docs(site): show all six themes, and put the demo line in English

Adds a gallery of the same Today view in each of the six themes — Northern lights,
Charcoal, Dusk, Daylight, Paper, Contrast — so the range is shown rather than
described, on the landing page and (as the swatch panel) the docs home. The lone
Charcoal Today capture is folded into it.

And the quick-add demo that leads the docs — "betal moms i morgen kl 10 p1 #Firma
@regnskab" — is now English, "file the VAT return tomorrow at 10am p1 #Accounts
@tax", on every page it appears as the line to type: the home, the quick-add page,
the API and MCP examples, and the OpenAPI blurb. The Danish date words on the
quick-add page stay, because documenting the Danish parser is their job.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -24,9 +24,10 @@ Documentation: [`docs/`](docs/), built with Material for MkDocs.
 
 ## Why this exists
 
-Todoist Pro, self-hosted, on your own hardware, with your own data — and with the
-integrations that a hosted product will not build for you: a real CalDAV server, a
-mail-to-task address, and an MCP endpoint so Claude can work your task list directly.
+A fast, self-hosted task manager — projects, quick add, filters, notes and shared
+lists — on your own hardware, with your own data, and with the integrations that a
+hosted product will not build for you: a real CalDAV server, a mail-to-task address,
+and an MCP endpoint so Claude can work your task list directly.
 
 ## What it does
 
@@ -102,7 +103,7 @@ Apple Reminders, forward mail into it, and add it to Claude as a connector.
 | CalDAV server (two-way VTODO) | Done, tested |
 | Mail-to-task | Done, tested |
 | AI layer (Anthropic/OpenAI/Google/local) | Built, degrades when unconfigured |
-| Gmail: OAuth2 with PKCE, polling, one-way to tasks | Done, tested |
+| Gmail: OAuth2 with PKCE, polling to tasks, unstars what it imports | Done, tested |
 | Google Calendar: read-only, laid over the task calendar | Built, never run against Google |
 | Calendar subscriptions: ICS and webcal, several per person | Done, tested |
 | Times on tasks, set by dragging in the week grid | Done, tested |

cmd/verdande/main.go

@@ -80,6 +80,16 @@ func run() error {
 		log.Info("notes sealed", "count", sealed)
 	}
 
+	// Names created before the app capitalised them on the way in — "andreas"
+	// rather than "Andreas". Idempotent, so it is a cheap pass of names once it has
+	// caught up. A failure here does not stop the start: a lower-case first name is
+	// a blemish, not a broken instance.
+	if fixed, err := db.NormalizeUserNames(context.Background()); err != nil {
+		log.Error("normalize user names", "err", err)
+	} else if fixed > 0 {
+		log.Info("user names normalized", "count", fixed)
+	}
+
 	httpapi.Version = version
 	api := httpapi.New(cfg, db, log, webAssets(log))
 

docs/api.md

@@ -85,7 +85,7 @@ what a person reads is decided by the client, which knows what language they are
 curl -X POST https://todo.example.dk/api/v1/tasks/quick-add \
   -H "Authorization: Bearer vrd_..." \
   -H "Content-Type: application/json" \
-  -d '{"text": "betal moms i morgen kl 10 p1 #Firma @regnskab"}'
+  -d '{"text": "file the VAT return tomorrow at 10am p1 #Accounts @tax"}'
 ```
 
 ### Projects and sections

docs/configuration.md

@@ -12,6 +12,25 @@ nowhere to put one that the operator would ever see.
 | `VERDANDE_DATA_DIR` | `/data` | Database, uploaded files and backups. |
 | `VERDANDE_DEV` | `false` | Human-readable logs at debug level, and a relaxed origin check so a Vite dev server can connect. Never in production. |
 
+## Behind a proxy
+
+verdande keys its login rate limit and its audit log on the caller's address, so
+that address has to be one the caller cannot forge. A forwarded-for header is
+believed only when the machine that connected is a trusted proxy; a connection
+straight off the internet is keyed on the address it really came from.
+
+| Variable | Default | What it does |
+|---|---|---|
+| `VERDANDE_TRUSTED_PROXIES` | private networks | Whose `X-Forwarded-For` to believe, as comma-separated CIDRs. The default trusts loopback and the private ranges — the shape of a reverse proxy or tunnel sharing the host or the docker bridge. Set to `none` for an instance exposed directly with no proxy, so no forwarded header is ever believed. |
+| `VERDANDE_REAL_IP_HEADER` | `X-Forwarded-For` | The header the client address is read from, for a trusted proxy. |
+
+!!! warning "A proxy that does not overwrite the header"
+    The default is safe when your proxy replaces a client-supplied
+    `X-Forwarded-For` with the real address — nginx, Caddy and Cloudflare Tunnel all
+    do. If yours passes the client's own header through, narrow
+    `VERDANDE_TRUSTED_PROXIES` to just your proxy's address so a visitor cannot
+    choose the address they are rate-limited and logged as.
+
 ## Sessions and links
 
 | Variable | Default | What it does |
@@ -55,7 +74,7 @@ Then enable the APIs and scopes for whichever you want:
 
 | For | Enable | Scope |
 |---|---|---|
-| Mailboxes | Gmail API | `gmail.readonly` |
+| Mailboxes | Gmail API | `gmail.modify` |
 | Calendar | Google Calendar API | `calendar.readonly` |
 
 | Variable | What it does |

docs/filters.md

@@ -1,7 +1,7 @@
 # Saved filters
 
-A filter is a small expression describing a slice of your tasks. The grammar is
-Todoist's, so if you are coming from there you already know it.
+A filter is a small expression describing a slice of your tasks. The grammar will
+feel familiar if you have used query-based filters in other task apps.
 
 ```
 today & p1

docs/index.md

@@ -11,28 +11,46 @@ of. Which is what a to-do list is.
 
 ## What it is for
 
-Todoist Pro, on your own hardware, with your own data. And with the integrations a
+A fast, self-hosted task manager — projects, quick add, filters, notes and shared
+lists — on your own hardware, with your own data. And with the integrations a
 hosted product will not build for you: a real CalDAV server, an address you can
 forward mail to, and an MCP endpoint so Claude can work your task list directly.
 
 ## What it does
 
-- **[Quick add](quick-add.md) that reads what you type.** `betal moms i morgen kl
-  10 p1 #Firma @regnskab` becomes a task due tomorrow at 10:00, priority 1, in
-  Firma, labelled regnskab. Danish and English, mixed freely in one line.
+- **[Quick add](quick-add.md) that reads what you type.** `file the VAT return
+  tomorrow at 10am p1 #Accounts @tax` becomes a task due tomorrow at 10:00,
+  priority 1, in Accounts, labelled tax. Danish and English, mixed freely in one
+  line.
 - **Projects, sections, sub-tasks, labels, [saved filters](filters.md).** List,
   board and calendar views, and foldable groups over the projects in the sidebar.
-- **Notes, beside the work.** Rich text to write in, Markdown on disk. A note is
-  shared by filing it in a project; `#project` and `[[another note]]` are links,
-  and a task shows what has been written about it.
+  The calendar draws each task to its length — drag the foot to resize, the body
+  to move it.
+- **Notes, beside the work.** Rich text to write in, Markdown on disk. Share a
+  single note with a person, or file it in a project; `#project` and
+  `[[another note]]` are links, and a task shows what has been written about it.
+- **Delegate, and snooze.** Hand a task to somebody and it is marked with an
+  arrow to them, gathered on a *Waiting on others* page. Snooze one to park it,
+  greyed, at the foot of the list until a moment you pick — without touching when
+  it is due.
 - **Drag where it means something** — reorder a list or a board, file a project
   under a group, drop a task on another project, or drop it on another day.
 - **Sharing** with owner, editor and viewer roles. Anyone outside your instance
   joins through an invite link.
 - **Live sync** — a change made by somebody else appears without a refresh.
-- **Repeating tasks** as RRULE, reminders, comments and attachments.
-- **[Calendar](caldav.md), [mail](mail.md) and [Claude](mcp.md)** connected over
-  open standards rather than private formats.
+- **Repeating tasks** as RRULE, comments and attachments, and reminders that go
+  out as Web Push to an iPhone or a Mac.
+- **[Your mail as an inbox](mailboxes.md).** Star a mail in Gmail, or flag one
+  over IMAP in iCloud or Fastmail, and it becomes a task — and the star or flag
+  comes off once it has, so a starred inbox empties as the tasks are made instead
+  of only filling up.
+- **[Calendar](caldav.md) and [Claude](mcp.md)** connected over open standards
+  rather than private formats.
+- **Six themes**, three dark and three light — including *Charcoal*, a warm
+  near-black after Apple Notes — and a size and typeface chosen apart from them.
+- **Holds through a short network drop.** A save rides out a few seconds of no
+  signal and goes through when it comes back; a reload opens from what it last saw
+  rather than the browser's offline page. It installs as a PWA.
 
 ## What it looks like
 
@@ -48,7 +66,19 @@ columns.*
 
 ![Waiting on others](screenshots/delegated.png)
 
-*What you have handed to somebody else, grouped by whoever has it.*
+*What you have handed to somebody else, grouped by whoever has it — and each row
+marked with an arrow to them, so a delegated task reads as delegated wherever you
+meet it.*
+
+![Notes in the Charcoal theme](screenshots/notes-charcoal.png)
+
+*Charcoal, the newest of six themes — a warm near-black after Apple Notes, with
+amber where the accent green usually is.*
+
+![The six themes as swatches](screenshots/themes.png)
+
+*Six themes — three dark, three light — chosen on the settings page, with the
+typeface and how tightly it sits set apart from them.*
 
 ![Settings, integrations](screenshots/settings.png)
 

docs/mcp.md

@@ -57,9 +57,9 @@ Both endpoints run the same server and reach the same things.
 | `complete_task` | Tick one off. |
 | `add_comment` | Comment on a task. |
 
-`create_task` prefers natural language, so *"add betal moms i morgen kl 10 p1
-#Firma"* goes through the same parser the app uses — dates, priorities, projects,
-labels and recurrence in either language.
+`create_task` prefers natural language, so *"add file the VAT return tomorrow at
+10am p1 #Accounts"* goes through the same parser the app uses — dates, priorities,
+projects, labels and recurrence in either language.
 
 ## What it can reach
 

docs/openapi.yaml

@@ -805,14 +805,36 @@ paths:
         "200": { $ref: "#/components/responses/Task" }
         "404": { $ref: "#/components/responses/NotFound" }
 
+  /api/v1/tasks/{taskID}/snooze:
+    parameters:
+      - { name: taskID, in: path, required: true, schema: { type: string } }
+    post:
+      tags: [tasks]
+      summary: Snooze a task until a time, or wake it.
+      description: |
+        Parks the task at the bottom of its list, greyed, until `until` passes —
+        nothing else about it moves. An empty `until` wakes it now.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                until: { type: string, format: date-time, description: "RFC3339; empty to wake." }
+      responses:
+        "200": { $ref: "#/components/responses/Task" }
+        "404": { $ref: "#/components/responses/NotFound" }
+        "422": { $ref: "#/components/responses/Validation" }
+
   /api/v1/tasks/quick-add:
     post:
       tags: [tasks]
       summary: Create a task from one line of natural language.
       description: |
-        Danish and English. `betal moms i morgen kl 10 p1 #Firma @vigtigt` becomes
-        a task due tomorrow at 10:00, priority 1, in the project Firma, labelled
-        vigtigt. An unknown `#project` is not an error — the task goes to the
+        Danish and English. `file the VAT return tomorrow at 10am p1 #Accounts @tax`
+        becomes a task due tomorrow at 10:00, priority 1, in the project Accounts,
+        labelled tax. An unknown `#project` is not an error — the task goes to the
         Inbox rather than a thought being thrown away over a typo.
       requestBody:
         required: true
@@ -1228,7 +1250,7 @@ paths:
 
         The one click that opens Google's consent screen already exists. What it
         needs behind it is a registered client, and no app can conjure one: Google
-        issues no Gmail access to an unregistered client, and `gmail.readonly` is a
+        issues no Gmail access to an unregistered client, and `gmail.modify` is a
         restricted scope, so an id shipped inside a public image would be both
         extractable from it and unusable without Google's security review of every
         deployment that used it.
@@ -3072,6 +3094,69 @@ paths:
         "204": { description: Deleted }
         "404": { $ref: "#/components/responses/NotFound" }
 
+  /api/v1/notes/{noteID}/shares:
+    parameters:
+      - name: noteID
+        in: path
+        required: true
+        schema: { type: string }
+    get:
+      tags: [notes]
+      summary: Who a note is shared with, and who it can be shared with.
+      description: >
+        Owner only. Returns the people the note is already shared with, each with
+        their role, and the candidates the owner may add — everyone on the instance
+        who is not already on the note.
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  shares:
+                    type: array
+                    items: { $ref: "#/components/schemas/NoteShare" }
+                  candidates:
+                    type: array
+                    items: { $ref: "#/components/schemas/Person" }
+        "404": { $ref: "#/components/responses/NotFound" }
+    post:
+      tags: [notes]
+      summary: Share a note with a person, or change the role they hold.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [user_id]
+              properties:
+                user_id: { type: string }
+                role: { type: string, enum: [viewer, editor] }
+      responses:
+        "204": { description: Shared }
+        "404": { $ref: "#/components/responses/NotFound" }
+        "422": { $ref: "#/components/responses/Validation" }
+
+  /api/v1/notes/{noteID}/shares/{userID}:
+    delete:
+      tags: [notes]
+      summary: Take a person's access to a note away again.
+      parameters:
+        - name: noteID
+          in: path
+          required: true
+          schema: { type: string }
+        - name: userID
+          in: path
+          required: true
+          schema: { type: string }
+      responses:
+        "204": { description: Unshared }
+        "404": { $ref: "#/components/responses/NotFound" }
+
   /api/v1/notes/linking/{kind}/{targetID}:
     get:
       tags: [notes]
@@ -3907,6 +3992,14 @@ components:
         pinned: { type: boolean }
         created_at: { type: string, format: date-time }
         updated_at: { type: string, format: date-time }
+        shared_with_me:
+          type: boolean
+          description: >
+            True when the reader reached this note through a direct share rather
+            than by owning it or its project. What puts it in the Delt med mig group.
+        owner:
+          allOf: [{ $ref: "#/components/schemas/Person" }]
+          description: Who the note belongs to, present on a note shared with the reader.
         links:
           type: array
           description: What the body points at, read out of the text on the way in.
@@ -3923,6 +4016,21 @@ components:
         body: { type: string, description: "Markdown. Its first line becomes the title." }
         pinned: { type: boolean }
 
+    Person:
+      type: object
+      description: A user, as much of one as a name and a colour.
+      properties:
+        id: { type: string }
+        name: { type: string }
+        avatar_color: { type: string }
+
+    NoteShare:
+      type: object
+      description: One person's direct grant on a note.
+      properties:
+        user: { $ref: "#/components/schemas/Person" }
+        role: { type: string, enum: [viewer, editor] }
+
     Mailbox:
       type: object
       description: One connected mailbox. The password and any token are never returned.

docs/quick-add.md

@@ -3,11 +3,11 @@
 One line in, a fully-formed task out.
 
 ```
-betal moms i morgen kl 10 p1 #Firma @regnskab
+file the VAT return tomorrow at 10am p1 #Accounts @tax
 ```
 
-becomes a task called **betal moms**, due tomorrow at 10:00, priority 1, in the
-Firma project, labelled regnskab.
+becomes a task called **file the VAT return**, due tomorrow at 10:00, priority 1,
+in the Accounts project, labelled tax.
 
 The parts it understands are tinted underneath the text as you type, so you can see
 it being read before you commit to it.
@@ -16,8 +16,8 @@ it being read before you commit to it.
 
 | You type | It means |
 |---|---|
-| `#Firma` | Put it in that project. `#"Q3 rapport"` for a name with spaces. |
-| `@regnskab` | Add that label. As many as you like. |
+| `#Accounts` | Put it in that project. `#"Q3 report"` for a name with spaces. |
+| `@tax` | Add that label. As many as you like. |
 | `p1` … `p4` | Priority. `!!!`, `!!` and `!` also work. |
 | `i dag`, `i morgen`, `i overmorgen` | Today, tomorrow, the day after. |
 | `mandag`, `på fredag` | The next such weekday. |

docs/self-hosting.md

@@ -1,7 +1,8 @@
-# Self-hosting
+# With Docker
 
-verdande is one static binary and one directory. There is no database server, no
-cache, no queue and no second process.
+Running it yourself outside a panel: one static binary and one directory. There is
+no database server, no cache, no queue and no second process. (Yggdrasil is
+self-hosting too — for that route see [As a Rune](rune.md).)
 
 ## Docker
 

go.mod

@@ -3,8 +3,10 @@ module github.com/kristianwind/verdande
 go 1.26.3
 
 require (
+	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc
 	github.com/coder/websocket v1.8.15
 	github.com/emersion/go-imap/v2 v2.0.0-beta.8
+	github.com/emersion/go-message v0.18.2
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/go-webauthn/webauthn v0.17.4
 	github.com/pquerna/otp v1.5.0
@@ -14,9 +16,7 @@ require (
 )
 
 require (
-	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/emersion/go-message v0.18.2 // indirect
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect

internal/auth/auth_test.go

@@ -265,6 +265,39 @@ func TestRecoveryCodes(t *testing.T) {
 	}
 }
 
+// TOTPStep returns the step a code matched, and it must be the same step across
+// the tolerance window — that number is what makes a code single-use, so a code
+// entered a little early or late has to spend the same step, not a new one.
+func TestTOTPStepIsStableAcrossTheWindow(t *testing.T) {
+	secret, _, err := NewTOTPSecret("verdande", "k@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Date(2026, 3, 10, 10, 0, 15, 0, time.UTC)
+	code := codeAt(t, secret, now)
+
+	want, err := TOTPStep(secret, code, now)
+	if err != nil {
+		t.Fatalf("the current code did not match: %v", err)
+	}
+	// Verified one step late — the code is still valid, and must report the step it
+	// was issued at, not the step it was checked at.
+	got, err := TOTPStep(secret, code, now.Add(30*time.Second))
+	if err != nil {
+		t.Fatalf("code rejected one step late: %v", err)
+	}
+	if got != want {
+		t.Errorf("same code reported step %d then %d; a replay check keyed on that would not catch it", want, got)
+	}
+
+	if _, err := TOTPStep(secret, "000000", now); err == nil {
+		t.Error("a wrong code returned a step")
+	}
+	if _, err := TOTPStep("", code, now); err != ErrNoTOTPSecret {
+		t.Errorf("empty secret: %v, want ErrNoTOTPSecret", err)
+	}
+}
+
 // codeAt produces the code an authenticator app would display at that moment,
 // using the same settings VerifyTOTP checks against.
 func codeAt(t *testing.T, secret string, now time.Time) string {

internal/auth/totp.go

@@ -2,6 +2,7 @@ package auth
 
 import (
 	"crypto/rand"
+	"crypto/subtle"
 	"encoding/base32"
 	"errors"
 	"fmt"
@@ -9,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/boombuler/barcode/qr"
 	"github.com/pquerna/otp"
 	"github.com/pquerna/otp/totp"
 )
@@ -49,6 +51,41 @@ func NewTOTPSecret(issuer, account string) (secret, uri string, err error) {
 	return key.Secret(), key.URL(), nil
 }
 
+// TOTPQRSVG renders the otpauth:// URI as a QR code, as an SVG a phone camera can
+// read. SVG rather than a PNG data URI so it stays crisp at any size and adds no
+// base64 blob to the page — one dark path on a white square, which is what a scanner
+// needs whatever theme the page is in.
+//
+// The barcode encoder is already in the module graph (pquerna/otp draws on it), so
+// this borrows a dependency rather than adding one.
+func TOTPQRSVG(uri string) (string, error) {
+	code, err := qr.Encode(uri, qr.M, qr.Auto)
+	if err != nil {
+		return "", fmt.Errorf("auth: encode totp qr: %w", err)
+	}
+	b := code.Bounds()
+	n := b.Dx()
+	// A four-module quiet zone all round, which the spec requires and scanners rely
+	// on — without it the code runs to the edge and a reader cannot find its border.
+	const quiet = 4
+	size := n + quiet*2
+
+	var sb strings.Builder
+	fmt.Fprintf(&sb, `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 %d %d" shape-rendering="crispEdges">`, size, size)
+	sb.WriteString(`<rect width="100%" height="100%" fill="#ffffff"/><path fill="#111312" d="`)
+	for y := 0; y < n; y++ {
+		for x := 0; x < n; x++ {
+			// Dark modules are black; the red channel is 0 for those and full for the
+			// light ones. One 1×1 rect per dark module, merged into a single path.
+			if r, _, _, _ := code.At(b.Min.X+x, b.Min.Y+y).RGBA(); r == 0 {
+				fmt.Fprintf(&sb, "M%d %dh1v1h-1z", x+quiet, y+quiet)
+			}
+		}
+	}
+	sb.WriteString(`"/></svg>`)
+	return sb.String(), nil
+}
+
 // TOTPURI rebuilds the otpauth:// URI for an existing secret, for showing the QR
 // code again before enrolment is confirmed.
 func TOTPURI(secret, issuer, account string) string {
@@ -82,6 +119,40 @@ func VerifyTOTP(secret, code string, now time.Time) error {
 	return nil
 }
 
+// TOTPStep verifies a code and returns the counter of the step it matched, so the
+// caller can refuse to accept the same step twice.
+//
+// ValidateCustom answers only yes or no, and "yes" for a code inside the skew
+// window is not enough to stop a replay: a code seen in flight stays valid for the
+// rest of its period, and the fix is to record which step was spent and never
+// accept that step or an earlier one again. That needs the number, so this walks
+// the same window ValidateCustom would — one step either side — and reports the
+// counter of the match. The comparison is constant time for the same reason the
+// password check is: a code is a secret being checked against a computed value.
+func TOTPStep(secret, code string, now time.Time) (int64, error) {
+	if secret == "" {
+		return 0, ErrNoTOTPSecret
+	}
+	code = strings.ReplaceAll(strings.TrimSpace(code), " ", "")
+
+	for offset := -int64(totpSkew); offset <= int64(totpSkew); offset++ {
+		at := now.Add(time.Duration(offset) * totpPeriod * time.Second)
+		want, err := totp.GenerateCodeCustom(secret, at, totp.ValidateOpts{
+			Period:    totpPeriod,
+			Skew:      0,
+			Digits:    totpDigits,
+			Algorithm: otp.AlgorithmSHA1,
+		})
+		if err != nil {
+			return 0, ErrInvalidCode
+		}
+		if subtle.ConstantTimeCompare([]byte(want), []byte(code)) == 1 {
+			return at.Unix() / totpPeriod, nil
+		}
+	}
+	return 0, ErrInvalidCode
+}
+
 // NewRecoveryCodes returns single-use codes for someone who has lost their phone,
 // and the hashes to store. Without these, losing a device means losing the account,
 // and the only fix left is editing the database by hand.

internal/config/config.go

@@ -7,6 +7,7 @@ package config
 
 import (
 	"fmt"
+	"net/netip"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -80,6 +81,26 @@ type Config struct {
 	// TrashRetention is how long a soft-deleted task or project stays recoverable.
 	TrashRetention time.Duration
 
+	// TrustedProxies are the peers whose forwarded-for header may be believed.
+	//
+	// The rate limiter and the audit log key on the caller's address, and that
+	// address is only as honest as wherever it was read. Read it from a header that
+	// anybody can set, and an attacker rotates it to get a fresh guess-bucket for
+	// every request and to write someone else's IP into the log. So the header is
+	// believed only when the machine that *connected* is one of these — a reverse
+	// proxy or tunnel the operator put there — and ignored when the connection came
+	// straight off the internet.
+	//
+	// The default is "the peer is on a private network", which is exactly the shape
+	// of a homelab behind Caddy, nginx or a Cloudflare Tunnel: the proxy shares the
+	// host or the docker bridge, so its address is loopback or RFC1918. A directly
+	// exposed instance sees a public peer, trusts nothing, and keys on the real
+	// connection. Override with VERDANDE_TRUSTED_PROXIES (comma-separated CIDRs),
+	// or "none" to trust no proxy at all.
+	TrustedProxies []netip.Prefix
+	// RealIPHeader is where the client address is read from, for a trusted peer.
+	RealIPHeader string
+
 	Dev bool
 }
 
@@ -149,9 +170,70 @@ func Load() (*Config, error) {
 	if c.DataDir, err = filepath.Abs(c.DataDir); err != nil {
 		return nil, fmt.Errorf("VERDANDE_DATA_DIR: %w", err)
 	}
+
+	c.RealIPHeader = env("VERDANDE_REAL_IP_HEADER", "X-Forwarded-For")
+	if c.TrustedProxies, err = parseTrustedProxies(env("VERDANDE_TRUSTED_PROXIES", "")); err != nil {
+		return nil, err
+	}
 	return c, nil
 }
 
+// defaultTrustedProxies is "the peer is not on the public internet": loopback,
+// the three RFC1918 ranges, Tailscale's CGNAT borrow, IPv6 unique-local and both
+// families' link-local. A proxy an operator stands up in front of this server is
+// on one of these; a stranger connecting directly is on none.
+var defaultTrustedProxies = mustPrefixes(
+	"127.0.0.0/8", "::1/128",
+	"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
+	"100.64.0.0/10",
+	"fc00::/7",
+	"169.254.0.0/16", "fe80::/10",
+)
+
+// parseTrustedProxies reads the override. Empty keeps the private-network default;
+// the literal "none" trusts no proxy at all, for an instance that is exposed
+// directly and must never believe a forwarded header.
+func parseTrustedProxies(raw string) ([]netip.Prefix, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return defaultTrustedProxies, nil
+	}
+	if strings.EqualFold(raw, "none") {
+		return nil, nil
+	}
+	var out []netip.Prefix
+	for _, part := range strings.Split(raw, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+		// A bare address is a host route: 10.0.0.5 means 10.0.0.5/32, so an operator
+		// naming one proxy does not have to know CIDR notation to do it.
+		if !strings.Contains(part, "/") {
+			addr, err := netip.ParseAddr(part)
+			if err != nil {
+				return nil, fmt.Errorf("VERDANDE_TRUSTED_PROXIES: %q is not an address or CIDR", part)
+			}
+			out = append(out, netip.PrefixFrom(addr, addr.BitLen()))
+			continue
+		}
+		p, err := netip.ParsePrefix(part)
+		if err != nil {
+			return nil, fmt.Errorf("VERDANDE_TRUSTED_PROXIES: %q is not a CIDR", part)
+		}
+		out = append(out, p.Masked())
+	}
+	return out, nil
+}
+
+func mustPrefixes(cidrs ...string) []netip.Prefix {
+	out := make([]netip.Prefix, 0, len(cidrs))
+	for _, c := range cidrs {
+		out = append(out, netip.MustParsePrefix(c))
+	}
+	return out
+}
+
 // DBPath, FilesDir and BackupsDir are the three things that live on the /data volume.
 func (c *Config) DBPath() string     { return filepath.Join(c.DataDir, "verdande.db") }
 func (c *Config) FilesDir() string   { return filepath.Join(c.DataDir, "files") }

internal/gmail/gmail.go

@@ -1,14 +1,20 @@
 // Package gmail is the small slice of the Gmail API verdande needs, and the scope
 // it asks for.
 //
-// The connection is one-way on purpose: a starred or labelled message becomes a
-// task, and nothing verdande does afterwards touches the mailbox. Unstarring the
-// message does not delete the task, completing the task does not unstar the
-// message. Two-way would mean deciding what to do when both sides changed, and the
-// only honest answer to that is a synchronisation model far bigger than the feature.
+// The one thing verdande writes back is the star. A starred message becomes a
+// task, and once it has, the star comes off — exactly as the IMAP side takes the
+// flag off a mail it has imported, and for the same reason: the star meant "turn
+// this into a task", the task now exists, so the star is no longer true. Nothing
+// else is touched. Completing the task does not reach back to the mail; the mail
+// is a pointer the task was made from, not a copy the two have to be kept in step.
 //
-// Scope is gmail.readonly. verdande never needs to send, modify or delete, and
-// asking for less is what makes the consent screen something a person can agree to.
+// That one write is why the scope is gmail.modify rather than gmail.readonly.
+// Removing the STARRED label is a modify, and Gmail offers no narrower scope that
+// can do it — so the consent screen asks for more than it used to, and the trade
+// is deliberate: a starred inbox that empties itself as the tasks are made, rather
+// than one that fills with stars nothing ever clears. Still not send, still not
+// delete — modify is labels, and the only label verdande removes is the one that
+// triggered the task.
 //
 // The OAuth flow itself moved to internal/google when Calendar needed the same one.
 // The names below are aliases so that every call site — and this package's own
@@ -27,8 +33,10 @@ import (
 	"github.com/kristianwind/verdande/internal/google"
 )
 
-// Read-only, and only mail. Not profile, not contacts, not send.
-const Scope = "https://www.googleapis.com/auth/gmail.readonly"
+// Read mail and change its labels, and only mail. Not profile, not contacts, not
+// send, not delete. The single write is removing the STARRED label from a message
+// that has become a task; see the package comment for why that costs modify.
+const Scope = "https://www.googleapis.com/auth/gmail.modify"
 
 const defaultAPIBase = "https://gmail.googleapis.com/gmail/v1"
 
@@ -169,6 +177,25 @@ func (c *Client) get(ctx context.Context, url string, out any) error {
 	return google.Get(ctx, c.http, c.accessToken, url, out)
 }
 
+// Unstar takes the star off the given messages — one call for all of them, the way
+// the IMAP side unflags a batch, so a sweep that made ten tasks is one write and
+// not ten.
+//
+// STARRED is a system label whose id is its name, so no lookup is needed; a custom
+// label would need one, and verdande removes none. batchModify answers 204 with no
+// body on success. An empty list is a no-op, not a call: batchModify with no ids is
+// an error on Google's side and nothing worth making a round trip to hear.
+func (c *Client) Unstar(ctx context.Context, ids []string) error {
+	if len(ids) == 0 {
+		return nil
+	}
+	body := struct {
+		IDs            []string `json:"ids"`
+		RemoveLabelIDs []string `json:"removeLabelIds"`
+	}{IDs: ids, RemoveLabelIDs: []string{"STARRED"}}
+	return google.Post(ctx, c.http, c.accessToken, c.api()+"/users/me/messages/batchModify", body, nil)
+}
+
 // SenderName pulls "Anders Jensen" out of "Anders Jensen <anders@example.dk>",
 // falling back to the address when there is no display name.
 func SenderName(from string) string {

internal/gmail/gmail_test.go

@@ -1,16 +1,81 @@
 package gmail
 
 import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 )
 
 // The scope is the one thing verdande chooses about the connection, and it is the
 // one the person reads on the consent screen. The flow itself is exercised in
-// internal/google; what belongs here is that Gmail still asks for read-only mail.
-func TestTheScopeIsReadOnlyMail(t *testing.T) {
-	if !strings.HasSuffix(Scope, "gmail.readonly") {
-		t.Errorf("scope = %q; verdande never needs to send or modify", Scope)
+// internal/google; what belongs here is that Gmail asks for modify — read plus the
+// one write it makes, taking the star off an imported message — and nothing wider.
+func TestTheScopeIsModifyMail(t *testing.T) {
+	if !strings.HasSuffix(Scope, "gmail.modify") {
+		t.Errorf("scope = %q; want gmail.modify — read, plus removing the star", Scope)
+	}
+	// Modify is the ceiling. Send, or the full account, would be a different promise
+	// to the person on the consent screen than the one this feature needs.
+	for _, wider := range []string{"gmail.send", "mail.google.com", "gmail.settings"} {
+		if strings.Contains(Scope, wider) {
+			t.Errorf("scope = %q; must not include %q", Scope, wider)
+		}
+	}
+}
+
+// Unstar removes the star from a batch in one call, and it addresses the messages
+// it was given and only the STARRED label.
+func TestUnstarRemovesOnlyTheStar(t *testing.T) {
+	var gotPath string
+	var gotBody struct {
+		IDs            []string `json:"ids"`
+		AddLabelIDs    []string `json:"addLabelIds"`
+		RemoveLabelIDs []string `json:"removeLabelIds"`
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		raw, _ := io.ReadAll(r.Body)
+		_ = json.Unmarshal(raw, &gotBody)
+		w.WriteHeader(http.StatusNoContent) // what batchModify answers on success
+	}))
+	defer srv.Close()
+
+	err := NewClient("token").At(srv.URL).Unstar(context.Background(), []string{"a", "b"})
+	if err != nil {
+		t.Fatalf("Unstar: %v", err)
+	}
+	if !strings.HasSuffix(gotPath, "/users/me/messages/batchModify") {
+		t.Errorf("path = %q, want the batchModify endpoint", gotPath)
+	}
+	if strings.Join(gotBody.IDs, ",") != "a,b" {
+		t.Errorf("ids = %v, want [a b]", gotBody.IDs)
+	}
+	if strings.Join(gotBody.RemoveLabelIDs, ",") != "STARRED" {
+		t.Errorf("removeLabelIds = %v, want [STARRED]", gotBody.RemoveLabelIDs)
+	}
+	if len(gotBody.AddLabelIDs) != 0 {
+		t.Errorf("addLabelIds = %v, want none — verdande adds no label", gotBody.AddLabelIDs)
+	}
+}
+
+// An empty batch is not a request: Gmail rejects a batchModify with no ids, and
+// there is nothing to say to it anyway.
+func TestUnstarOfNothingMakesNoCall(t *testing.T) {
+	called := false
+	srv := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+		called = true
+	}))
+	defer srv.Close()
+
+	if err := NewClient("token").At(srv.URL).Unstar(context.Background(), nil); err != nil {
+		t.Fatalf("Unstar(nil): %v", err)
+	}
+	if called {
+		t.Error("Unstar(nil) made a request; it should make none")
 	}
 }
 

internal/google/google.go

@@ -215,6 +215,40 @@ func Get(ctx context.Context, client *http.Client, accessToken, url string, out
 	return json.NewDecoder(resp.Body).Decode(out)
 }
 
+// Post sends a JSON body to a Google API and, unlike Get, does not insist on a
+// body coming back. A write call — modifying labels on a message — answers with
+// 204 No Content when it worked, so anything 2xx is success and only the body is
+// decoded, and only when the caller asked for one.
+func Post(ctx context.Context, client *http.Client, accessToken, url string, body, out any) error {
+	payload, err := json.Marshal(body)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, strings.NewReader(string(payload)))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+accessToken)
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusUnauthorized {
+		return ErrUnauthorized
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("google: %s", resp.Status)
+	}
+	if out == nil || resp.StatusCode == http.StatusNoContent {
+		return nil
+	}
+	return json.NewDecoder(resp.Body).Decode(out)
+}
+
 func randomString(n int) (string, error) {
 	b := make([]byte, n)
 	if _, err := rand.Read(b); err != nil {

internal/httpapi/auth_handlers.go

@@ -218,7 +218,24 @@ func (s *Server) handleLoginTOTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err := auth.VerifyTOTP(user.TOTPSecret, req.Code, time.Now())
+	step, err := auth.TOTPStep(user.TOTPSecret, req.Code, time.Now())
+	if err == nil {
+		// The code is right; now it must also be unused. A TOTP code stays valid for
+		// its whole window, so one observed in flight — a phishing page, a proxy,
+		// over the shoulder — could otherwise be replayed until it expires. Spending
+		// the step here makes it single-use: a second presentation of the same code,
+		// or an earlier one, finds the step already gone.
+		fresh, cerr := s.db.ConsumeTOTPStep(r.Context(), user.ID, step)
+		if cerr != nil {
+			s.internal(w, r, "consume totp step", cerr)
+			return
+		}
+		if !fresh {
+			writeError(w, http.StatusUnauthorized, CodeUnauthorized,
+				"that verification code has already been used")
+			return
+		}
+	}
 	if err != nil {
 		// A recovery code is accepted in the same field. Making somebody find a
 		// different form while locked out of their account is a poor time to

internal/httpapi/auth_test.go

@@ -372,6 +372,50 @@ func TestTOTPEnrolmentAndTwoStepLogin(t *testing.T) {
 	}
 }
 
+// A TOTP code works once. A code seen in flight and replayed inside its window
+// must be refused the second time, or the second factor is only as good as the
+// thirty seconds an attacker has to reuse what they captured.
+func TestTOTPCodeIsSingleUse(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, body := ts.do(t, "POST", "/api/v1/auth/totp/setup", map[string]string{
+		"password": "et langt kodeord",
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("totp setup: %d %v", resp.StatusCode, body)
+	}
+	secret, _ := body["secret"].(string)
+	resp, body = ts.do(t, "POST", "/api/v1/auth/totp/confirm", map[string]string{
+		"code": codeFor(t, secret),
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("totp confirm: %d %v", resp.StatusCode, body)
+	}
+
+	// One code, captured once and presented twice.
+	code := codeFor(t, secret)
+
+	ts.do(t, "POST", "/api/v1/auth/logout", nil)
+	ts.do(t, "POST", "/api/v1/auth/login", map[string]string{
+		"email": "kristian@example.dk", "password": "et langt kodeord",
+	})
+	resp, body = ts.do(t, "POST", "/api/v1/auth/login/totp", map[string]string{"code": code})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("first use of the code failed: %d %v", resp.StatusCode, body)
+	}
+
+	// A second login, same code, same window.
+	ts.do(t, "POST", "/api/v1/auth/logout", nil)
+	ts.do(t, "POST", "/api/v1/auth/login", map[string]string{
+		"email": "kristian@example.dk", "password": "et langt kodeord",
+	})
+	resp, body = ts.do(t, "POST", "/api/v1/auth/login/totp", map[string]string{"code": code})
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("the same code was accepted twice: %d %v", resp.StatusCode, body)
+	}
+}
+
 // A recovery code is accepted in the same field as a TOTP code, and works once.
 func TestRecoveryCodeCompletesLoginOnce(t *testing.T) {
 	ts := newTestServer(t)

internal/httpapi/csp_header_test.go

@@ -3,6 +3,8 @@ package httpapi
 import (
 	"strings"
 	"testing"
+
+	"github.com/kristianwind/verdande/internal/config"
 )
 
 // Politikken skal stå i svaret, og den skal stadig være stram.
@@ -50,6 +52,39 @@ func TestEveryResponseCarriesAStrictCSP(t *testing.T) {
 	}
 }
 
+// HSTS følger med, når instansen kører over HTTPS — og kun der.
+//
+// Sessionen bor i en __Host-cookie, der kun findes over TLS, så hele modellen
+// forudsætter allerede HTTPS. HSTS er det, der holder den forudsætning mod en
+// netværksangriber; men bedt om over ren HTTP ville den bede en browser om at
+// kræve et certifikat, en dev-instans ikke har. Begge halvdele skal stå prøven.
+func TestHSTSTracksHTTPS(t *testing.T) {
+	overHTTP := newTestServer(t) // BaseURL er http://localhost
+	resp, _ := overHTTP.do(t, "GET", "/api/v1/ping", nil)
+	if got := resp.Header.Get("Strict-Transport-Security"); got != "" {
+		t.Errorf("HSTS sat over ren HTTP: %q", got)
+	}
+
+	overHTTPS := newTestServerWith(t, func(c *config.Config) {
+		c.BaseURL = "https://todo.example.dk"
+	})
+	resp, _ = overHTTPS.do(t, "GET", "/api/v1/ping", nil)
+	if got := resp.Header.Get("Strict-Transport-Security"); got == "" {
+		t.Error("ingen HSTS over HTTPS")
+	} else if !strings.Contains(got, "includeSubDomains") {
+		t.Errorf("HSTS uden includeSubDomains: %q", got)
+	}
+	// Permissions-Policy står på hvert svar, uanset skema: den lukker for kamera,
+	// mikrofon og placering, som appen aldrig beder om.
+	if got := resp.Header.Get("Permissions-Policy"); !strings.Contains(got, "camera=()") {
+		t.Errorf("Permissions-Policy lukker ikke for kameraet: %q", got)
+	}
+	// COOP isolerer browserkonteksten og står på hvert svar.
+	if got := resp.Header.Get("Cross-Origin-Opener-Policy"); got != "same-origin" {
+		t.Errorf("Cross-Origin-Opener-Policy er ikke same-origin: %q", got)
+	}
+}
+
 // Et bilag må ikke kunne blive læst som et dokument.
 func TestAttachmentsAreNotServedAsDocuments(t *testing.T) {
 	for _, mime := range []string{"image/svg+xml", "text/html", "application/xhtml+xml", "text/xml"} {

internal/httpapi/gmail_handlers.go

@@ -251,10 +251,12 @@ func (s *Server) handleGmailSyncNow(w http.ResponseWriter, r *http.Request) {
 // takes a context and a user rather than a request.
 // maxGmailSeen bounds the list of message ids already turned into tasks.
 //
-// Gmail is read-only here — the scope is `gmail.readonly`, deliberately, because
-// asking for less is what makes the consent screen something a person can agree
-// to — so verdande cannot unstar a message the way the IMAP side unflags one. The
-// record has to live on this side, and a record on this side has to be bounded.
+// The star is taken off an imported message now, so on a starred trigger the mail
+// leaves the query on its own and this list is a safety net rather than the only
+// record. It still earns its place: it covers the window between making the task
+// and the star coming off, and it is the whole of the dedup for a label trigger,
+// where the label is the person's and not ours to remove. A record on this side
+// has to be bounded.
 //
 // A count rather than the previous rule of "whatever Gmail returned this run",
 // which was not a bound but a way of forgetting.
@@ -381,6 +383,29 @@ func (s *Server) SyncGmail(ctx context.Context, user *store.User) (int, error) {
 		s.hub.Publish(projectID, "task.created", toTaskJSON(*task))
 	}
 
+	// The star comes off every message this query returned that now has a task —
+	// the ones made this run and the ones a run before it already made. Gated to the
+	// triggers that are about the star: for a label trigger the star is the person's
+	// own and not ours to touch, and dedup there rests on the seen list alone.
+	//
+	// Best effort, exactly like the IMAP unflag: a task made is not undone by a star
+	// that would not come off. The likeliest reason it will not, right after this
+	// ships, is a connection still holding the old read-only grant — the write is a
+	// 403 until the account is reconnected, and this logs it rather than failing the
+	// sync. It self-heals: the mail stays starred, stays in the next query, and is
+	// tried again once the grant is there.
+	if box.Trigger == "starred" || box.Trigger == "both" {
+		unstar := make([]string, 0, len(ids))
+		for _, id := range ids {
+			if seen[id] {
+				unstar = append(unstar, id)
+			}
+		}
+		if err := client.Unstar(ctx, unstar); err != nil {
+			s.log.Warn("gmail unstar", "err", err, "user", user.ID, "count", len(unstar))
+		}
+	}
+
 	if created > 0 {
 		// The ids this run saw, on top of the ones already known.
 		//
@@ -442,8 +467,8 @@ func (s *Server) handleVersion(w http.ResponseWriter, r *http.Request) {
 //
 // The one click that opens Google's consent screen already exists; what it needs
 // behind it is a registered client, and that is not something any app can conjure:
-// Google issues no Gmail access to an unregistered client, and `gmail.readonly` is
-// a restricted scope, so an id shipped inside a public image would be both
+// Google issues no Gmail access to an unregistered client, and `gmail.modify` is a
+// restricted scope, so an id shipped inside a public image would be both
 // extractable from it and unusable without Google's security review of every
 // deployment. The registration is a one-off. Having to edit a Rune's manifest and
 // recreate the container to paste the result was not.

internal/httpapi/gmail_test.go

@@ -1,14 +1,17 @@
 package httpapi
 
 import (
-	"github.com/kristianwind/verdande/internal/store"
+	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/kristianwind/verdande/internal/config"
+	"github.com/kristianwind/verdande/internal/store"
 )
 
 // A Gmail failure has to survive being reported.
@@ -150,6 +153,84 @@ func TestASlowMailboxDoesNotHangTheRequest(t *testing.T) {
 	t.Logf("came back in %s with %d", took.Round(time.Millisecond), resp.StatusCode)
 }
 
+// A message that becomes a task has its star taken off — the write that the whole
+// gmail.modify scope is for. The mail's own inbox empties as the tasks are made,
+// the way the IMAP side unflags what it imports.
+func TestASyncedGmailMessageIsUnstarred(t *testing.T) {
+	var unstarred struct {
+		hit  bool
+		body struct {
+			IDs            []string `json:"ids"`
+			RemoveLabelIDs []string `json:"removeLabelIds"`
+		}
+	}
+	google := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == "POST" && strings.HasSuffix(r.URL.Path, "/messages/batchModify"):
+			unstarred.hit = true
+			raw, _ := io.ReadAll(r.Body)
+			_ = json.Unmarshal(raw, &unstarred.body)
+			w.WriteHeader(http.StatusNoContent)
+		case strings.Contains(r.URL.Path, "/messages/") && r.URL.Query().Get("format") == "metadata":
+			writeTestJSON(w, map[string]any{
+				"id": "m1", "threadId": "t1", "snippet": "kort tekst",
+				"payload": map[string]any{"headers": []map[string]string{
+					{"name": "From", "value": "Anders <anders@example.dk>"},
+					{"name": "Subject", "value": "Møde på fredag"},
+				}},
+			})
+		case strings.HasSuffix(r.URL.Path, "/messages"):
+			writeTestJSON(w, map[string]any{"messages": []map[string]string{{"id": "m1"}}})
+		default:
+			http.Error(w, "unexpected "+r.Method+" "+r.URL.Path, http.StatusNotFound)
+		}
+	}))
+	defer google.Close()
+
+	ts := newTestServerWith(t, func(cfg *config.Config) {
+		cfg.GmailClientID = "test-client"
+		cfg.GmailClientSecret = "test-secret"
+		cfg.GoogleTokenURL = google.URL + "/token"
+		cfg.GmailAPIURL = google.URL
+	})
+	ts.bootstrap(t)
+
+	user, err := ts.db.UserByEmail(t.Context(), "kristian@example.dk")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A live access token, so the run goes straight to the list without a refresh.
+	if err := ts.db.SaveMailbox(t.Context(), &store.Mailbox{
+		UserID: user.ID, Kind: "gmail", RefreshToken: "r", AccessToken: "a",
+		Trigger: "starred", ExpiresAt: time.Now().Add(time.Hour),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	resp, body := ts.do(t, "POST", "/api/v1/gmail/sync", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("sync: status %d, want 200", resp.StatusCode)
+	}
+	if created, _ := body["created"].(float64); created != 1 {
+		t.Fatalf("created = %v, want 1", body["created"])
+	}
+
+	if !unstarred.hit {
+		t.Fatal("the message was never unstarred; its star is the one thing modify is for")
+	}
+	if strings.Join(unstarred.body.IDs, ",") != "m1" {
+		t.Errorf("unstarred ids = %v, want [m1]", unstarred.body.IDs)
+	}
+	if strings.Join(unstarred.body.RemoveLabelIDs, ",") != "STARRED" {
+		t.Errorf("removed = %v, want [STARRED]", unstarred.body.RemoveLabelIDs)
+	}
+}
+
+func writeTestJSON(w http.ResponseWriter, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(v)
+}
+
 func mustParse(t *testing.T, raw string) *url.URL {
 	t.Helper()
 	u, err := url.Parse(raw)

internal/httpapi/notes_handlers.go

@@ -19,21 +19,38 @@ import (
 
 // Notes.
 //
-// Access follows the project, because that is where a note lives: a note in a
-// shared project is readable by everybody who can read the project and writable
-// by an editor. A note with no project is its author's alone — the same answer a
-// task in the inbox gets, arrived at the same way rather than by a rule of its own.
+// Access has three ways in, and a note may have any of them at once. A note with
+// no project is its author's alone — the same answer a task in the inbox gets. A
+// note in a project is readable by everyone who can read the project and writable
+// by an editor. And a note can be shared with a person directly, which grants that
+// person a role of its own. The effective role is the most any of the three allow.
 
-// mayReadNote reports whether this person may see the note, and mayWriteNote
-// whether they may change it. Split, because a viewer on a shared project can do
-// the first and not the second.
+// mayTouchNote reports whether this person may act on the note at the given role —
+// RoleViewer to read, RoleEditor to change. Split by role because a viewer, whether
+// on a shared project or a shared note, may do the first and not the second.
 func (s *Server) mayTouchNote(r *http.Request, n *store.Note, role store.Role) bool {
 	user := userFrom(r.Context())
+	// The owner and the project path, exactly as before.
 	if n.ProjectID == "" {
-		return n.CreatedBy == user.ID
+		if n.CreatedBy == user.ID {
+			return true
+		}
+	} else if _, err := store.RequireProjectRole(r.Context(), s.db, n.ProjectID, user.ID, role); err == nil {
+		return true
 	}
-	_, err := store.RequireProjectRole(r.Context(), s.db, n.ProjectID, user.ID, role)
-	return err == nil
+	// A direct share grants its role on top of whatever the above allow.
+	if shareRole, ok, err := s.db.NoteShareRole(r.Context(), n.ID, user.ID); err == nil && ok {
+		return shareRole.AtLeast(role)
+	}
+	return false
+}
+
+// ownsNote reports whether this person is the note's owner — its created_by — which
+// is who, and only who, may hand it to other people. An editor on a shared note can
+// change its text; giving away access is the owner's alone, the same shape a
+// project takes where members edit but only the owner invites.
+func (s *Server) ownsNote(r *http.Request, n *store.Note) bool {
+	return n != nil && n.CreatedBy == userFrom(r.Context()).ID
 }
 
 func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
@@ -48,7 +65,7 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 			s.internal(w, r, "search notes", err)
 			return
 		}
-		writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(s.readable(r, found))})
+		writeJSON(w, http.StatusOK, map[string]any{"notes": s.markShared(r, briefly(s.readable(r, found)))})
 		return
 	}
 
@@ -62,7 +79,7 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 			s.internal(w, r, "notes in project", err)
 			return
 		}
-		writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(found)})
+		writeJSON(w, http.StatusOK, map[string]any{"notes": s.markShared(r, briefly(found))})
 		return
 	}
 
@@ -75,7 +92,7 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 			s.internal(w, r, "list archived notes", err)
 			return
 		}
-		writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(found)})
+		writeJSON(w, http.StatusOK, map[string]any{"notes": s.markShared(r, briefly(found))})
 		return
 	}
 
@@ -87,7 +104,7 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, r, "list notes", err)
 		return
 	}
-	writeJSON(w, http.StatusOK, map[string]any{"notes": briefly(found)})
+	writeJSON(w, http.StatusOK, map[string]any{"notes": s.markShared(r, briefly(found))})
 }
 
 // briefly replaces each note's body with the first of it.
@@ -206,9 +223,16 @@ func (s *Server) handleUpdateNote(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if body.ProjectID != nil {
-		// Moving it means being allowed on both sides: you cannot file somebody
-		// else's note into your project, nor yours into theirs.
+	if body.ProjectID != nil && *body.ProjectID != n.ProjectID {
+		// Filing a note is the owner's call, not an editor's. A shared editor may
+		// change the text; letting them also move the note would let them file
+		// somebody else's note into a project the owner is not in — and the owner,
+		// who is not a member there, would lose their own note. So the move is
+		// owner-only, and then only into a project the owner may write to.
+		if !s.ownsNote(r, n) {
+			writeError(w, http.StatusForbidden, CodeForbidden, "only the note's owner can move it")
+			return
+		}
 		if *body.ProjectID != "" {
 			if _, err := store.RequireProjectRole(r.Context(), s.db, *body.ProjectID,
 				userFrom(r.Context()).ID, store.RoleEditor); err != nil {
@@ -238,7 +262,16 @@ func (s *Server) handleDeleteNote(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, r, "delete note", err)
 		return
 	}
-	if n == nil || !s.mayTouchNote(r, n, store.RoleEditor) {
+	// Deleting is not editing. Someone the note was shared with — even as an editor
+	// — may change its text, but throwing away the owner's note is the owner's to
+	// do. A project editor keeps the reach they have always had over a project's
+	// notes; a direct share does not extend that far.
+	mayDelete := s.ownsNote(r, n)
+	if !mayDelete && n != nil && n.ProjectID != "" {
+		_, perr := store.RequireProjectRole(r.Context(), s.db, n.ProjectID, userFrom(r.Context()).ID, store.RoleEditor)
+		mayDelete = perr == nil
+	}
+	if n == nil || !mayDelete {
 		writeError(w, http.StatusNotFound, CodeNotFound, "no such note")
 		return
 	}
@@ -280,6 +313,18 @@ func (s *Server) handleExportNotes(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Oldest first, and the id to break a tie. AllNotes comes back newest-first by
+	// the second, so two notes made in the same second have no order between them —
+	// and then which of two same-titled notes gets the plain name and which gets
+	// "(2)" is a coin toss that lands differently each export. Ordering the whole
+	// thing by when it was made settles it: the first note of a name keeps the name.
+	sort.SliceStable(notes, func(i, j int) bool {
+		if notes[i].CreatedAt.Equal(notes[j].CreatedAt) {
+			return notes[i].ID < notes[j].ID
+		}
+		return notes[i].CreatedAt.Before(notes[j].CreatedAt)
+	})
+
 	w.Header().Set("Content-Type", "application/zip")
 	w.Header().Set("Content-Disposition",
 		`attachment; filename="verdande-noter-`+time.Now().Format("2006-01-02")+`.zip"`)

internal/httpapi/notes_share_handlers.go

@@ -0,0 +1,181 @@
+package httpapi
+
+import (
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// markShared fills in the two fields the list needs to show a note somebody else
+// shared with the reader: that it is such a note, and whose it is.
+//
+// Done in one pass over the page rather than per note: one query asks which of
+// these ids are shared with the reader, and one asks for the owners' names and
+// colours. A note the reader owns is never "shared with me", however it was
+// reached — the group is other people's notes, not one's own.
+func (s *Server) markShared(r *http.Request, notes []store.Note) []store.Note {
+	me := userFrom(r.Context()).ID
+	if len(notes) == 0 {
+		return notes
+	}
+
+	ids := make([]string, 0, len(notes))
+	for _, n := range notes {
+		if n.CreatedBy != me {
+			ids = append(ids, n.ID)
+		}
+	}
+	shared, err := s.db.NotesSharedWith(r.Context(), me, ids)
+	if err != nil {
+		// The list is worth more than the chip: a note without its "shared" mark
+		// still reads and still opens. Log nothing here — the store already did.
+		return notes
+	}
+
+	owners := map[string]store.Person{}
+	if len(shared) > 0 {
+		ownerIDs := make([]string, 0, len(shared))
+		for _, n := range notes {
+			if shared[n.ID] && n.CreatedBy != "" {
+				ownerIDs = append(ownerIDs, n.CreatedBy)
+			}
+		}
+		owners, _ = s.db.PeopleByIDs(r.Context(), ownerIDs)
+	}
+
+	for i := range notes {
+		if !shared[notes[i].ID] {
+			continue
+		}
+		notes[i].SharedWithMe = true
+		if p, ok := owners[notes[i].CreatedBy]; ok {
+			owner := p
+			notes[i].Owner = &owner
+		}
+	}
+	return notes
+}
+
+// handleListNoteShares is who a note is shared with. Owner only: the list of people
+// who can see your note is itself something only you should see.
+func (s *Server) handleListNoteShares(w http.ResponseWriter, r *http.Request) {
+	n, err := s.db.Note(r.Context(), chi.URLParam(r, "noteID"))
+	if err != nil {
+		s.internal(w, r, "get note", err)
+		return
+	}
+	// 404, not 403: telling a stranger "not yours" still confirms the note exists.
+	if n == nil || !s.ownsNote(r, n) {
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such note")
+		return
+	}
+
+	shares, err := s.db.ListNoteShares(r.Context(), n.ID)
+	if err != nil {
+		s.internal(w, r, "list note shares", err)
+		return
+	}
+	out := make([]noteShareJSON, 0, len(shares))
+	already := map[string]bool{}
+	for _, sh := range shares {
+		out = append(out, noteShareJSON{
+			User: personJSON{ID: sh.User.ID, Name: sh.User.Name, AvatarColor: sh.User.AvatarColor},
+			Role: string(sh.Role),
+		})
+		already[sh.User.ID] = true
+	}
+
+	// The picker is filled from the same response, so the panel opens complete in
+	// one round-trip. People already on the note are left out — they are in the list
+	// above it, not the "add someone" menu.
+	candidates, err := s.db.UsersForSharing(r.Context(), userFrom(r.Context()).ID)
+	if err != nil {
+		s.internal(w, r, "share candidates", err)
+		return
+	}
+	cand := make([]personJSON, 0, len(candidates))
+	for _, p := range candidates {
+		if already[p.ID] {
+			continue
+		}
+		cand = append(cand, personJSON{ID: p.ID, Name: p.Name, AvatarColor: p.AvatarColor})
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{"shares": out, "candidates": cand})
+}
+
+type noteShareJSON struct {
+	User personJSON `json:"user"`
+	Role string     `json:"role"`
+}
+
+type shareNoteRequest struct {
+	UserID string `json:"user_id"`
+	Role   string `json:"role"`
+}
+
+// handleShareNote grants a person a role on a note, or changes the role they hold.
+func (s *Server) handleShareNote(w http.ResponseWriter, r *http.Request) {
+	var req shareNoteRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	n, err := s.db.Note(r.Context(), chi.URLParam(r, "noteID"))
+	if err != nil {
+		s.internal(w, r, "get note", err)
+		return
+	}
+	if n == nil || !s.ownsNote(r, n) {
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such note")
+		return
+	}
+
+	role := store.Role(req.Role)
+	if role == "" {
+		role = store.RoleViewer
+	}
+	if role != store.RoleViewer && role != store.RoleEditor {
+		writeFieldErrors(w, map[string]string{"role": "must be viewer or editor"})
+		return
+	}
+	if req.UserID == "" {
+		writeFieldErrors(w, map[string]string{"user_id": "required"})
+		return
+	}
+	// The recipient must be a real account and not the sharer themselves; ShareNote
+	// refuses the owner, and a made-up id should not reach it.
+	if req.UserID == userFrom(r.Context()).ID {
+		writeFieldErrors(w, map[string]string{"user_id": "you already have this note"})
+		return
+	}
+	if _, err := s.db.PersonByID(r.Context(), req.UserID); err != nil {
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such person")
+		return
+	}
+
+	if err := s.db.ShareNote(r.Context(), n.ID, req.UserID, role, userFrom(r.Context()).ID); err != nil {
+		s.storeError(w, r, "share note", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// handleUnshareNote takes a person's access away again.
+func (s *Server) handleUnshareNote(w http.ResponseWriter, r *http.Request) {
+	n, err := s.db.Note(r.Context(), chi.URLParam(r, "noteID"))
+	if err != nil {
+		s.internal(w, r, "get note", err)
+		return
+	}
+	if n == nil || !s.ownsNote(r, n) {
+		writeError(w, http.StatusNotFound, CodeNotFound, "no such note")
+		return
+	}
+	if err := s.db.UnshareNote(r.Context(), n.ID, chi.URLParam(r, "userID")); err != nil {
+		s.internal(w, r, "unshare note", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}

internal/httpapi/notes_share_test.go

@@ -0,0 +1,199 @@
+package httpapi
+
+import (
+	"net/http"
+	"testing"
+)
+
+// createNote makes a note as the current client and returns its id.
+func (ts *testServer) createNote(t *testing.T, body string) string {
+	t.Helper()
+	resp, out := ts.do(t, "POST", "/api/v1/notes", map[string]any{"body": body})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create note: status %d", resp.StatusCode)
+	}
+	id, _ := out["id"].(string)
+	if id == "" {
+		t.Fatal("create note returned no id")
+	}
+	return id
+}
+
+func userID(t *testing.T, ts *testServer, email string) string {
+	t.Helper()
+	u, err := ts.db.UserByEmail(t.Context(), email)
+	if err != nil {
+		t.Fatalf("look up %s: %v", email, err)
+	}
+	return u.ID
+}
+
+// A note shared with a person shows up in their list, marked as theirs-from-
+// somebody, and a viewer can read it but not change it.
+func TestSharedNoteReachesTheOtherPerson(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	noteID := owner.createNote(t, "# Ferieplan\nuge 29")
+
+	// Before sharing, Sofie cannot see it at all.
+	if resp, _ := other.do(t, "GET", "/api/v1/notes/"+noteID, nil); resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("an unshared note was reachable: %d", resp.StatusCode)
+	}
+
+	// Share it as a viewer.
+	resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "viewer"})
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("share: status %d", resp.StatusCode)
+	}
+
+	// Now it is in Sofie's list, flagged as shared with her and carrying its owner.
+	_, list := other.do(t, "GET", "/api/v1/notes", nil)
+	notes, _ := list["notes"].([]any)
+	var found map[string]any
+	for _, raw := range notes {
+		n := raw.(map[string]any)
+		if n["id"] == noteID {
+			found = n
+		}
+	}
+	if found == nil {
+		t.Fatal("the shared note is not in the recipient's list")
+	}
+	if found["shared_with_me"] != true {
+		t.Errorf("the note is not marked shared_with_me: %v", found)
+	}
+	ownerObj, _ := found["owner"].(map[string]any)
+	if ownerObj == nil || ownerObj["name"] != "Kristian" {
+		t.Errorf("the owner is not carried on the shared note: %v", found["owner"])
+	}
+
+	// A viewer reads it.
+	if resp, _ := other.do(t, "GET", "/api/v1/notes/"+noteID, nil); resp.StatusCode != http.StatusOK {
+		t.Errorf("a viewer could not read the shared note: %d", resp.StatusCode)
+	}
+	// But cannot change it.
+	if resp, _ := other.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "hijacked"}); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("a viewer changed a shared note: %d", resp.StatusCode)
+	}
+}
+
+// An editor may change the text, but only the owner may delete the note or hand it
+// to somebody else.
+func TestSharedEditorCanWriteButNotGiveAway(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	noteID := owner.createNote(t, "# Delt\noprindelig")
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "editor"}); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("share as editor failed")
+	}
+
+	// The editor writes.
+	if resp, _ := other.do(t, "PATCH", "/api/v1/notes/"+noteID,
+		map[string]any{"body": "# Delt\nrettet"}); resp.StatusCode != http.StatusOK {
+		t.Errorf("an editor could not change a shared note: %d", resp.StatusCode)
+	}
+
+	// The editor cannot re-share it: giving access is the owner's alone.
+	if resp, _ := other.do(t, "GET", "/api/v1/notes/"+noteID+"/shares", nil); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("an editor could read the share list: %d", resp.StatusCode)
+	}
+	// The editor cannot delete it.
+	if resp, _ := other.do(t, "DELETE", "/api/v1/notes/"+noteID, nil); resp.StatusCode == http.StatusNoContent {
+		t.Error("an editor deleted the owner's note")
+	}
+	// The note still exists for the owner.
+	if resp, _ := owner.do(t, "GET", "/api/v1/notes/"+noteID, nil); resp.StatusCode != http.StatusOK {
+		t.Errorf("the note is gone after the editor's delete attempt: %d", resp.StatusCode)
+	}
+}
+
+// Unsharing takes access away again, and only the owner can do it.
+func TestUnshareRemovesAccess(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	other := owner.newUser(t, "sofie@example.dk", "Sofie")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	noteID := owner.createNote(t, "# Hemmelig")
+	owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "viewer"})
+
+	// A non-owner cannot unshare.
+	if resp, _ := other.do(t, "DELETE", "/api/v1/notes/"+noteID+"/shares/"+sofie, nil); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("a non-owner unshared a note: %d", resp.StatusCode)
+	}
+
+	// The owner can.
+	if resp, _ := owner.do(t, "DELETE", "/api/v1/notes/"+noteID+"/shares/"+sofie, nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("owner unshare: %d", resp.StatusCode)
+	}
+	// And access is gone.
+	if resp, _ := other.do(t, "GET", "/api/v1/notes/"+noteID, nil); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("the note was still reachable after unsharing: %d", resp.StatusCode)
+	}
+}
+
+// The share list is owner-only and offers the instance's other people as
+// candidates, minus those already on the note.
+func TestShareListShowsCandidatesAndIsOwnerOnly(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	owner.newUser(t, "sofie@example.dk", "Sofie")
+	owner.newUser(t, "anders@example.dk", "Anders")
+	sofie := userID(t, owner, "sofie@example.dk")
+
+	noteID := owner.createNote(t, "# Plan")
+	owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": sofie, "role": "viewer"})
+
+	_, out := owner.do(t, "GET", "/api/v1/notes/"+noteID+"/shares", nil)
+	shares, _ := out["shares"].([]any)
+	if len(shares) != 1 {
+		t.Fatalf("shares = %d, want 1", len(shares))
+	}
+	cands, _ := out["candidates"].([]any)
+	// Anders is a candidate; Sofie is already on the note and so is not.
+	names := map[string]bool{}
+	for _, c := range cands {
+		names[c.(map[string]any)["name"].(string)] = true
+	}
+	if !names["Anders"] {
+		t.Errorf("Anders is not offered as a candidate: %v", names)
+	}
+	if names["Sofie"] {
+		t.Error("somebody already on the note is offered as a candidate")
+	}
+	if names["Kristian"] {
+		t.Error("the owner is offered as a candidate to share with themselves")
+	}
+}
+
+// Sharing refuses a made-up person and the owner themselves.
+func TestShareRejectsUnknownAndSelf(t *testing.T) {
+	owner := newTestServer(t)
+	owner.bootstrap(t)
+	me := userID(t, owner, "kristian@example.dk")
+	noteID := owner.createNote(t, "# Note")
+
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": "does-not-exist", "role": "viewer"}); resp.StatusCode != http.StatusNotFound {
+		t.Errorf("sharing with an unknown id: %d, want 404", resp.StatusCode)
+	}
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": me, "role": "viewer"}); resp.StatusCode != http.StatusUnprocessableEntity {
+		t.Errorf("sharing with oneself: %d, want 422", resp.StatusCode)
+	}
+	if resp, _ := owner.do(t, "POST", "/api/v1/notes/"+noteID+"/shares",
+		map[string]string{"user_id": me, "role": "owner"}); resp.StatusCode == http.StatusNoContent {
+		t.Error("a note was shared at the owner role")
+	}
+}

internal/httpapi/notifications_handlers.go

@@ -148,15 +148,23 @@ func (s *Server) pushToUser(userID, title, body, projectID string) pushOutcome {
 		return out
 	}
 
-	payload := push.Payload{Title: title, Body: body, URL: "/projekt/" + projectID}
+	target := "/projekt/" + projectID
+	if projectID == "" {
+		target = "/"
+	}
+	payload := push.Payload{Title: title, Body: body, URL: target}
+	subject := s.vapidSubject()
 	for _, sub := range subs {
 		err := push.Send(ctx, push.Subscription{
 			Endpoint: sub.Endpoint, P256dh: sub.P256dh, Auth: sub.Auth,
 		}, payload, push.VAPID{
-			Public: public, Private: private, Subject: "mailto:" + s.cfg.SMTP.From,
+			Public: public, Private: private, Subject: subject,
 		})
 		if err == nil {
 			out.Sent++
+			if delErr := s.db.MarkPushDelivered(ctx, sub.Endpoint); delErr != nil {
+				s.log.Warn("mark push delivered", "err", delErr)
+			}
 			continue
 		}
 		// Warn, not Debug.
@@ -257,6 +265,29 @@ func (s *Server) vapidKeys(ctx contextLike) (string, string, error) {
 	return s.db.InstanceKeys(ctx, push.GenerateVAPIDKeys)
 }
 
+// vapidSubject is the "sub" claim a push service is told to reach the sender at.
+//
+// It has to be one the service will actually accept, and Apple is the strict one:
+// it answers 403 Forbidden to a mailto whose domain is made up — which is exactly
+// what the old fallback, mailto:verdande@example.invalid, was on an instance with
+// no mail set up. Every push to an iPhone or a Mac was rejected, silently as far as
+// the person waiting for the notification could tell.
+//
+// So a real address is used when there is one, and otherwise the instance's own
+// https address — which is a valid VAPID subject, points at something that exists,
+// and Apple accepts. Verified against web.push.apple.com: the mailto gets a 403,
+// the https URL a 201.
+func (s *Server) vapidSubject() string {
+	from := strings.TrimSpace(s.cfg.SMTP.From)
+	if from != "" && strings.Contains(from, "@") && !strings.HasSuffix(from, "@localhost") {
+		return "mailto:" + from
+	}
+	if strings.HasPrefix(s.cfg.BaseURL, "https://") || strings.HasPrefix(s.cfg.BaseURL, "http://") {
+		return s.cfg.BaseURL
+	}
+	return "mailto:verdande@example.invalid"
+}
+
 // --- subscription endpoints -----------------------------------------------------------
 
 type pushSubscriptionRequest struct {

internal/httpapi/push_subject_test.go

@@ -0,0 +1,33 @@
+package httpapi
+
+import (
+	"testing"
+
+	"github.com/kristianwind/verdande/internal/config"
+)
+
+// The VAPID subject has to be one a push service will accept. Apple answers 403 to
+// a mailto with a made-up domain, which is what the no-mail fallback used to be, so
+// every push to an Apple device was refused. With no real address, the instance's
+// own https URL is used instead — valid, real, and accepted.
+func TestVAPIDSubject(t *testing.T) {
+	cases := []struct {
+		name    string
+		from    string
+		baseURL string
+		want    string
+	}{
+		{"a real address is used as-is", "todo@example.dk", "https://verdande.example.dk", "mailto:todo@example.dk"},
+		{"no mail falls back to the https url", "", "https://verdande.example.dk", "https://verdande.example.dk"},
+		{"the localhost default is not a real address", "verdande@localhost", "https://verdande.example.dk", "https://verdande.example.dk"},
+		{"a plain http dev url still serves as a subject", "", "http://localhost:8080", "http://localhost:8080"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			s := &Server{cfg: &config.Config{BaseURL: tc.baseURL, SMTP: config.SMTP{From: tc.from}}}
+			if got := s.vapidSubject(); got != tc.want {
+				t.Errorf("vapidSubject() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}

internal/httpapi/realip.go

@@ -0,0 +1,88 @@
+package httpapi
+
+import (
+	"net"
+	"net/http"
+	"net/netip"
+	"strings"
+
+	"github.com/kristianwind/verdande/internal/config"
+)
+
+// realIP rewrites r.RemoteAddr to the client address a trusted proxy reported,
+// and does nothing at all when the peer is not trusted.
+//
+// This replaces chi's middleware.RealIP, which is deprecated precisely because it
+// believes a forwarded header from anyone: an attacker sets X-Forwarded-For to a
+// new value on every request and gets a fresh rate-limit bucket each time, and
+// writes whatever address they like into the audit log. The one control that
+// exists for when a password is already gone is keyed on this address, so it has
+// to be an address the caller cannot choose.
+//
+// The gate is the peer. A header is read only when the machine that opened the
+// connection is one of cfg.TrustedProxies — a reverse proxy or tunnel the operator
+// put there. A connection straight off the internet is trusted for nothing, so its
+// header is ignored and it is keyed on the address it actually came from. Behind a
+// proxy that overwrites the client's own header (nginx, Caddy and cloudflared all
+// do) the value is then the real client and cannot be forged from outside.
+func realIP(cfg *config.Config) func(http.Handler) http.Handler {
+	trusted := cfg.TrustedProxies
+	header := cfg.RealIPHeader
+	if header == "" {
+		header = "X-Forwarded-For"
+	}
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if ip := trustedClientIP(r, trusted, header); ip != "" {
+				// Port preserved off the original peer only for shape; downstream
+				// clientIP() splits it away, and the forwarded value carries none.
+				r.RemoteAddr = ip
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// trustedClientIP returns the forwarded client address if the peer may be believed,
+// or "" to leave RemoteAddr untouched.
+func trustedClientIP(r *http.Request, trusted []netip.Prefix, header string) string {
+	peer := r.RemoteAddr
+	if host, _, err := net.SplitHostPort(peer); err == nil {
+		peer = host
+	}
+	peerAddr, err := netip.ParseAddr(peer)
+	if err != nil || !isTrusted(peerAddr, trusted) {
+		return ""
+	}
+
+	raw := r.Header.Get(header)
+	if raw == "" {
+		return ""
+	}
+	// The leftmost entry is the original client. That entry is only as trustworthy
+	// as the proxy that wrote it — but the trusted proxy is exactly the one that
+	// replaces a client-supplied header, so on the deployments this is written for
+	// it is the real client, and on a direct connection we never reach this line.
+	first := raw
+	if i := strings.IndexByte(raw, ','); i >= 0 {
+		first = raw[:i]
+	}
+	first = strings.TrimSpace(first)
+	if _, err := netip.ParseAddr(first); err != nil {
+		return ""
+	}
+	return first
+}
+
+func isTrusted(addr netip.Addr, trusted []netip.Prefix) bool {
+	if !addr.IsValid() {
+		return false
+	}
+	addr = addr.Unmap()
+	for _, p := range trusted {
+		if p.Contains(addr) {
+			return true
+		}
+	}
+	return false
+}

internal/httpapi/realip_test.go

@@ -0,0 +1,94 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/kristianwind/verdande/internal/config"
+)
+
+// The address the rate limiter keys on must be one the caller cannot choose. A
+// forwarded header is believed only from a trusted proxy, and ignored from a
+// stranger connecting directly — the difference between a control and a suggestion.
+func TestRealIPTrustsOnlyTheProxy(t *testing.T) {
+	cfg, err := config.Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	seen := ""
+	h := realIP(cfg)(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
+		seen = clientIP(r)
+	}))
+
+	cases := []struct {
+		name       string
+		remoteAddr string
+		xff        string
+		want       string
+	}{
+		{
+			// A private peer is a proxy the operator put there: believe it.
+			name:       "trusted proxy is believed",
+			remoteAddr: "10.1.2.3:5000",
+			xff:        "203.0.113.9",
+			want:       "203.0.113.9",
+		},
+		{
+			// A public peer connected straight to us; its header is a guess.
+			name:       "public peer header ignored",
+			remoteAddr: "198.51.100.7:5000",
+			xff:        "203.0.113.9",
+			want:       "198.51.100.7",
+		},
+		{
+			// No header from a trusted proxy leaves the peer as the answer.
+			name:       "trusted peer without header",
+			remoteAddr: "127.0.0.1:5000",
+			xff:        "",
+			want:       "127.0.0.1",
+		},
+		{
+			// A spoofed value from a stranger cannot become the key.
+			name:       "spoof from outside does not win",
+			remoteAddr: "198.51.100.7:5000",
+			xff:        "127.0.0.1",
+			want:       "198.51.100.7",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest("POST", "/api/v1/auth/login", nil)
+			r.RemoteAddr = tc.remoteAddr
+			if tc.xff != "" {
+				r.Header.Set("X-Forwarded-For", tc.xff)
+			}
+			h.ServeHTTP(httptest.NewRecorder(), r)
+			if seen != tc.want {
+				t.Errorf("keyed on %q, want %q", seen, tc.want)
+			}
+		})
+	}
+}
+
+// "none" turns the trust off entirely, for an instance exposed directly.
+func TestRealIPTrustNone(t *testing.T) {
+	t.Setenv("VERDANDE_TRUSTED_PROXIES", "none")
+	cfg, err := config.Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := ""
+	h := realIP(cfg)(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
+		seen = clientIP(r)
+	}))
+	r := httptest.NewRequest("POST", "/", nil)
+	r.RemoteAddr = "10.1.2.3:5000" // even a private peer is not trusted now
+	r.Header.Set("X-Forwarded-For", "203.0.113.9")
+	h.ServeHTTP(httptest.NewRecorder(), r)
+	if seen != "10.1.2.3" {
+		t.Errorf("keyed on %q, want the peer 10.1.2.3", seen)
+	}
+}

internal/httpapi/server.go

@@ -110,7 +110,10 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 
 	r := chi.NewRouter()
 	r.Use(middleware.RequestID)
-	r.Use(middleware.RealIP)
+	// Not middleware.RealIP: that believes a forwarded header from anyone, which
+	// lets a caller pick the address the rate limiter and audit log key on. This
+	// one reads the header only from a trusted proxy — see realip.go.
+	r.Use(realIP(cfg))
 	r.Use(requestLogger(log))
 	r.Use(middleware.Recoverer)
 	r.Use(middleware.Timeout(30 * time.Second))
@@ -345,6 +348,11 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				r.Post("/", s.handleCreateNote)
 				r.Post("/import", s.handleImportNotes)
 				r.Get("/linking/{kind}/{targetID}", s.handleNotesLinking)
+				// Sharing a note with a person directly — its own access list, beside
+				// the project path. Owner only; see notes_share_handlers.go.
+				r.Get("/{noteID}/shares", s.handleListNoteShares)
+				r.Post("/{noteID}/shares", s.handleShareNote)
+				r.Delete("/{noteID}/shares/{userID}", s.handleUnshareNote)
 				r.Get("/{noteID}", s.handleGetNote)
 				r.Patch("/{noteID}", s.handleUpdateNote)
 				r.Delete("/{noteID}", s.handleDeleteNote)
@@ -543,6 +551,7 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 					r.Post("/complete", s.handleCompleteTask)
 					r.Post("/reopen", s.handleReopenTask)
 					r.Post("/move", s.handleMoveTask)
+					r.Post("/snooze", s.handleSnoozeTask)
 				})
 			})
 		})
@@ -665,6 +674,31 @@ func (s *Server) securityHeaders(next http.Handler) http.Handler {
 		h.Set("X-Frame-Options", "DENY")
 		h.Set("Referrer-Policy", "same-origin")
 		h.Set("Content-Security-Policy", s.csp)
+		// The session lives in a __Host- cookie that only exists over HTTPS, so the
+		// whole security model already assumes TLS. HSTS is what makes that
+		// assumption hold against a network attacker: without it, the very first
+		// navigation can be stripped to http:// and the cookie handed over in the
+		// clear. Gated on the same condition as the cookie's Secure flag, so a
+		// plain-HTTP dev instance is never told to demand a certificate it cannot
+		// present. Two years, subdomains included; no preload directive, because
+		// asking to be hard-coded into browsers is a decision the operator makes
+		// for their domain, not one a self-hosted app makes for them.
+		if s.secureCookies() {
+			h.Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
+		}
+		// verdande uses none of the powerful browser features, so the safest policy
+		// is to turn them all off: an injected element cannot ask for the camera,
+		// the microphone or the location if the page itself has already declined
+		// them. Named explicitly rather than with a wildcard because the wildcard
+		// form of this header is not universally understood, and a directive a
+		// browser ignores is not a control.
+		h.Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), "+
+			"payment=(), usb=(), interest-cohort=()")
+		// Isolate the browsing context: a window this page opened, or one that
+		// opened it, cannot keep a handle across the origin boundary. verdande
+		// never scripts another window, so there is nothing to lose and a whole
+		// class of cross-window attacks to close.
+		h.Set("Cross-Origin-Opener-Policy", "same-origin")
 		next.ServeHTTP(w, r)
 	})
 }

internal/httpapi/tasks_handlers.go

@@ -16,23 +16,24 @@ import (
 )
 
 type taskJSON struct {
-	ID          string   `json:"id"`
-	ProjectID   string   `json:"project_id"`
-	SectionID   string   `json:"section_id,omitempty"`
-	ParentID    string   `json:"parent_id,omitempty"`
-	Content     string   `json:"content"`
-	Description string   `json:"description,omitempty"`
-	Priority    int      `json:"priority"`
-	DueDate     string   `json:"due_date,omitempty"`
-	DueDatetime string   `json:"due_datetime,omitempty"`
-	DurationMin *int     `json:"duration_min,omitempty"`
-	Recurrence  string   `json:"recurrence_rule,omitempty"`
-	RepeatText  string   `json:"recurrence_text,omitempty"`
-	AssigneeID  string   `json:"assignee_id,omitempty"`
-	Labels      []string `json:"labels"`
-	Completed   bool     `json:"completed"`
-	CompletedAt string   `json:"completed_at,omitempty"`
-	CreatedBy   string   `json:"created_by"`
+	ID           string   `json:"id"`
+	ProjectID    string   `json:"project_id"`
+	SectionID    string   `json:"section_id,omitempty"`
+	ParentID     string   `json:"parent_id,omitempty"`
+	Content      string   `json:"content"`
+	Description  string   `json:"description,omitempty"`
+	Priority     int      `json:"priority"`
+	DueDate      string   `json:"due_date,omitempty"`
+	DueDatetime  string   `json:"due_datetime,omitempty"`
+	DurationMin  *int     `json:"duration_min,omitempty"`
+	Recurrence   string   `json:"recurrence_rule,omitempty"`
+	RepeatText   string   `json:"recurrence_text,omitempty"`
+	AssigneeID   string   `json:"assignee_id,omitempty"`
+	Labels       []string `json:"labels"`
+	Completed    bool     `json:"completed"`
+	CompletedAt  string   `json:"completed_at,omitempty"`
+	SnoozedUntil string   `json:"snoozed_until,omitempty"`
+	CreatedBy    string   `json:"created_by"`
 	// What the row can say without being opened. Sent with every task rather than
 	// fetched when one is opened, because the point is that you see it in the list.
 	SubtaskCount    int     `json:"subtask_count,omitempty"`
@@ -67,6 +68,9 @@ func toTaskJSON(t store.Task) taskJSON {
 	if t.CompletedAt != nil {
 		j.CompletedAt = t.CompletedAt.Format(time.RFC3339)
 	}
+	if t.SnoozedUntil != nil {
+		j.SnoozedUntil = t.SnoozedUntil.Format(time.RFC3339)
+	}
 	return j
 }
 
@@ -698,3 +702,52 @@ func parseLimit(raw string, def, max int) int {
 	}
 	return n
 }
+
+type snoozeRequest struct {
+	// Until is an RFC3339 time to snooze to, or empty to wake the task now.
+	Until string `json:"until"`
+}
+
+// handleSnoozeTask parks a task until a time, or wakes it. Snooze changes nothing
+// but when the task wants to be seen — its due date and everything else stay put.
+func (s *Server) handleSnoozeTask(w http.ResponseWriter, r *http.Request) {
+	var req snoozeRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	taskID := chi.URLParam(r, "taskID")
+	user := userFrom(r.Context())
+
+	role, err := store.TaskRole(r.Context(), s.db, taskID, user.ID)
+	if err != nil || !role.CanEdit() {
+		writeError(w, http.StatusNotFound, CodeNotFound, "not found")
+		return
+	}
+
+	var until *time.Time
+	if strings.TrimSpace(req.Until) != "" {
+		parsed, perr := time.Parse(time.RFC3339, req.Until)
+		if perr != nil {
+			writeFieldErrors(w, map[string]string{"until": "must be an RFC3339 time"})
+			return
+		}
+		until = &parsed
+	}
+	if err := s.db.SnoozeTask(r.Context(), taskID, until); err != nil {
+		s.storeError(w, r, "snooze task", err)
+		return
+	}
+
+	t, err := s.db.GetTask(r.Context(), taskID, user.ID)
+	if err != nil {
+		s.storeError(w, r, "get task", err)
+		return
+	}
+	verb := "task.snoozed"
+	if until == nil {
+		verb = "task.unsnoozed"
+	}
+	s.activity(r, t.ProjectID, t.ID, verb, nil)
+	s.publish(t.ProjectID, "task.updated", toTaskJSON(*t))
+	writeJSON(w, http.StatusOK, toTaskJSON(*t))
+}

internal/httpapi/tasks_test.go

@@ -1817,3 +1817,50 @@ func TestATaskIsFoundByAWordInsideAWord(t *testing.T) {
 		}
 	}
 }
+
+// A snoozed task sinks to the bottom of the list and greys until its time; waking
+// it puts it back. The list order is what the row's dimming rides on.
+func TestSnoozeSinksAndWakes(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, a := ts.do(t, "POST", "/api/v1/tasks", map[string]any{"content": "Alfa"})
+	ts.do(t, "POST", "/api/v1/tasks", map[string]any{"content": "Bravo"})
+	aID, _ := a["id"].(string)
+
+	// Snooze Alfa two days out.
+	future := time.Now().Add(48 * time.Hour).UTC().Format(time.RFC3339)
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/"+aID+"/snooze", map[string]any{"until": future})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("snooze: %d %v", resp.StatusCode, body)
+	}
+	if body["snoozed_until"] == "" || body["snoozed_until"] == nil {
+		t.Error("the response does not carry snoozed_until")
+	}
+
+	// Alfa now sorts after Bravo, though it was created first.
+	order := func() []string {
+		_, list := ts.do(t, "GET", "/api/v1/tasks", nil)
+		var out []string
+		for _, raw := range list["tasks"].([]any) {
+			out = append(out, raw.(map[string]any)["content"].(string))
+		}
+		return out
+	}
+	got := order()
+	if len(got) != 2 || got[0] != "Bravo" || got[1] != "Alfa" {
+		t.Errorf("snoozed task did not sink: order = %v", got)
+	}
+
+	// Wake it, and it comes back above Bravo.
+	resp, body = ts.do(t, "POST", "/api/v1/tasks/"+aID+"/snooze", map[string]any{"until": ""})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("wake: %d %v", resp.StatusCode, body)
+	}
+	if s, _ := body["snoozed_until"].(string); s != "" {
+		t.Errorf("waking left snoozed_until set: %q", s)
+	}
+	if got := order(); got[0] != "Alfa" {
+		t.Errorf("woken task did not return: order = %v", got)
+	}
+}

internal/httpapi/totp_handlers.go

@@ -17,6 +17,9 @@ import (
 type totpSetupResponse struct {
 	Secret string `json:"secret"`
 	URI    string `json:"uri"`
+	// The URI as a scannable QR code (SVG). The secret and URI stay for typing in by
+	// hand on a device that cannot scan.
+	QR string `json:"qr"`
 }
 
 func (s *Server) handleTOTPSetup(w http.ResponseWriter, r *http.Request) {
@@ -54,7 +57,12 @@ func (s *Server) handleTOTPSetup(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, r, "store totp secret", err)
 		return
 	}
-	writeJSON(w, http.StatusOK, totpSetupResponse{Secret: secret, URI: uri})
+	qrSVG, err := auth.TOTPQRSVG(uri)
+	if err != nil {
+		s.internal(w, r, "render totp qr", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, totpSetupResponse{Secret: secret, URI: uri, QR: qrSVG})
 }
 
 type totpConfirmResponse struct {

internal/ics/ics.go

@@ -62,8 +62,13 @@ func Render(cal Calendar) string {
 
 	for _, t := range cal.Tasks {
 		writeTodo(&b, t, cal.Domain)
-		// A dated task also goes out as an event, for clients that ignore VTODO.
-		if t.DueDatetime != nil && !t.Completed {
+		// A dated task also goes out as an event, for the calendar apps that ignore
+		// VTODO — which is all of them: Apple Calendar and Google both drop a
+		// subscribed to-do on the floor and show only events. A task with a clock
+		// time becomes a timed event; one with only a date, an all-day event. Once
+		// this was limited to timed tasks, so a date-only task — most of them —
+		// simply never appeared in the calendar it was subscribed into.
+		if !t.Completed && (t.DueDatetime != nil || t.DueDate != "") {
 			writeEvent(&b, t, cal.Domain)
 		}
 	}
@@ -128,22 +133,31 @@ func writeTodo(b *strings.Builder, t Task, domain string) {
 }
 
 func writeEvent(b *strings.Builder, t Task, domain string) {
-	start := *t.DueDatetime
-	// Without a stated duration a task is shown as half an hour. A zero-length
-	// event collapses to an invisible sliver in most calendar grids.
-	minutes := 30
-	if t.DurationMin != nil && *t.DurationMin > 0 {
-		minutes = *t.DurationMin
-	}
-	end := start.Add(time.Duration(minutes) * time.Minute)
-
 	b.WriteString("BEGIN:VEVENT\r\n")
 	// A distinct UID suffix: the event and the to-do describe the same task, and
 	// sharing a UID would make a client treat them as two versions of one item.
 	writeLine(b, "UID:"+t.ID+"-event@"+domain)
 	writeLine(b, "DTSTAMP:"+utc(t.UpdatedAt))
-	writeLine(b, "DTSTART:"+utc(start))
-	writeLine(b, "DTEND:"+utc(end))
+
+	if t.DueDatetime != nil {
+		start := *t.DueDatetime
+		// Without a stated duration a task is shown as half an hour. A zero-length
+		// event collapses to an invisible sliver in most calendar grids.
+		minutes := 30
+		if t.DurationMin != nil && *t.DurationMin > 0 {
+			minutes = *t.DurationMin
+		}
+		writeLine(b, "DTSTART:"+utc(start))
+		writeLine(b, "DTEND:"+utc(start.Add(time.Duration(minutes)*time.Minute)))
+	} else {
+		// A date with no time is an all-day event. DTEND is exclusive — a one-day
+		// event ends on the following date — which is what keeps it a single day in
+		// the grid rather than bleeding into the next.
+		day := strings.ReplaceAll(t.DueDate, "-", "")
+		writeLine(b, "DTSTART;VALUE=DATE:"+day)
+		writeLine(b, "DTEND;VALUE=DATE:"+nextDay(t.DueDate))
+	}
+
 	writeLine(b, "SUMMARY:"+escape(t.Content))
 	if t.Description != "" {
 		writeLine(b, "DESCRIPTION:"+escape(t.Description))
@@ -157,6 +171,17 @@ func writeEvent(b *strings.Builder, t Task, domain string) {
 
 func utc(t time.Time) string { return t.UTC().Format("20060102T150405Z") }
 
+// nextDay is the YYYYMMDD after a YYYY-MM-DD date, for an all-day event's exclusive
+// DTEND. A malformed date is returned as its own compacted form rather than
+// dropped, so a task never loses its event over a bad string.
+func nextDay(date string) string {
+	d, err := time.Parse("2006-01-02", date)
+	if err != nil {
+		return strings.ReplaceAll(date, "-", "")
+	}
+	return d.AddDate(0, 0, 1).Format("20060102")
+}
+
 // escape applies RFC 5545 text escaping. A comma or semicolon in a task title is
 // a value separator in iCalendar, so an unescaped one silently truncates the
 // summary at that character in every client.

internal/ics/ics_test.go

@@ -102,19 +102,28 @@ func TestWholeDayDueDatesAreDates(t *testing.T) {
 
 // Google Calendar ignores VTODO. Timed tasks are therefore also emitted as events,
 // or a feed is useless in the calendar most people actually keep.
-func TestTimedTasksAlsoBecomeEvents(t *testing.T) {
+func TestDatedTasksBecomeEvents(t *testing.T) {
 	out := Render(sample())
 
-	if strings.Count(out, "BEGIN:VEVENT") != 1 {
-		t.Fatalf("got %d VEVENTs, want one for the single timed task",
-			strings.Count(out, "BEGIN:VEVENT"))
+	// Every dated, unfinished task becomes an event, so it shows in a calendar app
+	// that ignores VTODO — timed t1, and date-only t2 and t3. The finished t4 has no
+	// date and no event.
+	if got := strings.Count(out, "BEGIN:VEVENT"); got != 3 {
+		t.Fatalf("got %d VEVENTs, want 3 (one timed, two all-day)", got)
 	}
-	if !strings.Contains(out, "DTSTART:20260310T090000Z") {
-		t.Error("the event has no start")
+
+	// The timed one keeps its clock and its 45-minute duration.
+	if !strings.Contains(out, "DTSTART:20260310T090000Z") || !strings.Contains(out, "DTEND:20260310T094500Z") {
+		t.Error("the timed event's start or duration is wrong")
 	}
-	// 45 minutes of stated duration.
-	if !strings.Contains(out, "DTEND:20260310T094500Z") {
-		t.Error("the event's end does not reflect the task's duration")
+	// The date-only ones are all-day: a DATE start and an exclusive next-day end, so
+	// they sit on their own day rather than bleeding into the next.
+	if !strings.Contains(out, "DTSTART;VALUE=DATE:20260312") || !strings.Contains(out, "DTEND;VALUE=DATE:20260313") {
+		t.Error("the date-only event is not a single all-day event")
+	}
+	// A recurring date-only task carries its rule onto the event.
+	if !strings.Contains(out, "RRULE:FREQ=WEEKLY;BYDAY=MO") {
+		t.Error("the recurring task's event has no RRULE")
 	}
 	// The event must not share the to-do's UID, or clients treat them as one item.
 	if !strings.Contains(out, "UID:t1-event@todo.example.dk") {

internal/store/migrations/0029_totp_single_use.sql

@@ -0,0 +1,11 @@
+-- A TOTP code is meant to be usable once. RFC 6238 says so in as many words: the
+-- verifier must reject a code that has already been accepted, or a code observed in
+-- flight — over the shoulder, off a phishing page, out of a proxy — can be replayed
+-- for the rest of its thirty-second window.
+--
+-- totp_last_step records the counter of the most recently accepted code (Unix time
+-- divided by the period). A login accepts a code only when its step is strictly
+-- greater, so the same code cannot be spent twice and time cannot run backwards.
+-- Null means no code has been accepted yet, which is every account until its owner
+-- next signs in with one.
+ALTER TABLE users ADD COLUMN totp_last_step INTEGER;

internal/store/migrations/0030_note_shares.sql

@@ -0,0 +1,30 @@
+-- Sharing a note with a person, rather than only by filing it in a shared project.
+--
+-- Until now a note was shared exactly one way: put it in a project, and everyone
+-- who could read the project could read the note. That is the right tool when the
+-- note belongs with a body of work, and the wrong one when it is just "let Sofie
+-- see this" — it makes you stand up a project to hand over a single page.
+--
+-- A note_shares row is that direct grant: this note, this person, this role. It
+-- sits alongside the project path, not instead of it — a note can be loose, filed,
+-- shared with people, or any combination, and access is the most that any of those
+-- allow. Only the note's owner (its created_by) writes these rows.
+--
+-- role is 'viewer' or 'editor', the same words a project membership uses, so there
+-- is one idea of what a role means in this program and not two.
+CREATE TABLE note_shares (
+    note_id    TEXT NOT NULL REFERENCES notes (id) ON DELETE CASCADE,
+    user_id    TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+    role       TEXT NOT NULL DEFAULT 'viewer',
+    created_by TEXT REFERENCES users (id) ON DELETE SET NULL,
+    created_at INTEGER NOT NULL,
+
+    -- One share per person per note: sharing again changes the role, it does not
+    -- add a second row that the first would then quietly disagree with.
+    PRIMARY KEY (note_id, user_id)
+);
+
+-- "Which notes are shared with me" is asked on every visit to the notes page, to
+-- build the Delt med mig group and to widen what the list may show. It is a lookup
+-- by user_id, so that is what carries the index.
+CREATE INDEX note_shares_by_user ON note_shares (user_id);

internal/store/migrations/0031_task_snooze.sql

@@ -0,0 +1,7 @@
+-- Snooze: put a task out of the way without finishing or filing it. A snoozed task
+-- sinks to the bottom of its list and greys out until the time it is snoozed to,
+-- then comes back on its own — no job wakes it, because "snoozed" is simply
+-- snoozed_until being still in the future, read against the clock each time.
+--
+-- Null means not snoozed, which is every task until somebody snoozes one.
+ALTER TABLE tasks ADD COLUMN snoozed_until INTEGER;

internal/store/names_test.go

@@ -0,0 +1,81 @@
+package store
+
+import (
+	"context"
+	"testing"
+)
+
+func TestNormalizeName(t *testing.T) {
+	cases := map[string]string{
+		"andreas":        "Andreas",
+		"Andreas":        "Andreas",
+		"anne mette":     "Anne Mette",
+		"  kristian  ":   "Kristian",
+		"anne   mette":   "Anne Mette",
+		"McDonald":       "McDonald", // an existing inner capital is kept
+		"óscar":          "Óscar",    // Unicode initial
+		"æblegaard":      "Æblegaard",
+		"":               "",
+		"   ":            "",
+		"mette-marie sø": "Mette-marie Sø", // only word-initials are raised
+		"iPhone listen":  "IPhone Listen",  // deliberately: the first letter is raised
+	}
+	for in, want := range cases {
+		if got := NormalizeName(in); got != want {
+			t.Errorf("NormalizeName(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestCreateUserCapitalisesName(t *testing.T) {
+	db := openTest(t)
+	ctx := context.Background()
+
+	u := &User{Email: "andreas@example.dk", Name: "andreas", PasswordHash: "x"}
+	if err := db.CreateUser(ctx, u, "Inbox"); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	got, err := db.UserByEmail(ctx, "andreas@example.dk")
+	if err != nil {
+		t.Fatalf("read back: %v", err)
+	}
+	if got.Name != "Andreas" {
+		t.Errorf("stored name = %q, want %q", got.Name, "Andreas")
+	}
+}
+
+func TestNormalizeUserNamesBackfill(t *testing.T) {
+	db := openTest(t)
+	ctx := context.Background()
+
+	// An account as it looked before the app capitalised names: made properly,
+	// then set back to lower case behind the store's back to stand in for an old row.
+	u := &User{Email: "a@example.dk", Name: "Andreas", PasswordHash: "x"}
+	if err := db.CreateUser(ctx, u, "Inbox"); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	if _, err := db.ExecContext(ctx, `UPDATE users SET name = 'andreas' WHERE id = ?`, u.ID); err != nil {
+		t.Fatalf("downgrade name: %v", err)
+	}
+
+	fixed, err := db.NormalizeUserNames(ctx)
+	if err != nil {
+		t.Fatalf("normalize: %v", err)
+	}
+	if fixed != 1 {
+		t.Fatalf("fixed = %d, want 1", fixed)
+	}
+	got, _ := db.UserByID(ctx, u.ID)
+	if got.Name != "Andreas" {
+		t.Errorf("name after backfill = %q, want %q", got.Name, "Andreas")
+	}
+
+	// Idempotent: nothing left to do on a second pass.
+	again, err := db.NormalizeUserNames(ctx)
+	if err != nil {
+		t.Fatalf("normalize again: %v", err)
+	}
+	if again != 0 {
+		t.Errorf("second pass fixed = %d, want 0", again)
+	}
+}

internal/store/note_shares.go

@@ -0,0 +1,133 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"time"
+)
+
+// NoteShare is one person's direct grant on a note: who they are, and what they
+// may do. The person is carried whole rather than by id, because every caller of
+// this wants to show them — a name and an avatar colour, never a bare id.
+type NoteShare struct {
+	User Person `json:"user"`
+	Role Role   `json:"role"`
+}
+
+// ShareNote grants a person a role on a note, or changes the role if they already
+// had one. The owner is passed so the row records who did the sharing; the caller
+// has already checked that they may.
+//
+// Sharing a note with its own owner is refused: the owner already has everything a
+// share could give, and a row saying otherwise is a contradiction waiting to
+// confuse the access check.
+func (db *DB) ShareNote(ctx context.Context, noteID, userID string, role Role, byUserID string) error {
+	if !role.Valid() || role == RoleOwner {
+		return errors.New("store: a note can be shared as viewer or editor")
+	}
+	var createdBy sql.NullString
+	if err := db.QueryRowContext(ctx,
+		`SELECT COALESCE(created_by, '') FROM notes WHERE id = ? AND deleted_at IS NULL`,
+		noteID).Scan(&createdBy.String); errors.Is(err, sql.ErrNoRows) {
+		return ErrNotFound
+	} else if err != nil {
+		return err
+	}
+	if createdBy.String == userID {
+		return errors.New("store: a note is already the owner's")
+	}
+	_, err := db.ExecContext(ctx, `
+		INSERT INTO note_shares (note_id, user_id, role, created_by, created_at)
+		VALUES (?, ?, ?, ?, ?)
+		ON CONFLICT (note_id, user_id) DO UPDATE SET role = excluded.role`,
+		noteID, userID, role, byUserID, time.Now().Unix())
+	return err
+}
+
+// UnshareNote removes a person's grant. Removing one that is not there is not an
+// error: the end state the caller asked for — this person cannot see this note —
+// is the same either way.
+func (db *DB) UnshareNote(ctx context.Context, noteID, userID string) error {
+	_, err := db.ExecContext(ctx,
+		`DELETE FROM note_shares WHERE note_id = ? AND user_id = ?`, noteID, userID)
+	return err
+}
+
+// ListNoteShares is who a note is shared with, each with their role, ordered by
+// name so the list under a note does not reshuffle every time it is opened.
+func (db *DB) ListNoteShares(ctx context.Context, noteID string) ([]NoteShare, error) {
+	rows, err := db.QueryContext(ctx, `
+		SELECT u.id, u.name, u.avatar_color, s.role
+		FROM note_shares s
+		JOIN users u ON u.id = s.user_id
+		WHERE s.note_id = ?
+		ORDER BY lower(u.name)`, noteID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []NoteShare
+	for rows.Next() {
+		var s NoteShare
+		if err := rows.Scan(&s.User.ID, &s.User.Name, &s.User.AvatarColor, &s.Role); err != nil {
+			return nil, err
+		}
+		out = append(out, s)
+	}
+	return out, rows.Err()
+}
+
+// NoteShareRole is the role a person holds on a note through a direct share, if
+// any. The bool is whether a share exists at all — distinct from a share whose
+// role could not be read — so a caller does not have to treat "no share" as an
+// error.
+func (db *DB) NoteShareRole(ctx context.Context, noteID, userID string) (Role, bool, error) {
+	var role Role
+	err := db.QueryRowContext(ctx,
+		`SELECT role FROM note_shares WHERE note_id = ? AND user_id = ?`, noteID, userID).Scan(&role)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", false, nil
+	}
+	if err != nil {
+		return "", false, err
+	}
+	if !role.Valid() {
+		// A role the database holds but this build does not understand is no access,
+		// never a guess — the same rule project roles follow.
+		return "", false, nil
+	}
+	return role, true, nil
+}
+
+// NotesSharedWith returns the ids, among those given, that are shared directly with
+// the user. It answers the Delt med mig question in one query rather than one per
+// note, and takes the ids it is scoping so it never has to load a person's whole
+// world to mark a single page.
+func (db *DB) NotesSharedWith(ctx context.Context, userID string, noteIDs []string) (map[string]bool, error) {
+	out := map[string]bool{}
+	if len(noteIDs) == 0 {
+		return out, nil
+	}
+	args := make([]any, 0, len(noteIDs)+1)
+	args = append(args, userID)
+	for _, id := range noteIDs {
+		args = append(args, id)
+	}
+	rows, err := db.QueryContext(ctx,
+		`SELECT note_id FROM note_shares WHERE user_id = ? AND note_id IN (`+placeholders(len(noteIDs))+`)`,
+		args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		out[id] = true
+	}
+	return out, rows.Err()
+}

internal/store/notes.go

@@ -37,6 +37,17 @@ type Note struct {
 	// set by a caller: it is derived, and a caller that set it would be describing
 	// a note whose text says something else.
 	Links []NoteLink `json:"links,omitempty"`
+
+	// SharedWithMe is true when the person reading the list reached this note
+	// through a direct share rather than by owning it or being in its project. It
+	// is what puts the note in the Delt med mig group and shows whose note it is.
+	// Derived per request, so it is never stored and never set by a caller.
+	SharedWithMe bool `json:"shared_with_me,omitempty"`
+
+	// Owner is who the note belongs to — its created_by — as a name and a colour,
+	// for the chip on a note shared with the reader. Set only when it helps the
+	// list say something; nil the rest of the time.
+	Owner *Person `json:"owner,omitempty"`
 }
 
 // NoteLink is one reference from a note to something else.
@@ -263,8 +274,9 @@ func (db *DB) allNotes(ctx context.Context, userID string, archived bool) ([]Not
 		      UNION
 		      SELECT project_id FROM project_members WHERE user_id = ?
 		    )
+		    OR notes.id IN (SELECT note_id FROM note_shares WHERE user_id = ?)
 		  )
-		ORDER BY pinned DESC, updated_at DESC`, userID, userID, userID)
+		ORDER BY pinned DESC, updated_at DESC`, userID, userID, userID, userID)
 }
 
 // NotesLinking answers the backwards question: what points at this thing.

internal/store/notifications.go

@@ -204,6 +204,17 @@ func (db *DB) dropPushEndpoint(ctx context.Context, endpoint string) error {
 // has failed enough times. A push service says 404 or 410 when an endpoint is gone,
 // but it also has bad days — forgiving a few failures keeps a flaky network from
 // silently unsubscribing somebody's phone.
+// MarkPushDelivered records that a push went through: the failure count goes back
+// to zero and last_used_at moves forward. Without it a subscription that failed a
+// few times and then recovered would keep those failures on its record and be one
+// flaky night away from the ten that delete it — even though it is working.
+func (db *DB) MarkPushDelivered(ctx context.Context, endpoint string) error {
+	_, err := db.ExecContext(ctx,
+		`UPDATE push_subscriptions SET failures = 0, last_used_at = ? WHERE endpoint = ?`,
+		time.Now().Unix(), endpoint)
+	return err
+}
+
 func (db *DB) RecordPushFailure(ctx context.Context, endpoint string, permanent bool) error {
 	if permanent {
 		// Not scoped by user, and that is right here: this is the push service

internal/store/tasks.go

@@ -29,6 +29,9 @@ type Task struct {
 	AssigneeID     string
 	CompletedAt    *time.Time
 	CompletedBy    string
+	// SnoozedUntil, when set and still in the future, parks the task at the bottom
+	// of its list, greyed, until it passes. Nil means the task is not snoozed.
+	SnoozedUntil *time.Time
 	// CreatedBy is empty when the author's account has been deleted: `created_by`
 	// is ON DELETE SET NULL so the task survives the person who wrote it.
 	CreatedBy string
@@ -219,7 +222,7 @@ func (db *DB) ListTasks(ctx context.Context, userID string, f TaskFilter) ([]Tas
 		SELECT t.id, t.project_id, t.section_id, t.parent_id, t.content, t.description,
 		       t.priority, t.due_date, t.due_datetime, t.due_timezone, t.duration_min,
 		       t.recurrence_rule, t.assignee_id, t.completed_at, t.completed_by,
-		       t.created_by, t.sort_order, t.created_at, t.updated_at,` + taskCounts + `
+		       t.created_by, t.sort_order, t.created_at, t.updated_at, t.snoozed_until,` + taskCounts + `
 		FROM tasks t
 		JOIN projects p ON p.id = t.project_id
 		WHERE ` + strings.Join(where, " AND ") + `
@@ -313,7 +316,7 @@ func (db *DB) GetTask(ctx context.Context, taskID, userID string) (*Task, error)
 		SELECT t.id, t.project_id, t.section_id, t.parent_id, t.content, t.description,
 		       t.priority, t.due_date, t.due_datetime, t.due_timezone, t.duration_min,
 		       t.recurrence_rule, t.assignee_id, t.completed_at, t.completed_by,
-		       t.created_by, t.sort_order, t.created_at, t.updated_at,`+taskCounts+`
+		       t.created_by, t.sort_order, t.created_at, t.updated_at, t.snoozed_until,`+taskCounts+`
 		FROM tasks t WHERE t.id = ? AND t.deleted_at IS NULL`, taskID)
 	if err != nil {
 		return nil, err
@@ -390,7 +393,32 @@ func order(f TaskFilter) string {
 	if f.CompletedOnly {
 		return "t.completed_at DESC, t.id DESC"
 	}
-	return "t.due_date IS NULL, t.due_date, t.priority, t.sort_order, t.created_at"
+	// A snoozed task sinks below everything else — the CASE is 1 while it is still
+	// snoozed and 0 the moment its time passes, so it rejoins the list in its proper
+	// place by the clock, with nothing to run. Compared as an integer, or the TEXT
+	// strftime returns would sort under every number.
+	snoozed := "(CASE WHEN t.snoozed_until > CAST(strftime('%s','now') AS INTEGER) THEN 1 ELSE 0 END)"
+	return snoozed + ", t.due_date IS NULL, t.due_date, t.priority, t.sort_order, t.created_at"
+}
+
+// SnoozeTask parks a task until a moment, or wakes it when until is nil. Only the
+// snooze changes; the due date, the time, everything else is left alone — a snooze
+// is about when you want to see it, not when it is due.
+func (db *DB) SnoozeTask(ctx context.Context, id string, until *time.Time) error {
+	var v any
+	if until != nil {
+		v = until.Unix()
+	}
+	res, err := db.ExecContext(ctx,
+		`UPDATE tasks SET snoozed_until = ?, updated_at = ? WHERE id = ? AND deleted_at IS NULL`,
+		v, time.Now().Unix(), id)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
 }
 
 func scanTask(rows *sql.Rows) (Task, error) {
@@ -400,13 +428,13 @@ func scanTask(rows *sql.Rows) (Task, error) {
 	// stays; it loses its author.
 	var createdBy sql.NullString
 	var dueDatetime, completedAt sql.NullInt64
-	var duration sql.NullInt64
+	var duration, snoozedUntil sql.NullInt64
 	var created, updated int64
 
 	err := rows.Scan(&t.ID, &t.ProjectID, &sectionID, &parentID, &t.Content, &t.Description,
 		&t.Priority, &dueDate, &dueDatetime, &dueTZ, &duration,
 		&recurrence, &assignee, &completedAt, &completedBy,
-		&createdBy, &t.SortOrder, &created, &updated,
+		&createdBy, &t.SortOrder, &created, &updated, &snoozedUntil,
 		&t.SubtaskCount, &t.SubtaskDone, &t.AttachmentCount)
 	if err != nil {
 		return t, err
@@ -432,6 +460,10 @@ func scanTask(rows *sql.Rows) (Task, error) {
 		v := int(duration.Int64)
 		t.DurationMin = &v
 	}
+	if snoozedUntil.Valid {
+		v := time.Unix(snoozedUntil.Int64, 0).UTC()
+		t.SnoozedUntil = &v
+	}
 	t.CreatedAt = time.Unix(created, 0).UTC()
 	t.UpdatedAt = time.Unix(updated, 0).UTC()
 	return t, nil

internal/store/users.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"strings"
 	"time"
+	"unicode"
 
 	"github.com/kristianwind/verdande/internal/auth"
 )
@@ -62,6 +63,26 @@ func NormalizeEmail(email string) string {
 	return strings.ToLower(strings.TrimSpace(email))
 }
 
+// NormalizeName trims a display name and capitalises the first letter of every
+// word, leaving the rest of each word exactly as typed. So "andreas" becomes
+// "Andreas" and "anne mette" becomes "Anne Mette", while a name that already
+// carries a capital in the middle — "McDonald", an "iPhone" — keeps it: only the
+// first letter of a word is ever raised, never lowered.
+//
+// A name is the person's to spell; the one thing the instance insists on is that
+// it does not start in lower case, because a column of lower-case first names
+// reads as a bug the person cannot fix from their own keyboard. Unicode-aware, so
+// "æblegaard" and "óscar" are raised the same as an ASCII initial.
+func NormalizeName(name string) string {
+	fields := strings.Fields(name)
+	for i, f := range fields {
+		r := []rune(f)
+		r[0] = unicode.ToUpper(r[0])
+		fields[i] = string(r)
+	}
+	return strings.Join(fields, " ")
+}
+
 // CreateUser inserts a user and gives them an Inbox, in one transaction.
 //
 // The Inbox is created here rather than lazily on first use because every other
@@ -70,6 +91,7 @@ func NormalizeEmail(email string) string {
 // of them end up racing to create the second one.
 func (db *DB) CreateUser(ctx context.Context, u *User, inboxName string) error {
 	u.Email = NormalizeEmail(u.Email)
+	u.Name = NormalizeName(u.Name)
 	if u.ID == "" {
 		u.ID = NewID()
 	}
@@ -205,9 +227,50 @@ func (db *DB) SetSidebarCollapsed(ctx context.Context, userID string, sections [
 // Person is the public half of a user: what somebody else is allowed to see when
 // their name has to appear next to a task. No address, no hash, no timezone.
 type Person struct {
-	ID          string
-	Name        string
-	AvatarColor string
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	AvatarColor string `json:"avatar_color"`
+}
+
+// PersonByID resolves one user to a name and colour, or ErrNotFound. Used to check
+// that somebody a note is about to be shared with actually exists, without loading
+// the whole account.
+func (db *DB) PersonByID(ctx context.Context, id string) (Person, error) {
+	var p Person
+	err := db.QueryRowContext(ctx,
+		`SELECT id, name, avatar_color FROM users WHERE id = ?`, id).Scan(&p.ID, &p.Name, &p.AvatarColor)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Person{}, ErrNotFound
+	}
+	return p, err
+}
+
+// UsersForSharing is everyone on the instance except the caller — the people a note
+// can be handed to.
+//
+// Deliberately wider than ListPeople, which is the project collaborators. The whole
+// point of sharing a note directly is to do it without first standing up a shared
+// project, so the picker cannot be limited to people you already share a project
+// with. An instance's accounts are a closed, invited set to begin with — there is
+// no open signup — so listing them to each other is not disclosure, it is the
+// address book the feature needs.
+func (db *DB) UsersForSharing(ctx context.Context, meID string) ([]Person, error) {
+	rows, err := db.QueryContext(ctx,
+		`SELECT id, name, avatar_color FROM users WHERE id <> ? ORDER BY lower(name)`, meID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	people := []Person{}
+	for rows.Next() {
+		var p Person
+		if err := rows.Scan(&p.ID, &p.Name, &p.AvatarColor); err != nil {
+			return nil, err
+		}
+		people = append(people, p)
+	}
+	return people, rows.Err()
 }
 
 // PeopleByIDs looks up several users at once.
@@ -432,6 +495,7 @@ func (db *DB) UpdatePasswordHash(ctx context.Context, userID, hash, keepSessionI
 // invites were sent to, and changing it is a re-verification flow rather than a
 // field. Neither is is_admin — an account cannot promote itself.
 func (db *DB) UpdateProfile(ctx context.Context, userID, name, timezone, locale string) error {
+	name = NormalizeName(name)
 	res, err := db.ExecContext(ctx,
 		`UPDATE users SET name = ?, timezone = ?, locale = ?, updated_at = ? WHERE id = ?`,
 		name, timezone, locale, time.Now().Unix(), userID)
@@ -444,6 +508,56 @@ func (db *DB) UpdateProfile(ctx context.Context, userID, name, timezone, locale
 	return nil
 }
 
+// NormalizeUserNames capitalises the first letter of every existing user's name,
+// for the accounts created before the app started doing it on the way in.
+//
+// Idempotent: a name already normalised is left untouched, so it costs one pass
+// of names at each start and writes nothing once it has caught up. Like SealNotes
+// it runs at boot rather than as a migration, because the rule lives in Go —
+// Unicode-aware and per word — and SQLite's own UPPER cannot spell it.
+//
+// `updated_at` is not touched: fixing the spelling of a name the person chose is
+// the instance tidying up after itself, not the person editing their profile.
+func (db *DB) NormalizeUserNames(ctx context.Context) (int, error) {
+	rows, err := db.QueryContext(ctx, `SELECT id, name FROM users`)
+	if err != nil {
+		return 0, err
+	}
+	type pending struct{ id, name string }
+	var todo []pending
+	for rows.Next() {
+		var id, name string
+		if err := rows.Scan(&id, &name); err != nil {
+			rows.Close()
+			return 0, err
+		}
+		if n := NormalizeName(name); n != name {
+			todo = append(todo, pending{id, n})
+		}
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return 0, err
+	}
+	if len(todo) == 0 {
+		return 0, nil
+	}
+
+	err = db.Tx(ctx, func(tx *sql.Tx) error {
+		for _, p := range todo {
+			if _, err := tx.ExecContext(ctx,
+				`UPDATE users SET name = ? WHERE id = ?`, p.name, p.id); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return 0, err
+	}
+	return len(todo), nil
+}
+
 func (db *DB) SetTOTPSecret(ctx context.Context, userID, secret string, enabled bool) error {
 	// Sealed, like a mailbox password and for the same reason: the copies, not the
 	// server. A TOTP secret in a downloadable backup lets whoever holds the copy
@@ -466,6 +580,26 @@ func (db *DB) SetTOTPSecret(ctx context.Context, userID, secret string, enabled
 	return err
 }
 
+// ConsumeTOTPStep records a just-accepted TOTP step and reports whether it was
+// fresh. It answers false when the step has already been spent — the same code, or
+// an earlier one, being presented a second time.
+//
+// The guard is in the statement, not in a read-then-write: two logins racing with
+// the same stolen code must not both find the old value and both proceed. The row
+// moves forward only when the new step is strictly greater, so exactly one of them
+// updates a row and the other sees nothing change.
+func (db *DB) ConsumeTOTPStep(ctx context.Context, userID string, step int64) (bool, error) {
+	res, err := db.ExecContext(ctx,
+		`UPDATE users SET totp_last_step = ? WHERE id = ?
+		   AND (totp_last_step IS NULL OR totp_last_step < ?)`,
+		step, userID, step)
+	if err != nil {
+		return false, err
+	}
+	n, _ := res.RowsAffected()
+	return n == 1, nil
+}
+
 // InboxID returns the user's Inbox project.
 func (db *DB) InboxID(ctx context.Context, userID string) (string, error) {
 	var id string

mkdocs.yml

@@ -44,8 +44,8 @@ extra_css:
 nav:
   - Home: index.md
   - Setting it up:
-      - Self-hosting: self-hosting.md
       - As a Rune: rune.md
+      - With Docker: self-hosting.md
       - Configuration: configuration.md
   - Using it:
       - Signing in: signing-in.md

site/index.html

@@ -856,8 +856,11 @@
 				</p>
 
 				<div class="actions">
-					<a class="button primary" href="https://kristianwind.github.io/verdande/self-hosting/">
-						Self-host it
+					<a class="button primary" href="https://kristianwind.github.io/verdande/rune/">
+						As a Rune
+					</a>
+					<a class="button" href="https://kristianwind.github.io/verdande/self-hosting/">
+						With Docker
 					</a>
 					<a class="button" href="https://github.com/kristianwind/verdande">Source</a>
 					<a class="button" href="https://kristianwind.github.io/verdande/">Documentation</a>
@@ -928,13 +931,33 @@
 				<div class="shots">
 					<figure class="shot">
 						<img
-							src="screenshots/board.webp"
-							alt="A project in board view: one column per section, with task cards showing due dates, labels and repetition."
+							src="screenshots/calendar-light.webp"
+							alt="A week in the calendar: timed tasks drawn to their length, a fifteen-minute stand-up short and a ninety-minute planning block tall, each on the day and at the time it is due."
 							width="1400"
 							height="900"
 							loading="lazy"
 						/>
-						<figcaption>Board view — one column per section.</figcaption>
+						<figcaption>The calendar draws a task to its length — drag its foot to change it.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/notes-shared-light.webp"
+							alt="Notes with a Shared with me group at the top of the list, holding a note somebody else shared, marked with whose it is, open on the right."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>A note shared with you, gathered under Shared with me.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/board.webp"
+							alt="A project in board view: one column per section, with task cards showing due dates, labels, an arrow to whoever a task is delegated to, and a snoozed card greyed at the foot of its column."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Board view — one column per section. A delegated card carries an arrow to whoever has it; a snoozed one greys at the foot.</figcaption>
 					</figure>
 					<figure class="shot">
 						<img
@@ -969,12 +992,22 @@
 					<figure class="shot">
 						<img
 							src="screenshots/themes.webp"
-							alt="The settings page showing five themes as swatches and, below them, four looks written in the typeface each one selects."
+							alt="The settings page showing six themes as swatches and, below them, four looks written in the typeface each one selects."
 							width="1400"
 							height="900"
 							loading="lazy"
 						/>
-						<figcaption>Five themes and four looks: how bright, and how it reads.</figcaption>
+						<figcaption>Six themes and four looks: how bright, and how it reads.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/notes-charcoal.webp"
+							alt="Notes in the Charcoal theme: a warm near-black modelled on Apple Notes, the note list on the left and a note open on the right, with amber where the accent green usually is."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Charcoal — the newest theme, a warm near-black after Apple Notes, amber for the accent.</figcaption>
 					</figure>
 					<figure class="shot">
 						<img
@@ -989,12 +1022,12 @@
 					<figure class="shot">
 						<img
 							src="screenshots/delegated.webp"
-							alt="Waiting on others: tasks that have been handed to somebody else, grouped under the person who has them."
+							alt="Waiting on others: tasks that have been handed to somebody else, grouped under the person who has them, each row carrying an arrow to that person."
 							width="1400"
 							height="900"
 							loading="lazy"
 						/>
-						<figcaption>Waiting on others — grouped by who has it.</figcaption>
+						<figcaption>Waiting on others — grouped by who has it, each marked with an arrow to them.</figcaption>
 					</figure>
 					<figure class="shot">
 						<img
@@ -1017,6 +1050,75 @@
 						<figcaption>Integrations: your mailbox, your calendar feed, your address.</figcaption>
 					</figure>
 				</div>
+
+				<h3 class="sub">Six themes, the same day</h3>
+				<p class="muted">
+					Three dark and three light — a property of the screen you are sitting at, a
+					laptop in the sun and a monitor in a dark room wanting different answers. The
+					typeface and how tight it sits are chosen apart from them.
+				</p>
+				<div class="shots">
+					<figure class="shot">
+						<img
+							src="screenshots/theme-northern-lights.webp"
+							alt="The Today view in the Northern lights theme: dark, with a green accent."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Northern lights — dark, a green accent. The default.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/theme-charcoal.webp"
+							alt="The Today view in the Charcoal theme: a warm near-black modelled on Apple Notes, with amber for the accent."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Charcoal — a warm near-black after Apple Notes, amber accent.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/theme-dusk.webp"
+							alt="The Today view in the Dusk theme: dark and warm, with an amber accent."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Dusk — dark and warm.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/theme-daylight.webp"
+							alt="The Today view in the Daylight theme: light and coolly neutral."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Daylight — light and coolly neutral.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/theme-paper.webp"
+							alt="The Today view in the Paper theme: light and warm, like paper."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Paper — light and warm, like paper.</figcaption>
+					</figure>
+					<figure class="shot">
+						<img
+							src="screenshots/theme-contrast.webp"
+							alt="The Today view in the Contrast theme: black on white, for bright light."
+							width="1400"
+							height="900"
+							loading="lazy"
+						/>
+						<figcaption>Contrast — black on white, for bright light.</figcaption>
+					</figure>
+				</div>
 			</section>
 
 			<section id="features">
@@ -1050,8 +1152,8 @@
 						<h3>Repeats, and says so in words</h3>
 						<p>
 							Recurring tasks are RRULE underneath and "every other Tuesday" on the
-							screen. Reminders are absolute or relative, and go out to the devices
-							you have allowed them on.
+							screen. Reminders are absolute or relative, and go out as Web Push to
+							an iPhone or a Mac you have allowed them on.
 						</p>
 					</div>
 					<div class="cell">
@@ -1063,12 +1165,47 @@
 							written about it. Archive what is done with it; the bin is for mistakes.
 						</p>
 					</div>
+					<div class="cell">
+						<h3>Share a note, or a page</h3>
+						<p>
+							Hand a single note to a person — to read or to edit — without standing up
+							a project for it. Notes other people share with you gather under
+							<em>Shared with me</em>, each marked with whose it is. File it in a project
+							instead and everyone who can read the project reads the note.
+						</p>
+					</div>
+					<div class="cell">
+						<h3>How long it takes</h3>
+						<p>
+							A task can carry a length, and the calendar draws it to scale. Drag the
+							foot of a task to make it longer or shorter, or drag its body to another
+							day or time — the length comes along.
+						</p>
+					</div>
 					<div class="cell">
 						<h3>Waiting on others</h3>
 						<p>
 							What you have handed to somebody else, on its own page, grouped under
-							the person who has it. The thing a shared list stops being able to tell
-							you the moment it is shared.
+							the person who has it — and marked where you meet it too, with an arrow
+							out of your hands, so a list reads at a glance as which tasks are yours
+							and which you are waiting on.
+						</p>
+					</div>
+					<div class="cell">
+						<h3>Snooze it out of the way</h3>
+						<p>
+							Park a task to this evening, tomorrow, next week, or a moment you pick.
+							It greys and sinks to the bottom of the list until then, and comes back
+							by itself — without touching when it is actually due.
+						</p>
+					</div>
+					<div class="cell">
+						<h3>Holds through a drop</h3>
+						<p>
+							A tunnel, a lift, a base station handing over — the app does not go
+							blank when the signal does. A save you make rides out a few seconds of
+							no connection and goes through when it comes back, and a reload opens
+							from what it last saw rather than the browser's offline page.
 						</p>
 					</div>
 				</div>
@@ -1105,9 +1242,10 @@
 						<h3>Your mail, as an inbox</h3>
 						<p>
 							Star a mail in Gmail, or flag one over IMAP in iCloud or Fastmail, and
-							it becomes a task. Forward one to your own address instead and the
-							subject is parsed like anything else you type. One way: unstarring it
-							later does nothing to the task you made.
+							it becomes a task — and the star or flag comes off once it has, so a
+							starred inbox empties as the tasks are made instead of only filling up.
+							Forward one to your own address instead and the subject is parsed like
+							anything else you type.
 						</p>
 					</div>
 					<div class="cell">
@@ -1188,6 +1326,42 @@
 					<a href="https://github.com/kristianwind/verdande/releases">the releases page</a>.
 				</p>
 				<ul class="lately">
+					<li>
+						<span class="ver">0.42</span>
+						A sixth theme, <strong>Charcoal</strong> — a warm near-black after Apple
+						Notes, with amber for the accent. And the app now holds through a short
+						network drop: a save rides out a few seconds of no signal, and a reload
+						opens from what it last saw rather than the browser's offline page.
+					</li>
+					<li>
+						<span class="ver">0.42</span>
+						A starred Gmail message loses its star once it has become a task, the way
+						a flagged IMAP mail already did — so a starred inbox empties itself as the
+						tasks are made instead of only filling up.
+					</li>
+					<li>
+						<span class="ver">0.42</span>
+						Notes read as three lines, the last one the project they are filed under;
+						the calendar lightened to pastel days with today marked at the top; and
+						two-factor set-up shows a QR code to scan.
+					</li>
+					<li>
+						<span class="ver">0.41</span>
+						A task you have delegated is marked where you meet it, not only on the
+						"Waiting on others" page. A task can be snoozed to the bottom of the list
+						until a moment you choose, and comes back by itself.
+					</li>
+					<li>
+						<span class="ver">0.41</span>
+						Web Push reminders reach an iPhone and a Mac again, and every dated task
+						now shows up in a calendar you have subscribed to — not only the timed ones.
+					</li>
+					<li>
+						<span class="ver">0.41</span>
+						The calendar draws each task to its length: drag the foot to resize, or the
+						body to move it. A single note can be shared with one person, and a
+						<code>[[note]]</code> is a link you follow inline.
+					</li>
 					<li>
 						<span class="ver">0.34</span>
 						Sections can be dragged into the order the work actually happens in. The
@@ -1199,21 +1373,6 @@
 						or drag in, a source view, and a copy button on code blocks. Search
 						stopped answering by date and started answering by relevance.
 					</li>
-					<li>
-						<span class="ver">0.32</span>
-						A calendar of its own as a menu item, with a read-only Google calendar
-						that can be laid over it.
-					</li>
-					<li>
-						<span class="ver">0.31</span>
-						Mailboxes over IMAP, so flagging a mail in iCloud or Fastmail makes a
-						task — not only Gmail.
-					</li>
-					<li>
-						<span class="ver">0.30</span>
-						An installation count that says exactly what it sends, and can be turned
-						off in one click.
-					</li>
 				</ul>
 			</section>
 

web/e2e/smoke.spec.js

@@ -86,6 +86,29 @@ test('hurtig tilføjelse opretter en opgave, og den kan lukkes', async ({ page }
 	expect(trouble).toEqual([]);
 });
 
+test('en URL i en opgave bliver et klikbart link, og resten åbner opgaven', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/');
+
+	const box = page.getByLabel('Ny opgave');
+	// The URL is one token, so the parser leaves it in the title; "i dag" is what it
+	// takes. The link is made at display time — the stored title is still plain text.
+	await box.fill('læs https://example.com/artikel i dag');
+	await box.press('Enter');
+
+	const row = page.locator('.row').filter({ hasText: 'læs' });
+	const link = row.getByRole('link', { name: 'https://example.com/artikel' });
+	await expect(link).toHaveAttribute('href', 'https://example.com/artikel');
+	await expect(link).toHaveAttribute('rel', /noopener/);
+
+	// Clicking the plain part of the title still opens the task; only the link is
+	// carved out. Aimed at the top-left, over "læs", not the URL in the middle.
+	await row.locator('.content').click({ position: { x: 3, y: 3 } });
+	await expect(page.getByRole('complementary', { name: 'Opgave' })).toBeVisible();
+
+	expect(trouble).toEqual([]);
+});
+
 test('hvert link i sidebjælken fører et sted hen', async ({ page }) => {
 	const trouble = watchForTrouble(page);
 	await page.goto('/');
@@ -127,6 +150,32 @@ test('hvert link i sidebjælken fører et sted hen', async ({ page }) => {
 	expect(trouble).toEqual([]);
 });
 
+test('en opgave kan slumres og hentes frem igen', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/');
+
+	// "i dag" is parsed as the due date, so the task is named "Alfa" and shows here.
+	const box = page.getByLabel('Ny opgave');
+	await box.fill('Alfa i dag');
+	await box.press('Enter');
+
+	// Snooze it to tomorrow from its drawer.
+	await page.getByText('Alfa', { exact: true }).click();
+	const drawer = page.getByRole('complementary', { name: 'Opgave' });
+	await drawer.getByRole('button', { name: 'I morgen' }).click();
+
+	// The row greys — it carries the snoozed class and a "slumret til" mark.
+	const alfa = page.locator('.row', { hasText: 'Alfa' });
+	await expect(alfa).toHaveClass(/snoozed/);
+	await expect(alfa.locator('.snooze-mark')).toBeVisible();
+
+	// The drawer now offers to wake it, and waking takes the grey off.
+	await drawer.getByRole('button', { name: 'Væk nu' }).click();
+	await expect(alfa).not.toHaveClass(/snoozed/);
+
+	expect(trouble).toEqual([]);
+});
+
 test('en opgave kan åbnes og redigeres', async ({ page }) => {
 	const trouble = watchForTrouble(page);
 	await page.goto('/');
@@ -196,6 +245,38 @@ test('hver fane under indstillinger renderer', async ({ page }) => {
 	expect(trouble).toEqual([]);
 });
 
+test('menu- og brødtekststørrelse sættes hver for sig og overlever en genindlæsning', async ({
+	page
+}) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/indstillinger');
+
+	// Two independent knobs under Udseende — the sidebar's size, and the body text's.
+	await page.getByLabel('Menu', { exact: true }).selectOption('large');
+	await page.getByLabel('Brødtekst', { exact: true }).selectOption('xl');
+	await expect(page.getByLabel('Menu', { exact: true })).toHaveValue('large');
+
+	const attrs = () =>
+		page.evaluate(() => [
+			document.documentElement.dataset.menuSize,
+			document.documentElement.dataset.textSize
+		]);
+	expect(await attrs()).toEqual(['large', 'xl']);
+
+	// They live in localStorage like the theme, so they survive a reload — and are
+	// applied before first paint, so the picker comes back showing the saved choice.
+	await page.reload();
+	expect(await attrs()).toEqual(['large', 'xl']);
+	await expect(page.getByLabel('Menu', { exact: true })).toHaveValue('large');
+
+	// Put them back, so the shared account does not leak a size into other tests.
+	await page.getByLabel('Menu', { exact: true }).selectOption('default');
+	await page.getByLabel('Brødtekst', { exact: true }).selectOption('default');
+	expect(await attrs()).toEqual([undefined, undefined]);
+
+	expect(trouble).toEqual([]);
+});
+
 /**
  * The PWA's own files. Both of the bugs found last in this project were of this
  * kind — a manifest promising icons that were never generated — and they are
@@ -217,11 +298,65 @@ test('manifestet og service workeren findes, og ikonerne findes også', async ({
 	const appleIcon = await request.get('/apple-touch-icon.png');
 	expect(appleIcon.ok(), 'apple-touch-icon.png findes ikke').toBeTruthy();
 
-	// The service worker is what Web Push needs; without it a subscription cannot
-	// be created at all.
-	const worker = await request.get('/sw.js');
+	// The service worker is what Web Push needs — and, since it also caches, what
+	// carries the app through a short network drop. SvelteKit serves it under this
+	// name and registers it itself; the old hand-registered /sw.js is gone.
+	const worker = await request.get('/service-worker.js');
 	expect(worker.ok()).toBeTruthy();
-	expect(await worker.text()).toContain("addEventListener('push'");
+	// The source is minified, so the quotes around the event names are whatever the
+	// minifier chose — match either kind rather than one it might change under us.
+	const source = await worker.text();
+	expect(source).toMatch(/addEventListener\(['"`]push['"`]/);
+	expect(source).toMatch(/addEventListener\(['"`]fetch['"`]/);
+});
+
+/**
+ * The app survives a network drop: reloaded with the network cut, it opens from
+ * the cache and still shows the tasks it last saw, instead of the browser's own
+ * "you are offline" page.
+ *
+ * This is the whole point of the service worker's cache — not offline authoring,
+ * which the app does not claim, but a reload through a tunnel or a handover coming
+ * back to the app rather than to a dead tab. The retry in api.js covers the write
+ * side of the same drop; this covers the read side.
+ */
+test.describe('med service worker', () => {
+	// The rest of the suite blocks the worker (see playwright.config.js); this one
+	// test is about the worker, so it turns it back on for its own context.
+	test.use({ serviceWorkers: 'allow' });
+
+	test('appen overlever et netværksudfald og åbner fra cachen', async ({ page, context }) => {
+	// First load, online: the worker installs, and once it controls the page the
+	// shell and the reads it serves are in the cache.
+	await page.goto('/');
+	await expect(page.getByRole('link', { name: 'I dag' })).toBeVisible();
+
+	// Wait until the worker actually controls this page. Until it does, a reload
+	// still goes to the network and the test proves nothing — the first load
+	// registers the worker but the page that triggered the install is not itself
+	// controlled until it activates and claims.
+	await page.waitForFunction(() => navigator.serviceWorker?.controller != null, null, {
+		timeout: 15000
+	});
+
+	// A controlled reload, still online: now the navigation and its API reads pass
+	// through the worker and land in the cache, ready for the drop.
+	await page.reload();
+	await expect(page.getByRole('link', { name: 'I dag' })).toBeVisible();
+
+	// The network is gone.
+	await context.setOffline(true);
+	try {
+		await page.reload();
+		// The shell came from the cache — the sidebar is here, not a browser error
+		// page — and so did the task list the app renders into it.
+		await expect(page.getByRole('link', { name: 'I dag' })).toBeVisible({ timeout: 15000 });
+		await expect(page.getByRole('link', { name: 'Indbakke' })).toBeVisible();
+	} finally {
+		// Never leave the shared context offline for whatever test runs next.
+		await context.setOffline(false);
+	}
+	});
 });
 
 /**
@@ -290,9 +425,9 @@ test('en projektgruppe kan foldes, fyldes og slettes uden at tage projekterne me
 	await sidebar.getByLabel('Gruppens navn').fill('Arbejde');
 	await sidebar.getByLabel('Gruppens navn').press('Enter');
 
-	// The name is a link to the group's own page; the chevron beside it is a
+	// The name is a link to the group's own page; the folder icon beside it is a
 	// separate button that folds. Two intentions, two targets — the single one they
-	// used to share could only ever serve the smaller.
+	// used to share could only ever serve the smaller, and neither wears an arrow.
 	//
 	// `exact` on the link, because a group's name is a user-chosen word that can
 	// turn up inside another control's name, and Playwright matches an accessible
@@ -302,19 +437,20 @@ test('en projektgruppe kan foldes, fyldes og slettes uden at tage projekterne me
 	await expect(heading).toBeVisible();
 	await expect(sidebar.getByText('Træk et projekt herop')).toBeVisible();
 
-	// A group's name must be readable in full, and must start where a project's
-	// name starts.
+	// A group's name must be readable in full, and must line up with the other
+	// headings — not with the projects filed under it.
 	//
-	// Both halves are here because both were once broken at the same time and for
-	// different reasons. "Omdøb" and "Slet" sat in the flow reserving their width
-	// even while invisible, so ARBEJDE was drawn as "ARBE"; and the fold chevron
-	// sat before the name, pushing a group 22px further in than the projects it
-	// contains — so a group read as if it were filed under them. Every assertion
-	// in this file passed through both, because both buttons still worked.
+	// The clipping half is here because it was once broken: "Omdøb" and "Slet" sat
+	// in the flow reserving their width even while invisible, so ARBEJDE was drawn
+	// as "ARBE". The alignment half changed meaning with the redesign: a group now
+	// carries a section icon just like "Projekter" above it, and belongs to that
+	// heading tier rather than to the project rows below.
 	const shape = await sidebar.locator('.folder-head').evaluate((el) => {
 		const link = el.querySelector('h2 a');
-		const name = { ...link.querySelector('.dot').getBoundingClientRect().toJSON() };
-		// The last child of the link is the name itself; the dot is a span before it.
+		// The leading mark is the section icon in its own fold button, the same
+		// folder/funnel/tag glyph the system headings carry — a group and a section
+		// read identically, and the icon sits before the name, not inside the link.
+		const name = { ...el.querySelector('.head-icon').getBoundingClientRect().toJSON() };
 		return {
 			clipped: link.scrollWidth > link.clientWidth + 1,
 			left: name.left,
@@ -326,17 +462,17 @@ test('en projektgruppe kan foldes, fyldes og slettes uden at tage projekterne me
 	expect(shape.clipped, 'gruppens navn bliver klippet').toBe(false);
 	expect(shape.count, 'navnet og tallet overlapper').toBeGreaterThanOrEqual(shape.right);
 
-	// Measured dot to dot, not box to box: both rows begin with the same coloured
-	// mark, and it is the only thing in them that means the same on both sides.
-	// Comparing the group's inner link with the project's outer box reported the
-	// row's own padding as a misalignment.
-	const projectLeft = await sidebar
-		.getByRole('link', { name: 'Regnskab' })
-		.evaluate((el) => el.querySelector('.dot').getBoundingClientRect().left);
+	// A group is a heading, not a project row: it belongs to the same tier as
+	// "Projekter" and the other system sections — icon, bold name, no arrow — and
+	// starts where they start, not where the projects filed under it do. Measured
+	// icon to icon, the one mark both headings share.
+	const sectionLeft = await sidebar
+		.getByRole('heading', { name: 'Projekter' })
+		.evaluate((el) => el.querySelector('.head-icon').getBoundingClientRect().left);
 	expect(
-		Math.abs(shape.left - projectLeft),
-		`gruppen starter ${Math.round(shape.left - projectLeft)}px fra projekterne`
-	).toBeLessThanOrEqual(2);
+		Math.abs(shape.left - sectionLeft),
+		`gruppen starter ${Math.round(shape.left - sectionLeft)}px fra sektionsoverskrifterne`
+	).toBeLessThanOrEqual(4);
 
 	// Dragged in, then dragged back out onto "Projekter" — which is the reason
 	// that heading is a drop target at all: with every project filed away there
@@ -359,18 +495,13 @@ test('en projektgruppe kan foldes, fyldes og slettes uden at tage projekterne me
 		'false'
 	);
 
-	// En foldet gruppe står med sin chevron fremme permanent, og den lå oven i
-	// prikken med et felt i --surface bag sig — en lys firkant ud for navnet på
-	// den sænkede bjælke, hele tiden. Nu tones prikken ud i stedet, så der er
-	// ingenting at male henover den med.
-	const chevron = await sidebar
-		.locator('.folder-head .chevron-button')
-		.evaluate((el) => ({
-			background: getComputedStyle(el).backgroundColor,
-			dot: getComputedStyle(el.closest('.folder-head').querySelector('.group-dot')).opacity
-		}));
-	expect(chevron.background, 'chevronen har en firkant bag sig').toBe('rgba(0, 0, 0, 0)');
-	expect(chevron.dot, 'prikken ligger stadig under chevronen').toBe('0');
+	// The fold control is the bare folder icon now — no chevron, and no --surface
+	// field behind it, so a folded group leaves no pale square beside its name on
+	// the sunken bar.
+	const foldBg = await sidebar
+		.locator('.folder-head .fold-icon')
+		.evaluate((el) => getComputedStyle(el).backgroundColor);
+	expect(foldBg, 'foldeknappen har en firkant bag sig').toBe('rgba(0, 0, 0, 0)');
 
 	await sidebar.getByRole('button', { name: /^Fold Arbejde/ }).click();
 
@@ -386,11 +517,7 @@ test('en projektgruppe kan foldes, fyldes og slettes uden at tage projekterne me
 	// button on click.
 	await expect(sidebar.getByLabel('Gruppens navn')).toBeVisible();
 	await sidebar.getByLabel('Gruppens navn').press('Enter');
-
-	const painted = await sidebar
-		.locator('.folder-head .group-dot')
-		.evaluate((el) => getComputedStyle(el).backgroundColor);
-	expect(painted, 'gruppens prik fik ikke sin farve').not.toBe('rgba(0, 0, 0, 0)');
+	await expect(sidebar.getByRole('link', { name: 'Arbejde', exact: true })).toBeVisible();
 
 	// The heading itself is *not* indented — only what is filed under it. A heading
 	// that starts further in than the rows above it says the heading is inside
@@ -404,10 +531,10 @@ test('en projektgruppe kan foldes, fyldes og slettes uden at tage projekterne me
 		.evaluate((el) => el.getBoundingClientRect().left + parseFloat(getComputedStyle(el).paddingLeft));
 	expect(headLeft, 'gruppehovedet er rykket ind').toBeLessThanOrEqual(looseLeft);
 
-	// A project inside a group starts further in than a row outside one. Measured
-	// rather than asserted on a class, because indentation is a fact about where
-	// the row's contents land — and measured at the *content* edge, not the box:
-	// the indent is padding, so the element's own left edge does not move.
+	// A project sits at the same left margin whether or not it is in a group — one
+	// straight edge down the sidebar, with the bold heading doing the grouping the
+	// indent used to. Measured at the *content* edge, not the box, because what the
+	// eye follows is where the text lands.
 	await sidebar.getByRole('link', { name: 'Regnskab' }).dragTo(heading);
 	const contentLeft = (el) =>
 		el.getBoundingClientRect().left + parseFloat(getComputedStyle(el).paddingLeft);
@@ -415,7 +542,10 @@ test('en projektgruppe kan foldes, fyldes og slettes uden at tage projekterne me
 		sidebar.locator('.folder > a').first().evaluate(contentLeft),
 		sidebar.locator('.views a').first().evaluate(contentLeft)
 	]);
-	expect(inside, 'et projekt i en gruppe er ikke rykket ind').toBeGreaterThan(outside);
+	expect(
+		Math.abs(inside - outside),
+		'et projekt i en gruppe står ikke i flugt med de faste visninger'
+	).toBeLessThan(2);
 
 	await sidebar
 		.getByRole('link', { name: 'Regnskab' })
@@ -489,8 +619,13 @@ test('en opgave kan trækkes ned i en tom sektion, og en fejlet indlæsning sige
 	await expect(section.getByText('brænde kaffe')).toBeVisible();
 	await expect(page.locator('.toast')).toHaveCount(0);
 
-	// A load that fails says so, and offers to try again.
-	await page.route('**/api/v1/projects/*', (r) => r.abort());
+	// A load that fails with a server error says so at once and offers to try again.
+	// A 500 is the server answering, not a dropped connection, so it is not a blip to
+	// wait out — it is not retried, and the message is immediate. (A dropped
+	// connection now retries for a few seconds first; that is the self-heal test.)
+	await page.route('**/api/v1/projects/*', (r) =>
+		r.fulfill({ status: 500, contentType: 'application/json', body: '{"code":"internal_error"}' })
+	);
 	await page.reload();
 	await expect(page.getByText('Serveren svarede ikke')).toBeVisible();
 	await expect(page.getByRole('button', { name: 'Prøv igen' })).toBeVisible();
@@ -501,6 +636,52 @@ test('en opgave kan trækkes ned i en tom sektion, og en fejlet indlæsning sige
 	expect(trouble.filter((t) => !t.includes('projects'))).toEqual([]);
 });
 
+/**
+ * A save made during a short drop is not lost to it.
+ *
+ * This is the whole of what "offline" means here: not a cache to work in with no
+ * server, but a save that rides out a few seconds of no connection and goes through
+ * when it comes back — with a quiet "reconnecting" while it waits, and no error and
+ * no reverted change once it heals. A drop that outlasts the retry window is a real
+ * outage and takes the normal error path; that is not this test.
+ */
+test('en kort netaudsætning under en handling genoprettes af sig selv', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/');
+
+	// Wait for the app to finish loading before cutting the line — `goto` resolves at
+	// the load event, but the data load runs after hydration, and aborting that would
+	// test a cold start, not a blip mid-use.
+	const box = page.getByLabel('Ny opgave');
+	await expect(box).toBeVisible();
+
+	// The app is loaded and online. Now the connection drops — every call fails, the
+	// way it does in a tunnel, rather than one endpoint erroring.
+	let down = true;
+	await page.route('**/api/v1/**', (route) => (down ? route.abort() : route.continue()));
+
+	// A task captured during the drop. Its save fails on the network and starts
+	// retrying rather than giving up.
+	await box.fill('under et udfald');
+	await box.press('Enter');
+
+	// The quiet pill, once the retry has lasted long enough to be worth showing.
+	await expect(page.locator('.netstatus')).toBeVisible();
+
+	// The drop ends. The retry goes through on its own and the pill leaves — no
+	// error, nothing toasted as failed.
+	down = false;
+	await expect(page.locator('.netstatus')).toHaveCount(0, { timeout: 10000 });
+	await expect(page.locator('.toast')).toHaveCount(0);
+
+	// And the save landed: an undated quick capture goes to the Inbox, and there it
+	// is, saved across the drop rather than lost to it.
+	await page.getByRole('link', { name: /Indbakke/ }).click();
+	await expect(page.getByText('under et udfald')).toBeVisible({ timeout: 10000 });
+
+	expect(trouble).toEqual([]);
+});
+
 /**
  * A task can be dragged onto another day, and onto another project.
  *
@@ -876,6 +1057,8 @@ test('en rolle kan rettes uden at fjerne personen', async ({ browser, page }) =>
 	const context = await browser.newContext({ storageState: { cookies: [], origins: [] } });
 	const andreas = await context.newPage();
 	await andreas.goto(link);
+	// Typed in lower case on purpose: the instance capitalises a name on the way
+	// in, so from here on this person is "Andreas" everywhere they are shown.
 	await andreas.getByLabel('Navn', { exact: true }).fill('andreas');
 	await andreas.getByLabel(/Adgangskode/).fill('et langt kodeord til test');
 	await andreas.getByRole('button', { name: 'Opret konto' }).click();
@@ -894,7 +1077,7 @@ test('en rolle kan rettes uden at fjerne personen', async ({ browser, page }) =>
 	await page.reload();
 	await projectAction(page, /Delt/);
 	await expect(page.getByText('Ejer')).toBeVisible();
-	await page.getByLabel('Rolle for andreas').selectOption('editor');
+	await page.getByLabel('Rolle for Andreas').selectOption('editor');
 
 	await andreas.reload();
 	await expect(andreas.getByLabel('Ny opgave')).toBeVisible();
@@ -907,11 +1090,11 @@ test('en rolle kan rettes uden at fjerne personen', async ({ browser, page }) =>
 	await page.getByLabel('Ny opgave').press('Enter');
 	await page.getByText('brænde kaffe', { exact: true }).click();
 	const drawer = page.getByRole('complementary', { name: 'Opgave' });
-	await drawer.getByLabel('Ansvarlig').selectOption({ label: 'andreas' });
+	await drawer.getByLabel('Ansvarlig').selectOption({ label: 'Andreas' });
 	await page.keyboard.press('Escape');
 
 	const row = page.locator('.row').filter({ hasText: 'brænde kaffe' });
-	await expect(row.getByTitle('Ansvarlig: andreas')).toBeVisible();
+	await expect(row.getByTitle('Uddelegeret til Andreas')).toBeVisible();
 	// And not on a task that is nobody's.
 	await page.getByLabel('Ny opgave').fill('min egen');
 	await page.getByLabel('Ny opgave').press('Enter');
@@ -1202,8 +1385,18 @@ test('kalenderen viser Googles begivenheder over egne opgaver, og kun opgaven ka
 	await expect(page.locator(`[data-date="${next}"] .tevent`).getByText('vande blomster')).toBeVisible();
 	await expect(band.getByText('vande blomster')).toBeHidden();
 	// The events stayed where they were; a rescheduled task moves nothing else.
-	await expect(cell.locator('.tevent')).toHaveCount(1);
-	await expect(band.locator('.event')).toHaveCount(1);
+	//
+	// Named, not counted. A raw `.tevent` count here assumes this day holds nothing
+	// but this test's own events — and it does not: the suite shares one database,
+	// so an earlier test that drags a task across a month boundary can leave a timed
+	// task on this very day, and a timed task is a `.tevent` too. Counting them all
+	// made this pass alone and fail in the full run, on whatever date the arithmetic
+	// happened to land the two tests on the same cell. Asserting the meeting stayed
+	// and the task left is the thing the test actually means, and it is true however
+	// full somebody else left the day.
+	await expect(cell.locator('.tevent').filter({ hasText: 'Bestyrelsesmøde' })).toHaveCount(1);
+	await expect(cell.locator('.tevent').filter({ hasText: 'vande blomster' })).toHaveCount(0);
+	await expect(band.locator('.event').filter({ hasText: 'Feriedag' })).toHaveCount(1);
 
 	expect(trouble).toEqual([]);
 });
@@ -1215,6 +1408,69 @@ test('kalenderen viser Googles begivenheder over egne opgaver, og kun opgaven ka
  * thing this view was before anything was laid over it — and a Google account that
  * is not there must not take it down with it.
  */
+test('en opgaves længde kan trækkes længere på kalenderen', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/');
+
+	// A timed task today at ten, half an hour long. Today, so the week opens on it
+	// without paging, and ten is inside the hours the grid draws by default.
+	const today = await page.evaluate(() => {
+		const d = new Date();
+		return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+	});
+	const id = await page.evaluate(async (day) => {
+		const r = await fetch('/api/v1/tasks', {
+			method: 'POST',
+			credentials: 'include',
+			headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+			body: JSON.stringify({
+				content: 'Møde med Anders',
+				due_date: day,
+				due_time: '10:00',
+				duration_min: 30
+			})
+		});
+		return (await r.json()).id;
+	}, today);
+
+	await page.goto('/kalender');
+	await page.getByRole('button', { name: 'Uge', exact: true }).click();
+
+	const chip = page
+		.locator(`[data-date="${today}"] .tevent.task`)
+		.filter({ hasText: 'Møde med Anders' });
+	await expect(chip).toBeVisible();
+	const before = await chip.evaluate((el) => el.getBoundingClientRect().height);
+
+	// Drag the foot of the task down a good stretch. It should grow, both on screen
+	// and in what the server stores — a resize is a change of length, not of time.
+	const box = await chip.boundingBox();
+	await page.mouse.move(box.x + box.width / 2, box.y + box.height - 2);
+	await page.mouse.down();
+	await page.mouse.move(box.x + box.width / 2, box.y + box.height + 130, { steps: 6 });
+	await page.mouse.up();
+
+	await expect
+		.poll(async () =>
+			page.evaluate(async (tid) => {
+				const r = await fetch('/api/v1/tasks/' + tid, {
+					credentials: 'include',
+					headers: { 'Sec-Fetch-Site': 'same-origin' }
+				});
+				return (await r.json()).duration_min;
+			}, id)
+		)
+		.toBeGreaterThan(30);
+
+	// And the chip is taller than it was, so the length is something you can see.
+	await expect.poll(async () => chip.evaluate((el) => el.getBoundingClientRect().height)).toBeGreaterThan(before);
+
+	// The time did not move: it is still a ten o'clock task.
+	await expect(chip.locator('.at')).toHaveText('10:00');
+
+	expect(trouble).toEqual([]);
+});
+
 test('kalenderen virker uden en forbundet Google-konto', async ({ page }) => {
 	const trouble = watchForTrouble(page);
 	await page.goto('/kalender');
@@ -1366,9 +1622,18 @@ test('en gruppe er en side med sine projekter, en beskrivelse og filer', async (
 	// Into the group, then onto its page — which is what the heading is a link to
 	// now. The chevron beside it still folds; they are two intentions and the old
 	// single target could only serve the smaller one.
-	await sidebar
-		.getByRole('link', { name: 'Drejebænk' })
-		.dragTo(sidebar.getByRole('link', { name: 'Værksted' }));
+	//
+	// The drop is retried until the project actually nests under the group: a native
+	// HTML5 drag occasionally does not register the first time under CI load, and a
+	// single dragTo then leaves the group empty and the page assertion failing for a
+	// reason that has nothing to do with what the test is about.
+	const nested = sidebar.locator('.folder > a').filter({ hasText: 'Drejebænk' });
+	await expect(async () => {
+		await sidebar
+			.getByRole('link', { name: 'Drejebænk' })
+			.dragTo(sidebar.getByRole('link', { name: 'Værksted' }));
+		await expect(nested).toHaveCount(1, { timeout: 1000 });
+	}).toPass({ timeout: 10000 });
 	await sidebar.getByRole('link', { name: 'Værksted' }).click();
 
 	await expect(page.getByRole('heading', { name: 'Værksted', level: 1 })).toBeVisible();
@@ -1819,7 +2084,12 @@ test('en passkey kan registreres og logges ind med', async ({ browser, browserNa
 	// Now sign out and back in with it. No email typed: the device knows which
 	// account its key belongs to, which is also why this page cannot be used to
 	// find out who has an account here.
-	await page.getByRole('navigation', { name: 'Hovedmenu' }).getByText('Log ud').click();
+	// Signing out asks first now: one click arms it, a second within a few seconds
+	// does it. The whole account row is the button; its label changes to the prompt.
+	const signOut = page.getByRole('navigation', { name: 'Hovedmenu' }).locator('.user');
+	await signOut.click();
+	await expect(signOut).toContainText('Tryk igen for at logge ud');
+	await signOut.click();
 	// `exact`, because "Log ind" is a substring of "Log ind med en passkey" and
 	// Playwright matches an accessible name loosely unless told otherwise.
 	await expect(page.getByRole('button', { name: 'Log ind', exact: true })).toBeVisible();
@@ -2430,8 +2700,9 @@ test('en note kan deles med et projekts folk, og tages tilbage igen', async ({ p
 	await page.keyboard.type('Fælles aftale om leveringen');
 	await page.getByRole('textbox', { name: 'Notens tekst' }).blur();
 
-	// Shared by being filed in a project. Not an access list of its own.
-	await page.getByLabel('Del i').selectOption({ label: 'Delenoter' });
+	// Filing it in a project — the controls live in the Del popover in the footer.
+	await page.locator('.sharewrap > button').click();
+	await page.getByLabel('Læg i projekt').selectOption({ label: 'Delenoter' });
 	await expect(page.getByText('delt med projektets folk')).toBeVisible();
 
 	// And it is really there, not merely labelled: the project's own page shows it.
@@ -2441,7 +2712,8 @@ test('en note kan deles med et projekts folk, og tages tilbage igen', async ({ p
 	// Taken back out, it is the author's alone again.
 	await sidebar.getByRole('link', { name: 'Noter', exact: true }).click();
 	await page.getByRole('button', { name: /Fælles aftale/ }).click();
-	await page.getByLabel('Del i').selectOption({ label: 'Kun mig' });
+	await page.locator('.sharewrap > button').click();
+	await page.getByLabel('Læg i projekt').selectOption({ label: 'Intet projekt' });
 	await expect(page.getByText('din igen')).toBeVisible();
 
 	await sidebar.getByRole('link', { name: 'Delenoter' }).click();
@@ -2450,6 +2722,68 @@ test('en note kan deles med et projekts folk, og tages tilbage igen', async ({ p
 	expect(trouble).toEqual([]);
 });
 
+test('en note kan deles med en person direkte, og dukker op hos dem', async ({ browser, page }) => {
+	const trouble = watchForTrouble(page);
+
+	// Somebody to share with: a second account on the instance, made the ordinary
+	// way. The candidate list is drawn when the note opens, so they must exist
+	// before it does.
+	await page.goto('/indstillinger/brugere');
+	await page.getByLabel('E-mailadresse').fill('sofie@example.dk');
+	await page.getByRole('button', { name: 'Send invitation' }).click();
+	const link = await page.locator('.link-out').textContent();
+
+	const sofieCtx = await browser.newContext({ storageState: { cookies: [], origins: [] } });
+	const sofie = await sofieCtx.newPage();
+	await sofie.goto(link);
+	await sofie.getByLabel('Navn', { exact: true }).fill('Sofie');
+	await sofie.getByLabel(/Adgangskode/).fill('et langt kodeord til test');
+	await sofie.getByRole('button', { name: 'Opret konto' }).click();
+	await expect(sofie.getByRole('navigation', { name: 'Hovedmenu' })).toBeVisible();
+
+	// The owner writes a note and hands it to Sofie, as a reader.
+	const sidebar = page.getByRole('navigation', { name: 'Hovedmenu' });
+	await sidebar.getByRole('link', { name: 'Noter', exact: true }).click();
+	await page.getByRole('button', { name: 'Ny note' }).click();
+	await page.getByRole('textbox', { name: 'Notens tekst' }).click();
+	await page.keyboard.type('Ferieplan for hele holdet');
+	await page.getByRole('textbox', { name: 'Notens tekst' }).blur();
+
+	// Sharing lives in a popover behind the Del button in the footer.
+	await page.locator('.sharewrap > button').click();
+	const share = page.locator('.sharepanel');
+	await expect(share).toBeVisible();
+	await share.locator('.addshare select').first().selectOption({ label: 'Sofie' });
+	await share.getByRole('button', { name: 'Tilføj' }).click();
+
+	// She is on the note now, with the role she was given.
+	const row = share.locator('.sharelist li').filter({ hasText: 'Sofie' });
+	await expect(row).toBeVisible();
+	await expect(row.locator('select')).toHaveValue('viewer');
+
+	// And it reaches her: her own notes list grows a Delt med mig group with it in.
+	//
+	// Navigated on the origin the invite signed her in on. VERDANDE_BASE_URL is
+	// localhost while the suite drives 127.0.0.1, and a session cookie set on one
+	// host is not sent to the other — a bare "/noter" would land her logged out.
+	const noterURL = new URL('/noter', link).href;
+	await sofie.goto(noterURL);
+	await expect(sofie.getByRole('button', { name: /Delt med mig/ })).toBeVisible();
+	await expect(sofie.getByRole('button', { name: /Ferieplan for hele holdet/ })).toBeVisible();
+	// A viewer's note carries no star or archive control — it is not hers to put away.
+	const sofieRow = sofie.locator('.notes li').filter({ hasText: 'Ferieplan for hele holdet' });
+	await expect(sofieRow.locator('.star')).toHaveCount(0);
+
+	// Taken back, it leaves her list.
+	await row.getByRole('button', { name: 'Fjern adgang' }).click();
+	await expect(row).toBeHidden();
+	await sofie.goto(noterURL);
+	await expect(sofie.getByRole('button', { name: /Ferieplan for hele holdet/ })).toBeHidden();
+
+	await sofieCtx.close();
+	expect(trouble).toEqual([]);
+});
+
 test('udseendet kan skiftes uafhængigt af temaet, og overlever en genindlæsning', async ({
 	page
 }) => {
@@ -2487,6 +2821,47 @@ test('udseendet kan skiftes uafhængigt af temaet, og overlever en genindlæsnin
 	expect(trouble).toEqual([]);
 });
 
+test('[[ foreslår en note, og linket lander i noten', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/noter');
+
+	// One note to point at, then another to write the link in.
+	await page.getByRole('button', { name: 'Ny note' }).click();
+	const ed = page.getByRole('textbox', { name: 'Notens tekst' });
+	await ed.click();
+	await page.keyboard.type('Rejseplan til Berlin');
+	await ed.blur();
+	await page.waitForTimeout(600);
+
+	await page.getByRole('button', { name: 'Ny note' }).click();
+	await ed.click();
+	await page.keyboard.type('Mine planer');
+	await page.keyboard.press('Enter');
+	await page.keyboard.type('Se ');
+	await page.keyboard.type('[[Rejse');
+
+	// The picker offers the note by title, and choosing it turns the text into a
+	// real inline link — the title, not the brackets.
+	const option = page.locator('.suggestions button', { hasText: 'Rejseplan til Berlin' });
+	await expect(option).toBeVisible();
+	await option.click();
+	const inline = ed.locator('a.notelink', { hasText: 'Rejseplan til Berlin' });
+	await expect(inline).toBeVisible();
+
+	// It survives the round-trip through Markdown and a reload.
+	await ed.blur();
+	await page.waitForTimeout(900);
+	await page.reload();
+	await page.getByRole('button', { name: /Mine planer/ }).click();
+	await expect(ed.locator('a.notelink', { hasText: 'Rejseplan til Berlin' })).toBeVisible();
+
+	// And it is a link you can follow: clicking it opens the note it names.
+	await ed.locator('a.notelink', { hasText: 'Rejseplan til Berlin' }).click();
+	await expect(ed.locator('h1')).toHaveText('Rejseplan til Berlin');
+
+	expect(trouble).toEqual([]);
+});
+
 test('en ny note begynder som titel, og linjen efter er brødtekst', async ({ page }) => {
 	const trouble = watchForTrouble(page);
 	await page.goto('/noter');
@@ -2910,10 +3285,11 @@ test('en note kan oprettes inde fra et projekt og hører til det med det samme',
 	await page.keyboard.type('Tagsten og lægter');
 	await page.waitForTimeout(1200);
 
-	// Den hører til projektet med det samme: "Del i" står på projektet, uden at
-	// nogen har valgt det bagefter.
-	await expect(page.getByLabel('Del i')).toHaveValue(/.+/);
-	const shared = await page.getByLabel('Del i').evaluate((el) => el.selectedOptions[0].textContent);
+	// Den hører til projektet med det samme: "Læg i projekt" står på projektet,
+	// uden at nogen har valgt det bagefter. Kontrollen ligger i Del-popoveren.
+	await page.locator('.sharewrap > button').click();
+	await expect(page.getByLabel('Læg i projekt')).toHaveValue(/.+/);
+	const shared = await page.getByLabel('Læg i projekt').evaluate((el) => el.selectedOptions[0].textContent);
 	expect(shared).toContain('Tagprojekt');
 
 	// Og den står på projektets egen side.
@@ -2979,6 +3355,96 @@ test('en note kan trækkes hen på et projekt i sidebjælken', async ({ page })
 	expect(trouble).toEqual([]);
 });
 
+test('en note kan arkiveres fra sin egen fod, og hentes frem igen', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/noter');
+
+	await page.getByRole('button', { name: 'Ny note' }).click();
+	const ed = page.getByRole('textbox', { name: 'Notens tekst' });
+	await ed.click();
+	await page.keyboard.type('Kvartalsplan');
+	await ed.blur();
+	await page.waitForTimeout(700);
+
+	// The Arkivér button in the note's footer puts it away: it leaves the list.
+	await page.locator('footer .actions .button', { hasText: 'Arkivér' }).click();
+	await expect(page.locator('.notes button.row', { hasText: 'Kvartalsplan' })).toHaveCount(0);
+
+	// It is in the archive, where the same button now offers to bring it back.
+	await page.getByRole('button', { name: 'Vis arkivet' }).click();
+	await page.locator('.notes button.row', { hasText: 'Kvartalsplan' }).click();
+	await page.locator('footer .actions .button', { hasText: 'Tag frem igen' }).click();
+	await expect(page.locator('.notes button.row', { hasText: 'Kvartalsplan' })).toHaveCount(0);
+
+	// And back in the ordinary list.
+	await page.getByRole('button', { name: 'Vis arkivet' }).click();
+	await expect(page.locator('.notes button.row', { hasText: 'Kvartalsplan' })).toBeVisible();
+
+	expect(trouble).toEqual([]);
+});
+
+test('en monospace-linje kan forlades — på retur og gennem menuen', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/noter');
+
+	await page.getByRole('button', { name: 'Ny note' }).click();
+	const ed = page.getByRole('textbox', { name: 'Notens tekst' });
+	await ed.click();
+	await page.keyboard.type('Titel');
+	await page.keyboard.press('Enter');
+
+	// En monospace-linje, og så retur: linjen efter skal være brødtekst, ikke mere
+	// monospace. Før rettelsen holdt en <pre> på markøren, og alt derefter blev ved
+	// med at være kode.
+	await page.getByRole('button', { name: 'Formatér' }).click();
+	await page.getByRole('menuitem', { name: 'Monotype' }).click();
+	await page.keyboard.type('kode linje');
+	await page.keyboard.press('Enter');
+	await page.keyboard.type('almindelig tekst');
+
+	// Koden står i sin blok; teksten efter står uden for den.
+	await expect(ed.locator('pre')).toHaveText('kode linje');
+	await expect(ed.locator('p').filter({ hasText: 'almindelig tekst' })).toBeVisible();
+	await expect(ed.locator('pre').filter({ hasText: 'almindelig tekst' })).toHaveCount(0);
+
+	// Shift+retur bliver derimod i blokken, så flerlinjet kode stadig kan skrives.
+	await page.getByRole('button', { name: 'Formatér' }).click();
+	await page.getByRole('menuitem', { name: 'Monotype' }).click();
+	await page.keyboard.type('linje et');
+	await page.keyboard.press('Shift+Enter');
+	await page.keyboard.type('linje to');
+	await expect(ed.locator('pre').filter({ hasText: 'linje et' })).toContainText('linje to');
+
+	// Og menuen kan føre en monospace-linje tilbage til brødtekst — dét, der før
+	// lagde et <p> inde i <pre> og ikke kom nogen vegne.
+	await page.getByRole('button', { name: 'Formatér' }).click();
+	await page.getByRole('menuitem', { name: 'Brødtekst' }).click();
+	// Den blok er nu brødtekst, ikke kode: den står som <p>, ikke i en <pre>.
+	await expect(ed.locator('p').filter({ hasText: 'linje et' })).toBeVisible();
+	await expect(ed.locator('pre').filter({ hasText: 'linje et' })).toHaveCount(0);
+
+	// Det overlever turen gennem Markdown. En ren note for sig, så prøven ikke
+	// afhænger af alt det ovenfor: kode, retur, brødtekst — gem, hent igen.
+	await page.getByRole('button', { name: 'Ny note' }).click();
+	await ed.click();
+	await page.keyboard.type('Rundtur');
+	await page.keyboard.press('Enter');
+	await page.getByRole('button', { name: 'Formatér' }).click();
+	await page.getByRole('menuitem', { name: 'Monotype' }).click();
+	await page.keyboard.type('docker pull');
+	await page.keyboard.press('Enter');
+	await page.keyboard.type('og så videre i almindelig skrift');
+	await ed.blur();
+	await page.waitForTimeout(1200);
+	await page.reload();
+	await page.getByRole('button', { name: /Rundtur/ }).click();
+	await expect(ed.locator('pre')).toContainText('docker pull');
+	await expect(ed.locator('p').filter({ hasText: 'almindelig skrift' })).toBeVisible();
+	await expect(ed.locator('pre').filter({ hasText: 'almindelig skrift' })).toHaveCount(0);
+
+	expect(trouble).toEqual([]);
+});
+
 test('kodeblokken har en kopiér-knap, og knappen havner ikke i filen', async ({ page }) => {
 	const trouble = watchForTrouble(page);
 	await page.context().grantPermissions(['clipboard-read', 'clipboard-write']);
@@ -3052,7 +3518,8 @@ test('flere noter kan markeres, arkiveres og hentes frem igen', async ({ page })
 	await rows.filter({ hasText: 'Bravo' }).click({ modifiers: ['Meta'] });
 	await expect(page.getByText('2 markeret')).toBeVisible();
 
-	await page.getByRole('button', { name: 'Arkivér', exact: true }).click();
+	// The selection bar's Arkivér, not the open note's own in the footer.
+	await page.locator('.picked-bar').getByRole('button', { name: 'Arkivér', exact: true }).click();
 	await page.waitForTimeout(900);
 
 	// Væk fra listen, og ikke i papirkurven: arkivering er ikke sletning.

web/playwright.config.js

@@ -51,6 +51,12 @@ export default defineConfig({
 
 	use: {
 		baseURL,
+		// Off by default. The app now ships a caching service worker, and once it
+		// controls a page Playwright's page.route() no longer sees the fetches it
+		// makes — so a test that forces a 500 to check the error path gets the real
+		// 200 through the worker instead, and reads as a broken feature. The one test
+		// that needs the real worker turns it back on for its own context.
+		serviceWorkers: 'block',
 		trace: 'retain-on-failure',
 		screenshot: 'only-on-failure',
 		// Pinned, because the app reads both. The sign-up form sends

web/scripts/generate-screenshots.js

@@ -73,6 +73,24 @@ const SHOTS = [
 	{ name: 'detail', path: (ids) => `/opgave/${ids.detail}`, theme: 'dark' },
 	{ name: 'notes', path: '/noter', theme: 'dark', prepare: openMeetingNote },
 	{ name: 'notes-source', path: '/noter', theme: 'dark', prepare: showNoteSource },
+	// Charcoal, the newest theme — a warm near-black modelled on Apple Notes, with
+	// amber where the green usually is. The notes list shows a theme's surfaces, text
+	// and one accent at once, so that is where the landing page carries it up close.
+	{ name: 'notes-charcoal', path: '/noter', theme: 'charcoal', prepare: openMeetingNote },
+	// The same Today view in each of the six themes, for a gallery that shows the
+	// whole range at a glance. One view throughout, so the only thing that changes
+	// from picture to picture is the theme itself. Names are the themes' own.
+	{ name: 'theme-northern-lights', path: '/', theme: 'dark' },
+	{ name: 'theme-charcoal', path: '/', theme: 'charcoal' },
+	{ name: 'theme-dusk', path: '/', theme: 'dusk' },
+	{ name: 'theme-daylight', path: '/', theme: 'light' },
+	{ name: 'theme-paper', path: '/', theme: 'paper' },
+	{ name: 'theme-contrast', path: '/', theme: 'contrast' },
+	// The new work, and in the light theme, which is what most people want to look
+	// at a landing page in. The calendar drawing tasks to their length, and a note
+	// somebody shared into the "Shared with me" group.
+	{ name: 'calendar-light', path: '/kalender', theme: 'light', prepare: showWeek },
+	{ name: 'notes-shared-light', path: '/noter', theme: 'light', prepare: openSharedNote },
 	{ name: 'delegated', path: '/uddelegeret', theme: 'dark' },
 	{ name: 'settings', path: '/indstillinger/integrationer', theme: 'dark' },
 	// Scrolled, because the themes are the second panel on the page and a picture
@@ -114,6 +132,13 @@ async function showNoteSource(page) {
 	await page.waitForTimeout(600);
 }
 
+async function openSharedNote(page) {
+	// The note Mette shared in, so the "Shared with me" group and its owner chip are
+	// what the picture is of rather than something the group happens to sit above.
+	await page.locator('button.row', { hasText: 'Packaging quotes' }).first().click();
+	await page.waitForTimeout(600);
+}
+
 async function showThemes(page) {
 	// scrollIntoView rather than Playwright's scrollIntoViewIfNeeded: the heading is
 	// already a few pixels inside the viewport when the page loads, so "if needed"
@@ -340,6 +365,23 @@ async function handOver(ids) {
 	await api(`/tasks/${ids.detail}/comments`, {
 		body: 'Room is booked for ten. Summer numbers are in the shared folder — the labels are still with the printer, I chase them Thursday.'
 	});
+
+	// A note of Mette's own, handed to the owner — so their Notes page has a
+	// "Shared with me" group with a real note in it, marked as hers. This is the
+	// other half of sharing: not the project path, but a page passed to a person.
+	const note = await api('/notes', {
+		body: `# Packaging quotes
+
+Three back, one still to come:
+
+- **Nordfelt** — 79 øre a bag at 2,000, plates included
+- **Kolding Karton** — 84 øre, faster, kinder about small runs
+- Bruun still owes me a number
+
+I'd lean Kolding for the first run and revisit at volume. #Autumn launch`
+	});
+	await api(`/notes/${note.id}/shares`, { user_id: ids.owner, role: 'editor' });
+
 	return { colleague: me.id };
 }
 
@@ -373,6 +415,8 @@ async function seed({ colleague, noteTitle }) {
 		).padStart(2, '0')}`;
 	};
 
+	const me = await api('/auth/me', null, 'GET');
+
 	// Two headings over the projects, which is what the sidebar grew for.
 	const work = await api('/project-groups', { name: 'Work' });
 	const home = await api('/project-groups', { name: 'Home' });
@@ -420,6 +464,17 @@ async function seed({ colleague, noteTitle }) {
 		{ content: 'Water the greenhouse', due_date: day(0), recurrence_rule: 'FREQ=DAILY', project_id: garden.id },
 		{ content: 'Collect the parcel from the post office', due_date: day(0), labels: ['errands'] },
 
+		// A handful given a time and a length, so the calendar's week draws them to
+		// scale rather than as a row of identical blocks — a stand-up, a long
+		// planning block, a call, a review. Spread across the day and the days, so
+		// the picture is a week that has a shape.
+		{ content: 'Stand-up', due_date: day(0), due_time: '09:00', duration_min: 15, project_id: launch.id, section_id: inFlight.id },
+		{ content: 'Planning block', due_date: day(0), due_time: '10:00', duration_min: 90, priority: 2, project_id: launch.id, section_id: planning.id, labels: ['meeting'] },
+		{ content: 'Call with the printer', due_date: day(0), due_time: '13:30', duration_min: 30, project_id: launch.id, labels: ['waiting'] },
+		{ content: 'Interview: designer', due_date: day(1), due_time: '11:00', duration_min: 60, priority: 1, project_id: launch.id, section_id: inFlight.id },
+		{ content: 'Budget review', due_date: day(2), due_time: '14:00', duration_min: 45, priority: 1, project_id: launch.id, section_id: inFlight.id },
+		{ content: 'One-to-one with Mette', due_date: day(3), due_time: '15:30', duration_min: 30, project_id: launch.id },
+
 		// The next couple of weeks, so Upcoming and the month grid have something in
 		// them rather than a row of empty cells.
 		{ content: 'Book a plumber for the bathroom', due_date: day(1), priority: 2, project_id: house.id },
@@ -441,6 +496,17 @@ async function seed({ colleague, noteTitle }) {
 	const made = {};
 	for (const task of tasks) made[task.content] = await api('/tasks', task);
 
+	// One task snoozed, so the board and the list show a card parked at the bottom
+	// of its section — greyed, with a "snoozed until" mark — set aside rather than
+	// forgotten, and without touching when it is due.
+	const snoozeUntil = (() => {
+		const d = new Date();
+		d.setDate(d.getDate() + 2);
+		d.setHours(9, 0, 0, 0);
+		return d.toISOString();
+	})();
+	await api(`/tasks/${made['Write the job advert'].id}/snooze`, { until: snoozeUntil });
+
 	// A saved filter, because the sidebar shows them and an empty heading reads as
 	// a feature that does not work.
 	await api('/filters', { name: 'Important this week', query: 'p1 & 7 days' });
@@ -560,6 +626,7 @@ The opening notes are a task, so they can be ticked off: task:${detail.id}`
 	await api('/users', { email: 'anders@example.dk' });
 
 	return {
+		owner: me.id,
 		work: launch.id,
 		detail: detail.id,
 		invite: invite.link,

web/src/app.css

@@ -86,6 +86,12 @@
 	--text-xl: 1.375rem;
 	--text-2xl: 1.75rem;
 
+	/* The sidebar's own text size, its own knob (Settings → Appearance) so the menu
+	   can be made easier to read without dragging the whole list with it. Default is
+	   a step up from the old --text-sm the nav used, at medium weight, so the menu
+	   items read as menu items. [data-menu-size] on <html> overrides it. */
+	--menu-size: 0.9375rem;
+
 	/* Spacing on a 4px grid. */
 	--s1: 0.25rem;
 	--s2: 0.5rem;
@@ -204,6 +210,52 @@
 	--shadow-lg: 0 8px 32px rgb(0 0 0 / 0.4);
 }
 
+/* Kul — the greys of Apple Notes' dark mode, to Kristian's own sampled values.
+   Three panel greys, lightest sidebar to darkest editor — the reverse of the usual
+   sunken-is-darkest order, which is why the editor gets its own --editor-bg rather
+   than sharing --surface-raised with the list. The accent turns amber, and the
+   selected menu item, selected note and section headings each get a fallback token
+   so this theme can hit its colours without touching any other. */
+[data-theme='charcoal'] {
+	--ground: #1e1e1e;
+	--surface: #2a3033;
+	--surface-raised: #242b2e; /* the note list */
+	--surface-sunken: #2d3133; /* the menu / sidebar — lightest here */
+	--line: #34393b;
+	--line-strong: #414749;
+
+	--ink: #ffffff;
+	--ink-muted: #dcdcdc;
+	--ink-faint: #9ba0a2;
+
+	/* Amber, Apple's Notes accent. The bright value is the selected menu item; the
+	   dark text rides on top of it. */
+	--accent: #ffce35;
+	--accent-hover: #ffd75a;
+	--accent-sunken: #ffce35;
+	--accent-ink: #1e1e1e;
+
+	/* Per-element, and only here — every other theme falls back to the shared token
+	   in the var() calls that read these. */
+	--editor-bg: #1e1e1e; /* the text field, a shade below the list */
+	--note-on-bg: #a78c26; /* a selected note in the list — gold */
+	--note-on-ink: #1e1e1e; /* dark text on the gold */
+	--nav-active-ink: #1e1e1e; /* dark text on the amber menu item */
+	--heading-ink: #8a8e90; /* PROJEKTER and the group names — quiet grey */
+	--note-group-bg: #2d3133; /* day separators take the menu's resting grey, not the darker ground */
+
+	--p1: #cf6b6b;
+	--p2: #d69f5c;
+	--p3: #6b9ecf;
+	--p4: var(--ink-faint);
+
+	--danger: #cf6b6b;
+	--danger-sunken: #33201f;
+
+	--shadow: 0 1px 2px rgb(0 0 0 / 0.25);
+	--shadow-lg: 0 8px 32px rgb(0 0 0 / 0.4);
+}
+
 /* Papir — warm light, closer to paper than to a screen. */
 [data-theme='paper'] {
 	--ground: #f6f1e7;
@@ -369,9 +421,13 @@ button {
 	   søgefelt. */
 }
 
+/* A translucent wash of the accent, not a solid block and not the old near-invisible
+   tint. --accent-sunken sat a hair off the editor's own surface in dark, so a
+   selection could not be seen; a solid accent could, but read as a heavy slab. Mixing
+   the accent part-way into transparent lays a clear green film over the text while it
+   keeps its own colour — visible on white and on the dark surfaces alike. */
 ::selection {
-	background: var(--accent-sunken);
-	color: var(--ink);
+	background: color-mix(in oklab, var(--accent) 42%, transparent);
 }
 
 /* Scrollbars, made quiet. The default on Windows is a wide grey slab that
@@ -516,3 +572,41 @@ button {
 	line-height: 1.5;
 	letter-spacing: -0.01em;
 }
+
+/* Body text size — its own control in Settings → Appearance, for reading the list
+   and the notes larger (or smaller) without touching the menu. It re-scales the
+   shared type tokens the same way a look does; placed after the looks so that an
+   explicit size choice wins the tokens they both set. The menu has its own knob
+   below and does not move with this one. */
+[data-text-size='small'] {
+	--text-base: 0.875rem;
+	--text-sm: 0.75rem;
+	--text-lg: 1rem;
+}
+
+[data-text-size='large'] {
+	--text-base: 1.0625rem;
+	--text-sm: 0.9375rem;
+	--text-lg: 1.1875rem;
+}
+
+[data-text-size='xl'] {
+	--text-base: 1.1875rem;
+	--text-sm: 1.0625rem;
+	--text-lg: 1.3125rem;
+}
+
+/* Menu (sidebar) font size — independent of the body size above, because the two
+   are separate questions: a menu you can read at a glance, and a list you can read
+   a paragraph of. */
+[data-menu-size='small'] {
+	--menu-size: 0.8125rem;
+}
+
+[data-menu-size='large'] {
+	--menu-size: 1.0625rem;
+}
+
+[data-menu-size='xl'] {
+	--menu-size: 1.1875rem;
+}

web/src/app.html

@@ -28,6 +28,14 @@
 				// face and again in another, which is a visible jump.
 				const look = localStorage.getItem('verdande:look');
 				if (look && look !== 'verdande') document.documentElement.dataset.look = look;
+
+				// The font-size choices change layout too, so they belong before first
+				// paint for the same reason: otherwise the sidebar and the list are drawn
+				// once at one size and again at another.
+				const menuSize = localStorage.getItem('verdande:menu-size');
+				if (menuSize && menuSize !== 'default') document.documentElement.dataset.menuSize = menuSize;
+				const textSize = localStorage.getItem('verdande:text-size');
+				if (textSize && textSize !== 'default') document.documentElement.dataset.textSize = textSize;
 			} catch (e) {
 				// Private browsing can refuse localStorage; the dark default stands.
 			}

web/src/lib/api.js

@@ -23,6 +23,57 @@ export class ApiError extends Error {
 }
 
 import { t } from './i18n.svelte.js';
+import { connectivity, sleepOrOnline } from './connectivity.svelte.js';
+
+/**
+ * How long a request keeps retrying a network failure before giving up.
+ *
+ * This is the whole of the "offline" feature and its whole limit: it rides out a
+ * blip of a few seconds so a save is not lost to it, and then — because the app is
+ * a live view of a shared list, not a local database — it stops and says so rather
+ * than holding an edit for a network that is not coming back. Fifteen seconds is
+ * long enough for a handover or a tunnel and short enough that a real outage fails
+ * while the user is still looking at what they did.
+ */
+const RETRY_WINDOW_MS = 15000;
+
+/** Backoff between attempts: 0.5s, 1s, 2s, then 3s, capped. A waiting sleep also
+ *  wakes the instant the OS reports a link again, so most blips end on the first. */
+const backoff = (attempt) => Math.min(500 * 2 ** attempt, 3000);
+
+/**
+ * Runs `send` (a fetch), retrying only network failures for a short window.
+ *
+ * A network failure is fetch rejecting — no HTTP status ever arrived. An HTTP
+ * error (4xx/5xx) is the server answering, so it is returned, not retried: retrying
+ * a 400 just asks the same wrong question again. An abort is the caller changing
+ * its mind (a superseded search), so it is left to propagate.
+ *
+ * Retrying is not free of risk: a create whose request reached the server but whose
+ * response was lost would be made twice. For a drop of seconds that is rare, and the
+ * alternative — losing the save every time the network hiccups — is the thing this
+ * exists to stop. A server-side idempotency key would remove even that; it is a
+ * larger change noted for later.
+ */
+async function withRetry(send, noRetry = false) {
+	const deadline = Date.now() + (noRetry ? 0 : RETRY_WINDOW_MS);
+	let attempt = 0;
+	for (;;) {
+		try {
+			const res = await send();
+			connectivity.reachable();
+			return res;
+		} catch (e) {
+			if (e?.name === 'AbortError') throw e;
+			if (Date.now() >= deadline) {
+				connectivity.lost();
+				throw new ApiError(0, 'offline', 'ingen forbindelse');
+			}
+			connectivity.retrying();
+			await sleepOrOnline(backoff(attempt++));
+		}
+	}
+}
 
 /**
  * The key for each code the API can return.
@@ -110,14 +161,10 @@ async function request(method, path, body, options = {}) {
 		init.body = JSON.stringify(body);
 	}
 
-	let res;
-	try {
-		res = await fetch(`/api/v1${path}`, init);
-	} catch (e) {
-		// A network failure is not an HTTP status; give it one the app can handle
-		// the same way as everything else.
-		throw new ApiError(0, 'offline', 'ingen forbindelse');
-	}
+	// Retries a network failure for a few seconds so a short drop does not lose the
+	// call; `withRetry` turns an exhausted window into the same `offline` error the
+	// app already handles. `options.noRetry` opts a call out — used by nothing yet.
+	const res = await withRetry(() => fetch(`/api/v1${path}`, init), options.noRetry);
 
 	if (res.status === 204) return null;
 
@@ -157,12 +204,9 @@ async function upload(path, file, field = 'file') {
 	const form = new FormData();
 	form.append(field, file);
 
-	let res;
-	try {
-		res = await fetch(`/api/v1${path}`, { method: 'POST', body: form, credentials: 'same-origin' });
-	} catch {
-		throw new ApiError(0, 'offline', 'ingen forbindelse');
-	}
+	const res = await withRetry(() =>
+		fetch(`/api/v1${path}`, { method: 'POST', body: form, credentials: 'same-origin' })
+	);
 
 	const text = await res.text();
 	let payload = null;
@@ -310,6 +354,7 @@ export const api = {
 	completeTask: (id) => post(`/tasks/${id}/complete`),
 	reopenTask: (id) => post(`/tasks/${id}/reopen`),
 	moveTask: (id, data) => post(`/tasks/${id}/move`, data),
+	snoozeTask: (id, until) => post(`/tasks/${id}/snooze`, { until: until ?? '' }),
 
 	quickAdd: (text, projectId, sectionId) =>
 		post('/tasks/quick-add', { text, project_id: projectId, section_id: sectionId }),
@@ -405,6 +450,12 @@ export const api = {
 	deleteNote: (id) => del(`/notes/${id}`),
 	notesLinking: (kind, targetId) => get(`/notes/linking/${kind}/${encodeURIComponent(targetId)}`),
 
+	// Sharing a note with people directly — its own access list, beside the project
+	// path. Owner only; the list call also returns who it can still be shared with.
+	noteShares: (id) => get(`/notes/${id}/shares`),
+	shareNote: (id, userId, role) => post(`/notes/${id}/shares`, { user_id: userId, role }),
+	unshareNote: (id, userId) => del(`/notes/${id}/shares/${userId}`),
+
 	// Mailboxes read over IMAP. Each belongs to the person who connected it, so
 	// there is no instance-wide registration behind these the way Gmail has one.
 	mailboxes: () => get('/mailboxes'),

web/src/lib/components/CalendarView.svelte

@@ -286,6 +286,48 @@
 	/** The cell lit up under the pointer. */
 	let over = $state(null);
 
+	// A resize in progress: which task, and where its foot is being dragged to, in
+	// minutes since midnight. Kept apart from the stored length so the task can
+	// follow the handle live and only be written when the drag ends.
+	let resizing = $state(null);
+
+	/**
+	 * Dragging the foot of a timed task changes how long it is.
+	 *
+	 * Pointer events rather than the HTML5 drag the body uses: the two must not be
+	 * the same gesture, or every attempt to make a task longer would instead pick it
+	 * up and move it. stopPropagation keeps the handle's press from starting the
+	 * move, and the column it lives in is what the minutes are measured against —
+	 * the same box onDropAt reads a drop time from.
+	 */
+	function startResize(event, task, date) {
+		event.stopPropagation();
+		event.preventDefault();
+		const col = event.currentTarget.closest('.daycol');
+		if (!col || !task.due_datetime) return;
+		const at = new Date(task.due_datetime);
+		const from = at.getHours() * 60 + at.getMinutes();
+		resizing = { id: task.id, from, to: from + (task.duration_min || 30), date: iso(date) };
+
+		const onMove = (e) => {
+			const box = col.getBoundingClientRect();
+			const share = Math.min(Math.max((e.clientY - box.top) / box.height, 0), 1);
+			const minutes = hours.from * 60 + share * hours.minutes;
+			// Quarter-hour steps, at least a quarter long, never past midnight.
+			const snapped = Math.min(Math.max(Math.round(minutes / 15) * 15, from + 15), 24 * 60);
+			resizing = { ...resizing, to: snapped };
+		};
+		const onUp = async () => {
+			window.removeEventListener('pointermove', onMove);
+			window.removeEventListener('pointerup', onUp);
+			const current = resizing;
+			resizing = null;
+			if (current) await app.resize(current.id, current.to - current.from);
+		};
+		window.addEventListener('pointermove', onMove);
+		window.addEventListener('pointerup', onUp);
+	}
+
 	function onDragOver(event, date) {
 		if (!carries(event, TASK)) return;
 		accept(event);
@@ -394,7 +436,16 @@
 			if (!task.due_datetime) continue;
 			const at = new Date(task.due_datetime);
 			const from = at.getHours() * 60 + at.getMinutes();
-			out.push({ kind: 'task', ref: task, from, to: from + 30 });
+			// The task's own length, not a fixed half hour. A quarter-hour floor so a
+			// zero-minute task is still something to see and grab, and the end of the
+			// day is the ceiling. While a resize is in flight this task follows the
+			// handle instead of its stored length.
+			let to =
+				resizing && resizing.id === task.id
+					? resizing.to
+					: from + (task.duration_min || 30);
+			to = Math.min(Math.max(to, from + 15), 24 * 60);
+			out.push({ kind: 'task', ref: task, from, to });
 		}
 
 		return out.toSorted((a, b) => a.from - b.from || a.to - b.to);
@@ -547,12 +598,13 @@
 		</svelte:element>
 	{/snippet}
 
-	{#snippet taskChip(task, kind, extra = '', at = '')}
+	{#snippet taskChip(task, kind, extra = '', at = '', date = null)}
 		<!-- Draggable as well as clickable: moving something to another day is the
 		     whole reason to be looking at a calendar. The browser needs a few pixels
 		     of movement before it calls a press a drag, so the click survives. -->
 		<button
 			class={kind}
+			class:resizing={resizing?.id === task.id}
 			data-priority={task.priority}
 			draggable="true"
 			ondragstart={(e) => startDrag(e, TASK, task.id)}
@@ -562,6 +614,16 @@
 		>
 			{#if at}<span class="at">{at}</span>{/if}
 			{task.content}
+			<!-- Only a task standing at a time can be made longer, and only where the
+			     grid has room to show it — the timed column, which passes the date. -->
+			{#if date && task.due_datetime}
+				<span
+					class="resize"
+					title={t('cal.resize')}
+					aria-hidden="true"
+					onpointerdown={(e) => startResize(e, task, date)}
+				></span>
+			{/if}
 		</button>
 	{/snippet}
 
@@ -589,6 +651,7 @@
 					<div
 						class="allday"
 						data-allday={iso(date)}
+						class:today={iso(date) === todayISO}
 						class:over={over === iso(date)}
 						ondragover={(e) => onDragOver(e, date)}
 						ondragleave={() => (over = null)}
@@ -632,7 +695,7 @@
 							{#if item.kind === 'event'}
 								{@render eventChip(item.ref, date, 'tevent', place(item))}
 							{:else}
-								{@render taskChip(item.ref, 'tevent task', place(item), clock(item.from))}
+								{@render taskChip(item.ref, 'tevent task', place(item), clock(item.from), date)}
 							{/if}
 						{/each}
 					</div>
@@ -814,12 +877,16 @@
 		overflow: hidden;
 	}
 
+	/* White, not the sidebar's sunken ground: a calendar reads lightest when the
+	   day itself is the brightest thing on the screen and the events are the soft
+	   colour laid on it — the opposite of the grey grid it was, where the events
+	   had to shout to be seen at all. */
 	.corner,
 	.head,
 	.gutter,
 	.allday,
 	.daycol {
-		background: var(--ground);
+		background: var(--surface);
 	}
 
 	.head {
@@ -827,6 +894,16 @@
 		text-align: center;
 	}
 
+	/* Today's whole column, faintly, so the eye finds it before it reads a number —
+	   the marker on the date above is the label, this is the glow it sits in. Kept
+	   under the events, so a pastel block still reads as its own calendar's colour
+	   rather than as this wash tinted. */
+	.head.today,
+	.allday.today,
+	.daycol.today {
+		background: color-mix(in oklab, var(--accent) 6%, var(--surface));
+	}
+
 	.head .wd {
 		display: block;
 		font-size: var(--text-xs);
@@ -839,9 +916,19 @@
 		font-size: var(--text-sm);
 	}
 
+	/* The marker at the top the day is named by: today's number in a filled disc,
+	   the same one the month grid gives today, so "this is today" is one glance in
+	   either view rather than a colour you have to already know to read. */
 	.head.today .num {
-		color: var(--accent);
+		color: var(--accent-ink);
+		background: var(--accent);
+		border-radius: var(--radius-full);
+		width: 20px;
+		height: 20px;
+		display: inline-grid;
+		place-items: center;
 		font-weight: 560;
+		margin-top: 1px;
 	}
 
 	.gutter {
@@ -915,6 +1002,10 @@
 	/* Placeringen kommer fra `place()` som en inline `style`; alt andet står her.
 	   To ting på samme tid deler bredden, så `margin-right` er den ene hårstrå
 	   luft, der gør to kasser til to kasser. */
+	/* A soft wash of the calendar's own colour rather than a grey block edged in it:
+	   each calendar keeps a dusty, unmistakable nuance, and a screen of them reads
+	   as colour laid on white instead of a grid of grey bars. The left edge stays,
+	   a shade stronger than the fill, so the block still has a spine. */
 	.tevent {
 		position: absolute;
 		margin-right: 2px;
@@ -922,21 +1013,48 @@
 		padding: 1px var(--s1);
 		border-radius: var(--radius-sm);
 		border-left: 3px solid var(--event-colour, var(--line-strong));
-		background: var(--surface-sunken);
-		color: var(--ink-muted);
+		background: color-mix(in oklab, var(--event-colour, var(--line-strong)) 16%, var(--surface));
+		color: var(--ink);
 		font-size: var(--text-xs);
 		line-height: 1.3;
 		text-align: left;
 		text-decoration: none;
 	}
 
+	/* A task is a card you can pick up, not an event you cannot — so on the white
+	   column it is an outlined card, where an event is a solid wash. The priority
+	   colour rides the left edge, as it does everywhere else. */
 	.tevent.task {
-		background: var(--surface-raised);
+		background: var(--surface);
+		box-shadow: inset 0 0 0 1px var(--line);
 		border-left-color: var(--line-strong);
 		color: var(--ink);
 		cursor: grab;
 	}
 
+	/* The grip along the foot of a task, for dragging its length. Out of the way
+	   until the task is hovered or being resized, so it never competes with the
+	   words above it. */
+	.tevent.task .resize {
+		position: absolute;
+		left: 0;
+		right: 0;
+		bottom: 0;
+		height: 7px;
+		cursor: ns-resize;
+		opacity: 0;
+		touch-action: none;
+	}
+	.tevent.task:hover .resize,
+	.tevent.task.resizing .resize {
+		opacity: 1;
+		background: linear-gradient(to bottom, transparent, var(--line-strong));
+	}
+	.tevent.task.resizing {
+		cursor: ns-resize;
+		z-index: 5;
+	}
+
 	.tevent.task[data-priority='1'] {
 		border-left-color: var(--p1);
 	}
@@ -1016,7 +1134,8 @@
 		text-align: left;
 		padding: 1px var(--s1);
 		border-radius: var(--radius-sm);
-		background: var(--surface-raised);
+		background: var(--surface);
+		box-shadow: inset 0 0 0 1px var(--line);
 		border-left: 2px solid var(--line-strong);
 		color: var(--ink);
 		overflow: hidden;
@@ -1035,7 +1154,7 @@
 	}
 
 	.chip:hover {
-		background: var(--surface);
+		background: var(--surface-sunken);
 	}
 
 	/* An event reads as a different kind of thing at a glance, before any of the
@@ -1055,8 +1174,8 @@
 		padding: 1px var(--s1);
 		border-radius: var(--radius-sm);
 		border-left: 3px solid var(--event-colour);
-		background: var(--surface-sunken);
-		color: var(--ink-muted);
+		background: color-mix(in oklab, var(--event-colour) 16%, var(--surface));
+		color: var(--ink);
 		text-decoration: none;
 		overflow: hidden;
 		text-overflow: ellipsis;
@@ -1071,7 +1190,7 @@
 	}
 
 	.event:hover {
-		background: var(--surface);
+		background: color-mix(in oklab, var(--event-colour) 26%, var(--surface));
 		color: var(--ink);
 	}
 
@@ -1080,7 +1199,7 @@
 	   every calendar anybody has used. */
 	.event.allday {
 		border-left: none;
-		background: color-mix(in oklab, var(--event-colour) 22%, var(--ground));
+		background: color-mix(in oklab, var(--event-colour) 22%, var(--surface));
 		box-shadow: inset 0 0 0 1px color-mix(in oklab, var(--event-colour) 45%, transparent);
 	}
 
@@ -1182,20 +1301,18 @@
 			padding: 1px var(--s1);
 			border-radius: var(--radius-sm);
 			border-left: 2px solid var(--line-strong);
-			background: var(--surface-raised);
+			background: var(--surface);
+			box-shadow: inset 0 0 0 1px var(--line);
 		}
 
 		.calendar.week .chip[data-priority='1'] {
 			border-left-color: var(--p1);
-			background: var(--surface-raised);
 		}
 		.calendar.week .chip[data-priority='2'] {
 			border-left-color: var(--p2);
-			background: var(--surface-raised);
 		}
 		.calendar.week .chip[data-priority='3'] {
 			border-left-color: var(--p3);
-			background: var(--surface-raised);
 		}
 
 		/* Readable again in the week, for the reason the task chips are: a
@@ -1207,12 +1324,12 @@
 			padding: 1px var(--s1);
 			border-radius: var(--radius-sm);
 			border-left: 3px solid var(--event-colour);
-			background: var(--surface-sunken);
+			background: color-mix(in oklab, var(--event-colour) 16%, var(--surface));
 		}
 
 		.calendar.week .event.allday {
 			border-left: none;
-			background: color-mix(in oklab, var(--event-colour) 22%, var(--ground));
+			background: color-mix(in oklab, var(--event-colour) 22%, var(--surface));
 		}
 
 		.calendar.week .at {

web/src/lib/components/NoteEditor.svelte

@@ -20,7 +20,7 @@
 	import { api, humanMessage } from '$lib/api.js';
 	import { colorVar } from '$lib/colors.js';
 
-	let { note, onchange, onsave } = $props();
+	let { note, notes = [], onchange, onsave, onopennote } = $props();
 
 	let editor;
 	// Forslagslisten, så tastaturvalget kan rulle den frem.
@@ -120,11 +120,99 @@
 
 	function setStyle(style) {
 		stylesOpen = false;
+		editor?.focus();
 		if (style.key === 'bullet') return apply('insertUnorderedList');
 		if (style.key === 'numbered') return apply('insertOrderedList');
+
+		// formatBlock is unreliable around <pre>. Asked to turn a monospace line back
+		// into body, Chromium and WebKit nest a <p> *inside* the <pre> —
+		// `<pre>…<p>body</p></pre>` — so the text stays monospace and there is no way
+		// out of the block from the menu. Do any conversion that touches a <pre> by
+		// hand, replacing the element rather than reformatting inside it.
+		const block = currentBlock();
+		if (block && (block.tagName === 'PRE' || style.tag === 'pre')) {
+			replaceBlock(block, style.tag);
+			return;
+		}
 		apply('formatBlock', style.tag);
 	}
 
+	/**
+	 * Replaces a block element with one of another tag, keeping its contents and the
+	 * caret. Used where execCommand cannot be trusted — converting to or from a
+	 * <pre>, which it either nests or ignores.
+	 */
+	function replaceBlock(block, tag) {
+		// The copy button lives inside the <pre> so it can sit in its corner; it is
+		// not text and must not travel into a paragraph. addCopyButtons puts it back
+		// on the next render for any <pre> that still needs one.
+		block.querySelectorAll?.('.copy').forEach((b) => b.remove());
+
+		const el = document.createElement(tag);
+		while (block.firstChild) el.appendChild(block.firstChild);
+		if (!el.firstChild) el.appendChild(document.createElement('br'));
+		block.replaceWith(el);
+
+		const range = document.createRange();
+		range.selectNodeContents(el);
+		range.collapse(false);
+		const selection = window.getSelection();
+		selection.removeAllRanges();
+		selection.addRange(range);
+
+		readState();
+		changed();
+	}
+
+	/**
+	 * Steps out of a code block on Enter.
+	 *
+	 * A <pre> is preformatted, so the browser answers Enter by inserting a <br> and
+	 * staying inside it — which means a monospace last line makes every line after
+	 * it monospace too, with no way back to body by typing. Plain Enter now leaves
+	 * the block: the tail after the caret becomes a paragraph below the <pre>, and
+	 * that is where the caret lands. Shift+Enter is left untouched, so a soft line
+	 * break still writes multi-line code inside the block.
+	 */
+	function exitPre(pre) {
+		pre.querySelectorAll('.copy').forEach((b) => b.remove());
+
+		const selection = window.getSelection();
+		const range = selection.getRangeAt(0);
+
+		// Everything from the caret to the end of the block leaves with the new line.
+		const tail = document.createRange();
+		tail.setStart(range.endContainer, range.endOffset);
+		tail.setEnd(pre, pre.childNodes.length);
+		const frag = tail.extractContents();
+
+		// A break at the head of what we carried is the empty line return was pressed
+		// on; it should not open the paragraph with a blank row.
+		while (frag.firstChild && frag.firstChild.nodeName === 'BR') frag.removeChild(frag.firstChild);
+
+		const p = document.createElement('p');
+		if (frag.childNodes.length) p.appendChild(frag);
+		// The split can leave an empty text node behind, and a block with no element
+		// and no text is not a caret host in Chromium — the next keystroke falls back
+		// into the block above. An empty paragraph needs a <br> to be stood in.
+		if (!p.textContent && !p.querySelector('br, img')) {
+			p.replaceChildren(document.createElement('br'));
+		}
+
+		// And the same break seen from the other side, left dangling in the <pre>.
+		while (pre.lastChild && pre.lastChild.nodeName === 'BR') pre.removeChild(pre.lastChild);
+
+		// Leaving an empty block behind is leaving nothing: the <pre> itself goes.
+		if (!pre.textContent.trim()) pre.replaceWith(p);
+		else pre.after(p);
+
+		const caret = document.createRange();
+		caret.setStart(p, 0);
+		caret.collapse(true);
+		selection.removeAllRanges();
+		selection.addRange(caret);
+	}
+
 	/** What the caret is standing in, for the toolbar's pressed states. */
 	function readState() {
 		if (!editor) return;
@@ -302,9 +390,26 @@
 		if (!node || node.nodeType !== Node.TEXT_NODE || !selection.isCollapsed) return null;
 
 		const before = node.textContent.slice(0, selection.anchorOffset);
-		const match = /(?:^|\s)#([\p{L}\p{N}_-]*)$/u.exec(before);
-		if (!match) return null;
-		return { node, start: selection.anchorOffset - match[1].length, term: match[1] };
+
+		// A note link, [[, is the same idea as a project tag and gets the same
+		// completion — checked first because it is the longer opener. The term runs
+		// to the caret and is anything up to the closing bracket, which has not been
+		// typed yet.
+		const note = /\[\[([^\]\n]*)$/u.exec(before);
+		if (note) {
+			return { kind: 'note', node, start: selection.anchorOffset - note[1].length, term: note[1] };
+		}
+
+		const project = /(?:^|\s)#([\p{L}\p{N}_-]*)$/u.exec(before);
+		if (project) {
+			return {
+				kind: 'project',
+				node,
+				start: selection.anchorOffset - project[1].length,
+				term: project[1]
+			};
+		}
+		return null;
 	}
 
 	/**
@@ -348,46 +453,87 @@
 		// pixels for hvert bogstav, mens listen snævres ind.
 		if (!suggestions.length) menuAt = tagPosition(partial);
 
-		// Alle der passer, ikke de seks første.
-		//
-		// Loftet på seks var sat, dengang listen ikke kunne rulle, og det gjorde
-		// noget værre end at skjule: med tyve projekter og et blot tastet `#` viste
-		// den seks vilkårlige og så færdig ud. Man kunne ikke se, at der manglede
-		// noget — kun at ens eget projekt ikke var der.
-		//
-		// Rækkefølgen bærer nu det, loftet gjorde forkert: det, der begynder med
-		// det tastede, står øverst, resten alfabetisk. Skriver man "ga", er
-		// GarageRisteriet den første, ikke den, der tilfældigvis lå først.
-		const matches = app.projects.filter(
-			(p) => !p.is_inbox && p.name.toLowerCase().includes(term)
-		);
-		matches.sort((a, b) => {
-			const an = a.name.toLowerCase();
-			const bn = b.name.toLowerCase();
-			const ap = an.startsWith(term);
-			const bp = bn.startsWith(term);
-			if (ap !== bp) return ap ? -1 : 1;
-			return an.localeCompare(bn, 'da');
-		});
-		suggestions = matches;
+		suggestions = partial.kind === 'note' ? noteMatches(term) : projectMatches(term);
 		chosen = 0;
 	}
 
-	/** Replaces the half-typed tag with the whole name. */
-	function accept(project) {
+	// Alle der passer, ikke de seks første. Rækkefølgen bærer det: det, der begynder
+	// med det tastede, står øverst, resten alfabetisk. Skriver man "ga", er
+	// GarageRisteriet den første, ikke den, der tilfældigvis lå først.
+	function projectMatches(term) {
+		return app.projects
+			.filter((p) => !p.is_inbox && p.name.toLowerCase().includes(term))
+			.map((p) => ({ id: p.id, kind: 'project', label: p.name, color: p.color }))
+			.sort((a, b) => rank(a.label, b.label, term));
+	}
+
+	// The same completion for [[ as for #, over the notes the page has loaded. The
+	// current note is left out — a note that links to itself is a loop nobody meant
+	// — and a note with no title yet cannot be pointed at, so it is skipped too.
+	function noteMatches(term) {
+		return notes
+			.filter((n) => n.id !== note?.id && n.title && n.title.toLowerCase().includes(term))
+			.map((n) => ({ id: n.id, kind: 'note', label: n.title }))
+			.sort((a, b) => rank(a.label, b.label, term));
+	}
+
+	function rank(a, b, term) {
+		const al = a.toLowerCase();
+		const bl = b.toLowerCase();
+		const ap = al.startsWith(term);
+		const bp = bl.startsWith(term);
+		if (ap !== bp) return ap ? -1 : 1;
+		return al.localeCompare(bl, 'da');
+	}
+
+	const escHtml = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+	const escAttr = (s) => escHtml(s).replace(/"/g, '&quot;');
+
+	// A click on a note link follows it; a click anywhere else re-colours the code,
+	// as it did before. The link is contenteditable="false", so the click is a click
+	// and not a caret landing in the middle of a word.
+	function onEditorClick(event) {
+		const link = event.target.closest?.('.notelink');
+		if (link) {
+			event.preventDefault();
+			onopennote?.(link.getAttribute('data-note') ?? link.textContent);
+			return;
+		}
+		colourCode();
+	}
+
+	/** Replaces the half-typed tag with the whole thing. */
+	function accept(item) {
 		const partial = partialTag();
 		if (!partial) return;
 
 		const range = document.createRange();
-		range.setStart(partial.node, partial.start);
-		range.setEnd(partial.node, partial.start + partial.term.length);
 		const selection = window.getSelection();
-		selection.removeAllRanges();
-		selection.addRange(range);
 
-		// A trailing space, because the next thing typed is a word and not more of
-		// the tag — and without it the suggestions come straight back.
-		document.execCommand('insertText', false, project.name + ' ');
+		if (item.kind === 'note') {
+			// Swallow the opening [[ as well and drop the finished link in its place,
+			// so it is a link the moment it is chosen — not the brackets, waiting to
+			// become one when the note is next opened. A space after, as its own text,
+			// so the caret leaves the atomic link and the next word is a word.
+			range.setStart(partial.node, partial.start - 2);
+			range.setEnd(partial.node, partial.start + partial.term.length);
+			selection.removeAllRanges();
+			selection.addRange(range);
+			document.execCommand(
+				'insertHTML',
+				false,
+				`<a class="notelink" data-note="${escAttr(item.label)}" contenteditable="false">${escHtml(item.label)}</a>`
+			);
+			document.execCommand('insertText', false, ' ');
+		} else {
+			range.setStart(partial.node, partial.start);
+			range.setEnd(partial.node, partial.start + partial.term.length);
+			selection.removeAllRanges();
+			selection.addRange(range);
+			// A trailing space, or the suggestions come straight back for the tag.
+			document.execCommand('insertText', false, `${item.label} `);
+		}
+
 		suggestions = [];
 		onchange?.(htmlToMarkdown(editor));
 	}
@@ -470,6 +616,16 @@
 		}
 
 		if (event.key === 'Enter' && !event.shiftKey) {
+			// A code block is the one place the browser keeps the caret inside on
+			// Enter rather than starting a new block. Step out of it ourselves, or a
+			// monospace last line traps everything typed after it in monospace.
+			const block = currentBlock();
+			if (block && block.tagName === 'PRE') {
+				event.preventDefault();
+				exitPre(block);
+				changed();
+				return;
+			}
 			// After the split, not before it.
 			setTimeout(() => {
 				keepTitleFirst();
@@ -678,7 +834,7 @@
 			readState();
 			readSuggestions();
 		}}
-		onclick={colourCode}
+		onclick={onEditorClick}
 		onmouseup={readState}
 		{onkeydown}
 		{onpaste}
@@ -698,7 +854,7 @@
 			style:top={menuAt ? `${menuAt.top}px` : null}
 			style:left={menuAt ? `${menuAt.left}px` : null}
 		>
-			{#each suggestions as project, i (project.id)}
+			{#each suggestions as item, i (item.kind + item.id)}
 				<li>
 					<button
 						class:on={i === chosen}
@@ -706,12 +862,17 @@
 						aria-selected={i === chosen}
 						onmousedown={(e) => {
 							e.preventDefault();
-							accept(project);
+							accept(item);
 						}}
 					>
-						<span class="dot" style="background: {colorVar(project.color)}" aria-hidden="true"
-						></span>
-						#{project.name}
+						{#if item.kind === 'note'}
+							<span class="dot note" aria-hidden="true">[[</span>
+							{item.label}
+						{:else}
+							<span class="dot" style="background: {colorVar(item.color)}" aria-hidden="true"
+							></span>
+							#{item.label}
+						{/if}
 					</button>
 				</li>
 			{/each}
@@ -864,6 +1025,18 @@
 		font-size: var(--text-sm);
 	}
 
+	/* A note suggestion wears the brackets that open it where a project wears its
+	   colour, so the two kinds are told apart at a glance in the same list. */
+	.suggestions .dot.note {
+		width: auto;
+		height: auto;
+		background: none;
+		color: var(--ink-faint);
+		font-family: var(--mono, ui-monospace, monospace);
+		font-size: 0.85em;
+		line-height: 1;
+	}
+
 	.suggestions button.on {
 		background: var(--surface);
 		color: var(--ink);
@@ -1023,6 +1196,18 @@
 		margin: var(--s2) 0;
 	}
 
+	/* A note link reads as a link: the accent colour, underlined on hover, and a
+	   pointer so it is plainly something to click rather than to edit. */
+	.page :global(a.notelink) {
+		color: var(--accent);
+		text-decoration: none;
+		cursor: pointer;
+		border-radius: var(--radius-sm);
+	}
+	.page :global(a.notelink:hover) {
+		text-decoration: underline;
+	}
+
 	.page :global(blockquote) {
 		margin: 0 0 var(--s2);
 		padding-left: var(--s3);