0,>=2.1.0.post1",
     "pydantic>2.0",
-    "jinja2<4.0.0,>=3.1.4",
+    "pydantic-settings<3.0.0,>=2.2.1",
+    "sqlmodel<1.0.0,>=0.0.21",
     "alembic<2.0.0,>=1.12.1",
     "httpx<1.0.0,>=0.25.1",
-    "sqlmodel<1.0.0,>=0.0.21",
-    "pydantic-settings<3.0.0,>=2.2.1",
+    # `Form(...)` on the OAuth token endpoint, which fastapi refuses to build
+    # the route without.
+    "python-multipart<1.0.0,>=0.0.7",
+    # `EmailStr` on the user model, so it is read on every start — an address
+    # is what a user is identified by, whether or not mail is ever sent. The
+    # sending itself is the `server` extra.
+    "email-validator<3.0.0.0,>=2.1.0.post1",
+    # Only the mail templates use it, and only after `send_email` — but it
+    # comes with `fastapi[standard]` either way, so an extra would move a line
+    # rather than a package.
+    "jinja2<4.0.0,>=3.1.4",
+    # Sessions, the secrets file, and the keypair an agent's token is signed
+    # with.
     "pyjwt<3.0.0,>=2.8.0",
     "pwdlib[argon2,bcrypt]>=0.3.0",
-    "numpy>=2.2.6",
+    "cryptography>=44.0.0",
+    # The state store and the work queue, and what a panel's config is read
+    # through.
     "redis>=7.1.0",
     # Every message costs a round trip's worth of encode and decode — state,
     # the journal, the worker pipe. Engine-side only: `fluksio-worker` is
     # copied onto other people's machines and stays dependency-free.
     "orjson>=3.10",
-    "cryptography>=44.0.0",
+    # The `mlp` node, which is registered at boot. Kept out of the extras
+    # because a data-science environment has it already.
+    "numpy>=2.2.6",
+    # The `inject` node's cron. Imported where it is used, behind a message
+    # that cannot fire while this line is here.
     "croniter>=1.3.0",
     "mcp>=1.29,<2",
     "fluksio-worker>=0.1,<0.2",
@@ -47,11 +67,10 @@ dependencies = [
     # the user's own. Present in the image; a pip install would otherwise have
     # to find one on PATH, and quietly fall back to the engine's interpreter.
     "uv>=0.5",
-    # `fluksio status` draws with it. Already here underneath fastapi's CLI,
-    # named because a command that depends on it should say so.
+    # `fluksio status` draws with it, and textual is built on it — named
+    # anyway, because a command that imports it should say so.
     "rich>=13",
-    # `fluksio serve` opens a dashboard with it at a terminal. Pure python and
-    # mostly rich underneath, which is already here.
+    # `fluksio serve` opens a dashboard with it at a terminal.
     "textual>=1.0",
 ]