fix(udgaver): porten dækkede 29 ruter og skulle dække 63 — og fladen ringede stadig på dørene

Prøven, der skal holde udgaverne adskilt, stod grøn gennem to merges, mens
34 opgaveruter blev betjent af noter-udgaven. Den fejlede ikke: den
sammenligner routeren med en nedskreven liste, og listen var skrevet ud
fra de ruter, nogen havde tænkt på. Den er en DRIFT-kontrol, og den kan
ikke være en fuldstændighedskontrol. Det står nu i prøven selv.

Lukket: CalDAV-træet (8 ruter, alle læser eller skriver en VTODO),
.well-known/caldav (en påstand om at der er en CalDAV-server), ICS-feedet
og de to ruter til dets token, de fire opgave-eksporter, Todoist- og
CSV-importen, skabelonerne, sektionerne, de seks AI-opgaveruter og
indbakke-krogen. Plus fem af ni MCP-værktøjer — endepunktet er der
stadig, værktøjslisten er kortere.

Tre blev afgjort ved at læse frem for ved navnet: en skabelon laver
opgaver (CreateProjectFromTemplate), `section_id` står på `tasks` og
findes ikke på `notes`, og add_comment hænger på en opgave.

Men den dyre halvdel var fladen. En vandring gennem hver side, der kan
nås i noter-udgaven, med konsollen og svarene aflæst, fandt SYV brud —
fire af dem fra den første port:

  sidebjælken      GET /filters  404 ved hver navigation, ædt af .catch()
  sidebjælken      GET /labels   404 ved hver navigation, ædt af .catch()
  notifikationer   GET /ai/plan  404, stille
  notesbogens side GET /tasks    kastede → status = 'failed'
  notesbogens side GET /sections kastede → samme fejlskærm
  indstillinger    GET /templates  toast med fejlbesked på skærmen
  integrationer    GET /feed     404, stille

Den fjerde er den, der har kostet noget: /projekt/{id} er notesbogens
side, og kaldene samles i et Promise.all, så én 404 tog hele siden med.
Den har vist en fejlskærm frem for noter siden porten blev sat. Ingen
prøve åbnede en notesbog i den udgave, og .catch(() => {}) sørgede for,
at resten ikke sagde noget. "Fladen følger udgaven" var sandt om menuen
og falsk om hentningerne.

Vagten for opgaver står i butikken frem for ved kaldestederne: der var
tre, og den fjerde blev glemt — hvilket er præcis sådan, den slap
igennem.

Og rettelsen lavede selv en fejl, som vandringen fangede: da opgavekaldet
holdt op med at fejle, kom en uendelig effekt-løkke frem, som 404'eren
havde holdt låg på. En ubetinget tilskrivning til app.tasks får
projektsidens effekt til at kalde tilbage. 404'eren var låget på en
løkke, ikke bare støj.

Også: -timeout 20m i begge CI-workflows. internal/httpapi tog 664s her og
498s i CI på #95, mod Go's standardgrænse på 600 — og når den krydses, er
beskeden "panic: test timed out after 10m0s" plus et goroutine-dump, som
læser som en deadlock i koden frem for som en suite, der blev for stor.

watchForTrouble udskilt til web/e2e/trouble.js, så udgave-suiten kan bruge
den samme.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -97,7 +97,13 @@ jobs:
       # -race is the whole point of running tests in CI for a server with a
       # WebSocket fan-out: a data race is exactly the bug that passes locally.
       - name: Test
-        run: go test -race -count=1 ./...
+        # -timeout, fordi internal/httpapi nærmer sig Go's standardgrænse på 600s:
+        # 498s i CI på #95, 656s på udviklingsmaskinen. Når den krydser, er
+        # beskeden "panic: test timed out after 10m0s" plus et goroutine-dump, og
+        # det læser som en deadlock i koden frem for som en suite, der blev for
+        # stor. Grænsen er der stadig; den er bare sat et sted, hvor den betyder
+        # "noget hænger" i stedet for "maskinen var langsom i dag".
+        run: go test -race -count=1 -timeout 20m ./...
 
       - name: Build
         run: CGO_ENABLED=0 go build ./...

.github/workflows/ci.yml

@@ -40,7 +40,13 @@ jobs:
       # -race is the whole point of running tests in CI for a server with a
       # WebSocket fan-out: a data race is exactly the bug that passes locally.
       - name: Test
-        run: go test -race -count=1 ./...
+        # -timeout, fordi internal/httpapi nærmer sig Go's standardgrænse på 600s:
+        # 498s i CI på #95, 656s på udviklingsmaskinen. Når den krydser, er
+        # beskeden "panic: test timed out after 10m0s" plus et goroutine-dump, og
+        # det læser som en deadlock i koden frem for som en suite, der blev for
+        # stor. Grænsen er der stadig; den er bare sat et sted, hvor den betyder
+        # "noget hænger" i stedet for "maskinen var langsom i dag".
+        run: go test -race -count=1 -timeout 20m ./...
 
       - name: Build
         run: CGO_ENABLED=0 go build ./...

.github/workflows/docs.yml

@@ -1,13 +1,21 @@
 name: Documentation
 
-# The docs are built on every push so a broken build is caught immediately, but
-# only published once GitHub Pages has been enabled for the repository. Until the
-# owner decides to publish, this job builds and stops.
+# Built on every push, and published from main.
 #
-# And on pull requests, where the build is the only check there is: `mkdocs build
-# --strict` fails on a link to a page that does not exist, and building only after
-# the merge means finding that out on `main`. Nothing is published from a pull
-# request — the `deploy` job below runs on a manual dispatch and nothing else.
+# The publishing used to wait for a manual dispatch, with a note saying it would
+# run "once Pages is enabled". Pages was enabled — and the condition was never
+# changed, so the site was built forty times and published none of them. What it
+# showed was a Verdande from before v0.43: /links/, /beacon/ and /notifications/
+# all answered 404, months after they were written. Nothing failed, because
+# building *is* what the job was asked to do.
+#
+# The lesson is not about this line. It is that "publish later" needs something
+# that fails when later arrives — a switch that is off and silent looks exactly
+# like a switch that is on.
+#
+# Pull requests still build and never publish: `mkdocs build --strict` fails on a
+# link to a page that does not exist, and building only after the merge means
+# finding that out on `main`.
 on:
   push:
     branches: [main]
@@ -54,9 +62,9 @@ jobs:
   deploy:
     needs: build
     runs-on: ubuntu-latest
-    # Only runs once Pages is enabled. Until then the build above still guards
-    # against a broken docs tree.
-    if: github.event_name == 'workflow_dispatch'
+    # From main, and by hand. Never from a pull request — a fork could otherwise
+    # publish over the site by opening one.
+    if: github.event_name != 'pull_request'
     environment:
       name: github-pages
       url: ${{ steps.deploy.outputs.page_url }}

.github/workflows/release.yml

@@ -72,13 +72,44 @@ jobs:
       #
       # Den sidste linje er et link til udgivelsen selv, og den tages af: en
       # side, der linker til sig selv, hjælper ingen.
+      #
+      # Og `fetch-depth: 0` er ikke nok, hvilket kostede to udgivelser at opdage.
+      # actions/checkout henter først alle tags korrekt — og overskriver derefter
+      # netop den ene, der udløste kørslen:
+      #
+      #   git rev-parse refs/tags/v0.46.0
+      #   git fetch --no-tags origin +0dc4c2f9b8…:refs/tags/v0.46.0
+      #
+      # Den henter commit-SHA'en ind i tag-refen, så den annoterede tag bliver til
+      # en letvægtstag, der peger direkte på commit'en. `%(contents)` giver så
+      # commitbeskeden, og det var flettecommittens overskrift, der stod som
+      # udgivelsestekst på v0.45.0 og v0.46.0 — uden at noget fejlede.
+      #
+      # Derfor hentes tagget som *ref* igen her, før det læses.
       - id: notes
         run: |
+          git fetch --force origin \
+            "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
+
+          body=$(git tag -l --format='%(contents)' "${GITHUB_REF_NAME}" \
+            | sed '\#^https://github.com/.*/releases/tag/#d' \
+            | sed -e :a -e '/^\n*$/{$d;N;ba' -e '}')
+
+          # Hver tagbesked begynder med sin egen version. Holder det ikke, læser vi
+          # noget andet end tagget — og en forkert udgivelsestekst skal fejle her
+          # frem for at blive opdaget på siden bagefter.
+          case "$body" in
+            "${GITHUB_REF_NAME}"*) ;;
+            *)
+              echo "::error::Tagbeskeden begynder ikke med ${GITHUB_REF_NAME}." \
+                   "Læste vi en letvægtstag? Første linje: $(printf '%s' "$body" | head -1)"
+              exit 1
+              ;;
+          esac
+
           {
             echo 'body<<VERDANDE_EOF'
-            git tag -l --format='%(contents)' "${GITHUB_REF_NAME}" \
-              | sed '\#^https://github.com/.*/releases/tag/#d' \
-              | sed -e :a -e '/^\n*$/{$d;N;ba' -e '}'
+            printf '%s\n' "$body"
             echo VERDANDE_EOF
           } >> "$GITHUB_OUTPUT"
 

.gitignore

@@ -44,6 +44,11 @@ node_modules.nosync/
 # End-to-end runs: the throwaway instance the suite starts, the saved session it
 # signs in with, and whatever a failure left behind.
 /web/.playwright-data/
+# Noter-udgavens egen instans i prøvekørslen. Den har sin egen database OG sin
+# egen secret.key, og den nåede at blive committet én gang: et mønster, der
+# nævner den ene mappe ved navn, dækker ikke den anden, selv om de er to kopier
+# af det samme.
+/web/.playwright-data-notes/
 /web/e2e/.auth/
 /web/test-results/
 /web/playwright-report/

README.md

@@ -15,12 +15,30 @@
 Not what has been, and not what is fated to be: the thing you are in the middle of.
 Which is what a to-do list is.
 
+## Two editions: verdande and urd
+
+This repository builds one program with two faces. Start it with
+`VERDANDE_EDITION=notes` and it is **urd** — notes and nothing else: the task
+routes are not mounted, the sidebar has no way to them, and the program calls
+itself urd in its tab, its wordmark and its web manifest.
+
+Urðr is Verðandi's sister in Völuspá, and the poem has the Norns cutting marks into
+wood. Verdande is what is becoming; urd is what has become and was kept.
+
+Not a fork, because the two share everything that is hard — accounts, sharing,
+passkeys, the realtime socket, search, backups, migrations — and notes are about a
+twentieth of the Go here. A test walks both routers and fails in either direction,
+so "the task routes are not there" is measured rather than promised — 63 routes and
+five of nine MCP tools. See
+[Two editions](docs/editions.md).
+
 ## Status
 
 All six phases are built. See [What works today](#what-works-today) for what is
 tested and what is not.
 
-Documentation: [`docs/`](docs/), built with Material for MkDocs.
+Documentation: **<https://kristianwind.github.io/verdande/>** — the source is in
+[`docs/`](docs/), built with Material for MkDocs and published from `main`.
 
 ## Why this exists
 
@@ -43,6 +61,10 @@ and an MCP endpoint so Claude can work your task list directly.
   the text, which shares it with her and tells her. `#project` and
   `[[another note]]` are links, and a task shows the notes that mention it. A zip of Markdown goes in — Obsidian, Bear, or Apple Notes through
   the exporter in [`tools/`](tools/) — and comes back out the same shape.
+- **Notes are sealed at rest.** Title and body are encrypted in the database under
+  a key in a file beside it — the title too, because a title beside a sealed body
+  leaves the beginning of every note in the open. A copy of the file is not a copy
+  of the notes.
 - **Drag where it means something.** Reorder a list or a board, file a project under
   a group, drop a task on another project, or drop it on another day.
 - **Sharing.** Owner, editor and viewer roles. There is no open registration:
@@ -128,6 +150,17 @@ Apple Reminders, forward mail into it, and add it to Claude as a connector.
 | OpenAPI 3.1 spec, checked against the router | Done, tested |
 | End-to-end smoke tests (Playwright) | Done |
 | Documentation, landing page, licence | Done |
+| Notes sealed at rest: title and body encrypted in the database | Done, tested |
+| `@name` in a note shares it with that person, and tells them | Done, tested |
+| Share a project with somebody who already has an account, by name | Done, tested |
+| Invitations that have not been taken up stay visible, and can be withdrawn | Done, tested |
+| Told when a project is shared with you — and able to leave it | Done, tested |
+| Push from other programs: a webhook address per person | Done, tested |
+| Today's plan as a card on **I dag**, not only as a notification | Done, tested |
+| Search the settings, from the page or from ⌘K | Done, tested |
+| Choose which browser a link opens in | Done, tested |
+| Images in notes: open full size, copy to the clipboard | Done, tested |
+| Install count: two values, once a day, one click to stop | Done, tested |
 
 **Not finished:** Web Push, the AI providers and the Google Calendar API calls are
 implemented against their specifications and have only ever been exercised there,

cmd/verdande/main.go

@@ -26,6 +26,9 @@ var version = "dev"
 
 func main() {
 	if err := run(); err != nil {
+		// Not the edition's name: this fires before the configuration is read, so
+		// the edition is not known yet — and one of the things it reports is a
+		// VERDANDE_EDITION the program refused.
 		fmt.Fprintf(os.Stderr, "verdande: %v\n", err)
 		os.Exit(1)
 	}
@@ -37,7 +40,9 @@ func run() error {
 		return err
 	}
 	log := httpapi.NewLogger(cfg.Dev)
-	log.Info("starting verdande", "version", version, "data_dir", cfg.DataDir, "base_url", cfg.BaseURL)
+	// The edition's own name, so an urd instance's log says urd. The full edition
+	// still logs "starting verdande", which is what the release check reads.
+	log.Info("starting "+cfg.ProductSlug(), "version", version, "data_dir", cfg.DataDir, "base_url", cfg.BaseURL, "edition", cfg.Edition)
 
 	// The data volume is the only state that matters; create the whole layout up
 	// front so a failure here is a startup error rather than a surprise at the

docs/beacon.md

@@ -1,6 +1,7 @@
 # The install count
 
-verdande reports that it exists. Two values, once a day:
+verdande reports that it exists — and so does urd, which is the same program in
+its [notes edition](editions.md). Two values, once a day:
 
 ```json
 {
@@ -11,7 +12,8 @@ verdande reports that it exists. Two values, once a day:
 
 That is the whole message. No IP is stored by the collector, no hostname, no
 domain, no account, no counts of anything you have made, nothing about what you
-use it for. The payload is small enough to be printed in full on the settings page,
+use it for — and not which of the two editions is running, so the count does not
+tell the two apart either. The payload is small enough to be printed in full on the settings page,
 and it is printed there — a promise about telemetry is worth exactly as much as
 your ability to check it.
 

docs/configuration.md

@@ -11,6 +11,7 @@ nowhere to put one that the operator would ever see.
 | `VERDANDE_ADDR` | `:8080` | Listen address. |
 | `VERDANDE_DATA_DIR` | `/data` | Database, uploaded files and backups. |
 | `VERDANDE_DEV` | `false` | Human-readable logs at debug level, and a relaxed origin check so a Vite dev server can connect. Never in production. |
+| `VERDANDE_EDITION` | `full` | Which of the two editions this instance is. `full` is verdande — tasks, projects and notes. `notes` is urd: the task routes are not mounted at all, and the program calls itself urd. Any other value refuses to start, by name. See [Two editions](editions.md). |
 
 ## Behind a proxy
 

docs/editions.md

@@ -0,0 +1,98 @@
+# Two editions: verdande and urd
+
+One program, built once, with two faces.
+
+| | **verdande** | **urd** |
+|---|---|---|
+| What it is | Tasks, projects and notes | Notes |
+| `VERDANDE_EDITION` | `full` (the default) | `notes` |
+| Routes served | 200 | 137 |
+| Mark | ᚹ | ᚢ |
+
+Set `VERDANDE_EDITION=notes` and the instance is urd: the task routes are not
+mounted, the sidebar has no way to them, search answers with notes only, and the
+program calls itself urd in its tab, its wordmark and its web manifest.
+
+## Why one codebase and not a fork
+
+The two share everything that is hard: accounts, sessions, passkeys, sharing,
+invitations, the realtime socket, search, the backup format, the migrations. Notes
+are about a twentieth of the Go in this repository and reference no task type;
+tasks reference no note type. A fork would have duplicated the other nineteen
+twentieths in order to separate the one — and then every security fix would have
+needed applying twice, by hand, forever.
+
+So the split is a configuration value read in one place, and the thing that keeps
+it honest is a test rather than a convention: `TestNotesEditionServesOnlyItsOwnRoutes`
+walks both routers, compares them against a written-down list of the 63 withheld
+routes, and fails in **both** directions — a route that appears in the notes
+edition and a route that stops being withheld are both a failure.
+
+## An unknown value refuses to start
+
+`VERDANDE_EDITION=note`, `Notes` and `none` are all rejected at startup, by name,
+rather than being treated as "not notes".
+
+The silent direction is the dangerous one here. An operator who sets up an instance
+for notes and mistypes the value would otherwise get every task route served on it,
+with no error anywhere and no way to tell from the outside.
+
+## What urd does not have
+
+The 63 withheld routes:
+
+| | what |
+|---|---|
+| 29 | tasks, sub-tasks, labels, saved filters, reminders, the upcoming and delegated views |
+| 8 | the CalDAV server — every route in it reads or writes a VTODO |
+| 1 | `/.well-known/caldav`, which is a claim that a CalDAV server is here |
+| 1 | the ICS calendar feed, plus 2 for the token it is reached with |
+| 4 | the task exports: `tasks.ics`, `projects.zip`, and a project's `.csv` and `.ics` |
+| 2 | the Todoist and CSV imports, which create tasks |
+| 4 | project templates — a template is a project plus sections plus tasks |
+| 5 | sections, which group tasks: `section_id` is a column on `tasks` and not on `notes` |
+| 6 | the AI task features: split, tidy the inbox, and the day's plan |
+| 1 | the inbox hook, which pushes a line of text in as a task |
+
+Plus five of the nine MCP tools — `search_tasks`, `create_task`, `update_task`,
+`complete_task` and `add_comment`. The endpoint is still there; the tool list is
+shorter. A tool a model can call is a surface, and one that answers "there are no
+tasks" is worse than one that does not exist: the model tries it, gets an empty
+answer, and tells the person there is nothing to do.
+
+Everything else is the same program:
+
+- accounts, invitations, passkeys and two-factor
+- projects — which in urd are what a note belongs to
+- per-note sharing with other people, independent of projects
+- search, over notes
+- export, of notes
+- the mail, calendar and MCP surfaces, minus their task routes and task tools
+- AI settings, `ask`, and the note actions
+
+!!! warning "Still being decided"
+    Four connectors are reachable in urd today and have not been settled either
+    way, because each has a plausible notes reading and withholding them would be
+    deciding what this product is rather than closing a hole: the mail-in address,
+    IMAP mailboxes, Gmail, and Google Calendar. They currently file what they
+    receive as **tasks**, so in urd they connect and then have nowhere to put
+    anything. The same applies to one handler rather than a route:
+    `POST /api/v1/ai/notes/{noteID}/actions/apply` creates tasks from a note.
+
+## The name
+
+Verðandi and Urðr are two of the three Norns in Völuspá, and the poem has them
+cutting marks into wood — the act of writing something down. Verdande is what is
+becoming; Urd is what has become and was kept.
+
+An instance started without the task routes is a different product to the person
+using it, so it says a different name. That name is read from the configuration in
+one place (`Config.ProductName`), which is why there is no build-time flag and no
+second frontend: the frontend is byte-identical in both editions, and the server
+renames the two files a browser reads before any JavaScript runs — the HTML shell's
+title and the web manifest.
+
+!!! note "The beacon counts them separately"
+    Both editions report the same two values once a day — instance id and version
+    — and nothing else; see [The install count](beacon.md). The edition is not in
+    the payload, so the count does not distinguish them.

docs/notes.md

@@ -41,6 +41,16 @@ it in an export. Every raster format works; SVG is stored but not shown inline
 it is a document that can run script, and a note is not a place to run somebody
 else's.
 
+**Click one to see it whole.** In the note it is scaled down to the width of the
+column — a photo off a phone is four thousand pixels across — so what you are
+looking at is a thumbnail that does not look like one. The full-size view has a
+button that copies the picture to the clipboard, and a link that opens it in its
+own tab. Escape closes it and puts the cursor back where it was.
+
+Copying converts to PNG on the way out when it has to. Clipboards take PNG and
+little else, and a photo off a phone is a JPEG — without the conversion the copy
+either fails or succeeds with something nothing will paste.
+
 ### Code blocks
 
 A fenced block is coloured for the language it names, and guesses when it does not.
@@ -128,6 +138,14 @@ Search finds a word wherever it is:
   body. A word in the title is what the note is about; the same word once in a long
   body is a mention.
 
+Two places to search from, and they now agree. The field above the list filters it
+in place. **⌘K** searches everything at once — tasks, projects, notes and the
+settings — and picking a note from it opens that note *with the rest of the matches
+still in the list beside it*. It used to drop you on the ordinary list, so the
+other results existed only in the popup you had just closed. The address carries
+the search, which also means a search worth keeping can be bookmarked or sent to
+somebody.
+
 ## Putting notes away
 
 Two different things, and the difference matters:

docs/openapi.yaml

@@ -53,7 +53,7 @@ paths:
   /api/v1/auth/setup:
     get:
       tags: [auth]
-      summary: Whether this instance still needs its first account.
+      summary: What this instance is, and whether it still needs its first account.
       security: []
       responses:
         "200":
@@ -64,6 +64,16 @@ paths:
                 type: object
                 properties:
                   needs_setup: { type: boolean }
+                  edition:
+                    type: string
+                    enum: [full, notes]
+                    description: >
+                      `full` is tasks, projects and notes together. `notes` is
+                      the notes half: the task routes are not mounted at all, so
+                      an instance that is not a task manager cannot be asked to
+                      be one through its API. The interface reads this before
+                      anybody is signed in, because it decides what there is to
+                      show rather than what this person may see.
     post:
       tags: [auth]
       summary: Create the first account, which becomes the administrator.
@@ -848,6 +858,20 @@ paths:
                 project_id:
                   type: string
                   description: Where it goes when the text names no project.
+                section_id:
+                  type: string
+                  description: >
+                    The section the box was opened in. A "/section" in the text
+                    wins, because typing it is a choice and standing there is a
+                    circumstance.
+                parent_id:
+                  type: string
+                  description: >
+                    Makes it a sub-task. A sub-task lives in its parent's
+                    project, so a "#project" on the same line is not honoured —
+                    it comes back as `unknown_project` rather than being
+                    silently dropped. Dates, labels and priority are read the
+                    same way as for any other line.
       responses:
         "201":
           description: Created
@@ -3143,6 +3167,40 @@ paths:
                   to: { type: string, format: date }
         "422": { $ref: "#/components/responses/Validation" }
 
+  /api/v1/export/projects.zip:
+    get:
+      tags: [projects]
+      summary: Every project's tasks as a CSV, in a zip.
+      description: >
+        One CSV per project, in the column layout Todoist writes — so the files
+        import into Todoist and into anything else that reads that shape. A zip
+        rather than one wide file because that is the shape on the other side,
+        and because a single project can be lifted out of it without opening a
+        spreadsheet. The per-project link does the same for one project; this is
+        the whole account in one download.
+      responses:
+        "200":
+          description: A zip archive.
+          content:
+            application/zip:
+              schema: { type: string, format: binary }
+
+  /api/v1/export/tasks.ics:
+    get:
+      tags: [projects]
+      summary: Every dated task as a calendar of VTODOs.
+      description: >
+        One file, not a zip: a calendar is made to hold many things, and each
+        task carries its project with it, so nothing is lost by putting them
+        together. Tasks without a due date are left out — a VTODO with no date
+        is a line most readers drop on the floor.
+      responses:
+        "200":
+          description: An iCalendar file.
+          content:
+            text/calendar:
+              schema: { type: string }
+
   /api/v1/export/notes.zip:
     get:
       tags: [notes]

internal/config/config.go

@@ -38,6 +38,28 @@ type Config struct {
 	// Empty means a key file beside the data — see internal/secret.
 	SecretKey string
 
+	// Edition decides which half of the program this instance serves.
+	//
+	// "full" is tasks, projects and notes together — what Verdande has always
+	// been. "notes" mounts the notes half and the base underneath it, and leaves
+	// the task routes unmounted: not hidden in the interface, absent from the
+	// router, so an instance that is not a task manager cannot be asked to be one
+	// through its API.
+	//
+	// Notes already stand nearly alone — they reference no task type anywhere in
+	// the store, and the one link between the halves is a `note_links` row whose
+	// kind happens to be "task". What is NOT separable is everything underneath
+	// both: accounts, sessions, invites, sharing, notifications, attachments,
+	// search. Hence one program with two faces rather than two programs: the
+	// alternative is two copies of the base, and two copies of a thing is how the
+	// copies start to disagree.
+	//
+	// Projects stay mounted in both. In the notes edition a project is a
+	// notebook — the same column, the same sharing, a different word — because a
+	// second grouping concept beside `note_shares` would be a second thing to keep
+	// in step for a difference nobody can see.
+	Edition string
+
 	// UpdateCheck asks GitHub whether a newer release exists. Off unless asked
 	// for: a self-hosted app that reaches out without being told to has broken
 	// the deal its operator made by self-hosting.
@@ -136,6 +158,7 @@ func Load() (*Config, error) {
 		PanelServerID:      env("VERDANDE_PANEL_SERVER_ID", ""),
 		GmailClientSecret:  env("VERDANDE_GMAIL_CLIENT_SECRET", ""),
 		SecretKey:          env("VERDANDE_SECRET_KEY", ""),
+		Edition:            env("VERDANDE_EDITION", EditionFull),
 		UpdateCheck:        envBool("VERDANDE_UPDATE_CHECK", false),
 	}
 
@@ -171,6 +194,19 @@ func Load() (*Config, error) {
 		return nil, fmt.Errorf("VERDANDE_DATA_DIR: %w", err)
 	}
 
+	// Afvist frem for gætte. En stavefejl — "note", "Notes" — ville ellers falde
+	// tilbage til den fulde udgave og servere opgaveruterne på en instans, der
+	// blev sat op for ikke at have dem. Det er den stille retning af fejlen, og
+	// den eneste måde at opdage den på ville være at bemærke, at noget virker,
+	// som ikke burde.
+	switch c.Edition {
+	case EditionFull, EditionNotes:
+	case "":
+		c.Edition = EditionFull
+	default:
+		return nil, fmt.Errorf("VERDANDE_EDITION: %q is not %q or %q", c.Edition, EditionFull, EditionNotes)
+	}
+
 	c.RealIPHeader = env("VERDANDE_REAL_IP_HEADER", "X-Forwarded-For")
 	if c.TrustedProxies, err = parseTrustedProxies(env("VERDANDE_TRUSTED_PROXIES", "")); err != nil {
 		return nil, err

internal/config/edition.go

@@ -0,0 +1,46 @@
+package config
+
+// The two faces of the program. Strings rather than a bool, because a bool named
+// `NotesOnly` answers one question and this one will be asked again — and a
+// third edition would mean changing every reading of it rather than adding a case.
+const (
+	EditionFull  = "full"
+	EditionNotes = "notes"
+)
+
+// NotesOnly is the one question the router asks. Written as a method so the
+// comparison lives in one place: `cfg.Edition == "notes"` spelled out at twenty
+// call sites is twenty chances to typo a string the compiler does not check.
+func (c *Config) NotesOnly() bool { return c.Edition == EditionNotes }
+
+// ProductName and ProductSlug are the two forms of the name the running instance
+// calls itself: "Urd" in a sentence, "urd" in a window title, a wordmark and a
+// manifest.
+//
+// Two editions of one program, two names — which is the whole reason the name is
+// read from the configuration rather than written into the templates. Verdande is
+// what is happening now; Urd, its sister in Völuspá, is what was cut into the wood
+// and kept. An instance started without the task routes is a different product to
+// whoever uses it, and a product that calls itself by its sibling's name is not a
+// product, it is a flag somebody set.
+//
+// The lowercase form is deliberate and not a styling accident: the wordmark, the
+// repository and the window title are all lowercase, so the slug is the name and
+// ProductName is the one that gets a capital because it stands in prose.
+func (c *Config) ProductName() string {
+	if c.NotesOnly() {
+		return "Urd"
+	}
+	return "Verdande"
+}
+
+// ProductSlug is ProductName lowercased, kept as its own method rather than as
+// strings.ToLower at the call sites: the two are the same transformation today and
+// a name that does not lowercase cleanly would otherwise be a bug in every caller
+// at once.
+func (c *Config) ProductSlug() string {
+	if c.NotesOnly() {
+		return "urd"
+	}
+	return "verdande"
+}

internal/config/edition_test.go

@@ -0,0 +1,44 @@
+package config
+
+import (
+	"testing"
+)
+
+// A typo in VERDANDE_EDITION must stop the program, not fall through to the full
+// edition. That is the silent direction of this fault: an instance set up to be a
+// notes program would serve every task route, and the only way to notice would be
+// to spot that something works which should not.
+func TestUnknownEditionIsRefused(t *testing.T) {
+	for _, tc := range []struct {
+		value string
+		want  string // the edition we expect, or "" when Load must fail
+	}{
+		{"", EditionFull}, // unset is the full program, as it has always been
+		{EditionFull, EditionFull},
+		{EditionNotes, EditionNotes},
+		{"note", ""},  // a letter short
+		{"Notes", ""}, // the right word, the wrong case
+		{"none", ""},  // plausible and meaning nothing
+	} {
+		t.Setenv("VERDANDE_EDITION", tc.value)
+		t.Setenv("VERDANDE_DATA_DIR", t.TempDir())
+
+		got, err := Load()
+		if tc.want == "" {
+			if err == nil {
+				t.Errorf("VERDANDE_EDITION=%q was accepted and gave %q", tc.value, got.Edition)
+			}
+			continue
+		}
+		if err != nil {
+			t.Errorf("VERDANDE_EDITION=%q: %v", tc.value, err)
+			continue
+		}
+		if got.Edition != tc.want {
+			t.Errorf("VERDANDE_EDITION=%q gave %q, want %q", tc.value, got.Edition, tc.want)
+		}
+		if notes := got.NotesOnly(); notes != (tc.want == EditionNotes) {
+			t.Errorf("VERDANDE_EDITION=%q: NotesOnly() = %v", tc.value, notes)
+		}
+	}
+}

internal/httpapi/auth_handlers.go

@@ -492,7 +492,14 @@ func (s *Server) handleSetupState(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, r, "count users", err)
 		return
 	}
-	writeJSON(w, http.StatusOK, map[string]bool{"needs_setup": n == 0})
+	// Udgaven hører til her og ikke på /auth/me: den er en egenskab ved
+	// instansen, ikke ved den, der er logget ind, og fladen skal kende den, før
+	// nogen er. Det her er i forvejen kaldet, der spørger "hvad er det her for en
+	// instans", så den følger med uden en ekstra tur.
+	writeJSON(w, http.StatusOK, struct {
+		NeedsSetup bool   `json:"needs_setup"`
+		Edition    string `json:"edition"`
+	}{n == 0, s.edition()})
 }
 
 func (s *Server) startSession(w http.ResponseWriter, r *http.Request, user *store.User) {

internal/httpapi/csp.go

@@ -36,7 +36,18 @@ func scriptHashes(web fs.FS) []string {
 	if err != nil {
 		return nil
 	}
+	return scriptHashesIn(raw)
+}
 
+// scriptHashesIn is the same thing over bytes that are already in hand.
+//
+// It exists because the notes edition does not serve the index.html that is on
+// disk — it serves a renamed copy of it (see shell.go) — and the policy has to
+// describe the bytes that actually leave the server. Hashing the file while
+// serving something else is the shape of mistake that cannot be noticed locally:
+// the policy is not enforced for a page opened from a file, so the page is blank
+// in production and nowhere else.
+func scriptHashesIn(raw []byte) []string {
 	var out []string
 	seen := map[string]bool{}
 	for _, match := range inlineScript.FindAllStringSubmatchIndex(string(raw), -1) {

internal/httpapi/edition.go

@@ -0,0 +1,16 @@
+package httpapi
+
+import "github.com/kristianwind/verdande/internal/config"
+
+// edition is what this instance tells the world it is.
+//
+// Never the empty string, even when the config was built by hand in a test and
+// never went through config.Load: a flade that reads "" cannot tell "this is the
+// full program" from "this build forgot to say", and the first of those is the
+// answer that has always been true.
+func (s *Server) edition() string {
+	if s.cfg.NotesOnly() {
+		return config.EditionNotes
+	}
+	return config.EditionFull
+}

internal/httpapi/edition_test.go

@@ -0,0 +1,375 @@
+package httpapi
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/kristianwind/verdande/internal/config"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// The notes edition is a different program, and this is what makes that true.
+//
+// A gate in a route tree is the easiest thing in the world to believe and the
+// hardest to see: the code reads `if full {`, somebody confirms the mechanism
+// exists, and nothing ever asks whether it covers the routes it was written for.
+// So this does not check that a gate is *present*. It walks both routers and
+// compares the two sets of routes they actually serve.
+//
+// The difference is written down below. A route added later that differs between
+// the editions — in either direction — fails here until somebody says which half
+// it belongs to. That is the point: the list is the decision, and the walk is
+// what keeps the decision honest.
+func TestNotesEditionServesOnlyItsOwnRoutes(t *testing.T) {
+	full := routesOf(t, config.EditionFull)
+	notes := routesOf(t, config.EditionNotes)
+
+	// Every route the full edition has and the notes edition does not. Written as
+	// the whole list rather than a prefix rule: a prefix is a description of what
+	// somebody meant, and this has to be a description of what is there.
+	//
+	// And note what this list could NOT catch, because it is the shape of mistake
+	// that outlived the first version of this test. The list went green at 29
+	// routes for two merges while CalDAV, the ICS feed, the inbox hook, four task
+	// exports, both task imports, the project templates, the sections and six AI
+	// task endpoints were all still served by the notes edition — because the test
+	// compares the router against THIS LIST, and the list was written from the
+	// routes somebody had thought of. It is a drift check, and it cannot be an
+	// is-it-complete check.
+	//
+	// So when a route is added that one edition should not have, the question to
+	// ask is not "does the walk still pass" but "can this endpoint do anything at
+	// all without the half it is being withheld from". Three of the ones above were
+	// settled by reading rather than by the name: a template turned out to create
+	// tasks (CreateProjectFromTemplate), `section_id` turned out to exist on
+	// `tasks` and not on `notes`, and add_comment turned out to hang off a task.
+	withheld := map[string]bool{}
+	for _, r := range []string{
+		"DELETE /api/v1/filters/{filterID}",
+		"DELETE /api/v1/labels/{labelID}",
+		"DELETE /api/v1/reminders/{reminderID}",
+		"DELETE /api/v1/sections/{sectionID}",
+		"DELETE /api/v1/tasks/{taskID}",
+		"DELETE /api/v1/templates/{templateID}",
+		"DELETE /caldav/{userID}/{projectID}/{taskFile}",
+		"GET /.well-known/caldav",
+		"GET /api/v1/ai/plan",
+		"GET /api/v1/delegated",
+		"GET /api/v1/export/projects.zip",
+		"GET /api/v1/export/projects/{projectID}.csv",
+		"GET /api/v1/export/projects/{projectID}.ics",
+		"GET /api/v1/export/tasks.ics",
+		"GET /api/v1/feed",
+		"GET /api/v1/filters",
+		"GET /api/v1/filters/preview",
+		"GET /api/v1/filters/{filterID}/tasks",
+		"GET /api/v1/labels",
+		"GET /api/v1/projects/{projectID}/sections",
+		"GET /api/v1/tasks",
+		"GET /api/v1/tasks/quick-add/preview",
+		"GET /api/v1/tasks/{taskID}",
+		"GET /api/v1/tasks/{taskID}/comments",
+		"GET /api/v1/tasks/{taskID}/reminders",
+		"GET /api/v1/templates",
+		"GET /api/v1/upcoming",
+		"GET /caldav/{userID}/{projectID}/{taskFile}",
+		"GET /ics/{token}",
+		"OPTIONS /caldav/*",
+		"PATCH /api/v1/filters/{filterID}",
+		"PATCH /api/v1/labels/{labelID}",
+		"PATCH /api/v1/sections/{sectionID}",
+		"PATCH /api/v1/tasks/{taskID}",
+		"POST /api/v1/ai/inbox/tidy",
+		"POST /api/v1/ai/inbox/tidy/apply",
+		"POST /api/v1/ai/plan/now",
+		"POST /api/v1/ai/tasks/{taskID}/split",
+		"POST /api/v1/feed/rotate",
+		"POST /api/v1/filters",
+		"POST /api/v1/import/csv",
+		"POST /api/v1/import/todoist",
+		"POST /api/v1/labels",
+		"POST /api/v1/projects/{projectID}/sections",
+		"POST /api/v1/projects/{projectID}/sections/reorder",
+		"POST /api/v1/tasks",
+		"POST /api/v1/tasks/quick-add",
+		"POST /api/v1/tasks/{taskID}/attachments",
+		"POST /api/v1/tasks/{taskID}/comments",
+		"POST /api/v1/tasks/{taskID}/complete",
+		"POST /api/v1/tasks/{taskID}/move",
+		"POST /api/v1/tasks/{taskID}/reminders",
+		"POST /api/v1/tasks/{taskID}/reopen",
+		"POST /api/v1/tasks/{taskID}/snooze",
+		"POST /api/v1/templates",
+		"POST /api/v1/templates/{templateID}/use",
+		"POST /inbound/hook/{token}",
+		"PROPFIND /caldav",
+		"PROPFIND /caldav/{userID}",
+		"PROPFIND /caldav/{userID}/{projectID}",
+		"PUT /api/v1/ai/plan",
+		"PUT /caldav/{userID}/{projectID}/{taskFile}",
+		"REPORT /caldav/{userID}/{projectID}",
+	} {
+		withheld[r] = true
+	}
+
+	var unexpected, stillThere []string
+	for r := range full {
+		if notes[r] {
+			if withheld[r] {
+				stillThere = append(stillThere, r)
+			}
+			continue
+		}
+		if !withheld[r] {
+			unexpected = append(unexpected, r)
+		}
+	}
+	// And the other direction: the notes edition must not grow a route the full
+	// one lacks. A gate that adds is not a gate either.
+	var onlyInNotes []string
+	for r := range notes {
+		if !full[r] {
+			onlyInNotes = append(onlyInNotes, r)
+		}
+	}
+
+	sort.Strings(unexpected)
+	sort.Strings(stillThere)
+	sort.Strings(onlyInNotes)
+	for _, r := range unexpected {
+		t.Errorf("withheld from the notes edition but not written down here: %s", r)
+	}
+	for _, r := range stillThere {
+		t.Errorf("listed as withheld and still served by the notes edition: %s", r)
+	}
+	for _, r := range onlyInNotes {
+		t.Errorf("served only by the notes edition: %s", r)
+	}
+
+	// Printed on the green as well as the red. "The editions differ correctly" over
+	// zero withheld routes and over twenty-nine are the same pass, and only one of
+	// them means anything — so the number is on screen either way.
+	t.Logf("full: %d routes · notes: %d · withheld: %d", len(full), len(notes), len(full)-len(notes))
+
+	// The half that stops this being a deletion rather than a gate: what the notes
+	// edition is FOR has to still be there.
+	for _, must := range []string{
+		"GET /api/v1/notes",
+		"POST /api/v1/notes",
+		"PATCH /api/v1/notes/{noteID}",
+		"DELETE /api/v1/notes/{noteID}",
+		// Deling er hele grunden til at det er et selvstændigt produkt frem for en
+		// enkeltbrugers notesblok, så den halvdel skal navngives her.
+		"POST /api/v1/notes/{noteID}/shares",
+		"GET /api/v1/notes/{noteID}/shares",
+		"POST /api/v1/notes/{noteID}/attachments",
+		"POST /api/v1/notes/import",
+		"GET /api/v1/export/notes.zip",
+		"GET /api/v1/export/account",
+		"POST /api/v1/ai/notes/{noteID}/actions",
+		"GET /api/v1/projects", // a notebook, in this edition
+		"GET /api/v1/search",
+		"GET /api/v1/auth/me",
+		// 34 ruter blev lukket i den anden omgang af denne port. Den her linje er
+		// den, der afgør, at det var en port: MCP-endepunktet er stadig der, og det
+		// er værktøjslisten bagved, der er kortere.
+		"POST /api/v1/mcp",
+		"POST /mcp",
+	} {
+		if !notes[must] {
+			t.Errorf("the notes edition does not serve %s — that is a deletion, not a gate", must)
+		}
+	}
+}
+
+// routesOf builds a server at one edition and returns every route it serves.
+func routesOf(t *testing.T, edition string) map[string]bool {
+	t.Helper()
+
+	db, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+
+	srv := New(&config.Config{
+		BaseURL: "http://127.0.0.1", DataDir: t.TempDir(), Edition: edition,
+		SessionTTL: time.Hour, InviteTTL: time.Hour, ResetTTL: time.Hour,
+	}, db, slog.New(slog.NewTextHandler(io.Discard, nil)), nil)
+
+	out := map[string]bool{}
+	err = chi.Walk(srv.router,
+		func(method, route string, _ http.Handler, _ ...func(http.Handler) http.Handler) error {
+			if route != "/" {
+				route = strings.TrimSuffix(route, "/")
+			}
+			out[method+" "+route] = true
+			return nil
+		})
+	if err != nil {
+		t.Fatalf("walk routes: %v", err)
+	}
+	if len(out) < 50 {
+		// A walk that found almost nothing would make every comparison below pass.
+		t.Fatalf("only %d routes at edition %q — the walk found nothing to compare", len(out), edition)
+	}
+	return out
+}
+
+// The interface cannot gate itself on something it is not told, and it has to be
+// told before anybody is signed in — an instance's shape is not a permission.
+func TestSetupStateSaysWhichEdition(t *testing.T) {
+	for _, tc := range []struct{ edition, want string }{
+		{config.EditionFull, "full"},
+		{config.EditionNotes, "notes"},
+		{"", "full"}, // a config built by hand is the program as it has always been
+	} {
+		ts := newTestServerWith(t, func(c *config.Config) { c.Edition = tc.edition })
+
+		_, body := ts.do(t, "GET", "/api/v1/auth/setup", nil)
+		if got := body["edition"]; got != tc.want {
+			t.Errorf("edition %q reported as %v, want %q", tc.edition, got, tc.want)
+		}
+		// And the field it has always had is still there: adding one must not
+		// quietly replace the answer the sign-in screen depends on.
+		if _, ok := body["needs_setup"]; !ok {
+			t.Errorf("edition %q: needs_setup is gone from the answer", tc.edition)
+		}
+	}
+}
+
+// Search is mounted in both editions — notes and notebooks have to be findable —
+// so it is the one door that could still open onto the half the router just shut.
+//
+// Not a theoretical case. An instance converted from a full one still has the
+// tasks in its database, and ⌘K would be the only place they turned up.
+func TestNotesEditionSearchFindsNoTasks(t *testing.T) {
+	for _, tc := range []struct {
+		edition string
+		want    int
+	}{
+		{config.EditionFull, 1},
+		{config.EditionNotes, 0},
+	} {
+		ts := newTestServerWith(t, func(c *config.Config) { c.Edition = tc.edition })
+		ts.bootstrap(t)
+
+		_, me := ts.do(t, "GET", "/api/v1/auth/me", nil)
+		userID, _ := me["id"].(string)
+		if userID == "" {
+			t.Fatalf("no user: %v", me)
+		}
+
+		// Created through the store rather than the API: in the notes edition there
+		// is no route to create one, and the row this is about is the row that is
+		// already there.
+		inbox, err := ts.db.InboxID(context.Background(), userID)
+		if err != nil {
+			t.Fatal(err)
+		}
+		task := &store.Task{ProjectID: inbox, Content: "Kvartalsregnskabet", CreatedBy: userID}
+		if err := ts.db.CreateTask(context.Background(), task, nil); err != nil {
+			t.Fatal(err)
+		}
+
+		_, body := ts.do(t, "GET", "/api/v1/search?q=Kvartalsregnskabet", nil)
+		found, _ := body["tasks"].([]any)
+		if len(found) != tc.want {
+			t.Errorf("edition %q: search returned %d tasks, want %d", tc.edition, len(found), tc.want)
+		}
+		// The full edition's number is the control: a search that finds nothing at
+		// all would satisfy the notes case for the wrong reason.
+		if tc.edition == config.EditionFull && len(found) == 0 {
+			t.Errorf("the full edition found no tasks either — this proves nothing about the notes one")
+		}
+	}
+}
+
+// TestNotesEditionOffersNoTaskToolsOverMCP.
+//
+// The same hole as the routes, through a different door — and it was still open
+// after the first gate. An MCP server advertises its tools, so a model connected
+// to a notes instance would be told it can create_task, call it, get something
+// back, and tell the person their task was filed.
+//
+// Asked through tools/list rather than by reading the server's own slice: that is
+// what a client actually sees, and the slice is unexported for the same reason.
+func TestNotesEditionOffersNoTaskToolsOverMCP(t *testing.T) {
+	taskTools := []string{"search_tasks", "create_task", "update_task", "complete_task", "add_comment"}
+	noteTools := []string{"search_notes", "create_note", "update_note"}
+
+	for _, edition := range []string{config.EditionFull, config.EditionNotes} {
+		t.Run(edition, func(t *testing.T) {
+			names := mcpToolNames(t, edition)
+
+			// Both editions: the shared tool, and the notes half.
+			for _, want := range append([]string{"list_projects"}, noteTools...) {
+				if !names[want] {
+					t.Errorf("%s edition does not offer %s", edition, want)
+				}
+			}
+			for _, task := range taskTools {
+				switch edition {
+				case config.EditionFull:
+					if !names[task] {
+						t.Errorf("the full edition lost %s — that is a deletion, not a gate", task)
+					}
+				default:
+					if names[task] {
+						t.Errorf("the notes edition offers %s over MCP", task)
+					}
+				}
+			}
+			t.Logf("%s: %d tools", edition, len(names))
+		})
+	}
+}
+
+// mcpToolNames asks one edition's MCP server for its tool list.
+func mcpToolNames(t *testing.T, edition string) map[string]bool {
+	t.Helper()
+
+	db, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+
+	cfg := &config.Config{BaseURL: "http://localhost", DataDir: t.TempDir(), SessionTTL: time.Hour, Edition: edition}
+	srv := New(cfg, db, slog.New(slog.NewTextHandler(io.Discard, nil)), nil)
+
+	resp := srv.mcp.Handle(context.Background(), "nobody", []byte(`{"jsonrpc":"2.0","id":1,"method":"tools/list"}`))
+	if resp == nil {
+		t.Fatal("tools/list got no response")
+	}
+	raw, err := json.Marshal(resp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var parsed struct {
+		Result struct {
+			Tools []struct{ Name string } `json:"tools"`
+		} `json:"result"`
+	}
+	if err := json.Unmarshal(raw, &parsed); err != nil {
+		t.Fatalf("tools/list: %v — %s", err, raw)
+	}
+	if len(parsed.Result.Tools) == 0 {
+		t.Fatalf("tools/list returned no tools at all: %s", raw)
+	}
+	names := map[string]bool{}
+	for _, tool := range parsed.Result.Tools {
+		names[tool.Name] = true
+	}
+	return names
+}

internal/httpapi/import_handlers.go

@@ -1,6 +1,7 @@
 package httpapi
 
 import (
+	"archive/zip"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -272,6 +273,111 @@ func (s *Server) handleExportProject(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// handleExportAllCSV is every project at once, one CSV per project in a zip.
+//
+// A zip rather than one wide CSV with a project column: Todoist's own export is a
+// file per project, so that is the shape an importer on the other side expects —
+// and the shape somebody can pick a single project out of without opening a
+// spreadsheet. Same reasoning as the notes export, which is a folder of Markdown
+// rather than one long file.
+//
+// It exists because the per-project links are per project: fifteen projects meant
+// fifteen downloads to move your own tasks somewhere else, which is an export that
+// technically works and nobody uses.
+func (s *Server) handleExportAllCSV(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+
+	projects, err := s.db.ListProjects(r.Context(), user.ID, true)
+	if err != nil {
+		s.internal(w, r, "export projects", err)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/zip")
+	w.Header().Set("Content-Disposition",
+		`attachment; filename="verdande-opgaver-`+time.Now().Format("2006-01-02")+`.zip"`)
+
+	zw := zip.NewWriter(w)
+	defer zw.Close()
+
+	// Two projects can share a name — they are still two projects, and a zip with
+	// one entry written twice loses one of them. Same guard as the notes export.
+	used := map[string]int{}
+	for _, project := range projects {
+		exported, err := s.buildExport(r, user, &project)
+		if err != nil {
+			// The response is already streaming, so there is no status left to send.
+			// Stopping leaves a truncated zip, which a zip tool reports as truncated —
+			// better than a complete-looking file with a project missing from it.
+			s.log.Error("export projects", "err", err, "project", project.ID)
+			return
+		}
+
+		name := strings.TrimSuffix(ics.Filename(project.Name), ".ics")
+		used[name]++
+		if used[name] > 1 {
+			name = fmt.Sprintf("%s (%d)", name, used[name])
+		}
+
+		f, err := zw.CreateHeader(&zip.FileHeader{Name: name + ".csv", Method: zip.Deflate})
+		if err != nil {
+			s.log.Error("export projects", "err", err, "project", project.ID)
+			return
+		}
+		if err := todoist.Write(f, todoist.ToRows(exported)); err != nil {
+			s.log.Error("export projects", "err", err, "project", project.ID)
+			return
+		}
+	}
+}
+
+// handleExportAllICS is every dated task in one calendar.
+//
+// One file and not a zip, unlike the CSV above, because a calendar is made to hold
+// many things and every reader takes a file with hundreds of VTODOs. The project
+// travels with each task as its own field, so nothing is lost by merging them.
+func (s *Server) handleExportAllICS(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+	ctx := r.Context()
+
+	projects, err := s.db.ListProjects(ctx, user.ID, true)
+	if err != nil {
+		s.internal(w, r, "export ics", err)
+		return
+	}
+	names := map[string]string{}
+	for _, p := range projects {
+		names[p.ID] = p.Name
+	}
+
+	tasks, err := s.db.ListTasks(ctx, user.ID, store.TaskFilter{
+		IncludeCompleted: true, Limit: 5000,
+	})
+	if err != nil {
+		s.internal(w, r, "export ics", err)
+		return
+	}
+
+	cal := ics.Calendar{Name: s.cfg.ProductName(), Domain: feedDomain(s.cfg.BaseURL)}
+	for _, t := range tasks {
+		if t.DueDate == "" {
+			continue
+		}
+		cal.Tasks = append(cal.Tasks, ics.Task{
+			ID: t.ID, Content: t.Content, Description: t.Description,
+			ProjectName: names[t.ProjectID], DueDate: t.DueDate, DueDatetime: t.DueDatetime,
+			DurationMin: t.DurationMin, Priority: t.Priority, Recurrence: t.RecurrenceRule,
+			Completed: t.Completed(), CompletedAt: t.CompletedAt,
+			CreatedAt: t.CreatedAt, UpdatedAt: t.UpdatedAt,
+		})
+	}
+
+	w.Header().Set("Content-Type", "text/calendar; charset=utf-8")
+	w.Header().Set("Content-Disposition",
+		`attachment; filename="verdande-opgaver-`+time.Now().Format("2006-01-02")+`.ics"`)
+	w.Write([]byte(ics.Render(cal)))
+}
+
 // buildExport turns a stored project back into the neutral shape the CSV writer
 // takes, rebuilding the task tree from parent ids.
 func (s *Server) buildExport(r *http.Request, user *store.User, project *store.Project) (todoist.Project, error) {

internal/httpapi/mcp_handlers.go

@@ -23,7 +23,9 @@ import (
 // `search_tasks` and `list_projects` is answering "which of these gets me closer",
 // and a description that only names the endpoint gives it nothing to decide with.
 func (s *Server) buildMCP() *mcp.Server {
-	m := mcp.NewServer("verdande", "1")
+	// Udgavens eget navn: det er sådan, instansen står i klientens
+	// forbindelsesliste.
+	m := mcp.NewServer(s.cfg.ProductSlug(), "1")
 
 	m.Register(mcp.Tool{
 		Name: "list_projects",
@@ -34,72 +36,79 @@ func (s *Server) buildMCP() *mcp.Server {
 		}),
 	}, s.mcpListProjects)
 
-	m.Register(mcp.Tool{
-		Name: "search_tasks",
-		Description: "Find tasks by text, project, label, priority, due date or assignee. " +
-			"This is the tool for any question about what the user has to do — " +
-			"\"what is due today\", \"what is overdue\", \"anything about the tax return\". " +
-			"The query accepts the same filter language as the app: \"today & p1\", " +
-			"\"overdue\", \"#Firma & @regnskab\", \"7 days\", \"assigned to: me\".",
-		InputSchema: mcp.Schema(map[string]any{
-			"query":             mcp.Str("A filter expression, e.g. \"today & p1\" or \"overdue\"."),
-			"text":              mcp.Str("Free text to search task titles and descriptions for."),
-			"limit":             mcp.Int("How many tasks to return. Defaults to 50, maximum 200."),
-			"include_completed": mcp.Bool("Include tasks that are already done. Defaults to false."),
-		}),
-	}, s.mcpSearchTasks)
+	// De fem opgaveværktøjer. Udeladt i noter-udgaven af samme grund som ruterne:
+	// et værktøj, en model kan kalde, er en flade på instansen, og et værktøj der
+	// svarer "der er ingen opgaver" er værre end et, der ikke findes — modellen
+	// prøver det, får et tomt svar og fortæller brugeren, at der ikke er noget at
+	// lave. add_comment er med her: en kommentar hænger på en opgave.
+	if !s.cfg.NotesOnly() {
+		m.Register(mcp.Tool{
+			Name: "search_tasks",
+			Description: "Find tasks by text, project, label, priority, due date or assignee. " +
+				"This is the tool for any question about what the user has to do — " +
+				"\"what is due today\", \"what is overdue\", \"anything about the tax return\". " +
+				"The query accepts the same filter language as the app: \"today & p1\", " +
+				"\"overdue\", \"#Firma & @regnskab\", \"7 days\", \"assigned to: me\".",
+			InputSchema: mcp.Schema(map[string]any{
+				"query":             mcp.Str("A filter expression, e.g. \"today & p1\" or \"overdue\"."),
+				"text":              mcp.Str("Free text to search task titles and descriptions for."),
+				"limit":             mcp.Int("How many tasks to return. Defaults to 50, maximum 200."),
+				"include_completed": mcp.Bool("Include tasks that are already done. Defaults to false."),
+			}),
+		}, s.mcpSearchTasks)
 
-	m.Register(mcp.Tool{
-		Name: "create_task",
-		Description: "Create a task. Prefer passing the whole thing as natural language in " +
-			"`text` — \"betal moms i morgen kl 10 p1 #Firma @regnskab\" — because the app's own " +
-			"parser handles dates, times, priorities, projects, labels and recurrence in Danish " +
-			"and English. Use the explicit fields only when the user was explicit.",
-		InputSchema: mcp.Schema(map[string]any{
-			"text":        mcp.Str("The task as a sentence, parsed for date, time, priority, #project, @label and recurrence."),
-			"content":     mcp.Str("The task title, if not using `text`."),
-			"project_id":  mcp.Str("Which project. Defaults to the Inbox. Naming a project that does not exist is not an error — the task goes to the Inbox and the answer says so."),
-			"parent_id":   mcp.Str("Make this a sub-task of that task. It joins the parent's project. One level deep."),
-			"due_date":    mcp.Str("A date as YYYY-MM-DD."),
-			"priority":    mcp.Int("1 (highest) to 4 (none)."),
-			"description": mcp.Str("Longer notes on the task."),
-			"labels":      mcp.StrArray("Label names."),
-		}),
-	}, s.mcpCreateTask)
+		m.Register(mcp.Tool{
+			Name: "create_task",
+			Description: "Create a task. Prefer passing the whole thing as natural language in " +
+				"`text` — \"betal moms i morgen kl 10 p1 #Firma @regnskab\" — because the app's own " +
+				"parser handles dates, times, priorities, projects, labels and recurrence in Danish " +
+				"and English. Use the explicit fields only when the user was explicit.",
+			InputSchema: mcp.Schema(map[string]any{
+				"text":        mcp.Str("The task as a sentence, parsed for date, time, priority, #project, @label and recurrence."),
+				"content":     mcp.Str("The task title, if not using `text`."),
+				"project_id":  mcp.Str("Which project. Defaults to the Inbox. Naming a project that does not exist is not an error — the task goes to the Inbox and the answer says so."),
+				"parent_id":   mcp.Str("Make this a sub-task of that task. It joins the parent's project. One level deep."),
+				"due_date":    mcp.Str("A date as YYYY-MM-DD."),
+				"priority":    mcp.Int("1 (highest) to 4 (none)."),
+				"description": mcp.Str("Longer notes on the task."),
+				"labels":      mcp.StrArray("Label names."),
+			}),
+		}, s.mcpCreateTask)
 
-	m.Register(mcp.Tool{
-		Name: "update_task",
-		Description: "Change an existing task: its title, description, priority, due date or " +
-			"project. Only the fields given are changed. To move a due date, pass due_date; " +
-			"to clear it, pass an empty string.",
-		InputSchema: mcp.Schema(map[string]any{
-			"task_id":     mcp.Str("The task to change."),
-			"content":     mcp.Str("A new title."),
-			"description": mcp.Str("New notes."),
-			"priority":    mcp.Int("1 (highest) to 4 (none)."),
-			"due_date":    mcp.Str("A date as YYYY-MM-DD, or an empty string to remove the date."),
-			"project_id":  mcp.Str("Move the task to another project."),
-			"labels":      mcp.StrArray("Replace the task's labels."),
-		}, "task_id"),
-	}, s.mcpUpdateTask)
+		m.Register(mcp.Tool{
+			Name: "update_task",
+			Description: "Change an existing task: its title, description, priority, due date or " +
+				"project. Only the fields given are changed. To move a due date, pass due_date; " +
+				"to clear it, pass an empty string.",
+			InputSchema: mcp.Schema(map[string]any{
+				"task_id":     mcp.Str("The task to change."),
+				"content":     mcp.Str("A new title."),
+				"description": mcp.Str("New notes."),
+				"priority":    mcp.Int("1 (highest) to 4 (none)."),
+				"due_date":    mcp.Str("A date as YYYY-MM-DD, or an empty string to remove the date."),
+				"project_id":  mcp.Str("Move the task to another project."),
+				"labels":      mcp.StrArray("Replace the task's labels."),
+			}, "task_id"),
+		}, s.mcpUpdateTask)
 
-	m.Register(mcp.Tool{
-		Name: "complete_task",
-		Description: "Mark a task done. A repeating task advances to its next occurrence " +
-			"instead of closing, and the result says so.",
-		InputSchema: mcp.Schema(map[string]any{
-			"task_id": mcp.Str("The task to complete."),
-		}, "task_id"),
-	}, s.mcpCompleteTask)
+		m.Register(mcp.Tool{
+			Name: "complete_task",
+			Description: "Mark a task done. A repeating task advances to its next occurrence " +
+				"instead of closing, and the result says so.",
+			InputSchema: mcp.Schema(map[string]any{
+				"task_id": mcp.Str("The task to complete."),
+			}, "task_id"),
+		}, s.mcpCompleteTask)
 
-	m.Register(mcp.Tool{
-		Name:        "add_comment",
-		Description: "Add a comment to a task. Everyone else with access to the project is notified.",
-		InputSchema: mcp.Schema(map[string]any{
-			"task_id": mcp.Str("The task to comment on."),
-			"body":    mcp.Str("What to say."),
-		}, "task_id", "body"),
-	}, s.mcpAddComment)
+		m.Register(mcp.Tool{
+			Name:        "add_comment",
+			Description: "Add a comment to a task. Everyone else with access to the project is notified.",
+			InputSchema: mcp.Schema(map[string]any{
+				"task_id": mcp.Str("The task to comment on."),
+				"body":    mcp.Str("What to say."),
+			}, "task_id", "body"),
+		}, s.mcpAddComment)
+	}
 
 	s.registerNoteTools(m)
 	return m

internal/httpapi/server.go

@@ -3,6 +3,7 @@
 package httpapi
 
 import (
+	"bytes"
 	"encoding/json"
 	"errors"
 	"io/fs"
@@ -77,6 +78,11 @@ type Server struct {
 	// Computed once from the built index.html; see csp.go.
 	csp string
 
+	// The shell and the manifest with this edition's name in them, or nil to serve
+	// the built files unchanged. Only the notes edition needs them; see shell.go.
+	shell    []byte
+	manifest []byte
+
 	router chi.Router
 }
 
@@ -86,7 +92,7 @@ type Server struct {
 func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server {
 	s := &Server{
 		cfg: cfg, db: db, log: log, web: web,
-		mail:         mail.New(cfg.SMTP, cfg.BaseURL, log),
+		mail:         mail.New(cfg.SMTP, cfg.BaseURL, cfg.ProductSlug(), log),
 		hub:          realtime.NewHub(log),
 		loginLimiter: newLimiter(10, 15*time.Minute),
 		// Generous on purpose: the caller is the mail server, one address delivering
@@ -101,8 +107,36 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 		// generous for a person and hopeless for a search through a million.
 		totpLimiter: newLimiter(10, time.Hour),
 	}
-	s.csp = contentSecurityPolicy(scriptHashes(web))
-	if w, err := auth.NewWebAuthn(cfg.BaseURL, "verdande"); err == nil {
+	// Before the CSP, deliberately: the policy has to describe the bytes that go
+	// out, and in the notes edition those are the renamed ones.
+	//
+	// A failure here is logged rather than fatal, and that is a judgement about
+	// this particular failure rather than a habit: an unknown VERDANDE_EDITION
+	// refuses to start, because serving task routes on an instance set up without
+	// them is a different kind of wrong. A shell whose title says the sibling's
+	// name is cosmetic — it must be loud, and it must not take the instance down.
+	// What makes it loud is not this line: the end-to-end suite reads the served
+	// title, so an anchor that falls out of app.html goes red there.
+	if web != nil && cfg.NotesOnly() {
+		shell, manifest, err := rebrandedAssets(web, cfg.ProductSlug(), notesShellDescription, notesManifestDescription)
+		if err != nil {
+			log.Error("the frontend could not be renamed for this edition; it will call itself verdande",
+				"edition", cfg.Edition, "err", err)
+		} else {
+			s.shell, s.manifest = shell, manifest
+		}
+	}
+
+	if s.shell != nil {
+		s.csp = contentSecurityPolicy(scriptHashesIn(s.shell))
+	} else {
+		s.csp = contentSecurityPolicy(scriptHashes(web))
+	}
+	// The second argument is WebAuthn's display name, not its relying party id —
+	// the id comes from BaseURL. So this is what the operating system's passkey
+	// prompt calls the site, and the slug keeps it identical to what every existing
+	// verdande instance already registered.
+	if w, err := auth.NewWebAuthn(cfg.BaseURL, cfg.ProductSlug()); err == nil {
 		s.passkeys = w
 	} else {
 		log.Warn("passkeys are unavailable", "err", err, "base_url", cfg.BaseURL)
@@ -125,13 +159,31 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 	// Docker both need this to answer before anyone has logged in.
 	r.Get("/healthz", s.handleHealth)
 
+	// The same question as inside /api/v1, asked again here because four of the
+	// task-only surfaces live outside it: the calendar feed, CalDAV, the inbox
+	// hook, and the well-known path CalDAV clients discover through. They are out
+	// here because their callers cannot hold a session, not because they are any
+	// less about tasks — and the first gate missed all four for exactly that
+	// reason. It read as complete because the /tasks tree was covered.
+	full := !s.cfg.NotesOnly()
+
 	// The calendar feed is outside /api/v1 and outside the session: a calendar
 	// client cannot log in, so the token in the path is the whole credential.
-	r.Get("/ics/{token}", s.handleICSFeed)
+	//
+	// A feed of VTODOs, so there is nothing for it to answer in the notes edition.
+	if full {
+		r.Get("/ics/{token}", s.handleICSFeed)
 
-	// CalDAV, outside /api/v1 because clients do well-known-path discovery
-	// against the root and authenticate with Basic rather than a session.
-	r.Get("/.well-known/caldav", s.wellKnownCalDAV)
+		// CalDAV, outside /api/v1 because clients do well-known-path discovery
+		// against the root and authenticate with Basic rather than a session.
+		//
+		// Withheld rather than left to answer an empty collection: the well-known
+		// path is a claim that a CalDAV server is here, and a client that believes
+		// it goes on to PROPFIND, authenticate, and sync nothing — reporting a
+		// broken calendar server on an instance that has none and needs none. Same
+		// reasoning as the /.well-known/ 404 in serveWeb.
+		r.Get("/.well-known/caldav", s.wellKnownCalDAV)
+	}
 
 	// Inbound mail. Delivered by the mail server rather than by a browser, and
 	// authenticated by the token in the recipient address.
@@ -156,8 +208,13 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 	//
 	// Sin egen kvote frem for postens: en travl integration skal ikke kunne lukke
 	// for den indgående post, og omvendt.
-	r.Method(http.MethodPost, "/inbound/hook/{token}",
-		s.rateLimit(s.hookLimiter, http.HandlerFunc(s.handleInboundHook)))
+	//
+	// Opgaver, efter sin egen beskrivelse ovenfor — den skubber en linje tekst ind
+	// i indbakken — så den findes ikke i noter-udgaven.
+	if full {
+		r.Method(http.MethodPost, "/inbound/hook/{token}",
+			s.rateLimit(s.hookLimiter, http.HandlerFunc(s.handleInboundHook)))
+	}
 
 	// MCP with the token in the query string, for clients that cannot send a
 	// header. Claude's custom-connector dialog takes a URL and nothing else, so
@@ -184,7 +241,10 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 		// Gmail connection with calendar tokens.
 		r.Get("/oauth/calendar/callback", s.handleCalendarCallback)
 	})
-	r.Route("/caldav", s.caldavRoutes)
+	// Hele CalDAV-træet: otte ruter, der alle læser eller skriver en VTODO.
+	if full {
+		r.Route("/caldav", s.caldavRoutes)
+	}
 
 	r.Route("/api/v1", func(r chi.Router) {
 		r.Use(s.requireCSRF)
@@ -285,6 +345,10 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 
 		// Everything past this point needs a complete login.
 		r.Group(func(r chi.Router) {
+			// Opgavehalvdelen monteres kun i den fulde udgave. Ikke skjult i
+			// fladen — fraværende fra routeren, så en instans, der ikke er et
+			// opgaveprogram, heller ikke kan bedes om at være det gennem sit API.
+			full := !s.cfg.NotesOnly()
 			r.Use(s.requireAuth)
 
 			r.Get("/ws", s.handleWebSocket)
@@ -294,17 +358,26 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 			r.Post("/mcp", s.handleMCP)
 
 			r.Get("/today", s.handleToday)
-			r.Get("/filters/preview", s.handlePreviewFilter)
+			if full {
+				r.Get("/filters/preview", s.handlePreviewFilter)
+			}
 
-			r.Route("/filters", func(r chi.Router) {
-				r.Get("/", s.handleListFilters)
-				r.Post("/", s.handleCreateFilter)
-				r.Get("/{filterID}/tasks", s.handleRunFilter)
-				r.Patch("/{filterID}", s.handleUpdateFilter)
-				r.Delete("/{filterID}", s.handleDeleteFilter)
-			})
+			if full {
+				r.Route("/filters", func(r chi.Router) {
+					r.Get("/", s.handleListFilters)
+					r.Post("/", s.handleCreateFilter)
+					r.Get("/{filterID}/tasks", s.handleRunFilter)
+					r.Patch("/{filterID}", s.handleUpdateFilter)
+					r.Delete("/{filterID}", s.handleDeleteFilter)
+				})
+			}
 
-			r.Get("/feed", s.handleGetFeed)
+			// Tokenet til ICS-feedet ovenfor. Et token til et feed, der ikke
+			// findes, er en indstillingsside, der tilbyder en adresse, intet
+			// svarer på.
+			if full {
+				r.Get("/feed", s.handleGetFeed)
+			}
 
 			r.Route("/notifications", func(r chi.Router) {
 				r.Get("/", s.handleListNotifications)
@@ -330,7 +403,9 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				r.Patch("/", s.handleUpdateComment)
 				r.Delete("/", s.handleDeleteComment)
 			})
-			r.Post("/feed/rotate", s.handleRotateFeed)
+			if full {
+				r.Post("/feed/rotate", s.handleRotateFeed)
+			}
 
 			r.Get("/mail-address", s.handleGetMailAddress)
 			r.Post("/mail-address/rotate", s.handleRotateMailAddress)
@@ -351,20 +426,24 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				r.Get("/settings", s.handleGetAISettings)
 				r.Put("/settings", s.handleSetAISettings)
 				r.Post("/summary", s.handleAISummary)
-				r.Post("/tasks/{taskID}/split", s.handleAISplit)
-				// Forslag, ikke skrivninger. De to første svarer med linjer i
-				// quick-add-syntaks, som fladen viser frem; de to sidste er dét,
-				// der sker, når nogen siger ja til én af dem.
-				r.Post("/inbox/tidy", s.handleAITidyInbox)
-				r.Post("/inbox/tidy/apply", s.handleAIApplyToTask)
+				if full {
+					r.Post("/tasks/{taskID}/split", s.handleAISplit)
+					// Forslag, ikke skrivninger. De to første svarer med linjer i
+					// quick-add-syntaks, som fladen viser frem; de to sidste er dét,
+					// der sker, når nogen siger ja til én af dem.
+					r.Post("/inbox/tidy", s.handleAITidyInbox)
+					r.Post("/inbox/tidy/apply", s.handleAIApplyToTask)
+				}
 				r.Post("/notes/{noteID}/actions", s.handleAINoteActions)
 				r.Post("/notes/{noteID}/actions/apply", s.handleAICreateFromNote)
 				// Dagens plan: indstillingen, og en knap til at se den nu. En
 				// indstilling, man skal vente til i morgen for at se virkningen af,
 				// er en indstilling, ingen tør slå til.
-				r.Get("/plan", s.handleGetPlanSettings)
-				r.Put("/plan", s.handleSetPlanSettings)
-				r.Post("/plan/now", s.handlePlanNow)
+				if full {
+					r.Get("/plan", s.handleGetPlanSettings)
+					r.Put("/plan", s.handleSetPlanSettings)
+					r.Post("/plan/now", s.handlePlanNow)
+				}
 				// Spørg om sine egne noter og opgaver i almindeligt sprog. Basen
 				// finder kandidaterne, modellen læser dem — og svaret bærer, hvad
 				// det er bygget på.
@@ -449,33 +528,53 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				r.Delete("/subscriptions/{id}", s.handleUnsubscribeCalendar)
 			})
 
-			r.Route("/import", func(r chi.Router) {
-				r.Post("/todoist", s.handleImportTodoist)
-				r.Post("/csv", s.handleImportCSV)
-			})
+			// Begge retninger laver eller læser opgaver: Todoist-importen laver
+			// dem, CSV-importen laver dem, og de fire opgave-eksporter skriver dem
+			// ud. De blev alle betjent i noter-udgaven indtil nu — de svarede tomt
+			// frem for at fejle, hvilket er den stille version af samme fejl.
+			if full {
+				r.Route("/import", func(r chi.Router) {
+					r.Post("/todoist", s.handleImportTodoist)
+					r.Post("/csv", s.handleImportCSV)
+				})
+			}
 
 			r.Get("/export/account", s.handleExportAccount)
 			r.Get("/export/notes.zip", s.handleExportNotes)
-			r.Get("/export/projects/{projectID}.csv", s.handleExportProject)
-			r.Get("/export/projects/{projectID}.ics", s.handleExportProjectICS)
+			if full {
+				r.Get("/export/projects.zip", s.handleExportAllCSV)
+				r.Get("/export/tasks.ics", s.handleExportAllICS)
+				r.Get("/export/projects/{projectID}.csv", s.handleExportProject)
+				r.Get("/export/projects/{projectID}.ics", s.handleExportProjectICS)
+			}
 
-			r.Route("/templates", func(r chi.Router) {
-				r.Get("/", s.handleListTemplates)
-				r.Post("/", s.handleSaveTemplate)
-				r.Post("/{templateID}/use", s.handleUseTemplate)
-				r.Delete("/{templateID}", s.handleDeleteTemplate)
-			})
+			// En skabelon er et projekt plus sektioner plus opgaver — læst i
+			// CreateProjectFromTemplate frem for gættet ud fra rutenavnet, som
+			// kun siger "projekt". Uden opgaver er den et tomt projekt med
+			// overskrifter i.
+			if full {
+				r.Route("/templates", func(r chi.Router) {
+					r.Get("/", s.handleListTemplates)
+					r.Post("/", s.handleSaveTemplate)
+					r.Post("/{templateID}/use", s.handleUseTemplate)
+					r.Delete("/{templateID}", s.handleDeleteTemplate)
+				})
+			}
 
-			r.Delete("/reminders/{reminderID}", s.handleDeleteReminder)
+			if full {
+				r.Delete("/reminders/{reminderID}", s.handleDeleteReminder)
+			}
 
-			r.Route("/labels", func(r chi.Router) {
-				r.Get("/", s.handleListLabels)
-				r.Post("/", s.handleCreateLabel)
-				r.Patch("/{labelID}", s.handleUpdateLabel)
-				r.Delete("/{labelID}", s.handleDeleteLabel)
-			})
-			r.Get("/upcoming", s.handleUpcoming)
-			r.Get("/delegated", s.handleDelegated)
+			if full {
+				r.Route("/labels", func(r chi.Router) {
+					r.Get("/", s.handleListLabels)
+					r.Post("/", s.handleCreateLabel)
+					r.Patch("/{labelID}", s.handleUpdateLabel)
+					r.Delete("/{labelID}", s.handleDeleteLabel)
+				})
+				r.Get("/upcoming", s.handleUpcoming)
+				r.Get("/delegated", s.handleDelegated)
+			}
 			r.Get("/people", s.handlePeople)
 			r.Get("/search", s.handleSearch)
 
@@ -491,7 +590,13 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 					r.Use(s.requireProject(store.RoleViewer))
 
 					r.Get("/", s.handleGetProject)
-					r.Get("/sections", s.handleListSections)
+					// Sektioner grupperer opgaver inde i et projekt, og det er
+					// afgjort af skemaet frem for af navnet: `section_id` står på
+					// `tasks` og findes ikke på `notes`. En sektion i en notesbog
+					// kan ikke indeholde noget.
+					if full {
+						r.Get("/sections", s.handleListSections)
+					}
 					r.Get("/members", s.handleListMembers)
 					// Uden for ejer-gruppen, fordi den nu dækker to ting: ejeren, der
 					// fjerner nogen, og den, der selv går. Handleren skiller dem ad.
@@ -500,8 +605,10 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 
 					r.Group(func(r chi.Router) {
 						r.Use(s.requireProject(store.RoleEditor))
-						r.Post("/sections", s.handleCreateSection)
-						r.Post("/sections/reorder", s.handleReorderSections)
+						if full {
+							r.Post("/sections", s.handleCreateSection)
+							r.Post("/sections/reorder", s.handleReorderSections)
+						}
 					})
 
 					r.Group(func(r chi.Router) {
@@ -576,32 +683,36 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 			r.Get("/trash/projects", s.handleListTrashedProjects)
 			r.Post("/trash/projects/{projectID}/restore", s.handleRestoreProject)
 
-			r.Route("/sections/{sectionID}", func(r chi.Router) {
-				r.Patch("/", s.handleUpdateSection)
-				r.Delete("/", s.handleDeleteSection)
-			})
-
-			r.Route("/tasks", func(r chi.Router) {
-				r.Get("/", s.handleListTasks)
-				r.Post("/", s.handleCreateTask)
-				r.Post("/quick-add", s.handleQuickAdd)
-				r.Get("/quick-add/preview", s.handleQuickAddPreview)
-
-				r.Route("/{taskID}", func(r chi.Router) {
-					r.Get("/", s.handleGetTask)
-					r.Patch("/", s.handleUpdateTask)
-					r.Delete("/", s.handleDeleteTask)
-					r.Get("/comments", s.handleListComments)
-					r.Post("/comments", s.handleCreateComment)
-					r.Post("/attachments", s.handleUploadAttachment)
-					r.Get("/reminders", s.handleListReminders)
-					r.Post("/reminders", s.handleCreateReminder)
-					r.Post("/complete", s.handleCompleteTask)
-					r.Post("/reopen", s.handleReopenTask)
-					r.Post("/move", s.handleMoveTask)
-					r.Post("/snooze", s.handleSnoozeTask)
+			if full {
+				r.Route("/sections/{sectionID}", func(r chi.Router) {
+					r.Patch("/", s.handleUpdateSection)
+					r.Delete("/", s.handleDeleteSection)
 				})
-			})
+			}
+
+			if full {
+				r.Route("/tasks", func(r chi.Router) {
+					r.Get("/", s.handleListTasks)
+					r.Post("/", s.handleCreateTask)
+					r.Post("/quick-add", s.handleQuickAdd)
+					r.Get("/quick-add/preview", s.handleQuickAddPreview)
+
+					r.Route("/{taskID}", func(r chi.Router) {
+						r.Get("/", s.handleGetTask)
+						r.Patch("/", s.handleUpdateTask)
+						r.Delete("/", s.handleDeleteTask)
+						r.Get("/comments", s.handleListComments)
+						r.Post("/comments", s.handleCreateComment)
+						r.Post("/attachments", s.handleUploadAttachment)
+						r.Get("/reminders", s.handleListReminders)
+						r.Post("/reminders", s.handleCreateReminder)
+						r.Post("/complete", s.handleCompleteTask)
+						r.Post("/reopen", s.handleReopenTask)
+						r.Post("/move", s.handleMoveTask)
+						r.Post("/snooze", s.handleSnoozeTask)
+					})
+				})
+			}
 		})
 	})
 
@@ -669,7 +780,7 @@ func (s *Server) serveWeb(w http.ResponseWriter, r *http.Request) {
 	if s.web == nil {
 		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("verdande — API is running. The web interface was not built into this binary.\n"))
+		w.Write([]byte(s.cfg.ProductSlug() + " — API is running. The web interface was not built into this binary.\n"))
 		return
 	}
 
@@ -690,6 +801,24 @@ func (s *Server) serveWeb(w http.ResponseWriter, r *http.Request) {
 	}
 	defer f.Close()
 
+	// Only here is `name` settled, and that matters: every client-side route —
+	// /noter and all the rest — arrives as a path with no file behind it and is
+	// resolved to index.html by the fallback above. Asking before the fallback
+	// would have renamed the shell for a request to "/" and handed back the built
+	// one for every other route in the app.
+	//
+	// These two assets never reach the filesystem: they are the built files with
+	// this edition's name in them, held in memory since startup. See shell.go.
+	if b := s.renamed(name); b != nil {
+		w.Header().Set("Content-Type", contentTypeFor(name))
+		// A zero modification time tells ServeContent to send no Last-Modified and
+		// to answer no conditional request — right for a shell that must never be
+		// cached, and the same thing the built shell gets below.
+		w.Header().Set("Cache-Control", "no-cache")
+		http.ServeContent(w, r, name, time.Time{}, bytes.NewReader(b))
+		return
+	}
+
 	info, err := f.Stat()
 	if err != nil || info.IsDir() {
 		writeJSON(w, http.StatusNotFound, map[string]string{"error": "not found"})

internal/httpapi/shell.go

@@ -0,0 +1,139 @@
+package httpapi
+
+import (
+	"bytes"
+	"fmt"
+	"io/fs"
+)
+
+// The product name is in the built frontend as a literal in four places, because
+// all four are read before any JavaScript runs: the window title and the meta
+// description in the HTML shell, and the two names in the web manifest that decide
+// what an installed PWA is called on a home screen.
+//
+// They cannot be filled in by the app at runtime. The shell is parsed before the
+// first script executes, the manifest is fetched by the browser rather than by us,
+// and the edition is not known until /auth/setup-state has answered — so a frontend
+// that renamed itself after loading would show the sibling's name first and correct
+// itself a moment later, on every load, in the tab and on the install prompt.
+//
+// So the server does it, once at startup, on the way out. One frontend build, two
+// names: the build is identical in both editions and the bytes served differ.
+//
+// Each replacement is REQUIRED and the anchors are exact. A rewrite that quietly
+// matched nothing is the whole failure mode here — it leaves an Urd instance
+// calling itself verdande, which is cosmetic enough that nobody files it and
+// nothing else notices.
+type rebrand struct {
+	old, new string
+}
+
+// shellRebrands returns the replacements for index.html.
+//
+// Note what is NOT in here: `localStorage.getItem('verdande:theme')` and its two
+// neighbours in the inline theme script. Those keys are storage, not a name — the
+// rest of the app reads the same three, so renaming them here and nowhere else
+// would set the theme from one key and read it from another, and the only symptom
+// is the white flash that script exists to prevent. This is why the replacements
+// are written out as whole anchored strings rather than as a replace of the word
+// "verdande".
+func shellRebrands(slug, description string) []rebrand {
+	return []rebrand{
+		{"<title>verdande</title>", "<title>" + slug + "</title>"},
+		{
+			`<meta name="description" content="verdande — opgaver og projekter, delt." />`,
+			`<meta name="description" content="` + description + `" />`,
+		},
+	}
+}
+
+// manifestRebrands returns the replacements for manifest.webmanifest. The
+// manifest's own description is a sentence rather than the shell's "name — sentence"
+// form, so it is passed separately rather than derived.
+func manifestRebrands(slug, description string) []rebrand {
+	return []rebrand{
+		{`"name": "verdande"`, `"name": "` + slug + `"`},
+		{`"short_name": "verdande"`, `"short_name": "` + slug + `"`},
+		{`"description": "Opgaver og projekter, delt."`, `"description": "` + description + `"`},
+	}
+}
+
+// applyRebrands replaces every pair exactly once and fails on the first anchor it
+// cannot find, naming it. Failing loudly rather than returning what it managed is
+// the point: a partial rename is a page whose tab and whose install prompt disagree
+// about which program this is.
+func applyRebrands(raw []byte, pairs []rebrand) ([]byte, error) {
+	out := raw
+	for _, p := range pairs {
+		old := []byte(p.old)
+		if bytes.Count(out, old) != 1 {
+			return nil, fmt.Errorf("found %d occurrences of %q, want exactly 1", bytes.Count(out, old), p.old)
+		}
+		out = bytes.Replace(out, old, []byte(p.new), 1)
+	}
+	return out, nil
+}
+
+// rebrandedAssets reads index.html and manifest.webmanifest out of the built
+// frontend and returns them renamed for this edition.
+//
+// Both or neither: an instance serving a renamed shell beside the sibling's
+// manifest installs under the wrong name on a phone, which is the half nobody looks
+// at until it is on their home screen.
+func rebrandedAssets(web fs.FS, slug, shellDesc, manifestDesc string) (shell, manifest []byte, err error) {
+	raw, err := fs.ReadFile(web, "index.html")
+	if err != nil {
+		return nil, nil, fmt.Errorf("index.html: %w", err)
+	}
+	shell, err = applyRebrands(raw, shellRebrands(slug, shellDesc))
+	if err != nil {
+		return nil, nil, fmt.Errorf("index.html: %w", err)
+	}
+
+	raw, err = fs.ReadFile(web, "manifest.webmanifest")
+	if err != nil {
+		return nil, nil, fmt.Errorf("manifest.webmanifest: %w", err)
+	}
+	manifest, err = applyRebrands(raw, manifestRebrands(slug, manifestDesc))
+	if err != nil {
+		return nil, nil, fmt.Errorf("manifest.webmanifest: %w", err)
+	}
+	return shell, manifest, nil
+}
+
+// The descriptions for the notes edition. Kept beside the replacements they feed
+// rather than in the locale files, because these two strings are read by a browser
+// and a home screen before any locale has been chosen — the shell is in Danish for
+// the same reason the built app.html is.
+const (
+	notesShellDescription    = "urd — noter, delt."
+	notesManifestDescription = "Noter, delt."
+)
+
+// renamed returns the renamed bytes for `name`, or nil to serve the built file.
+//
+// Nil for everything in the full edition, which is what keeps that path exactly as
+// it was: one comparison per request against a nil slice.
+func (s *Server) renamed(name string) []byte {
+	switch name {
+	case "index.html":
+		return s.shell
+	case "manifest.webmanifest":
+		return s.manifest
+	}
+	return nil
+}
+
+// contentTypeFor names the type for the two assets served from memory.
+//
+// http.ServeContent sniffs from the extension, and it gets .html right and
+// .webmanifest wrong — Go's table does not have it, so the sniffer reads the first
+// bytes, sees JSON-ish text and answers text/plain. A manifest served as text/plain
+// is ignored by the browser without an error anywhere: the install prompt simply
+// does not appear.
+func contentTypeFor(name string) string {
+	if name == "manifest.webmanifest" {
+		return "application/manifest+json"
+	}
+	return "text/html; charset=utf-8"
+}

internal/httpapi/shell_test.go

@@ -0,0 +1,235 @@
+package httpapi
+
+import (
+	"io"
+	"io/fs"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"testing/fstest"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/config"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// serverWithWeb builds the real router around a frontend, which newTestServerWith
+// cannot do — it passes nil for the web filesystem, because every other test here
+// is about the API. The renaming only happens when there is something to rename.
+func serverWithWeb(t *testing.T, edition string, web fs.FS) *Server {
+	t.Helper()
+
+	db, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+
+	cfg := &config.Config{
+		BaseURL:    "http://localhost",
+		DataDir:    t.TempDir(),
+		SessionTTL: 24 * time.Hour,
+		Edition:    edition,
+	}
+	return New(cfg, db, slog.New(slog.NewTextHandler(io.Discard, nil)), web)
+}
+
+// The shell as the frontend build produces it, cut down to the parts that matter
+// here: the two anchors that get renamed, and the inline theme script that must
+// not be touched. TestAppHTMLStillCarriesTheAnchors below is what keeps this
+// honest against the real file.
+const builtShell = `<!doctype html>
+<html lang="da" data-theme="dark">
+	<head>
+		<meta name="description" content="verdande — opgaver og projekter, delt." />
+		<link rel="manifest" href="/manifest.webmanifest" />
+		<title>verdande</title>
+		<script>
+			try {
+				const stored = localStorage.getItem('verdande:theme');
+				const look = localStorage.getItem('verdande:look');
+				if (look && look !== 'verdande') document.documentElement.dataset.look = look;
+			} catch (e) {}
+		</script>
+	</head>
+	<body></body>
+</html>
+`
+
+const builtManifest = `{
+  "name": "verdande",
+  "short_name": "verdande",
+  "description": "Opgaver og projekter, delt.",
+  "start_url": "/"
+}
+`
+
+func builtWeb() fstest.MapFS {
+	return fstest.MapFS{
+		"index.html":            {Data: []byte(builtShell)},
+		"manifest.webmanifest":  {Data: []byte(builtManifest)},
+		"_app/immutable/app.js": {Data: []byte("// app")},
+	}
+}
+
+// TestRenamingTheShellLeavesTheStorageKeysAlone is the one this file exists for.
+//
+// The product name and the localStorage prefix are the same word in app.html, and
+// they are not the same thing: the prefix is read back by the app itself, so
+// renaming it here and nowhere else sets the theme from one key and reads it from
+// another. The symptom is the white flash on load that the inline script exists to
+// prevent — which is to say, no error, nothing in a log, and nothing a test that
+// merely checked the title would see.
+func TestRenamingTheShellLeavesTheStorageKeysAlone(t *testing.T) {
+	shell, manifest, err := rebrandedAssets(builtWeb(), "urd", "urd — noter, delt.", "Noter, delt.")
+	if err != nil {
+		t.Fatalf("rebrandedAssets: %v", err)
+	}
+
+	got := string(shell)
+	for _, want := range []string{
+		"<title>urd</title>",
+		`content="urd — noter, delt."`,
+	} {
+		if !strings.Contains(got, want) {
+			t.Errorf("the shell does not contain %q", want)
+		}
+	}
+	// Named values rather than "no occurrences of verdande": the three keys are
+	// what has to survive, so the assertion says the three keys.
+	for _, want := range []string{
+		`localStorage.getItem('verdande:theme')`,
+		`localStorage.getItem('verdande:look')`,
+		`look !== 'verdande'`,
+	} {
+		if !strings.Contains(got, want) {
+			t.Errorf("renaming the shell changed a storage key: %q is gone", want)
+		}
+	}
+	if strings.Contains(got, "urd:theme") || strings.Contains(got, "urd:look") {
+		t.Error("renaming the shell rewrote a localStorage prefix; the app reads the verdande: ones")
+	}
+
+	gotManifest := string(manifest)
+	for _, want := range []string{`"name": "urd"`, `"short_name": "urd"`, `"description": "Noter, delt."`} {
+		if !strings.Contains(gotManifest, want) {
+			t.Errorf("the manifest does not contain %q", want)
+		}
+	}
+}
+
+// TestRenamingTheShellKeepsTheCSPHashValid pins the relationship between the two
+// files that is easy to break and impossible to notice: the policy names a hash of
+// the inline script, and the renamed shell is what gets served. If a replacement
+// ever reached inside the <script>, the hash would change, the browser would refuse
+// to run it, and the page would be blank — in production only, because the policy
+// is not enforced for a page opened from a file.
+func TestRenamingTheShellKeepsTheCSPHashValid(t *testing.T) {
+	shell, _, err := rebrandedAssets(builtWeb(), "urd", "urd — noter, delt.", "Noter, delt.")
+	if err != nil {
+		t.Fatalf("rebrandedAssets: %v", err)
+	}
+
+	before := scriptHashesIn([]byte(builtShell))
+	after := scriptHashesIn(shell)
+	if len(before) != 1 {
+		t.Fatalf("the fixture should have exactly one inline script, found %d", len(before))
+	}
+	if len(after) != len(before) || after[0] != before[0] {
+		t.Errorf("renaming changed the inline script: policy had %v, served shell hashes to %v", before, after)
+	}
+}
+
+// TestRenamingRefusesAMissingAnchor is the direction that matters more than the
+// happy path. A replacement that silently matched nothing leaves an Urd instance
+// calling itself verdande, which is cosmetic enough that nobody reports it — so the
+// rewrite has to say so rather than return what it managed.
+func TestRenamingRefusesAMissingAnchor(t *testing.T) {
+	cases := map[string]fstest.MapFS{
+		"no title": {
+			"index.html":           {Data: []byte(strings.Replace(builtShell, "<title>verdande</title>", "<title>something else</title>", 1))},
+			"manifest.webmanifest": {Data: []byte(builtManifest)},
+		},
+		"no description": {
+			"index.html":           {Data: []byte(strings.Replace(builtShell, `content="verdande — opgaver og projekter, delt."`, `content="other"`, 1))},
+			"manifest.webmanifest": {Data: []byte(builtManifest)},
+		},
+		"no manifest name": {
+			"index.html":           {Data: []byte(builtShell)},
+			"manifest.webmanifest": {Data: []byte(strings.Replace(builtManifest, `"name": "verdande"`, `"name": "other"`, 1))},
+		},
+		"no index.html at all": {
+			"manifest.webmanifest": {Data: []byte(builtManifest)},
+		},
+		"no manifest at all": {
+			"index.html": {Data: []byte(builtShell)},
+		},
+	}
+	for name, web := range cases {
+		t.Run(name, func(t *testing.T) {
+			if _, _, err := rebrandedAssets(web, "urd", "d", "m"); err == nil {
+				t.Error("renaming reported success over a shell it could not rename")
+			}
+		})
+	}
+}
+
+// TestAppHTMLStillCarriesTheAnchors is what stops the fixture above from becoming a
+// frozen copy of a file that has moved on.
+//
+// The anchors are exact strings in web/src/app.html, and that file is edited for
+// unrelated reasons — a meta tag, a new theme attribute. An edit that reformats the
+// title line or rewrites the description breaks the rename and nothing in Go would
+// know, because the Go build graph has never heard of app.html.
+//
+// Note the caching trap that comes with reading a non-Go file from a test: `go
+// test` will serve a cached green over a changed app.html. CI passes -count=1 in
+// both workflows; a local run needs it typed.
+func TestAppHTMLStillCarriesTheAnchors(t *testing.T) {
+	raw, err := os.ReadFile("../../web/src/app.html")
+	if err != nil {
+		t.Skipf("app.html is not reachable from here: %v", err)
+	}
+	src := string(raw)
+
+	for _, pair := range shellRebrands("urd", "d") {
+		if n := strings.Count(src, pair.old); n != 1 {
+			t.Errorf("web/src/app.html contains %d occurrences of the anchor %q, want exactly 1 — "+
+				"the notes edition renames the shell by replacing it", n, pair.old)
+		}
+	}
+	// And the keys the rename must not touch, asserted here too: app.html is where
+	// somebody would rename them, and if they are renamed there they must be
+	// renamed in stores.svelte.js in the same commit.
+	if !strings.Contains(src, `localStorage.getItem('verdande:theme')`) {
+		t.Error("web/src/app.html no longer reads verdande:theme; check that the app reads the same key")
+	}
+	t.Logf("app.html: %d bytes, %d anchors found", len(raw), len(shellRebrands("urd", "d")))
+}
+
+// TestTheFullEditionServesTheBuiltFilesUnchanged is the control. Everything above
+// is about the renamed path; this says the other edition does not go through it.
+func TestTheFullEditionServesTheBuiltFilesUnchanged(t *testing.T) {
+	for _, edition := range []string{"full", "notes"} {
+		t.Run(edition, func(t *testing.T) {
+			srv := serverWithWeb(t, edition, builtWeb())
+			if edition == "full" {
+				if srv.renamed("index.html") != nil || srv.renamed("manifest.webmanifest") != nil {
+					t.Error("the full edition renamed the shell")
+				}
+				return
+			}
+			if srv.renamed("index.html") == nil || srv.renamed("manifest.webmanifest") == nil {
+				t.Fatal("the notes edition did not rename the shell")
+			}
+			if !strings.Contains(string(srv.renamed("index.html")), "<title>urd</title>") {
+				t.Error("the notes edition's shell does not say urd")
+			}
+			if srv.renamed("_app/immutable/app.js") != nil {
+				t.Error("a build asset was served from memory; only the shell and the manifest are renamed")
+			}
+		})
+	}
+}

internal/httpapi/tasks_handlers.go

@@ -501,6 +501,18 @@ type quickAddRequest struct {
 	// the foot of one. Same rule as the project: a "/section" in the text wins,
 	// because typing it is a choice and standing there is a circumstance.
 	SectionID string `json:"section_id,omitempty"`
+
+	// ParentID makes the new task a sub-task of an existing one. It is what a
+	// pasted list uses for its indented lines, and what the sub-task field at the
+	// foot of a task uses — both want the same parsing of dates, #project and
+	// @labels that a top-level task gets, so they come through here rather than
+	// through a second, dumber path.
+	//
+	// A sub-task lives in its parent's project. Saying otherwise would describe a
+	// task whose parent is somewhere else, which the list views cannot draw and
+	// nobody means; a "#project" on an indented line is therefore not honoured,
+	// and the caller is told so the word does not just vanish.
+	ParentID string `json:"parent_id,omitempty"`
 }
 
 func (s *Server) handleQuickAdd(w http.ResponseWriter, r *http.Request) {
@@ -517,6 +529,18 @@ func (s *Server) handleQuickAdd(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// A parent decides the project before anything else is read: a sub-task
+	// somewhere other than its parent is not a shape this program has.
+	parent := (*store.Task)(nil)
+	if req.ParentID != "" {
+		found, err := s.db.GetTask(r.Context(), req.ParentID, user.ID)
+		if err != nil {
+			writeError(w, http.StatusNotFound, CodeNotFound, "not found")
+			return
+		}
+		parent = found
+	}
+
 	projectID := req.ProjectID
 	// Set when the text named a project that does not exist. The task is still
 	// created — see below — but the caller is told, because the alternative is
@@ -532,6 +556,14 @@ func (s *Server) handleQuickAdd(w http.ResponseWriter, r *http.Request) {
 			unknownProject = parsed.Project
 		}
 	}
+	// The parent has the last word, and the word it overrules is reported the same
+	// way an unknown project is — the task is created either way.
+	if parent != nil {
+		if parsed.Project != "" && projectID != parent.ProjectID {
+			unknownProject = parsed.Project
+		}
+		projectID = parent.ProjectID
+	}
 	if projectID == "" {
 		var err error
 		if projectID, err = s.db.InboxID(r.Context(), user.ID); err != nil {
@@ -570,6 +602,9 @@ func (s *Server) handleQuickAdd(w http.ResponseWriter, r *http.Request) {
 		Priority: parsed.Priority, CreatedBy: user.ID, DueDate: parsed.DueDate,
 		RecurrenceRule: parsed.Recurrence,
 	}
+	if parent != nil {
+		t.ParentID = parent.ID
+	}
 	if parsed.DueDate != "" {
 		_, when, err := resolveDue(parsed.DueDate, parsed.DueTime, user.Timezone)
 		if err == nil {

internal/httpapi/tasks_test.go

@@ -1,6 +1,7 @@
 package httpapi
 
 import (
+	"archive/zip"
 	"bytes"
 	"encoding/json"
 	"io"
@@ -1562,6 +1563,178 @@ func TestImportTodoistCSV(t *testing.T) {
 }
 
 // The whole point of import and export together: what goes in comes back out.
+
+// TestQuickAddSubTask covers the parent a pasted list's indented lines use.
+//
+// The line still goes through the same parser as a top-level one — a sub-task
+// with a date is an ordinary thing to paste, and a second, dumber creation path
+// for indented lines would be a second place for "i morgen" to mean something
+// different.
+func TestQuickAddSubTask(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, parent := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "Flytte garagen",
+	})
+	parentID, _ := parent["id"].(string)
+	if parentID == "" {
+		t.Fatalf("no parent: %v", parent)
+	}
+
+	_, child := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "Rydde hylderne p1", "parent_id": parentID,
+	})
+	if got := child["parent_id"]; got != parentID {
+		t.Errorf("parent_id = %v, want %v", got, parentID)
+	}
+	// The line was parsed, not stored raw: the priority marker is gone from the
+	// text and present as a priority.
+	if got := child["content"]; got != "Rydde hylderne" {
+		t.Errorf("content = %v, want the line without its marker", got)
+	}
+	if got := child["priority"]; got != float64(1) {
+		t.Errorf("priority = %v, want 1", got)
+	}
+
+	t.Run("a sub-task cannot be put in another project", func(t *testing.T) {
+		_, other := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Andetsteds"})
+		otherID, _ := other["id"].(string)
+
+		_, moved := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+			"text": "Hente nøglen #Andetsteds", "parent_id": parentID,
+		})
+		if got := moved["project_id"]; got == otherID {
+			t.Errorf("the sub-task left its parent's project")
+		}
+		// And it is said out loud rather than the word just disappearing from the
+		// title — the failure this reports is exactly the one that used to be silent.
+		if got := moved["unknown_project"]; got != "Andetsteds" {
+			t.Errorf("unknown_project = %v, want the name that could not be honoured", got)
+		}
+	})
+}
+
+// raw fetches a download — a zip or a calendar — as bytes.
+//
+// `do` decodes JSON, which these two are not: it would report an empty body and a
+// parse error where the interesting thing is the bytes themselves.
+func (ts *testServer) raw(t *testing.T, path string) ([]byte, string) {
+	t.Helper()
+	req, _ := http.NewRequest("GET", ts.URL+path, nil)
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
+	resp, err := ts.client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("%s: status %d", path, resp.StatusCode)
+	}
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return body, resp.Header.Get("Content-Type")
+}
+
+// TestExportEverythingAtOnce covers the two whole-account exports.
+//
+// The per-project links worked and were unusable at any size: fifteen projects
+// meant fifteen downloads to move your own tasks somewhere else. These two are
+// the same data without the fifteen clicks.
+//
+// Asserted on the CONTENTS rather than on the status: a zip with no entries and a
+// calendar with no VTODOs are both 200 with a plausible Content-Type, and that is
+// exactly the shape an export bug takes.
+func TestExportEverythingAtOnce(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	// Two projects, so the zip has to hold more than the one that happens to be
+	// first — a loop that exports only the last project passes a one-project test.
+	_, first := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Firma"})
+	_, second := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Hjem"})
+	firstID, _ := first["id"].(string)
+	secondID, _ := second["id"].(string)
+
+	ts.do(t, "POST", "/api/v1/tasks", map[string]any{
+		"content": "Betal moms", "project_id": firstID, "due_date": "2026-11-03",
+	})
+	ts.do(t, "POST", "/api/v1/tasks", map[string]any{
+		"content": "Skifte daek", "project_id": secondID,
+	})
+
+	t.Run("csv zip holds one file per project", func(t *testing.T) {
+		body, ct := ts.raw(t, "/api/v1/export/projects.zip")
+		if ct != "application/zip" {
+			t.Fatalf("content-type %q", ct)
+		}
+		zr, err := zip.NewReader(bytes.NewReader(body), int64(len(body)))
+		if err != nil {
+			t.Fatalf("not a zip: %v", err)
+		}
+
+		found := map[string]string{}
+		for _, f := range zr.File {
+			rc, err := f.Open()
+			if err != nil {
+				t.Fatal(err)
+			}
+			text, _ := io.ReadAll(rc)
+			rc.Close()
+			found[f.Name] = string(text)
+		}
+		if len(found) < 2 {
+			t.Fatalf("want a file per project, got %d: %v", len(found), found)
+		}
+
+		// The task has to be IN the file named after its own project. A zip with the
+		// right filenames and every task in the wrong one is the failure this is for.
+		var sawMoms, sawDaek bool
+		for name, text := range found {
+			// Filenames are lower-cased by ics.Filename, so the comparison is too —
+			// asserting on the stored capitalisation would be asserting on a detail
+			// the exporter is free to change.
+			lower := strings.ToLower(name)
+			if strings.Contains(text, "Betal moms") {
+				sawMoms = true
+				if !strings.Contains(lower, "firma") {
+					t.Errorf("Betal moms landed in %q, not in Firma", name)
+				}
+			}
+			if strings.Contains(text, "Skifte daek") {
+				sawDaek = true
+				if !strings.Contains(lower, "hjem") {
+					t.Errorf("Skifte daek landed in %q, not in Hjem", name)
+				}
+			}
+		}
+		if !sawMoms || !sawDaek {
+			t.Errorf("a task is missing from the zip: moms=%v daek=%v", sawMoms, sawDaek)
+		}
+	})
+
+	t.Run("ics holds every dated task across projects", func(t *testing.T) {
+		body, ct := ts.raw(t, "/api/v1/export/tasks.ics")
+		if !strings.HasPrefix(ct, "text/calendar") {
+			t.Fatalf("content-type %q", ct)
+		}
+		text := string(body)
+		if n := strings.Count(text, "BEGIN:VTODO"); n != 1 {
+			t.Fatalf("want the one dated task, got %d VTODOs:\n%s", n, text)
+		}
+		if !strings.Contains(text, "Betal moms") {
+			t.Errorf("the dated task is missing:\n%s", text)
+		}
+		// Undated tasks are deliberately left out — a VTODO with no date is a line
+		// most readers drop. Asserted so the omission stays a decision.
+		if strings.Contains(text, "Skifte daek") {
+			t.Errorf("an undated task was exported:\n%s", text)
+		}
+	})
+}
+
 func TestTodoistImportExportRoundTrip(t *testing.T) {
 	ts := newTestServer(t)
 	ts.bootstrap(t)

internal/httpapi/views_handlers.go

@@ -206,13 +206,22 @@ func (s *Server) handleSearch(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	tasks, err := s.db.ListTasks(r.Context(), user.ID, store.TaskFilter{
-		Search: query,
-		// Completed tasks are included: "what was that thing I did last week" is
-		// a search, and excluding them makes the box feel broken.
-		IncludeCompleted: true,
-		Limit:            parseLimit(r.URL.Query().Get("limit"), 40, 100),
-	})
+	// Søgningen er monteret i begge udgaver, fordi man også skal kunne finde sine
+	// noter og notesbøger. Men opgaverne må ikke komme med i noter-udgaven, og det
+	// er ikke en teoretisk sag: en instans lavet om fra en fuld har opgaverne
+	// liggende i databasen endnu, og så ville ⌘K være den ene dør, der stod åben
+	// ind til den halvdel, resten af programmet lige har lukket.
+	var tasks []store.Task
+	var err error
+	if !s.cfg.NotesOnly() {
+		tasks, err = s.db.ListTasks(r.Context(), user.ID, store.TaskFilter{
+			Search: query,
+			// Completed tasks are included: "what was that thing I did last week" is
+			// a search, and excluding them makes the box feel broken.
+			IncludeCompleted: true,
+			Limit:            parseLimit(r.URL.Query().Get("limit"), 40, 100),
+		})
+	}
 	if err != nil {
 		s.internal(w, r, "search tasks", err)
 		return

internal/jobs/jobs_test.go

@@ -40,7 +40,7 @@ func newRunner(t *testing.T) (*Runner, *store.DB, *config.Config) {
 	t.Cleanup(func() { db.Close() })
 
 	log := slog.New(slog.NewTextHandler(io.Discard, nil))
-	return New(cfg, db, log, mail.New(cfg.SMTP, cfg.BaseURL, log), realtime.NewHub(log)), db, cfg
+	return New(cfg, db, log, mail.New(cfg.SMTP, cfg.BaseURL, cfg.ProductSlug(), log), realtime.NewHub(log)), db, cfg
 }
 
 func seedUser(t *testing.T, db *store.DB) *store.User {

internal/mail/mail.go

@@ -24,13 +24,19 @@ import (
 type Sender struct {
 	cfg config.SMTP
 	log *slog.Logger
-	// appName and baseURL appear in the body of every message.
+	// appName and baseURL appear in every message. appName is the edition's own
+	// name — an invite from an urd instance that said "verdande" would be a letter
+	// to somebody else's inbox about a program they are not being invited to.
+	//
+	// It was a field with a value and no reader until 2026-10-07: the three places
+	// that needed it had the word written out instead, and the comment above said
+	// it appeared in every message. It does now.
 	appName string
 	baseURL string
 }
 
-func New(cfg config.SMTP, baseURL string, log *slog.Logger) *Sender {
-	return &Sender{cfg: cfg, log: log, appName: "verdande", baseURL: baseURL}
+func New(cfg config.SMTP, baseURL, appName string, log *slog.Logger) *Sender {
+	return &Sender{cfg: cfg, log: log, appName: appName, baseURL: baseURL}
 }
 
 // Configured reports whether mail can actually be sent. Handlers use it to decide
@@ -38,7 +44,7 @@ func New(cfg config.SMTP, baseURL string, log *slog.Logger) *Sender {
 func (s *Sender) Configured() bool { return s.cfg.Configured() }
 
 func (s *Sender) SendInvite(ctx context.Context, to, inviterName, projectName, link string, ttl time.Duration) error {
-	what := "verdande"
+	what := s.appName
 	if projectName != "" {
 		what = "projektet “" + projectName + "”"
 	}
@@ -61,7 +67,7 @@ func (s *Sender) SendNoteInvite(ctx context.Context, to, inviterName, noteTitle,
 }
 
 func (s *Sender) sendInvite(ctx context.Context, to, inviterName, what, link string, ttl time.Duration) error {
-	subject := fmt.Sprintf("%s har delt noget med dig i verdande", inviterName)
+	subject := fmt.Sprintf("%s har delt noget med dig i %s", inviterName, s.appName)
 	body := fmt.Sprintf(`Hej
 
 %s har inviteret dig til %s.
@@ -71,9 +77,9 @@ Opret din konto her:
 
 Linket virker i %s. Hvis du ikke ved, hvad det her handler om, kan du roligt slette denne mail — der sker ikke noget, hvis du ikke bruger linket.
 
-— verdande
+— %s
 %s
-`, inviterName, what, link, humanDuration(ttl), s.baseURL)
+`, inviterName, what, link, humanDuration(ttl), s.appName, s.baseURL)
 
 	return s.send(ctx, to, subject, body)
 }
@@ -88,17 +94,17 @@ Du bad om en påmindelse om:
 
 %s
 
-— verdande
-`, name, task, link)
+— %s
+`, name, task, link, s.appName)
 
 	return s.send(ctx, to, subject, body)
 }
 
 func (s *Sender) SendPasswordReset(ctx context.Context, to, name, link string, ttl time.Duration) error {
-	subject := "Nulstil din adgangskode i verdande"
+	subject := "Nulstil din adgangskode i " + s.appName
 	body := fmt.Sprintf(`Hej %s
 
-Der er bedt om at nulstille adgangskoden til din verdande-konto.
+Der er bedt om at nulstille adgangskoden til din %s-konto.
 
 Vælg en ny adgangskode her:
 %s
@@ -107,9 +113,9 @@ Linket virker i %s og kan kun bruges én gang.
 
 Har du ikke selv bedt om det, behøver du ikke gøre noget — din nuværende adgangskode virker stadig, og linket udløber af sig selv.
 
-— verdande
+— %s
 %s
-`, name, link, humanDuration(ttl), s.baseURL)
+`, name, s.appName, link, humanDuration(ttl), s.appName, s.baseURL)
 
 	return s.send(ctx, to, subject, body)
 }

internal/mail/mail_test.go

@@ -0,0 +1,76 @@
+package mail
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/config"
+)
+
+// TestEveryMessageCarriesTheEditionsOwnName.
+//
+// These three letters are the only thing this program sends to an address its
+// operator does not control, and an invitation from an urd instance that says
+// "verdande" is a letter to a stranger about a program they are not being invited
+// to. The name was a field with a value and no reader until 2026-10-07 — the three
+// places that needed it had the word written out instead — so the assertion that
+// matters is not "it says urd" but "it does not say the other one".
+//
+// Measured through the unconfigured path on purpose: with no SMTP host, send()
+// logs the whole message at warn level and returns, so the subject and the body
+// can be read as the recipient would get them without a mail server in the test.
+func TestEveryMessageCarriesTheEditionsOwnName(t *testing.T) {
+	for _, tc := range []struct{ name, other string }{
+		{"verdande", "urd"},
+		{"urd", "verdande"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var buf bytes.Buffer
+			s := New(config.SMTP{}, "https://example.dk", tc.name,
+				slog.New(slog.NewTextHandler(&buf, &slog.HandlerOptions{Level: slog.LevelWarn})))
+
+			ctx := context.Background()
+			if err := s.SendInvite(ctx, "ny@example.dk", "Kristian", "", "https://example.dk/i/abc", time.Hour); err != nil {
+				t.Fatalf("SendInvite: %v", err)
+			}
+			if err := s.SendPasswordReset(ctx, "ny@example.dk", "Kristian", "https://example.dk/r/abc", time.Hour); err != nil {
+				t.Fatalf("SendPasswordReset: %v", err)
+			}
+			if err := s.SendReminder(ctx, "ny@example.dk", "Kristian", "Ring til tandlægen", "https://example.dk/opgave/1"); err != nil {
+				t.Fatalf("SendReminder: %v", err)
+			}
+
+			got := buf.String()
+			if n := strings.Count(got, `msg="no SMTP host configured`); n != 3 {
+				t.Fatalf("expected three logged messages, got %d — the test is reading the wrong thing", n)
+			}
+			if !strings.Contains(got, tc.name) {
+				t.Errorf("no message mentions %q", tc.name)
+			}
+			if strings.Contains(got, tc.other) {
+				t.Errorf("a message mentions %q on a %s instance; the name is hard-coded somewhere", tc.other, tc.name)
+			}
+			t.Logf("%s: %d bytes of mail across three messages", tc.name, len(got))
+		})
+	}
+}
+
+// TestAnInviteWithoutAProjectNamesTheProgram pins the one place the name is the
+// *subject* of the sentence rather than a signature: an invitation to the instance
+// itself, with no project, reads "has invited you to <program>".
+func TestAnInviteWithoutAProjectNamesTheProgram(t *testing.T) {
+	var buf bytes.Buffer
+	s := New(config.SMTP{}, "https://example.dk", "urd",
+		slog.New(slog.NewTextHandler(&buf, &slog.HandlerOptions{Level: slog.LevelWarn})))
+
+	if err := s.SendInvite(context.Background(), "ny@example.dk", "Kristian", "", "https://example.dk/i/abc", time.Hour); err != nil {
+		t.Fatalf("SendInvite: %v", err)
+	}
+	if !strings.Contains(buf.String(), "inviteret dig til urd") {
+		t.Errorf("the invite does not read \"inviteret dig til urd\":\n%s", buf.String())
+	}
+}

mkdocs.yml

@@ -44,6 +44,7 @@ extra_css:
 nav:
   - Home: index.md
   - Setting it up:
+      - Two editions: editions.md
       - As a Rune: rune.md
       - With Docker: self-hosting.md
       - Configuration: configuration.md

site/index.html

@@ -819,6 +819,15 @@
 				color: var(--accent);
 			}
 		</style>
+		<!-- Besøgstælling for denne side — ikke for programmet, som melder det, der
+		     står under "It counts itself". Plausible på vores egen maskine: ingen
+		     cookie, ingen gemt adresse, ingen tredjepart, og derfor ingen bjælke at
+		     møde folk med. `defer`, så tælleren aldrig holder siden tilbage. -->
+		<script
+			defer
+			data-domain="verdandetodo.com"
+			src="https://plausible.yggdrasilpanel.com/js/script.outbound-links.js"
+		></script>
 	</head>
 
 	<body>
@@ -1326,6 +1335,64 @@
 					<a href="https://github.com/kristianwind/verdande/releases">the releases page</a>.
 				</p>
 				<ul class="lately">
+					<li>
+						<span class="ver">0.47</span>
+						Click a picture in a note and it opens at full size, with a button that
+						copies it to the clipboard. In the note it is scaled to the width of the
+						column — a photo off a phone is four thousand pixels across — so what you
+						were looking at was a thumbnail that did not look like one.
+					</li>
+					<li>
+						<span class="ver">0.47</span>
+						Search in ⌘K, pick a note, and the rest of the matches stay in the list
+						beside it. They used to exist only in the popup you had just closed.
+					</li>
+					<li>
+						<span class="ver">0.46</span>
+						Share a project with somebody who already has an account by picking their
+						name, rather than by spelling an email address you would have to know.
+						Invitations that have not been taken up stay visible so they do not get
+						sent twice, and can be withdrawn.
+					</li>
+					<li>
+						<span class="ver">0.46</span>
+						You are told when a project is shared with you, and there is a
+						<strong>Leave the project</strong> button. Being let in without being
+						asked, without being told, and with no way out was three things at once.
+					</li>
+					<li>
+						<span class="ver">0.45</span>
+						Search for a setting instead of remembering which tab it was under — in
+						the settings themselves and in ⌘K. It knows them by what they do, so
+						<em>beacon</em> finds the install count even though that is not its name.
+					</li>
+					<li>
+						<span class="ver">0.45</span>
+						Today's plan is a card on <strong>I dag</strong> rather than only a
+						message in the morning that was gone if you did not read it at once. And
+						a link can be told which browser to open in.
+					</li>
+					<li>
+						<span class="ver">0.44</span>
+						An optional AI layer, on your own key: it tidies the inbox, pulls the
+						tasks out of a meeting note, writes a morning plan, turns
+						<em>"SV: SV: Vedr. levering uge 12"</em> into what the mail actually asks
+						for, and answers questions about your own notes with links to what the
+						answer rests on. Every one of them is a line you accept, edit or refuse —
+						it suggests, it never writes.
+					</li>
+					<li>
+						<span class="ver">0.44</span>
+						Administrators are told in the bell when a new version is out, once per
+						version, and the message leads to the button that restarts.
+					</li>
+					<li>
+						<span class="ver">0.43</span>
+						Anything that can call a URL can put a task in your inbox — a shortcut on
+						your phone, a script, a service. Notes can be handed to somebody who has
+						no account yet, and writing <code>@Sofie</code> in a note shares it with
+						her and tells her. Unread counts show on the app's icon in the Dock.
+					</li>
 					<li>
 						<span class="ver">0.42</span>
 						A sixth theme, <strong>Charcoal</strong> — a warm near-black after Apple
@@ -1362,17 +1429,6 @@
 						body to move it. A single note can be shared with one person, and a
 						<code>[[note]]</code> is a link you follow inline.
 					</li>
-					<li>
-						<span class="ver">0.34</span>
-						Sections can be dragged into the order the work actually happens in. The
-						sidebar keeps its head still while the projects scroll.
-					</li>
-					<li>
-						<span class="ver">0.33</span>
-						Notes grew an archive, selection of many at once, pictures you can paste
-						or drag in, a source view, and a copy button on code blocks. Search
-						stopped answering by date and started answering by relevance.
-					</li>
 				</ul>
 			</section>
 

web/e2e/edition.spec.js

@@ -0,0 +1,248 @@
+import { test, expect } from '@playwright/test';
+import { watchForTrouble } from './trouble.js';
+
+/**
+ * Noter-udgaven, kørt som sit eget program.
+ *
+ * Egen server på sin egen port med `VERDANDE_EDITION=notes`, egen database og
+ * ingen lånt session: den her instans har aldrig set den konto, den fulde udgaves
+ * opsætning lavede, så den laver sin egen.
+ *
+ * Og det er hele grunden til at prøven findes som en separat server frem for som
+ * en indstilling, en prøve skruer på. En skakt, der kun er prøvet ved at kalde en
+ * funktion, er prøvet på det, nogen mente — det her måler programmet, som en
+ * bruger møder det.
+ */
+
+const KONTO = {
+	email: 'noter@example.dk',
+	name: 'Noteskriver',
+	password: 'et langt kodeord til test'
+};
+
+test.beforeEach(async ({ page }) => {
+	await page.goto('/');
+	// Første konto, hvis den ikke er lavet endnu. Prøverne i filen deler instans,
+	// så den anden gang er det en almindelig login.
+	const opret = page.getByRole('button', { name: 'Opret konto' });
+	const login = page.getByRole('button', { name: 'Log ind' });
+	// Ventet på, at EN af de to er der, før der spørges hvilken. Spurgt før
+	// tegningen svarer begge nej, og så faldt prøven i den forkerte gren og ventede
+	// tredive sekunder på en knap, der aldrig kom.
+	await expect(opret.or(login)).toBeVisible();
+
+	if (await opret.isVisible()) {
+		await page.getByLabel(/Navn/).fill(KONTO.name);
+		await page.getByLabel(/E-mail/).fill(KONTO.email);
+		await page.getByLabel(/Adgangskode/).fill(KONTO.password);
+		await opret.click();
+		// Beaconens besked står øverst første gang; den er ikke det her prøvens
+		// ærinde, men den dækker for det, der er.
+		const besked = page.getByRole('region', { name: /melder, at den findes/ });
+		if (await besked.isVisible().catch(() => false)) {
+			await besked.getByRole('button', { name: 'Behold den' }).click();
+		}
+	} else {
+		await page.getByLabel(/E-mail/).fill(KONTO.email);
+		await page.getByLabel(/Adgangskode/).fill(KONTO.password);
+		await page.getByRole('button', { name: 'Log ind' }).click();
+	}
+	await expect(page.getByRole('navigation', { name: 'Hovedmenu' })).toBeVisible();
+});
+
+test('instansen siger selv, at den er noter-udgaven', async ({ page }) => {
+	// Fladen kan ikke lukke af for noget, den ikke får at vide, og den skal have
+	// det at vide, før nogen er logget ind.
+	const svar = await page.request.get('/api/v1/auth/setup');
+	expect((await svar.json()).edition).toBe('notes');
+});
+
+test('der er ingen vej til opgaverne i menuen', async ({ page }) => {
+	const menu = page.getByRole('navigation', { name: 'Hovedmenu' });
+	await expect(menu).toBeVisible();
+
+	// Udeladt, ikke gråtonet: ruterne bag dem er ikke monteret på serveren.
+	for (const navn of ['I dag', 'Kommende', 'Kalender', 'Uddelegeret']) {
+		await expect(menu.getByRole('link', { name: navn })).toHaveCount(0);
+	}
+
+	// Og det, udgaven ER til, står der. En menu uden opgaver OG uden noter ville
+	// også bestå prøven ovenfor, og den ville være en sletning frem for en skakt.
+	await expect(menu.getByRole('link', { name: 'Noter', exact: true })).toBeVisible();
+});
+
+test('forsiden er noterne, ikke en tom opgaveliste', async ({ page }) => {
+	await page.goto('/');
+	await expect(page).toHaveURL(/\/noter$/);
+});
+
+test('en gemt adresse til en opgaveside fører til noterne i stedet for et blindt spor', async ({
+	page
+}) => {
+	// Nogen, der har gemt et link fra en fuld instans, skal lande et sted, der
+	// giver mening. Der er ikke sket noget forkert — adressen hører bare til et
+	// andet program end det, der kører her.
+	for (const sti of ['/upcoming', '/kalender', '/uddelegeret', '/faerdige']) {
+		await page.goto(sti);
+		await expect(page).toHaveURL(/\/noter$/);
+	}
+});
+
+test('⌘K finder noter og ikke opgaver', async ({ page }) => {
+	await page.goto('/noter');
+	await page.getByRole('button', { name: 'Ny note' }).click();
+	const felt = page.getByRole('textbox', { name: 'Notens tekst' });
+	await expect(felt).toHaveText('');
+	await felt.click();
+	await page.keyboard.type('Kvartalsregnskabet');
+	await felt.blur();
+	await expect(page.locator('.notes button.row strong').filter({ hasText: /^Kvartalsregnskabet$/ })).toHaveCount(1);
+
+	await page.getByRole('button', { name: /Søg/ }).click();
+	const palette = page.getByRole('dialog');
+	await palette.getByRole('textbox').fill('Kvartalsregnskabet');
+
+	// Noten findes — ellers beviser det næste ingenting.
+	await expect(palette.locator('li button', { hasText: 'Kvartalsregnskabet' })).toBeVisible();
+	// Og søgningen på serveren svarer uden opgaver overhovedet.
+	const svar = await page.request.get('/api/v1/search?q=Kvartalsregnskabet');
+	expect((await svar.json()).tasks ?? []).toEqual([]);
+});
+
+test('opgaveruterne findes slet ikke på serveren', async ({ page }) => {
+	// Det her er forskellen på skjult og fraværende, målt udefra.
+	for (const sti of ['/api/v1/tasks', '/api/v1/labels', '/api/v1/upcoming', '/api/v1/filters']) {
+		const svar = await page.request.get(sti);
+		expect(svar.status(), `${sti} svarede ${svar.status()}`).toBe(404);
+	}
+	// Kontrollen: en rute, der ER monteret, svarer ikke 404 — ellers ville
+	// ovenstående bestå på en server, der var helt væk.
+	expect((await page.request.get('/api/v1/notes')).status()).toBe(200);
+});
+
+/**
+ * Navnet.
+ *
+ * To udgaver af ét program er to produkter, og det eneste sted en læser afgør
+ * hvilket af dem de ser på, er navnet: fanen, mærket i menuen, og det navn appen
+ * lægger sig under på en hjemmeskærm. De tre står i filer, browseren læser FØR
+ * noget JavaScript kører, så serveren skriver dem om på vejen ud — og derfor skal
+ * de måles her, på det der faktisk blev sendt, frem for i en funktion.
+ */
+test('fanen, mærket og manifestet siger alle urd', async ({ page }) => {
+	// Der er TO titler, og det blev opdaget her frem for i en Go-prøve: skallens,
+	// som browseren læser før noget JavaScript kører og som serveren skriver om,
+	// og rutens egen, som appen sætter i <svelte:head> når siden tegner. Den sidste
+	// overskriver den første — så en prøve, der kun læste den ene, ville være grøn
+	// over en fane, der sagde "Noter · verdande".
+	const skal = await (await page.request.get('/')).text();
+	expect(skal, 'skallens titel, før appen kører').toContain('<title>urd</title>');
+	await expect(page, 'rutens egen titel, efter appen har tegnet').toHaveTitle(/· urd$/);
+
+	const mærke = page.getByRole('navigation', { name: 'Hovedmenu' }).locator('.brand');
+	await expect(mærke.locator('.name')).toHaveText('urd');
+	// ᚢ uruz, det bogstav navnet begynder med i den ældre futhark — og ikke ᚹ
+	// wunjo, som er Verdandes. Begge er navngivne værdier frem for "der er en
+	// rune": en tom span og den forkerte rune ser ens ud for en prøve, der kun
+	// spørger om der står noget.
+	await expect(mærke.locator('.rune')).toHaveText('ᚢ');
+
+	const manifest = await (await page.request.get('/manifest.webmanifest')).json();
+	expect(manifest.name).toBe('urd');
+	expect(manifest.short_name).toBe('urd');
+});
+
+test('manifestet bliver sendt som et manifest, ikke som tekst', async ({ page }) => {
+	// Go kender ikke .webmanifest, så uden en eksplicit type sniffes den til
+	// text/plain — og en browser ignorerer så manifestet uden at sige noget.
+	// Symptomet er at installationsknappen bare ikke er der.
+	const svar = await page.request.get('/manifest.webmanifest');
+	expect(svar.headers()['content-type']).toContain('application/manifest+json');
+});
+
+test('omdøbningen rørte ikke lagernøglerne', async ({ page }) => {
+	// Fælden i hele øvelsen: produktnavnet og localStorage-præfikset er samme ord
+	// i app.html, og de er ikke samme ting. Omdøbes præfikset her og ikke i
+	// resten af appen, bliver temaet sat fra én nøgle og læst fra en anden, og det
+	// eneste symptom er det hvide blink, det indlejrede script findes for at
+	// undgå. Målt på de bytes der blev sendt, ikke på kilden.
+	const skal = await (await page.request.get('/')).text();
+	expect(skal).toContain("localStorage.getItem('verdande:theme')");
+	expect(skal).toContain("localStorage.getItem('verdande:look')");
+	expect(skal).not.toContain('urd:theme');
+});
+
+test('navnet står også i teksterne, ikke kun i mærket', async ({ page }) => {
+	// `{product}`-pladsholderen, hele vejen gennem i18n og ud på skærmen. Udseendet
+	// "som du kender det" er opkaldt efter programmet, så det er det kort, der
+	// skifter navn med udgaven.
+	await page.goto('/indstillinger');
+	await expect(page.getByRole('button', { name: /^Urd\b/ })).toBeVisible();
+	await expect(page.getByRole('button', { name: /^Verdande\b/ })).toHaveCount(0);
+});
+
+/**
+ * Hver side, der KAN nås i noter-udgaven, må ikke kalde noget, der er lukket.
+ *
+ * Det er den halvdel, en port let glemmer, og den fejler stille: lukkes en rute,
+ * fladen stadig henter, svarer serveren 404, komponenten fanger det, og siden
+ * tegner uden den sektion — pænt, tomt, og uden at nogen får at vide, at noget
+ * manglede. Der er ingen fejlskærm at se.
+ *
+ * Målt på svarene frem for på det tegnede: en manglende sektion ser ud som en
+ * sektion, der ikke var noget i.
+ *
+ * Skrevet før ruterne blev lukket, og den fangede SYV — fire af dem fra den første
+ * port, som havde været i drift i to merges: sidebjælken hentede /filters og
+ * /labels ved hver navigation, notifikationssiden hentede /ai/plan, og
+ * notesbogens egen side hentede /tasks. Den sidste var ikke støj: kaldene samles i
+ * et Promise.all, så 404'eren kastede og siden viste `status = 'failed'` frem for
+ * notesbogens noter.
+ *
+ * Og den fangede én mere, som rettelsen selv lavede: da opgavekaldet holdt op med
+ * at fejle, kom en uendelig effekt-løkke frem, som 404'eren havde holdt låg på
+ * (effect_update_depth_exceeded). Derfor læser den konsollen og ikke kun svarene.
+ *
+ * Hvad den IKKE dækker, sagt her frem for underforstået: elleve sider plus ét
+ * projekt. En gruppe (/gruppe/{id}) og en åben note er ikke med, fordi begge
+ * kræver, at prøven først laver en — og skuffer og dialoger, der åbnes ved et
+ * klik, er slet ikke besøgt. En grøn her betyder "ingen af de tolv adresser",
+ * ikke "ingen flade".
+ */
+test('ingen side kalder en rute, udgaven ikke har', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+
+	// Projektet skal med som en rigtig adresse: /projekt/{id} er en notesbog her,
+	// og den er den eneste side med en id i stien, der kan nås.
+	await page.goto('/noter');
+	const projekter = await (await page.request.get('/api/v1/projects')).json();
+	const id = (projekter.projects ?? projekter)[0]?.id;
+	expect(id, 'der skal findes mindst ét projekt at åbne').toBeTruthy();
+
+	const sider = [
+		'/noter',
+		'/genveje',
+		'/indstillinger',
+		'/indstillinger/ai',
+		'/indstillinger/brugere',
+		'/indstillinger/data',
+		'/indstillinger/fejl',
+		'/indstillinger/historik',
+		'/indstillinger/integrationer',
+		'/indstillinger/notifikationer',
+		'/indstillinger/tokens',
+		`/projekt/${id}`
+	];
+
+	for (const side of sider) {
+		await page.goto(side);
+		// Ventet på at fladen er tegnet, så de kald siden laver ved opstart er
+		// nået at komme afsted. Uden den her går løkken videre, før svarene er
+		// kommet, og prøven måler ingenting.
+		await expect(page.getByRole('navigation', { name: 'Hovedmenu' })).toBeVisible();
+		await page.waitForLoadState('networkidle');
+	}
+
+	// Tallet med på det grønne: elleve sider og et projekt, frem for "ingen fejl".
+	expect(trouble, `besøgte ${sider.length} sider`).toEqual([]);
+});

web/e2e/pastelist.spec.js

@@ -0,0 +1,83 @@
+import { test, expect } from '@playwright/test';
+import { readList } from '../src/lib/pastelist.js';
+
+/**
+ * Læsningen af en indsat liste, prøvet for sig.
+ *
+ * Reglerne er små og mange, og de er billigere at stille her end gennem en
+ * browser: hvad er et mærke, hvad er indhold, og hvor dybt står en linje. Flowet
+ * gennem fladen har sin egen prøve i smoke.spec.js — den viser, at det hænger
+ * sammen, ikke at hvert tilfælde er rigtigt.
+ */
+test.describe('en indsat liste læses som opgaver og underopgaver', () => {
+	test('mærker fjernes, teksten bliver', () => {
+		expect(readList('- køb mælk\n* ring til Per\n+ hent pakken\n')).toEqual([
+			{ depth: 0, text: 'køb mælk', done: false },
+			{ depth: 0, text: 'ring til Per', done: false },
+			{ depth: 0, text: 'hent pakken', done: false }
+		]);
+	});
+
+	test('nummererede lister er også lister', () => {
+		expect(readList('1. først\n2) så\n10. til sidst')).toEqual([
+			{ depth: 0, text: 'først', done: false },
+			{ depth: 0, text: 'så', done: false },
+			{ depth: 0, text: 'til sidst', done: false }
+		]);
+	});
+
+	test('en afkrydsning er indhold, ikke notation', () => {
+		// Det er hele grunden til at læse boksen: en halvt afkrydset liste, der
+		// kommer ind som lutter uløste opgaver, har tabt det, man indsatte den for.
+		expect(readList('- [x] betalt\n- [ ] ikke betalt\n- [X] også betalt')).toEqual([
+			{ depth: 0, text: 'betalt', done: true },
+			{ depth: 0, text: 'ikke betalt', done: false },
+			{ depth: 0, text: 'også betalt', done: true }
+		]);
+	});
+
+	test('indrykning bærer niveauet, uanset hvor bred den er', () => {
+		// To mellemrum i den ene liste, fire i den anden, en tabulator i den tredje:
+		// alle tre betyder ét niveau. Bredden gættes ikke, den læses af teksten.
+		const to = readList('a\n  b\nc');
+		const fire = readList('a\n    b\nc');
+		const tab = readList('a\n\tb\nc');
+		const want = [
+			{ depth: 0, text: 'a', done: false },
+			{ depth: 1, text: 'b', done: false },
+			{ depth: 0, text: 'c', done: false }
+		];
+		expect(to).toEqual(want);
+		expect(fire).toEqual(want);
+		expect(tab).toEqual(want);
+	});
+
+	test('en liste, der er rykket ind som helhed, begynder stadig på niveau nul', () => {
+		// Kopierer man fra et dokument, følger der ofte indrykning med på alle
+		// linjer. Den er ikke et niveau — der er ikke noget at være under.
+		expect(readList('    a\n      b')).toEqual([
+			{ depth: 0, text: 'a', done: false },
+			{ depth: 1, text: 'b', done: false }
+		]);
+	});
+
+	test('tomme linjer er luft i det kopierede, ikke punkter', () => {
+		// Og de nulstiller ikke niveauet: en liste med luft mellem punkterne er én
+		// liste.
+		expect(readList('a\n\n  b\n\n  c')).toEqual([
+			{ depth: 0, text: 'a', done: false },
+			{ depth: 1, text: 'b', done: false },
+			{ depth: 1, text: 'c', done: false }
+		]);
+	});
+
+	test('teksten røres ikke ud over mærket', () => {
+		// Datoer, #projekt og @etiket læses af quickadd på serveren, præcis som når
+		// linjen er skrevet i hånden. To steder at forstå en opgavelinje er ét for
+		// mange.
+		expect(readList('- betal moms i morgen #Firma p1\n- andet')).toEqual([
+			{ depth: 0, text: 'betal moms i morgen #Firma p1', done: false },
+			{ depth: 0, text: 'andet', done: false }
+		]);
+	});
+});

web/e2e/trouble.js

@@ -0,0 +1,38 @@
+/**
+ * Collects anything that went wrong quietly: a thrown exception, a console error,
+ * or an API call that came back a failure.
+ *
+ * Failed responses are recorded with their URL and status. "A console error
+ * happened" is not an actionable test failure — "PATCH /api/v1/tasks/x returned
+ * 500" is.
+ *
+ * Udskilt fra smoke.spec.js, så udgave-suiten kan bruge den samme — og den
+ * fortjente flytningen med det samme: lukker man en rute, fladen stadig kalder,
+ * står der en 404 på en side, der ser helt rigtig ud, og det her er det eneste,
+ * der ser den.
+ */
+export function watchForTrouble(page) {
+	const trouble = [];
+	page.on('console', (message) => {
+		// The browser logs its own line for every failed fetch. It carries no URL,
+		// so it is noise next to the response listener below.
+		if (message.type() === 'error' && !message.text().includes('Failed to load resource')) {
+			trouble.push(message.text());
+		}
+	});
+	page.on('pageerror', (error) => trouble.push(String(error)));
+	page.on('response', (response) => {
+		const url = response.url();
+		if (!url.includes('/api/') || response.ok()) return;
+
+		// A 401 from /auth/me is the app asking "am I signed in?" and being told no,
+		// which is the correct answer on the sign-in page and after signing out.
+		// Every other non-ok response is worth failing over — that is what this
+		// watcher is for.
+		const path = new URL(url).pathname;
+		if (path.endsWith('/auth/me') && response.status() === 401) return;
+
+		trouble.push(`${response.request().method()} ${path} → ${response.status()}`);
+	});
+	return trouble;
+}

web/playwright.config.js

@@ -20,6 +20,7 @@ import { dirname, join } from 'node:path';
 const here = dirname(fileURLToPath(import.meta.url));
 const repo = join(here, '..');
 const dataDir = join(here, '.playwright-data');
+const notesDataDir = join(here, '.playwright-data-notes');
 
 // A clean instance every run: the first test creates the first account, which only
 // works on an empty database.
@@ -31,9 +32,14 @@ const dataDir = join(here, '.playwright-data');
 // connection fail, with SQLITE_CANTOPEN. It looks exactly like a flaky auth bug.
 if (process.env.TEST_WORKER_INDEX === undefined) {
 	rmSync(dataDir, { recursive: true, force: true });
+	rmSync(notesDataDir, { recursive: true, force: true });
 }
 
 const PORT = 8097;
+// Noter-udgaven kører som sin egen server ved siden af den fulde. Den kan ikke
+// dele port, og den må ikke dele database: de to er to instanser, og en prøve der
+// lod dem skrive i den samme ville måle en tilstand, ingen af dem ejer.
+const NOTES_PORT = 8098;
 // `localhost`, not `127.0.0.1`. WebAuthn refuses an IP address as a relying party
 // id — `SecurityError: This is an invalid domain` — and localhost is the exception
 // every browser makes. The passkey test cannot run against a loopback address.
@@ -72,6 +78,10 @@ export default defineConfig({
 		{ name: 'setup', testMatch: /.*\.setup\.js/ },
 		{
 			name: 'chromium',
+			// Alt undtagen noter-udgaven, som har sin egen server på sin egen port.
+			// Uden den her linje kørte den prøve også her — mod den FULDE udgave, hvor
+			// den naturligvis fejler, og hvor fejlen læser som om skakten ikke virker.
+			testIgnore: /edition\.spec\.js/,
 			use: { ...devices['Desktop Chrome'], storageState: 'e2e/.auth/user.json' },
 			dependencies: ['setup']
 		},
@@ -95,6 +105,21 @@ export default defineConfig({
 		 *
 		 * WebKit here is the same engine Safari is, which is the whole point.
 		 */
+		/**
+		 * Noter-udgaven, som sit eget program.
+		 *
+		 * Egen server, egen port, egen database, og ingen `storageState`: den her
+		 * instans har aldrig set den konto, den fulde udgaves opsætning lavede, og
+		 * at låne dens cookie ville prøve to instanser som var de én.
+		 *
+		 * Den deler ikke `setup` af samme grund — den laver sin egen første konto.
+		 */
+		{
+			name: 'notes-edition',
+			testMatch: /edition\.spec\.js/,
+			use: { ...devices['Desktop Chrome'], baseURL: `http://127.0.0.1:${NOTES_PORT}` }
+		},
+
 		{
 			name: 'webkit-forms',
 			grep: /@forms/,
@@ -103,42 +128,64 @@ export default defineConfig({
 		}
 	],
 
-	webServer: {
-		// The whole chain, every run.
-		//
-		// The frontend is embedded in the binary at compile time, from a copy under
-		// cmd/verdande/webbuild — so a suite that merely started the server would
-		// test whatever frontend was copied there last, which during development is
-		// nearly always the wrong one. Testing a stale build is worse than not
-		// testing: it reports green on code that is not running.
-		command: [
-			'npm run build',
-			'rm -rf ../cmd/verdande/webbuild',
-			'cp -r build ../cmd/verdande/webbuild',
-			'cd .. && go run -tags embedweb ./cmd/verdande'
-		].join(' && '),
-		cwd: here,
-		url: `${baseURL}/healthz`,
-		reuseExistingServer: false,
-		// The first run compiles the binary and builds nothing else; a cold Go
-		// build on a CI runner is comfortably under two minutes.
-		timeout: 180_000,
-		stdout: 'pipe',
-		stderr: 'pipe',
-		env: {
-			VERDANDE_ADDR: `:${PORT}`,
-			// `localhost`, while the suite itself drives `127.0.0.1`. These are two
-			// different things: the suite's address is where the browser goes, and
-			// this one is what the server calls itself — which is now also the
-			// WebAuthn relying party id, and WebAuthn refuses an IP address.
+	webServer: [
+		{
+			// The whole chain, every run.
 			//
-			// The passkey test navigates to localhost explicitly so its origin
-			// matches. Everything else stays on the loopback address, where it has
-			// always been.
-			VERDANDE_BASE_URL: `http://localhost:${PORT}`,
-			VERDANDE_DATA_DIR: dataDir,
-			// Off: an update check would reach out to GitHub from a test run.
-			VERDANDE_UPDATE_CHECK: 'false'
+			// The frontend is embedded in the binary at compile time, from a copy under
+			// cmd/verdande/webbuild — so a suite that merely started the server would
+			// test whatever frontend was copied there last, which during development is
+			// nearly always the wrong one. Testing a stale build is worse than not
+			// testing: it reports green on code that is not running.
+			command: [
+				'npm run build',
+				'rm -rf ../cmd/verdande/webbuild',
+				'cp -r build ../cmd/verdande/webbuild',
+				'cd .. && go run -tags embedweb ./cmd/verdande'
+			].join(' && '),
+			cwd: here,
+			url: `${baseURL}/healthz`,
+			reuseExistingServer: false,
+			// The first run compiles the binary and builds nothing else; a cold Go
+			// build on a CI runner is comfortably under two minutes.
+			timeout: 180_000,
+			stdout: 'pipe',
+			stderr: 'pipe',
+			env: {
+				VERDANDE_ADDR: `:${PORT}`,
+				// `localhost`, while the suite itself drives `127.0.0.1`. These are two
+				// different things: the suite's address is where the browser goes, and
+				// this one is what the server calls itself — which is now also the
+				// WebAuthn relying party id, and WebAuthn refuses an IP address.
+				//
+				// The passkey test navigates to localhost explicitly so its origin
+				// matches. Everything else stays on the loopback address, where it has
+				// always been.
+				VERDANDE_BASE_URL: `http://localhost:${PORT}`,
+				VERDANDE_DATA_DIR: dataDir,
+				// Off: an update check would reach out to GitHub from a test run.
+				VERDANDE_UPDATE_CHECK: 'false'
+			}
+		},
+
+		// Den samme binær en gang til, med den anden udgave slået til. Bygningen er
+		// allerede lavet af serveren ovenfor — `go run` genbruger byggecachen — så
+		// det her koster en opstart og ikke en oversættelse.
+		{
+			command: 'cd .. && go run -tags embedweb ./cmd/verdande',
+			cwd: here,
+			url: `http://127.0.0.1:${NOTES_PORT}/healthz`,
+			reuseExistingServer: false,
+			timeout: 180_000,
+			stdout: 'pipe',
+			stderr: 'pipe',
+			env: {
+				VERDANDE_ADDR: `:${NOTES_PORT}`,
+				VERDANDE_BASE_URL: `http://localhost:${NOTES_PORT}`,
+				VERDANDE_DATA_DIR: notesDataDir,
+				VERDANDE_EDITION: 'notes',
+				VERDANDE_UPDATE_CHECK: 'false'
+			}
 		}
-	}
+	]
 });

web/src/lib/api.js

@@ -365,8 +365,13 @@ export const api = {
 	moveTask: (id, data) => post(`/tasks/${id}/move`, data),
 	snoozeTask: (id, until) => post(`/tasks/${id}/snooze`, { until: until ?? '' }),
 
-	quickAdd: (text, projectId, sectionId) =>
-		post('/tasks/quick-add', { text, project_id: projectId, section_id: sectionId }),
+	quickAdd: (text, projectId, sectionId, parentId) =>
+		post('/tasks/quick-add', {
+			text,
+			project_id: projectId,
+			section_id: sectionId,
+			parent_id: parentId
+		}),
 	quickAddPreview: (text, signal) =>
 		get(`/tasks/quick-add/preview?text=${encodeURIComponent(text)}`, { signal }),
 
@@ -511,6 +516,8 @@ export const api = {
 	importCSV: (data) => post('/import/csv', data),
 	exportAccountURL: () => '/api/v1/export/account',
 	exportNotesURL: () => '/api/v1/export/notes.zip',
+	exportAllCSVURL: () => '/api/v1/export/projects.zip',
+	exportAllICSURL: () => '/api/v1/export/tasks.ics',
 	// Through `upload`, not `request`: a multipart body has to set its own boundary,
 	// and the browser only does that when nothing has claimed the header.
 	importNotes: (file) => upload('/notes/import', file),

web/src/lib/components/BeaconNotice.svelte

@@ -64,7 +64,7 @@
 {#if notice}
 	<aside class="notice" role="region" aria-label={t('beacon.noticeTitle')}>
 		<h2>{t('beacon.noticeTitle')}</h2>
-		<p>{t('beacon.noticeBody')}</p>
+		<p>{t('beacon.noticeBody', { product: app.productName })}</p>
 
 		<!-- Det, der bliver sendt, med de rigtige værdier i. Ikke et eksempel: det
 		     er selve meldingen, og den kan sammenholdes med indstillingssiden. -->

web/src/lib/components/CommandPalette.svelte

@@ -85,7 +85,11 @@
 		...settings.map((s) => ({ kind: 'setting', id: s.href, label: `${s.tab} · ${s.title}` })),
 		...projects.map((p) => ({ kind: 'project', id: p.id, label: p.name })),
 		...notes.map((n) => ({ kind: 'note', id: n.id, label: n.title || n.body.slice(0, 60) })),
-		...tasks.map((t) => ({
+		// Serveren sender ingen opgaver i noter-udgaven, så listen er alligevel tom.
+		// Spurgt her også, fordi en tom liste af den rigtige grund og en tom liste
+		// ved et tilfælde ser ens ud — og den dag nogen mounter søgningen anderledes,
+		// skal ⌘K ikke være stedet, det viser sig.
+		...(app.notesOnly ? [] : tasks).map((t) => ({
 			kind: 'task',
 			id: t.id,
 			label: t.content,
@@ -125,7 +129,13 @@
 		// En indstilling bærer sin egen adresse i sit id — der er ingen række at slå
 		// op, den ER stedet.
 		if (item.kind === 'setting') return goto(item.id);
-		if (item.kind === 'note') return goto(`/noter?note=${item.id}`);
+		// Søgningen følger med noten. Uden den åbner man én træffer på en side, hvis
+		// liste står uændret — og de andre træffere var kun at se i den popup, man
+		// lige lukkede.
+		if (item.kind === 'note') {
+			const q = query.trim();
+			return goto(`/noter?note=${item.id}` + (q ? `&q=${encodeURIComponent(q)}` : ''));
+		}
 		goto(item.kind === 'project' ? `/projekt/${item.id}` : `/projekt/${item.project}`);
 	}
 

web/src/lib/components/NoConnection.svelte

@@ -0,0 +1,95 @@
+<script>
+	/**
+	 * What the app shows when it could not reach the server at all.
+	 *
+	 * Before this, an outage rendered the sign-in screen: the boot asks who you
+	 * are, the request never gets an answer, `user` stays null, and null means
+	 * "logged out" everywhere else. So the app blamed the session for the network
+	 * being down, and offered a password box that could not possibly work. That is
+	 * worse than an error message, because it looks like it might work — people
+	 * type the password, get nothing, and conclude their account is broken.
+	 *
+	 * It happened for real on 17 September 2026: the instance's DNS record was
+	 * deleted, and what the app showed was a slow-loading login page.
+	 *
+	 * The text says the data is safe, because that is the question somebody
+	 * actually has when their notes vanish behind a login box.
+	 */
+	import { t } from '$lib/i18n.svelte.js';
+	import { app } from '$lib/stores.svelte.js';
+
+	let trying = $state(false);
+
+	async function again() {
+		trying = true;
+		try {
+			await app.load();
+		} finally {
+			trying = false;
+		}
+	}
+</script>
+
+<div class="screen">
+	<div class="card">
+		<div class="brand">
+			<span class="rune" aria-hidden="true">ᚹ</span>
+			<h1>verdande</h1>
+		</div>
+
+		<h2>{t('net.downTitle')}</h2>
+		<p class="lede">{t('net.downBody', { product: app.productName })}</p>
+
+		<button onclick={again} disabled={trying}>
+			{trying ? t('net.reconnecting') : t('net.downRetry')}
+		</button>
+	</div>
+</div>
+
+<style>
+	.screen {
+		height: 100dvh;
+		display: grid;
+		place-items: center;
+		padding: var(--s4);
+		background: var(--ground);
+	}
+
+	.card {
+		width: 100%;
+		max-width: 340px;
+		display: flex;
+		flex-direction: column;
+		gap: var(--s4);
+		text-align: center;
+	}
+
+	.brand {
+		display: flex;
+		align-items: center;
+		gap: var(--s3);
+		justify-content: center;
+	}
+
+	.rune {
+		font-size: var(--text-2xl);
+		color: var(--accent);
+		line-height: 1;
+	}
+
+	h1 {
+		font-size: var(--text-xl);
+		margin: 0;
+	}
+
+	h2 {
+		font-size: var(--text-lg);
+		margin: 0;
+	}
+
+	.lede {
+		margin: 0;
+		color: var(--ink-soft);
+		line-height: 1.5;
+	}
+</style>

web/src/lib/components/NoteEditor.svelte

@@ -13,7 +13,7 @@
 	 * unforgivable. When the replacement (the EditContext API) is everywhere, this
 	 * is the file to change.
 	 */
-	import { markdownToHtml, htmlToMarkdown } from '$lib/richtext.js';
+	import { markdownToHtml, htmlToMarkdown, blockText } from '$lib/richtext.js';
 	import { highlight, guessLanguage } from '$lib/highlight.js';
 	import { t } from '$lib/i18n.svelte.js';
 	import { app } from '$lib/stores.svelte.js';
@@ -133,20 +133,78 @@
 		// `<pre>…<p>body</p></pre>` — so the text stays monospace and there is no way
 		// out of the block from the menu. Do any conversion that touches a <pre> by
 		// hand, replacing the element rather than reformatting inside it.
-		const block = currentBlock();
-		if (block && (block.tagName === 'PRE' || style.tag === 'pre')) {
-			replaceBlock(block, style.tag);
+		//
+		// Hele markeringen, ikke blokken markøren står i. Den her vej spurgte efter
+		// `currentBlock()`, og det er ét blok — så en markering over ti linjers
+		// terminaludskrift gjorde den første linje til kode og lod resten stå. Det
+		// er den slags, man ikke opdager med to linjer og ikke kan overse med ti.
+		const blocks = selectedBlocks();
+		if (!blocks.length) return apply('formatBlock', style.tag);
+
+		if (style.tag === 'pre') {
+			mergeToMono(blocks);
+			return;
+		}
+
+		// Ud af monotype igen: hver blok for sig, uden at røre markeringen —
+		// tekstknuderne flytter med over i de nye elementer, så den range, browseren
+		// holder på, stadig peger på noget, der er i dokumentet. Resten klarer
+		// formatBlock bagefter, nu hvor der ikke er en <pre> i vejen.
+		const pres = blocks.filter((b) => b.tagName === 'PRE');
+		for (const b of pres) swapTag(b, style.tag);
+		if (pres.length === blocks.length) {
+			readState();
+			changed();
 			return;
 		}
 		apply('formatBlock', style.tag);
 	}
 
 	/**
-	 * Replaces a block element with one of another tag, keeping its contents and the
-	 * caret. Used where execCommand cannot be trusted — converting to or from a
-	 * <pre>, which it either nests or ignores.
+	 * Alle de blokke, markeringen rører — ikke kun den, markøren står i.
+	 *
+	 * En sammenfaldet markering rører præcis ét blok, så den enkle sag opfører sig
+	 * som før.
 	 */
-	function replaceBlock(block, tag) {
+	function selectedBlocks() {
+		const selection = window.getSelection();
+		if (!selection || !selection.rangeCount || !editor) return [];
+		const range = selection.getRangeAt(0);
+		return [...editor.children].filter((b) => range.intersectsNode(b));
+	}
+
+	/**
+	 * Lægger flere blokke sammen til én monotypeblok.
+	 *
+	 * Én blok og ikke én pr. linje: en udskrift, man indsætter, er ét stykke kode.
+	 * Tre blokke ved siden af hinanden ser næsten ens ud på skærmen og bliver til
+	 * tre hegn i filen — og så kan de ikke rulles eller kopieres som det ene,
+	 * de er.
+	 */
+	function mergeToMono(blocks) {
+		const pre = document.createElement('pre');
+		// blockText og ikke textContent: et <br> har den tomme streng som
+		// textContent, og det er netop <br>, der står for et linjeskift inde i en
+		// blok. Samme grund som da en kodeblok ikke kunne gemme mere end én linje.
+		pre.textContent = blocks.map((b) => blockText(b)).join('\n');
+		if (!pre.textContent) pre.appendChild(document.createElement('br'));
+
+		blocks[0].replaceWith(pre);
+		for (const b of blocks.slice(1)) b.remove();
+
+		const range = document.createRange();
+		range.selectNodeContents(pre);
+		range.collapse(false);
+		const selection = window.getSelection();
+		selection.removeAllRanges();
+		selection.addRange(range);
+
+		readState();
+		changed();
+	}
+
+	/** Bytter et bloks tag ud og flytter indholdet med, uden at røre markøren. */
+	function swapTag(block, tag) {
 		// The copy button lives inside the <pre> so it can sit in its corner; it is
 		// not text and must not travel into a paragraph. addCopyButtons puts it back
 		// on the next render for any <pre> that still needs one.
@@ -156,6 +214,16 @@
 		while (block.firstChild) el.appendChild(block.firstChild);
 		if (!el.firstChild) el.appendChild(document.createElement('br'));
 		block.replaceWith(el);
+		return el;
+	}
+
+	/**
+	 * Replaces a block element with one of another tag, keeping its contents and the
+	 * caret. Used where execCommand cannot be trusted — converting to or from a
+	 * <pre>, which it either nests or ignores.
+	 */
+	function replaceBlock(block, tag) {
+		const el = swapTag(block, tag);
 
 		const range = document.createRange();
 		range.selectNodeContents(el);
@@ -380,7 +448,7 @@
 			btn.addEventListener('click', async (e) => {
 				e.preventDefault();
 				e.stopPropagation();
-				const text = codeTextOf(pre);
+				const text = blockText(pre);
 				try {
 					await navigator.clipboard.writeText(text.replace(/\n$/, ''));
 					btn.textContent = t('notes.copied');
@@ -394,19 +462,16 @@
 	}
 
 	/**
-	 * Teksten i en kodeblok, uden knapper og andet, editoren har lagt oven på den.
+	 * Teksten i en kodeblok kommer fra `blockText` i richtext.js — ÉT sted, hvilket
+	 * den her kommentar påstod i forvejen, mens der stod en kopi lige her.
 	 *
-	 * Ét sted, fordi to steder skal bruge det samme svar: farvelægningen, som
-	 * skriver resultatet tilbage i blokken, og oversættelsen til Markdown, som
-	 * skriver det i filen. Var de to uenige, ville forskellen ende i noten.
+	 * De to skal bruge det samme svar: farvelægningen, som skriver resultatet
+	 * tilbage i blokken, og oversættelsen til Markdown, som skriver det i filen. De
+	 * var uenige om ét tegn — kopien her læste `textContent`, og et <br> har den
+	 * tomme streng som textContent. Så en blok, man havde skrevet med shift+retur,
+	 * fik sine linjer skrevet sammen af farvelægningen, i det øjeblik man klikkede
+	 * væk fra den. På skærmen, ikke kun i filen.
 	 */
-	function codeTextOf(pre) {
-		const from = pre.querySelector('code') ?? pre;
-		return [...from.childNodes]
-			.filter((n) => n.nodeType !== Node.ELEMENT_NODE || !n.classList?.contains('copy'))
-			.map((n) => n.textContent ?? '')
-			.join('');
-	}
 
 	function colourCode() {
 		if (!editor) return;
@@ -419,7 +484,7 @@
 			// maler resultatet tilbage ind i blokken — så et klik på "Kopiér" skrev
 			// "Kopieret" ind i koden, og den næste gemning lagde det i filen. Knappen
 			// spiste den kode, den var sat der for at kopiere.
-			const code = codeTextOf(pre);
+			const code = blockText(pre);
 			const lang = pre.getAttribute('data-lang') || guessLanguage(code);
 			if (lang) pre.setAttribute('data-lang', lang);
 			const painted = highlight(code, lang);
@@ -640,9 +705,69 @@
 			onopennote?.(link.getAttribute('data-note') ?? link.textContent);
 			return;
 		}
+		// Et billede i en note er et billede, man har indsat for at kunne se det. I
+		// arket er det skaleret ned til spaltens bredde — et foto fra en telefon er
+		// fire tusind pixels bredt — så det, man kigger på, er et miniaturebillede,
+		// der ikke ser ud som et.
+		const image = event.target.closest?.('img');
+		if (image) {
+			event.preventDefault();
+			showing = { src: image.currentSrc || image.src, alt: image.alt ?? '' };
+			copied = false;
+			copyError = '';
+			return;
+		}
 		colourCode();
 	}
 
+	// --- billedet i fuld størrelse ------------------------------------------------
+
+	let showing = $state(null);
+	let copied = $state(false);
+	let copyError = $state('');
+
+	function closeImage() {
+		showing = null;
+		// Tilbage i teksten, hvor man var. Uden det står fokus på en knap, der ikke
+		// findes længere, og den næste tast går ingen steder.
+		editor?.focus();
+	}
+
+	/**
+	 * Billedet som PNG, uanset hvad det kom som.
+	 *
+	 * Udklipsholderen tager kun PNG i de fleste browsere, og et foto fra en telefon
+	 * er en JPEG. Så et billede, der ikke allerede er PNG, tegnes om — ellers
+	 * lykkes skrivningen enten ikke, eller den lykkes med noget, ingen kan indsætte.
+	 */
+	async function asPNG(src) {
+		const blob = await (await fetch(src)).blob();
+		if (blob.type === 'image/png') return blob;
+
+		const bitmap = await createImageBitmap(blob);
+		const canvas = document.createElement('canvas');
+		canvas.width = bitmap.width;
+		canvas.height = bitmap.height;
+		canvas.getContext('2d').drawImage(bitmap, 0, 0);
+		return new Promise((resolve) => canvas.toBlob(resolve, 'image/png'));
+	}
+
+	async function copyImage() {
+		copyError = '';
+		try {
+			// Løftet gives videre frem for at blive ventet af først. Safari kræver, at
+			// clipboard.write kaldes i selve klikket, og en hentning imellem gør
+			// klikket til fortid — et ClipboardItem må gerne indeholde et løfte.
+			await navigator.clipboard.write([new ClipboardItem({ 'image/png': asPNG(showing.src) })]);
+			copied = true;
+			setTimeout(() => (copied = false), 2000);
+		} catch (e) {
+			// Sagt højt frem for tavst. En kopiér-knap, der ikke gør noget, er værre
+			// end ingen knap: man indsætter noget andet og opdager det et andet sted.
+			copyError = t('notes.copyFailed');
+		}
+	}
+
 	/** Replaces the half-typed tag with the whole thing. */
 	function accept(item) {
 		const partial = partialTag();
@@ -728,6 +853,17 @@
 		});
 	}
 
+	/**
+	 * Står markøren i en punktliste eller en nummereret liste?
+	 *
+	 * Spurgt gennem kommandotilstanden frem for ved at gå op gennem træet: det er
+	 * den samme kilde, værktøjslinjen allerede markerer knappen efter, så de to kan
+	 * ikke blive uenige om, hvad der er en liste.
+	 */
+	const inList = () =>
+		document.queryCommandState('insertUnorderedList') ||
+		document.queryCommandState('insertOrderedList');
+
 	function onkeydown(event) {
 		// The suggestion list owns the arrows and return while it is open, the way
 		// every other completion does. Escape closes it without choosing.
@@ -756,6 +892,15 @@
 			}
 		}
 
+		// Tab rykker et punkt ind og ud, som i enhver anden liste. Kun i en liste:
+		// alle andre steder er Tab den tast, der flytter fokus videre, og en editor,
+		// der stjæler den, er en editor, man ikke kan komme ud af med tastaturet.
+		if (event.key === 'Tab' && inList()) {
+			event.preventDefault();
+			apply(event.shiftKey ? 'outdent' : 'indent');
+			return;
+		}
+
 		if (event.key === 'Enter' && !event.shiftKey) {
 			// A code block is the one place the browser keeps the caret inside on
 			// Enter rather than starting a new block. Step out of it ourselves, or a
@@ -1068,7 +1213,102 @@
 	</p>
 </div>
 
+<!-- Billedet i fuld størrelse. Uden for .wrap, fordi editoren har sin egen
+     rulning og sin egen stablingskontekst — et lag inde i den ville blive klippet
+     af netop det ark, det skal lægge sig over. -->
+{#if showing}
+	<!-- svelte-ignore a11y_click_events_have_key_events, a11y_no_static_element_interactions -->
+	<div class="lightbox" onclick={closeImage} role="dialog" aria-modal="true" aria-label={t('notes.imageTitle')}>
+		<!-- svelte-ignore a11y_click_events_have_key_events, a11y_no_static_element_interactions -->
+		<div class="shot" onclick={(e) => e.stopPropagation()}>
+			<img src={showing.src} alt={showing.alt} />
+			<div class="tools">
+				<button onclick={copyImage}>{copied ? t('notes.imageCopied') : t('notes.imageCopy')}</button>
+				<a href={showing.src} target="_blank" rel="noopener">{t('notes.imageOpen')}</a>
+				<button class="shut" onclick={closeImage}>{t('detail.close')}</button>
+			</div>
+			{#if copyError}<p class="bad">{copyError}</p>{/if}
+		</div>
+	</div>
+{/if}
+
+<svelte:window
+	onkeydown={(e) => {
+		if (showing && e.key === 'Escape') {
+			e.stopPropagation();
+			closeImage();
+		}
+	}}
+/>
+
 <style>
+	/* Over alt andet og midt på skærmen. Baggrunden er mørk nok til at billedet
+	   står alene — det er hele grunden til at åbne det. */
+	.lightbox {
+		position: fixed;
+		inset: 0;
+		z-index: 100;
+		background: rgb(0 0 0 / 0.8);
+		display: flex;
+		align-items: center;
+		justify-content: center;
+		padding: var(--s4);
+	}
+
+	.shot {
+		display: flex;
+		flex-direction: column;
+		align-items: center;
+		gap: var(--s3);
+		max-width: 100%;
+		max-height: 100%;
+	}
+
+	/* `min-height: 0` hører med: uden den nægter et flex-element at blive lavere
+	   end sit indhold, og et højt billede vokser ud over skærmen i stedet for at
+	   passe sig ind i den. */
+	.shot img {
+		min-height: 0;
+		max-width: 100%;
+		max-height: calc(100vh - 8rem);
+		object-fit: contain;
+		border-radius: var(--radius);
+	}
+
+	.tools {
+		display: flex;
+		gap: var(--s2);
+		align-items: center;
+		flex-wrap: wrap;
+	}
+
+	.tools button,
+	.tools a {
+		padding: var(--s2) var(--s3);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+		background: var(--surface);
+		color: var(--ink);
+		font-size: var(--text-sm);
+		text-decoration: none;
+	}
+
+	.tools button:hover,
+	.tools a:hover {
+		border-color: var(--accent);
+	}
+
+	.bad {
+		margin: 0;
+		font-size: var(--text-sm);
+		color: var(--danger);
+	}
+
+	/* Markøren siger, at billedet er til at klikke på, før man prøver. */
+	.page :global(img) {
+		cursor: zoom-in;
+	}
+
 	.wrap {
 		display: flex;
 		flex-direction: column;

web/src/lib/components/Notifications.svelte

@@ -20,6 +20,31 @@
 	let open = $state(false);
 	let wrap = $state(null);
 
+	/**
+	 * Hvor panelet begynder på en telefon — målt, ikke regnet ud.
+	 *
+	 * På en bred skærm hænger panelet under klokken og hører til den. På en telefon
+	 * kan det ikke: klokken sidder tættere på højre kant end panelet er bredt, så et
+	 * panel, der er stillet op efter klokken, skydes ud over venstre side og bliver
+	 * klippet. Der stod tre en halv linje tekst uden for skærmen.
+	 *
+	 * Bredden kunne trækkes fra i CSS — der er en temaknap, et mellemrum og en
+	 * kantafstand til højre for klokken — men så ville den her fil kende sine
+	 * naboers størrelse, og næste knap i toplinjen ville lave fejlen om igen uden
+	 * at sige noget. Toplinjens underkant måles i stedet, og så spænder panelet over
+	 * skærmen med en kant i hver side.
+	 */
+	let below = $state(0);
+
+	function place() {
+		if (wrap) below = Math.round(wrap.getBoundingClientRect().bottom);
+	}
+
+	function toggle() {
+		open = !open;
+		if (open) place();
+	}
+
 	const KINDS = {
 		assigned: 'notif.assigned',
 		'note.changed': 'notif.noteChanged',
@@ -72,6 +97,7 @@
 
 <svelte:window
 	onclick={outside}
+	onresize={() => open && place()}
 	onkeydown={(e) => {
 		if (e.key === 'Escape' && open) open = false;
 	}}
@@ -81,7 +107,7 @@
 	<button
 		class="bell"
 		class:on={open}
-		onclick={() => (open = !open)}
+		onclick={toggle}
 		aria-expanded={open}
 		aria-haspopup="dialog"
 		aria-label={app.unread
@@ -101,7 +127,7 @@
 	</button>
 
 	{#if open}
-		<div class="panel" role="dialog" aria-label={t('notif.title')}>
+		<div class="panel" role="dialog" aria-label={t('notif.title')} style="--below: {below}px">
 			<header>
 				<span>{t('notif.title')}</span>
 				{#if app.unread}
@@ -193,6 +219,21 @@
 		box-shadow: var(--shadow-lg, 0 8px 30px rgb(0 0 0 / 0.25));
 	}
 
+	/* På en telefon hører panelet til skærmen, ikke til klokken. Se `below` i
+	   skriptet for hvorfor det måles frem for at blive regnet ud. Samme knæk som
+	   toplinjens egen menuknap, så de to skifter form samtidig. */
+	@media (max-width: 820px) {
+		.panel {
+			position: fixed;
+			top: calc(var(--below) + 6px);
+			left: var(--s3);
+			right: var(--s3);
+			width: auto;
+			max-height: calc(100dvh - var(--below) - var(--s3) * 2);
+			overscroll-behavior: contain;
+		}
+	}
+
 	.panel header {
 		display: flex;
 		align-items: center;

web/src/lib/components/QuickAdd.svelte

@@ -15,6 +15,7 @@
 	import { api } from '$lib/api.js';
 	import { app } from '$lib/stores.svelte.js';
 	import { t } from '$lib/i18n.svelte.js';
+	import { readList } from '$lib/pastelist.js';
 	let { projectId = undefined, onadded = undefined, autofocus = false } = $props();
 
 	let text = $state('');
@@ -97,6 +98,60 @@
 		return out;
 	});
 
+	/**
+	 * En indsat liste bliver til opgaver frem for til én opgave med det hele i.
+	 *
+	 * Browseren smider linjeskiftene væk, når man indsætter i et `<input>`, så uden
+	 * det her blev en kopieret liste til én opgave med punkterne mast sammen. En
+	 * enkelt linje røres ikke — det er almindelig indsætning, og den skal opføre sig
+	 * som altid.
+	 *
+	 * Vist før den oprettes. Fyrre opgaver fra et fejlklik er ikke noget, man skal
+	 * opdage bagefter, og listen er også svaret på "forstod den indrykningen" —
+	 * stillet mens der stadig er en Fortryd-knap.
+	 */
+	let pending = $state([]);
+
+	function onpaste(event) {
+		const pasted = event.clipboardData?.getData('text/plain') ?? '';
+		if (!pasted.includes('\n')) return;
+
+		const rows = readList(pasted);
+		if (rows.length < 2) return;
+
+		event.preventDefault();
+		pending = rows;
+	}
+
+	async function createPending() {
+		if (submitting) return;
+		submitting = true;
+
+		// Den seneste opgave på hvert niveau, så en indrykket linje havner under den
+		// linje, den stod under — og ikke under den første, den bedste.
+		const parents = [];
+		let made = 0;
+		for (const row of pending) {
+			const parentId = row.depth > 0 ? parents[row.depth - 1] : undefined;
+			const task = await app.quickAdd(row.text, projectId, undefined, parentId);
+			// Stopper ved den første, der ikke kunne laves. At køre videre ville lægge
+			// resten af listen ind uden den, de hang under, og det er værre end at
+			// standse et sted, man kan se.
+			if (!task) break;
+			parents[row.depth] = task.id;
+			parents.length = row.depth + 1;
+			if (row.done) await app.complete(task.id);
+			onadded?.(task);
+			made++;
+		}
+
+		submitting = false;
+		// Det, der ikke nåede at blive lavet, bliver stående, så man kan se hvor langt
+		// den kom og prøve resten igen.
+		pending = pending.slice(made);
+		input?.focus();
+	}
+
 	async function submit(event) {
 		event?.preventDefault();
 		const value = text.trim();
@@ -164,13 +219,32 @@
 			aria-label={t('task.new')}
 			autocomplete="off"
 			spellcheck="false"
+			{onpaste}
 		/>
 	</div>
 
-	{#if text.trim()}
+	{#if text.trim() && !pending.length}
 		<button type="submit" class="submit" disabled={submitting}>{t('task.add')}</button>
 	{/if}
 
+	{#if pending.length}
+		<div class="pasted" role="group" aria-label={t('task.pastedTitle')}>
+			<ul>
+				{#each pending as row, i (i)}
+					<li style="--depth: {row.depth}" class:done={row.done}>{row.text}</li>
+				{/each}
+			</ul>
+			<div class="actions">
+				<button type="button" class="submit" disabled={submitting} onclick={createPending}>
+					{t('task.pastedAdd', { n: String(pending.length) })}
+				</button>
+				<button type="button" class="cancel" onclick={() => (pending = [])}>
+					{t('task.pastedCancel')}
+				</button>
+			</div>
+		</div>
+	{/if}
+
 	<!-- What the parser understands, spelled out while somebody is typing into it.
 	     It was in the placeholder before, which is the one place a hint cannot be:
 	     the placeholder disappears at the first keystroke, so the help was gone
@@ -190,6 +264,57 @@
 </form>
 
 <style>
+	/* Den indsatte liste, før den bliver til opgaver. Ligger i flowet og ikke
+	   svævende: den skal kunne klikkes på, og den er noget, man læser færdig frem
+	   for et vink, der forsvinder. */
+	.pasted {
+		grid-column: 1 / -1;
+		margin-top: var(--s2);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+		background: var(--surface);
+		padding: var(--s2);
+	}
+
+	.pasted ul {
+		list-style: none;
+		margin: 0 0 var(--s2);
+		padding: 0;
+		max-height: 40vh;
+		overflow-y: auto;
+	}
+
+	.pasted li {
+		/* Indrykningen er hele pointen med visningen: den viser, hvad der bliver en
+		   underopgave, mens der stadig er en vej tilbage. */
+		padding: 2px 0 2px calc(var(--depth) * var(--s4));
+		font-size: var(--text-sm);
+		color: var(--ink);
+	}
+
+	.pasted li.done {
+		text-decoration: line-through;
+		color: var(--ink-muted);
+	}
+
+	.pasted .actions {
+		display: flex;
+		gap: var(--s2);
+		align-items: center;
+	}
+
+	.cancel {
+		border: none;
+		background: none;
+		padding: 0;
+		font: inherit;
+		color: var(--ink-muted);
+		cursor: pointer;
+	}
+	.cancel:hover {
+		text-decoration: underline;
+	}
+
 	/* Sits under the field it explains, in the same rhythm as a hint anywhere else. */
 	.syntax {
 		/* Nothing to click, and it floats over the first task in the list — which it

web/src/lib/components/Sidebar.svelte

@@ -73,6 +73,11 @@
 	// through the connector.
 	$effect(() => {
 		app.labelsChanged;
+		// Ikke i noter-udgaven: begge ruter findes slet ikke der, så de to kald var
+		// to 404'ere ved hver navigation — opslugt af .catch() og derfor usynlige.
+		// Fundet af vandringen i edition.spec.js, efter at porten havde været i
+		// drift i to merges.
+		if (app.notesOnly) return;
 		api.listFilters().then((r) => (filters = r.filters)).catch(() => {});
 		api.listLabels().then((r) => (labels = r.labels)).catch(() => {});
 	});
@@ -155,9 +160,12 @@
 	// entry is a question the sidebar keeps asking and answering "no".
 	let navItems = $derived(
 		[
-			{ key: 'today', href: '/', label: 'nav.today' },
-			{ key: 'upcoming', href: '/upcoming', label: 'nav.upcoming' },
-			app.projects.some((p) => p.shared)
+			// Opgavernes egne indgange findes ikke i noter-udgaven. Ikke gråtonet og
+			// ikke skjult med CSS — udeladt, fordi ruterne bag dem ikke er monteret
+			// på serveren. Et link til noget, der ikke findes, er ikke en skønhedsfejl.
+			app.notesOnly ? null : { key: 'today', href: '/', label: 'nav.today' },
+			app.notesOnly ? null : { key: 'upcoming', href: '/upcoming', label: 'nav.upcoming' },
+			!app.notesOnly && app.projects.some((p) => p.shared)
 				? { key: 'delegated', href: '/uddelegeret', label: 'nav.delegated' }
 				: null,
 			// No href: the inbox is a project and is drawn by projectRow, which knows
@@ -185,7 +193,7 @@
 			// Sidst i rækken, fordi `navOrder` føjer en ukendt nøgle til bagest: står
 			// den et andet sted her, ser en ny konto én rækkefølge og alle
 			// eksisterende en anden.
-			{ key: 'calendar', href: '/kalender', label: 'nav.calendar' }
+			app.notesOnly ? null : { key: 'calendar', href: '/kalender', label: 'nav.calendar' }
 		].filter(Boolean)
 	);
 
@@ -472,11 +480,13 @@
 
 <nav class="sidebar" aria-label={t('nav.main')}>
 	<div class="brand">
-		<!-- Verdande's mark: the rune Wunjo, which is the letter the Norn's name
-		     starts with in the elder futhark. One glyph, no wordmark beside it —
-		     the name is in the tab and everywhere else already. -->
-		<span class="rune" aria-hidden="true">ᚹ</span>
-		<span class="name">verdande</span>
+		<!-- The mark: one rune, the letter the Norn's name starts with in the elder
+		     futhark — Wunjo for Verdande, Uruz for Urd. Both come from the store
+		     rather than from here, because the two editions of this program are two
+		     products with two names, and a wordmark is the one place a reader
+		     decides which one they are looking at. -->
+		<span class="rune" aria-hidden="true">{app.productRune}</span>
+		<span class="name">{app.productSlug}</span>
 	</div>
 
 	<div class="views">

web/src/lib/components/TaskDetail.svelte

@@ -15,6 +15,7 @@
 	import { focusOnMount } from '$lib/focus.js';
 	import { t, tag } from '$lib/i18n.svelte.js';
 	import { REPEATS } from '$lib/when.js';
+	import { readList } from '$lib/pastelist.js';
 
 	let { task, onclose } = $props();
 
@@ -171,6 +172,32 @@
 	 * took is said out loud, because a title that edits itself without a word is
 	 * worse than one that does nothing.
 	 */
+	/**
+	 * Lader et felt være lige så højt som sin tekst.
+	 *
+	 * `height: auto` først, og så `scrollHeight`: uden nulstillingen kan feltet kun
+	 * vokse, for scrollHeight på et felt, der allerede er for højt, er dets egen
+	 * højde.
+	 */
+	function grow(node) {
+		const fit = () => {
+			node.style.height = 'auto';
+			node.style.height = `${node.scrollHeight}px`;
+		};
+		fit();
+		node.addEventListener('input', fit);
+		// Bredden skifter, når ruden gør — og en tekst, der fyldte to linjer, fylder
+		// tre på en smallere skærm uden at der er rørt ved den.
+		const watch = new ResizeObserver(fit);
+		watch.observe(node);
+		return {
+			destroy() {
+				node.removeEventListener('input', fit);
+				watch.disconnect();
+			}
+		};
+	}
+
 	async function saveContent() {
 		if (!task) return;
 		const trimmed = content.trim();
@@ -256,6 +283,73 @@
 
 	// --- sub-tasks ----------------------------------------------------------------
 
+	/**
+	 * En liste indsat i undertask-feltet bliver til undertasks under DEN her opgave.
+	 *
+	 * Det er den anden halvdel af "enten opgaver eller undertasks": hvor man
+	 * indsætter, afgør hvad linjerne bliver, uden at nogen skal vælge noget i en
+	 * menu. Indrykning i det indsatte giver stadig et niveau mere, så en liste med
+	 * punkter under punkter kommer ind som den stod.
+	 *
+	 * Som i quick-add vises den, før den oprettes — og af samme grund.
+	 */
+	let pastedSubtasks = $state([]);
+
+	function onPasteSubtasks(event) {
+		const pasted = event.clipboardData?.getData('text/plain') ?? '';
+		if (!pasted.includes('\n')) return;
+		const rows = readList(pasted);
+		if (rows.length < 2) return;
+		event.preventDefault();
+		pastedSubtasks = rows;
+	}
+
+	async function createPastedSubtasks() {
+		if (addingPasted) return;
+		addingPasted = true;
+
+		// Niveau nul hænger under den åbne opgave; dybere niveauer hænger under den
+		// seneste linje ovenfor, som i quick-add.
+		const parents = [task.id];
+		let made = 0;
+		for (const row of pastedSubtasks) {
+			const created = await app.quickAdd(row.text, task.project_id, undefined, parents[row.depth]);
+			if (!created) break;
+			parents[row.depth + 1] = created.id;
+			parents.length = row.depth + 2;
+			if (row.done) await app.complete(created.id);
+			// Kun dem, der hører direkte under den åbne opgave, står i listen her —
+			// resten hører under deres egen.
+			if (row.depth === 0) subtasks = [...subtasks, created];
+			made++;
+		}
+
+		addingPasted = false;
+		pastedSubtasks = pastedSubtasks.slice(made);
+		countSubtasks();
+	}
+
+	let addingPasted = $state(false);
+
+	/**
+	 * Rækkens tæller, når en undertask er kommet til eller er blevet lukket.
+	 *
+	 * Tallene bor på FORÆLDEREN og sendes med hver opgave, så listen kan sige
+	 * "1/4" uden at åbne noget. Serveren regner dem ud, når opgaverne hentes — den
+	 * sender ikke forælderen igen, fordi et barn blev lavet. Så uden det her stod
+	 * rækken bagved og sagde 1/2, mens ruden foran viste fire undertasks.
+	 *
+	 * Samme regel som resten af butikken: en lokal handling slår igennem med det
+	 * samme og bliver afstemt bagefter. Næste hentning henter serverens tal.
+	 */
+	function countSubtasks() {
+		app.upsert({
+			...task,
+			subtask_count: subtasks.length,
+			subtask_done: subtasks.filter((s) => s.completed).length
+		});
+	}
+
 	async function addSubtask(event) {
 		event.preventDefault();
 		const text = newSubtask.trim();
@@ -268,6 +362,7 @@
 				parent_id: task.id
 			});
 			subtasks = [...subtasks, created];
+			countSubtasks();
 		} catch (e) {
 			app.toast(humanMessage(e));
 		}
@@ -418,13 +513,27 @@
 
 	<div class="scroll">
 		<div class="field">
-			<input
+			<!-- Et felt frem for en linje. En opgavetitel er tit længere end en telefon
+			     er bred — "tado°: Your Smart Thermostat needs new batteries" er en
+			     almindelig en — og et <input> kan ikke ombryde: det ruller, og så står
+			     halvdelen af overskriften uden for kanten. -->
+			<textarea
 				class="title"
+				rows="1"
 				use:focusOnMount
+				use:grow
 				bind:value={content}
 				onblur={saveContent}
+				onkeydown={(e) => {
+					// Retur gemmer frem for at lave en ny linje. En titel er én linje,
+					// uanset hvor mange den fylder på skærmen.
+					if (e.key === 'Enter') {
+						e.preventDefault();
+						e.currentTarget.blur();
+					}
+				}}
 				aria-label={t('detail.text')}
-			/>
+			></textarea>
 		</div>
 
 		<div class="field">
@@ -595,8 +704,31 @@
 			{/each}
 
 			<form onsubmit={addSubtask}>
-				<input bind:value={newSubtask} placeholder={t('detail.addSubtask')} aria-label={t('detail.newSubtask')} />
+				<input
+					bind:value={newSubtask}
+					onpaste={onPasteSubtasks}
+					placeholder={t('detail.addSubtask')}
+					aria-label={t('detail.newSubtask')}
+				/>
 			</form>
+
+			{#if pastedSubtasks.length}
+				<div class="pasted" role="group" aria-label={t('task.pastedTitle')}>
+					<ul>
+						{#each pastedSubtasks as row, i (i)}
+							<li style="--depth: {row.depth}" class:done={row.done}>{row.text}</li>
+						{/each}
+					</ul>
+					<div class="pasted-actions">
+						<button type="button" disabled={addingPasted} onclick={createPastedSubtasks}>
+							{t('task.pastedAdd', { n: String(pastedSubtasks.length) })}
+						</button>
+						<button type="button" class="plain" onclick={() => (pastedSubtasks = [])}>
+							{t('task.pastedCancel')}
+						</button>
+					</div>
+				</div>
+			{/if}
 		</section>
 
 		<section>
@@ -701,6 +833,43 @@
 </aside>
 
 <style>
+	/* Den indsatte liste, før den bliver til undertasks. Samme form som i
+	   quick-add — det er den samme beslutning, stillet samme sted i forløbet. */
+	.pasted {
+		margin-top: var(--s2);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+		padding: var(--s2);
+	}
+	.pasted ul {
+		list-style: none;
+		margin: 0 0 var(--s2);
+		padding: 0;
+		max-height: 30vh;
+		overflow-y: auto;
+	}
+	.pasted li {
+		padding: 2px 0 2px calc(var(--depth) * var(--s4));
+		font-size: var(--text-sm);
+	}
+	.pasted li.done {
+		text-decoration: line-through;
+		color: var(--ink-muted);
+	}
+	.pasted-actions {
+		display: flex;
+		gap: var(--s2);
+		align-items: center;
+	}
+	.pasted-actions .plain {
+		border: none;
+		background: none;
+		padding: 0;
+		font: inherit;
+		color: var(--ink-muted);
+		cursor: pointer;
+	}
+
 	.linked-note {
 		display: block;
 		padding: var(--s2);
@@ -894,6 +1063,16 @@
 		resize: vertical;
 		font-family: inherit;
 		line-height: 1.5;
+		/* En beskrivelse er tit et klippet stykke mail med en URL i. Et <textarea>
+		   ombryder ved mellemrum, og en URL har ingen — så feltet rullede vandret,
+		   og på en telefon stod teksten forskudt med venstre kant klippet af. Det
+		   ser ikke ud som rulning; det ser ud som manglende bogstaver.
+
+		   `break-word` og ikke `anywhere`: den første bryder kun et ord, der ikke kan
+		   stå på en linje alene, mens den anden bryder ved først givne lejlighed og
+		   delte "GarageRisteriet" midt i en stavelse. Se h1 på projektets side — den
+		   lektion er betalt én gang. */
+		overflow-wrap: break-word;
 	}
 
 	/* The title is the one field that should not look like a field until you are in
@@ -905,6 +1084,10 @@
 		background: transparent;
 		border-color: transparent;
 		padding-left: 0;
+		/* Højden sættes af `grow`, så håndtaget ville love noget, det ikke kan
+		   holde: trækker man i det, retter det næste bogstav det tilbage. */
+		resize: none;
+		overflow: hidden;
 	}
 
 	.title:hover {

web/src/lib/locales/da.js

@@ -145,7 +145,7 @@ export const da = {
 	// læserens mulighed for at efterprøve det.
 	'beacon.noticeTitle': 'Denne installation melder, at den findes',
 	'beacon.noticeBody':
-		'Én gang i døgnet sender Verdande to værdier til projektet, så det kan ses, hvor mange installationer der er. Præcis de her to — intet andet, ingen IP bliver gemt, intet om hvad du bruger det til:',
+		'Én gang i døgnet sender {product} to værdier til projektet, så det kan ses, hvor mange installationer der er. Præcis de her to — intet andet, ingen IP bliver gemt, intet om hvad du bruger det til:',
 	'beacon.noticeTo': 'Sendes til {url}',
 	'beacon.noticeKeep': 'Behold den',
 	'beacon.noticeStop': 'Slå den fra',
@@ -173,6 +173,10 @@ export const da = {
 	'notes.copyCode': 'Kopiér',
 	'notes.copied': 'Kopieret',
 	'notes.copyFailed': 'Kunne ikke kopiere',
+	'notes.imageTitle': 'Billede',
+	'notes.imageCopy': 'Kopiér billedet',
+	'notes.imageCopied': 'Kopieret',
+	'notes.imageOpen': 'Åbn i nyt faneblad',
 	'notes.strike': 'Gennemstreget',
 	'notes.code': 'Kode',
 	'notes.showSource': 'Vis kilden (Markdown)',
@@ -233,6 +237,9 @@ export const da = {
 	'nav.offlineHint': 'Ændringer fra andre vises ikke lige nu',
 	'net.reconnecting': 'Genopretter forbindelse…',
 	'net.offline': 'Ingen forbindelse',
+	'net.downTitle': 'Ingen forbindelse',
+	'net.downBody': '{product} kan ikke nås herfra lige nu. Din tekst er ikke væk — den ligger på serveren, og den kommer igen, når forbindelsen gør.',
+	'net.downRetry': 'Prøv igen',
 	'nav.doItToday': 'Gør det i dag',
 
 	// --- the sidebar's own sections ------------------------------------------------
@@ -256,6 +263,9 @@ export const da = {
 
 	// --- a task in a list ----------------------------------------------------------
 	'task.add': 'Tilføj',
+	'task.pastedTitle': 'Indsat liste',
+	'task.pastedAdd': 'Opret {n} opgaver',
+	'task.pastedCancel': 'Fortryd',
 	'task.new': 'Ny opgave',
 	'task.syntaxProject': 'projekt',
 	'task.syntaxSection': 'sektion',
@@ -343,7 +353,7 @@ export const da = {
 	'size.default': 'Standard',
 	'size.large': 'Stor',
 	'size.xl': 'Størst',
-	'look.verdande': 'Verdande',
+	'look.verdande': '{product}',
 	'look.verdandeNote': 'Som du kender den.',
 	'look.rolig': 'Rolig',
 	'look.roligNote': 'Serif, mere luft. Til at læse og skrive i.',
@@ -604,6 +614,8 @@ export const da = {
 	'data.importNotesHint': 'Én .md-fil pr. note; første linje bliver titlen. Billeder, der ligger ved siden af, følger med og bliver hængt på noten. Scriptet i tools/ henter dine Apple Noter ud.',
 	'data.notesImported': '{n} noter og {files} filer hentet ind.',
 	'data.exportNotes': 'Alle noter som Markdown-filer',
+	'data.exportAllCSV': 'Alle opgaver (CSV)',
+	'data.exportAllICS': 'Alle opgaver (kalender)',
 	'data.exportAccount': 'Hele kontoen som JSON',
 	'data.exportOne': 'Ét projekt',
 	'data.pickProject': 'Vælg et projekt',

web/src/lib/locales/en.js

@@ -142,7 +142,7 @@ export const en = {
 	// the reader's ability to check it.
 	'beacon.noticeTitle': 'This installation reports that it exists',
 	'beacon.noticeBody':
-		'Once a day Verdande sends two values to the project, so it can see how many installations there are. Exactly these two — nothing else, no IP is stored, nothing about what you use it for:',
+		'Once a day {product} sends two values to the project, so it can see how many installations there are. Exactly these two — nothing else, no IP is stored, nothing about what you use it for:',
 	'beacon.noticeTo': 'Sent to {url}',
 	'beacon.noticeKeep': 'Keep it on',
 	'beacon.noticeStop': 'Turn it off',
@@ -170,6 +170,10 @@ export const en = {
 	'notes.copyCode': 'Copy',
 	'notes.copied': 'Copied',
 	'notes.copyFailed': 'Could not copy',
+	'notes.imageTitle': 'Image',
+	'notes.imageCopy': 'Copy the image',
+	'notes.imageCopied': 'Copied',
+	'notes.imageOpen': 'Open in a new tab',
 	'notes.strike': 'Strikethrough',
 	'notes.code': 'Code',
 	'notes.showSource': 'Show the source (Markdown)',
@@ -230,6 +234,9 @@ export const en = {
 	'nav.offlineHint': 'Changes from other people are not showing right now',
 	'net.reconnecting': 'Reconnecting…',
 	'net.offline': 'No connection',
+	'net.downTitle': 'No connection',
+	'net.downBody': '{product} cannot be reached from here right now. Nothing you wrote is lost — it is on the server, and it comes back when the connection does.',
+	'net.downRetry': 'Try again',
 	'nav.doItToday': 'Do it today',
 
 	// --- the sidebar's own sections ------------------------------------------------
@@ -253,6 +260,9 @@ export const en = {
 
 	// --- a task in a list ----------------------------------------------------------
 	'task.add': 'Add',
+	'task.pastedTitle': 'Pasted list',
+	'task.pastedAdd': 'Add {n} tasks',
+	'task.pastedCancel': 'Cancel',
 	'task.new': 'New task',
 	'task.syntaxProject': 'project',
 	'task.syntaxSection': 'section',
@@ -340,7 +350,7 @@ export const en = {
 	'size.default': 'Default',
 	'size.large': 'Large',
 	'size.xl': 'Largest',
-	'look.verdande': 'Verdande',
+	'look.verdande': '{product}',
 	'look.verdandeNote': 'As you know it.',
 	'look.rolig': 'Calm',
 	'look.roligNote': 'Serif, more air. For reading and writing.',
@@ -600,6 +610,8 @@ export const en = {
 	'data.importNotesHint': 'One .md file per note; the first line becomes the title. Pictures beside the files come with them and are attached to the note. The script in tools/ gets your Apple Notes out.',
 	'data.notesImported': '{n} notes and {files} files brought in.',
 	'data.exportNotes': 'Every note as Markdown files',
+	'data.exportAllCSV': 'All tasks (CSV)',
+	'data.exportAllICS': 'All tasks (calendar)',
 	'data.exportAccount': 'The whole account as JSON',
 	'data.exportOne': 'One project',
 	'data.pickProject': 'Pick a project',

web/src/lib/pastelist.js

@@ -0,0 +1,64 @@
+/**
+ * En indsat liste, læst som opgaver og underopgaver.
+ *
+ * Quick-add er ét felt på én linje, og en browser smider linjeskiftene væk, når
+ * man indsætter i et `<input>` — så en kopieret liste blev til én opgave med det
+ * hele mast sammen. Det her er den anden halvdel: hvad linjerne betyder.
+ *
+ * Indrykning bærer niveauet, samme regel som punktlisterne i noterne. Bredden
+ * læses af teksten selv frem for at være gættet til to eller fire: en liste fra
+ * Apple Noter rykker ind med ét antal mellemrum, en fra et Markdown-dokument med
+ * et andet, og begge dele skal give ét niveau. En stak over de indrykninger, der
+ * faktisk er set, klarer begge uden at kende tallet på forhånd.
+ *
+ * Mærkerne — `-`, `*`, `+`, `1.`, `1)` — fjernes, fordi de er listens notation og
+ * ikke en del af opgaven. En afkrydsningsboks er derimod indhold: `- [x]` siger,
+ * at punktet var gjort, og en halvt afkrydset liste, der kommer ind som lutter
+ * uløste opgaver, har tabt det, man indsatte den for.
+ *
+ * Teksten selv røres ikke ud over det. Datoer, `#projekt` og `@etiket` læses af
+ * quickadd på serveren, præcis som når linjen var skrevet i hånden — ét sted at
+ * forstå en opgavelinje, ikke to.
+ */
+
+/** `- `, `* `, `+ `, `1. `, `1) ` — listens egen notation, ikke opgavens navn. */
+const MARKER = /^(?:[-*+]|\d+[.)])\s+/;
+/** `[ ]`, `[x]`, `[X]` — står efter mærket, når der er et. */
+const BOX = /^\[([ xX])\]\s*/;
+
+/** Hvor bredt et stykke indrykning er, med en tabulator som to mellemrum. */
+function width(indent) {
+	return indent.replace(/\t/g, '  ').length;
+}
+
+export function readList(text) {
+	const out = [];
+	// De indrykningsbredder, der står åbne lige nu — én pr. niveau.
+	const levels = [];
+
+	for (const raw of (text ?? '').split(/\r?\n/)) {
+		const indent = /^[ \t]*/.exec(raw)[0];
+		let rest = raw.slice(indent.length).trim();
+		// En tom linje er et mellemrum i den, man kopierede, ikke et punkt. Den
+		// nulstiller ikke niveauet: en liste med luft mellem punkterne er én liste.
+		if (!rest) continue;
+
+		rest = rest.replace(MARKER, '');
+		let done = false;
+		const box = BOX.exec(rest);
+		if (box) {
+			done = box[1] !== ' ';
+			rest = rest.slice(box[0].length);
+		}
+		rest = rest.trim();
+		if (!rest) continue;
+
+		const w = width(indent);
+		while (levels.length && w < levels[levels.length - 1]) levels.pop();
+		if (!levels.length || w > levels[levels.length - 1]) levels.push(w);
+
+		out.push({ depth: levels.length - 1, text: rest, done });
+	}
+
+	return out;
+}

web/src/lib/richtext.js

@@ -314,6 +314,41 @@ const BLOCK_TAGS = /^(P|H[1-6]|UL|OL|LI|PRE|BLOCKQUOTE|DIV)$/;
 /** Whether an element holds blocks, in which case reading it as one line loses them. */
 const holdsBlocks = (el) => [...el.children].some((c) => BLOCK_TAGS.test(c.tagName));
 
+/**
+ * Teksten i et blok, med linjeskiftene i behold.
+ *
+ * `textContent` er ikke nok, og det er ikke en detalje: et <br> har den tomme
+ * streng som textContent, og <br> er præcis det, browseren lægger ind, når man
+ * trykker shift+retur i en blok. Blokken blev derfor skrevet ned som én linje —
+ * "first linesecond line" — så man kunne skrive flere linjer og ikke gemme dem.
+ * Det er usynligt indtil en genindlæsning, for på skærmen står de rigtigt hele
+ * tiden.
+ *
+ * Kopiér-knappen springes over. Den ligger inde i <pre> for at kunne sidde i
+ * hjørnet af den, og ellers stod ordet "Kopiér" i hver eneste kodeblok efter hver
+ * gemning.
+ *
+ * Rekursivt, fordi indholdet ligger i et <code> inde i blokken: en filtrering over
+ * <pre>'ens egne børn ser kun det ene element og spørger det om en textContent,
+ * der allerede har tabt linjeskiftet.
+ */
+export function blockText(node) {
+	let out = '';
+	for (const n of node.childNodes) {
+		if (n.nodeType !== Node.ELEMENT_NODE) {
+			out += n.textContent ?? '';
+			continue;
+		}
+		if (n.classList?.contains('copy')) continue;
+		if (n.tagName === 'BR') {
+			out += '\n';
+			continue;
+		}
+		out += blockText(n);
+	}
+	return out;
+}
+
 export function htmlToMarkdown(root) {
 	const lines = [];
 
@@ -366,14 +401,7 @@ export function htmlToMarkdown(root) {
 					// else and an indent does not.
 					const lang = child.getAttribute('data-lang') ?? '';
 					emit('```' + lang);
-					// Knapper og andet, editoren har lagt oven på blokken, hører ikke til
-					// i filen. Kopiér-knappen ligger inde i <pre> for at kunne placeres i
-					// hjørnet af den, og `textContent` ville ellers skrive ordet "Kopiér"
-					// ind i hver eneste kodeblok, hver gang noten blev gemt.
-					const code = [...child.childNodes]
-						.filter((n) => n.nodeType !== Node.ELEMENT_NODE || !n.classList?.contains('copy'))
-						.map((n) => n.textContent ?? '')
-						.join('');
+					const code = blockText(child);
 					for (const l of code.replace(/\n$/, '').split('\n')) {
 						emit(l);
 					}
@@ -408,6 +436,14 @@ export function htmlToMarkdown(root) {
 		const pad = '  '.repeat(depth);
 
 		for (const li of el.children) {
+			// En underliste, der ligger som SØSKENDE til punktet frem for inde i det.
+			// Browserne er uenige om, hvilken af de to former en indrykning laver, og
+			// de to ser ens ud på skærmen — men den her løkke sprang søskendeformen
+			// over uden lyd, så et indrykket punkt ville forsvinde ved gemningen.
+			if (li.tagName === 'UL' || li.tagName === 'OL') {
+				list(li, depth + 1, emit);
+				continue;
+			}
 			if (li.tagName !== 'LI') continue;
 
 			// Punktets egen tekst er alt undtagen de lister, der ligger under det.

web/src/lib/stores.svelte.js

@@ -29,6 +29,70 @@ class AppState {
 	people = $state([]);
 	tasks = $state([]);
 	loading = $state(true);
+
+	/**
+	 * True when the boot never reached the server — as opposed to reaching it and
+	 * being told the session is gone.
+	 *
+	 * The two are indistinguishable from `user === null`, and they are opposite
+	 * things to the person looking at the screen: one means "log ind", the other
+	 * means "der er intet at logge ind på herfra, og et kodeord hjælper ikke". A
+	 * total outage used to show the login screen, so the app blamed the user's
+	 * session for the network being down — and a login page that cannot possibly
+	 * work is worse than an error, because it looks like it might.
+	 */
+	unreachable = $state(false);
+
+	/**
+	 * Hvilken udgave af programmet den her instans er.
+	 *
+	 * `full` er opgaver, projekter og noter sammen. `notes` er notehalvdelen, hvor
+	 * opgaveruterne slet ikke er monteret på serveren — så fladen må ikke tilbyde
+	 * en vej til dem. Et link til en rute, der ikke findes, er ikke en skønhedsfejl:
+	 * det er en knap, der fører et sted hen, hvor der ikke er noget.
+	 *
+	 * Instansens form, ikke personens rettigheder. Derfor hentes den ved siden af
+	 * kontoen frem for efter den: den skal også være kendt, når ingen er logget ind.
+	 *
+	 * `full` som udgangspunkt, fordi det er det, programmet altid har været — en
+	 * instans, der ikke når at svare, skal ikke pludselig se ud som et andet
+	 * program.
+	 */
+	edition = $state('full');
+
+	get notesOnly() {
+		return this.edition === 'notes';
+	}
+
+	/**
+	 * Navnet instansen kalder sig selv — `Urd` i en sætning, `urd` i et mærke.
+	 *
+	 * To udgaver af ét program, to navne. Grunden til at det læses fra udgaven
+	 * frem for at stå skrevet i teksterne: for den der bruger en instans uden
+	 * opgaveruter er det et andet produkt, og et produkt, der kalder sig sin
+	 * søsters navn, er ikke et produkt — det er et flag, nogen har sat.
+	 *
+	 * Vinduets titel og manifestet står der IKKE. De læses af browseren, før
+	 * noget JavaScript kører, så serveren skriver dem om på vejen ud
+	 * (`internal/httpapi/shell.go`). Gjorde vi det her, ville hver indlæsning
+	 * vise søsterens navn et øjeblik og så rette sig selv.
+	 */
+	get productName() {
+		return this.notesOnly ? 'Urd' : 'Verdande';
+	}
+
+	get productSlug() {
+		return this.notesOnly ? 'urd' : 'verdande';
+	}
+
+	/**
+	 * Mærket: én rune, det bogstav navnet begynder med i den ældre futhark.
+	 * ᚹ wunjo for Verdande, ᚢ uruz for Urd.
+	 */
+	get productRune() {
+		return this.notesOnly ? '\u16A2' : '\u16B9';
+	}
+
 	/** Transient messages: a failed save, a rolled-back change. */
 	toasts = $state([]);
 	connected = $state(false);
@@ -94,8 +158,20 @@ class AppState {
 
 	async load() {
 		this.loading = true;
+
+		// Formen hentes for sig, og en fejl på den tier. En 401 fra `me` må ikke
+		// tage udgaven med sig — login-skærmen er også en flade i en udgave — og
+		// en instans, der slet ikke svarer, melder `me` ordentligt nedenfor.
+		const shape = api
+			.setupState()
+			.then((state) => {
+				if (state?.edition) this.edition = state.edition;
+			})
+			.catch(() => {});
+
 		try {
 			this.user = await api.me();
+			this.unreachable = false;
 			// The interface's language follows the account, so it is set the moment
 			// the session is known — before anything has drawn a string.
 			i18n.set(this.user.locale);
@@ -111,7 +187,15 @@ class AppState {
 			this.loadNotifications();
 		} catch (e) {
 			this.user = null;
+			// `offline` is the one code the request layer makes up itself: it is what
+			// is thrown when the retry window ran out without any status ever
+			// arriving. A 401 is the server answering, and that is a real sign-out.
+			this.unreachable = e?.code === 'offline';
 		} finally {
+			// Afventet her, så fladen aldrig tegnes, før den ved hvilket program den
+			// er. Tegnet først og rettet bagefter ville vise opgaver i et sekund på
+			// en instans, der ikke har nogen.
+			await shape;
 			this.loading = false;
 		}
 	}
@@ -259,6 +343,21 @@ class AppState {
 	 * `completed: 'exclude'`.
 	 */
 	async loadTasks(params) {
+		// Noter-udgaven har ingen opgaveruter, så den her ville kaste en 404 — og
+		// kalderne samler den i et Promise.all, hvor én fejl tager hele siden med.
+		// Vagten står HER frem for ved de tre kaldesteder, fordi butikken er det
+		// ene sted, der kender udgaven: en vagt pr. kalder er tre steder at glemme
+		// den fjerde, og det var præcis sådan den her slap igennem.
+		if (this.notesOnly) {
+			// Skrevet kun hvis der ER noget at rydde. En ubetinget tilskrivning
+			// looper: projektsiden har en effekt, der læser app.tasks og kalder
+			// herind, så et skriv ved hvert kald er en uendelig runde —
+			// effect_update_depth_exceeded, ikke en 404. Før vagten kastede kaldet
+			// på 404'eren og nåede aldrig at skrive, så løkken var skjult bag en
+			// fejl.
+			if (this.tasks.length) this.tasks = [];
+			return this.tasks;
+		}
 		const { tasks } = await api.listTasks({
 			completed: completedView.shown ? 'include' : undefined,
 			...params
@@ -505,9 +604,9 @@ class AppState {
 	 * request is fast and the box clears immediately, which is where the
 	 * responsiveness actually needs to be.
 	 */
-	async quickAdd(text, projectId) {
+	async quickAdd(text, projectId, sectionId, parentId) {
 		try {
-			const task = await api.quickAdd(text, projectId);
+			const task = await api.quickAdd(text, projectId, sectionId, parentId);
 			this.upsert(task);
 			return task;
 		} catch (e) {

web/src/routes/+layout.svelte

@@ -8,6 +8,7 @@
 	import Sidebar from '$lib/components/Sidebar.svelte';
 	import CommandPalette from '$lib/components/CommandPalette.svelte';
 	import SignIn from '$lib/components/SignIn.svelte';
+	import NoConnection from '$lib/components/NoConnection.svelte';
 	import TaskDetail from '$lib/components/TaskDetail.svelte';
 	import { t } from '$lib/i18n.svelte.js';
 	import { setBadge } from '$lib/badge.js';
@@ -56,6 +57,39 @@
 		app.load();
 	});
 
+	/**
+	 * Opgavernes sider findes ikke i noter-udgaven.
+	 *
+	 * Ét sted frem for en vagt i hver rute: listen ER beslutningen, og en vagt pr.
+	 * fil er syv steder at glemme den ottende. Skrevet som præfikser, fordi
+	 * `/opgave/<id>` og `/filter/<id>` er sider under dem.
+	 *
+	 * Sendt til noterne og ikke til en fejlside: der er ikke sket noget forkert.
+	 * Adressen hører bare til et andet program end det, der kører her — og nogen,
+	 * der har gemt et link fra en fuld instans, skal lande et sted, der giver
+	 * mening frem for i en blindgyde.
+	 *
+	 * `replaceState`, så Tilbage ikke fører hen til den side, man lige blev sendt
+	 * væk fra, og derfra tilbage igen.
+	 */
+	const TASK_PAGES = [
+		'/',
+		'/upcoming',
+		'/uddelegeret',
+		'/kalender',
+		'/faerdige',
+		'/opgave',
+		'/filter',
+		'/etiket'
+	];
+
+	$effect(() => {
+		if (!app.notesOnly) return;
+		const here = $page.url.pathname;
+		const taskPage = TASK_PAGES.some((p) => here === p || (p !== '/' && here.startsWith(p + '/')));
+		if (taskPage) goto('/noter', { replaceState: true });
+	});
+
 	/**
 	 * Links ud af programmet, åbnet i den browser, maskinen er sat op til.
 	 *
@@ -129,8 +163,20 @@
 		// Folding the sidebar had a button and nothing else, and a rectangle with a
 		// line down it is not a word: somebody who wanted the menu out of the way
 		// asked for the feature that was already there. ⌘B is where an editor puts
-		// it. Works while typing as well — it moves nothing in the field.
-		if ((event.metaKey || event.ctrlKey) && (event.key === 'b' || event.key === 'B')) {
+		// it.
+		//
+		// Men ikke i en rig editor. Her stod der "works while typing as well — it
+		// moves nothing in the field", og det passer for et <input>, hvor ⌘B ikke
+		// gør noget. I en contenteditable ER ⌘B fed tekst, og `preventDefault()`
+		// nedenfor stoppede browseren i at gøre den — så i noterne foldede
+		// sidebjælken sig i stedet for at gøre ordet fedt. Feltet, markøren står i,
+		// har førsteret til en tast, det selv bruger.
+		const writing = el?.isContentEditable || el?.closest?.('[contenteditable="true"]');
+		if (
+			(event.metaKey || event.ctrlKey) &&
+			(event.key === 'b' || event.key === 'B') &&
+			!writing
+		) {
 			event.preventDefault();
 			sidebar.toggle();
 			return;
@@ -166,6 +212,10 @@
 	<div class="booting"></div>
 {:else if standalone}
 	{@render children()}
+{:else if app.unreachable}
+	<!-- Ikke login-skærmen: en total udfald er ikke en udløbet session, og et
+	     kodeord hjælper ikke mod en manglende forbindelse. -->
+	<NoConnection />
 {:else if !app.user}
 	<SignIn />
 {:else}

web/src/routes/faerdige/+page.svelte

@@ -75,7 +75,7 @@
 	}
 </script>
 
-<svelte:head><title>{t('done.title')} — verdande</title></svelte:head>
+<svelte:head><title>{t('done.title')} — {app.productSlug}</title></svelte:head>
 
 <div class="view">
 	<header>

web/src/routes/gruppe/[id]/+page.svelte

@@ -126,7 +126,7 @@
 	}
 </script>
 
-<svelte:head><title>{group?.name ?? t('group.projects')} — verdande</title></svelte:head>
+<svelte:head><title>{group?.name ?? t('group.projects')} — {app.productSlug}</title></svelte:head>
 
 <div class="view">
 	{#if status === 'denied'}

web/src/routes/indstillinger/+page.svelte

@@ -379,7 +379,10 @@
 					<!-- Each card is written in the face it selects, because that is the
 					     only part of the choice a name cannot carry. -->
 					<span class="look-sample" data-look={option.id} aria-hidden="true">Aa</span>
-					<span class="theme-name">{t(option.name)}</span>
+					<!-- The product name is passed to every look, and only one of them has a
+					     place for it: the look named after the program. The other three
+					     carry no placeholder, so the parameter is ignored. -->
+					<span class="theme-name">{t(option.name, { product: app.productName })}</span>
 					<span class="theme-note">{t(option.note)}</span>
 				</button>
 			{/each}

web/src/routes/indstillinger/data/+page.svelte

@@ -141,6 +141,13 @@
 	let startDate = $state('');
 
 	$effect(() => {
+		// Skabeloner er projekt plus sektioner plus opgaver, så ruten findes ikke i
+		// noter-udgaven — og den her fangede fejlen i en toast, altså en synlig
+		// fejlbesked på indstillingssiden frem for en tom liste.
+		if (app.notesOnly) {
+			loadingTemplates = false;
+			return;
+		}
 		api
 			.listTemplates()
 			.then((r) => (templates = r.templates))
@@ -393,6 +400,8 @@
 		     do with a Content-Disposition, and the session cookie rides along. -->
 		<a class="link" href={api.exportAccountURL()} download>{t('data.exportAccount')}</a>
 		<a class="link" href={api.exportNotesURL()} download>{t('data.exportNotes')}</a>
+		<a class="link" href={api.exportAllCSVURL()} download>{t('data.exportAllCSV')}</a>
+		<a class="link" href={api.exportAllICSURL()} download>{t('data.exportAllICS')}</a>
 	</div>
 
 	<!-- The way back in, and from anywhere else: a folder of Markdown is what
@@ -410,6 +419,8 @@
 		<p class="hint">{t('data.importNotesHint')}</p>
 	</div>
 
+	<!-- Vælgeren bliver stående ved siden af "alle": den er stadig vejen til ét
+	     projekt, og det er en anden opgave end at flytte hele kontoen. -->
 	<div class="field">
 		<label for="export-project">{t('data.exportOne')}</label>
 		<select id="export-project" bind:value={exportProject}>

web/src/routes/indstillinger/integrationer/+page.svelte

@@ -296,7 +296,11 @@
 	let mailConfigured = $state(null);
 
 	$effect(() => {
-		api.feed().then((r) => (feedURL = r.url)).catch(() => {});
+		// Feedet er en kalender af opgaver, så adressen findes ikke i
+		// noter-udgaven.
+		if (!app.notesOnly) {
+			api.feed().then((r) => (feedURL = r.url)).catch(() => {});
+		}
 		api
 			.getMailAddress()
 			.then((r) => {

web/src/routes/indstillinger/notifikationer/+page.svelte

@@ -92,6 +92,8 @@
 	let planBusy = $state(false);
 
 	$effect(() => {
+		// Dagens plan er dagens opgaver.
+		if (app.notesOnly) return;
 		api
 			.planSettings()
 			.then((p) => (plan = p))

web/src/routes/invite/+page.svelte

@@ -12,8 +12,12 @@
 	 * and it reads the token out of the URL itself.
 	 */
 	import SignIn from '$lib/components/SignIn.svelte';
+	// Udgavens navn i titlen. Siden her tegner først, når layoutets `app.load()`
+	// har svaret, så udgaven er kendt — også uden en session, hvilket er hele
+	// pointen med den her rute.
+	import { app } from '$lib/stores.svelte.js';
 </script>
 
-<svelte:head><title>Invitation · verdande</title></svelte:head>
+<svelte:head><title>Invitation · {app.productSlug}</title></svelte:head>
 
 <SignIn />

web/src/routes/noter/+page.svelte

@@ -14,7 +14,8 @@
 	import { api, humanMessage } from '$lib/api.js';
 	import { app } from '$lib/stores.svelte.js';
 	import { page } from '$app/stores';
-	import { goto } from '$app/navigation';
+	import { onMount, untrack } from 'svelte';
+	import { afterNavigate, goto } from '$app/navigation';
 	import { t, tag } from '$lib/i18n.svelte.js';
 	import { NOTE, startDrag } from '$lib/dnd.js';
 	import { colorVar } from '$lib/colors.js';
@@ -483,23 +484,95 @@
 		load(query);
 	});
 
-	// Arriving from somewhere that names a note — a task's panel, a project's page —
-	// opens it rather than dropping the person on a list to find it again.
-	let asked = $derived($page.url.searchParams.get('note'));
+	/**
+	 * En søgning, man kommer med.
+	 *
+	 * ⌘K sender `?note=…&q=…`, så listen ved siden af den åbne note er de andre
+	 * træffere frem for den almindelige liste.
+	 *
+	 * Læst, aldrig skrevet. Den første udgave skrev også søgningen tilbage i
+	 * adressen ved hvert tastetryk, så den kunne gemmes og deles — og det kostede
+	 * bogstaver. `replaceState` opdaterer `$page.url` et øjeblik efter, den kaldes,
+	 * så to hurtige tastetryk gav en effekt, der læste den *forrige* adresse, fandt
+	 * den uenig med det skrevne, og skrev den gamle værdi tilbage i feltet. Man
+	 * skrev "verd", og der stod "nde". Målt på en skærmoptagelse, ikke gættet.
+	 *
+	 * En markør, der skal holde to retninger enige, er en markør, der taber
+	 * kapløbet et sted. Adressen skrives derfor kun af navigation, og det her er
+	 * den eneste, der læser den.
+	 */
+	let cameWith = $state(null);
+
 	$effect(() => {
-		if (!asked || selectedId === asked) return;
-		const found = notes.find((n) => n.id === asked);
-		if (found) open(found);
-		else api.note(asked).then(open).catch(() => {});
+		const inURL = $page.url.searchParams.get('q') ?? '';
+		if (inURL === untrack(() => cameWith)) return;
+		cameWith = inURL;
+		draftQuery = inURL;
+		query = inURL;
 	});
 
+	/**
+	 * En note, man kommer MED — en besked fra klokken, et link fra en opgave, en
+	 * træffer i ⌘K. Den åbnes, så man ikke bliver sat af på en liste og skal finde
+	 * den igen.
+	 *
+	 * Bundet til selve navigationen og ikke til adressens indhold, og det er hele
+	 * pointen. Siden skriver aldrig adressen — det blev fjernet, fordi det kostede
+	 * bogstaver ud af søgefeltet — så `?note=` bliver stående på den, man kom med,
+	 * uanset hvad man klikker bagefter. En effekt, der læste den igen, hver gang
+	 * noget ændrede sig, så derfor `selectedId` uenig med adressen og åbnede den
+	 * gamle igen: man kunne søge og ikke vælge, for hvert klik på en anden række
+	 * sprang tilbage til den første.
+	 *
+	 * En adresse, der ikke følger med, er ikke en tilstand at holde sig enig med.
+	 * Den er en besked, der kommer én gang — så den læses ved ankomsten frem for
+	 * ved hver ændring.
+	 */
+	function openFromURL(url) {
+		const id = url?.searchParams.get('note');
+		if (!id || id === selectedId) return;
+		const found = notes.find((n) => n.id === id);
+		if (found) open(found);
+		else api.note(id).then(open).catch(() => {});
+	}
+
+	// To veje ind, fordi der er to måder at ankomme på, og hver af dem er blind for
+	// den anden.
+	//
+	// `afterNavigate` alene rækker ikke: layoutet tegner ingenting, mens kontoen
+	// hentes, så den her side bliver monteret EFTER den første navigation er forbi.
+	// En lytter, der registreres der, hører den aldrig — `/noter?note=<id>` tastet
+	// eller fulgt udefra åbnede så ingenting.
+	//
+	// Og `onMount` alene rækker heller ikke: går man til en anden note inde i
+	// programmet, monteres siden ikke om.
+	onMount(() => openFromURL($page.url));
+	afterNavigate((nav) => openFromURL(nav?.to?.url ?? $page.url));
+
+	/**
+	 * Hvilken hentning der gælder.
+	 *
+	 * To søgninger kan være undervejs på én gang, og den langsomste kan lande
+	 * sidst. Uden det her betød det, at listen viste svaret på et spørgsmål, der
+	 * ikke længere blev stillet — på optagelsen stod resultaterne for "verdande" i
+	 * listen, efter feltet var tømt. Pausen på 250 ms gjorde det sjældnere og kunne
+	 * ikke gøre det umuligt.
+	 */
+	let newest = 0;
+
 	async function load(q) {
+		const mine = ++newest;
 		try {
 			const params = q ? { q } : showArchive ? { archived: '1' } : {};
-			notes = (await api.notes(params)).notes ?? [];
+			const got = (await api.notes(params)).notes ?? [];
+			// Et svar, der er blevet overhalet, kastes væk. Det er ikke forkert —
+			// det er bare ikke længere svaret på det, der blev spurgt om.
+			if (mine !== newest) return;
+			notes = got;
 			status = 'ready';
 			if (selectedId && !notes.some((n) => n.id === selectedId)) open(notes[0] ?? null);
 		} catch (e) {
+			if (mine !== newest) return;
 			status = 'failed';
 			app.toast(humanMessage(e));
 		}
@@ -516,7 +589,17 @@
 	 * Derfor hentes den hele her. Rækken vises med det samme, så det ikke føles som
 	 * at vente; teksten kommer, når den er der.
 	 */
-	async function open(note) {
+	/**
+	 * `whole` siger, at noten allerede er hel, og at der ikke skal hentes.
+	 *
+	 * En tom krop bruges ellers som tegn på, at det her er en listerække — serveren
+	 * tømmer `body` på dem med vilje. Men en *nyoprettet* note er også tom, og den
+	 * er hel. Uden det her blev den lukket ud som en halv note: editoren blev pillet
+	 * af skærmen, noten hentet igen, og editoren sat op på ny. I det hul står
+	 * `selected` som null, og `save()` går tavst tilbage uden at gemme — så tekst
+	 * skrevet der forsvandt sporløst.
+	 */
+	async function open(note, { whole = false } = {}) {
 		clearTimeout(timer);
 		if (!note) {
 			selectedId = null;
@@ -532,9 +615,9 @@
 		// id'et være det samme begge gange, så den anden aldrig blev vist. Man ville
 		// sidde med en tom note, der lige havde haft en titel.
 		selectedId = note.id;
-		if (note.body) {
+		if (whole || note.body) {
 			selected = note;
-			draft = note.body;
+			draft = note.body ?? '';
 			return;
 		}
 		selected = null;
@@ -646,7 +729,8 @@
 		try {
 			const note = await api.createNote({ body: '' });
 			notes = [note, ...notes];
-			open(note);
+			// Svaret er hele noten, så den skal ikke hentes igen — se open().
+			await open(note, { whole: true });
 			document.querySelector('.editor textarea')?.focus();
 		} catch (e) {
 			app.toast(humanMessage(e));
@@ -849,7 +933,7 @@
 
 </script>
 
-<svelte:head><title>{t('notes.title')} · verdande</title></svelte:head>
+<svelte:head><title>{t('notes.title')} · {app.productSlug}</title></svelte:head>
 
 <svelte:window
 	onclick={onShareOutside}

web/src/routes/projekt/[id]/+page.svelte

@@ -88,9 +88,14 @@
 		if (!projectId) return;
 		status = 'loading';
 		try {
+			// Sektioner findes ikke i noter-udgaven, hvor et projekt er en notesbog
+			// — og det er ikke bare støj: Promise.all kaster på den første, der
+			// fejler, så en 404 herfra satte status = 'failed', og siden viste en
+			// fejlskærm frem for notesbogens noter. `loadTasks` vogter sig selv i
+			// butikken, fordi den har tre kaldesteder her.
 			const [p, s] = await Promise.all([
 				api.getProject(projectId),
-				api.listSections(projectId),
+				app.notesOnly ? Promise.resolve({ sections: [] }) : api.listSections(projectId),
 				app.loadTasks({ project_id: projectId })
 			]);
 			project = p;

web/src/routes/reset/+page.svelte

@@ -8,8 +8,12 @@
 	 * fill in. Same shape as the invite link, and found the same way.
 	 */
 	import SignIn from '$lib/components/SignIn.svelte';
+	// Udgavens navn i titlen. Siden her tegner først, når layoutets `app.load()`
+	// har svaret, så udgaven er kendt — også uden en session, hvilket er hele
+	// pointen med den her rute.
+	import { app } from '$lib/stores.svelte.js';
 </script>
 
-<svelte:head><title>Ny adgangskode · verdande</title></svelte:head>
+<svelte:head><title>Ny adgangskode · {app.productSlug}</title></svelte:head>
 
 <SignIn />