docs: byggeprompten, så den kan hentes uden en terminal

Filen har ligget utracket i arbejdstræet hele tiden. Den ligger her på en
gren og ikke på main, fordi spørgsmålet om den hører til i repoet stadig er
Kristians — det her er kun en vej til at hente den fra en browser.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/docs.yml

@@ -3,6 +3,11 @@ name: Documentation
 # The docs are built on every push so a broken build is caught immediately, but
 # only published once GitHub Pages has been enabled for the repository. Until the
 # owner decides to publish, this job builds and stops.
+#
+# And on pull requests, where the build is the only check there is: `mkdocs build
+# --strict` fails on a link to a page that does not exist, and building only after
+# the merge means finding that out on `main`. Nothing is published from a pull
+# request — the `deploy` job below runs on a manual dispatch and nothing else.
 on:
   push:
     branches: [main]
@@ -10,6 +15,11 @@ on:
       - 'docs/**'
       - 'mkdocs.yml'
       - '.github/workflows/docs.yml'
+  pull_request:
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - '.github/workflows/docs.yml'
   workflow_dispatch:
 
 permissions:

.github/workflows/release.yml

@@ -17,6 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          # Taggen selv, ikke kun den commit den peger på: udgivelsesteksten
+          # nedenfor står i tagbeskeden, og en overfladisk checkout henter
+          # commit'en uden den.
+          fetch-depth: 0
 
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
@@ -60,7 +65,28 @@ jobs:
       #
       # Created after the image, so a release never announces a version that
       # failed to build.
+      # Tagbeskeden ER annonceringen. Den skrives, når der tagges, på produktets
+      # eget sprog og til dem, der bruger det — og indtil nu nåede den aldrig
+      # frem: udgivelsen på GitHub blev fyldt med en autogenereret liste over
+      # commit-overskrifter, som er skrevet til dem, der læser koden.
+      #
+      # Den sidste linje er et link til udgivelsen selv, og den tages af: en
+      # side, der linker til sig selv, hjælper ingen.
+      - id: notes
+        run: |
+          {
+            echo 'body<<VERDANDE_EOF'
+            git tag -l --format='%(contents)' "${GITHUB_REF_NAME}" \
+              | sed '\#^https://github.com/.*/releases/tag/#d' \
+              | sed -e :a -e '/^\n*$/{$d;N;ba' -e '}'
+            echo VERDANDE_EOF
+          } >> "$GITHUB_OUTPUT"
+
       - uses: softprops/action-gh-release@v2
         with:
+          body: ${{ steps.notes.outputs.body }}
+          # Stadig sat: den autogenererede liste lægges *under* teksten ovenfor,
+          # så både den, der vil vide hvad der er nyt, og den, der vil se hvilke
+          # ændringer det var, kan læse det samme sted.
           generate_release_notes: true
           make_latest: true

README.md

@@ -37,17 +37,32 @@ and an MCP endpoint so Claude can work your task list directly.
 - **Projects, sections, sub-tasks, labels, saved filters.** List, board and calendar
   views, and foldable groups over the projects in the sidebar.
 - **Notes, beside the work.** Rich text that is Markdown underneath — headings,
-  lists, quotes, fenced code. A note is shared by filing it in a project;
-  `#project` and `[[another note]]` are links, and a task shows the notes that
-  mention it. A zip of Markdown goes in — Obsidian, Bear, or Apple Notes through
+  lists, quotes, fenced code. A note is shared by filing it in a project, by
+  handing it to one person — including somebody who has no account yet, who gets an
+  invitation that becomes the share when they sign up — or by writing `@Sofie` in
+  the text, which shares it with her and tells her. `#project` and
+  `[[another note]]` are links, and a task shows the notes that mention it. A zip of Markdown goes in — Obsidian, Bear, or Apple Notes through
   the exporter in [`tools/`](tools/) — and comes back out the same shape.
 - **Drag where it means something.** Reorder a list or a board, file a project under
   a group, drop a task on another project, or drop it on another day.
 - **Sharing.** Owner, editor and viewer roles. There is no open registration:
-  everybody arrives through an invite link, either to a project or — from
-  **Settings → Brugere** — to the instance itself. Nobody's password is ever chosen
-  by somebody else.
+  everybody arrives through an invite link — to a project, to a single note, or
+  from **Settings → Brugere** to the instance itself. Nobody's password is ever
+  chosen by somebody else.
 - **Live sync.** A change made by somebody else appears without a refresh.
+- **Notifications that are worth reading.** A bell for what other people did to what
+  you share — folded, so one person typing for five minutes is one line — pushed to
+  your devices and counted on the app's icon in the Dock.
+- **AI that suggests and never writes.** Optional, off by default, your own key and
+  your own model if you want. It tidies the inbox, pulls the tasks out of a meeting
+  note, writes a morning plan, turns *"SV: SV: Vedr. levering uge 12"* into the
+  action the mail asks for, and answers questions about your own notes with links to
+  what the answer rests on. Every one of them arrives as a line you accept, edit or
+  refuse — a model that edits your tasks directly has to be right every time to be
+  worth having.
+- **Anything can put a task in the inbox.** A mail to your own forwarding address,
+  or a POST of one line of text from a shortcut on your phone, a script or any
+  service that can call a URL.
 - **Recurring tasks** as RRULE (RFC 5545), reminders, comments and attachments.
 - **Standards, not homegrown formats.** iCalendar and CalDAV, ICS feeds, OAuth2 with
   PKCE, OpenAPI 3.1, MCP, Web Push, Argon2id.

docs/ai.md

@@ -43,23 +43,92 @@ The key is stored on your account and is **never sent back** to the settings pag
 a page that repopulates a password field is one that will eventually leak it into a
 screenshot.
 
+## The shape of all of it
+
+**The model proposes; you decide.** Nothing is written until you say yes, and the
+proposal is a line in the same syntax you type yourself — `Ring til Anders i morgen
+p1 #Firma` — sitting in a field you can edit before you accept it.
+
+That is not caution for its own sake. A model that edits your tasks directly has to
+be right *every* time to be worth having. One that suggests only has to be right
+often enough to save you some typing, and when it is wrong you have already seen it.
+
+It is also why the suggestion is a line rather than a set of fields: there is one
+reading of "i morgen" in this program, and a suggestion goes through the same
+[quick add](quick-add.md) parser as anything you type — including after you have
+edited it by hand.
+
+The model is given the names of the projects that exist and may name no others. A
+`#Projekt` it invented would create one by accident the first time you accepted it,
+and a guess must not be able to move a task somewhere you will not look for it.
+
 ## What it can do
 
-**Split a task into sub-tasks.** On any task: *Split with AI*. It suggests two to
-seven concrete actions and creates them as sub-tasks. Written in your language.
+**Tidy up the inbox.** In the Inbox, the menu → *Ryd op i indbakken*. For each loose
+line it suggests how you would have written it if you had finished it — project,
+date, priority — with one sentence on what it read out of the task. Accept, edit, or
+skip, one line at a time.
+
+**Find the tasks in a note.** Open a note → *Find opgaver i noten*. Only what
+somebody committed to or was asked to do; a heading is not a task and a topic that
+was discussed is not a task. Each suggestion quotes the words it came from, so a
+wrong one can be seen through rather than merely being wrong. The note itself is
+never edited — the task carries `[[the note's title]]` in its description instead.
+
+**Today's plan, in the morning.** **Settings → Beskeder → Dagens plan**, off by
+default; pick the hour yourself. One notification about what is due today and what
+has been missed, and what to start with — and the same text as a card at the top of
+**I dag**, where you are looking anyway when you start the day. The notification is
+the reminder; the card is where it stays.
+
+The card shows the plan *as it was sent*, with the time it was made, rather than a
+new one each time you look: a plan that says something different when you look at it
+than it said when it arrived is worse than either. **Forny planen** makes a new one
+when the day has moved, and it does not send a notification about something you are
+already looking at. With the morning notification off, the card offers to make one
+on the spot.
+
+The counts are done in the database and handed to the model as facts it may not
+recompute — a plan that says four tasks where there are three is worse than no plan.
+With no model configured the counts stand on their own, which is what you needed to
+know at seven in the morning anyway. Nothing due and nothing overdue sends nothing.
+
+**Mail that becomes a task you can act on.** Where a
+[mailbox](mailboxes.md) used to produce *"Anders Jensen: SV: SV: Vedr. levering uge
+12"*, the model writes the action the mail asks for — and leaves the mail alone if
+it asks for nothing. The subject stays in the description, so a mail it misread can
+still be read. If the model is unavailable the task is named sender and subject as
+before: a model that is down must not be able to stop the post.
+
+**Ask your own notes and tasks.** ⌘K, type the question, ⌘⏎. *"Hvad lovede jeg
+Anders i august?"* — search finds what contains the words, this answers the
+question, and the answer links to the notes and tasks it rests on. If nothing
+matches, it says so; a guess would be useless here, because you are asking precisely
+because you cannot remember.
+
+**Split a task into sub-tasks.** On any task: *Split with AI*. Two to seven concrete
+actions, created as sub-tasks.
 
 **A weekly summary.** A short note over what is outstanding: what looks urgent and
-what appears to be slipping. At most six lines — it is a prompt to think, not a
-report.
+what appears to be slipping. At most six lines — a prompt to think, not a report.
 
 ## What is sent
 
-Only what the feature needs: for a split, the task's title and notes; for a
-summary, the titles, dates and priorities of your open tasks. Never comments,
-attachments, or anything from a project the feature was not invoked on.
+Only what the feature needs, and only when you invoke it:
 
-Nothing is sent to anybody until you configure a provider. With a local model,
-nothing leaves your machine at all.
+| Feature | What leaves the instance |
+| --- | --- |
+| Tidy the inbox | The titles of the loose tasks in your inbox, the first words of their descriptions, and your project names |
+| Tasks in a note | That one note's text, and your project names |
+| Today's plan | The titles and dates of what is due or overdue today |
+| Mail to task | Sender, subject and the snippet of the mails in that sweep |
+| Ask | Your question, and the notes and tasks the search matched |
+| Split a task | That task's title and notes |
+| Weekly summary | The titles, dates and priorities of your open tasks |
+
+Never comments, never attachments, never a project the feature was not invoked on,
+and never anything belonging to somebody else. Nothing is sent to anybody until you
+configure a provider, and with a local model nothing leaves your machine at all.
 
 ## Turning it off
 

docs/beacon.md

@@ -0,0 +1,75 @@
+# The install count
+
+verdande reports that it exists. Two values, once a day:
+
+```json
+{
+  "instance_id": "01a0806d-3601-7000-ad76-057f1f684881",
+  "version": "v0.44.1"
+}
+```
+
+That is the whole message. No IP is stored by the collector, no hostname, no
+domain, no account, no counts of anything you have made, nothing about what you
+use it for. The payload is small enough to be printed in full on the settings page,
+and it is printed there — a promise about telemetry is worth exactly as much as
+your ability to check it.
+
+## On by default, off in one click
+
+The alternative that was considered first was compulsory, and the argument against
+it is practical rather than principled: it cannot be enforced. The domain can be
+blocked, the binary can be patched, and a fork removes it in its first commit. So
+mandatory buys nothing over on-by-default while costing the trust the rest of this
+program works for.
+
+Which is why the first administrator to sign in is **told, unprompted**, with the
+real id, the real version and the real address in front of them, and two buttons.
+On by default is only defensible if it is said out loud without being asked; a
+settings page where it is stated fully is not the same thing, because that page is
+opened by people who already suspect there is something to read.
+
+**Settings → Data** afterwards: one switch. An explicit "off" survives upgrades.
+
+!!! note "This disagrees with the update check, on purpose"
+
+    `VERDANDE_UPDATE_CHECK` is off unless you ask for it, and its reasoning is that
+    a self-hosted app reaching out unbidden has broken the deal its operator made by
+    self-hosting. That is the same situation as this one, and the two defaults do
+    not agree. The case for treating them differently: the update check reveals an
+    instance to a third party (GitHub) and returns something you can act on, while
+    this returns nothing and goes to the project. Whether that is a distinction or
+    an excuse is a judgement call, and it was made deliberately.
+
+## What the collector cannot see, and what it can
+
+A request has a source address whether or not anybody writes it down. The collector
+stores none and logs none, and the code is arranged so the address never reaches a
+function that could — the table has nowhere to put one. But the request passes
+through a reverse proxy and a tunnel on the way, and those keep their own logs.
+"We send no IP" would be a half-truth; what is true is that nothing here records
+one.
+
+The ping is not authenticated either, so anybody can post a made-up id and inflate
+the count. That is an accepted trade: a token would have to ship inside every
+install anyway.
+
+## Running your own count
+
+Somebody running a fleet points **Settings → Data → Modtagerens adresse** at their
+own instance, and ticks **Denne instans er tælleren** there. Until that is ticked,
+`POST /api/v1/beacon` answers **404** rather than accepting quietly — an instance
+nobody made a collector must not become a bucket anyone can post into.
+
+The collector's page then shows totals, active in 7 and 30 days, and a breakdown by
+version. Publishing that number at `/api/v1/beacon/count` is a second, separate
+opt-in, and it has a floor under it (25 by default): a number that *falls* cannot be
+published as a fact — a bad release, a DNS change that quietly stops the pings, or
+lost rows all look like "fewer people use this now" — and a small number mostly says
+how little it takes to move it.
+
+## When it cannot reach
+
+The reason is written down and shown on the settings page. A beacon that cannot
+reach its collector otherwise fails in complete silence: it tries again tomorrow,
+the page says "last sent" with a date that quietly gets older, and nobody notices.

docs/configuration.md

@@ -127,11 +127,17 @@ next time each value is written, so turning this on costs nobody a reconnection.
 
 | Variable | Default | What it does |
 |---|---|---|
-| `VERDANDE_UPDATE_CHECK` | `false` | Ask GitHub whether a newer release exists. |
+| `VERDANDE_UPDATE_CHECK` | `false` | Ask GitHub whether a newer release exists, and tell the administrators when one does. |
 | `VERDANDE_PANEL_URL` | — | The Yggdrasil panel this instance runs under. |
 | `VERDANDE_PANEL_TOKEN` | — | An API token from that panel, belonging to somebody with control of this server. |
 | `VERDANDE_PANEL_SERVER_ID` | — | Which server to restart — the id in the panel's URL. |
 
+With the check on, administrators are told **once per version** — in the bell, in
+push and on the app's badge — rather than having to open the settings page and
+look. The notification leads to the page where the restart button is. With the
+check off nothing is fetched and nothing is said; see
+[Notifications](notifications.md).
+
 All three together let **Settings → Notifications** restart this instance,
 which is also how it picks up a new version: a container cannot replace its own
 image, so the panel recreates it and pulls `:latest` on the way. The request asks

docs/index.md

@@ -27,8 +27,9 @@ forward mail to, and an MCP endpoint so Claude can work your task list directly.
   The calendar draws each task to its length — drag the foot to resize, the body
   to move it.
 - **Notes, beside the work.** Rich text to write in, Markdown on disk. Share a
-  single note with a person, or file it in a project; `#project` and
-  `[[another note]]` are links, and a task shows what has been written about it.
+  single note with a person — by name, by email address, or by writing `@Sofie` in
+  the text — or file it in a project; `#project` and `[[another note]]` are links,
+  and a task shows what has been written about it.
 - **Delegate, and snooze.** Hand a task to somebody and it is marked with an
   arrow to them, gathered on a *Waiting on others* page. Snooze one to park it,
   greyed, at the foot of the list until a moment you pick — without touching when
@@ -38,8 +39,18 @@ forward mail to, and an MCP endpoint so Claude can work your task list directly.
 - **Sharing** with owner, editor and viewer roles. Anyone outside your instance
   joins through an invite link.
 - **Live sync** — a change made by somebody else appears without a refresh.
+- **[Told when it matters](notifications.md).** A bell for what other people did to
+  what you share, pushed to your devices and counted on the app's icon in the Dock.
+- **[AI that suggests and never writes](ai.md).** Optional, your own key. It tidies
+  the inbox, pulls the tasks out of a meeting note, writes a morning plan, turns
+  *"SV: SV: Vedr. levering uge 12"* into what the mail actually asks for, and
+  answers questions about your own notes with links to what the answer rests on —
+  every one of them as a line you accept, edit or refuse.
 - **Repeating tasks** as RRULE, comments and attachments, and reminders that go
   out as Web Push to an iPhone or a Mac.
+- **[Anything can put a task in your inbox](mail.md)** — a mail to your own
+  address, or a POST from a shortcut on your phone, a script, or any service that
+  can call a URL.
 - **[Your mail as an inbox](mailboxes.md).** Star a mail in Gmail, or flag one
   over IMAP in iCloud or Fastmail, and it becomes a task — and the star or flag
   comes off once it has, so a starred inbox empties as the tasks are made instead

docs/links.md

@@ -0,0 +1,52 @@
+# Opening links
+
+A link in a task or a note opens in whichever browser your system opens links in.
+**Settings → Links** can try to change that — and the honest description of what it
+does is *try*.
+
+## What a web page cannot do
+
+Two things, and they set the limits of this feature:
+
+- **It cannot see which browsers are installed.** The list is deliberately closed:
+  it would be a fingerprint, distinctive enough to follow somebody from site to
+  site.
+- **It cannot ask the system to use a particular one.** A link goes to the default
+  browser, and there is no API that says otherwise.
+
+The only handle that exists is the URL schemes browsers register for themselves —
+`firefox://open-url?url=…`, `googlechrome://…`, `microsoft-edge:…` — and there is no
+way to ask whether one exists. You can only try it.
+
+## So the setting is an attempt
+
+Pick Safari, Chrome, Firefox or Edge, or write your own scheme. When you click a
+link, that scheme is tried first; if nothing has happened within about half a
+second, the link opens the ordinary way.
+
+The fallback is the whole reason this is safe to turn on. Without it, a setting
+that works on your phone would leave links doing nothing on your desktop.
+
+In practice: **it works on a phone**, where browsers register these schemes, and
+**rarely on a Mac or a PC**, where Chrome and Firefox do not. Edge on Windows is
+the usual exception. There is a **Prøv det** button for exactly this reason — you
+cannot ask whether a scheme exists, so it is better to find out on example.dk than
+on a link you meant to follow.
+
+## Writing your own
+
+Three placeholders, because browsers disagree about the shape they want the address
+in:
+
+| | |
+| --- | --- |
+| `{url}` | The address as it is — `x-safari-https://example.dk` |
+| `{encoded}` | The address as a parameter value — `firefox://open-url?url=https%3A%2F%2F…` |
+| `{stripped}` | The address without the `https://` — `googlechrome://example.dk` |
+
+## It belongs to the machine, not the account
+
+The choice is kept in the browser you are sitting at, not on your account — the
+same rule the sidebar's width follows. `firefox://` works on the phone and does
+nothing on the Mac, so a choice that followed the account would be wrong in one of
+the two places every time.

docs/mail.md

@@ -67,3 +67,36 @@ immediately.
 
 !!! tip "Keep the address to yourself"
     Treat it like a secret. If you publish it somewhere, rotate it.
+
+## Pushing from another program
+
+The address above needs a mail server. When what you want is a shortcut on your
+phone, a script, or any service that can call a URL, there is a second way in:
+**Settings → Integrationer → Skub fra andre programmer** gives you an address to
+POST a line of text to.
+
+```bash
+curl -X POST https://todo.example.dk/inbound/hook/<token> \
+  -H "Content-Type: text/plain" \
+  -d "Ring til Anders i morgen p1 #Firma"
+```
+
+The body is read three ways, because those are the three you meet: plain text from
+a shortcut that just sends what was selected, JSON with a `text` field from a
+service, or a form field from a webhook form. The first line becomes the task and
+the rest sits underneath it, and the line goes through the [quick add](quick-add.md)
+parser — so "i morgen", "p1" and "#Firma" mean here what they mean in the box at the
+top of the app.
+
+**The address is a key.** It has its own token rather than sharing the mail one:
+the two are the same kind of secret but they leak separately, and a URL that has
+been sitting in a shortcut on a lost phone has to be replaceable without changing
+the address other people have in their address books. A token here can do one
+thing — put a task in your inbox — which is why it is not an
+[API token](api.md), which can do everything. Change it under the same setting; the
+old one stops working at once.
+
+**POST only.** A GET would be easier to call, and that is exactly the problem: a
+browser prefetch, a link check in a chat, and a revisited history entry would all
+create tasks nobody asked for.
+

docs/notes.md

@@ -79,6 +79,37 @@ There is no folder tree. Projects, groups and labels already exist, are already
 shared and already have roles — a second hierarchy to file things in is one too
 many, and a note in a project inherits every one of those answers.
 
+### Sharing one note with one person
+
+Filing a note in a project is the right tool when the note belongs with a body of
+work, and the wrong one when it is just *let Sofie see this*. **Del med personer**
+at the foot of the note does the second: this note, this person, as reader or
+editor. Only the note's owner can share it.
+
+Type an **email address** rather than picking a name, and one of two things
+happens. An address that already has an account is shared with straight away. One
+that does not gets an invitation — a link that creates the account and the share
+together, so the note is theirs the moment they sign up. Invitations wait in the
+panel under the note, where they can be withdrawn; that is the only way back, since
+only the token's hash is stored and a link sent to the wrong address cannot be
+looked up.
+
+### Naming somebody in a note
+
+Writing `@Sofie` in a note shares it with her and tells her. Naming somebody in a
+note *is* wanting them to read it, and doing it as two acts — write the name, then
+open the panel and find the person — meant the second was forgotten, and the note
+sat there addressing somebody who could not see it. The editor suggests names after
+`@`, the same way `#` suggests projects.
+
+- **Only the owner's mentions share.** An editor may write the name; giving
+  somebody else's note away is the owner's alone.
+- **As a reader**, which is the least that satisfies "look at this". A role you
+  have raised in the panel is never lowered by a mention.
+- **Only a name that has just appeared** counts. A note is saved on every typing
+  pause, so without that every save would be another share and another notification
+  about the same name.
+
 ## Finding
 
 The list groups itself: favourites first, then **Today**, **Yesterday**, **This

docs/notifications.md

@@ -0,0 +1,51 @@
+# Notifications
+
+What other people did that you need to know about, and what the day has in it.
+Verdande tells you in three places at once, and they are the same thing said three
+ways: the **bell** in the header, a **push** to your devices, and the **badge** on
+the app's icon.
+
+## What causes one
+
+| | |
+| --- | --- |
+| Somebody edited a note shared with you | Repeat edits fold into one line while it is unread |
+| Somebody shared a note with you | Once, when it happens |
+| Somebody named you in a note with `@` | Instead of "edited a note" — one act, one message |
+| Somebody gave you a task | Only on the change, and only to the person who got it |
+| Somebody commented | |
+| [Today's plan](ai.md), if you turned it on | In the morning, at the hour you chose — it opens the card on **I dag** |
+| A new version is out | Administrators only, once per version |
+
+Not your own actions: the server does not tell anybody what they just did
+themselves. And not everything that happens — a bell that rings at every change in
+a shared project is a bell people stop looking at.
+
+**Repeat edits are folded.** A note is saved on every typing pause, so one person
+writing for five minutes would otherwise be twenty identical lines. While the
+message is unread, a further edit moves it back to the top and says who touched it
+last. Once you have read it, the next edit is a new thing to be told.
+
+## Push, and the badge
+
+**Settings → Beskeder** turns on Web Push for the device you are sitting at, per
+device: the phone in your pocket and the laptop you have open are different
+answers, and a permission granted on one is not the other's.
+
+The **badge** — the number on the icon in the Dock on a Mac, on the taskbar on a
+PC — needs the app to be installed (added to the Dock, or installed as an app in
+Chrome or Edge). Half the point of being told is being told while you are doing
+something else, and the icon is the only place the app can say anything then. It
+counts unread messages and goes down by itself as you read them. Firefox does not
+support it; nothing else changes there.
+
+The sentence you see is written in your browser from *what happened* and *who did
+it*, so an English interface gets an English bell. The server's own wording is
+Danish and is used only for push, which has no dictionary to look a phrase up in.
+
+## Telling you about a new version
+
+If the [update check](configuration.md) is on, administrators get one notification
+per version — never one a day about the same one — and it leads to
+**Settings → Beskeder**, where the button that restarts the instance to update it
+sits. With the check off, nothing is fetched and nothing is said.

docs/openapi.yaml

@@ -3688,7 +3688,21 @@ paths:
   /api/v1/ai/plan/now:
     post:
       tags: [integrations]
-      summary: Send today's plan now, to whoever asks.
+      summary: Make today's plan now, to whoever asks.
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                silent:
+                  type: boolean
+                  description: >
+                    Make and store it without sending a notification — the card on
+                    Today asking for a plan while somebody is looking at it. A
+                    notification about something in front of you is the kind that
+                    teaches people to ignore the bell.
       description: |
         The counts come from the database and the sentence from the model, in that
         order: a model that counted for itself would sometimes count wrong, and a
@@ -4545,8 +4559,9 @@ components:
     DailyPlanSettings:
       type: object
       description: >
-        One person's morning plan. Off by default — a notification at seven in the
-        morning that nobody asked for is not a help.
+        One person's morning plan, and today's plan itself. One resource, because
+        it is one thing: the plan is the resource and the setting is when it gets
+        made.
       properties:
         enabled: { type: boolean }
         hour:
@@ -4555,6 +4570,17 @@ components:
         last_sent:
           type: string
           description: The date it last went out, in that person's own timezone.
+        plan:
+          type: string
+          description: >
+            Today's plan as it was sent — kept rather than recomputed on every
+            look. A plan that says something different when you look at it than it
+            said when it arrived is worse than either. Absent when the stored plan
+            is from another day.
+        plan_date: { type: string }
+        plan_at:
+          type: integer
+          description: Unix seconds. Shown on the card, because a plan made at seven reads differently at four.
 
     AISuggestion:
       type: object

internal/httpapi/ai_plan_handlers.go

@@ -39,6 +39,19 @@ type planSettings struct {
 	// tidszone. En dato og ikke et tidsstempel, fordi spørgsmålet er "har de fået
 	// dagens plan i dag" — og det er et spørgsmål om dagen dér, hvor de er.
 	LastSent string `json:"last_sent,omitempty"`
+	// Plan er teksten, som den blev sendt, og PlanDate den dag den gælder.
+	//
+	// Gemt frem for regnet forfra, hver gang nogen kigger. To grunde, og den anden
+	// er den vigtige: en model pr. sidevisning er dyr, og en plan, der siger noget
+	// andet end den besked, man fik i morges, er værre end begge dele hver for
+	// sig. Det er den samme tekst — ellers er det ikke *dagens plan*, men et nyt
+	// gæt hver gang man kigger.
+	//
+	// PlanAt er klokkeslættet, den blev lavet, så kortet kan sige det: en plan fra
+	// klokken syv er en anden slags oplysning klokken fire end klokken otte.
+	Plan     string `json:"plan,omitempty"`
+	PlanDate string `json:"plan_date,omitempty"`
+	PlanAt   int64  `json:"plan_at,omitempty"`
 }
 
 func (s *Server) planSettings(ctx context.Context, userID string) (planSettings, error) {
@@ -56,21 +69,44 @@ func (s *Server) planSettings(ctx context.Context, userID string) (planSettings,
 	if v, ok := stored["last_sent"].(string); ok {
 		out.LastSent = v
 	}
+	if v, ok := stored["plan"].(string); ok {
+		out.Plan = v
+	}
+	if v, ok := stored["plan_date"].(string); ok {
+		out.PlanDate = v
+	}
+	if v, ok := stored["plan_at"].(float64); ok {
+		out.PlanAt = int64(v)
+	}
 	return out, nil
 }
 
 func (s *Server) savePlanSettings(ctx context.Context, userID string, p planSettings) error {
 	return s.db.SetUserSettings(ctx, userID, planScope, map[string]any{
 		"enabled": p.Enabled, "hour": p.Hour, "last_sent": p.LastSent,
+		"plan": p.Plan, "plan_date": p.PlanDate, "plan_at": p.PlanAt,
 	})
 }
 
+// handleGetPlanSettings er både indstillingen og dagens plan.
+//
+// Ét endepunkt, fordi det er én ting: planen *er* ressourcen, og indstillingen er,
+// hvornår den bliver lavet. To ville betyde to kald fra siden, der viser den, og
+// to steder at huske at rydde en plan fra i går.
+//
+// En plan fra i går sendes ikke med. Den er ikke forkert, den er bare ikke dagens
+// — og et kort, der viser gårsdagens plan under overskriften "i dag", er værre end
+// et tomt kort.
 func (s *Server) handleGetPlanSettings(w http.ResponseWriter, r *http.Request) {
-	p, err := s.planSettings(r.Context(), userFrom(r.Context()).ID)
+	user := userFrom(r.Context())
+	p, err := s.planSettings(r.Context(), user.ID)
 	if err != nil {
 		s.internal(w, r, "plan settings", err)
 		return
 	}
+	if p.PlanDate != time.Now().In(userLocation(user.Timezone)).Format("2006-01-02") {
+		p.Plan, p.PlanDate, p.PlanAt = "", "", 0
+	}
 	writeJSON(w, http.StatusOK, p)
 }
 
@@ -111,12 +147,29 @@ func (s *Server) handleSetPlanSettings(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, p)
 }
 
-// handlePlanNow sender dagens plan med det samme, til den der beder om det.
+type planNowRequest struct {
+	// Silent er kortet på I dag, der beder om en plan, mens man kigger på den.
+	//
+	// En besked om noget, man står og ser på, er en besked, der lærer folk at
+	// ignorere klokken. Indstillingssidens knap sender derimod rigtigt — det er
+	// hele dens formål: at vise, at push virker på det her apparat.
+	Silent bool `json:"silent"`
+}
+
+// handlePlanNow laver dagens plan med det samme, til den der beder om det.
 //
 // Findes, fordi en indstilling, man skal vente til i morgen for at se virkningen
-// af, er en indstilling, ingen tør slå til.
+// af, er en indstilling, ingen tør slå til — og fordi kortet på I dag skal kunne
+// lave en plan for den, der har beskeden slået fra.
 func (s *Server) handlePlanNow(w http.ResponseWriter, r *http.Request) {
+	var req planNowRequest
+	if r.ContentLength > 0 {
+		if err := decodeJSON(w, r, &req); err != nil {
+			return
+		}
+	}
 	user := userFrom(r.Context())
+
 	plan, err := s.buildPlan(r.Context(), user)
 	if err != nil {
 		s.internal(w, r, "build plan", err)
@@ -126,11 +179,36 @@ func (s *Server) handlePlanNow(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, http.StatusOK, map[string]any{"plan": "", "sent": false})
 		return
 	}
-	s.notify(r, &store.Notification{
-		UserID: user.ID, Kind: "daily.plan",
-		Title: planTitle(user.Locale), Body: plan,
+	if err := s.rememberPlan(r.Context(), user, plan); err != nil {
+		s.internal(w, r, "save plan", err)
+		return
+	}
+
+	sent := false
+	if !req.Silent {
+		s.notify(r, &store.Notification{
+			UserID: user.ID, Kind: "daily.plan",
+			Title: planTitle(user.Locale), Body: plan,
+		})
+		sent = true
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"plan": plan, "sent": sent,
+		"plan_at": time.Now().Unix(),
 	})
-	writeJSON(w, http.StatusOK, map[string]any{"plan": plan, "sent": true})
+}
+
+// rememberPlan gemmer dagens plan, så den kan ses igen uden at blive lavet igen.
+func (s *Server) rememberPlan(ctx context.Context, user *store.User, plan string) error {
+	p, err := s.planSettings(ctx, user.ID)
+	if err != nil {
+		return err
+	}
+	now := time.Now()
+	p.Plan = plan
+	p.PlanDate = now.In(userLocation(user.Timezone)).Format("2006-01-02")
+	p.PlanAt = now.Unix()
+	return s.savePlanSettings(ctx, user.ID, p)
 }
 
 // DailyPlans er timeslaget: hvem er der morgen hos, og hvem har ikke fået planen
@@ -182,6 +260,10 @@ func (s *Server) DailyPlans(ctx context.Context) error {
 				UserID: user.ID, Kind: "daily.plan",
 				Title: planTitle(user.Locale), Body: plan,
 			})
+			// Gemt, og gemt her frem for i rememberPlan: rækken er allerede
+			// læst ind i `p`, og to gemninger oven i hinanden ville lade den
+			// ene overskrive den andens `last_sent`.
+			p.Plan, p.PlanDate, p.PlanAt = plan, today, time.Now().Unix()
 		}
 		p.LastSent = today
 		if err := s.savePlanSettings(ctx, user.ID, p); err != nil {

internal/httpapi/ai_plan_test.go

@@ -3,6 +3,7 @@ package httpapi
 import (
 	"net/http"
 	"testing"
+	"time"
 )
 
 // Planen er tal fra basen, ikke fra modellen. En plan, der siger fire opgaver,
@@ -94,3 +95,63 @@ func TestAnImpossiblePlanHourIsRefused(t *testing.T) {
 		t.Fatalf("time 25 gav %d, want 422", resp.StatusCode)
 	}
 }
+
+// Planen gemmes for dagen, så kortet på I dag kan vise nøjagtig den tekst,
+// beskeden bar — og ikke et nyt gæt, hver gang nogen kigger.
+func TestTodaysPlanIsKeptForTheDay(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.quickTask(t, "noget i dag")
+
+	// Ingen plan endnu: kortet viser en knap frem for gårsdagens tekst.
+	if _, before := ts.do(t, "GET", "/api/v1/ai/plan", nil); before["plan"] != nil && before["plan"] != "" {
+		t.Fatalf("der lå en plan, før nogen havde lavet en: %v", before["plan"])
+	}
+
+	resp, made := ts.do(t, "POST", "/api/v1/ai/plan/now", map[string]any{"silent": true})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("lav planen: %d", resp.StatusCode)
+	}
+	if made["sent"] != false {
+		t.Errorf("en stille plan sendte en besked: %v", made["sent"])
+	}
+	if list, _ := notifications(t, ts); len(list) != 0 {
+		t.Errorf("kortets egen plan gav %d beskeder, want 0", len(list))
+	}
+
+	_, after := ts.do(t, "GET", "/api/v1/ai/plan", nil)
+	if after["plan"] != made["plan"] {
+		t.Errorf("den gemte plan = %v, den lavede = %v", after["plan"], made["plan"])
+	}
+	if after["plan_at"] == nil {
+		t.Error("planen bærer ikke, hvornår den blev lavet")
+	}
+}
+
+// En plan fra i går er ikke dagens. Et kort, der viser gårsdagens plan under
+// overskriften "i dag", er værre end et tomt kort.
+func TestYesterdaysPlanIsNotTodays(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.quickTask(t, "noget i dag")
+
+	if resp, _ := ts.do(t, "POST", "/api/v1/ai/plan/now", map[string]any{"silent": true}); resp.StatusCode != http.StatusOK {
+		t.Fatal("lav planen")
+	}
+
+	// Sat en dag tilbage, som om den var lavet i går.
+	user := userID(t, ts, "kristian@example.dk")
+	stored, err := ts.db.UserSettings(t.Context(), user, "dailyplan")
+	if err != nil {
+		t.Fatal(err)
+	}
+	stored["plan_date"] = time.Now().AddDate(0, 0, -1).Format("2006-01-02")
+	if err := ts.db.SetUserSettings(t.Context(), user, "dailyplan", stored); err != nil {
+		t.Fatal(err)
+	}
+
+	_, out := ts.do(t, "GET", "/api/v1/ai/plan", nil)
+	if plan, _ := out["plan"].(string); plan != "" {
+		t.Errorf("gårsdagens plan blev vist som dagens: %q", plan)
+	}
+}

mkdocs.yml

@@ -51,6 +51,8 @@ nav:
       - Signing in: signing-in.md
       - Quick add: quick-add.md
       - Notes: notes.md
+      - Notifications: notifications.md
+      - Opening links: links.md
       - Filters: filters.md
       - Importing from Todoist: import.md
   - Connecting things:
@@ -60,6 +62,8 @@ nav:
       - Mailboxes: mailboxes.md
       - Claude (MCP): mcp.md
       - AI features: ai.md
+  - Privacy:
+      - The install count: beacon.md
   # openapi.yaml is deliberately not in the nav: MkDocs copies it to the site as a
   # file, and api.md links to it. A nav entry expects a page to render.
   - Reference:

web/e2e/smoke.spec.js

@@ -4272,3 +4272,91 @@ test('en gentagelse, serveren kun kan på dansk, siges alligevel i fladen', asyn
 
 	expect(trouble).toEqual([]);
 });
+
+test('links kan åbnes i en anden browser, og åbner alligevel når skemaet ikke findes', async ({
+	page
+}) => {
+	const trouble = watchForTrouble(page);
+
+	await page.goto('/indstillinger');
+	await expect(page.getByRole('heading', { name: 'Links' })).toBeVisible();
+
+	// Som udgangspunkt gør indstillingen ingenting, og der er intet skemafelt at
+	// skrive i: et felt til en adresse, der ikke bliver brugt, er en invitation
+	// til at udfylde den og undre sig.
+	await expect(page.getByLabel('Skema')).toBeHidden();
+
+	// Et skema, der med sikkerhed ikke findes på nogen maskine. Pointen er ikke,
+	// at det virker — pointen er, hvad der sker, når det ikke gør.
+	await page.getByLabel('Åbn links i').selectOption('custom');
+	await page.getByLabel('Skema').fill('verdande-findes-ikke://{url}');
+	await page.getByLabel('Skema').blur();
+
+	// Valget hører til maskinen, ikke kontoen, så det står i localStorage.
+	const stored = await page.evaluate(() => localStorage.getItem('verdande:link-opener'));
+	expect(stored, 'valget blev ikke gemt på apparatet').toContain('verdande-findes-ikke');
+
+	// Om browseren rent faktisk tegner en fane, er browserens sag og ikke appens —
+	// en headless Chromium åbner den uden at fortælle nogen om det. Det, der er
+	// vores, er beslutningen: prøv skemaet, og åbn linket alligevel, når det ikke
+	// findes. Så det er dét, der bliver målt.
+	await page.evaluate(() => {
+		window.__opened = [];
+		window.open = (url) => {
+			window.__opened.push(url);
+			return { closed: false, close() {} };
+		};
+	});
+
+	await page.getByRole('button', { name: 'Prøv det' }).click();
+	await expect
+		.poll(() => page.evaluate(() => window.__opened), { timeout: 5000 })
+		.toEqual(['https://example.dk']);
+
+	// Og appen blev, hvor den var. Faldbacket må ikke kapre den fane, man står i:
+	// et link, der smider en ud af programmet, er værre end et, der åbner et sted,
+	// man ikke havde valgt.
+	await expect(page).toHaveURL(/\/indstillinger$/);
+
+	// Tilbage til systemets standard, så resten af prøverne klikker på links som
+	// alle andre.
+	await page.getByLabel('Åbn links i').selectOption('');
+	await expect(page.getByLabel('Skema')).toBeHidden();
+
+	expect(trouble).toEqual([]);
+});
+
+test('dagens plan står på I dag, og ikke kun som en besked', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+
+	await page.goto('/');
+	const box = page.getByLabel('Ny opgave');
+	await box.fill('ring til planlæggeren i dag');
+	await box.press('Enter');
+	await page.waitForTimeout(400);
+
+	// Uden en model er planen to tal — og det er stadig det, man havde brug for at
+	// vide om morgenen. Knappen er der, fordi morgenbeskeden er slået fra som
+	// udgangspunkt: den, der ikke vil vækkes, skal stadig kunne få planen.
+	await page.getByRole('button', { name: 'Lav dagens plan' }).click();
+
+	const card = page.locator('.plan');
+	await expect(card).toBeVisible();
+	await expect(card).toContainText('forfalder i dag');
+	// Klokkeslættet står på kortet: en plan fra klokken syv er en anden slags
+	// oplysning klokken fire end klokken otte.
+	await expect(card.locator('.made')).toBeVisible();
+
+	// Og den bliver stående — det er hele forskellen på et kort og en besked.
+	await page.reload();
+	await expect(page.locator('.plan')).toContainText('forfalder i dag');
+
+	// Skjult for i dag, ikke slettet: kortet er en påmindelse, og den der har læst
+	// den skal kunne få den af vejen.
+	await page.locator('.plan .close').click();
+	await expect(page.locator('.plan')).toBeHidden();
+	await page.reload();
+	await expect(page.locator('.plan')).toBeHidden();
+
+	expect(trouble).toEqual([]);
+});

web/src/lib/api.js

@@ -496,7 +496,9 @@ export const api = {
 	// Dagens plan om morgenen.
 	planSettings: () => get('/ai/plan'),
 	setPlanSettings: (body) => put('/ai/plan', body),
-	planNow: () => post('/ai/plan/now'),
+	// `silent` er kortet på I dag, der beder om en plan, mens man kigger på den:
+	// en besked om noget, man står og ser på, lærer folk at ignorere klokken.
+	planNow: (options) => post('/ai/plan/now', options ?? {}),
 
 	version: () => get('/version'),
 

web/src/lib/components/Notifications.svelte

@@ -56,6 +56,9 @@
 		// En ny version hører ingen steder hen i data — den fører hen, hvor knappen
 		// til at gøre noget ved den sidder.
 		if (n.kind === 'update.available') return goto('/indstillinger/notifikationer');
+		// Dagens plan står på I dag, hvor den bliver ved med at stå — beskeden er
+		// påmindelsen, kortet er stedet.
+		if (n.kind === 'daily.plan') return goto('/');
 		if (n.note_id) goto(`/noter?note=${n.note_id}`);
 		else if (n.task_id) app.openDetail(n.task_id);
 		else if (n.project_id) goto(`/projekt/${n.project_id}`);
@@ -111,7 +114,10 @@
 						<li>
 							<button class="row" class:unread={!n.read} onclick={() => follow(n)}>
 								<span class="what">{headline(n)}</span>
-								{#if n.body}<span class="about">{n.body}</span>{/if}
+								<!-- Dagens plan er tre linjer og ikke en overskrift. Klippet af
+								     efter én linje sagde den "2 forfalder i dag, 1 er sprun…",
+								     hvilket er den halve oplysning og hele støjen. -->
+								{#if n.body}<span class="about" class:full={n.kind === 'daily.plan'}>{n.body}</span>{/if}
 								<span class="ago">{when(n.created_at)}</span>
 							</button>
 						</li>
@@ -260,6 +266,12 @@
 		white-space: nowrap;
 	}
 
+	.about.full {
+		white-space: pre-line;
+		text-overflow: clip;
+		line-height: 1.5;
+	}
+
 	.ago {
 		font-size: var(--text-xs);
 		color: var(--ink-faint);

web/src/lib/linkopen.js

@@ -0,0 +1,172 @@
+/**
+ * Hvilken browser et link åbner i.
+ *
+ * # Hvad der ikke kan lade sig gøre
+ *
+ * En webside kan hverken se, hvilke browsere der er installeret, eller bede
+ * systemet om at åbne et link i en bestemt af dem. Listen over installerede
+ * programmer er lukket land med vilje — den er et fingeraftryk, der ville følge
+ * folk rundt på nettet — og et almindeligt link går altid til standardbrowseren.
+ *
+ * Det eneste håndtag, der findes, er de URL-skemaer, browserne selv registrerer:
+ * `firefox://open-url?url=…`, `googlechrome://…`, `microsoft-edge:…`. Der er ingen
+ * måde at spørge, om et skema findes; man kan kun prøve.
+ *
+ * # Hvad der så sker
+ *
+ * Vi prøver skemaet og holder øje med, om siden forsvinder. Åbnede en anden
+ * browser, mister denne fane fokus, og så er der ikke mere at gøre. Sker der
+ * ingenting inden for et sekund — hvilket er, hvad en Mac gør, hvor Chrome og
+ * Firefox ikke registrerer noget skema — åbnes linket helt normalt.
+ *
+ * Faldbacket er ikke en detalje: uden det ville en indstilling, der ser ud til at
+ * virke på telefonen, gøre links uklikbare på skrivebordet.
+ *
+ * # Hvorfor det står i localStorage
+ *
+ * Samme grund som sidebjælkens bredde: det er en egenskab ved maskinen, man
+ * sidder ved, ikke ved personen. `firefox://` virker på telefonen og gør
+ * ingenting på Mac'en, så et valg, der fulgte kontoen, ville være forkert det ene
+ * af de to steder hver gang.
+ */
+
+const KEY = 'verdande:link-opener';
+
+/**
+ * De skemaer, der er værd at tilbyde, og hvad de faktisk gør.
+ *
+ * `{url}` erstattes af adressen. Nogle skemaer vil have den kodet som en parameter
+ * (Firefox), andre sætter den bag skemaet, som den er (Chrome, Edge) — derfor er
+ * det en skabelon og ikke et navn, og derfor kan man skrive sin egen.
+ */
+export const OPENERS = [
+	{ id: '', label: 'link.openerDefault', template: '' },
+	{ id: 'safari', label: 'link.openerSafari', template: 'x-safari-{url}' },
+	{ id: 'chrome', label: 'link.openerChrome', template: 'googlechrome{stripped}' },
+	{ id: 'firefox', label: 'link.openerFirefox', template: 'firefox://open-url?url={encoded}' },
+	{ id: 'edge', label: 'link.openerEdge', template: 'microsoft-edge:{url}' }
+];
+
+/** Det gemte valg: en af id'erne ovenfor, eller en skabelon man selv har skrevet. */
+export function stored() {
+	if (typeof localStorage === 'undefined') return { id: '', template: '' };
+	try {
+		const raw = localStorage.getItem(KEY);
+		if (!raw) return { id: '', template: '' };
+		const parsed = JSON.parse(raw);
+		return { id: parsed.id ?? '', template: parsed.template ?? '' };
+	} catch {
+		return { id: '', template: '' };
+	}
+}
+
+export function save(choice) {
+	try {
+		localStorage.setItem(KEY, JSON.stringify(choice));
+	} catch {
+		// Privat vindue; valget holder til fanen lukkes.
+	}
+}
+
+/** Skabelonen, der gælder nu — enten den valgte eller den, man selv har skrevet. */
+function template() {
+	const choice = stored();
+	if (choice.id === 'custom') return choice.template;
+	return OPENERS.find((o) => o.id === choice.id)?.template ?? '';
+}
+
+/**
+ * Skabelonen fyldt ud med adressen.
+ *
+ * `{url}` er adressen, som den er — det er dét, `x-safari-https://…` og
+ * `microsoft-edge:https://…` vil have. `{encoded}` er den som parameterværdi, til
+ * Firefox. `{stripped}` er den uden `https://` foran, som Chrome vil have den:
+ * `googlechrome://example.dk`.
+ */
+export function expand(tpl, url) {
+	if (!tpl) return '';
+	return tpl
+		.replace('{encoded}', encodeURIComponent(url))
+		.replace('{stripped}', '://' + url.replace(/^https?:\/\//, ''))
+		.replace('{url}', url);
+}
+
+/**
+ * Åbner en adresse i den valgte browser, og ellers helt normalt.
+ *
+ * Returnerer, om skemaet blev forsøgt. Kalderen skal stadig lade være med at
+ * følge linket selv — det er derfor, klikket bliver stoppet, inden vi kommer
+ * hertil.
+ */
+export function open(url) {
+	const tpl = template();
+	if (!tpl) {
+		window.open(url, '_blank', 'noopener,noreferrer');
+		return false;
+	}
+
+	let handled = false;
+	// Forsvinder siden, åbnede noget andet den. Begge signaler, fordi de to
+	// platforme ikke er enige om hvilket der kommer: en telefon skjuler siden, en
+	// pc flytter fokus.
+	const gone = () => {
+		handled = true;
+	};
+	window.addEventListener('blur', gone, { once: true });
+	document.addEventListener('visibilitychange', gone, { once: true });
+
+	// Adresselinjen og ikke et skjult iframe.
+	//
+	// Iframet er den kendte opskrift, og den kan ikke bruges her: appens egen
+	// Content-Security-Policy siger `default-src 'self'`, så en ramme med et
+	// fremmed skema bliver blokeret, inden browseren når at se på den. Målt i
+	// e2e-prøven, som fangede CSP-fejlen i konsollen — uden den ville skemaet
+	// aldrig være blevet forsøgt i produktion, og indstillingen ville se ud til
+	// at virke, fordi faldbacket åbnede linket alligevel.
+	//
+	// At sætte location på et ukendt skema afbryder navigationen frem for at
+	// forlade siden: dokumentet bliver stående, og det er dét, der gør, at
+	// faldbacket nedenfor stadig har en side at køre i. Nogle browsere siger til
+	// om en adresse, de ikke forstår, og det er prisen for at kunne prøve.
+	location.href = expand(tpl, url);
+
+	// Kort, og det er ikke en smagssag.
+	//
+	// Faldbacket åbner en fane, og en browser tillader kun det et øjeblik efter et
+	// klik — Chrome og Firefox regner med omtrent fem sekunder, Safari med
+	// betydeligt mindre. Ventes der for længe, bliver faldbacket blokeret som en
+	// pop-up, og så gør linket ingenting overhovedet. Seks hundrede millisekunder
+	// er rigeligt til, at en anden browser når at tage over, og godt inden for
+	// det, der stadig tæller som "fordi nogen klikkede".
+	setTimeout(() => {
+		window.removeEventListener('blur', gone);
+		document.removeEventListener('visibilitychange', gone);
+		if (handled || document.hidden) return;
+
+		// Skemaet fandtes ikke her. Linket skal stadig åbne — alt andet ville gøre
+		// en indstilling, der virker på telefonen, til ødelagte links på
+		// skrivebordet.
+		//
+		// Uden `noopener`, og det er ikke en forglemmelse: med den flag returnerer
+		// window.open **altid** null, også når fanen åbnede fint — det står i
+		// specifikationen. Målt her, efter at faldbacket havde troet sig blokeret
+		// hver eneste gang og navigeret den aktuelle fane væk i stedet. Håndtaget
+		// er det eneste, der kan kende en blokeret fane fra en åbnet, så det skal
+		// bruges, og opener ryddes bagefter.
+		const tab = window.open(url, '_blank');
+		if (tab) {
+			try {
+				tab.opener = null;
+			} catch {
+				// En fane på et andet domæne lader sig ikke altid røre. Fanen er
+				// åbnet, og det var det, klikket handlede om.
+			}
+			return;
+		}
+		// Blev den alligevel blokeret, går vi i den fane, vi står i. Et dårligere
+		// sted at ende end en ny fane, og et meget bedre sted end et link, der
+		// ikke gjorde noget.
+		location.href = url;
+	}, 600);
+	return true;
+}

web/src/lib/locales/da.js

@@ -96,6 +96,10 @@ export const da = {
 	'ai.planHint':
 		'En besked om morgenen om det, der forfalder i dag, og det, der er sprunget over. Tallene tælles her; er der en model sat op, skriver den sætningen.',
 	'ai.planHour': 'Klokken',
+	'ai.planMade': 'lavet {time}',
+	'ai.planAgain': 'Forny planen',
+	'ai.planMake': 'Lav dagens plan',
+	'ai.planDismiss': 'Skjul planen i dag',
 	'ai.planNow': 'Send den nu',
 	'ai.planSent': 'Sendt — kig i klokken.',
 	'ai.planNothing': 'Der er ikke noget at planlægge i dag.',
@@ -105,6 +109,23 @@ export const da = {
 	'ai.skip': 'Nej tak',
 	'ai.applied': 'Gjort.',
 	'ai.allDone': 'Ikke mere at tage stilling til.',
+	// Hvilken browser links åbner i. Se linkopen.js for, hvorfor det er et forsøg
+	// og ikke et løfte: en webside kan ikke se, hvilke browsere der findes.
+	'link.title': 'Links',
+	'link.hint':
+		'Hvilken browser et link åbner i. Der findes ingen måde at spørge systemet, hvilke browsere der er installeret, så valget er et forsøg: virker det ikke på denne maskine, åbner linket helt normalt. I praksis virker det på telefonen og sjældent på en Mac eller pc.',
+	'link.opener': 'Åbn links i',
+	'link.openerDefault': 'Systemets standard',
+	'link.openerSafari': 'Safari',
+	'link.openerChrome': 'Chrome',
+	'link.openerFirefox': 'Firefox',
+	'link.openerEdge': 'Edge',
+	'link.openerCustom': 'Min egen adresse …',
+	'link.template': 'Skema',
+	'link.templateHint':
+		'{url} bliver til adressen som den er, {encoded} til den som parameterværdi, og {stripped} til den uden http foran.',
+	'link.try': 'Prøv det',
+	'link.tryHint': 'Åbner example.dk, så du kan se, om det virker her.',
 	'beacon.title': 'Tælling af installationer',
 	'beacon.hint': 'Én gang i døgnet melder denne installation, at den findes, så projektet kan se hvor mange der bruger det. Der sendes kun de to værdier herunder — et tilfældigt id og versionen — og intet andet: ingen IP bliver gemt, ingen navne, ingen adresser, intet om hvad du bruger det til. Slået til som udgangspunkt, og du kan slå den fra her.',
 	'beacon.send': 'Send en anonym daglig melding',

web/src/lib/locales/en.js

@@ -93,6 +93,10 @@ export const en = {
 	'ai.planHint':
 		'A notification in the morning about what is due today and what has been missed. The numbers are counted here; if a model is set up, it writes the sentence.',
 	'ai.planHour': 'At',
+	'ai.planMade': 'made at {time}',
+	'ai.planAgain': 'Make it again',
+	'ai.planMake': "Make today's plan",
+	'ai.planDismiss': 'Hide the plan for today',
 	'ai.planNow': 'Send it now',
 	'ai.planSent': 'Sent — look in the bell.',
 	'ai.planNothing': 'There is nothing to plan for today.',
@@ -102,6 +106,23 @@ export const en = {
 	'ai.skip': 'No thanks',
 	'ai.applied': 'Done.',
 	'ai.allDone': 'Nothing left to decide on.',
+	// Which browser links open in. See linkopen.js for why this is an attempt and
+	// not a promise: a web page cannot see which browsers exist.
+	'link.title': 'Links',
+	'link.hint':
+		'Which browser a link opens in. There is no way to ask the system which browsers are installed, so the choice is an attempt: if it does not work on this machine, the link opens the usual way. In practice it works on a phone and rarely on a Mac or PC.',
+	'link.opener': 'Open links in',
+	'link.openerDefault': 'The system default',
+	'link.openerSafari': 'Safari',
+	'link.openerChrome': 'Chrome',
+	'link.openerFirefox': 'Firefox',
+	'link.openerEdge': 'Edge',
+	'link.openerCustom': 'My own address …',
+	'link.template': 'Scheme',
+	'link.templateHint':
+		'{url} becomes the address as it is, {encoded} the address as a parameter value, and {stripped} the address without the http in front.',
+	'link.try': 'Try it',
+	'link.tryHint': 'Opens example.dk, so you can see whether it works here.',
 	'beacon.title': 'Counting installations',
 	'beacon.hint': 'Once a day this installation reports that it exists, so the project can see how many people run it. It sends only the two values below — a random id and the version — and nothing else: no IP is stored, no names, no addresses, nothing about what you use it for. On by default, and you can turn it off here.',
 	'beacon.send': 'Send an anonymous daily report',

web/src/routes/+layout.svelte

@@ -11,6 +11,7 @@
 	import TaskDetail from '$lib/components/TaskDetail.svelte';
 	import { t } from '$lib/i18n.svelte.js';
 	import { setBadge } from '$lib/badge.js';
+	import { open as openInChosenBrowser, stored as storedOpener } from '$lib/linkopen.js';
 	import BeaconNotice from '$lib/components/BeaconNotice.svelte';
 
 	let { children } = $props();
@@ -55,6 +56,37 @@
 		app.load();
 	});
 
+	/**
+	 * Links ud af programmet, åbnet i den browser, maskinen er sat op til.
+	 *
+	 * Ét sted frem for ét pr. komponent. Links står i opgavetitler, i
+	 * beskrivelser, i noter og i indstillingerne, og en regel, der skulle
+	 * gentages hvert af de steder, ville mangle det ene sted, ingen tænkte på.
+	 *
+	 * Kun udadgående. Programmets egne ruter går gennem SvelteKit og skal blive
+	 * ved med at gøre det: en fane mere til ens egen notesside er ikke noget,
+	 * nogen har bedt om.
+	 *
+	 * Er der ikke valgt nogen browser — hvilket er udgangspunktet — bliver
+	 * klikket ikke rørt, og systemet gør, som det plejer.
+	 */
+	function onLinkClick(event) {
+		if (event.defaultPrevented || event.button !== 0) return;
+		if (event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return;
+		if (!storedOpener().id) return;
+
+		const link = event.target?.closest?.('a[href]');
+		if (!link || link.target === '_self') return;
+		const href = link.getAttribute('href') ?? '';
+		if (!/^https?:\/\//i.test(href)) return;
+		// Vores egen adresse er ikke et link ud af programmet, uanset hvor den
+		// står — en fane mere til den side, man allerede er på, er ingen hjælp.
+		if (new URL(href, location.href).origin === location.origin) return;
+
+		event.preventDefault();
+		openInChosenBrowser(href);
+	}
+
 	// Tallet på appens ikon følger klokken. Ét sted, fordi der er ét tal: hentet,
 	// skubbet over websocket'en eller læst væk — mærket er det samme svar på alle
 	// tre, og en optælling pr. vej ville være tre, der kan blive uenige.
@@ -125,7 +157,8 @@
 	}
 </script>
 
-<svelte:window {onkeydown} />
+<svelte:window
+	onclick={onLinkClick} {onkeydown} />
 
 {#if app.loading}
 	<!-- Deliberately blank. A spinner for a request that resolves in 30ms is a

web/src/routes/+page.svelte

@@ -5,6 +5,7 @@
 	import TaskRow from '$lib/components/TaskRow.svelte';
 	import QuickAdd from '$lib/components/QuickAdd.svelte';
 	import { t, tag } from '$lib/i18n.svelte.js';
+	import { humanMessage } from '$lib/api.js';
 
 	let loaded = $state(false);
 
@@ -17,6 +18,72 @@
 		).padStart(2, '0')}`;
 	})();
 
+
+	/**
+	 * Dagens plan, dér hvor man kigger, når man starter dagen.
+	 *
+	 * Hentet og ikke regnet forfra: det er den samme tekst, beskeden i morges bar.
+	 * En plan, der siger noget andet, når man kigger på den, end den sagde, da den
+	 * kom, er værre end begge dele hver for sig — og en model pr. sidevisning er
+	 * dyr for noget, der ikke har ændret sig.
+	 *
+	 * Lukket for i dag frem for slettet. Kortet er en påmindelse, ikke en opgave,
+	 * og den, der har læst den, skal kunne få den af vejen uden at miste den —
+	 * derfor står lukningen i localStorage med dagens dato og ikke på kontoen.
+	 */
+	let plan = $state(null);
+	let planBusy = $state(false);
+	let planError = $state('');
+	const DISMISS_KEY = 'verdande:plan-dismissed';
+
+	let dismissed = $state(
+		typeof localStorage !== 'undefined' && localStorage.getItem(DISMISS_KEY) === isoToday
+	);
+
+	function dismissPlan() {
+		dismissed = true;
+		try {
+			localStorage.setItem(DISMISS_KEY, isoToday);
+		} catch {
+			// Privat vindue; kortet er væk til næste indlæsning.
+		}
+	}
+
+	async function makePlan() {
+		if (planBusy) return;
+		planBusy = true;
+		planError = '';
+		try {
+			// Stille: man står og kigger på den. En besked om noget, man har foran
+			// sig, er den slags, der lærer folk at ignorere klokken.
+			const made = await api.planNow({ silent: true });
+			plan = { ...plan, plan: made.plan, plan_at: made.plan_at };
+			dismissed = false;
+		} catch (e) {
+			planError = humanMessage(e);
+		} finally {
+			planBusy = false;
+		}
+	}
+
+	$effect(() => {
+		api
+			.planSettings()
+			.then((p) => (plan = p))
+			.catch(() => {
+				// Et kort, der ikke kunne hentes, må ikke stå i vejen for listen.
+			});
+	});
+
+	const planMade = $derived(
+		plan?.plan_at
+			? new Date(plan.plan_at * 1000).toLocaleTimeString(tag(), {
+					hour: '2-digit',
+					minute: '2-digit'
+				})
+			: ''
+	);
+
 	async function load() {
 		const data = await api.today();
 		app.tasks = [...data.overdue, ...data.today];
@@ -54,6 +121,33 @@
 
 	<QuickAdd />
 
+	{#if plan?.plan && !dismissed}
+		<!-- Teksten som den blev sendt, og klokkeslættet den blev lavet: en plan fra
+		     klokken syv er en anden slags oplysning klokken fire end klokken otte. -->
+		<section class="plan">
+			<header>
+				<h2>{t('ai.plan')}</h2>
+				{#if planMade}<span class="made">{t('ai.planMade', { time: planMade })}</span>{/if}
+				<button class="close" onclick={dismissPlan} aria-label={t('ai.planDismiss')}>×</button>
+			</header>
+			<p>{plan.plan}</p>
+			<button class="again" onclick={makePlan} disabled={planBusy}>
+				{planBusy ? t('ai.thinking') : t('ai.planAgain')}
+			</button>
+		</section>
+	{:else if plan && !plan.plan && (liveToday.length || liveOverdue.length)}
+		<!-- Ingen plan i dag: enten er beskeden slået fra, eller også er timen ikke
+		     kommet endnu. Knappen frem for ingenting, så den, der har slået
+		     morgenbeskeden fra, stadig kan bede om planen. Kun når der er noget at
+		     lægge en plan om — en tom dag har ikke brug for en knap. -->
+		<p class="planask">
+			<button class="again" onclick={makePlan} disabled={planBusy}>
+				{planBusy ? t('ai.thinking') : t('ai.planMake')}
+			</button>
+			{#if planError}<span class="planerror">{planError}</span>{/if}
+		</p>
+	{/if}
+
 	{#if liveOverdue.length}
 		<section>
 			<h2 class="overdue">{t('view.overdue')}</h2>
@@ -93,6 +187,77 @@
 		margin-bottom: var(--s5);
 	}
 
+	/* Kortet ligger mellem feltet og listen: under det, man skriver i, og over det,
+	   man skal se på. Dæmpet frem for fremhævet — det er en påmindelse om, hvad
+	   dagen indeholder, ikke en opgave, der skal laves. */
+	.plan {
+		margin: 0 0 var(--s5);
+		padding: var(--s3);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+		background: var(--surface-raised, var(--surface));
+	}
+
+	.plan header {
+		display: flex;
+		align-items: baseline;
+		gap: var(--s2);
+		margin: 0 0 var(--s2);
+	}
+
+	.plan h2 {
+		font-size: var(--text-sm);
+		margin: 0;
+	}
+
+	.plan .made {
+		color: var(--ink-faint);
+		font-size: var(--text-xs);
+	}
+
+	.plan .close {
+		margin-left: auto;
+		border: none;
+		background: none;
+		color: var(--ink-faint);
+		cursor: pointer;
+		line-height: 1;
+		font-size: var(--text-md);
+	}
+
+	/* Linjeskift bevaret: planen er to-tre linjer, og de er skrevet som linjer. */
+	.plan p {
+		margin: 0 0 var(--s2);
+		font-size: var(--text-sm);
+		line-height: 1.6;
+		white-space: pre-line;
+	}
+
+	.again {
+		border: none;
+		background: none;
+		padding: 0;
+		font: inherit;
+		font-size: var(--text-xs);
+		color: var(--accent);
+		cursor: pointer;
+	}
+
+	.again:disabled {
+		color: var(--ink-faint);
+		cursor: default;
+	}
+
+	.planask {
+		margin: 0 0 var(--s5);
+	}
+
+	.planerror {
+		margin-left: var(--s2);
+		font-size: var(--text-xs);
+		color: var(--ink-muted);
+	}
+
 	h1 {
 		font-size: var(--text-2xl);
 	}

web/src/routes/indstillinger/+page.svelte

@@ -1,6 +1,12 @@
 <script>
 	/** Konto: who you are, your password, and the second factor. */
 	import { api, humanMessage } from '$lib/api.js';
+	import {
+		OPENERS,
+		stored as storedOpener,
+		save as saveOpenerChoice,
+		open as openLink
+	} from '$lib/linkopen.js';
 	import { app, theme, THEMES, look, LOOKS, menuSize, textSize, SIZES } from '$lib/stores.svelte.js';
 	import { t, plural, i18n } from '$lib/i18n.svelte.js';
 	import { supported, register } from '$lib/passkey.js';
@@ -8,6 +14,20 @@
 
 	// --- profile ---------------------------------------------------------------
 
+	// Hvilken browser links åbner i. På apparatet, ikke på kontoen: `firefox://`
+	// virker på telefonen og gør ingenting på Mac'en, så et valg, der fulgte
+	// kontoen, ville være forkert det ene af de to steder hver gang.
+	let opener = $state(storedOpener());
+
+	function saveOpener(choice) {
+		opener = choice;
+		saveOpenerChoice(choice);
+	}
+
+	function chooseOpener(id) {
+		saveOpener({ id, template: id === 'custom' ? opener.template : '' });
+	}
+
 	let name = $state('');
 	let timezone = $state('');
 	let locale = $state('da');
@@ -401,6 +421,49 @@
 	</div>
 </section>
 
+<section class="panel">
+	<header>
+		<h2>{t('link.title')}</h2>
+		<p class="hint">{t('link.hint')}</p>
+	</header>
+
+	<div class="field">
+		<label for="opener">{t('link.opener')}</label>
+		<select id="opener" value={opener.id} onchange={(e) => chooseOpener(e.currentTarget.value)}>
+			{#each OPENERS as option (option.id)}
+				<option value={option.id}>{t(option.label)}</option>
+			{/each}
+			<option value="custom">{t('link.openerCustom')}</option>
+		</select>
+	</div>
+
+	{#if opener.id === 'custom'}
+		<div class="field">
+			<label for="openertpl">{t('link.template')}</label>
+			<input
+				id="openertpl"
+				class="mono"
+				value={opener.template}
+				placeholder="firefox://open-url?url={'{encoded}'}"
+				onchange={(e) => saveOpener({ id: 'custom', template: e.currentTarget.value })}
+			/>
+			<p class="hint">{t('link.templateHint')}</p>
+		</div>
+	{/if}
+
+	{#if opener.id}
+		<!-- Et forsøg frem for et løfte. Der er ingen måde at spørge, om et skema
+		     findes — man kan kun prøve, og så er det bedre at prøve på en adresse,
+		     man selv har valgt, end at opdage det på et rigtigt link. -->
+		<div class="row">
+			<button class="secondary" onclick={() => openLink('https://example.dk')}>
+				{t('link.try')}
+			</button>
+			<span class="hint">{t('link.tryHint')}</span>
+		</div>
+	{/if}
+</section>
+
 <section class="panel">
 	<header>
 		<h2>{t('account.password')}</h2>