# 
# 
# add_file "vocab_cast.hh"
#  content [cdf5c8043fbdcfdd6be9e4d14191c1b977fdb798]
# 
# patch "app_state.cc"
#  from [f822fba65f5a53f435ed83ce59890f0a0853e04d]
#    to [535224378d20deda9c44610599206018412c2929]
# 
# patch "automate.cc"
#  from [9744e787de2a1cb295eba30ce082b6c58949f4c5]
#    to [7cf37fae78b775f64ac0d63ec1bd36d203357936]
# 
# patch "cert.cc"
#  from [e86e9223c584511c756093339a13de5ad80f64c1]
#    to [d1e372169720b4019e26e30f735d724205228027]
# 
# patch "cert.hh"
#  from [27ebea1da11b533c812ef27b1b8263098523c636]
#    to [b20ae36eddabf64a73a7c90d00cfce219a880a42]
# 
# patch "cmd_key_cert.cc"
#  from [3b5637f1674cfffbf1048bde42f666da7c3163db]
#    to [2dc4128b1f916d2fdaa990f3e8d324774f52d1b3]
# 
# patch "cmd_list.cc"
#  from [5a80aa9fb82b10d989597d3b3c1b9177f8725073]
#    to [32379aca6b212b98988604dc1aa1fce4594345a7]
# 
# patch "cmd_merging.cc"
#  from [4d2247118dc8e6d757be9a86f8ebd4eed7322322]
#    to [9ab60698531667923015ebaa59b536c18de3350f]
# 
# patch "cmd_netsync.cc"
#  from [fbea616c4f033670253d7e91d963e9c35e6b2924]
#    to [f0a73af0909b03372b8c96bad5647e3bddff17ac]
# 
# patch "cmd_ws_commit.cc"
#  from [8d1fcea9995a4ec8b88e26fcb5bf138531939884]
#    to [872a33692067d30d5861be0615b8643691f6be78]
# 
# patch "commands.cc"
#  from [a15a57664c8a134a2ba174826d805cd4fc5b848c]
#    to [ccae8a0a37eb7eceab3cd4586e22e3660ddef9ee]
# 
# patch "database.cc"
#  from [cac4ab9d4b50bd45c5888e84619bc6f342570367]
#    to [fed4a1460ddef1784907fbce73c0aa67b262683a]
# 
# patch "globish.cc"
#  from [85d971be4e285160674cbb8cd1ae6e948f433037]
#    to [316d1da34877cb89cb11ea55741be9343c476ff6]
# 
# patch "globish.hh"
#  from [0cc1789ca486ca25778d7c88b5e935c916503091]
#    to [a09c59d14a2425049d00b50a963e22543939c366]
# 
# patch "key_store.cc"
#  from [271e3ecac273faa7a7d0957037dde742875c323a]
#    to [647396cd291637e0c1d4c2465ca372f19a5762a3]
# 
# patch "lua.cc"
#  from [2f678713385631c4ca9782e9b767651d2f26ab21]
#    to [a86b67e6ece4d5e661bbfd6f0c439e3fc8a69f7c]
# 
# patch "lua_hooks.cc"
#  from [1f41837fe4b656f8455b5abb327c21f65b41d3f2]
#    to [02a923f2e6c785ccc218a67ba83acbbbc04a179b]
# 
# patch "lua_hooks.hh"
#  from [d1b989184b673d8a9f2082b58ae3bd0a9f38b717]
#    to [3136f049c267df992198a278d5e71ee0ee687562]
# 
# patch "luaext_globish.cc"
#  from [cbce64612aa5d0ca8542dcb10d54c6839d839d79]
#    to [72dd38c8bfcd89d9af8bb2a9a3562867f97175c0]
# 
# patch "netcmd.cc"
#  from [aa9c61e301fc6c077007dd9008f49765f839ff81]
#    to [f5c66fabed53103434a5e728525b7c8414f6736d]
# 
# patch "netcmd.hh"
#  from [c8c14900e822a49270dfa3da37a2fc44323f66e6]
#    to [51ac9116aaec71bcb8ecd7baaa0885cda65dcf90]
# 
# patch "netsync.cc"
#  from [6e345e2b5623d96d05acc870dcbbfb21850fa677]
#    to [92e2302554f48a5a6fdee6bb42cba24f22152c97]
# 
# patch "netsync.hh"
#  from [510ac1917bd6aa7a2ec21c7e9d709305268169a3]
#    to [2a4d8e88f8774f885470a658ba101a06bc403eeb]
# 
# patch "options_list.hh"
#  from [bdf99561b7ca94bcf196ca26b8d192d8d74f1492]
#    to [e6bc6c91be2105a71eca5cdcfa79b1deca8d2ec3]
# 
# patch "project.cc"
#  from [3a69d5eebcacb3ab5625a49dc98edf9979e7b46c]
#    to [bad2c3f0707a4510e2790baaffe6cace0587ebf9]
# 
# patch "project.hh"
#  from [3a2f56c73b1467f8c3b8c6be8800f741d3a7430e]
#    to [e240ddb603a1c6f453816264803987ad655cd2c7]
# 
# patch "rcs_import.cc"
#  from [06415479a87c0d212fade497f1fb982283e0d83d]
#    to [625106ea8f4aa1fbfdcd16df5ba3d088c065b408]
# 
# patch "update.cc"
#  from [7bb7a4e2ae0cb21eae4aaa90c4d0c749d68db69b]
#    to [51b3d312313c0d4dd25fc43b3bdaaef1c299a928]
# 
# patch "vocab_terms.hh"
#  from [fbe8c7a60365939a2813a58765ae37a70d48e66d]
#    to [bb5a992fb126662ed70bb7f41560f77615164e69]
# 
# patch "work.cc"
#  from [7e91a9216deab1463fde0f8193c2384909199193]
#    to [7141e5e50d9e81e4a8aea4137c0411ead01cb9a1]
# 
# patch "work.hh"
#  from [9df251792aff86d3c0b54838e1c888459768c6db]
#    to [5515f5af71490b7fd5ffc7e0d64f712df5b72a27]
# 
============================================================
--- vocab_cast.hh	cdf5c8043fbdcfdd6be9e4d14191c1b977fdb798
+++ vocab_cast.hh	cdf5c8043fbdcfdd6be9e4d14191c1b977fdb798
@@ -0,0 +1,44 @@
+#ifndef __VOCAB_CAST_HH
+#define __VOCAB_CAST_HH
+
+#include <algorithm>
+
+// You probably won't use this yourself, but it's needed by...
+template<typename From, typename To>
+To typecast_vocab(From const & from)
+{ return To(from()); }
+
+// There are a few places where we want to typecast an entire
+// container full of vocab types.
+template<typename From, typename To>
+void typecast_vocab_container(From const & from, To & to)
+{
+  std::transform(from.begin(), from.end(), std::inserter(to, to.end()),
+		 &typecast_vocab<typename From::value_type,
+		 typename To::value_type>);
+}
+
+// You won't use this directly either.
+template<typename From, typename To>
+To add_decoration(From const & from)
+{
+  return To(from);
+}
+
+// There are also some places that want to decorate a container full
+// of vocab types.
+template<typename From, typename To>
+void add_decoration_to_container(From const & from, To & to)
+{
+  std::transform(from.begin(), from.end(), std::inserter(to, to.end()),
+		 &add_decoration<typename From::value_type,
+		 typename To::value_type>);
+}
+
+template<typename From, typename To>
+void vocabify_container(From const & from, To & to)
+{
+  add_decoration_to_container(from, to);
+}
+
+#endif
============================================================
--- app_state.cc	f822fba65f5a53f435ed83ce59890f0a0853e04d
+++ app_state.cc	535224378d20deda9c44610599206018412c2929
@@ -77,7 +77,10 @@ app_state::process_options()
 void
 app_state::process_options()
 {
-  utf8 database_option, branch_option, key_option, keydir_option;
+  system_path database_option;
+  branch_name branch_option;
+  rsa_keypair_id key_option;
+  system_path keydir_option;
 
   if (!found_workspace)
     return;
@@ -87,37 +90,41 @@ app_state::process_options()
                       key_option, keydir_option);
 
   // Workspace options are not to override the command line.
-  if (db.get_filename().as_internal().empty() && !database_option().empty())
-    db.set_filename(system_path(database_option));
+  if (db.get_filename().as_internal().empty() && !database_option.as_internal().empty())
+    db.set_filename(database_option);
 
-  if (keys.get_key_dir().as_internal().empty() && !keydir_option().empty())
-    set_key_dir(system_path(keydir_option));
+  if (keys.get_key_dir().as_internal().empty() && !keydir_option.as_internal().empty())
+    set_key_dir(keydir_option);
 
-  if (opts.branch_name().empty() && !branch_option().empty())
+  if (opts.branchname().empty() && !branch_option().empty())
     {
-      opts.branch_name = branch_option;
+      opts.branchname = branch_option;
       branch_is_sticky = true;
     }
 
-  L(FL("branch name is '%s'") % opts.branch_name);
+  L(FL("branch name is '%s'") % opts.branchname);
 
   if (!opts.key_given)
-    internalize_rsa_keypair_id(key_option, opts.signing_key);
+    opts.signing_key = key_option;
 }
 
 void
 app_state::write_options()
 {
-  utf8 database_option, branch_option, key_option, keydir_option;
+  system_path database_option;
+  branch_name branch_option;
+  rsa_keypair_id key_option;
+  system_path keydir_option;
 
-  database_option = utf8(db.get_filename().as_internal());
-  keydir_option = utf8(keys.get_key_dir().as_internal());
+  database_option = db.get_filename();
+  keydir_option = keys.get_key_dir();
 
   if (branch_is_sticky)
-    branch_option = opts.branch_name;
+    branch_option = opts.branchname;
 
   if (opts.key_given)
-    externalize_rsa_keypair_id(opts.signing_key, key_option);
+    key_option = opts.signing_key;
+
   work.set_ws_options(database_option, branch_option,
                       key_option, keydir_option);
 }
============================================================
--- automate.cc	9744e787de2a1cb295eba30ce082b6c58949f4c5
+++ automate.cc	7cf37fae78b775f64ac0d63ec1bd36d203357936
@@ -67,10 +67,10 @@ AUTOMATE(heads, N_("[BRANCH]"), options:
 
   if (args.size() ==1 ) {
     // branchname was explicitly given, use that
-    app.opts.branch_name = idx(args, 0);
+    app.opts.branchname = branch_name(idx(args, 0)());
   }
   set<revision_id> heads;
-  app.get_project().get_branch_heads(app.opts.branch_name, heads);
+  app.get_project().get_branch_heads(app.opts.branchname, heads);
   for (set<revision_id>::const_iterator i = heads.begin(); i != heads.end(); ++i)
     output << (*i).inner()() << "\n";
 }
@@ -1267,14 +1267,14 @@ AUTOMATE(branches, "", options::opts::no
   N(args.size() == 0,
     F("no arguments needed"));
 
-  set<utf8> names;
+  set<branch_name> names;
 
   app.get_project().get_branch_list(names);
 
-  for (set<utf8>::const_iterator i = names.begin();
+  for (set<branch_name>::const_iterator i = names.begin();
        i != names.end(); ++i)
     {
-      if (!app.lua.hook_ignore_branch((*i)()))
+      if (!app.lua.hook_ignore_branch(*i))
         output << (*i) << "\n";
     }
 }
@@ -1316,15 +1316,15 @@ AUTOMATE(tags, N_("[BRANCH_PATTERN]"), o
   N(args.size() < 2,
     F("wrong argument count"));
 
-  utf8 incl("*");
+  globish incl("*");
   bool filtering(false);
   
   if (args.size() == 1) {
-    incl = idx(args, 0);
+    incl = globish(idx(args, 0)());
     filtering = true;
   }
 
-  globish_matcher match(incl, utf8());
+  globish_matcher match(incl, globish());
   basic_io::printer prt;
   basic_io::stanza stz;
   stz.push_str_pair(symbol("format_version"), "1");
@@ -1336,16 +1336,16 @@ AUTOMATE(tags, N_("[BRANCH_PATTERN]"), o
   for (set<tag_t>::const_iterator tag = tags.begin();
        tag != tags.end(); ++tag)
     {
-      set<utf8> branches;
+      set<branch_name> branches;
       app.get_project().get_revision_branches(tag->ident, branches);
     
       bool show(!filtering);
       vector<string> branch_names;
 
-      for (set<utf8>::const_iterator branch = branches.begin();
+      for (set<branch_name>::const_iterator branch = branches.begin();
            branch != branches.end(); ++branch)
         {
-          if (app.lua.hook_ignore_branch((*branch)()))
+          if (app.lua.hook_ignore_branch(*branch))
             continue;
       
           if (!show && match((*branch)()))
@@ -1468,7 +1468,10 @@ AUTOMATE(get_option, N_("OPTION"), optio
   // this command requires a workspace to be run on
   app.require_workspace();
 
-  utf8 database_option, branch_option, key_option, keydir_option;
+  system_path database_option;
+  branch_name branch_option;
+  rsa_keypair_id key_option;
+  system_path keydir_option;
   app.work.get_ws_options(database_option, branch_option,
                           key_option, keydir_option);
 
============================================================
--- cert.cc	e86e9223c584511c756093339a13de5ad80f64c1
+++ cert.cc	d1e372169720b4019e26e30f735d724205228027
@@ -456,7 +456,7 @@ get_user_key(rsa_keypair_id & key, app_s
       return;
     }
 
-  if (app.lua.hook_get_branch_key(app.opts.branch_name, key))
+  if (app.lua.hook_get_branch_key(app.opts.branchname, key))
     return;
 
   vector<rsa_keypair_id> all_privkeys;
@@ -474,17 +474,17 @@ void
 // APP may override.  Branch name is returned in BRANCHNAME.
 // Does not modify branch state in APP.
 void
-guess_branch(revision_id const & ident, app_state & app, utf8 & branchname)
+guess_branch(revision_id const & ident, app_state & app, branch_name & branchname)
 {
-  if (app.opts.branch_given && !app.opts.branch_name().empty())
-    branchname = app.opts.branch_name;
+  if (app.opts.branch_given && !app.opts.branchname().empty())
+    branchname = app.opts.branchname;
   else
     {
       N(!ident.inner()().empty(),
         F("no branch found for empty revision, "
           "please provide a branch name"));
 
-      set<utf8> branches;
+      set<branch_name> branches;
       app.get_project().get_revision_branches(ident, branches);
 
       N(branches.size() != 0,
@@ -495,7 +495,7 @@ guess_branch(revision_id const & ident, 
         F("multiple branch certs found for revision %s, "
           "please provide a branch name") % ident);
 
-      set<utf8>::iterator i = branches.begin();
+      set<branch_name>::iterator i = branches.begin();
       I(i != branches.end());
       branchname = *i;
     }
@@ -505,9 +505,9 @@ guess_branch(revision_id const & ident, 
 void
 guess_branch(revision_id const & ident, app_state & app)
 {
-  utf8 branchname;
+  branch_name branchname;
   guess_branch(ident, app, branchname);
-  app.opts.branch_name = branchname;
+  app.opts.branchname = branchname;
 }
 
 void
@@ -607,7 +607,7 @@ cert_revision_author_default(revision_id
                              packet_consumer & pc)
 {
   string author;
-  if (!app.lua.hook_get_author(app.opts.branch_name, author))
+  if (!app.lua.hook_get_author(app.opts.branchname, author))
     {
       rsa_keypair_id key;
       get_user_key(key, app),
============================================================
--- cert.hh	27ebea1da11b533c812ef27b1b8263098523c636
+++ cert.hh	b20ae36eddabf64a73a7c90d00cfce219a880a42
@@ -111,7 +111,7 @@ void
 get_user_key(rsa_keypair_id & key, app_state & app);
 
 void
-guess_branch(revision_id const & id, app_state & app, utf8 & branchname);
+guess_branch(revision_id const & id, app_state & app, branch_name & branchname);
 void
 guess_branch(revision_id const & id, app_state & app);
 
============================================================
--- cmd_key_cert.cc	3b5637f1674cfffbf1048bde42f666da7c3163db
+++ cmd_key_cert.cc	2dc4128b1f916d2fdaa990f3e8d324774f52d1b3
@@ -222,8 +222,8 @@ CMD(approve, N_("review"), N_("REVISION"
   complete(app, idx(args, 0)(), r);
   packet_db_writer dbw(app);
   guess_branch(r, app);
-  N(app.opts.branch_name() != "", F("need --branch argument for approval"));
-  app.get_project().put_revision_in_branch(r, app.opts.branch_name, dbw);
+  N(app.opts.branchname() != "", F("need --branch argument for approval"));
+  app.get_project().put_revision_in_branch(r, app.opts.branchname, dbw);
 }
 
 CMD(comment, N_("review"), N_("REVISION [COMMENT]"),
============================================================
--- cmd_list.cc	5a80aa9fb82b10d989597d3b3c1b9177f8725073
+++ cmd_list.cc	32379aca6b212b98988604dc1aa1fce4594345a7
@@ -25,6 +25,7 @@
 #include "simplestring_xform.hh"
 #include "transforms.hh"
 #include "ui.hh"
+#include "vocab_cast.hh"
 
 using std::cout;
 using std::endl;
@@ -234,21 +235,23 @@ ls_branches(string name, app_state & app
 static void
 ls_branches(string name, app_state & app, vector<utf8> const & args)
 {
-  utf8 inc("*");
-  utf8 exc;
+  globish inc("*");
+  globish exc;
   if (args.size() == 1)
-    inc = idx(args,0);
+    inc = globish(idx(args,0)());
   else if (args.size() > 1)
     throw usage(name);
-  combine_and_check_globish(app.opts.exclude_patterns, exc);
+  vector<globish> excludes;
+  typecast_vocab_container(app.opts.exclude_patterns, excludes);
+  combine_and_check_globish(excludes, exc);
   globish_matcher match(inc, exc);
-  set<utf8> names;
+  set<branch_name> names;
   app.get_project().get_branch_list(names);
 
-  for (set<utf8>::const_iterator i = names.begin();
+  for (set<branch_name>::const_iterator i = names.begin();
        i != names.end(); ++i)
     {
-      if (match((*i)()) && !app.lua.hook_ignore_branch((*i)()))
+      if (match((*i)()) && !app.lua.hook_ignore_branch(*i))
         {
           cout << *i << "\n";
         }
============================================================
--- cmd_merging.cc	4d2247118dc8e6d757be9a86f8ebd4eed7322322
+++ cmd_merging.cc	9ab60698531667923015ebaa59b536c18de3350f
@@ -80,18 +80,18 @@ pick_branch_for_update(revision_id chose
   app.db.get_revision_certs(chosen_rid, branch_cert_name, certs);
   erase_bogus_certs(certs, app);
 
-  set< utf8 > branches;
+  set< branch_name > branches;
   for (vector< revision<cert> >::const_iterator i = certs.begin();
        i != certs.end(); i++)
     {
       cert_value b;
       decode_base64(i->inner().value, b);
-      branches.insert(utf8(b()));
+      branches.insert(branch_name(b()));
     }
 
-  if (branches.find(app.opts.branch_name) != branches.end())
+  if (branches.find(app.opts.branchname) != branches.end())
     {
-      L(FL("using existing branch %s") % app.opts.branch_name());
+      L(FL("using existing branch %s") % app.opts.branchname());
     }
   else
     {
@@ -100,7 +100,7 @@ pick_branch_for_update(revision_id chose
         {
           // multiple non-matching branchnames
           string branch_list;
-          for (set<utf8>::const_iterator i = branches.begin();
+          for (set<branch_name>::const_iterator i = branches.begin();
                i != branches.end(); i++)
             branch_list += "\n  " + (*i)();
           N(false, F("target revision is in multiple branches:%s\n\n"
@@ -109,7 +109,7 @@ pick_branch_for_update(revision_id chose
       else if (branches.size() == 1)
         {
           // one non-matching, inform and update
-          app.opts.branch_name = *(branches.begin());
+          app.opts.branchname = *(branches.begin());
           switched_branch = true;
         }
       else
@@ -117,7 +117,7 @@ pick_branch_for_update(revision_id chose
           I(branches.size() == 0);
           W(F("target revision not in any branch\n"
               "next commit will use branch %s")
-            % app.opts.branch_name);
+            % app.opts.branchname);
         }
     }
   return switched_branch;
@@ -155,14 +155,14 @@ CMD(update, N_("workspace"), "",
   revision_id chosen_rid;
   if (app.opts.revision_selectors.size() == 0)
     {
-      P(F("updating along branch '%s'") % app.opts.branch_name);
+      P(F("updating along branch '%s'") % app.opts.branchname);
       set<revision_id> candidates;
       pick_update_candidates(old_rid, app, candidates);
       N(!candidates.empty(),
         F("your request matches no descendents of the current revision\n"
           "in fact, it doesn't even match the current revision\n"
           "maybe you want something like --revision=h:%s")
-        % app.opts.branch_name);
+        % app.opts.branchname);
       if (candidates.size() != 1)
         {
           P(F("multiple update candidates:"));
@@ -192,7 +192,7 @@ CMD(update, N_("workspace"), "",
       P(F("already up to date at %s") % old_rid);
       // do still switch the workspace branch, in case they have used
       // update to switch branches.
-      if (!app.opts.branch_name().empty())
+      if (!app.opts.branchname().empty())
         app.make_branch_sticky();
       return;
     }
@@ -203,7 +203,7 @@ CMD(update, N_("workspace"), "",
   // wants.
   bool switched_branch = pick_branch_for_update(chosen_rid, app);
   if (switched_branch)
-    P(F("switching to branch %s") % app.opts.branch_name());
+    P(F("switching to branch %s") % app.opts.branchname());
 
   // Okay, we have a target, we have a branch, let's do this merge!
 
@@ -268,10 +268,10 @@ CMD(update, N_("workspace"), "",
   app.work.update_any_attrs();
   app.work.maybe_update_inodeprints();
 
-  if (!app.opts.branch_name().empty())
+  if (!app.opts.branchname().empty())
     app.make_branch_sticky();
   if (switched_branch)
-    P(F("switched branch; next commit will use branch %s") % app.opts.branch_name());
+    P(F("switched branch; next commit will use branch %s") % app.opts.branchname());
   P(F("updated to base revision %s") % chosen_rid);
 }
 
@@ -280,7 +280,7 @@ merge_two(revision_id const & left, revi
 // bomb out, and therefore so may this.
 static void
 merge_two(revision_id const & left, revision_id const & right,
-          string const & branch, string const & caller, app_state & app)
+          branch_name const & branch, string const & caller, app_state & app)
 {
   // The following mess constructs a neatly formatted log message that looks
   // like this:
@@ -296,14 +296,14 @@ merge_two(revision_id const & left, revi
   ostringstream log;
   size_t fieldwidth = max(caller.size() + strlen(" of '"), strlen("and '"));
 
-  if (branch != app.opts.branch_name())
+  if (branch != app.opts.branchname)
     fieldwidth = max(fieldwidth, strlen("to branch '"));
 
   log << setw(fieldwidth - strlen(" of '")) << caller << " of '" << left
       << "'\n" << setw(fieldwidth) << "and '" << right
       << "'\n";
 
-  if (branch != app.opts.branch_name())
+  if (branch != app.opts.branchname)
     log << setw(fieldwidth) << "to branch '" << branch << "'\n";
 
   // Now it's time for the real work.
@@ -316,7 +316,7 @@ merge_two(revision_id const & left, revi
 
   packet_db_writer dbw(app);
   app.get_project().put_standard_certs_from_options(merged,
-                                                    utf8(branch),
+                                                    branch,
                                                     utf8(log.str()),
                                                     dbw);
 
@@ -337,21 +337,21 @@ CMD(merge, N_("tree"), "", N_("merge unm
   if (args.size() != 0)
     throw usage(name);
 
-  N(app.opts.branch_name() != "",
+  N(app.opts.branchname() != "",
     F("please specify a branch, with --branch=BRANCH"));
 
   set<revision_id> heads;
-  app.get_project().get_branch_heads(app.opts.branch_name, heads);
+  app.get_project().get_branch_heads(app.opts.branchname, heads);
 
-  N(heads.size() != 0, F("branch '%s' is empty") % app.opts.branch_name);
+  N(heads.size() != 0, F("branch '%s' is empty") % app.opts.branchname);
   if (heads.size() == 1)
     {
-      P(F("branch '%s' is already merged") % app.opts.branch_name);
+      P(F("branch '%s' is already merged") % app.opts.branchname);
       return;
     }
 
   P(FP("%d head on branch '%s'", "%d heads on branch '%s'", heads.size())
-    % heads.size() % app.opts.branch_name);
+    % heads.size() % app.opts.branchname);
 
   map<revision_id, revpair> heads_for_ancestor;
   set<revision_id> ancestors;
@@ -405,11 +405,11 @@ CMD(merge, N_("tree"), "", N_("merge unm
       // corresponding pair of heads.
       revpair p = heads_for_ancestor[*ancestors.begin()];
       
-      merge_two(p.first, p.second, app.opts.branch_name(), string("merge"), app);
+      merge_two(p.first, p.second, app.opts.branchname, string("merge"), app);
 
       ancestors.clear();
       heads_for_ancestor.clear();
-      app.get_project().get_branch_heads(app.opts.branch_name, heads);
+      app.get_project().get_branch_heads(app.opts.branchname, heads);
       pass++;
     }
 
@@ -423,7 +423,7 @@ CMD(merge, N_("tree"), "", N_("merge unm
   revision_id right = *i++;
   I(i == heads.end());
   
-  merge_two(left, right, app.opts.branch_name(), string("merge"), app);
+  merge_two(left, right, app.opts.branchname, string("merge"), app);
   P(F("note: your workspaces have not been updated"));
 }
 
@@ -474,8 +474,8 @@ CMD(merge_into_dir, N_("tree"), N_("SOUR
   if (args.size() != 3)
     throw usage(name);
 
-  app.get_project().get_branch_heads(idx(args, 0), src_heads);
-  app.get_project().get_branch_heads(idx(args, 1), dst_heads);
+  app.get_project().get_branch_heads(branch_name(idx(args, 0)()), src_heads);
+  app.get_project().get_branch_heads(branch_name(idx(args, 1)()), dst_heads);
 
   N(src_heads.size() != 0, F("branch '%s' is empty") % idx(args, 0)());
   N(src_heads.size() == 1, F("branch '%s' is not merged") % idx(args, 0)());
@@ -503,7 +503,9 @@ CMD(merge_into_dir, N_("tree"), N_("SOUR
         % (*src_i) % idx(args, 1)());
       transaction_guard guard(app.db);
       packet_db_writer dbw(app);
-      app.get_project().put_revision_in_branch(*src_i, idx(args, 1), dbw);
+      app.get_project().put_revision_in_branch(*src_i,
+                                               branch_name(idx(args, 1)()),
+                                               dbw);
       guard.commit();
     }
   else
@@ -587,9 +589,9 @@ CMD(merge_into_dir, N_("tree"), N_("SOUR
 
       packet_db_writer dbw(app);
       app.get_project().put_standard_certs_from_options(merged,
-                                                  idx(args, 1),
-                                                  log_message,
-                                                  dbw);
+                                                        branch_name(idx(args, 1)()),
+                                                        log_message,
+                                                        dbw);
 
       guard.commit();
       P(F("[merged] %s") % merged);
@@ -696,14 +698,14 @@ CMD(explicit_merge, N_("tree"),
     options::opts::date | options::opts::author)
 {
   revision_id left, right;
-  string branch;
+  branch_name branch;
 
   if (args.size() != 3)
     throw usage(name);
 
   complete(app, idx(args, 0)(), left);
   complete(app, idx(args, 1)(), right);
-  branch = idx(args, 2)();
+  branch = branch_name(idx(args, 2)());
 
   N(!(left == right),
     F("%s and %s are the same revision, aborting") % left % right);
@@ -932,17 +934,17 @@ CMD(heads, N_("tree"), "", N_("show unme
   if (args.size() != 0)
     throw usage(name);
 
-  N(app.opts.branch_name() != "",
+  N(app.opts.branchname() != "",
     F("please specify a branch, with --branch=BRANCH"));
 
-  app.get_project().get_branch_heads(app.opts.branch_name, heads);
+  app.get_project().get_branch_heads(app.opts.branchname, heads);
 
   if (heads.size() == 0)
-    P(F("branch '%s' is empty") % app.opts.branch_name);
+    P(F("branch '%s' is empty") % app.opts.branchname);
   else if (heads.size() == 1)
-    P(F("branch '%s' is currently merged:") % app.opts.branch_name);
+    P(F("branch '%s' is currently merged:") % app.opts.branchname);
   else
-    P(F("branch '%s' is currently unmerged:") % app.opts.branch_name);
+    P(F("branch '%s' is currently unmerged:") % app.opts.branchname);
 
   for (set<revision_id>::const_iterator i = heads.begin();
        i != heads.end(); ++i)
============================================================
--- cmd_netsync.cc	fbea616c4f033670253d7e91d963e9c35e6b2924
+++ cmd_netsync.cc	f0a73af0909b03372b8c96bad5647e3bddff17ac
@@ -5,6 +5,7 @@
 #include "keys.hh"
 #include "cert.hh"
 #include "uri.hh"
+#include "vocab_cast.hh"
 
 #include <fstream>
 
@@ -64,16 +65,21 @@ extract_patterns(vector<utf8> const & ar
 
 static void
 extract_patterns(vector<utf8> const & args,
-                 utf8 & include_pattern, utf8 & exclude_pattern,
+                 globish & include_pattern, globish & exclude_pattern,
                  app_state & app)
 {
   if (args.size() >= 2 || app.opts.exclude_given)
     {
       E(args.size() >= 2, F("no branch pattern given"));
       int pattern_offset = 1;
-      vector<utf8> patterns(args.begin() + pattern_offset, args.end());
+      vector<globish> patterns;
+      std::transform(args.begin() + pattern_offset, args.end(),
+                     std::inserter(patterns, patterns.end()),
+                     &typecast_vocab<utf8, globish>);
       combine_and_check_globish(patterns, include_pattern);
-      combine_and_check_globish(app.opts.exclude_patterns, exclude_pattern);
+      vector<globish> excludes;
+      typecast_vocab_container(app.opts.exclude_patterns, excludes);
+      combine_and_check_globish(excludes, exclude_pattern);
       if (!app.db.var_exists(default_include_pattern_key)
           || app.opts.set_default)
         {
@@ -93,15 +99,15 @@ extract_patterns(vector<utf8> const & ar
         F("no branch pattern given and no default pattern set"));
       var_value pattern_value;
       app.db.get_var(default_include_pattern_key, pattern_value);
-      include_pattern = utf8(pattern_value());
+      include_pattern = globish(pattern_value());
       L(FL("using default branch include pattern: '%s'") % include_pattern);
       if (app.db.var_exists(default_exclude_pattern_key))
         {
           app.db.get_var(default_exclude_pattern_key, pattern_value);
-          exclude_pattern = utf8(pattern_value());
+          exclude_pattern = globish(pattern_value());
         }
       else
-        exclude_pattern = utf8("");
+        exclude_pattern = globish();
       L(FL("excluding: %s") % exclude_pattern);
     }
 }
@@ -111,7 +117,8 @@ CMD(push, N_("network"), N_("[ADDRESS[:P
     options::opts::set_default | options::opts::exclude |
     options::opts::key_to_push)
 {
-  utf8 addr, include_pattern, exclude_pattern;
+  utf8 addr;
+  globish include_pattern, exclude_pattern;
   extract_address(args, addr, app);
   find_key_if_needed(addr, app);
   extract_patterns(args, include_pattern, exclude_pattern, app);
@@ -124,7 +131,8 @@ CMD(pull, N_("network"), N_("[ADDRESS[:P
     N_("pull branches matching PATTERN from netsync server at ADDRESS"),
     options::opts::set_default | options::opts::exclude)
 {
-  utf8 addr, include_pattern, exclude_pattern;
+  utf8 addr;
+  globish include_pattern, exclude_pattern;
   extract_address(args, addr, app);
   extract_patterns(args, include_pattern, exclude_pattern, app);
 
@@ -140,7 +148,8 @@ CMD(sync, N_("network"), N_("[ADDRESS[:P
     options::opts::set_default | options::opts::exclude |
     options::opts::key_to_push)
 {
-  utf8 addr, include_pattern, exclude_pattern;
+  utf8 addr;
+  globish include_pattern, exclude_pattern;
   extract_address(args, addr, app);
   find_key_if_needed(addr, app);
   extract_patterns(args, include_pattern, exclude_pattern, app);
@@ -210,7 +219,7 @@ CMD_NO_WORKSPACE(serve, N_("network"), "
   app.db.ensure_open();
 
   run_netsync_protocol(server_voice, source_and_sink_role, app.opts.bind_address,
-                       utf8("*"), utf8(""), app);
+                       globish("*"), globish(""), app);
 }
 
 // Local Variables:
============================================================
--- cmd_ws_commit.cc	8d1fcea9995a4ec8b88e26fcb5bf138531939884
+++ cmd_ws_commit.cc	872a33692067d30d5861be0615b8643691f6be78
@@ -226,7 +226,7 @@ CMD(disapprove, N_("review"), N_("REVISI
     F("revision %s has %d changesets, cannot invert") % r % rev.edges.size());
 
   guess_branch(r, app);
-  N(app.opts.branch_name() != "", F("need --branch argument for disapproval"));
+  N(app.opts.branchname() != "", F("need --branch argument for disapproval"));
 
   process_commit_message_args(log_message_given, log_message, app,
                               utf8((FL("disapproval of revision '%s'") % r).str()));
@@ -254,7 +254,7 @@ CMD(disapprove, N_("review"), N_("REVISI
     dbw.consume_revision_data(inv_id, rdat);
 
     app.get_project().put_standard_certs_from_options(inv_id,
-                                                      app.opts.branch_name,
+                                                      app.opts.branchname,
                                                       log_message,
                                                       dbw);
     guard.commit();
@@ -437,7 +437,7 @@ CMD(status, N_("informative"), N_("[PATH
   // We intentionally do not collapse the final \n into the format
   // strings here, for consistency with newline conventions used by most
   // other format strings.
-  cout << (F("Current branch: %s") % app.opts.branch_name).str() << "\n";
+  cout << (F("Current branch: %s") % app.opts.branchname).str() << "\n";
   for (edge_map::const_iterator i = rev.edges.begin(); i != rev.edges.end(); ++i)
     {
       revision_id parent = edge_old_revision(*i);
@@ -492,20 +492,20 @@ CMD(checkout, N_("tree"), N_("[DIRECTORY
   if (app.opts.revision_selectors.size() == 0)
     {
       // use branch head revision
-      N(!app.opts.branch_name().empty(),
+      N(!app.opts.branchname().empty(),
         F("use --revision or --branch to specify what to checkout"));
 
       set<revision_id> heads;
-      app.get_project().get_branch_heads(app.opts.branch_name, heads);
+      app.get_project().get_branch_heads(app.opts.branchname, heads);
       N(heads.size() > 0,
-        F("branch '%s' is empty") % app.opts.branch_name);
+        F("branch '%s' is empty") % app.opts.branchname);
       if (heads.size() > 1)
         {
-          P(F("branch %s has multiple heads:") % app.opts.branch_name);
+          P(F("branch %s has multiple heads:") % app.opts.branchname);
           for (set<revision_id>::const_iterator i = heads.begin(); i != heads.end(); ++i)
             P(i18n_format("  %s") % describe_revision(app, *i));
           P(F("choose one with '%s checkout -r<id>'") % ui.prog_name);
-          E(false, F("branch %s has multiple heads") % app.opts.branch_name);
+          E(false, F("branch %s has multiple heads") % app.opts.branchname);
         }
       ident = *(heads.begin());
     }
@@ -518,11 +518,11 @@ CMD(checkout, N_("tree"), N_("[DIRECTORY
 
       guess_branch(ident, app);
 
-      I(!app.opts.branch_name().empty());
+      I(!app.opts.branchname().empty());
 
-      N(app.get_project().revision_is_in_branch(ident, app.opts.branch_name),
+      N(app.get_project().revision_is_in_branch(ident, app.opts.branchname),
         F("revision %s is not a member of branch %s")
-        % ident % app.opts.branch_name);
+        % ident % app.opts.branchname);
     }
 
   // we do this part of the checking down here, because it is legitimate to
@@ -537,9 +537,9 @@ CMD(checkout, N_("tree"), N_("[DIRECTORY
     if (args.size() == 0)
       {
         // No checkout dir specified, use branch name for dir.
-        N(!app.opts.branch_name().empty(),
+        N(!app.opts.branchname().empty(),
           F("you must specify a destination directory"));
-        dir = system_path(app.opts.branch_name());
+        dir = system_path(app.opts.branchname());
       }
     else
       {
@@ -725,9 +725,9 @@ CMD(commit, N_("workspace"), N_("[PATH].
 
   // We need the 'if' because guess_branch will try to override any branch
   // picked up from _MTN/options.
-  if (app.opts.branch_name().empty())
+  if (app.opts.branchname().empty())
     {
-      utf8 branchname, bn_candidate;
+      branch_name branchname, bn_candidate;
       for (edge_map::iterator i = restricted_rev.edges.begin();
            i != restricted_rev.edges.end();
            i++)
@@ -742,11 +742,11 @@ CMD(commit, N_("workspace"), N_("[PATH].
           branchname = bn_candidate;
         }
 
-      app.opts.branch_name = branchname;
+      app.opts.branchname = branchname;
     }
 
 
-  P(F("beginning commit on branch '%s'") % app.opts.branch_name);
+  P(F("beginning commit on branch '%s'") % app.opts.branchname);
   L(FL("new manifest '%s'\n"
        "new revision '%s'\n")
     % restricted_rev.new_manifest
@@ -790,13 +790,13 @@ CMD(commit, N_("workspace"), N_("[PATH].
   revision_data new_rev;
   write_revision(restricted_rev, new_rev);
 
-  app.lua.hook_validate_commit_message(log_message, new_rev, app.opts.branch_name,
+  app.lua.hook_validate_commit_message(log_message, new_rev, app.opts.branchname,
                                        message_validated, reason);
   N(message_validated, F("log message rejected by hook: %s") % reason);
 
   // for the divergence check, below
   set<revision_id> heads;
-  app.get_project().get_branch_heads(app.opts.branch_name, heads);
+  app.get_project().get_branch_heads(app.opts.branchname, heads);
   unsigned int old_head_size = heads.size();
   
   {
@@ -883,7 +883,7 @@ CMD(commit, N_("workspace"), N_("[PATH].
       }
 
     app.get_project().put_standard_certs_from_options(restricted_rev_id,
-                                                      app.opts.branch_name,
+                                                      app.opts.branchname,
                                                       log_message,
                                                       dbw);
     guard.commit();
@@ -900,7 +900,7 @@ CMD(commit, N_("workspace"), N_("[PATH].
 
   app.work.blank_user_log();
 
-  app.get_project().get_branch_heads(app.opts.branch_name, heads);
+  app.get_project().get_branch_heads(app.opts.branchname, heads);
   if (heads.size() > old_head_size && old_head_size > 0) {
     P(F("note: this revision creates divergence\n"
         "note: you may (or may not) wish to run '%s merge'")
@@ -942,7 +942,7 @@ CMD_NO_WORKSPACE(setup, N_("tree"), N_("
   if (args.size() > 1)
     throw usage(name);
 
-  N(!app.opts.branch_name().empty(), F("need --branch argument for setup"));
+  N(!app.opts.branchname().empty(), F("need --branch argument for setup"));
   app.db.ensure_open();
 
   string dir;
@@ -981,27 +981,27 @@ CMD_NO_WORKSPACE(import, N_("tree"), N_(
 
       guess_branch(ident, app);
 
-      I(!app.opts.branch_name().empty());
+      I(!app.opts.branchname().empty());
 
-      N(app.get_project().revision_is_in_branch(ident, app.opts.branch_name),
+      N(app.get_project().revision_is_in_branch(ident, app.opts.branchname),
         F("revision %s is not a member of branch %s")
-        % ident % app.opts.branch_name);
+        % ident % app.opts.branchname);
     }
   else
     {
       // use branch head revision
-      N(!app.opts.branch_name().empty(),
+      N(!app.opts.branchname().empty(),
         F("use --revision or --branch to specify what to checkout"));
 
       set<revision_id> heads;
-      app.get_project().get_branch_heads(app.opts.branch_name, heads);
+      app.get_project().get_branch_heads(app.opts.branchname, heads);
       if (heads.size() > 1)
         {
-          P(F("branch %s has multiple heads:") % app.opts.branch_name);
+          P(F("branch %s has multiple heads:") % app.opts.branchname);
           for (set<revision_id>::const_iterator i = heads.begin(); i != heads.end(); ++i)
             P(i18n_format("  %s") % describe_revision(app, *i));
           P(F("choose one with '%s checkout -r<id>'") % ui.prog_name);
-          E(false, F("branch %s has multiple heads") % app.opts.branch_name);
+          E(false, F("branch %s has multiple heads") % app.opts.branchname);
         }
       if (heads.size() > 0)
         ident = *(heads.begin());
============================================================
--- commands.cc	a15a57664c8a134a2ba174826d805cd4fc5b848c
+++ commands.cc	ccae8a0a37eb7eceab3cd4586e22e3660ddef9ee
@@ -462,14 +462,14 @@ notify_if_multiple_heads(app_state & app
 notify_if_multiple_heads(app_state & app)
 {
   set<revision_id> heads;
-  app.get_project().get_branch_heads(app.opts.branch_name, heads);
+  app.get_project().get_branch_heads(app.opts.branchname, heads);
   if (heads.size() > 1) {
     string prefixedline;
     prefix_lines_with(_("note: "),
                       _("branch '%s' has multiple heads\n"
                         "perhaps consider '%s merge'"),
                       prefixedline);
-    P(i18n_format(prefixedline) % app.opts.branch_name % ui.prog_name);
+    P(i18n_format(prefixedline) % app.opts.branchname % ui.prog_name);
   }
 }
 
============================================================
--- database.cc	cac4ab9d4b50bd45c5888e84619bc6f342570367
+++ database.cc	fed4a1460ddef1784907fbce73c0aa67b262683a
@@ -37,6 +37,7 @@
 #include "transforms.hh"
 #include "ui.hh"
 #include "vocab.hh"
+#include "vocab_cast.hh"
 #include "xdelta.hh"
 #include "epoch.hh"
 #include "graph.hh"
@@ -1491,19 +1492,6 @@ database::revision_exists(revision_id co
   return res.size() == 1;
 }
 
-template<typename From, typename To>
-To add_decoration(From const & from)
-{
-  return To(from);
-}
-
-template<typename From, typename To>
-void add_decoration_to_container(From const & from, To & to)
-{
-  transform(from.begin(), from.end(), std::inserter(to, to.end()),
-            &add_decoration<typename From::value_type, typename To::value_type>);
-}
-
 void
 database::get_file_ids(set<file_id> & ids)
 {
@@ -2665,20 +2653,20 @@ void database::complete(selector_type ty
           else if (i->first == selectors::sel_head)
             {
               // get branch names
-              set<utf8> branch_names;
+              set<branch_name> branch_names;
               if (i->second.size() == 0)
                 {
                   __app->require_workspace("the empty head selector h: refers to the head of the current branch");
-                  branch_names.insert(__app->opts.branch_name);
+                  branch_names.insert(__app->opts.branchname);
                 }
               else
                 {
-                  __app->get_project().get_branch_list(utf8(i->second), branch_names);
+                  __app->get_project().get_branch_list(globish(i->second), branch_names);
                 }
 
               // for each branch name, get the branch heads
               set<revision_id> heads;
-              for (set<utf8>::const_iterator bn = branch_names.begin();
+              for (set<branch_name>::const_iterator bn = branch_names.begin();
                    bn != branch_names.end(); bn++)
                 {
                   set<revision_id> branch_heads;
@@ -2714,8 +2702,8 @@ void database::complete(selector_type ty
                 {
                   __app->require_workspace("the empty branch selector b: refers to the current branch");
                   lim.sql_cmd += "SELECT id FROM revision_certs WHERE name=? AND CAST(value AS TEXT) glob ?";
-                  lim % text(branch_cert_name()) % text(__app->opts.branch_name());
-                  L(FL("limiting to current branch '%s'") % __app->opts.branch_name);
+                  lim % text(branch_cert_name()) % text(__app->opts.branchname());
+                  L(FL("limiting to current branch '%s'") % __app->opts.branchname);
                 }
               else
                 {
============================================================
--- globish.cc	85d971be4e285160674cbb8cd1ae6e948f433037
+++ globish.cc	316d1da34877cb89cb11ea55741be9343c476ff6
@@ -108,13 +108,14 @@ void
 }
 
 void
-combine_and_check_globish(vector<utf8> const & patterns, utf8 & pattern)
+combine_and_check_globish(vector<globish> const & patterns, globish & pattern)
 {
   string p;
   if (patterns.size() > 1)
     p += '{';
   bool first = true;
-  for (vector<utf8>::const_iterator i = patterns.begin(); i != patterns.end(); ++i)
+  for (vector<globish>::const_iterator i = patterns.begin();
+       i != patterns.end(); ++i)
     {
       string tmp;
       // run for the checking it does
@@ -126,10 +127,11 @@ combine_and_check_globish(vector<utf8> c
     }
   if (patterns.size() > 1)
     p += '}';
-  pattern = utf8(p);
+  pattern = globish(p);
 }
 
-globish_matcher::globish_matcher(utf8 const & include_pat, utf8 const & exclude_pat)
+globish_matcher::globish_matcher(globish const & include_pat,
+                                 globish const & exclude_pat)
 {
   string re;
   checked_globish_to_regex(include_pat(), re);
@@ -190,11 +192,11 @@ UNIT_TEST(globish, combine_and_check_glo
 
 UNIT_TEST(globish, combine_and_check_globish)
 {
-  vector<utf8> s;
-  s.push_back(utf8("a"));
-  s.push_back(utf8("b"));
-  s.push_back(utf8("c"));
-  utf8 combined;
+  vector<globish> s;
+  s.push_back(globish("a"));
+  s.push_back(globish("b"));
+  s.push_back(globish("c"));
+  globish combined;
   combine_and_check_globish(s, combined);
   BOOST_CHECK(combined() == "{a,b,c}");
 }
@@ -202,7 +204,7 @@ UNIT_TEST(globish, globish_matcher)
 UNIT_TEST(globish, globish_matcher)
 {
   {
-    globish_matcher m(utf8("{a,b}?*\\*|"), utf8("*c*"));
+    globish_matcher m(globish("{a,b}?*\\*|"), globish("*c*"));
     BOOST_CHECK(m("aq*|"));
     BOOST_CHECK(m("bq*|"));
     BOOST_CHECK(!m("bc*|"));
@@ -211,7 +213,7 @@ UNIT_TEST(globish, globish_matcher)
     BOOST_CHECK(!m(""));
   }
   {
-    globish_matcher m(utf8("{a,\\\\,b*}"), utf8("*c*"));
+    globish_matcher m(globish("{a,\\\\,b*}"), globish("*c*"));
     BOOST_CHECK(m("a"));
     BOOST_CHECK(!m("ab"));
     BOOST_CHECK(m("\\"));
@@ -221,12 +223,12 @@ UNIT_TEST(globish, globish_matcher)
     BOOST_CHECK(!m("bfoobarcfoobar"));
   }
   {
-    globish_matcher m(utf8("*"), utf8(""));
+    globish_matcher m(globish("*"), globish(""));
     BOOST_CHECK(m("foo"));
     BOOST_CHECK(m(""));
   }
   {
-    globish_matcher m(utf8("{foo}"), utf8(""));
+    globish_matcher m(globish("{foo}"), globish(""));
     BOOST_CHECK(m("foo"));
     BOOST_CHECK(!m("bar"));
   }
============================================================
--- globish.hh	0cc1789ca486ca25778d7c88b5e935c916503091
+++ globish.hh	a09c59d14a2425049d00b50a963e22543939c366
@@ -34,13 +34,14 @@
 
 #include "vocab.hh"
 
-void combine_and_check_globish(std::vector<utf8> const &patterns, utf8 & pattern);
+void combine_and_check_globish(std::vector<globish> const &patterns,
+                               globish & pattern);
 
 class globish_matcher
 {
 public:
   // this may throw an informative_failure if a pattern is invalid
-  globish_matcher(utf8 const & include_pat, utf8 const & exclude_pat);
+  globish_matcher(globish const & include_pat, globish const & exclude_pat);
   // this method may throw a std::runtime_error if the pattern is really
   // pathological
   bool operator()(std::string const & s);
============================================================
--- key_store.cc	271e3ecac273faa7a7d0957037dde742875c323a
+++ key_store.cc	647396cd291637e0c1d4c2465ca372f19a5762a3
@@ -131,10 +131,10 @@ key_store::get_key_ids(string const & pa
 {
   maybe_read_key_dir();
   priv.clear();
-  utf8 inc(pattern);
+  globish inc(pattern);
   if (pattern.empty())
-    inc = utf8("*");
-  globish_matcher gm(inc, utf8(""));
+    inc = globish("*");
+  globish_matcher gm(inc, globish(""));
   for (map<rsa_keypair_id, keypair>::const_iterator
          i = keys.begin(); i != keys.end(); ++i)
     {
============================================================
--- lua.cc	2f678713385631c4ca9782e9b767651d2f26ab21
+++ lua.cc	a86b67e6ece4d5e661bbfd6f0c439e3fc8a69f7c
@@ -518,8 +518,8 @@ LUAEXT(includedirpattern, )
   // directory, iterate over it, skipping subdirs, taking every filename
   // matching the pattern, sorting them and loading in sorted order
   fs::directory_iterator it(locpath);
-  utf8 r = utf8(string(pattern));
-  globish_matcher glob(r, utf8());
+  globish r = globish(pattern);
+  globish_matcher glob(r, globish());
   vector<fs::path> arr;
   while (it != fs::directory_iterator())
     {
============================================================
--- lua_hooks.cc	1f41837fe4b656f8455b5abb327c21f65b41d3f2
+++ lua_hooks.cc	02a923f2e6c785ccc218a67ba83acbbbc04a179b
@@ -253,7 +253,7 @@ bool
 }
 
 bool
-lua_hooks::hook_get_branch_key(utf8 const & branchname,
+lua_hooks::hook_get_branch_key(branch_name const & branchname,
                                rsa_keypair_id & k)
 {
   string key;
@@ -269,7 +269,7 @@ bool
 }
 
 bool
-lua_hooks::hook_get_author(utf8 const & branchname,
+lua_hooks::hook_get_author(branch_name const & branchname,
                            string & author)
 {
   return Lua(st)
@@ -311,12 +311,12 @@ bool
 }
 
 bool
-lua_hooks::hook_ignore_branch(string const & branch)
+lua_hooks::hook_ignore_branch(branch_name const & branch)
 {
   bool ignore_it = false;
   bool exec_ok = Lua(st)
     .func("ignore_branch")
-    .push_str(branch)
+    .push_str(branch())
     .call(1,1)
     .extract_bool(ignore_it)
     .ok();
@@ -566,8 +566,8 @@ lua_hooks::hook_get_netsync_connect_comm
 
 bool
 lua_hooks::hook_get_netsync_connect_command(uri const & u,
-                                            std::string const & include_pattern,
-                                            std::string const & exclude_pattern,
+                                            globish const & include_pattern,
+                                            globish const & exclude_pattern,
                                             bool debug,
                                             std::vector<std::string> & argv)
 {
@@ -579,17 +579,17 @@ lua_hooks::hook_get_netsync_connect_comm
 
   ll.push_table();
 
-  if (!include_pattern.empty())
+  if (!include_pattern().empty())
     {
       ll.push_str("include");
-      ll.push_str(include_pattern);
+      ll.push_str(include_pattern());
       ll.set_table();
     }
 
-  if (!exclude_pattern.empty())
+  if (!exclude_pattern().empty())
     {
       ll.push_str("exclude");
-      ll.push_str(exclude_pattern);
+      ll.push_str(exclude_pattern());
       ll.set_table();
     }
 
@@ -738,7 +738,7 @@ lua_hooks::hook_validate_commit_message(
 bool
 lua_hooks::hook_validate_commit_message(utf8 const & message,
                                         revision_data const & new_rev,
-                                        utf8 const & branchname,
+                                        branch_name const & branchname,
                                         bool & validated,
                                         string & reason)
 {
@@ -785,8 +785,8 @@ lua_hooks::hook_note_netsync_start(size_
 lua_hooks::hook_note_netsync_start(size_t session_id, string my_role,
                                    int sync_type, string remote_host,
                                    rsa_keypair_id remote_keyname,
-                                   utf8 include_pattern,
-                                   utf8 exclude_pattern)
+                                   globish include_pattern,
+                                   globish exclude_pattern)
 {
   string type;
   switch (sync_type)
============================================================
--- lua_hooks.hh	d1b989184b673d8a9f2082b58ae3bd0a9f38b717
+++ lua_hooks.hh	3136f049c267df992198a278d5e71ee0ee687562
@@ -44,9 +44,9 @@ public:
   // cert hooks
   bool hook_expand_selector(std::string const & sel, std::string & exp);
   bool hook_expand_date(std::string const & sel, std::string & exp);
-  bool hook_get_branch_key(utf8 const & branchname, rsa_keypair_id & k);
+  bool hook_get_branch_key(branch_name const & branchname, rsa_keypair_id & k);
   bool hook_get_passphrase(rsa_keypair_id const & k, std::string & phrase);
-  bool hook_get_author(utf8 const & branchname, std::string & author);
+  bool hook_get_author(branch_name const & branchname, std::string & author);
   bool hook_edit_comment(external const & commentary,
                          external const & user_log_message,
                          external & result);
@@ -64,8 +64,8 @@ public:
 
   // network hooks
   bool hook_get_netsync_connect_command(uri const & u,
-                                        std::string const & include_pattern,
-                                        std::string const & exclude_pattern,
+                                        globish const & include_pattern,
+                                        globish const & exclude_pattern,
                                         bool debug,
                                         std::vector<std::string> & argv);
   bool hook_use_transport_auth(uri const & u);
@@ -78,7 +78,7 @@ public:
 
   // local repo hooks
   bool hook_ignore_file(file_path const & p);
-  bool hook_ignore_branch(std::string const & branch);
+  bool hook_ignore_branch(branch_name const & branch);
   bool hook_merge3(file_path const & anc_path,
                    file_path const & left_path,
                    file_path const & right_path,
@@ -113,7 +113,7 @@ public:
   // validation hooks
   bool hook_validate_commit_message(utf8 const & message,
                                     revision_data const & new_rev,
-                                    utf8 const & branchname,
+                                    branch_name const & branchname,
                                     bool & validated,
                                     std::string & reason);
 
@@ -127,8 +127,8 @@ public:
                                int sync_type,
                                std::string remote_host,
                                rsa_keypair_id remote_keyname,
-                               utf8 include_pattern,
-                               utf8 exclude_pattern);
+                               globish include_pattern,
+                               globish exclude_pattern);
   bool hook_note_netsync_revision_received(revision_id const & new_id,
                                            revision_data const & rdat,
                         std::set<std::pair<rsa_keypair_id,
============================================================
--- luaext_globish.cc	cbce64612aa5d0ca8542dcb10d54c6839d839d79
+++ luaext_globish.cc	72dd38c8bfcd89d9af8bb2a9a3562867f97175c0
@@ -15,7 +15,7 @@ LUAEXT(match, globish)
     string r(re);
     string n;
     string s(str);
-    result = globish_matcher(utf8(r), utf8(n))(s);
+    result = globish_matcher(globish(r), globish(n))(s);
   } catch (informative_failure & e) {
     return luaL_error(L, e.what());
   } catch (boost::bad_pattern & e) {
============================================================
--- netcmd.cc	aa9c61e301fc6c077007dd9008f49765f839ff81
+++ netcmd.cc	f5c66fabed53103434a5e728525b7c8414f6736d
@@ -259,8 +259,8 @@ netcmd::read_anonymous_cmd(protocol_role
 
 void
 netcmd::read_anonymous_cmd(protocol_role & role,
-                           utf8 & include_pattern,
-                           utf8 & exclude_pattern,
+                           globish & include_pattern,
+                           globish & exclude_pattern,
                            rsa_oaep_sha_data & hmac_key_encrypted) const
 {
   size_t pos = 0;
@@ -274,10 +274,10 @@ netcmd::read_anonymous_cmd(protocol_role
   string pattern_string;
   extract_variable_length_string(payload, pattern_string, pos,
                                  "anonymous(hmac) netcmd, include_pattern");
-  include_pattern = utf8(pattern_string);
+  include_pattern = globish(pattern_string);
   extract_variable_length_string(payload, pattern_string, pos,
                                  "anonymous(hmac) netcmd, exclude_pattern");
-  exclude_pattern = utf8(pattern_string);
+  exclude_pattern = globish(pattern_string);
   string hmac_key_string;
   extract_variable_length_string(payload, hmac_key_string, pos,
                                  "anonymous(hmac) netcmd, hmac_key_encrypted");
@@ -287,8 +287,8 @@ netcmd::write_anonymous_cmd(protocol_rol
 
 void
 netcmd::write_anonymous_cmd(protocol_role role,
-                            utf8 const & include_pattern,
-                            utf8 const & exclude_pattern,
+                            globish const & include_pattern,
+                            globish const & exclude_pattern,
                             rsa_oaep_sha_data const & hmac_key_encrypted)
 {
   cmd_code = anonymous_cmd;
@@ -300,8 +300,8 @@ netcmd::read_auth_cmd(protocol_role & ro
 
 void
 netcmd::read_auth_cmd(protocol_role & role,
-                      utf8 & include_pattern,
-                      utf8 & exclude_pattern,
+                      globish & include_pattern,
+                      globish & exclude_pattern,
                       id & client,
                       id & nonce1,
                       rsa_oaep_sha_data & hmac_key_encrypted,
@@ -320,10 +320,10 @@ netcmd::read_auth_cmd(protocol_role & ro
   string pattern_string;
   extract_variable_length_string(payload, pattern_string, pos,
                                  "auth(hmac) netcmd, include_pattern");
-  include_pattern = utf8(pattern_string);
+  include_pattern = globish(pattern_string);
   extract_variable_length_string(payload, pattern_string, pos,
                                  "auth(hmac) netcmd, exclude_pattern");
-  exclude_pattern = utf8(pattern_string);
+  exclude_pattern = globish(pattern_string);
   client = id(extract_substring(payload, pos,
                                 constants::merkle_hash_length_in_bytes,
                                 "auth(hmac) netcmd, client identifier"));
@@ -341,8 +341,8 @@ netcmd::write_auth_cmd(protocol_role rol
 
 void
 netcmd::write_auth_cmd(protocol_role role,
-                       utf8 const & include_pattern,
-                       utf8 const & exclude_pattern,
+                       globish const & include_pattern,
+                       globish const & exclude_pattern,
                        id const & client,
                        id const & nonce1,
                        rsa_oaep_sha_data const & hmac_key_encrypted,
@@ -541,7 +541,7 @@ void
 }
 
 void
-netcmd::write_usher_reply_cmd(utf8 const & server, utf8 const & pattern)
+netcmd::write_usher_reply_cmd(utf8 const & server, globish const & pattern)
 {
   cmd_code = usher_reply_cmd;
   payload.clear();
@@ -673,8 +673,8 @@ UNIT_TEST(netcmd, functions)
         // total cheat, since we don't actually verify that rsa_oaep_sha_data
         // is sensible anywhere here...
         rsa_oaep_sha_data out_key("nonce start my heart"), in_key;
-        utf8 out_include_pattern("radishes galore!"), in_include_pattern;
-        utf8 out_exclude_pattern("turnips galore!"), in_exclude_pattern;
+        globish out_include_pattern("radishes galore!"), in_include_pattern;
+        globish out_exclude_pattern("turnips galore!"), in_exclude_pattern;
 
         out_cmd.write_anonymous_cmd(out_role, out_include_pattern, out_exclude_pattern, out_key);
         do_netcmd_roundtrip(out_cmd, in_cmd, buf);
@@ -698,8 +698,8 @@ UNIT_TEST(netcmd, functions)
         // is sensible anywhere here...
         rsa_oaep_sha_data out_key("nonce start my heart"), in_key;
         string out_signature(raw_sha1("burble") + raw_sha1("gorby")), in_signature;
-        utf8 out_include_pattern("radishes galore!"), in_include_pattern;
-        utf8 out_exclude_pattern("turnips galore!"), in_exclude_pattern;
+        globish out_include_pattern("radishes galore!"), in_include_pattern;
+        globish out_exclude_pattern("turnips galore!"), in_exclude_pattern;
 
         out_cmd.write_auth_cmd(out_role, out_include_pattern, out_exclude_pattern
                                , out_client, out_nonce1, out_key, out_signature);
============================================================
--- netcmd.hh	c8c14900e822a49270dfa3da37a2fc44323f66e6
+++ netcmd.hh	51ac9116aaec71bcb8ecd7baaa0885cda65dcf90
@@ -111,24 +111,24 @@ public:
   void write_bye_cmd(u8 phase);
 
   void read_anonymous_cmd(protocol_role & role,
-                          utf8 & include_pattern,
-                          utf8 & exclude_pattern,
+                          globish & include_pattern,
+                          globish & exclude_pattern,
                           rsa_oaep_sha_data & hmac_key_encrypted) const;
   void write_anonymous_cmd(protocol_role role,
-                           utf8 const & include_pattern,
-                           utf8 const & exclude_pattern,
+                           globish const & include_pattern,
+                           globish const & exclude_pattern,
                            rsa_oaep_sha_data const & hmac_key_encrypted);
 
   void read_auth_cmd(protocol_role & role,
-                     utf8 & include_pattern,
-                     utf8 & exclude_pattern,
+                     globish & include_pattern,
+                     globish & exclude_pattern,
                      id & client,
                      id & nonce1,
                      rsa_oaep_sha_data & hmac_key_encrypted,
                      std::string & signature) const;
   void write_auth_cmd(protocol_role role,
-                      utf8 const & include_pattern,
-                      utf8 const & exclude_pattern,
+                      globish const & include_pattern,
+                      globish const & exclude_pattern,
                       id const & client,
                       id const & nonce1,
                       rsa_oaep_sha_data const & hmac_key_encrypted,
@@ -158,7 +158,7 @@ public:
                        delta const & del);
 
   void read_usher_cmd(utf8 & greeting) const;
-  void write_usher_reply_cmd(utf8 const & server, utf8 const & pattern);
+  void write_usher_reply_cmd(utf8 const & server, globish const & pattern);
 
 };
 
============================================================
--- netsync.cc	6e345e2b5623d96d05acc870dcbbfb21850fa677
+++ netsync.cc	92e2302554f48a5a6fdee6bb42cba24f22152c97
@@ -271,8 +271,8 @@ session:
 {
   protocol_role role;
   protocol_voice const voice;
-  utf8 const & our_include_pattern;
-  utf8 const & our_exclude_pattern;
+  globish const & our_include_pattern;
+  globish const & our_exclude_pattern;
   globish_matcher our_matcher;
   app_state & app;
 
@@ -371,8 +371,8 @@ session:
 
   session(protocol_role role,
           protocol_voice voice,
-          utf8 const & our_include_pattern,
-          utf8 const & our_exclude_pattern,
+          globish const & our_include_pattern,
+          globish const & our_exclude_pattern,
           app_state & app,
           string const & peer,
           shared_ptr<Netxx::StreamBase> sock);
@@ -417,13 +417,13 @@ session:
                        base64<rsa_pub_key> const & pub_encoded,
                        id const & nonce);
   void queue_anonymous_cmd(protocol_role role,
-                           utf8 const & include_pattern,
-                           utf8 const & exclude_pattern,
+                           globish const & include_pattern,
+                           globish const & exclude_pattern,
                            id const & nonce2,
                            base64<rsa_pub_key> server_key_encoded);
   void queue_auth_cmd(protocol_role role,
-                      utf8 const & include_pattern,
-                      utf8 const & exclude_pattern,
+                      globish const & include_pattern,
+                      globish const & exclude_pattern,
                       id const & client,
                       id const & nonce1,
                       id const & nonce2,
@@ -446,11 +446,11 @@ session:
                          id const & nonce);
   bool process_bye_cmd(u8 phase, transaction_guard & guard);
   bool process_anonymous_cmd(protocol_role role,
-                             utf8 const & their_include_pattern,
-                             utf8 const & their_exclude_pattern);
+                             globish const & their_include_pattern,
+                             globish const & their_exclude_pattern);
   bool process_auth_cmd(protocol_role role,
-                        utf8 const & their_include_pattern,
-                        utf8 const & their_exclude_pattern,
+                        globish const & their_include_pattern,
+                        globish const & their_exclude_pattern,
                         id const & client,
                         id const & nonce1,
                         string const & signature);
@@ -479,7 +479,7 @@ session:
                  string & out);
 
   void rebuild_merkle_trees(app_state & app,
-                            set<utf8> const & branches);
+                            set<branch_name> const & branches);
 
   void send_all_data(netcmd_item_type ty, set<id> const & items);
   void begin_service();
@@ -489,8 +489,8 @@ session::session(protocol_role role,
 
 session::session(protocol_role role,
                  protocol_voice voice,
-                 utf8 const & our_include_pattern,
-                 utf8 const & our_exclude_pattern,
+                 globish const & our_include_pattern,
+                 globish const & our_exclude_pattern,
                  app_state & app,
                  string const & peer,
                  shared_ptr<Netxx::StreamBase> sock) :
@@ -1119,8 +1119,8 @@ session::queue_anonymous_cmd(protocol_ro
 
 void
 session::queue_anonymous_cmd(protocol_role role,
-                             utf8 const & include_pattern,
-                             utf8 const & exclude_pattern,
+                             globish const & include_pattern,
+                             globish const & exclude_pattern,
                              id const & nonce2,
                              base64<rsa_pub_key> server_key_encoded)
 {
@@ -1137,8 +1137,8 @@ session::queue_auth_cmd(protocol_role ro
 
 void
 session::queue_auth_cmd(protocol_role role,
-                        utf8 const & include_pattern,
-                        utf8 const & exclude_pattern,
+                        globish const & include_pattern,
+                        globish const & exclude_pattern,
                         id const & client,
                         id const & nonce1,
                         id const & nonce2,
@@ -1335,9 +1335,9 @@ session::process_hello_cmd(rsa_keypair_i
 
   // clients always include in the synchronization set, every branch that the
   // user requested
-  set<utf8> all_branches, ok_branches;
+  set<branch_name> all_branches, ok_branches;
   app.get_project().get_branch_list(all_branches);
-  for (set<utf8>::const_iterator i = all_branches.begin();
+  for (set<branch_name>::const_iterator i = all_branches.begin();
       i != all_branches.end(); i++)
     {
       if (our_matcher((*i)()))
@@ -1386,8 +1386,8 @@ session::process_anonymous_cmd(protocol_
 
 bool
 session::process_anonymous_cmd(protocol_role their_role,
-                               utf8 const & their_include_pattern,
-                               utf8 const & their_exclude_pattern)
+                               globish const & their_include_pattern,
+                               globish const & their_exclude_pattern)
 {
   // Internally netsync thinks in terms of sources and sinks. Users like
   // thinking of repositories as "readonly", "readwrite", or "writeonly".
@@ -1428,10 +1428,10 @@ session::process_anonymous_cmd(protocol_
         }
     }
 
-  set<utf8> all_branches, ok_branches;
+  set<branch_name> all_branches, ok_branches;
   app.get_project().get_branch_list(all_branches);
   globish_matcher their_matcher(their_include_pattern, their_exclude_pattern);
-  for (set<utf8>::const_iterator i = all_branches.begin();
+  for (set<branch_name>::const_iterator i = all_branches.begin();
       i != all_branches.end(); i++)
     {
       if (their_matcher((*i)()))
@@ -1489,8 +1489,8 @@ session::process_auth_cmd(protocol_role 
 
 bool
 session::process_auth_cmd(protocol_role their_role,
-                          utf8 const & their_include_pattern,
-                          utf8 const & their_exclude_pattern,
+                          globish const & their_include_pattern,
+                          globish const & their_exclude_pattern,
                           id const & client,
                           id const & nonce1,
                           string const & signature)
@@ -1561,9 +1561,9 @@ session::process_auth_cmd(protocol_role 
         }
     }
 
-  set<utf8> all_branches, ok_branches;
+  set<branch_name> all_branches, ok_branches;
   app.get_project().get_branch_list(all_branches);
-  for (set<utf8>::const_iterator i = all_branches.begin();
+  for (set<branch_name>::const_iterator i = all_branches.begin();
        i != all_branches.end(); i++)
     {
       if (their_matcher((*i)()))
@@ -2107,7 +2107,7 @@ session::dispatch_payload(netcmd const &
               "anonymous netcmd received in source or source/sink role");
       {
         protocol_role role;
-        utf8 their_include_pattern, their_exclude_pattern;
+        globish their_include_pattern, their_exclude_pattern;
         rsa_oaep_sha_data hmac_key_encrypted;
         cmd.read_anonymous_cmd(role, their_include_pattern, their_exclude_pattern, hmac_key_encrypted);
         L(FL("received 'anonymous' netcmd from client for pattern '%s' excluding '%s' "
@@ -2130,7 +2130,7 @@ session::dispatch_payload(netcmd const &
       {
         protocol_role role;
         string signature;
-        utf8 their_include_pattern, their_exclude_pattern;
+        globish their_include_pattern, their_exclude_pattern;
         id client, nonce1, nonce2;
         rsa_oaep_sha_data hmac_key_encrypted;
         cmd.read_auth_cmd(role, their_include_pattern, their_exclude_pattern,
@@ -2329,8 +2329,8 @@ build_stream_to_server(app_state & app,
 
 static shared_ptr<Netxx::StreamBase>
 build_stream_to_server(app_state & app,
-                       utf8 const & include_pattern,
-                       utf8 const & exclude_pattern,
+                       globish const & include_pattern,
+                       globish const & exclude_pattern,
                        utf8 const & address,
                        Netxx::port_type default_port,
                        Netxx::Timeout timeout)
@@ -2340,8 +2340,8 @@ build_stream_to_server(app_state & app,
   vector<string> argv;
   if (parse_uri(address(), u)
       && app.lua.hook_get_netsync_connect_command(u,
-                                                  include_pattern(),
-                                                  exclude_pattern(),
+                                                  include_pattern,
+                                                  exclude_pattern,
                                                   global_sanity.debug,
                                                   argv))
     {
@@ -2369,8 +2369,8 @@ call_server(protocol_role role,
 
 static void
 call_server(protocol_role role,
-            utf8 const & include_pattern,
-            utf8 const & exclude_pattern,
+            globish const & include_pattern,
+            globish const & exclude_pattern,
             app_state & app,
             utf8 const & address,
             Netxx::port_type default_port,
@@ -2561,8 +2561,8 @@ handle_new_connection(Netxx::Address & a
                       Netxx::StreamServer & server,
                       Netxx::Timeout & timeout,
                       protocol_role role,
-                      utf8 const & include_pattern,
-                      utf8 const & exclude_pattern,
+                      globish const & include_pattern,
+                      globish const & exclude_pattern,
                       map<Netxx::socket_type, shared_ptr<session> > & sessions,
                       app_state & app)
 {
@@ -2730,8 +2730,8 @@ serve_connections(protocol_role role,
 
 static void
 serve_connections(protocol_role role,
-                  utf8 const & include_pattern,
-                  utf8 const & exclude_pattern,
+                  globish const & include_pattern,
+                  globish const & exclude_pattern,
                   app_state & app,
                   utf8 const & address,
                   Netxx::port_type default_port,
@@ -3042,10 +3042,10 @@ session::rebuild_merkle_trees(app_state 
 
 void
 session::rebuild_merkle_trees(app_state & app,
-                              set<utf8> const & branchnames)
+                              set<branch_name> const & branchnames)
 {
   P(F("finding items to synchronize:"));
-  for (set<utf8>::const_iterator i = branchnames.begin();
+  for (set<branch_name>::const_iterator i = branchnames.begin();
       i != branchnames.end(); ++i)
     L(FL("including branch %s") % *i);
 
@@ -3060,7 +3060,7 @@ session::rebuild_merkle_trees(app_state 
   set<rsa_keypair_id> inserted_keys;
 
   {
-    for (set<utf8>::const_iterator i = branchnames.begin();
+    for (set<branch_name>::const_iterator i = branchnames.begin();
          i != branchnames.end(); ++i)
       {
         // Get branch certs.
@@ -3093,7 +3093,7 @@ session::rebuild_merkle_trees(app_state 
     app.db.get_epochs(epochs);
 
     epoch_data epoch_zero(string(constants::epochlen, '0'));
-    for (set<utf8>::const_iterator i = branchnames.begin();
+    for (set<branch_name>::const_iterator i = branchnames.begin();
          i != branchnames.end(); ++i)
       {
         cert_value branch((*i)());
@@ -3195,8 +3195,8 @@ run_netsync_protocol(protocol_voice voic
 run_netsync_protocol(protocol_voice voice,
                      protocol_role role,
                      utf8 const & addr,
-                     utf8 const & include_pattern,
-                     utf8 const & exclude_pattern,
+                     globish const & include_pattern,
+                     globish const & exclude_pattern,
                      app_state & app)
 {
   if (include_pattern().find_first_of("'\"") != string::npos)
============================================================
--- netsync.hh	510ac1917bd6aa7a2ec21c7e9d709305268169a3
+++ netsync.hh	2a4d8e88f8774f885470a658ba101a06bc403eeb
@@ -26,8 +26,8 @@ void run_netsync_protocol(protocol_voice
 void run_netsync_protocol(protocol_voice voice,
                           protocol_role role,
                           utf8 const & addr,
-                          utf8 const & include_pattern,
-                          utf8 const & exclude_pattern,
+                          globish const & include_pattern,
+                          globish const & exclude_pattern,
                           app_state & app);
 
 // Local Variables:
============================================================
--- options_list.hh	bdf99561b7ca94bcf196ca26b8d192d8d74f1492
+++ options_list.hh	e6bc6c91be2105a71eca5cdcfa79b1deca8d2ec3
@@ -91,12 +91,12 @@ OPTION(bind_opts, bind_stdio, false, "st
 }
 #endif
 
-OPTVAR(branch, utf8, branch_name, )
+OPTVAR(branch, branch_name, branchname, )
 OPTION(branch, branch, true, "branch,b",
         gettext_noop("select branch cert for operation"))
 #ifdef option_bodies
 {
-  branch_name = utf8(arg);
+  branchname = branch_name(arg);
 }
 #endif
 
============================================================
--- project.cc	3a69d5eebcacb3ab5625a49dc98edf9979e7b46c
+++ project.cc	bad2c3f0707a4510e2790baaffe6cace0587ebf9
@@ -29,7 +29,7 @@ void
 {}
 
 void
-project_t::get_branch_list(std::set<utf8> & names)
+project_t::get_branch_list(std::set<branch_name> & names)
 {
   if (indicator.outdated())
     {
@@ -39,7 +39,7 @@ project_t::get_branch_list(std::set<utf8
       for (std::vector<std::string>::iterator i = got.begin();
            i != got.end(); ++i)
         {
-          branches.insert(utf8(*i));
+          branches.insert(branch_name(*i));
         }
     }
 
@@ -47,8 +47,8 @@ void
 }
 
 void
-project_t::get_branch_list(utf8 const & glob,
-                           std::set<utf8> & names)
+project_t::get_branch_list(globish const & glob,
+                           std::set<branch_name> & names)
 {
   std::vector<std::string> got;
   app.db.get_branches(glob(), got);
@@ -56,7 +56,7 @@ project_t::get_branch_list(utf8 const & 
   for (std::vector<std::string>::iterator i = got.begin();
        i != got.end(); ++i)
     {
-      names.insert(utf8(*i));
+      names.insert(branch_name(*i));
     }
 }
 
@@ -84,7 +84,7 @@ void
 }
 
 void
-project_t::get_branch_heads(utf8 const & name, std::set<revision_id> & heads)
+project_t::get_branch_heads(branch_name const & name, std::set<revision_id> & heads)
 {
   std::pair<outdated_indicator, std::set<revision_id> > & branch = branch_heads[name];
   if (branch.first.outdated())
@@ -108,7 +108,7 @@ project_t::revision_is_in_branch(revisio
 
 bool
 project_t::revision_is_in_branch(revision_id const & id,
-                                 utf8 const & branch)
+                                 branch_name const & branch)
 {
   base64<cert_value> branch_encoded;
   encode_base64(cert_value(branch()), branch_encoded);
@@ -131,7 +131,7 @@ project_t::put_revision_in_branch(revisi
 
 void
 project_t::put_revision_in_branch(revision_id const & id,
-                                  utf8 const & branch,
+                                  branch_name const & branch,
                                   packet_consumer & pc)
 {
   cert_revision_in_branch(id, cert_value(branch()), app, pc);
@@ -164,7 +164,7 @@ project_t::get_revision_branches(revisio
 
 outdated_indicator
 project_t::get_revision_branches(revision_id const & id,
-                                 std::set<utf8> & branches)
+                                 std::set<branch_name> & branches)
 {
   std::vector<revision<cert> > certs;
   outdated_indicator i = get_revision_certs_by_name(id, branch_cert_name, certs);
@@ -174,13 +174,13 @@ project_t::get_revision_branches(revisio
     {
       cert_value b;
       decode_base64(i->inner().value, b);
-      branches.insert(utf8(b()));
+      branches.insert(branch_name(b()));
     }
   return i;
 }
 
 outdated_indicator
-project_t::get_branch_certs(utf8 const & branch,
+project_t::get_branch_certs(branch_name const & branch,
                             std::vector<revision<cert> > & certs)
 {
   base64<cert_value> branch_encoded;
@@ -241,7 +241,7 @@ project_t::put_standard_certs(revision_i
 
 void
 project_t::put_standard_certs(revision_id const & id,
-                              utf8 const & branch,
+                              branch_name const & branch,
                               utf8 const & changelog,
                               boost::posix_time::ptime const & time,
                               utf8 const & author,
@@ -258,7 +258,7 @@ project_t::put_standard_certs_from_optio
 
 void
 project_t::put_standard_certs_from_options(revision_id const & id,
-                                           utf8 const & branch,
+                                           branch_name const & branch,
                                            utf8 const & changelog,
                                            packet_consumer & pc)
 {
============================================================
--- project.hh	3a2f56c73b1467f8c3b8c6be8800f741d3a7430e
+++ project.hh	e240ddb603a1c6f453816264803987ad655cd2c7
@@ -38,23 +38,23 @@ class project_t
 class project_t
 {
   app_state & app;
-  std::map<utf8, std::pair<outdated_indicator, std::set<revision_id> > > branch_heads;
-  std::set<utf8> branches;
+  std::map<branch_name, std::pair<outdated_indicator, std::set<revision_id> > > branch_heads;
+  std::set<branch_name> branches;
   outdated_indicator indicator;
 
 public:
   project_t(app_state & app);
 
-  void get_branch_list(std::set<utf8> & names);
-  void get_branch_list(utf8 const & glob, std::set<utf8> & names);
-  void get_branch_heads(utf8 const & name, std::set<revision_id> & heads);
+  void get_branch_list(std::set<branch_name> & names);
+  void get_branch_list(globish const & glob, std::set<branch_name> & names);
+  void get_branch_heads(branch_name const & name, std::set<revision_id> & heads);
 
   outdated_indicator get_tags(std::set<tag_t> & tags);
   void put_tag(revision_id const & id, std::string const & name, packet_consumer & pc);
 
-  bool revision_is_in_branch(revision_id const & id, utf8 const & branch);
+  bool revision_is_in_branch(revision_id const & id, branch_name const & branch);
   void put_revision_in_branch(revision_id const & id,
-                              utf8 const & branch,
+                              branch_name const & branch,
                               packet_consumer & pc);
 
   outdated_indicator get_revision_cert_hashes(revision_id const & id,
@@ -65,18 +65,18 @@ public:
                                                 cert_name const & name,
                                                 std::vector<revision<cert> > & certs);
   outdated_indicator get_revision_branches(revision_id const & id,
-                                           std::set<utf8> & branches);
-  outdated_indicator get_branch_certs(utf8 const & branch,
+                                           std::set<branch_name> & branches);
+  outdated_indicator get_branch_certs(branch_name const & branch,
                                       std::vector<revision<cert> > & certs);
 
   void put_standard_certs(revision_id const & id,
-                          utf8 const & branch,
+                          branch_name const & branch,
                           utf8 const & changelog,
                           boost::posix_time::ptime const & time,
                           utf8 const & author,
                           packet_consumer & pc);
   void put_standard_certs_from_options(revision_id const & id,
-                                       utf8 const & branch,
+                                       branch_name const & branch,
                                        utf8 const & changelog,
                                        packet_consumer & pc);
 
============================================================
--- rcs_import.cc	06415479a87c0d212fade497f1fb982283e0d83d
+++ rcs_import.cc	625106ea8f4aa1fbfdcd16df5ba3d088c065b408
@@ -1218,8 +1218,8 @@ import_cvs_repo(system_path const & cvsr
   }
 
   cvs_history cvs;
-  N(app.opts.branch_name() != "", F("need base --branch argument for importing"));
-  cvs.base_branch = app.opts.branch_name();
+  N(app.opts.branchname() != "", F("need base --branch argument for importing"));
+  cvs.base_branch = app.opts.branchname();
 
   // push the trunk
   cvs.trunk = shared_ptr<cvs_branch>(new cvs_branch());
@@ -1386,7 +1386,7 @@ cluster_consumer::store_auxiliary_certs(
     }
 
   app.get_project().put_standard_certs(p.rid,
-                                       utf8(branchname),
+                                       branch_name(branchname),
                                        utf8(cvs.changelog_interner.lookup(p.changelog)),
                                        time_from_time_t(p.time),
                                        utf8(cvs.author_interner.lookup(p.author)),
============================================================
--- update.cc	7bb7a4e2ae0cb21eae4aaa90c4d0c749d68db69b
+++ update.cc	51b3d312313c0d4dd25fc43b3bdaaef1c299a928
@@ -83,7 +83,7 @@ acceptable_descendent(cert_value const &
   L(FL("Considering update target %s") % target);
 
   // step 1: check the branch
-  if (!app.get_project().revision_is_in_branch(target, utf8(branch())))
+  if (!app.get_project().revision_is_in_branch(target, branch_name(branch())))
     {
       L(FL("%s not in branch %s") % target % branch);
       return false;
@@ -156,11 +156,11 @@ void pick_update_candidates(revision_id 
                             app_state & app,
                             set<revision_id> & candidates)
 {
-  N(app.opts.branch_name() != "",
+  N(app.opts.branchname() != "",
     F("cannot determine branch for update"));
   I(!null_id(base_ident));
 
-  calculate_update_set(base_ident, cert_value(app.opts.branch_name()),
+  calculate_update_set(base_ident, cert_value(app.opts.branchname()),
                        app, candidates);
 }
 
============================================================
--- vocab_terms.hh	fbe8c7a60365939a2813a58765ae37a70d48e66d
+++ vocab_terms.hh	bb5a992fb126662ed70bb7f41560f77615164e69
@@ -23,6 +23,9 @@ ATOMIC_NOVERIFY(inodeprint);  // fingerp
 ATOMIC_NOVERIFY(delta);       // xdelta between 2 datas
 ATOMIC_NOVERIFY(inodeprint);  // fingerprint of an inode
 
+ATOMIC_NOVERIFY(branch_name); // utf-8
+ATOMIC_NOVERIFY(globish);     // kinda like a glob, see globish.hh (also, utf-8)
+
 ATOMIC(cert_name);            // symbol-of-your-choosing
 ATOMIC_NOVERIFY(cert_value);  // symbol-of-your-choosing
 
============================================================
--- work.cc	7e91a9216deab1463fde0f8193c2384909199193
+++ work.cc	7141e5e50d9e81e4a8aea4137c0411ead01cb9a1
@@ -223,10 +223,10 @@ void
 // _MTN/options handling.
 
 void
-workspace::get_ws_options(utf8 & database_option,
-                          utf8 & branch_option,
-                          utf8 & key_option,
-                          utf8 & keydir_option)
+workspace::get_ws_options(system_path & database_option,
+                          branch_name & branch_option,
+                          rsa_keypair_id & key_option,
+                          system_path & keydir_option)
 {
   bookkeeping_path o_path;
   get_options_path(o_path);
@@ -248,13 +248,13 @@ workspace::get_ws_options(utf8 & databas
               parser.str(val);
 
               if (opt == "database")
-                database_option = utf8(val);
+                database_option = system_path(val);
               else if (opt == "branch")
-                branch_option = utf8(val);
+                branch_option = branch_name(val);
               else if (opt == "key")
-                key_option = utf8(val);
+                internalize_rsa_keypair_id(utf8(val), key_option);
               else if (opt == "keydir")
-                keydir_option = utf8(val);
+                keydir_option = system_path(val);
               else
                 W(F("unrecognized key '%s' in options file %s - ignored")
                   % opt % o_path);
@@ -268,37 +268,43 @@ void
 }
 
 void
-workspace::set_ws_options(utf8 & database_option,
-                          utf8 & branch_option,
-                          utf8 & key_option,
-                          utf8 & keydir_option)
+workspace::set_ws_options(system_path & database_option,
+                          branch_name & branch_option,
+                          rsa_keypair_id & key_option,
+                          system_path & keydir_option)
 {
   // If caller passes an empty string for any of the incoming options,
   // we want to leave that option as is in _MTN/options, not write out
   // an empty option.
-  utf8 old_database_option, old_branch_option;
-  utf8 old_key_option, old_keydir_option;
+  system_path old_database_option;
+  branch_name old_branch_option;
+  rsa_keypair_id old_key_option;
+  system_path old_keydir_option;
   get_ws_options(old_database_option, old_branch_option,
                  old_key_option, old_keydir_option);
 
-  if (database_option().empty())
+  if (database_option.as_internal().empty())
     database_option = old_database_option;
   if (branch_option().empty())
     branch_option = old_branch_option;
   if (key_option().empty())
     key_option = old_key_option;
-  if (keydir_option().empty())
+  if (keydir_option.as_internal().empty())
     keydir_option = old_keydir_option;
 
   basic_io::stanza st;
-  if (!database_option().empty())
-    st.push_str_pair(symbol("database"), database_option());
+  if (!database_option.as_internal().empty())
+    st.push_str_pair(symbol("database"), database_option.as_internal());
   if (!branch_option().empty())
     st.push_str_pair(symbol("branch"), branch_option());
   if (!key_option().empty())
-    st.push_str_pair(symbol("key"), key_option());
-  if (!keydir_option().empty())
-    st.push_str_pair(symbol("keydir"), keydir_option());
+    {
+      utf8 key;
+      externalize_rsa_keypair_id(key_option, key);
+      st.push_str_pair(symbol("key"), key());
+    }
+  if (!keydir_option.as_internal().empty())
+    st.push_str_pair(symbol("keydir"), keydir_option.as_internal());
 
   basic_io::printer pr;
   pr.print_stanza(st);
============================================================
--- work.hh	9df251792aff86d3c0b54838e1c888459768c6db
+++ work.hh	5515f5af71490b7fd5ffc7e0d64f712df5b72a27
@@ -157,14 +157,14 @@ struct workspace
   // implied unless overridden on the command line. the set of valid keys
   // corresponds exactly to the argument list of these functions.
 
-  void get_ws_options(utf8 & database_option,
-                      utf8 & branch_option,
-                      utf8 & key_option,
-                      utf8 & keydir_option);
-  void set_ws_options(utf8 & database_option,
-                      utf8 & branch_option,
-                      utf8 & key_option,
-                      utf8 & keydir_option);
+  void get_ws_options(system_path & database_option,
+                      branch_name & branch_option,
+                      rsa_keypair_id & key_option,
+                      system_path & keydir_option);
+  void set_ws_options(system_path & database_option,
+                      branch_name & branch_option,
+                      rsa_keypair_id & key_option,
+                      system_path & keydir_option);
 
   // the "workspace format version" is a nonnegative integer value, stored
   // in _MTN/format as an unadorned decimal number.  at any given time