fix(mail): den samme mail blev en opgave igen og igen

Rapporteret fra drift med et skærmbillede af den samme mail seks gange i træk.

**IMAP: flaget kommer af, når mailen er blevet en opgave.** Markøren var et uid —
husk det højeste, begynd over det næste gang — og den holdt kun, hvis uids var,
hvad serveren sagde. Den brød på et fetch-svar uden uid, på en UIDVALIDITY, der
skiftede under en genopbygget postkasse, og på to postkasse-rækker, der pegede
samme sted og hver især førte deres eget regnskab. Alle tre gav det samme
symptom.

Så regnskabet flytter derhen, hvor spørgsmålet bliver stillet. "Flaget" betyder
"lav det her om til en opgave"; når den er en opgave, har flaget gjort sit
arbejde og er ikke sandt længere. Så er der ingenting at huske, og dermed
ingenting, der kan komme ud af trit — en anden synkronisering, en anden
postkasse-række eller en database gendannet fra en kopi finder alle det samme
svar, fordi svaret ligger i postkassen.

Flaget tages af *efter* opgaven er skrevet. Et flag fjernet fra en mail, hvis
opgave aldrig blev gemt, er en mail, ingen ser igen.

**Gmail havde den samme fejl af en anden grund.** Listen over allerede behandlede
beskeder blev bygget om ved hver kørsel af *kun de id'er, Gmail svarede med den
gang* — for at den ikke skulle vokse uendeligt. Men forespørgslen er begrænset,
så på en konto med mere stjernemarkeret post, end der er plads til i ét svar,
glemte hver kørsel det, den forrige havde husket. De kom tilbage som ubehandlede
og blev opgaver igen. Det var ikke en grænse, det var en måde at glemme på.
Listen har nu et loft på antal i stedet, nyeste først.

Gmail kan ikke få taget stjernen af: scopet er `gmail.readonly`, med vilje, fordi
det er dét, der gør samtykkeskærmen til noget, et menneske kan sige ja til. Derfor
skal regnskabet blive på vores side dér — men det skal så være et regnskab, der
kan holde.

Prøven kører hele vejen mod en rigtig IMAP-server: find de flagede, tag flaget af,
og spørg så forfra med markøren sat til nul — altså det værst tænkelige tilfælde,
hvor alt, vi selv havde husket, er væk. Der kommer ingenting tilbage.

Co-Authored-By: Claude Opus 5 <[email protected]>

.gitignore

@@ -66,3 +66,6 @@ node_modules.nosync/
 # Kept on disk because it is how a session hands over to the next one.
 HANDOFF.md
 NOTES-PLAN.md
+
+# Agenternes arbejdstræer. Et git-repo inde i et git-repo, som ikke hører til her.
+.claude/worktrees/

cmd/verdande/main.go

@@ -76,6 +76,7 @@ func run() error {
 	runner.SyncGmail = api.SyncGmail
 	runner.SyncMailbox = api.SyncMailbox
 	runner.Push = api.PushToUser
+	runner.SendBeacon = api.SendBeacon
 	runner.Start(jobCtx)
 
 	srv := &http.Server{

docs/openapi.yaml

@@ -1396,6 +1396,114 @@ paths:
                     description: The environment variables that are not set.
         "403": { $ref: "#/components/responses/Forbidden" }
 
+  /api/v1/beacon:
+    post:
+      tags: [auth]
+      summary: Report that an installation exists. Unauthenticated.
+      description: |
+        The receiving end of the beacon. Open on purpose: the caller is a
+        stranger's installation, which is the whole feature.
+
+        Answers 404 unless this instance has been told it is the collector, so an
+        ordinary installation is not a spam sink that answers 200 to anything.
+        Rate limited like the login routes, and the table behind it has a ceiling:
+        the endpoint inserts a row keyed on an id the caller invented, so without
+        one anybody could grow it until the volume is full.
+
+        Nothing about the request is recorded but the two values in the body. No
+        source address is read or written here.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [instance_id]
+              properties:
+                instance_id:
+                  type: string
+                  description: A random id the installation generated for itself.
+                version:
+                  type: string
+      responses:
+        "204":
+          description: Recorded.
+        "400":
+          description: The id or the version is not the expected shape.
+        "404":
+          description: This instance is not a collector.
+
+  /api/v1/beacon/count:
+    get:
+      tags: [auth]
+      summary: How many installations reported in the last thirty days.
+      description: |
+        Unauthenticated and cached for a minute, and only answered when the
+        collector has been told to publish it.
+
+        A window rather than a running total: a total only climbs, so it stops
+        meaning "how many people use this" and starts meaning "how many ever
+        tried it".
+      responses:
+        "200":
+          description: The count.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  installs: { type: integer }
+                  window_days: { type: integer }
+        "404":
+          description: Not a collector, or not published.
+
+  /api/v1/beacon/settings:
+    get:
+      tags: [auth]
+      summary: What this instance reports, and to whom. Administrators only.
+      description: |
+        Includes the exact payload that will be sent, so the settings page can
+        print it in full rather than describe it.
+      responses:
+        "200":
+          description: The current configuration, and the counts if this is the collector.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  enabled: { type: boolean }
+                  collector_url: { type: string }
+                  instance_id: { type: string }
+                  version: { type: string }
+                  is_collector: { type: boolean }
+                  publish_count: { type: boolean }
+                  last_ping_at: { type: string, format: date-time }
+    put:
+      tags: [auth]
+      summary: Turn the beacon off, or point it somewhere else. Administrators only.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                enabled: { type: boolean }
+                collector_url:
+                  type: string
+                  description: |
+                    Where reports go. Fetched through a dialer that refuses
+                    loopback and private address space, so this cannot be used to
+                    make the server reach inside its own network.
+                is_collector: { type: boolean }
+                publish_count: { type: boolean }
+      responses:
+        "200":
+          description: The configuration as it now stands.
+        "422":
+          description: The collector address is not an http or https URL.
+
   /api/v1/panel/restart:
     post:
       tags: [auth]
@@ -2507,6 +2615,22 @@ paths:
                   created: { type: integer }
         "502": { $ref: "#/components/responses/Upstream" }
 
+  /api/v1/export/notes.zip:
+    get:
+      tags: [notes]
+      summary: Every note as a Markdown file, in a zip.
+      description: >
+        One file per note, named after its title, containing exactly what is
+        stored. Nothing is converted on the way out — the note on disk is already
+        the file you would export — so it opens in Obsidian, in a text editor, or
+        in anything else that reads Markdown.
+      responses:
+        "200":
+          description: A zip archive.
+          content:
+            application/zip:
+              schema: { type: string, format: binary }
+
   /api/v1/notes:
     get:
       tags: [notes]
@@ -2550,6 +2674,37 @@ paths:
               schema: { $ref: "#/components/schemas/Note" }
         "403": { $ref: "#/components/responses/Forbidden" }
 
+  /api/v1/notes/import:
+    post:
+      tags: [notes]
+      summary: A zip of Markdown files becomes notes.
+      description: >
+        The mirror of the export, and the way in from anywhere else: a folder of
+        Markdown is what Obsidian, Bear, iA Writer and a shell script all produce.
+        Filenames are ignored — the title is the first line of the body, here as
+        everywhere, and taking it from the filename would be a second rule for the
+        same thing. Directories, macOS resource forks and anything that is not .md
+        are passed over.
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                file: { type: string, format: binary }
+      responses:
+        "200":
+          description: Read
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  created: { type: integer }
+                  skipped: { type: integer, description: Files that were not usable as a note. }
+        "413": { description: The archive is too large. }
+
   /api/v1/notes/{noteID}:
     parameters:
       - name: noteID
@@ -3308,7 +3463,7 @@ components:
       properties:
         id: { type: string }
         project_id: { type: string }
-        title: { type: string, description: "Taken from the first line when not given." }
+        title: { type: string, readOnly: true, description: "The note's first line. Derived on every save; it cannot be set." }
         body: { type: string, description: Markdown }
         pinned: { type: boolean }
         created_at: { type: string, format: date-time }
@@ -3326,8 +3481,7 @@ components:
       type: object
       properties:
         project_id: { type: string, description: "Empty files it under no project." }
-        title: { type: string }
-        body: { type: string }
+        body: { type: string, description: "Markdown. Its first line becomes the title." }
         pinned: { type: boolean }
 
     Mailbox:

internal/beacon/beacon.go

@@ -0,0 +1,139 @@
+// Package beacon answers one question for the project, and refuses to answer any
+// other: how many installations are out there.
+//
+// It sends two values once a day — an anonymous id the installation made up for
+// itself, and the version it is running — and nothing else. No IP is stored by
+// the collector, no hostname, no domain, no account, no usage. The payload is
+// small enough to be printed in full on the settings page, and it is, because a
+// promise about telemetry is worth exactly as much as the reader's ability to
+// check it.
+//
+// # On by default, and off in one click
+//
+// The alternative that was asked for first was mandatory, and the argument
+// against it is practical rather than principled: it cannot be enforced. The
+// domain can be blocked, the binary can be patched, and a fork removes it in its
+// first commit — so mandatory buys nothing over on-by-default, while costing the
+// trust the rest of this program works for. Secrets are sealed here, the key is
+// kept out of the database, and the backup page warns you what a copy contains.
+// Telemetry you are not allowed to refuse is the one sentence in that story that
+// does not fit.
+//
+// So: on by default, said plainly, one switch to turn it off. That collects
+// essentially the same number and leaves nobody feeling tricked.
+//
+// # Where this disagrees with the rest of the program
+//
+// `config.UpdateCheck` is off unless asked for, and its comment gives the reason:
+// "a self-hosted app that reaches out without being told to has broken the deal
+// its operator made by self-hosting." That is the same situation as this one, and
+// the two defaults do not agree.
+//
+// The disagreement is written down here rather than smoothed over, because it is
+// a real one and the reader deserves to see both halves. The case for treating
+// them differently is that the update check reveals an instance to a third party
+// (GitHub) and returns something the operator can act on, while this returns
+// nothing and goes to the project itself — and that a count nobody sends is a
+// count that does not exist, whereas an update nobody checks for is one you can
+// still go and look up. Whether that is a distinction or an excuse is a judgement
+// call, and it was made deliberately by the person whose instance this is.
+//
+// If it is ever decided the other way, the change is one word: the default in
+// `beaconSettings`. Nothing else in this package assumes which way it points.
+//
+// # What the collector can still see
+//
+// A request has a source address whether or not anybody writes it down. The
+// collector does not store or log it, and the code is arranged so that it never
+// reaches a function that could — but it passes through a reverse proxy and a
+// tunnel on the way, and those keep their own logs. Saying "we send no IP" would
+// be a half-truth; what is true is that nothing here records one.
+package beacon
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"regexp"
+	"time"
+)
+
+// DefaultCollector is where a fresh installation reports, unless it is told
+// otherwise. Somebody running their own fleet points it at their own instance;
+// the field is on the settings page for exactly that.
+const DefaultCollector = "https://verdande.yggdrasilpanel.com/api/v1/beacon"
+
+// Payload is the entire message. Two fields, and adding a third is a change to
+// what this program promises, not a change to a struct.
+type Payload struct {
+	InstanceID string `json:"instance_id"`
+	Version    string `json:"version"`
+}
+
+// InstanceID and Version are checked on the way in as well as written on the way
+// out, because the collector's endpoint is unauthenticated: anything that reaches
+// it is a stranger's bytes, and it should be able to store only the two shapes it
+// expects.
+var (
+	idShape      = regexp.MustCompile(`^[0-9a-fA-F-]{16,64}$`)
+	versionShape = regexp.MustCompile(`^v?[0-9]{1,4}(\.[0-9]{1,5}){0,3}(-[0-9A-Za-z.]{1,20})?$`)
+)
+
+// ValidID reports whether an id is the shape this program writes.
+func ValidID(s string) bool { return idShape.MatchString(s) }
+
+// ValidVersion allows a version number and the word this binary uses when it was
+// built outside a release.
+func ValidVersion(s string) bool { return s == "dev" || versionShape.MatchString(s) }
+
+// Send delivers one ping. It is deliberately dull: a short timeout, no retry, no
+// queue, and a failure that is returned rather than made anybody's problem.
+//
+// No retry, because the next pass is tomorrow and a missed day changes a count of
+// installations by nothing. A telemetry ping that retries is a telemetry ping
+// that can hammer somebody's server on the day it is down.
+func Send(ctx context.Context, client *http.Client, collector string, p Payload) error {
+	if !ValidID(p.InstanceID) {
+		return fmt.Errorf("beacon: refusing to send a malformed id")
+	}
+	// Versionen kontrolleres også her, ikke kun hos modtageren. Kommentaren ved
+	// mønstrene lovede begge veje, og gjorde det ikke — og en installation, der
+	// sender noget mærkeligt, skal opdage det hos sig selv frem for at være noget,
+	// en fremmed collector skal filtrere fra.
+	if !ValidVersion(p.Version) {
+		return fmt.Errorf("beacon: refusing to send a malformed version")
+	}
+	body, err := json.Marshal(p)
+	if err != nil {
+		return err
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, collector, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	// A plain user agent with the version already in the payload. Nothing is
+	// learned from it that the body does not already say, and it makes the request
+	// legible in a log rather than anonymous-looking.
+	req.Header.Set("User-Agent", "verdande-beacon/1")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	// Read and discard, so the connection can be reused rather than dropped.
+	_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 4<<10))
+
+	if resp.StatusCode >= 400 {
+		return fmt.Errorf("beacon: collector answered %d", resp.StatusCode)
+	}
+	return nil
+}

internal/beacon/beacon_test.go

@@ -0,0 +1,114 @@
+package beacon
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// Hvad der bliver sendt, tegn for tegn.
+//
+// Prøven er skrevet imod *hele* kroppen og ikke imod enkelte felter, fordi det er
+// den, der er løftet: siden siger "præcis det her og ikke mere", og et felt lagt
+// til senere skal vælte noget. En prøve, der kun så efter, at instance_id var med,
+// ville lade en ny nøgle glide igennem uden at nogen opdagede det.
+func TestSendsExactlyTwoFields(t *testing.T) {
+	var got map[string]any
+	var contentType string
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		contentType = r.Header.Get("Content-Type")
+		body, _ := io.ReadAll(r.Body)
+		if err := json.Unmarshal(body, &got); err != nil {
+			t.Errorf("kroppen er ikke JSON: %v", err)
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer srv.Close()
+
+	err := Send(context.Background(), srv.Client(), srv.URL, Payload{
+		InstanceID: "01a01b16-4e54-7000-9eaa-2f8eb0629c3a",
+		Version:    "v0.26.3",
+	})
+	if err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+
+	if contentType != "application/json" {
+		t.Errorf("Content-Type = %q", contentType)
+	}
+	if len(got) != 2 {
+		t.Fatalf("der blev sendt %d felter, ikke to: %v", len(got), got)
+	}
+	if got["instance_id"] != "01a01b16-4e54-7000-9eaa-2f8eb0629c3a" {
+		t.Errorf("instance_id = %v", got["instance_id"])
+	}
+	if got["version"] != "v0.26.3" {
+		t.Errorf("version = %v", got["version"])
+	}
+}
+
+// En collector, der er nede, er ikke denne installations problem.
+func TestSendReportsAFailureRatherThanRetrying(t *testing.T) {
+	calls := 0
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	err := Send(context.Background(), srv.Client(), srv.URL, Payload{
+		InstanceID: "01a01b16-4e54-7000-9eaa-2f8eb0629c3a", Version: "v1.0.0",
+	})
+	if err == nil {
+		t.Fatal("en 500 skal give en fejl")
+	}
+	if calls != 1 {
+		t.Errorf("der blev prøvet %d gange; en telemetri-ping må ikke hamre på en server, der er nede", calls)
+	}
+}
+
+// Et id, der ikke er id-formet, sendes slet ikke — så en fejl her ikke bliver til
+// noget, en fremmed collector skal filtrere fra.
+func TestSendRefusesAMalformedID(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Error("der blev sendt noget, som ikke skulle sendes")
+	}))
+	defer srv.Close()
+
+	if err := Send(context.Background(), srv.Client(), srv.URL, Payload{
+		InstanceID: "; DROP TABLE beacon_installs", Version: "v1.0.0",
+	}); err == nil {
+		t.Fatal("et misformet id skal afvises før det forlader maskinen")
+	}
+}
+
+func TestShapes(t *testing.T) {
+	ok := []string{"01a01b16-4e54-7000-9eaa-2f8eb0629c3a", "89df44d7-3742-4611-9a43-db0b07733c6d"}
+	for _, s := range ok {
+		if !ValidID(s) {
+			t.Errorf("ValidID(%q) = false", s)
+		}
+	}
+	bad := []string{"", "kort", "../../etc/passwd", "01a01b16-4e54-7000-9eaa-2f8eb0629c3a'; --",
+		"<script>alert(1)</script>"}
+	for _, s := range bad {
+		if ValidID(s) {
+			t.Errorf("ValidID(%q) = true", s)
+		}
+	}
+
+	for _, s := range []string{"v0.26.3", "0.26.3", "v1.2.3-rc.1", "dev"} {
+		if !ValidVersion(s) {
+			t.Errorf("ValidVersion(%q) = false", s)
+		}
+	}
+	for _, s := range []string{"", "v<script>", "v" + string(make([]byte, 200))} {
+		if ValidVersion(s) {
+			t.Errorf("ValidVersion(%q) = true", s)
+		}
+	}
+}

internal/httpapi/beacon_handlers.go

@@ -0,0 +1,297 @@
+package httpapi
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/beacon"
+	"github.com/kristianwind/verdande/internal/safedial"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// The beacon, from the instance's side.
+//
+// Two halves that happen to live in the same binary: the part that reports in,
+// which every installation runs, and the part that receives, which only the one
+// acting as collector turns on. See internal/beacon for what is sent and why it
+// is on by default rather than compulsory.
+
+const beaconScope = "beacon"
+
+// beaconConfig is what this instance has been told to do. The zero value is what
+// a fresh installation gets, which is why Enabled defaults to true elsewhere and
+// not here — a zero struct must never mean "silently on".
+type beaconConfig struct {
+	Enabled      bool   `json:"enabled"`
+	Collector    string `json:"collector_url"`
+	InstanceID   string `json:"instance_id"`
+	IsCollector  bool   `json:"is_collector"`
+	PublishCount bool   `json:"publish_count"`
+	LastPingAt   int64  `json:"last_ping_at,omitempty"`
+}
+
+// beaconSettings reads the configuration, filling in the defaults and minting the
+// anonymous id on first use.
+//
+// The id is generated here rather than derived from anything about the machine.
+// A hash of the hostname or the base URL would be stable and convenient and would
+// also be a value the collector could compare against a guess — which is the
+// difference between anonymous and pseudonymous, and it is the whole point.
+func (s *Server) beaconSettings(ctx context.Context) (beaconConfig, error) {
+	cfg := beaconConfig{Enabled: true, Collector: beacon.DefaultCollector}
+
+	stored, err := s.db.InstanceSettings(ctx, beaconScope)
+	if err != nil {
+		return cfg, err
+	}
+
+	if v, ok := stored["enabled"].(bool); ok {
+		cfg.Enabled = v
+	}
+	if v, ok := stored["collector_url"].(string); ok && strings.TrimSpace(v) != "" {
+		cfg.Collector = strings.TrimSpace(v)
+	}
+	if v, ok := stored["instance_id"].(string); ok && beacon.ValidID(v) {
+		cfg.InstanceID = v
+	}
+	if v, ok := stored["is_collector"].(bool); ok {
+		cfg.IsCollector = v
+	}
+	if v, ok := stored["publish_count"].(bool); ok {
+		cfg.PublishCount = v
+	}
+	if v, ok := stored["last_ping_at"].(float64); ok {
+		cfg.LastPingAt = int64(v)
+	}
+
+	if cfg.InstanceID == "" {
+		cfg.InstanceID = store.NewID()
+		if err := s.saveBeaconSettings(ctx, cfg); err != nil {
+			return cfg, err
+		}
+	}
+	return cfg, nil
+}
+
+func (s *Server) saveBeaconSettings(ctx context.Context, cfg beaconConfig) error {
+	return s.db.SetInstanceSettings(ctx, beaconScope, map[string]any{
+		"enabled":       cfg.Enabled,
+		"collector_url": cfg.Collector,
+		"instance_id":   cfg.InstanceID,
+		"is_collector":  cfg.IsCollector,
+		"publish_count": cfg.PublishCount,
+		"last_ping_at":  cfg.LastPingAt,
+	})
+}
+
+// --- what the settings page shows ------------------------------------------------
+
+type beaconStatusJSON struct {
+	Enabled      bool               `json:"enabled"`
+	Collector    string             `json:"collector_url"`
+	InstanceID   string             `json:"instance_id"`
+	Version      string             `json:"version"`
+	IsCollector  bool               `json:"is_collector"`
+	PublishCount bool               `json:"publish_count"`
+	LastPingAt   string             `json:"last_ping_at,omitempty"`
+	Stats        *store.BeaconStats `json:"stats,omitempty"`
+}
+
+func (s *Server) handleBeaconStatus(w http.ResponseWriter, r *http.Request) {
+	cfg, err := s.beaconSettings(r.Context())
+	if err != nil {
+		s.internal(w, r, "beacon settings", err)
+		return
+	}
+
+	out := beaconStatusJSON{
+		Enabled: cfg.Enabled, Collector: cfg.Collector, InstanceID: cfg.InstanceID,
+		Version: Version, IsCollector: cfg.IsCollector, PublishCount: cfg.PublishCount,
+	}
+	if cfg.LastPingAt > 0 {
+		out.LastPingAt = time.Unix(cfg.LastPingAt, 0).Format(time.RFC3339)
+	}
+	if cfg.IsCollector {
+		stats, err := s.db.BeaconSummary(r.Context())
+		if err != nil {
+			s.internal(w, r, "beacon summary", err)
+			return
+		}
+		out.Stats = &stats
+	}
+	writeJSON(w, http.StatusOK, out)
+}
+
+type beaconRequest struct {
+	Enabled      *bool   `json:"enabled"`
+	Collector    *string `json:"collector_url"`
+	IsCollector  *bool   `json:"is_collector"`
+	PublishCount *bool   `json:"publish_count"`
+}
+
+func (s *Server) handleSetBeacon(w http.ResponseWriter, r *http.Request) {
+	var req beaconRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	cfg, err := s.beaconSettings(r.Context())
+	if err != nil {
+		s.internal(w, r, "beacon settings", err)
+		return
+	}
+
+	if req.Enabled != nil {
+		cfg.Enabled = *req.Enabled
+	}
+	if req.IsCollector != nil {
+		cfg.IsCollector = *req.IsCollector
+	}
+	if req.PublishCount != nil {
+		cfg.PublishCount = *req.PublishCount
+	}
+	if req.Collector != nil {
+		url := strings.TrimSpace(*req.Collector)
+		if url == "" {
+			url = beacon.DefaultCollector
+		}
+		// http and https only, and said as a field error rather than a 500: an
+		// operator pointing this at their own collector will mistype it, and the
+		// page should say which field is wrong.
+		if !strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://") {
+			writeFieldErrors(w, map[string]string{"collector_url": "must start with http:// or https://"})
+			return
+		}
+		cfg.Collector = url
+	}
+
+	if err := s.saveBeaconSettings(r.Context(), cfg); err != nil {
+		s.internal(w, r, "save beacon settings", err)
+		return
+	}
+	s.handleBeaconStatus(w, r)
+}
+
+// --- the collector's side ---------------------------------------------------------
+
+// handleBeaconPing receives one report. Unauthenticated, because the whole point
+// is that a stranger's installation can reach it.
+//
+// Nothing about the request is recorded except the two values in the body. The
+// source address is not read here, and there is no code path from this function
+// to anything that could write one down — which is the only version of that
+// promise worth making.
+func (s *Server) handleBeaconPing(w http.ResponseWriter, r *http.Request) {
+	cfg, err := s.beaconSettings(r.Context())
+	if err != nil {
+		s.internal(w, r, "beacon settings", err)
+		return
+	}
+	// An instance that is not a collector does not quietly accept and drop pings —
+	// it says there is nothing here. Otherwise every installation in the world is a
+	// spam sink that answers 200 to anything.
+	if !cfg.IsCollector {
+		writeError(w, http.StatusNotFound, CodeNotFound, "this instance is not a beacon collector")
+		return
+	}
+
+	r.Body = http.MaxBytesReader(w, r.Body, 4<<10)
+	var p beacon.Payload
+	if err := decodeJSON(w, r, &p); err != nil {
+		return
+	}
+
+	// Checked, not trusted. This is the one endpoint anybody can post to, and the
+	// two columns behind it should only ever hold the two shapes this program
+	// writes — an id that is not id-shaped is somebody probing, not an install.
+	if !beacon.ValidID(p.InstanceID) {
+		writeFieldErrors(w, map[string]string{"instance_id": "malformed"})
+		return
+	}
+	if p.Version != "" && !beacon.ValidVersion(p.Version) {
+		writeFieldErrors(w, map[string]string{"version": "malformed"})
+		return
+	}
+
+	if err := s.db.RecordBeacon(r.Context(), p.InstanceID, p.Version); err != nil {
+		s.internal(w, r, "record beacon", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// handleBeaconCount publishes the number, when the collector has been told to.
+//
+// Thirty days rather than a running total: a total only climbs, so it stops
+// meaning "how many people use this" and starts meaning "how many ever tried it".
+func (s *Server) handleBeaconCount(w http.ResponseWriter, r *http.Request) {
+	cfg, err := s.beaconSettings(r.Context())
+	if err != nil {
+		s.internal(w, r, "beacon settings", err)
+		return
+	}
+	if !cfg.IsCollector || !cfg.PublishCount {
+		writeError(w, http.StatusNotFound, CodeNotFound, "not published")
+		return
+	}
+
+	n, err := s.db.BeaconCount(r.Context(), 30*24*time.Hour)
+	if err != nil {
+		s.internal(w, r, "beacon count", err)
+		return
+	}
+	w.Header().Set("Cache-Control", "public, max-age=60")
+	writeJSON(w, http.StatusOK, map[string]any{"installs": n, "window_days": 30})
+}
+
+// SendBeacon reports this installation, at most once a day.
+//
+// Exported and handed to the jobs runner the same way the mailbox syncs are: the
+// settings, the anonymous id and the version all live on this side, and the
+// runner should not have to know about any of them.
+//
+// The day is counted from the last successful send, not from a wall-clock hour.
+// A fleet of installations that all pinged at 03:00 would arrive in one spike;
+// counted this way they spread themselves out by when each was started.
+func (s *Server) SendBeacon(ctx context.Context) error {
+	cfg, err := s.beaconSettings(ctx)
+	if err != nil {
+		return err
+	}
+	if !cfg.Enabled {
+		return nil
+	}
+	// The collector does not report to itself over the network. It would work, and
+	// it would also mean the one instance whose count matters most depends on its
+	// own tunnel being up to be counted.
+	if cfg.IsCollector {
+		if err := s.db.RecordBeacon(ctx, cfg.InstanceID, Version); err != nil {
+			return err
+		}
+		cfg.LastPingAt = time.Now().Unix()
+		return s.saveBeaconSettings(ctx, cfg)
+	}
+
+	if time.Since(time.Unix(cfg.LastPingAt, 0)) < 24*time.Hour {
+		return nil
+	}
+
+	// safedial, ikke http.DefaultClient. Adressen kan skrives i fladen, og en
+	// administrator, der peger den på 127.0.0.1 eller på 169.254.169.254, ville
+	// ellers have en maskine, der henter indefra på kommando — og svaret på om den
+	// svarede, er i sig selv det, sådan et forsøg leder efter.
+	if err := beacon.Send(ctx, safedial.Client(15*time.Second), cfg.Collector, beacon.Payload{
+		InstanceID: cfg.InstanceID,
+		Version:    Version,
+	}); err != nil {
+		// Logged at info, not error. The collector being unreachable is not this
+		// installation's problem and must never look like one — it is somebody
+		// else's server, and the only consequence is a number being one lower.
+		s.log.Info("beacon not delivered", "err", err)
+		return nil
+	}
+
+	cfg.LastPingAt = time.Now().Unix()
+	return s.saveBeaconSettings(ctx, cfg)
+}

internal/httpapi/comments_handlers.go

@@ -327,6 +327,30 @@ func (s *Server) reachAttachment(r *http.Request, attachmentID string) (canEdit
 		return true, nil
 	}
 
+	// A file inside a note follows the note, which follows its project — the same
+	// chain everything else here follows. Without this a picture imported with a
+	// note answered 404 while sitting in the middle of the text that named it.
+	if a.NoteID != "" {
+		n, err := s.db.Note(r.Context(), a.NoteID)
+		if err != nil {
+			return false, err
+		}
+		if n == nil {
+			return false, store.ErrNotFound
+		}
+		if n.ProjectID == "" {
+			if n.CreatedBy != user.ID {
+				return false, store.ErrNotFound
+			}
+			return true, nil
+		}
+		role, err := store.RequireProjectRole(r.Context(), s.db, n.ProjectID, user.ID, store.RoleViewer)
+		if err != nil {
+			return false, err
+		}
+		return role.CanEdit(), nil
+	}
+
 	taskID, err := s.db.AttachmentTask(r.Context(), attachmentID)
 	if err != nil {
 		return false, err
@@ -370,12 +394,30 @@ func (s *Server) handleDownloadAttachment(w http.ResponseWriter, r *http.Request
 	}
 	defer f.Close()
 
-	// Everything is served as a download rather than rendered. An uploaded SVG or
-	// HTML file displayed inline would run its own script on this origin, with the
-	// session cookie attached — attachments are the one place a user supplies
-	// content that another user opens.
-	w.Header().Set("Content-Type", "application/octet-stream")
-	w.Header().Set("Content-Disposition", "attachment; filename*=UTF-8''"+
+	// Almost everything is served as a download rather than rendered. An uploaded
+	// SVG or HTML file displayed inline would run its own script on this origin,
+	// with the session cookie attached — attachments are the one place a user
+	// supplies content that another user opens.
+	//
+	// The exception is a short list of raster images, and it is not a softening of
+	// that rule but what makes a note work: a note carries its pictures in the text
+	// as `![](…)`, and served as octet-stream every one of them is a broken image.
+	// The whole Apple Notes import exists to bring those pictures along.
+	//
+	// Safe because it is an allowlist of formats that cannot carry script, sent as
+	// the exact type with `nosniff` — so the browser must treat it as that image or
+	// not at all, and can never be talked into reading it as HTML. SVG is
+	// deliberately absent: it is a document, not a picture, and it is the one image
+	// type that can run script.
+	disposition := "attachment"
+	contentType := "application/octet-stream"
+	if inlineImage[a.MimeType] {
+		disposition = "inline"
+		contentType = a.MimeType
+	}
+
+	w.Header().Set("Content-Type", contentType)
+	w.Header().Set("Content-Disposition", disposition+"; filename*=UTF-8''"+
 		strings.ReplaceAll(mime.QEncoding.Encode("utf-8", a.Filename), " ", "%20"))
 	w.Header().Set("X-Content-Type-Options", "nosniff")
 	w.Header().Set("Content-Length", fmt.Sprint(a.Size))
@@ -384,6 +426,24 @@ func (s *Server) handleDownloadAttachment(w http.ResponseWriter, r *http.Request
 	http.ServeContent(w, r, a.Filename, a.CreatedAt, f)
 }
 
+// inlineImage is what may be shown rather than downloaded.
+//
+// Raster formats only, and named one by one rather than matched on an "image/"
+// prefix: the prefix would let image/svg+xml through, which is a document that
+// can run script, and a list that grows by accident is how that happens.
+var inlineImage = map[string]bool{
+	"image/png":  true,
+	"image/jpeg": true,
+	"image/gif":  true,
+	"image/webp": true,
+	"image/avif": true,
+	// Sendes med, selv om ingen browser viser den endnu. Den er lige så ufarlig
+	// som de andre, og en iPhone-note er fuld af dem — den dag Safari viser dem,
+	// virker de, uden at nogen skal huske hvorfor de ikke gjorde.
+	"image/heic": true,
+	"image/heif": true,
+}
+
 func (s *Server) handleDeleteAttachment(w http.ResponseWriter, r *http.Request) {
 	attachmentID := chi.URLParam(r, "attachmentID")
 

internal/httpapi/gmail_handlers.go

@@ -251,6 +251,17 @@ func (s *Server) handleGmailSyncNow(w http.ResponseWriter, r *http.Request) {
 //
 // Returns how many were made. Also used by the background job, which is why it
 // takes a context and a user rather than a request.
+// maxGmailSeen bounds the list of message ids already turned into tasks.
+//
+// Gmail is read-only here — the scope is `gmail.readonly`, deliberately, because
+// asking for less is what makes the consent screen something a person can agree
+// to — so verdande cannot unstar a message the way the IMAP side unflags one. The
+// record has to live on this side, and a record on this side has to be bounded.
+//
+// A count rather than the previous rule of "whatever Gmail returned this run",
+// which was not a bound but a way of forgetting.
+const maxGmailSeen = 2000
+
 func (s *Server) SyncGmail(ctx context.Context, user *store.User) (int, error) {
 	box, err := s.db.MailboxOfKind(ctx, user.ID, "gmail")
 	if err != nil {
@@ -362,14 +373,35 @@ func (s *Server) SyncGmail(ctx context.Context, user *store.User) (int, error) {
 	}
 
 	if created > 0 {
-		// Only the ids Gmail still returns are kept, so the list cannot grow
-		// without bound as messages fall out of the 30-day window.
-		keep := make([]string, 0, len(ids))
+		// The ids this run saw, on top of the ones already known.
+		//
+		// It used to keep only the ids Gmail returned *this run*, to stop the list
+		// growing without bound. That threw away every id that was not on the page
+		// it happened to fetch — and the query is capped, so on an account with more
+		// starred mail than one page, each run forgot the messages the last one had
+		// remembered. They came back unseen, and became tasks again, and again. That
+		// is the duplicate.
+		//
+		// Bounded by a count instead. Newest first, and a ceiling far above any
+		// plausible page, so an id leaves the list because it is old rather than
+		// because it was not in the last answer.
+		keep := make([]string, 0, len(ids)+len(box.Seen))
+		added := map[string]bool{}
 		for _, id := range ids {
-			if seen[id] {
+			if seen[id] && !added[id] {
 				keep = append(keep, id)
+				added[id] = true
 			}
 		}
+		for _, id := range box.Seen {
+			if !added[id] {
+				keep = append(keep, id)
+				added[id] = true
+			}
+		}
+		if len(keep) > maxGmailSeen {
+			keep = keep[:maxGmailSeen]
+		}
 		box.Seen = keep
 		box.LastSyncAt = time.Now()
 		if err := s.db.SaveMailbox(ctx, box); err != nil {

internal/httpapi/mailbox_handlers.go

@@ -175,6 +175,10 @@ func (s *Server) SyncMailbox(ctx context.Context, user *store.User, m *store.Mai
 
 	created := 0
 	highest := m.LastUID
+	// The uids of the mails that actually became tasks. Only those get unflagged,
+	// and only after the task is committed: a flag removed from a mail whose task
+	// was never written is a mail nobody will ever see again.
+	done := make([]uint32, 0, len(messages))
 	for _, msg := range messages {
 		if ctx.Err() != nil {
 			// What was made so far is already committed and counted, and the marker
@@ -204,12 +208,27 @@ func (s *Server) SyncMailbox(ctx context.Context, user *store.User, m *store.Mai
 			continue
 		}
 		created++
+		done = append(done, msg.UID)
 		if msg.UID > highest {
 			highest = msg.UID
 		}
 		s.hub.Publish(projectID, "task.created", toTaskJSON(*task))
 	}
 
+	// The flag comes off what became a task. This is what actually stops a mail
+	// arriving twice; the marker below is now a second line rather than the only
+	// one. See imap.Unflag for why the record belongs in the mailbox and not here.
+	//
+	// Outside the request's context, like the marker: a cancelled request that
+	// already created tasks must still take the flags off them, or the next run
+	// makes them all again.
+	if err := client.Unflag(done); err != nil {
+		// Not fatal, and not the caller's problem. A folder somebody opened
+		// read-only, or a server that refuses the STORE, still gets the uid marker
+		// underneath — worse, but not broken.
+		s.log.Warn("could not unflag imported mail", "err", err, "mailbox", m.ID, "count", len(done))
+	}
+
 	// A run that got all the way through moves the marker to the whole of what the
 	// search considered, not merely to the last message it happened to read. That
 	// is what stops the same mail becoming a task again on the next run when the

internal/httpapi/mcp_handlers.go

@@ -530,8 +530,7 @@ func (s *Server) registerNoteTools(m *mcp.Server) {
 			"links to a note by its title. Use this to bring notes in from elsewhere — " +
 			"Apple Notes, OneNote, a folder of Markdown — one call per note.",
 		InputSchema: mcp.Schema(map[string]any{
-			"body":       mcp.Str("The note as Markdown. #Projekt and [[note]] become links."),
-			"title":      mcp.Str("A title. Left out, the first line of the body becomes it."),
+			"body":       mcp.Str("The note as Markdown. Its first line becomes the title, so start with one. #Projekt and [[note]] become links."),
 			"project_id": mcp.Str("File it under a project by id. Usually unnecessary — a #tag in the body does the same and is what a person would type."),
 			"pinned":     mcp.Bool("Keep it at the top of the list."),
 		}),
@@ -545,8 +544,7 @@ func (s *Server) registerNoteTools(m *mcp.Server) {
 			"removed.",
 		InputSchema: mcp.Schema(map[string]any{
 			"note_id": mcp.Str("Which note."),
-			"body":    mcp.Str("The whole new text, as Markdown."),
-			"title":   mcp.Str("A new title."),
+			"body":    mcp.Str("The whole new text, as Markdown. The title follows its first line."),
 			"pinned":  mcp.Bool("Pin it or unpin it."),
 		}),
 	}, s.mcpUpdateNote)
@@ -604,7 +602,6 @@ func (s *Server) mcpMayRead(ctx context.Context, n *store.Note, userID string) b
 func (s *Server) mcpCreateNote(ctx context.Context, userID string, args json.RawMessage) (any, error) {
 	var params struct {
 		Body      string `json:"body"`
-		Title     string `json:"title"`
 		ProjectID string `json:"project_id"`
 		Pinned    bool   `json:"pinned"`
 	}
@@ -612,7 +609,6 @@ func (s *Server) mcpCreateNote(ctx context.Context, userID string, args json.Raw
 
 	n := &store.Note{
 		CreatedBy: userID,
-		Title:     params.Title,
 		Body:      params.Body,
 		Pinned:    params.Pinned,
 	}
@@ -638,7 +634,6 @@ func (s *Server) mcpUpdateNote(ctx context.Context, userID string, args json.Raw
 	var params struct {
 		NoteID string  `json:"note_id"`
 		Body   *string `json:"body"`
-		Title  *string `json:"title"`
 		Pinned *bool   `json:"pinned"`
 	}
 	_ = json.Unmarshal(args, &params)
@@ -659,9 +654,6 @@ func (s *Server) mcpUpdateNote(ctx context.Context, userID string, args json.Raw
 	if params.Body != nil {
 		n.Body = *params.Body
 	}
-	if params.Title != nil {
-		n.Title = *params.Title
-	}
 	if params.Pinned != nil {
 		n.Pinned = *params.Pinned
 	}

internal/httpapi/notes_handlers.go

@@ -1,8 +1,15 @@
 package httpapi
 
 import (
+	"archive/zip"
+	"fmt"
+	"io"
+	"mime"
 	"net/http"
+	"path"
+	"sort"
 	"strings"
+	"time"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/kristianwind/verdande/internal/store"
@@ -97,9 +104,10 @@ func (s *Server) handleGetNote(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, n)
 }
 
+// No title. It is the note's first line and is derived on every save — a field
+// here would be a promise this server cannot keep.
 type noteBody struct {
 	ProjectID *string `json:"project_id"`
-	Title     *string `json:"title"`
 	Body      *string `json:"body"`
 	Pinned    *bool   `json:"pinned"`
 }
@@ -119,9 +127,6 @@ func (s *Server) handleCreateNote(w http.ResponseWriter, r *http.Request) {
 		}
 		n.ProjectID = *body.ProjectID
 	}
-	if body.Title != nil {
-		n.Title = *body.Title
-	}
 	if body.Body != nil {
 		n.Body = *body.Body
 	}
@@ -164,9 +169,6 @@ func (s *Server) handleUpdateNote(w http.ResponseWriter, r *http.Request) {
 		}
 		n.ProjectID = *body.ProjectID
 	}
-	if body.Title != nil {
-		n.Title = *body.Title
-	}
 	if body.Body != nil {
 		n.Body = *body.Body
 	}
@@ -213,3 +215,367 @@ func (s *Server) handleNotesLinking(w http.ResponseWriter, r *http.Request) {
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"notes": s.readable(r, found)})
 }
+
+// handleExportNotes writes every note this person can see as a zip of Markdown
+// files, one per note.
+//
+// A zip of plain files rather than one bundle in a format of our own: what comes
+// out is what was stored, and it opens in Obsidian, in a text editor, in anything.
+// That is the promise the whole design was arranged around — the note on disk is
+// already the file you would export — and this is where it is either kept or not.
+func (s *Server) handleExportNotes(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+	notes, err := s.db.AllNotes(r.Context(), user.ID)
+	if err != nil {
+		s.internal(w, r, "export notes", err)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/zip")
+	w.Header().Set("Content-Disposition",
+		`attachment; filename="verdande-noter-`+time.Now().Format("2006-01-02")+`.zip"`)
+
+	zw := zip.NewWriter(w)
+	defer zw.Close()
+
+	// Names collide: two notes called "Møde" are two notes, and a zip with one entry
+	// twice is a zip that loses one of them.
+	used := map[string]int{}
+	for _, n := range notes {
+		name := noteFilename(n.Title)
+		used[name]++
+		if used[name] > 1 {
+			name = fmt.Sprintf("%s (%d)", name, used[name])
+		}
+
+		f, err := zw.CreateHeader(&zip.FileHeader{
+			Name:     name + ".md",
+			Method:   zip.Deflate,
+			Modified: n.UpdatedAt,
+		})
+		if err != nil {
+			// The response is already streaming, so there is no status left to send.
+			// Stopping leaves a truncated zip, which a zip tool says is truncated —
+			// better than a complete-looking file with a note missing from it.
+			s.log.Error("export notes", "err", err, "note", n.ID)
+			return
+		}
+		if _, err := io.WriteString(f, n.Body); err != nil {
+			s.log.Error("export notes", "err", err, "note", n.ID)
+			return
+		}
+	}
+}
+
+// noteFilename makes a title safe to be a filename on any of the three systems
+// people actually use, without turning it into something unrecognisable.
+func noteFilename(title string) string {
+	name := strings.TrimSpace(title)
+	if name == "" {
+		name = "uden titel"
+	}
+	// Windows refuses these outright; a slash would make directories on the others.
+	name = strings.Map(func(r rune) rune {
+		if strings.ContainsRune(`/\:*?"<>|`, r) || r < 0x20 {
+			return '-'
+		}
+		return r
+	}, name)
+	// Long titles are the first line of a note, which can be a whole sentence.
+	if len([]rune(name)) > 80 {
+		name = string([]rune(name)[:80])
+	}
+	return strings.TrimRight(name, " .")
+}
+
+// maxNoteImportBytes bounds one upload. Generous for text — a decade of notes is
+// a few megabytes — and small enough that a wrong file is refused rather than read.
+const maxNoteImportBytes = 64 << 20
+
+// handleImportNotes reads a zip of Markdown files and makes a note of each.
+//
+// The mirror of the export, and deliberately the same shape: whatever comes out of
+// this program goes back into it. It is also the way in from anywhere else, since
+// a folder of Markdown is what Obsidian, Bear, iA Writer and a shell script all
+// produce — and what the Apple Notes exporter in tools/ writes.
+//
+// Filenames are ignored. The title is the first line of the body, everywhere else
+// in this program, and making it the filename here would be a second rule for the
+// same thing that disagrees the moment somebody renames a file.
+func (s *Server) handleImportNotes(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxNoteImportBytes)
+	if err := r.ParseMultipartForm(4 << 20); err != nil {
+		writeError(w, http.StatusRequestEntityTooLarge, CodePayloadTooLarge, "the file is too large")
+		return
+	}
+	defer r.MultipartForm.RemoveAll()
+
+	file, header, err := r.FormFile("file")
+	if err != nil {
+		writeFieldErrors(w, map[string]string{"file": "required"})
+		return
+	}
+	defer file.Close()
+
+	zr, err := zip.NewReader(file.(io.ReaderAt), header.Size)
+	if err != nil {
+		writeFieldErrors(w, map[string]string{"file": "not a zip archive"})
+		return
+	}
+
+	user := userFrom(r.Context())
+	created, skipped, files := 0, 0, 0
+
+	// Two passes. Everything that is not Markdown is stored first, so that when a
+	// note is read its pictures already have addresses to be rewritten to — a note
+	// and its images arrive in whatever order the archive happens to hold them, and
+	// one pass would leave half the links pointing at nothing.
+	stored := map[string]string{}
+	for _, f := range zr.File {
+		name := f.Name
+		if f.FileInfo().IsDir() || skipFile(name) || strings.EqualFold(path.Ext(name), ".md") {
+			continue
+		}
+		rc, err := f.Open()
+		if err != nil {
+			continue
+		}
+		hashed, size, err := s.storeUpload(rc)
+		rc.Close()
+		if err != nil {
+			s.log.Warn("import note file", "err", err, "file", name)
+			continue
+		}
+		stored[name] = hashed
+		_ = size
+		files++
+	}
+
+	for _, f := range zr.File {
+		name := f.Name
+		if f.FileInfo().IsDir() || !strings.EqualFold(path.Ext(name), ".md") {
+			continue
+		}
+		// Counted, not passed over in silence. A Markdown file the filter refuses is
+		// a note that did not arrive, and the caller is told the same number either
+		// way unless it is said here — which is how one note went missing without
+		// anything looking wrong.
+		if skipFile(name) {
+			s.log.Warn("import skipped a note file", "file", name)
+			skipped++
+			continue
+		}
+
+		rc, err := f.Open()
+		if err != nil {
+			skipped++
+			continue
+		}
+		body, err := io.ReadAll(io.LimitReader(rc, 2<<20))
+		rc.Close()
+		if err != nil || strings.TrimSpace(string(body)) == "" {
+			skipped++
+			continue
+		}
+
+		text, wrote, changed := readFrontMatter(string(body))
+
+		n := &store.Note{CreatedBy: user.ID, Body: text}
+		if err := s.db.SaveNote(r.Context(), n); err != nil {
+			s.log.Warn("import note", "err", err, "file", name)
+			skipped++
+			continue
+		}
+
+		// After the save, not as part of it: SaveNote owns `updated_at` and is right
+		// to, so the dates a note had before this program existed are written over
+		// the top rather than passed through it.
+		if !wrote.IsZero() || !changed.IsZero() {
+			if err := s.db.SetNoteTimes(r.Context(), n.ID, wrote, changed); err != nil {
+				s.log.Warn("import note dates", "err", err, "file", name)
+			}
+		}
+
+		// The pictures the note referred to, now that it has an id to hang them on.
+		// The text is rewritten to the addresses they were given, so an image that
+		// sat in the middle of a paragraph is still in the middle of it.
+		if rewritten, attached := s.attachToNote(r, n, path.Dir(name), stored, zr); attached > 0 {
+			n.Body = rewritten
+			if err := s.db.SaveNote(r.Context(), n); err != nil {
+				s.log.Warn("rewrite note links", "err", err, "note", n.ID)
+			}
+		}
+		created++
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"created": created, "skipped": skipped, "files": files,
+	})
+}
+
+// skipFile is the things in an archive that are not content: directories' own
+// entries, macOS resource forks, and anything trying to climb out of the archive.
+// A zip made on a Mac carries a __MACOSX copy of every file, and importing those
+// would double a whole library with each copy full of binary rubbish.
+func skipFile(name string) bool {
+	if strings.HasPrefix(name, "__MACOSX/") ||
+		strings.HasPrefix(path.Base(name), "._") ||
+		strings.HasPrefix(path.Base(name), ".") {
+		return true
+	}
+
+	// Traversal, read as path segments rather than as a substring.
+	//
+	// This was `strings.Contains(name, "..")`, which is the right idea aimed at the
+	// wrong thing: it does not describe a path that climbs out of the archive, it
+	// describes any name with two dots next to each other anywhere in it. A note
+	// called "Så blev det endelig jul! Stay tuned... ☕️" was therefore dropped —
+	// silently, and without even counting as skipped, so the number the import
+	// reported still looked right. One note in twelve hundred, found only by
+	// counting what came out.
+	//
+	// An ellipsis in a title is ordinary. A segment that *is* "..", or a path that
+	// starts at the root, is not — and those are what a zip uses to write outside
+	// the folder it was unpacked into.
+	if strings.HasPrefix(name, "/") {
+		return true
+	}
+	for _, part := range strings.Split(name, "/") {
+		if part == ".." {
+			return true
+		}
+	}
+	return false
+}
+
+// attachToNote records the files a note's text points at and rewrites the text to
+// where they now live. Returns the new body and how many were attached.
+//
+// Only the files this note refers to. An archive is one folder for many notes, and
+// hanging every picture on every note would turn a library of a hundred into ten
+// thousand attachments.
+func (s *Server) attachToNote(
+	r *http.Request, n *store.Note, dir string, stored map[string]string, zr *zip.Reader,
+) (string, int) {
+	body := n.Body
+	attached := 0
+
+	for _, f := range zr.File {
+		hashed, ok := stored[f.Name]
+		if !ok {
+			continue
+		}
+		base := path.Base(f.Name)
+		// The three ways a Markdown file names a neighbouring image: by its path
+		// inside the archive, by the path relative to the note, and by its bare name.
+		//
+		// The archive path was missing, and it is the one an Apple Notes export
+		// actually writes — `vedhaeftninger/751-2-IMG_0615.heic`, with the note at the
+		// root beside the folder. Only the bare name matched, so only the bare name
+		// was replaced, and every picture in every imported note ended up pointing at
+		// `vedhaeftninger//api/v1/attachments/…`, which is nothing. The images were
+		// stored and attached correctly; it was the link that was wrong.
+		relative := strings.TrimPrefix(path.Join(dir, base), "./")
+		refs := []string{f.Name, relative, base}
+		if !strings.Contains(body, f.Name) &&
+			!strings.Contains(body, relative) &&
+			!strings.Contains(body, base) {
+			continue
+		}
+
+		a := &store.Attachment{
+			NoteID:     n.ID,
+			Filename:   base,
+			MimeType:   mimeOf(base),
+			Size:       int64(f.UncompressedSize64),
+			Path:       hashed,
+			UploadedBy: n.CreatedBy,
+		}
+		if err := s.db.CreateAttachment(r.Context(), a); err != nil {
+			s.log.Warn("attach to note", "err", err, "file", base)
+			continue
+		}
+
+		// Længste først. Erstattes det bare navn inde i en længere sti, bliver mappen
+		// stående foran adressen, og linket peger på ingenting.
+		url := "/api/v1/attachments/" + a.ID
+		sort.Slice(refs, func(i, j int) bool { return len(refs[i]) > len(refs[j]) })
+		for _, ref := range refs {
+			if ref != "" {
+				body = strings.ReplaceAll(body, ref, url)
+			}
+		}
+		attached++
+	}
+	return body, attached
+}
+
+// readFrontMatter takes the YAML block off the top of a Markdown file and reads
+// the two dates out of it, returning the rest of the text.
+//
+// Not a YAML parser, and deliberately not: the block this reads is the one this
+// program writes, plus whatever Obsidian and Bear write, and all of them use the
+// same handful of `key: value` lines. Pulling in a parser to read two dates would
+// be a dependency that can fail in ways nobody here would recognise.
+//
+// A file with no front matter comes back untouched — that is the normal case, and
+// it must never lose its first line to a rule about a block that is not there.
+func readFrontMatter(body string) (text string, created, modified time.Time) {
+	if !strings.HasPrefix(body, "---\n") && !strings.HasPrefix(body, "---\r\n") {
+		return body, time.Time{}, time.Time{}
+	}
+	rest := body[strings.Index(body, "\n")+1:]
+
+	end := strings.Index(rest, "\n---")
+	if end < 0 {
+		// An opening fence with no close is not front matter; it is a horizontal
+		// rule somebody wrote at the top of their note.
+		return body, time.Time{}, time.Time{}
+	}
+	block := rest[:end]
+	after := rest[end+len("\n---"):]
+	after = strings.TrimPrefix(after, "\r")
+	after = strings.TrimPrefix(after, "\n")
+
+	for _, line := range strings.Split(block, "\n") {
+		key, value, ok := strings.Cut(line, ":")
+		if !ok {
+			continue
+		}
+		value = strings.TrimSpace(strings.Trim(strings.TrimSpace(value), `"'`))
+		switch strings.ToLower(strings.TrimSpace(key)) {
+		case "created", "created_at", "date":
+			created = parseNoteTime(value)
+		case "modified", "updated", "updated_at":
+			modified = parseNoteTime(value)
+		}
+	}
+	return strings.TrimLeft(after, "\n"), created, modified
+}
+
+// parseNoteTime accepts the shapes these files actually carry. A date without a
+// time is that day at midnight, local — the note was written on that day, and
+// pretending to know the hour would be worse than not having one.
+func parseNoteTime(v string) time.Time {
+	for _, layout := range []string{
+		time.RFC3339,
+		"2006-01-02T15:04:05",
+		"2006-01-02 15:04:05",
+		"2006-01-02 15:04",
+		"2006-01-02",
+	} {
+		if t, err := time.ParseInLocation(layout, v, time.Local); err == nil {
+			return t
+		}
+	}
+	return time.Time{}
+}
+
+// mimeOf guesses from the extension. The archive does not carry a type, and
+// sniffing the bytes would mean reading every file twice.
+func mimeOf(name string) string {
+	if t := mime.TypeByExtension(path.Ext(name)); t != "" {
+		return t
+	}
+	return "application/octet-stream"
+}

internal/httpapi/notes_import_filter_test.go

@@ -0,0 +1,38 @@
+package httpapi
+
+import "testing"
+
+// En titel med tre prikker i er ikke et forsøg på at skrive uden for mappen.
+//
+// `strings.Contains(name, "..")` var den rigtige idé rettet mod det forkerte:
+// den beskriver ikke en sti, der klatrer ud af arkivet, men ethvert navn med to
+// prikker ved siden af hinanden. Noten "Så blev det endelig jul! Stay tuned... ☕️"
+// blev derfor droppet lydløst — én ud af tolv hundrede, og kun fundet ved at
+// tælle efter, hvor mange der kom ud.
+func TestSkipFileTakesEllipsesButRefusesTraversal(t *testing.T) {
+	keep := []string{
+		"Så blev det endelig jul! Stay tuned... ☕️.md",
+		"Møde 12.8..md",
+		"vedhaeftninger/1-2-Pasted Graphic.png",
+		"noter/Referat....md",
+	}
+	for _, name := range keep {
+		if skipFile(name) {
+			t.Errorf("skipFile(%q) = true, men det er et almindeligt filnavn", name)
+		}
+	}
+
+	drop := []string{
+		"../uden for.md",
+		"noter/../../etc/passwd",
+		"/etc/passwd",
+		"__MACOSX/._noget",
+		".skjult.md",
+		"noter/._AppleDouble.md",
+	}
+	for _, name := range drop {
+		if !skipFile(name) {
+			t.Errorf("skipFile(%q) = false, men den skal afvises", name)
+		}
+	}
+}

internal/httpapi/notes_test.go

@@ -1,7 +1,13 @@
 package httpapi
 
 import (
+	"archive/zip"
+	"bytes"
+	"encoding/json"
+	"io"
+	"mime/multipart"
 	"net/http"
+	"strings"
 	"testing"
 )
 
@@ -113,3 +119,248 @@ func TestChangingANoteChangesWhatItPointsAt(t *testing.T) {
 		t.Errorf("%d notes still point at Firma", got)
 	}
 }
+
+// The export is the promise the whole design was arranged around: the note on
+// disk is already the file you would export, so nothing is converted on the way
+// out and nothing can be lost in the conversion.
+func TestNotesExportAsMarkdownFiles(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	bodies := []string{
+		"# Møde med Anders\n\nHan vil gerne have **kaffe** hver uge.",
+		"Slash/i/titlen\n\nog noget tekst",
+		"# Møde med Anders\n\nen anden note med samme titel",
+	}
+	for _, body := range bodies {
+		if resp, _ := ts.do(t, "POST", "/api/v1/notes", map[string]any{"body": body}); resp.StatusCode != http.StatusCreated {
+			t.Fatalf("create: %d", resp.StatusCode)
+		}
+	}
+
+	req, _ := http.NewRequest("GET", ts.URL+"/api/v1/export/notes.zip", nil)
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
+	for _, c := range ts.client.Jar.Cookies(mustParse(t, ts.URL)) {
+		req.AddCookie(c)
+	}
+	resp, err := ts.client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("export: status %d", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("Content-Type"); ct != "application/zip" {
+		t.Errorf("content type is %q", ct)
+	}
+
+	raw, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	zr, err := zip.NewReader(bytes.NewReader(raw), int64(len(raw)))
+	if err != nil {
+		t.Fatalf("the archive does not open: %v", err)
+	}
+	if len(zr.File) != 3 {
+		t.Fatalf("the archive holds %d files, want 3", len(zr.File))
+	}
+
+	byName := map[string]string{}
+	for _, f := range zr.File {
+		r, err := f.Open()
+		if err != nil {
+			t.Fatal(err)
+		}
+		text, _ := io.ReadAll(r)
+		r.Close()
+		byName[f.Name] = string(text)
+	}
+
+	// Exactly what was stored, byte for byte. A converted export is an export that
+	// can be wrong.
+	if got := byName["Møde med Anders.md"]; got != bodies[0] {
+		t.Errorf("the note came out as %q", got)
+	}
+	// A slash in a title would make a directory, and on Windows it is refused
+	// outright.
+	if _, ok := byName["Slash-i-titlen.md"]; !ok {
+		t.Errorf("the awkward title became %v", keysOf(byName))
+	}
+	// Two notes with the same title are two notes; one entry twice is one lost.
+	if _, ok := byName["Møde med Anders (2).md"]; !ok {
+		t.Errorf("the second note of the same name is missing: %v", keysOf(byName))
+	}
+}
+
+func keysOf(m map[string]string) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	return out
+}
+
+// Out and back in again. If an export cannot be imported, it is not an export —
+// it is a file somebody hopes will be readable later.
+func TestNotesSurviveTheRoundTripThroughAZip(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	var archive bytes.Buffer
+	zw := zip.NewWriter(&archive)
+	files := map[string]string{
+		"Møde med Anders.md": "# Møde med Anders\n\nHan vil have **kaffe** hver uge. #Firma",
+		"noget andet.md":     "Løse tanker\n\nog en linje til",
+		// A zip made on a Mac carries these beside every file. Importing them would
+		// double the whole library, with each copy full of binary rubbish.
+		"__MACOSX/._Møde med Anders.md": "\x00\x05\x16\x07binært",
+		"billede.png":                   "ikke en note",
+		"tom.md":                        "   \n  ",
+	}
+	for name, body := range files {
+		f, err := zw.Create(name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := io.WriteString(f, body); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	var form bytes.Buffer
+	mw := multipart.NewWriter(&form)
+	part, _ := mw.CreateFormFile("file", "noter.zip")
+	part.Write(archive.Bytes())
+	mw.Close()
+
+	req, _ := http.NewRequest("POST", ts.URL+"/api/v1/notes/import", &form)
+	req.Header.Set("Content-Type", mw.FormDataContentType())
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
+	for _, c := range ts.client.Jar.Cookies(mustParse(t, ts.URL)) {
+		req.AddCookie(c)
+	}
+	resp, err := ts.client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("import: status %d", resp.StatusCode)
+	}
+
+	var out struct{ Created, Skipped int }
+	json.NewDecoder(resp.Body).Decode(&out)
+	if out.Created != 2 {
+		t.Fatalf("imported %d notes, want the 2 real ones", out.Created)
+	}
+
+	// The title came from the first line, not from the filename — which is the same
+	// rule as everywhere else, and the reason renaming a file cannot rename a note.
+	_, listed := ts.do(t, "GET", "/api/v1/notes", nil)
+	titles := map[string]bool{}
+	for _, raw := range listed["notes"].([]any) {
+		titles[raw.(map[string]any)["title"].(string)] = true
+	}
+	if !titles["Møde med Anders"] || !titles["Løse tanker"] {
+		t.Errorf("the titles came out as %v", titles)
+	}
+
+	// And the #tag was read on the way in, so an imported note lands on its project
+	// exactly as a typed one does.
+	_, linked := ts.do(t, "GET", "/api/v1/notes/linking/project/Firma", nil)
+	if len(linked["notes"].([]any)) != 1 {
+		t.Errorf("the imported note did not link to its project")
+	}
+}
+
+// A note from Apple Notes is full of photographs. One that arrives as words alone
+// is not that note — it is a summary of it.
+func TestAnImportedNoteKeepsItsPictures(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	var archive bytes.Buffer
+	zw := zip.NewWriter(&archive)
+	write := func(name, body string) {
+		f, err := zw.Create(name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := io.WriteString(f, body); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write("noter/Kvittering.md", "# Kvittering\n\nHer er den:\n\n![](vedhaeftninger/bon.png)\n\nog resten af teksten")
+	write("noter/vedhaeftninger/bon.png", "\x89PNG\r\n\x1a\nlad som om")
+	// Another note in the same archive, which must not inherit the first one's
+	// picture: an archive is one folder for many notes.
+	write("noter/Uden billede.md", "Uden billede\n\nbare tekst")
+	if err := zw.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	var form bytes.Buffer
+	mw := multipart.NewWriter(&form)
+	part, _ := mw.CreateFormFile("file", "noter.zip")
+	part.Write(archive.Bytes())
+	mw.Close()
+
+	req, _ := http.NewRequest("POST", ts.URL+"/api/v1/notes/import", &form)
+	req.Header.Set("Content-Type", mw.FormDataContentType())
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
+	for _, c := range ts.client.Jar.Cookies(mustParse(t, ts.URL)) {
+		req.AddCookie(c)
+	}
+	resp, err := ts.client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+
+	var out struct{ Created, Skipped, Files int }
+	json.NewDecoder(resp.Body).Decode(&out)
+	if out.Created != 2 || out.Files != 1 {
+		t.Fatalf("imported %d notes and %d files, want 2 and 1", out.Created, out.Files)
+	}
+
+	_, listed := ts.do(t, "GET", "/api/v1/notes?q=kvittering", nil)
+	notes := listed["notes"].([]any)
+	if len(notes) != 1 {
+		t.Fatalf("found %d notes", len(notes))
+	}
+	body := notes[0].(map[string]any)["body"].(string)
+
+	// The link points at the file where it now lives, not at a path inside an
+	// archive nobody kept.
+	if strings.Contains(body, "vedhaeftninger/bon.png") {
+		t.Errorf("the link still points into the archive: %q", body)
+	}
+	if !strings.Contains(body, "/api/v1/attachments/") {
+		t.Errorf("the picture was not attached: %q", body)
+	}
+	// And it is still where it was written, in the middle of the note.
+	if !strings.HasPrefix(body, "# Kvittering") || !strings.Contains(body, "og resten af teksten") {
+		t.Errorf("the note was rearranged: %q", body)
+	}
+
+	// The picture is really there and really readable.
+	id := body[strings.Index(body, "/api/v1/attachments/")+len("/api/v1/attachments/"):]
+	id = strings.SplitN(id, ")", 2)[0]
+	got, _ := ts.do(t, "GET", "/api/v1/attachments/"+id, nil)
+	if got.StatusCode != http.StatusOK {
+		t.Errorf("the attachment answers %d", got.StatusCode)
+	}
+
+	// The other note did not inherit it.
+	_, other := ts.do(t, "GET", "/api/v1/notes?q=Uden", nil)
+	for _, raw := range other["notes"].([]any) {
+		if strings.Contains(raw.(map[string]any)["body"].(string), "attachments/") {
+			t.Error("a note that mentioned no picture was given one")
+		}
+	}
+}

internal/httpapi/server.go

@@ -143,6 +143,19 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 			writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
 		})
 
+		// The beacon's receiving end, and the number it produces. Both without a
+		// session, because the caller is a stranger's installation — that is the
+		// whole feature. Rate limited like the login routes: it is the one endpoint
+		// anybody on the internet can write to, and a row per request is a row per
+		// request whether or not the request is honest.
+		//
+		// Refused with a 404 unless this instance has been told it is the collector,
+		// so an ordinary installation is not a spam sink that answers 200 to
+		// anything.
+		r.Method(http.MethodPost, "/beacon",
+			s.rateLimit(s.loginLimiter, http.HandlerFunc(s.handleBeaconPing)))
+		r.Get("/beacon/count", s.handleBeaconCount)
+
 		// Reachable without being signed in — these are how you become signed in.
 		r.Route("/auth", func(r chi.Router) {
 			r.Get("/setup", s.handleSetupState)
@@ -283,6 +296,7 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 			r.Route("/notes", func(r chi.Router) {
 				r.Get("/", s.handleListNotes)
 				r.Post("/", s.handleCreateNote)
+				r.Post("/import", s.handleImportNotes)
 				r.Get("/linking/{kind}/{targetID}", s.handleNotesLinking)
 				r.Get("/{noteID}", s.handleGetNote)
 				r.Patch("/{noteID}", s.handleUpdateNote)
@@ -321,6 +335,7 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 			})
 
 			r.Get("/export/account", s.handleExportAccount)
+			r.Get("/export/notes.zip", s.handleExportNotes)
 			r.Get("/export/projects/{projectID}.csv", s.handleExportProject)
 			r.Get("/export/projects/{projectID}.ics", s.handleExportProjectICS)
 
@@ -388,6 +403,11 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				// `:latest` on the way, which is what makes a restart an update.
 				r.Get("/panel", s.handlePanelStatus)
 				r.Post("/panel/restart", s.handleRestartFromPanel)
+				// Who this instance reports to, and whether it does. An
+				// administrator's decision, not a person's: there is one
+				// installation and it either phones home or it does not.
+				r.Get("/beacon/settings", s.handleBeaconStatus)
+				r.Put("/beacon/settings", s.handleSetBeacon)
 				// A backup file is a complete copy of the database, so this whole
 				// group is sessions-only as well as administrators-only: a leaked
 				// token must not be able to download everybody's data.

internal/imap/imap.go

@@ -310,3 +310,61 @@ func cut(text string) string {
 	}
 	return text
 }
+
+// Unflag takes the flag off the messages that have become tasks.
+//
+// This is what stops the same mail arriving twice, and it replaces a marker that
+// could not be made to hold. The marker was a uid: remember the highest one seen,
+// start above it next time. That is correct only if uids are what the server says
+// they are, and it broke in every way such a scheme can — a fetch reply without a
+// uid, a UIDVALIDITY that changed under a rebuilt mailbox, two mailbox rows
+// pointing at the same folder and each keeping its own marker. Every one of those
+// produced the same symptom: the same mail became a task again, and again.
+//
+// Unflagging moves the record out of our database and into the mailbox, where the
+// question is asked. "Flagged" means "turn this into a task"; once it is a task,
+// the flag has done its job and is not true any more. Nothing has to be
+// remembered, so there is nothing to get out of step — a second sync, a second
+// mailbox row, or a database restored from a backup all find the same answer,
+// because the answer is in the mailbox.
+//
+// It is destructive in the small way that matters: it changes something in
+// somebody's mail. That is the trade, and it is the right way round — a flag is a
+// note to self that this needs doing, and it has been done.
+//
+// The folder is re-selected writable. Since() opens it read-only on purpose, and
+// a search should not need write access just because a later step might.
+func (c *Client) Unflag(uids []uint32) error {
+	if len(uids) == 0 {
+		return nil
+	}
+	if _, err := c.c.Select(c.folder, nil).Wait(); err != nil {
+		return fmt.Errorf("open %s for writing: %w", c.folder, err)
+	}
+
+	set := imap.UIDSetNum()
+	for _, u := range uids {
+		if u == 0 {
+			// No uid means nothing to address. The message keeps its flag and will
+			// be seen again — which is the failure this whole function exists to
+			// prevent, so it is worth saying rather than skipping quietly.
+			continue
+		}
+		set.AddNum(imap.UID(u))
+	}
+	if len(set) == 0 {
+		return nil
+	}
+
+	// Silent: the server has nothing to tell us that we would act on, and the
+	// untagged replies would only have to be collected and thrown away.
+	cmd := c.c.Store(set, &imap.StoreFlags{
+		Op:     imap.StoreFlagsDel,
+		Silent: true,
+		Flags:  []imap.Flag{imap.FlagFlagged},
+	}, nil)
+	if err := cmd.Close(); err != nil {
+		return fmt.Errorf("unflag in %s: %w", c.folder, err)
+	}
+	return nil
+}

internal/imap/roundtrip_test.go

@@ -316,3 +316,81 @@ func TestNothingAtOrBelowTheMarkerComesBack(t *testing.T) {
 		}
 	}
 }
+
+// Den samme mail må ikke kunne blive en opgave to gange.
+//
+// Prøven kører hele vejen imod en rigtig server: den finder de flagede mails,
+// tager flaget af dem, og spørger så forfra som en ny synkronisering ville — med
+// markøren sat til nul, altså det værst tænkelige tilfælde, hvor alt, hvad vi
+// selv havde husket, er væk. Der skal ikke komme noget tilbage.
+//
+// Det er det, markøren ikke kunne love. Den holdt kun, hvis uids var, hvad
+// serveren sagde, og fejlede på et fetch-svar uden uid, på en UIDVALIDITY, der
+// skiftede, og på to postkasse-rækker, der pegede samme sted og hver især førte
+// deres eget regnskab. Alle tre gav det samme: mailen blev en opgave igen.
+func TestAnUnflaggedMailDoesNotComeBack(t *testing.T) {
+	addr, pool := serveMailbox(t, []mail{
+		{subject: "Faktura 4711", from: "[email protected]", body: "Vedhæftet.", flagged: true},
+		{subject: "Nyhedsbrev", from: "[email protected]", body: "Læs mere", flagged: false},
+		{subject: "Kontrakt", from: "[email protected]", body: "Til underskrift", flagged: true},
+	})
+
+	client, err := Dial(Account{Host: addr, Username: "kw", Password: "hemmelig", RootCAs: pool})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer client.Close()
+
+	msgs, _, err := client.Since(0, 25)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(msgs) != 2 {
+		t.Fatalf("fandt %d flagede mails, ventede 2", len(msgs))
+	}
+
+	uids := make([]uint32, 0, len(msgs))
+	for _, m := range msgs {
+		uids = append(uids, m.UID)
+	}
+	if err := client.Unflag(uids); err != nil {
+		t.Fatalf("Unflag: %v", err)
+	}
+
+	// Forfra, og fra nul: selv en instans, der intet husker, må ikke finde dem igen.
+	again, _, err := client.Since(0, 25)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(again) != 0 {
+		t.Fatalf("%d mails kom igen efter at flaget var taget af — den første af dem er %q",
+			len(again), again[0].Subject)
+	}
+}
+
+// Et tomt kald må ikke åbne mappen skrivbar for ingenting.
+func TestUnflagWithNothingToDoIsQuiet(t *testing.T) {
+	addr, pool := serveMailbox(t, []mail{
+		{subject: "Faktura", from: "[email protected]", body: "x", flagged: true},
+	})
+	client, err := Dial(Account{Host: addr, Username: "kw", Password: "hemmelig", RootCAs: pool})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer client.Close()
+
+	if err := client.Unflag(nil); err != nil {
+		t.Errorf("Unflag(nil) = %v", err)
+	}
+	// Kun nuller: der er intet at adressere, og mailen skal beholde sit flag.
+	if err := client.Unflag([]uint32{0, 0}); err != nil {
+		t.Errorf("Unflag(nuller) = %v", err)
+	}
+	msgs, _, err := client.Since(0, 25)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(msgs) != 1 {
+		t.Errorf("mailen mistede sit flag, uden at nogen havde adresseret den")
+	}
+}

internal/jobs/jobs.go

@@ -45,6 +45,11 @@ type Runner struct {
 	// layer, which owns the VAPID keys and the subscription list.
 	Push func(userID, title, body, projectID string)
 
+	// SendBeacon reports this installation to the collector, if it is switched on
+	// and a day has passed. Supplied by the HTTP layer for the same reason as the
+	// syncs: that is where the instance settings and the version live.
+	SendBeacon func(ctx context.Context) error
+
 	wg sync.WaitGroup
 }
 
@@ -69,6 +74,10 @@ func (r *Runner) Start(ctx context.Context) {
 	// account for a to-do app. Ten minutes is fast enough for something somebody
 	// starred and slow enough not to look like abuse.
 	r.every(ctx, "mailboxes", 10*time.Minute, r.syncMailboxes)
+	// Checked hourly, sent at most daily — the same shape as the backup, and for
+	// the same reason: a container asleep at the scheduled minute would otherwise
+	// skip the day. SendBeacon decides whether a day has passed.
+	r.every(ctx, "beacon", time.Hour, r.sendBeacon)
 }
 
 func (r *Runner) Wait() { r.wg.Wait() }
@@ -103,6 +112,17 @@ func (r *Runner) every(ctx context.Context, name string, interval time.Duration,
 	}()
 }
 
+// sendBeacon reports that this installation exists, at most once a day.
+//
+// Every decision about what is sent, and why this is on by default rather than
+// compulsory, lives in internal/beacon. This is only the clock.
+func (r *Runner) sendBeacon(ctx context.Context) error {
+	if r.SendBeacon == nil {
+		return nil
+	}
+	return r.SendBeacon(ctx)
+}
+
 // --- reminders ------------------------------------------------------------------
 
 // sendDueReminders delivers everything that has come due since the last pass.

internal/safedial/safedial.go

@@ -0,0 +1,106 @@
+// Package safedial refuses to open a connection to this machine or to the
+// network it sits on.
+//
+// The problem it solves is the same one three times: somewhere a user supplies a
+// URL or a host, and the server fetches it. An AI provider's base address, a push
+// endpoint, an IMAP host, a beacon collector. Each of them is a feature, and each
+// of them is also a way to ask the server to reach something the caller cannot —
+// the panel next door, a metadata endpoint, a database on the same bridge — and
+// to report back whether it answered. On a homelab that is the whole point of the
+// box being where it is.
+//
+// # Why the check is on the address and not on the URL
+//
+// Parsing the URL and refusing "localhost" or "127.0.0.1" is the obvious version
+// and it does not work: a name resolves to whatever its owner says, so
+// `evil.example.com` can answer 127.0.0.1 — and can answer differently the second
+// time, after a parse-time check has passed. That is DNS rebinding, and the only
+// place it can be caught is after resolution and before the connection, which is
+// exactly where net.Dialer's Control hook runs.
+//
+// # What is refused
+//
+// Loopback, link-local (including 169.254.169.254, which is where cloud metadata
+// lives), the private ranges, unique-local IPv6, and the unspecified address.
+// Everything else is allowed: this is not an allowlist of the internet, it is a
+// wall around the inside.
+package safedial
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"syscall"
+	"time"
+)
+
+// ErrPrivate is returned when a connection was refused for where it pointed. It
+// deliberately does not say which address it resolved to: the answer is itself
+// the thing an attacker is fishing for.
+type ErrPrivate struct{ Host string }
+
+func (e *ErrPrivate) Error() string {
+	return fmt.Sprintf("refusing to connect to %s: it resolves to an address on this machine or its private network", e.Host)
+}
+
+// Blocked reports whether an address must not be dialled.
+func Blocked(ip net.IP) bool {
+	return ip == nil ||
+		ip.IsLoopback() ||
+		ip.IsUnspecified() ||
+		ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() ||
+		ip.IsInterfaceLocalMulticast() ||
+		ip.IsMulticast() ||
+		ip.IsPrivate()
+}
+
+// Control is a net.Dialer Control function that refuses a private destination.
+//
+// It runs after the name has been resolved and before the socket is connected,
+// which is the only moment where the address that will actually be used is known.
+func Control(network, address string, _ syscall.RawConn) error {
+	host, _, err := net.SplitHostPort(address)
+	if err != nil {
+		return err
+	}
+	ip := net.ParseIP(host)
+	if Blocked(ip) {
+		return &ErrPrivate{Host: host}
+	}
+	return nil
+}
+
+// Dialer is a net.Dialer that will not reach inside.
+func Dialer(timeout time.Duration) *net.Dialer {
+	return &net.Dialer{Timeout: timeout, Control: Control}
+}
+
+// Client is an http.Client for fetching something a user named.
+//
+// Redirects are followed but capped, and every hop goes through the same dialer —
+// a redirect to 127.0.0.1 is the oldest way around a check that only looked at the
+// URL somebody typed.
+func Client(timeout time.Duration) *http.Client {
+	return &http.Client{
+		Timeout: timeout,
+		Transport: &http.Transport{
+			DialContext:           Dialer(timeout).DialContext,
+			TLSHandshakeTimeout:   timeout,
+			ResponseHeaderTimeout: timeout,
+		},
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			if len(via) >= 5 {
+				return fmt.Errorf("too many redirects")
+			}
+			return nil
+		},
+	}
+}
+
+// AllowPrivate is the same client without the wall, for a destination the
+// operator configured rather than a user — the panel, and nothing else. Named so
+// that using it is a decision somebody wrote down.
+func AllowPrivate(timeout time.Duration) *http.Client {
+	return &http.Client{Timeout: timeout}
+}

internal/safedial/safedial_test.go

@@ -0,0 +1,55 @@
+package safedial
+
+import (
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestBlockedCoversTheInside(t *testing.T) {
+	blocked := []string{
+		"127.0.0.1", "::1", "0.0.0.0",
+		// Skyens metadata-endepunkt. Den ene adresse, enhver SSRF sigter efter.
+		"169.254.169.254",
+		"10.0.0.5", "172.16.0.1", "192.168.1.10", "fd00::1", "fe80::1",
+	}
+	for _, s := range blocked {
+		if !Blocked(net.ParseIP(s)) {
+			t.Errorf("Blocked(%s) = false", s)
+		}
+	}
+	for _, s := range []string{"93.184.216.34", "8.8.8.8", "2606:2800:220:1:248:1893:25c8:1946"} {
+		if Blocked(net.ParseIP(s)) {
+			t.Errorf("Blocked(%s) = true, men det er en almindelig adresse", s)
+		}
+	}
+}
+
+// En httptest-server lytter på loopback, hvilket gør den til den perfekte prøve:
+// den findes, den svarer, og den må ikke kunne nås.
+func TestClientRefusesLoopback(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Error("forbindelsen blev oprettet; den skulle være afvist")
+	}))
+	defer srv.Close()
+
+	_, err := Client(3 * time.Second).Get(srv.URL)
+	if err == nil {
+		t.Fatal("en forespørgsel til loopback skal afvises")
+	}
+}
+
+func TestAllowPrivateStillReaches(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer srv.Close()
+
+	resp, err := AllowPrivate(3 * time.Second).Get(srv.URL)
+	if err != nil {
+		t.Fatalf("den skal kunne nå det, operatøren selv har peget på: %v", err)
+	}
+	resp.Body.Close()
+}

internal/store/beacon.go

@@ -0,0 +1,138 @@
+package store
+
+import (
+	"context"
+	"time"
+)
+
+// The collector's side of the beacon: what has reported in, and how many.
+//
+// Every method here is about counting installations, never about identifying one.
+// There is no lookup by anything but the id an installation made up for itself,
+// and there is nothing to join it against.
+
+// BeaconStats is the whole of what the collector can say.
+type BeaconStats struct {
+	Total      int            `json:"total"`
+	Active7d   int            `json:"active_7d"`
+	Active30d  int            `json:"active_30d"`
+	ByVersion  map[string]int `json:"by_version"`
+	LastPingAt *time.Time     `json:"last_ping_at,omitempty"`
+}
+
+// maxBeaconInstalls bounds the table.
+//
+// The receiving endpoint is unauthenticated — it has to be, since the caller is a
+// stranger's installation — and it inserts a row keyed on an id the caller made
+// up. Anybody can therefore mint ids and grow this table until the volume the
+// database lives on is full. A ceiling turns that from a disk-fill into a number
+// that is merely wrong, which is the difference between an outage and an
+// annoyance. A hundred thousand is far above any plausible real count and far
+// below anything that matters on disk.
+const maxBeaconInstalls = 100_000
+
+// RecordBeacon writes down that an installation is alive, and on which version.
+//
+// `first_seen` is kept from the original row on purpose: it is the only thing
+// that distinguishes an installation that has been running for a year from one
+// that appeared this morning, and it costs nothing to keep.
+func (db *DB) RecordBeacon(ctx context.Context, instanceID, version string) error {
+	now := time.Now().Unix()
+
+	// An installation already known keeps reporting whatever the ceiling says: the
+	// cap must never stop counting the real ones, only stop new rows from being
+	// invented without limit.
+	var known int
+	if err := db.QueryRowContext(ctx,
+		`SELECT count(*) FROM beacon_installs WHERE instance_id = ?`, instanceID).Scan(&known); err != nil {
+		return err
+	}
+	if known == 0 {
+		var total int
+		if err := db.QueryRowContext(ctx,
+			`SELECT count(*) FROM beacon_installs`).Scan(&total); err != nil {
+			return err
+		}
+		if total >= maxBeaconInstalls {
+			// Not an error to the caller. Their installation did nothing wrong, and
+			// there is nothing for them to do about it.
+			return nil
+		}
+	}
+
+	_, err := db.ExecContext(ctx, `
+		INSERT INTO beacon_installs (instance_id, version, first_seen, last_seen)
+		VALUES (?, ?, ?, ?)
+		ON CONFLICT (instance_id) DO UPDATE SET
+		    version   = excluded.version,
+		    last_seen = excluded.last_seen`,
+		instanceID, version, now, now)
+	return err
+}
+
+// BeaconCount is how many installations have reported within the window.
+//
+// A window rather than a running total, and that is not a detail. A total only
+// ever climbs: every instance anybody ever started for ten minutes stays in it
+// forever, so the number stops meaning "how many people use this" and starts
+// meaning "how many people have ever tried it". The question being asked is the
+// first one.
+func (db *DB) BeaconCount(ctx context.Context, within time.Duration) (int, error) {
+	var n int
+	err := db.QueryRowContext(ctx,
+		`SELECT count(*) FROM beacon_installs WHERE last_seen >= ?`,
+		time.Now().Add(-within).Unix()).Scan(&n)
+	return n, err
+}
+
+// BeaconSummary is everything the settings page shows.
+func (db *DB) BeaconSummary(ctx context.Context) (BeaconStats, error) {
+	out := BeaconStats{ByVersion: map[string]int{}}
+
+	if err := db.QueryRowContext(ctx,
+		`SELECT count(*) FROM beacon_installs`).Scan(&out.Total); err != nil {
+		return out, err
+	}
+
+	var err error
+	if out.Active7d, err = db.BeaconCount(ctx, 7*24*time.Hour); err != nil {
+		return out, err
+	}
+	if out.Active30d, err = db.BeaconCount(ctx, 30*24*time.Hour); err != nil {
+		return out, err
+	}
+
+	// Versions of the ones still alive, not of everything ever seen: an instance
+	// that stopped reporting two years ago should not still be counted as running
+	// the version it was on when it stopped.
+	rows, err := db.QueryContext(ctx, `
+		SELECT version, count(*) FROM beacon_installs
+		 WHERE last_seen >= ? AND version <> ''
+		 GROUP BY version`, time.Now().Add(-30*24*time.Hour).Unix())
+	if err != nil {
+		return out, err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var v string
+		var n int
+		if err := rows.Scan(&v, &n); err != nil {
+			return out, err
+		}
+		out.ByVersion[v] = n
+	}
+	if err := rows.Err(); err != nil {
+		return out, err
+	}
+
+	var last *int64
+	if err := db.QueryRowContext(ctx,
+		`SELECT max(last_seen) FROM beacon_installs`).Scan(&last); err != nil {
+		return out, err
+	}
+	if last != nil {
+		t := time.Unix(*last, 0)
+		out.LastPingAt = &t
+	}
+	return out, nil
+}

internal/store/comments.go

@@ -27,6 +27,7 @@ type Attachment struct {
 	// GroupID hangs the file on a project group rather than on any one task in
 	// it: the contract that governs all of "Arbejde", not a step in it.
 	GroupID    string
+	NoteID     string
 	Filename   string
 	MimeType   string
 	Size       int64
@@ -157,17 +158,18 @@ func (db *DB) CreateAttachment(ctx context.Context, a *Attachment) error {
 	a.CreatedAt = time.Now().UTC()
 
 	_, err := db.ExecContext(ctx,
-		`INSERT INTO attachments (id, task_id, comment_id, group_id, filename, mime_type,
+		`INSERT INTO attachments (id, task_id, comment_id, group_id, note_id, filename, mime_type,
 		                          size, path, uploaded_by, created_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		a.ID, nullString(a.TaskID), nullString(a.CommentID), nullString(a.GroupID),
+		nullString(a.NoteID),
 		a.Filename, a.MimeType, a.Size, a.Path, a.UploadedBy, a.CreatedAt.Unix())
 	return err
 }
 
 func (db *DB) ListTaskAttachments(ctx context.Context, taskID string) ([]Attachment, error) {
 	rows, err := db.QueryContext(ctx,
-		`SELECT id, task_id, comment_id, group_id, filename, mime_type, size, path, uploaded_by, created_at
+		`SELECT id, task_id, comment_id, group_id, note_id, filename, mime_type, size, path, uploaded_by, created_at
 		 FROM attachments WHERE task_id = ? ORDER BY created_at`, taskID)
 	if err != nil {
 		return nil, err
@@ -176,11 +178,24 @@ func (db *DB) ListTaskAttachments(ctx context.Context, taskID string) ([]Attachm
 	return scanAttachments(rows)
 }
 
+// ListNoteAttachments is the files inside one note — the pictures and scans that
+// came with it, and anything added since.
+func (db *DB) ListNoteAttachments(ctx context.Context, noteID string) ([]Attachment, error) {
+	rows, err := db.QueryContext(ctx,
+		`SELECT id, task_id, comment_id, group_id, note_id, filename, mime_type, size, path, uploaded_by, created_at
+		 FROM attachments WHERE note_id = ? ORDER BY created_at`, noteID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	return scanAttachments(rows)
+}
+
 // ListGroupAttachments is the documents that belong to a whole group rather than
 // to anything inside it.
 func (db *DB) ListGroupAttachments(ctx context.Context, groupID string) ([]Attachment, error) {
 	rows, err := db.QueryContext(ctx,
-		`SELECT id, task_id, comment_id, group_id, filename, mime_type, size, path, uploaded_by, created_at
+		`SELECT id, task_id, comment_id, group_id, note_id, filename, mime_type, size, path, uploaded_by, created_at
 		 FROM attachments WHERE group_id = ? ORDER BY created_at`, groupID)
 	if err != nil {
 		return nil, err
@@ -195,7 +210,7 @@ func (db *DB) attachmentsByComment(ctx context.Context, commentIDs []string) (ma
 		args[i] = id
 	}
 	rows, err := db.QueryContext(ctx,
-		`SELECT id, task_id, comment_id, group_id, filename, mime_type, size, path, uploaded_by, created_at
+		`SELECT id, task_id, comment_id, group_id, note_id, filename, mime_type, size, path, uploaded_by, created_at
 		 FROM attachments WHERE comment_id IN (`+placeholders(len(commentIDs))+`)
 		 ORDER BY created_at`, args...)
 	if err != nil {
@@ -218,15 +233,16 @@ func scanAttachments(rows *sql.Rows) ([]Attachment, error) {
 	out := []Attachment{}
 	for rows.Next() {
 		var a Attachment
-		var taskID, commentID, groupID sql.NullString
+		var taskID, commentID, groupID, noteID sql.NullString
 		var created int64
-		if err := rows.Scan(&a.ID, &taskID, &commentID, &groupID, &a.Filename, &a.MimeType,
+		if err := rows.Scan(&a.ID, &taskID, &commentID, &groupID, &noteID, &a.Filename, &a.MimeType,
 			&a.Size, &a.Path, &a.UploadedBy, &created); err != nil {
 			return nil, err
 		}
 		a.TaskID = taskID.String
 		a.CommentID = commentID.String
 		a.GroupID = groupID.String
+		a.NoteID = noteID.String
 		a.CreatedAt = time.Unix(created, 0).UTC()
 		out = append(out, a)
 	}
@@ -235,7 +251,7 @@ func scanAttachments(rows *sql.Rows) ([]Attachment, error) {
 
 func (db *DB) GetAttachment(ctx context.Context, attachmentID string) (*Attachment, error) {
 	rows, err := db.QueryContext(ctx,
-		`SELECT id, task_id, comment_id, group_id, filename, mime_type, size, path, uploaded_by, created_at
+		`SELECT id, task_id, comment_id, group_id, note_id, filename, mime_type, size, path, uploaded_by, created_at
 		 FROM attachments WHERE id = ?`, attachmentID)
 	if err != nil {
 		return nil, err

internal/store/migrations/0020_fold_note_tags.sql

@@ -0,0 +1,29 @@
+-- #garageristeriet and #GarageRisteriet are the same project.
+--
+-- They were not, because the key was stored exactly as typed and looked up the
+-- same way — so a note that named a project in lower case simply did not appear
+-- on it, silently and with nothing to suggest why.
+--
+-- Folded on the way in from now on; this brings the rows already written into
+-- line. Only projects: a [[note title]] is a title, and two notes called "Møde"
+-- and "møde" are two notes.
+--
+-- The primary key is (note_id, kind, target_id), so folding can collide with a row
+-- that is already there — a note that wrote both spellings. INSERT OR IGNORE into
+-- a fresh set and swap, which keeps one of each rather than failing on the pair.
+CREATE TABLE note_links_folded (
+    note_id     TEXT NOT NULL REFERENCES notes (id) ON DELETE CASCADE,
+    kind        TEXT NOT NULL CHECK (kind IN ('task', 'note', 'project')),
+    target_id   TEXT NOT NULL,
+    PRIMARY KEY (note_id, kind, target_id)
+);
+
+INSERT OR IGNORE INTO note_links_folded (note_id, kind, target_id)
+SELECT note_id, kind,
+       CASE WHEN kind = 'project' THEN lower(target_id) ELSE target_id END
+FROM note_links;
+
+DROP TABLE note_links;
+ALTER TABLE note_links_folded RENAME TO note_links;
+
+CREATE INDEX note_links_backwards ON note_links (kind, target_id);

internal/store/migrations/0021_note_attachments.sql

@@ -0,0 +1,45 @@
+-- A note can carry files, the way a task and a group already can.
+--
+-- Apple Notes is full of photographs, scans and pasted screenshots, and a note
+-- that arrives here as words alone is not that note — it is a summary of it. The
+-- import writes the files as attachments and rewrites the links in the text, so a
+-- picture that was in the middle of a paragraph is still in the middle of it.
+--
+-- Same table as everything else attaches to, rather than one of its own. The files
+-- are content-addressed and deduplicated on disk, the upload path is written and
+-- tested, and the cleanup that removes an orphan already walks this table. A
+-- second table would be a second everything.
+
+-- verdande:rebuild-tables
+
+CREATE TABLE attachments_with_notes (
+    id          TEXT PRIMARY KEY,
+    task_id     TEXT REFERENCES tasks (id) ON DELETE CASCADE,
+    comment_id  TEXT REFERENCES comments (id) ON DELETE CASCADE,
+    group_id    TEXT REFERENCES project_groups (id) ON DELETE CASCADE,
+    note_id     TEXT REFERENCES notes (id) ON DELETE CASCADE,
+    filename    TEXT NOT NULL,
+    mime_type   TEXT NOT NULL DEFAULT 'application/octet-stream',
+    size        INTEGER NOT NULL,
+    path        TEXT NOT NULL,
+    uploaded_by TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+    created_at  INTEGER NOT NULL,
+    -- Counted, not spelled out as pairs: with four columns the pairwise version is
+    -- six clauses, and the one that is wrong looks exactly like the one that is right.
+    CHECK ((task_id IS NOT NULL) + (comment_id IS NOT NULL)
+         + (group_id IS NOT NULL) + (note_id IS NOT NULL) = 1)
+);
+
+INSERT INTO attachments_with_notes
+    (id, task_id, comment_id, group_id, filename, mime_type, size, path, uploaded_by, created_at)
+SELECT id, task_id, comment_id, group_id, filename, mime_type, size, path, uploaded_by, created_at
+FROM attachments;
+
+DROP TABLE attachments;
+
+ALTER TABLE attachments_with_notes RENAME TO attachments;
+
+CREATE INDEX idx_attachments_task ON attachments (task_id) WHERE task_id IS NOT NULL;
+CREATE INDEX idx_attachments_comment ON attachments (comment_id) WHERE comment_id IS NOT NULL;
+CREATE INDEX idx_attachments_group ON attachments (group_id) WHERE group_id IS NOT NULL;
+CREATE INDEX idx_attachments_note ON attachments (note_id) WHERE note_id IS NOT NULL;

internal/store/migrations/0022_beacon.sql

@@ -0,0 +1,26 @@
+-- One row per installation that has ever reported in.
+--
+-- This table only exists on the instance that is acting as the collector. Every
+-- other instance has it too, empty, because the schema is the same everywhere —
+-- and because "am I the collector" is a setting, not a build.
+--
+-- What is deliberately NOT here is the point of the whole feature: there is no
+-- column for an IP address, a hostname, a domain, an account, a count of tasks,
+-- or anything else. The two things stored are the two things sent, and the table
+-- is the promise written down where it cannot drift from the prose — a column
+-- added here later is a promise broken, and it should be as awkward to add as
+-- possible.
+--
+-- `instance_id` is the primary key rather than a rowid alias, because the same
+-- installation reporting daily must update its row rather than grow a new one.
+-- What is wanted is "how many installations", not "how many pings".
+CREATE TABLE beacon_installs (
+    instance_id TEXT PRIMARY KEY,
+    version     TEXT NOT NULL DEFAULT '',
+    first_seen  INTEGER NOT NULL,
+    last_seen   INTEGER NOT NULL
+);
+
+-- The count is always "seen in the last N days", so last_seen is what every query
+-- sorts and filters on.
+CREATE INDEX beacon_by_last_seen ON beacon_installs (last_seen DESC);

internal/store/notes.go

@@ -62,11 +62,12 @@ func (db *DB) SaveNote(ctx context.Context, n *Note) error {
 	}
 	n.UpdatedAt = now
 
-	// A note with no title takes its first line, the way Apple Notes does. A list
-	// of untitled notes is a list nobody can read.
-	if strings.TrimSpace(n.Title) == "" {
-		n.Title = firstLine(n.Body)
-	}
+	// The title is always the first line, the way Apple Notes does it. Not "when it
+	// is empty": derived once and then left alone, it goes stale the moment somebody
+	// rewrites the opening of a note, and the list ends up calling a note by a name
+	// that is nowhere in it. The column is a cache of the body, not a field beside
+	// it, and every caller gets the same answer because none of them can set it.
+	n.Title = firstLine(n.Body)
 
 	return db.Tx(ctx, func(tx *sql.Tx) error {
 		var projectID any
@@ -127,7 +128,14 @@ func LinksIn(body string) []NoteLink {
 		add("task", strings.ToLower(m[1]))
 	}
 	for _, m := range projectRef.FindAllStringSubmatch(body, -1) {
-		add("project", m[1])
+		// Folded, because #garageristeriet and #GarageRisteriet are the same project
+		// to everybody except a database. The key is stored folded and looked up
+		// folded, so the comparison stays an exact match and keeps using its index —
+		// a comparison that lowered the column instead would read the whole table.
+		//
+		// The project's real spelling is not lost: it is on the project, which is
+		// what the interface shows. This column is a key, not a label.
+		add("project", strings.ToLower(m[1]))
 	}
 	for _, m := range noteRef.FindAllStringSubmatch(body, -1) {
 		add("note", strings.TrimSpace(m[1]))
@@ -209,6 +217,9 @@ func (db *DB) AllNotes(ctx context.Context, userID string) ([]Note, error) {
 // The reason note_links exists. Without it this would mean reading every note's
 // prose, and a panel that slow is one nobody leaves open.
 func (db *DB) NotesLinking(ctx context.Context, kind, targetID string) ([]Note, error) {
+	if kind == "project" {
+		targetID = strings.ToLower(targetID)
+	}
 	return db.notesWhere(ctx, `
 		WHERE deleted_at IS NULL
 		  AND id IN (SELECT note_id FROM note_links WHERE kind = ? AND target_id = ?)
@@ -236,6 +247,37 @@ func (db *DB) SearchNotes(ctx context.Context, query string, limit int) ([]Note,
 		LIMIT ?`, expr, limit)
 }
 
+// SetNoteTimes writes the dates a note had somewhere else.
+//
+// Only the import calls this, and it exists because SaveNote is right to refuse:
+// `updated_at` is when this program last wrote the note, and letting any caller
+// set it would make the column mean whatever the last writer felt like. A note
+// brought in from Apple Notes is the one case where the dates are facts from
+// before this database existed — and without them a move of twelve hundred notes
+// is a pile that was all written the same evening, which throws away the order
+// they were written in. That order is half of what an archive is.
+func (db *DB) SetNoteTimes(ctx context.Context, id string, created, updated time.Time) error {
+	if created.IsZero() && updated.IsZero() {
+		return nil
+	}
+	// COALESCE, so a note carrying only one of the two keeps what it already had
+	// for the other rather than being stamped with the zero time — which would sort
+	// it to the year one.
+	var c, u any
+	if !created.IsZero() {
+		c = created.Unix()
+	}
+	if !updated.IsZero() {
+		u = updated.Unix()
+	}
+	_, err := db.ExecContext(ctx, `
+		UPDATE notes
+		   SET created_at = COALESCE(?, created_at),
+		       updated_at = COALESCE(?, updated_at)
+		 WHERE id = ?`, c, u, id)
+	return err
+}
+
 // DeleteNote puts it in the trash. Nothing here removes a row.
 func (db *DB) DeleteNote(ctx context.Context, id string) error {
 	_, err := db.ExecContext(ctx,

internal/store/notes_test.go

@@ -29,7 +29,10 @@ func TestATagInANoteIsTheSameTagAsInATask(t *testing.T) {
 	if len(projects) != 2 {
 		t.Fatalf("read %v out of the note, want the two projects", n.Links)
 	}
-	if projects[0] != "Firma" || projects[1] != "Regnskab" {
+	// Folded: the key is a key, not a label. #firma and #Firma are the same project
+	// to everybody except a database, and the project's own spelling is on the
+	// project, which is what the interface shows.
+	if projects[0] != "firma" || projects[1] != "regnskab" {
 		t.Errorf("got %v", projects)
 	}
 }
@@ -118,10 +121,10 @@ func TestNotesAreFoundInEitherSpelling(t *testing.T) {
 	db, userID := sealedStore(t)
 	ctx := context.Background()
 
+	// The title is the first line now, so that is where it goes.
 	if err := db.SaveNote(ctx, &Note{
 		CreatedBy: userID,
-		Title:     "Grønt regnskab",
-		Body:      "Målt på årsbasis for Århus.",
+		Body:      "Grønt regnskab\n\nMålt på årsbasis for Århus.",
 	}); err != nil {
 		t.Fatal(err)
 	}
@@ -173,7 +176,9 @@ func TestWhatIsReadOutOfABody(t *testing.T) {
 		{"a hash inside a word is not a tag", "C#Sharp og x#y", nil},
 		{"a note by title", "se [[Møde med Anders]]", []NoteLink{{"note", "Møde med Anders"}}},
 		{"the same tag twice is one link", "#Firma og #Firma igen",
-			[]NoteLink{{"project", "Firma"}}},
+			[]NoteLink{{"project", "firma"}}},
+		{"two spellings are one tag", "#Firma og #firma",
+			[]NoteLink{{"project", "firma"}}},
 		{"a heading is not a tag", "# Overskrift", nil},
 	} {
 		t.Run(c.name, func(t *testing.T) {
@@ -245,3 +250,86 @@ func TestTheProjectCountIsWhatIsLeft(t *testing.T) {
 		t.Errorf("after deleting one, the count is %d, want 1", n)
 	}
 }
+
+// The title follows the first line, always — not only the first time.
+//
+// Derived once and then left alone, it goes stale the moment somebody rewrites
+// the opening, and the list ends up calling a note by a name that is nowhere in
+// it. That is exactly what happened: a note headed "Ny note" was listed as
+// "fdgfgfgh", which was what its first line had been some edits ago.
+func TestTheTitleFollowsTheFirstLine(t *testing.T) {
+	db, userID := sealedStore(t)
+	ctx := context.Background()
+
+	n := &Note{CreatedBy: userID, Body: "Første udgave\n\nnoget tekst"}
+	if err := db.SaveNote(ctx, n); err != nil {
+		t.Fatal(err)
+	}
+	if n.Title != "Første udgave" {
+		t.Fatalf("title started as %q", n.Title)
+	}
+
+	n.Body = "# Ny note\n\nDette er mit nye noteprogram"
+	if err := db.SaveNote(ctx, n); err != nil {
+		t.Fatal(err)
+	}
+	if n.Title != "Ny note" {
+		t.Errorf("after rewriting the first line the title is %q", n.Title)
+	}
+
+	back, err := db.Note(ctx, n.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if back.Title != "Ny note" {
+		t.Errorf("the stored title is %q", back.Title)
+	}
+
+	// And a title cannot be set beside the text, because then the two can disagree.
+	n.Title = "noget andet"
+	if err := db.SaveNote(ctx, n); err != nil {
+		t.Fatal(err)
+	}
+	if n.Title != "Ny note" {
+		t.Errorf("a title set by hand survived as %q", n.Title)
+	}
+}
+
+// A note that names a project in the other case must still turn up on it.
+//
+// It did not, and nothing said why: the key was stored exactly as typed and
+// looked up the same way, so #garageristeriet and #GarageRisteriet were two
+// different things that looked identical to a person.
+func TestATagFindsItsProjectWhateverTheCase(t *testing.T) {
+	db, userID := sealedStore(t)
+	ctx := context.Background()
+
+	if err := db.SaveNote(ctx, &Note{
+		CreatedBy: userID,
+		Body:      "Bønnerne kommer fredag #garageristeriet",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, spelling := range []string{"GarageRisteriet", "garageristeriet", "GARAGERISTERIET"} {
+		found, err := db.NotesLinking(ctx, "project", spelling)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(found) != 1 {
+			t.Errorf("looking up %q found %d notes, want 1", spelling, len(found))
+		}
+	}
+
+	// A note title is a title, not a key: two notes called "Møde" and "møde" are
+	// two notes, and folding them together would merge things somebody kept apart.
+	if err := db.SaveNote(ctx, &Note{CreatedBy: userID, Body: "se [[Møde]]"}); err != nil {
+		t.Fatal(err)
+	}
+	if found, _ := db.NotesLinking(ctx, "note", "møde"); len(found) != 0 {
+		t.Error("a note title was folded")
+	}
+	if found, _ := db.NotesLinking(ctx, "note", "Møde"); len(found) != 1 {
+		t.Error("a note title did not match itself")
+	}
+}

tools/apple-notes-til-markdown.py

@@ -0,0 +1,491 @@
+#!/usr/bin/env python3
+"""Apple Noter → Markdown, med formateringen i behold.
+
+Den første udgave af det her brugte `textutil -convert txt`, som er hurtigt at
+skrive og smider alt væk: overskrifter, fed, monospace, lister. Ti prøvenoter
+viste hvad det koster — en note er ikke kun sine ord, den er også hvordan de er
+sat op, og et referat med overskrifter er ikke det samme referat som en klump.
+
+Apple Noter er HTML indeni, og HTML kan læses. Kortet er lille, fordi Noter selv
+bruger et lille sæt:
+
+    <h1> <h2> <h3>   overskrifter        →  # ## ###
+    <b> <i> <u>      fremhævning         →  ** * <u>
+    <tt>             monospace           →  ```-blok
+    <ul><li>         punktliste          →  -
+    <ol><li>         nummereret          →  1.
+    <div>            en linje            →  linjeskift
+    <br>             en tom linje        →  tom linje
+
+Kører på din egen maskine og sender ingenting nogen steder.
+
+    ./apple-notes-til-markdown.py ~/Desktop/noter          # alle
+    ./apple-notes-til-markdown.py ~/Desktop/noter 10       # de første ti
+"""
+
+import html
+import os
+import re
+import subprocess
+import sys
+from html.parser import HTMLParser
+
+BLOCK_PREFIX = {"h1": "# ", "h2": "## ", "h3": "### ", "h4": "#### "}
+# Fra lukkemærke tilbage til åbnemærke, når et mærke skal deles over to linjer.
+OPENER = {"**": "**", "*": "*", "</u>": "<u>"}
+MARKS_ONLY = re.compile(r"(?:\*\*|\*|~~|<u>|</u>|\s)*")
+FORBIDDEN = set('/\\:*?"<>|')
+
+
+def osascript(script: str) -> str:
+    """Ét kald til Noter. Fejl er tomme frem for fatale: en enkelt note, der ikke
+    kan læses, skal ikke stoppe en kørsel på tolv hundrede."""
+    try:
+        out = subprocess.run(
+            ["osascript", "-e", script],
+            capture_output=True, text=True, timeout=60, check=False,
+        )
+        return out.stdout.rstrip("\n")
+    except subprocess.SubprocessError:
+        return ""
+
+
+class NoteParser(HTMLParser):
+    """Apple Noters HTML til Markdown.
+
+    Linjebaseret, fordi Noter er linjebaseret: hver <div> er en linje, og det er
+    dét, personen skrev. En rigtig Markdown-gengiver ville slå linjer sammen til
+    afsnit, hvilket er korrekt Markdown og forkert i forhold til noten.
+    """
+
+    def __init__(self):
+        super().__init__(convert_charrefs=True)
+        self.lines: list[str] = []
+        self.line: list[str] = []
+        self.block: str | None = None     # h1, h2 …
+        self.mono = False                 # den aktuelle linje er monospace
+        self.mono_lines: list[str] = []   # samlet op til én kodeblok
+        self.list_kind: list[str] = []    # ul/ol i lag
+        self.list_no: list[int] = []
+        self.marks: list[str] = []        # b, i, u i lag
+
+    # --- linjer ---------------------------------------------------------------
+
+    def _flush_line(self):
+        # Et mærke, der står åbent, når linjen slutter, lukkes her og åbnes igen på
+        # den næste.
+        #
+        # Noter skriver <b>Møde forberedelse<br></b>: linjeskiftet ligger *inde i*
+        # det fede. Skrev man linjen ud uden videre, blev de to stjerner, der lukker,
+        # til den næste linjes første tegn — "**Møde forberedelse" og så en linje med
+        # "**" på. Markdown er linjebaseret; et mærke, der skal over et linjeskift,
+        # findes ikke, og skal derfor deles i to.
+        reopen = list(self.marks)
+        for closer in reversed(self.marks):
+            self.line.append(closer)
+
+        text = "".join(self.line).rstrip()
+
+        # En linje, der kun er mærker, er en tom linje. Det sker for den sidste
+        # stump af et fedt afsnit, hvor der ikke står andet end linjeskiftet.
+        if MARKS_ONLY.fullmatch(text):
+            text = ""
+
+        self.line = [OPENER[c] for c in reopen]
+        mono, self.mono = self.mono, False
+
+        if mono:
+            # Monospace samles op og skrives som én blok, ikke som en række
+            # enkeltlinjer: en terminaludskrift er én ting.
+            self.mono_lines.append(text)
+            return
+
+        # En tom linje lukker ikke en kodeblok. Hver linje i Noter er pakket ind i
+        # sin egen <div>, og dens starttag tømmer den forrige linje — så mellem to
+        # <tt>-linjer kommer der altid en tom flush forbi. Lod man den lukke
+        # blokken, blev hver eneste linje i en terminaludskrift sin egen blok.
+        if not text and self.mono_lines:
+            return
+
+        self._close_mono()
+
+        if self.block:
+            self.lines.append(BLOCK_PREFIX[self.block] + text if text else "")
+            return
+        if self.list_kind:
+            if not text:
+                return
+            if self.list_kind[-1] == "ol":
+                self.list_no[-1] += 1
+                self.lines.append(f"{self.list_no[-1]}. {text}")
+            else:
+                self.lines.append(f"- {text}")
+            return
+        self.lines.append(text)
+
+    def _close_mono(self):
+        if not self.mono_lines:
+            return
+        # Tomme linjer i enderne er afstand omkring blokken, ikke en del af koden.
+        block = self.mono_lines
+        while block and not block[0].strip():
+            block.pop(0)
+        while block and not block[-1].strip():
+            block.pop()
+        if block:
+            self.lines.append("```")
+            self.lines.extend(block)
+            self.lines.append("```")
+            # Luft efter blokken. Uden den klæber den næste sætning til den
+            # afsluttende hegnslinje, og en Markdown-læser er i sin gode ret til
+            # at læse dem som ét.
+            self.lines.append("")
+        self.mono_lines = []
+
+    def _open(self, opener: str, closer: str):
+        """Åbner et mærke — eller fortryder det, der lige lukkede.
+
+        Noter deler også fremhævet tekst op i kørsler: "Møde" står som
+        <b>M</b><b>øde</b>, fordi der er en attributkørsel bag hver stump. Skrevet
+        ligeud bliver det **M****øde**, som er ét ord i fed sagt på den grimmest
+        mulige måde — og for kursiv bliver det *M**øde*, hvor de to stjerner i
+        midten læses som fed af enhver Markdown-læser. Ordet kom ud forkert.
+
+        Lukkes et mærke og åbnes det samme igen med det samme, er der ikke sket
+        noget imellem. Så tages lukningen tilbage, og de to kørsler er ét mærke.
+        """
+        if self.line and self.line[-1] == closer:
+            self.line.pop()
+        else:
+            self.line.append(opener)
+        self.marks.append(closer)
+
+    # --- tags -----------------------------------------------------------------
+
+    def handle_starttag(self, tag, attrs):
+        if tag in BLOCK_PREFIX:
+            # En overskrift, der fortsætter den forrige, er den samme linje.
+            #
+            # Noter deler en linje op i så mange stumper, den har brug for — en
+            # overskrift skrevet i ét hug står som
+            # <h1>A</h1><h1>alb</h1><h1>org Kom</h1><h1>mune</h1>, fordi der er en
+            # attributkørsel bag hver stump. Læste man et linjeskift ved hver <h1>,
+            # blev "Aalborg Kommune" til fire overskrifter oven på hinanden, og
+            # noten så ødelagt ud på den mest synlige måde, der findes: i sin egen
+            # titel.
+            #
+            # Der brydes derfor kun, når blokken skifter til en anden slags. Selve
+            # linjeskiftene kommer fra <div> og <br>, som er dem, der betyder det.
+            if self.block != tag:
+                self._flush_line()
+            self.block = tag
+        elif tag in ("ul", "ol"):
+            self._flush_line()
+            self.list_kind.append(tag)
+            self.list_no.append(0)
+        elif tag == "li":
+            self._flush_line()
+        elif tag in ("tt", "code", "pre"):
+            # Ikke et linjeskift: <tt> står inde i den <div>, der ER linjen.
+            # Mærket sættes på linjen og aflæses, når den skrives ud.
+            self.mono = True
+        elif tag in ("b", "strong"):
+            self._open("**", "**")
+        elif tag in ("i", "em"):
+            self._open("*", "*")
+        elif tag == "u":
+            self._open("<u>", "</u>")
+        elif tag == "br":
+            self._flush_line()
+            self.block = None
+        elif tag == "div":
+            self._flush_line()
+            self.block = None
+
+    def handle_endtag(self, tag):
+        if tag in BLOCK_PREFIX:
+            # Ikke her. Lukkes overskriften ved sit eget sluttag, kan den næste
+            # stump af samme linje ikke se, at den hører til — det er <div> og <br>,
+            # der afgør, hvor linjen holder op.
+            pass
+        elif tag in ("ul", "ol"):
+            self._flush_line()
+            if self.list_kind:
+                self.list_kind.pop()
+                self.list_no.pop()
+        elif tag == "li":
+            self._flush_line()
+        elif tag in ("tt", "code", "pre"):
+            # Blokken lukkes IKKE her. To <tt>-linjer efter hinanden er én
+            # terminaludskrift, ikke to; den lukkes, når en linje uden monospace
+            # skrives ud, hvilket _flush_line sørger for.
+            pass
+        elif tag in ("b", "strong", "i", "em", "u"):
+            if self.marks:
+                self.line.append(self.marks.pop())
+        elif tag == "div":
+            self._flush_line()
+            self.block = None
+
+    def handle_data(self, data):
+        self.line.append(data)
+
+    def result(self) -> str:
+        self._flush_line()
+        self._close_mono()
+        # Tomme linjer i stimer bliver til én: Noter er fuld af <div><br></div>,
+        # og fem tomme linjer i træk er ikke afstand, det er rod.
+        out, blanks = [], 0
+        for line in self.lines:
+            if line.strip():
+                blanks = 0
+                out.append(line)
+            else:
+                blanks += 1
+                if blanks == 1:
+                    out.append("")
+        while out and not out[-1].strip():
+            out.pop()
+        return "\n".join(out)
+
+
+def to_markdown(body: str) -> str:
+    p = NoteParser()
+    p.feed(body)
+    p.close()
+    return p.result()
+
+
+def safe_name(title: str, fallback: str) -> str:
+    name = "".join("-" if c in FORBIDDEN or ord(c) < 32 else c for c in title).strip()
+    name = name.rstrip(" .")
+    return name[:80] or fallback
+
+
+# Skilletegn, der ikke står i en note: enhedsadskillere fra ASCII, som ingen
+# skriver med et tastatur.
+FIELD, RECORD = "\u241f", "\u241e"
+
+
+def osascript_file(script: str) -> str:
+    """Som osascript(), men til et manuskript, der er for stort til -e."""
+    import tempfile
+    with tempfile.NamedTemporaryFile("w", suffix=".applescript", delete=False,
+                                     encoding="utf-8") as f:
+        f.write(script)
+        path = f.name
+    try:
+        out = subprocess.run(["osascript", path], capture_output=True, text=True,
+                             timeout=600, check=False)
+        return out.stdout
+    except subprocess.SubprocessError:
+        return ""
+    finally:
+        os.unlink(path)
+
+
+def fetch(ids: list[str]) -> list[dict]:
+    """Navn, krop og datoer for en håndfuld noter i ét kald.
+
+    Ét kald pr. note var det oplagte, og det tog halvanden time for tolv hundrede
+    — ikke fordi Noter er langsom, men fordi hvert kald er en proces, der skal
+    startes. Det gjorde det umuligt at rette en fejl i oversættelsen og se
+    resultatet: hver runde var en frokostpause. Nu hentes de i klumper, og hele
+    eksporten tager minutter.
+
+    Klumper frem for alle på én gang, fordi en enkelt uleselig note ellers ville
+    tage hele kørslen med sig — og fordi svaret skal kunne være i hukommelsen.
+
+    Datoerne læses som tal frem for som tekst. `creation date` giver en dato
+    formateret efter maskinens sprog, og den ville skulle gættes tilbage; year,
+    month og day er de samme tal på enhver maskine.
+    """
+    quoted = ", ".join('"' + i.replace('"', '\\"') + '"' for i in ids)
+    script = f'''
+tell application "Notes"
+	set out to ""
+	repeat with theId in {{{quoted}}}
+		try
+			set n to note id theId
+			set c to creation date of n
+			set m to modification date of n
+			set out to out & (name of n) & "{FIELD}" & ¬
+				((year of c) & "-" & (month of c as integer) & "-" & (day of c) & "T" & ¬
+				 (hours of c) & ":" & (minutes of c) & ":" & (seconds of c)) & "{FIELD}" & ¬
+				((year of m) & "-" & (month of m as integer) & "-" & (day of m) & "T" & ¬
+				 (hours of m) & ":" & (minutes of m) & ":" & (seconds of m)) & "{FIELD}" & ¬
+				(count of attachments of n) & "{FIELD}" & ¬
+				(body of n) & "{RECORD}"
+		on error
+			set out to out & "{FIELD}{FIELD}{FIELD}{FIELD}" & "{RECORD}"
+		end try
+	end repeat
+	return out
+end tell
+'''
+    raw = osascript_file(script)
+    rows = []
+    for chunk in raw.split(RECORD):
+        if not chunk.strip("\n "):
+            continue
+        parts = chunk.split(FIELD)
+        if len(parts) < 5:
+            rows.append({"name": "", "created": "", "modified": "", "files": 0, "body": ""})
+            continue
+        rows.append({
+            "name": parts[0].lstrip("\n"), "created": parts[1], "modified": parts[2],
+            "files": int(parts[3]) if parts[3].strip().isdigit() else 0,
+            "body": parts[4],
+        })
+    return rows
+
+
+def iso(stamp: str) -> str:
+    """"2026-8-17T12:55:14" → "2026-08-17T12:55:14". Nul foran, så det sorterer."""
+    try:
+        date, _, time = stamp.partition("T")
+        y, mo, d = (int(x) for x in date.split("-"))
+        h, mi, se = (int(x) for x in time.split(":"))
+        return f"{y:04d}-{mo:02d}-{d:02d}T{h:02d}:{mi:02d}:{se:02d}"
+    except (ValueError, AttributeError):
+        return ""
+
+
+def main() -> int:
+    out_dir = sys.argv[1] if len(sys.argv) > 1 else os.path.expanduser("~/Desktop/apple-noter")
+    limit = int(sys.argv[2]) if len(sys.argv) > 2 else 0
+    os.makedirs(out_dir, exist_ok=True)
+
+    # Id'erne først, i ét kald.
+    #
+    # Ikke "note 1", "note 2" …: Noter sorterer listen efter ændringsdato, så et
+    # indeks peger på noget andet, hvis noget flytter sig imellem to kald — og
+    # navn og krop blev hentet hver for sig. Resultatet var en note med én titel
+    # og en andens indhold, hvilket først ses, når man læser dem igennem. Et id
+    # peger på den samme note hver gang.
+    ids = osascript(
+        'tell application "Notes" to return id of every note'
+    )
+    if not ids:
+        print("Noter svarer ikke. Første gang skal macOS have lov — se efter dialogen.")
+        return 1
+    ids = [x.strip() for x in ids.split(",") if x.strip()]
+
+    total = len(ids)
+    print(f"Fandt {total} noter.")
+    if limit and limit < total:
+        ids = ids[:limit]
+        total = limit
+        print(f"Tager de første {total}.")
+
+    used: dict[str, int] = {}
+    attachments_dir = os.path.join(out_dir, "vedhaeftninger")
+
+    CHUNK = 40
+    fetched: list[dict] = []
+    for start in range(0, len(ids), CHUNK):
+        fetched.extend(fetch(ids[start:start + CHUNK]))
+        print(f"  hentet {min(start + CHUNK, len(ids))} / {total}")
+
+    for i, (note_id, row) in enumerate(zip(ids, fetched), start=1):
+        title = row["name"].strip() or f"uden titel {i}"
+        text = to_markdown(row["body"])
+
+        # Kroppen begynder med notens egen titel. Skrives der en overskrift
+        # ovenover, står titlen to gange i hver eneste note.
+        #
+        # De tomme linjer skal forbi først: <h1> ligger inde i en <div>, hvis
+        # starttag tømmer linjen før den — så første linje er tom, og
+        # sammenligningen så på ingenting.
+        # Titlen kan være delt over flere overskrifter.
+        #
+        # Noter kalder noten det, der står på de første linjer, sat sammen med
+        # mellemrum — så en note, hvis to første linjer er "CPU" og "CAN", hedder
+        # "CPU CAN". Sammenlignede man kun med den første linje, gik det fri, og
+        # titlen stod bagefter to gange: én gang som overskrift og én gang som de
+        # stumper, den var lavet af. Fjorten noter ud af tolv hundrede.
+        #
+        # Overskrifterne øverst tages derfor med, så længe de tilsammen stadig er
+        # begyndelsen på titlen, og fjernes kun, hvis de til sidst er hele titlen.
+        lines = text.split("\n")
+        while lines and not lines[0].strip():
+            lines.pop(0)
+
+        taken, joined = 0, ""
+        for line in lines:
+            if not line.strip():
+                taken += 1
+                continue
+            if not line.lstrip().startswith("#"):
+                break
+            candidate = (joined + " " + line.lstrip("# ").strip()).strip()
+            if not title.strip().startswith(candidate):
+                break
+            joined, taken = candidate, taken + 1
+            if joined == title.strip():
+                break
+
+        if joined == title.strip():
+            lines = lines[taken:]
+            while lines and not lines[0].strip():
+                lines.pop(0)
+        text = "\n".join(lines)
+
+        name = safe_name(title, f"note-{i}")
+        used[name] = used.get(name, 0) + 1
+        path = os.path.join(out_dir, name if used[name] == 1 else f"{name} ({used[name]})") + ".md"
+
+        # Datoerne i et hoved, som enhver anden Markdown-læser kender.
+        #
+        # Uden dem er en flytning af tolv hundrede noter en bunke, der alle er
+        # skrevet samme aften: rækkefølgen, som er halvdelen af hvad et arkiv er,
+        # findes ikke længere. Obsidian, Bear og alt andet læser den her blok, og
+        # verdandes egen import gør nu også.
+        created, modified = iso(row["created"]), iso(row["modified"])
+        head = ""
+        if created or modified:
+            head = "---\n"
+            if created:
+                head += f"created: {created}\n"
+            if modified:
+                head += f"modified: {modified}\n"
+            head += "---\n\n"
+
+        with open(path, "w", encoding="utf-8") as f:
+            f.write(f"{head}# {title}\n\n{text}\n")
+
+        # Billeder og bilag. En note fra Noter er ofte fuld af fotografier, og en
+        # note, der kommer over som ord alene, er ikke den note.
+        # Antallet kom med i klumpen. Det var ét kald pr. note, og da kun hver
+        # tiende note har et bilag, var de ni af dem en proces startet for at få
+        # svaret nul.
+        if row["files"] > 0:
+            os.makedirs(attachments_dir, exist_ok=True)
+            with open(path, "a", encoding="utf-8") as f:
+                for j in range(1, row["files"] + 1):
+                    a_name = osascript(
+                        f'tell application "Notes" to return name of attachment {j} '
+                        f'of note id "{note_id}"'
+                    ) or f"bilag-{i}-{j}"
+                    a_file = f"{i}-{j}-" + safe_name(a_name, f"bilag-{i}-{j}")
+                    target = os.path.join(attachments_dir, a_file)
+                    # Nogle vedhæftninger — links til websider, kort — har ingen
+                    # fil bag sig og fejler her. De springes over.
+                    osascript(
+                        f'tell application "Notes" to save attachment {j} '
+                        f'of note id "{note_id}" in POSIX file "{target}"'
+                    )
+                    if os.path.exists(target):
+                        f.write(f"\n![](vedhaeftninger/{os.path.basename(target)})\n")
+
+        if i % 25 == 0:
+            print(f"  {i} / {total}")
+
+    print(f"\nFærdig. {total} noter ligger i:\n  {out_dir}\n")
+    print("Pak dem og importér zip'en under Indstillinger → Data:")
+    print(f'  cd "{os.path.dirname(out_dir)}" && zip -r "{os.path.basename(out_dir)}.zip" "{os.path.basename(out_dir)}"')
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

tools/pak-noter-i-portioner.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""Pakker en Apple Noter-eksport i portioner, der kan importeres.
+
+Eksporten af tolv hundrede noter fylder knap to hundrede megabyte, og næsten
+alt sammen er billeder: teksten selv er under fire. Importen tager 64 MB ad
+gangen, og tunnelen foran den tager mindre — så det skal deles.
+
+Delt efter hvad en note *vejer med sine billeder*, ikke efter antal. De fleste
+noter har ingen, så de fylder én portion til sammen; de få med et fotoalbum i
+får hver deres. En note og dens billeder ligger altid i samme portion, for
+linkene i teksten er relative, og en note, hvis billeder kom med i næste
+portion, ville pege på ingenting.
+
+    ./pak-noter-i-portioner.py ~/Desktop/apple-noter [MB]
+"""
+
+import os
+import re
+import sys
+import zipfile
+
+# Under importens 64 MB og under det, en tunnel plejer at tage. Hellere en
+# portion mere end en, der ryger på målstregen.
+DEFAULT_LIMIT_MB = 40
+
+LINK = re.compile(r"!\[[^\]]*\]\((vedhaeftninger/[^)]+)\)")
+
+
+def main() -> int:
+    src = os.path.expanduser(sys.argv[1] if len(sys.argv) > 1 else "~/Desktop/apple-noter")
+    limit = int(float(sys.argv[2] if len(sys.argv) > 2 else DEFAULT_LIMIT_MB) * 1024 * 1024)
+    out_dir = src.rstrip("/") + "-portioner"
+    os.makedirs(out_dir, exist_ok=True)
+
+    notes = sorted(f for f in os.listdir(src) if f.endswith(".md"))
+    if not notes:
+        print(f"Ingen .md-filer i {src}")
+        return 1
+
+    # Hvad hver note vejer, og hvad den trækker med sig.
+    weighed = []
+    for name in notes:
+        path = os.path.join(src, name)
+        text = open(path, encoding="utf-8", errors="replace").read()
+        files = []
+        size = os.path.getsize(path)
+        for rel in LINK.findall(text):
+            f = os.path.join(src, rel)
+            if os.path.exists(f):
+                files.append(rel)
+                size += os.path.getsize(f)
+        weighed.append((name, files, size))
+
+    # En note, der alene er større end grænsen, får sin egen portion frem for at
+    # blive sprunget over: den skal med, og en portion på 25 MB er stadig en, der
+    # kan sendes.
+    batches, current, current_size = [], [], 0
+    for item in weighed:
+        if current and current_size + item[2] > limit:
+            batches.append(current)
+            current, current_size = [], 0
+        current.append(item)
+        current_size += item[2]
+    if current:
+        batches.append(current)
+
+    print(f"{len(notes)} noter → {len(batches)} portioner\n")
+    for i, batch in enumerate(batches, start=1):
+        zip_path = os.path.join(out_dir, f"noter-{i:02d}.zip")
+        seen = set()
+        with zipfile.ZipFile(zip_path, "w", zipfile.ZIP_DEFLATED) as z:
+            for name, files, _ in batch:
+                z.write(os.path.join(src, name), name)
+                for rel in files:
+                    if rel in seen:
+                        continue
+                    seen.add(rel)
+                    z.write(os.path.join(src, rel), rel)
+        mb = os.path.getsize(zip_path) / 1024 / 1024
+        print(f"  {os.path.basename(zip_path)}  {len(batch):4d} noter  {len(seen):3d} bilag  {mb:6.1f} MB")
+
+    print(f"\nLigger i:\n  {out_dir}")
+    print("\nImportér én ad gangen under Indstillinger → Data → Noter.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

web/e2e/smoke.spec.js

@@ -655,7 +655,15 @@ test('et invitationslink opretter kontoen og giver adgang til projektet', async
 
 	await page.getByLabel('Ny opgave').fill('males inden fredag #Fælleshuset');
 	await page.getByLabel('Ny opgave').press('Enter');
-	await page.getByText('males inden fredag', { exact: true }).click();
+	// Titlen alene, ikke rækken med datomærket i.
+	//
+	// Hurtig tilføjelse læser "fredag" som forfaldsdatoen og tager ordet ud af
+	// titlen, så rækken er "males inden" plus et mærke, der siger hvornår. Mærkets
+	// ord skifter med ugedagen — "fredag", når der er langt, og "I morgen", når man
+	// kører prøven på en torsdag. Den her linje ledte efter hele rækken og fandt
+	// den derfor ikke én dag om ugen. Prøven handler om invitationer, ikke om
+	// datoer; den skal ikke vide hvilken dag det er.
+	await page.getByText('males inden', { exact: true }).click();
 
 	const drawer = page.getByRole('complementary', { name: 'Opgave' });
 	await drawer.getByLabel('Ansvarlig').selectOption({ label: 'Nabo' });
@@ -2129,3 +2137,300 @@ test('en ny note begynder som titel, og linjen efter er brødtekst', async ({ pa
 
 	expect(trouble).toEqual([]);
 });
+
+test('# foreslår et projekt, og titlen følger den første linje', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/');
+
+	const sidebar = page.getByRole('navigation', { name: 'Hovedmenu' });
+	await sidebar.getByRole('button', { name: 'Nyt projekt' }).click();
+	await sidebar.getByLabel('Projektnavn').fill('Forslagsprojektet');
+	await sidebar.getByLabel('Projektnavn').press('Enter');
+	await expect(sidebar.getByRole('link', { name: 'Forslagsprojektet' })).toBeVisible();
+
+	await sidebar.getByRole('link', { name: 'Noter', exact: true }).click();
+	await page.getByRole('button', { name: 'Ny note' }).click();
+	const ed = page.getByRole('textbox', { name: 'Notens tekst' });
+	await ed.click();
+
+	await page.keyboard.type('Første udkast');
+	await page.keyboard.press('Enter');
+
+	// Half a tag is enough. The name is long and nobody should have to spell it.
+	await page.keyboard.type('Handler om #Forslags');
+	const option = page.getByRole('option', { name: /Forslagsprojektet/ }).first();
+	await expect(option).toBeVisible();
+
+	// Return takes the highlighted one — the list owns the key while it is open.
+	await page.keyboard.press('Enter');
+	await expect(ed).toContainText('#Forslagsprojektet');
+	await expect(option).toBeHidden();
+
+	// And the syntax is spelled out under the field, where it is being typed.
+	await expect(page.getByText('projekt', { exact: false }).first()).toBeVisible();
+
+	// The title is the first line. It used to be derived once and then left alone,
+	// so rewriting the opening left the list calling the note by an old name.
+	await page.keyboard.press('Enter');
+	await ed.blur();
+	await expect(page.getByRole('button', { name: /Første udkast/ })).toBeVisible();
+
+	// Rewrite the first line; the list has to follow.
+	await ed.click();
+	await page.keyboard.press('ControlOrMeta+Home');
+	for (let i = 0; i < 13; i++) await page.keyboard.press('Shift+ArrowRight');
+	await page.keyboard.type('Andet udkast');
+	await ed.blur();
+	await expect(page.getByRole('button', { name: /Andet udkast/ })).toBeVisible();
+
+	expect(trouble).toEqual([]);
+});
+
+test('et tag finder sit projekt uanset store og små bogstaver', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/');
+
+	const sidebar = page.getByRole('navigation', { name: 'Hovedmenu' });
+	await sidebar.getByRole('button', { name: 'Nyt projekt' }).click();
+	await sidebar.getByLabel('Projektnavn').fill('StoreBogstaver');
+	await sidebar.getByLabel('Projektnavn').press('Enter');
+	await expect(sidebar.getByRole('link', { name: 'StoreBogstaver' })).toBeVisible();
+
+	await sidebar.getByRole('link', { name: 'Noter', exact: true }).click();
+	await page.getByRole('button', { name: 'Ny note' }).click();
+	const ed = page.getByRole('textbox', { name: 'Notens tekst' });
+	await ed.click();
+
+	// Written in lower case, the way somebody types when they are not thinking
+	// about it. It used to mean the note simply never appeared on the project, with
+	// nothing anywhere to say why.
+	await page.keyboard.type('Aftale om levering');
+	await page.keyboard.press('Enter');
+	await page.keyboard.type('Handler om #storebogstaver');
+	await page.keyboard.press('Escape');
+	await ed.blur();
+
+	// The panel shows the project's own spelling, not the folded key: a label
+	// nobody wrote and that is nowhere in the note would be worse than none.
+	await expect(page.locator('.link', { hasText: '#StoreBogstaver' })).toBeVisible();
+
+	await sidebar.getByRole('link', { name: 'StoreBogstaver' }).click();
+	await expect(page.locator('.notes').getByRole('link', { name: /Aftale om levering/ })).toBeVisible();
+
+	expect(trouble).toEqual([]);
+});
+
+test('en opgave viser de noter, der nævner den, og linket åbner noten', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/');
+
+	const box = page.getByLabel('Ny opgave');
+	await box.fill('ring til leverandøren i dag');
+	await box.press('Enter');
+	await expect(page.getByText('ring til leverandøren', { exact: true })).toBeVisible();
+
+	// Asked for rather than read off the address bar: opening a task shows a drawer
+	// without navigating, so the URL is still the list's.
+	const taskId = await page.evaluate(async () => {
+		const r = await fetch('/api/v1/tasks?limit=100', {
+			credentials: 'include',
+			headers: { 'Sec-Fetch-Site': 'same-origin' }
+		});
+		const j = await r.json();
+		return (j.tasks ?? []).find((t) => t.content === 'ring til leverandøren')?.id;
+	});
+	expect(taskId, 'opgaven blev ikke oprettet').toBeTruthy();
+
+	const sidebar = page.getByRole('navigation', { name: 'Hovedmenu' });
+	await sidebar.getByRole('link', { name: 'Noter', exact: true }).click();
+	await page.getByRole('button', { name: 'Ny note' }).click();
+	const ed = page.getByRole('textbox', { name: 'Notens tekst' });
+	await ed.click();
+	await page.keyboard.type('Referat fra tirsdag');
+	await page.keyboard.press('Enter');
+	await page.keyboard.type('Aftalt at han ringer, se /opgave/' + taskId);
+	await ed.blur();
+
+	// Back on the task: the other direction of the same link. Without it the
+	// connection only works if you happen to be reading the note, which is the half
+	// nobody needs help with.
+	await page.goto('/opgave/' + taskId);
+	const linked = page.locator('.linked-notes').getByRole('link', { name: /Referat fra tirsdag/ });
+	await expect(linked).toBeVisible();
+
+	// And it opens the note rather than dropping you on a list to find it again.
+	await linked.click();
+	await expect(page.getByRole('textbox', { name: 'Notens tekst' })).toContainText(
+		'Aftalt at han ringer'
+	);
+
+	expect(trouble).toEqual([]);
+});
+
+test('en kodeblok ser ud som en terminal og bliver farvet', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/noter');
+
+	// Skrevet ind som Markdown, sådan som importen fra Apple Noter leverer den.
+	const id = await page.evaluate(async () => {
+		const r = await fetch('/api/v1/notes', {
+			method: 'POST',
+			credentials: 'include',
+			headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+			body: JSON.stringify({
+				body: '# Terminalprøven\n\nHer er udskriften:\n\n```bash\nkw@shell:~$ ls -la\n# en kommentar\necho "hej"\n```\n\nog resten.'
+			})
+		});
+		return (await r.json()).id;
+	});
+	await page.goto('/noter?note=' + id);
+
+	const ed = page.getByRole('textbox', { name: 'Notens tekst' });
+	const pre = ed.locator('pre');
+	await expect(pre).toBeVisible();
+
+	// Mørk flade uanset tema: en terminal er sort, også midt på dagen.
+	const look = await pre.evaluate((el) => {
+		const s = getComputedStyle(el);
+		return { bg: s.backgroundColor, font: s.fontFamily };
+	});
+	expect(look.bg).toBe('rgb(20, 24, 27)');
+	expect(look.font.toLowerCase()).toMatch(/mono/);
+
+	// Og farvet: prompten, kommentaren og strengen skal kunne skelnes.
+	await expect(pre.locator('.tok-prompt')).toBeVisible();
+	await expect(pre.locator('.tok-comment')).toContainText('en kommentar');
+	await expect(pre.locator('.tok-string')).toContainText('hej');
+
+	// Teksten omkring er ikke blevet til kode.
+	await expect(ed.locator('h1')).toHaveText('Terminalprøven');
+	await expect(ed).toContainText('og resten.');
+
+	// Og blokken overlever turen tilbage til Markdown: den skal komme ud som en
+	// hegnet blok med sit sprog, ikke som en klump linjer.
+	const body = await page.evaluate(async (noteId) => {
+		const r = await fetch('/api/v1/notes/' + noteId, {
+			credentials: 'include',
+			headers: { 'Sec-Fetch-Site': 'same-origin' }
+		});
+		return (await r.json()).body;
+	}, id);
+	expect(body).toContain('```bash');
+	expect(body).toContain('kw@shell:~$ ls -la');
+
+	expect(trouble).toEqual([]);
+});
+
+test('lister overlever en gemning — også i et citat, og også med numre', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/noter');
+
+	// Formerne, der hver især gik tabt: en punktliste, en nummereret, en der
+	// begynder et andet sted end ved ét, en liste i en liste, og en liste inde i et
+	// citat. Den sidste er den, en note fra Apple Noter er fuld af.
+	const markdown = [
+		'# Former',
+		'',
+		'- Punkt',
+		'- Punkt 2',
+		'',
+		'1. Nummer',
+		'2. Nummer 2',
+		'',
+		'10. Ti',
+		'11. Elleve',
+		'',
+		'- Ydre',
+		'  - Indre',
+		'',
+		'> Et citat',
+		'> - med en liste i'
+	].join('\n');
+
+	const id = await page.evaluate(async (body) => {
+		const r = await fetch('/api/v1/notes', {
+			method: 'POST',
+			credentials: 'include',
+			headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+			body: JSON.stringify({ body })
+		});
+		return (await r.json()).id;
+	}, markdown);
+
+	await page.goto('/noter?note=' + id);
+	const ed = page.getByRole('textbox', { name: 'Notens tekst' });
+	await expect(ed.locator('ul > li').first()).toBeVisible();
+
+	// Vist som lister, ikke som linjer med bindestreger i.
+	await expect(ed.locator('ol')).toHaveCount(2);
+	await expect(ed.locator('blockquote ul li')).toHaveText('med en liste i');
+	// Den indlejrede ligger inde i sit punkt, ikke ved siden af.
+	await expect(ed.locator('ul li ul li')).toHaveText('Indre');
+	// Og den, der begyndte ved ti, gør det stadig.
+	await expect(ed.locator('ol[start="10"] li').first()).toHaveText('Ti');
+
+	// Rør noten, sådan som en tastning gør, og lad den gemme.
+	await ed.click();
+	await page.keyboard.press('End');
+	await page.keyboard.type(' ');
+	await page.waitForTimeout(1200);
+
+	// Det, der står i filen bagefter, er det, der stod i den før.
+	//
+	// Det var her, det gik galt: alt fra det første punkt blev til én linje —
+	// "PunktPunkt 2NummerNummer 2" — fordi en liste inde i en blok blev læst som
+	// tekst. Ingen havde rørt de linjer.
+	const body = await page.evaluate(async (noteId) => {
+		const r = await fetch('/api/v1/notes/' + noteId, {
+			credentials: 'include',
+			headers: { 'Sec-Fetch-Site': 'same-origin' }
+		});
+		return (await r.json()).body;
+	}, id);
+
+	expect(body).toContain('- Punkt\n- Punkt 2');
+	expect(body).toContain('1. Nummer\n2. Nummer 2');
+	expect(body).toContain('10. Ti\n11. Elleve');
+	expect(body).toContain('- Ydre\n  - Indre');
+	expect(body).toContain('> Et citat\n> - med en liste i');
+
+	expect(trouble).toEqual([]);
+});
+
+test('en note kan ikke smugle et script ind gennem et billedes alt-tekst', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+	await page.goto('/noter');
+
+	// Undslap `alt` ikke sine anførselstegn, lukkede den første af dem attributten,
+	// og resten stod som markup: et img med en onerror på. En note deles gennem et
+	// projekt, så det ville køre på vores eget domæne, hos den der åbnede noten.
+	const id = await page.evaluate(async () => {
+		const r = await fetch('/api/v1/notes', {
+			method: 'POST',
+			credentials: 'include',
+			headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+			body: JSON.stringify({
+				body: '# Ondsindet\n\n![" onerror="window.__pwned = true](/api/v1/attachments/aaaabbbbccccdddd)\n'
+			})
+		});
+		return (await r.json()).id;
+	});
+
+	await page.goto('/noter?note=' + id);
+	const ed = page.getByRole('textbox', { name: 'Notens tekst' });
+	await expect(ed.locator('img')).toHaveCount(1);
+	// Billedet peger ingen steder, så det fejler at indlæse — hvilket er præcis
+	// den vej, en onerror ville blive kaldt ad.
+	await page.waitForTimeout(800);
+
+	expect(await page.evaluate(() => window.__pwned)).toBeUndefined();
+	// Og hændelsen står som tekst i alt-attributten, hvor den hører hjemme.
+	const alt = await ed.locator('img').getAttribute('alt');
+	expect(alt).toContain('onerror');
+	expect(await ed.locator('img').evaluate((el) => el.hasAttribute('onerror'))).toBe(false);
+
+	// Billedets egen 404 hører til prøven: adressen peger med vilje på et bilag,
+	// der ikke findes, fordi det er den vej en onerror ville blive kaldt ad. Alt
+	// andet skal stadig være stille.
+	expect(trouble.filter((t) => !t.includes('/api/v1/attachments/'))).toEqual([]);
+});

web/src/app.css

@@ -363,7 +363,10 @@ button {
 :focus-visible {
 	outline: 2px solid var(--accent);
 	outline-offset: 2px;
-	border-radius: var(--radius-sm);
+	/* Ingen radius her. En omrids følger elementets egen afrunding af sig selv, og
+	   at tvinge en anden på tegner en firkantet bue uden om en rund kant — to
+	   streger, hvor der skulle være én. Det ses tydeligst om et pilleformet
+	   søgefelt. */
 }
 
 ::selection {

web/src/lib/api.js

@@ -227,6 +227,9 @@ export const api = {
 	gmailClient: () => get('/gmail/client'),
 	setGmailClient: (data) => put('/gmail/client', data),
 
+	beacon: () => get('/beacon/settings'),
+	setBeacon: (body) => put('/beacon/settings', body),
+
 	listBackups: () => get('/backups'),
 	runBackup: () => post('/backups'),
 	// A link rather than a fetch: the browser's own download handles a file of
@@ -391,6 +394,10 @@ export const api = {
 	importTodoist: (file) => upload('/import/todoist', file),
 	importCSV: (data) => post('/import/csv', data),
 	exportAccountURL: () => '/api/v1/export/account',
+	exportNotesURL: () => '/api/v1/export/notes.zip',
+	// Through `upload`, not `request`: a multipart body has to set its own boundary,
+	// and the browser only does that when nothing has claimed the header.
+	importNotes: (file) => upload('/notes/import', file),
 	exportProjectCSVURL: (id) => `/api/v1/export/projects/${id}.csv`,
 	exportProjectICSURL: (id) => `/api/v1/export/projects/${id}.ics`,
 

web/src/lib/components/CommandPalette.svelte

@@ -9,6 +9,7 @@
 	let query = $state('');
 	let tasks = $state([]);
 	let projects = $state([]);
+	let notes = $state([]);
 	let selected = $state(0);
 	let input;
 	let controller = null;
@@ -32,13 +33,21 @@
 		if (!value) {
 			tasks = [];
 			projects = [];
+			notes = [];
 			return;
 		}
 		timer = setTimeout(async () => {
 			try {
-				const result = await api.search(value);
+				// Noter er sit eget endepunkt, så de hentes ved siden af. Uden dem
+				// søger ⌘K kun i halvdelen af programmet, hvilket er svært at gætte
+				// som bruger: feltet ser ud til at kunne finde alt.
+				const [result, found] = await Promise.all([
+					api.search(value),
+					api.notes({ q: value }).catch(() => ({ notes: [] }))
+				]);
 				tasks = result.tasks ?? [];
 				projects = result.projects ?? [];
+				notes = found.notes ?? [];
 				selected = 0;
 			} catch {
 				// A failed search shows nothing rather than an error inside a
@@ -49,6 +58,7 @@
 
 	let results = $derived([
 		...projects.map((p) => ({ kind: 'project', id: p.id, label: p.name })),
+		...notes.map((n) => ({ kind: 'note', id: n.id, label: n.title || n.body.slice(0, 60) })),
 		...tasks.map((t) => ({
 			kind: 'task',
 			id: t.id,
@@ -60,6 +70,7 @@
 
 	function choose(item) {
 		open = false;
+		if (item.kind === 'note') return goto(`/noter?note=${item.id}`);
 		goto(item.kind === 'project' ? `/projekt/${item.id}` : `/projekt/${item.project}`);
 	}
 
@@ -109,7 +120,7 @@
 								onclick={() => choose(item)}
 								onmouseenter={() => (selected = i)}
 							>
-								<span class="kind">{item.kind === 'project' ? 'Projekt' : 'Opgave'}</span>
+								<span class="kind">{t('palette.' + item.kind)}</span>
 								<span class="label">{item.label}</span>
 							</button>
 						</li>

web/src/lib/components/NoteEditor.svelte

@@ -14,11 +14,16 @@
 	 * is the file to change.
 	 */
 	import { markdownToHtml, htmlToMarkdown } from '$lib/richtext.js';
+	import { highlight, guessLanguage } from '$lib/highlight.js';
 	import { t } from '$lib/i18n.svelte.js';
+	import { app } from '$lib/stores.svelte.js';
+	import { colorVar } from '$lib/colors.js';
 
 	let { note, onchange, onsave } = $props();
 
 	let editor;
+	// Forslagslisten, så tastaturvalget kan rulle den frem.
+	let list;
 	let stylesOpen = $state(false);
 	// Which marks are on where the caret is, so the toolbar shows state rather than
 	// only offering actions.
@@ -38,8 +43,20 @@
 		editor.innerHTML = note.body.trim() ? markdownToHtml(note.body) : '<h1><br></h1>';
 		loadedId = note.id;
 		active = {};
+		// Kildevisningen hører til den note, den blev slået til på. Skifter man note,
+		// er det den rige flade, man skal møde — ellers står den næste note som kode,
+		// uden at nogen har bedt om det.
+		asSource = false;
+		colourCode();
 	});
 
+	const SYNTAX = [
+		{ mark: '#', what: 'notes.syntaxProject' },
+		{ mark: '[[', what: 'notes.syntaxNote' },
+		{ mark: '⌘B', what: 'notes.bold' },
+		{ mark: '⌘U', what: 'notes.underline' }
+	];
+
 	const STYLES = [
 		{ key: 'title', tag: 'h1', label: 'notes.styleTitle' },
 		{ key: 'heading', tag: 'h2', label: 'notes.styleHeading' },
@@ -93,9 +110,192 @@
 		}
 	}
 
+	/**
+	 * Farver kodeblokkene.
+	 *
+	 * Kun dem, markøren ikke står i. At farve blokken, mens nogen skriver i den,
+	 * betyder at bygge dens indhold om ved hvert tastetryk og sætte markøren
+	 * tilbage bagefter — det er den slags, der virker i ni tilfælde ud af ti og
+	 * flytter markøren midt i en sætning i det tiende. Blokken er mørk og
+	 * monospace hele tiden; farverne kommer, når man forlader den, hvilket er når
+	 * man læser den.
+	 */
+	function colourCode() {
+		if (!editor) return;
+		const inside = currentBlock();
+		for (const pre of editor.querySelectorAll('pre')) {
+			if (pre === inside || pre.contains(inside)) continue;
+			const code = pre.textContent ?? '';
+			const lang = pre.getAttribute('data-lang') || guessLanguage(code);
+			if (lang) pre.setAttribute('data-lang', lang);
+			const painted = highlight(code, lang);
+			// Kun hvis der er noget at ændre: at skrive innerHTML uændret ville
+			// stadig rive noden op og lægge den tilbage, og det ses som et blink.
+			const target = pre.querySelector('code') ?? pre;
+			if (target.innerHTML !== painted) target.innerHTML = painted;
+		}
+	}
+
 	function changed() {
 		if (!editor) return;
 		onchange?.(htmlToMarkdown(editor));
+		readSuggestions();
+	}
+
+	// --- kilden ----------------------------------------------------------------------
+
+	/**
+	 * Noten som den Markdown, den er.
+	 *
+	 * Fladen er rig tekst, fordi det er den, folk kan. Men filen under er Markdown,
+	 * og der er to ting, den rige flade ikke kan: tage imod Markdown, nogen har
+	 * skrevet et andet sted — indsat i den rige flade er `## Overskrift` fem tegn og
+	 * ikke en overskrift — og vise, hvad der faktisk bliver gemt. Begge dele er det
+	 * samme svar: lad folk se kilden.
+	 *
+	 * Ikke en tredje tilstand at holde styr på: teksten går gennem de samme to
+	 * funktioner som altid, kun den anden vej. Det, man ser i kildefeltet, er ord for
+	 * ord det, der ligger i databasen.
+	 */
+	let asSource = $state(false);
+	let source = $state('');
+
+	function toggleSource() {
+		if (!asSource) {
+			source = htmlToMarkdown(editor);
+			asSource = true;
+			return;
+		}
+		asSource = false;
+		onchange?.(source);
+		// Fyldt fra kilden, ikke fra `note.body`.
+		//
+		// Noten i lageret er den sidst gemte, og gemningen venter på sin pause — så
+		// den vej ville kaste det, der lige er skrevet i kildefeltet, væk. `loadedId`
+		// røres ikke: $effect ser stadig en note, den har indlæst, og skriver ikke
+		// hen over det her.
+		queueMicrotask(() => {
+			if (!editor) return;
+			editor.innerHTML = source.trim() ? markdownToHtml(source) : '<h1><br></h1>';
+			colourCode();
+		});
+	}
+
+	/** Kilden skrives direkte igennem: det er filen, man redigerer. */
+	function sourceChanged(event) {
+		source = event.currentTarget.value;
+		onchange?.(source);
+	}
+
+	// --- suggesting a project ------------------------------------------------------
+
+	let suggestions = $state([]);
+	let chosen = $state(0);
+	// Hvor forslagslisten skal stå, og wrappen den måles imod.
+	let menuAt = $state(null);
+	let wrap;
+
+	/**
+	 * The word being typed after a #, if that is what is happening.
+	 *
+	 * Read from the text node the caret is in rather than from the whole document:
+	 * a note can mention twenty projects, and only the one under the cursor is being
+	 * written.
+	 */
+	function partialTag() {
+		const selection = window.getSelection();
+		const node = selection?.anchorNode;
+		if (!node || node.nodeType !== Node.TEXT_NODE || !selection.isCollapsed) return null;
+
+		const before = node.textContent.slice(0, selection.anchorOffset);
+		const match = /(?:^|\s)#([\p{L}\p{N}_-]*)$/u.exec(before);
+		if (!match) return null;
+		return { node, start: selection.anchorOffset - match[1].length, term: match[1] };
+	}
+
+	/**
+	 * Hvor `#` står, målt i wrappens koordinater.
+	 *
+	 * Målt på selve tegnet og ikke på markøren: et sammenfaldet område har ingen
+	 * kasse på en tom linje, mens `#term` altid har en, fordi der står noget i den.
+	 *
+	 * Klemt inden for ruden, så en note skrevet helt ude i højre side ikke sender
+	 * menuen ud over kanten, og vendt op over linjen, når der ikke er plads under.
+	 */
+	function tagPosition(partial) {
+		if (!wrap) return null;
+		const range = document.createRange();
+		range.setStart(partial.node, Math.max(0, partial.start - 1));
+		range.setEnd(partial.node, partial.start + partial.term.length);
+		const at = range.getBoundingClientRect();
+		const box = wrap.getBoundingClientRect();
+		if (!at.width && !at.height) return null;
+
+		const MENU = { w: 210, h: 240 };
+		const below = at.bottom - box.top + 6;
+		const flip = at.bottom + MENU.h > box.bottom && at.top - box.top > MENU.h;
+		return {
+			top: flip ? at.top - box.top - MENU.h - 6 : below,
+			left: Math.max(0, Math.min(at.left - box.left, box.width - MENU.w))
+		};
+	}
+
+	function readSuggestions() {
+		const partial = partialTag();
+		if (!partial) {
+			suggestions = [];
+			return;
+		}
+		const term = partial.term.toLowerCase();
+
+		// Målt når menuen åbner, ikke ved hvert tastetryk. Den skal stå ved det `#`,
+		// man skriver — den stod før øverst i ruden, hvilket i en lang note er et
+		// helt andet sted end det, øjet er — men den må heller ikke rykke sig et par
+		// pixels for hvert bogstav, mens listen snævres ind.
+		if (!suggestions.length) menuAt = tagPosition(partial);
+
+		// Alle der passer, ikke de seks første.
+		//
+		// Loftet på seks var sat, dengang listen ikke kunne rulle, og det gjorde
+		// noget værre end at skjule: med tyve projekter og et blot tastet `#` viste
+		// den seks vilkårlige og så færdig ud. Man kunne ikke se, at der manglede
+		// noget — kun at ens eget projekt ikke var der.
+		//
+		// Rækkefølgen bærer nu det, loftet gjorde forkert: det, der begynder med
+		// det tastede, står øverst, resten alfabetisk. Skriver man "ga", er
+		// GarageRisteriet den første, ikke den, der tilfældigvis lå først.
+		const matches = app.projects.filter(
+			(p) => !p.is_inbox && p.name.toLowerCase().includes(term)
+		);
+		matches.sort((a, b) => {
+			const an = a.name.toLowerCase();
+			const bn = b.name.toLowerCase();
+			const ap = an.startsWith(term);
+			const bp = bn.startsWith(term);
+			if (ap !== bp) return ap ? -1 : 1;
+			return an.localeCompare(bn, 'da');
+		});
+		suggestions = matches;
+		chosen = 0;
+	}
+
+	/** Replaces the half-typed tag with the whole name. */
+	function accept(project) {
+		const partial = partialTag();
+		if (!partial) return;
+
+		const range = document.createRange();
+		range.setStart(partial.node, partial.start);
+		range.setEnd(partial.node, partial.start + partial.term.length);
+		const selection = window.getSelection();
+		selection.removeAllRanges();
+		selection.addRange(range);
+
+		// A trailing space, because the next thing typed is a word and not more of
+		// the tag — and without it the suggestions come straight back.
+		document.execCommand('insertText', false, project.name + ' ');
+		suggestions = [];
+		onchange?.(htmlToMarkdown(editor));
 	}
 
 	/** The block the caret is standing in. */
@@ -134,7 +334,47 @@
 		}
 	}
 
+	/**
+	 * Ruller det valgte forslag frem, når listen er længere end sin egen kasse.
+	 *
+	 * Efter opdateringen, ikke før: `chosen` er netop sat, og rækken bærer klassen
+	 * først når Svelte har skrevet den ud. Uden ventetiden ruller den til den
+	 * forrige.
+	 */
+	function keepChosenInView() {
+		requestAnimationFrame(() => {
+			list?.querySelector('button.on')?.scrollIntoView({ block: 'nearest' });
+		});
+	}
+
 	function onkeydown(event) {
+		// The suggestion list owns the arrows and return while it is open, the way
+		// every other completion does. Escape closes it without choosing.
+		if (suggestions.length) {
+			if (event.key === 'ArrowDown') {
+				event.preventDefault();
+				chosen = (chosen + 1) % suggestions.length;
+				keepChosenInView();
+				return;
+			}
+			if (event.key === 'ArrowUp') {
+				event.preventDefault();
+				chosen = (chosen - 1 + suggestions.length) % suggestions.length;
+				keepChosenInView();
+				return;
+			}
+			if (event.key === 'Enter' || event.key === 'Tab') {
+				event.preventDefault();
+				accept(suggestions[chosen]);
+				return;
+			}
+			if (event.key === 'Escape') {
+				event.preventDefault();
+				suggestions = [];
+				return;
+			}
+		}
+
 		if (event.key === 'Enter' && !event.shiftKey) {
 			// After the split, not before it.
 			setTimeout(() => {
@@ -167,7 +407,7 @@
 	}
 </script>
 
-<div class="wrap">
+<div class="wrap" bind:this={wrap}>
 	<!-- Nothing in here may take focus. A click that moves focus out of the editor
 	     collapses the selection first, so the format lands on nothing — the button
 	     appears to do nothing at all, which is how it read the first time. -->
@@ -218,11 +458,37 @@
 		<button class:on={active.strike} onclick={() => apply('strikeThrough')} aria-label={t('notes.strike')}>
 			<s>S</s>
 		</button>
+
+		<span class="sep" aria-hidden="true"></span>
+
+		<!-- Kilden. Til højre for de andre, fordi den ikke er et format men en
+		     anden måde at se det hele på. -->
+		<button
+			class="src"
+			class:on={asSource}
+			onclick={toggleSource}
+			aria-pressed={asSource}
+			aria-label={t('notes.showSource')}
+			title={t('notes.showSource')}>&lt;/&gt;</button
+		>
 	</div>
 
+	{#if asSource}
+		<!-- Et almindeligt tekstfelt, fordi det er almindelig tekst. Ingen
+		     contenteditable, ingen execCommand: her er der intet at formatere. -->
+		<textarea
+			class="page source"
+			aria-label={t('notes.source')}
+			spellcheck="false"
+			value={source}
+			oninput={sourceChanged}
+			onblur={() => onsave?.()}
+		></textarea>
+	{/if}
 	<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
 	<div
 		class="page"
+		class:hidden={asSource}
 		bind:this={editor}
 		contenteditable="true"
 		role="textbox"
@@ -230,12 +496,58 @@
 		aria-label={t('notes.body')}
 		spellcheck="true"
 		oninput={changed}
-		onblur={onsave}
-		onkeyup={readState}
+		onblur={() => {
+			colourCode();
+			onsave?.();
+		}}
+		onkeyup={() => {
+			readState();
+			readSuggestions();
+		}}
+		onclick={colourCode}
 		onmouseup={readState}
 		{onkeydown}
 		{onpaste}
 	></div>
+
+	{#if suggestions.length}
+		<!-- Ved det `#`, der bliver skrevet. Målt én gang, da menuen åbnede, så den
+		     står stille, mens listen snævres ind. -->
+		<ul
+			class="suggestions"
+			role="listbox"
+			bind:this={list}
+			style:top={menuAt ? `${menuAt.top}px` : null}
+			style:left={menuAt ? `${menuAt.left}px` : null}
+		>
+			{#each suggestions as project, i (project.id)}
+				<li>
+					<button
+						class:on={i === chosen}
+						role="option"
+						aria-selected={i === chosen}
+						onmousedown={(e) => {
+							e.preventDefault();
+							accept(project);
+						}}
+					>
+						<span class="dot" style="background: {colorVar(project.color)}" aria-hidden="true"
+						></span>
+						#{project.name}
+					</button>
+				</li>
+			{/each}
+		</ul>
+	{/if}
+
+	<!-- What the text understands, said where it is being typed. The same idea as
+	     the line under the quick-add box: a note is the other place in this program
+	     where what you type is read for meaning. -->
+	<p class="legend">
+		{#each SYNTAX as item}
+			<span><kbd>{item.mark}</kbd> {t(item.what)}</span>
+		{/each}
+	</p>
 </div>
 
 <style>
@@ -345,13 +657,103 @@
 		color: var(--ink-muted);
 	}
 
+	.suggestions {
+		position: absolute;
+		z-index: 30;
+		list-style: none;
+		margin: 0;
+		padding: var(--s1);
+		min-width: 200px;
+		background: var(--surface-raised);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+		box-shadow: 0 8px 24px rgb(0 0 0 / 0.25);
+		/* Nu hvor alle der passer står på listen, skal den kunne rulle. Otte rækker
+		   er nok til at det ses, at der er flere, uden at menuen dækker noten. */
+		max-height: 15rem;
+		overflow-y: auto;
+	}
+
+	.suggestions button {
+		display: flex;
+		align-items: center;
+		gap: var(--s2);
+		width: 100%;
+		text-align: left;
+		padding: var(--s1) var(--s2);
+		border-radius: var(--radius-sm);
+		color: var(--ink-muted);
+		font-size: var(--text-sm);
+	}
+
+	.suggestions button.on {
+		background: var(--surface);
+		color: var(--ink);
+	}
+
+	.legend {
+		display: flex;
+		flex-wrap: wrap;
+		gap: var(--s1) var(--s3);
+		padding-top: var(--s2);
+		font-size: var(--text-xs);
+		color: var(--ink-faint);
+	}
+
+	.legend kbd {
+		font-family: var(--mono, ui-monospace, monospace);
+		color: var(--ink-muted);
+	}
+
+	.wrap {
+		position: relative;
+	}
+
 	.page {
+		/* Et token eller en URL er ét ord, der er bredere end skærmen. Uden det her
+		   får siden en vandret rullebjælke, og teksten forsvinder ud til højre. */
+		overflow-wrap: anywhere;
 		flex: 1;
 		min-height: 50vh;
 		padding: var(--s3) 0;
 		outline: none;
 		line-height: 1.55;
 		overflow-y: auto;
+
+		/* Linjelængden har en grænse, som skærmen ikke har.
+		 *
+		 * En note i fuld bredde på en stor skærm er linjer på hundrede og fyrre tegn,
+		 * og øjet mister hvilken linje det var på, når det springer tilbage. Alle,
+		 * der laver noget, man læser i, sætter det her — Apple Noter, Bear, Notion —
+		 * og de sætter det omkring det samme sted.
+		 *
+		 * Kun teksten, ikke arket: værktøjslinjen og foden hører til ruden og skal
+		 * blive i den. */
+		max-width: 46rem;
+		width: 100%;
+	}
+
+	.hidden {
+		display: none;
+	}
+
+	/* Kildeteksten. Monospace, fordi det er en fil — og fordi indrykningen i en
+	   liste er indhold her og ikke pynt: den skal kunne tælles. */
+	.source {
+		font-family: var(--font-mono);
+		font-size: var(--text-sm);
+		line-height: 1.6;
+		tab-size: 2;
+		white-space: pre-wrap;
+		border: 0;
+		background: none;
+		color: var(--ink);
+		resize: none;
+	}
+
+	.src {
+		font-family: var(--font-mono);
+		font-size: var(--text-xs);
 	}
 
 	/* The document styles. These are the whole of "it should look like Apple Notes":
@@ -380,16 +782,39 @@
 		margin: 0 0 var(--s2);
 	}
 
+	/* Renden skal kunne rumme det bredeste mærke.
+	 *
+	 * Mærket sættes uden for tekstkanten, inde i listens egen indrykning, og en fast
+	 * indrykning på 16px rakte til et punkttegn og ikke til "10." — resten hang ud
+	 * over kanten, hvor `.page`, som ruller lodret og derfor beskærer vandret,
+	 * klippede det af. Man så et punktum uden sit tal.
+	 *
+	 * Samme rende til begge slags, frem for en bredere til den nummererede: mærket
+	 * lægger sig op ad teksten uanset hvor bred renden er, så deler de den, flugter
+	 * punkter og tal — og gør de ikke, står to lister under hinanden med hver sin
+	 * venstrekant.
+	 *
+	 * Målt i em, så den følger skriftstørrelsen, og bred nok til tre cifre. */
 	.page :global(ul),
 	.page :global(ol) {
 		margin: 0 0 var(--s2);
-		padding-left: var(--s4);
+		padding-left: 2.2em;
 	}
 
 	.page :global(li) {
 		margin-bottom: var(--s1);
 	}
 
+	/* Et billede fylder sin egen bredde og ikke mere. Et foto fra en telefon er
+	   fire tusind pixels bredt, og uden det her stikker det ud af arket. */
+	.page :global(img) {
+		max-width: 100%;
+		height: auto;
+		border-radius: var(--radius-sm);
+		display: block;
+		margin: var(--s2) 0;
+	}
+
 	.page :global(blockquote) {
 		margin: 0 0 var(--s2);
 		padding-left: var(--s3);
@@ -397,10 +822,84 @@
 		color: var(--ink-muted);
 	}
 
+	/* En kodeblok ser ud som en terminal, fordi det er hvad den er.
+	   Monospace er altid kode i praksis — Apple Noters "Monotype" er stort set kun
+	   brugt til kommandoer og udskrifter — og en mørk flade siger det på afstand,
+	   uden at man skal læse et ord. Farverne er de samme i lys og mørk tilstand:
+	   en terminal er sort, også midt på dagen. */
 	.page :global(pre) {
-		margin: 0 0 var(--s2);
+		margin: 0 0 var(--s3);
+		padding: var(--s3);
+		border-radius: var(--radius);
+		background: #14181b;
+		color: #d7dde3;
 		font-family: var(--mono, ui-monospace, monospace);
+		font-size: 0.8125rem;
+		line-height: 1.5;
 		white-space: pre-wrap;
+		overflow-wrap: anywhere;
+		position: relative;
+	}
+
+	/* Sproget i hjørnet, når blokken siger hvad den er. */
+	.page :global(pre[data-lang]:not([data-lang=''])::after) {
+		content: attr(data-lang);
+		position: absolute;
+		top: 4px;
+		right: 8px;
+		font-size: 0.625rem;
+		letter-spacing: 0.06em;
+		text-transform: uppercase;
+		color: #5a656e;
+	}
+
+	.page :global(pre code) {
+		font: inherit;
+		color: inherit;
+	}
+
+	.page :global(.tok-comment) {
+		color: #6b7a85;
+		font-style: italic;
+	}
+
+	.page :global(.tok-string) {
+		color: #9ecb8a;
+	}
+
+	.page :global(.tok-number) {
+		color: #d9a25f;
+	}
+
+	.page :global(.tok-keyword) {
+		color: #7fb3e8;
+	}
+
+	.page :global(.tok-key) {
+		color: #7fb3e8;
+	}
+
+	.page :global(.tok-bool) {
+		color: #c48fd6;
+	}
+
+	.page :global(.tok-variable) {
+		color: #d9a25f;
+	}
+
+	.page :global(.tok-flag) {
+		color: #c48fd6;
+	}
+
+	.page :global(.tok-punct) {
+		color: #8a949c;
+	}
+
+	/* Prompten i en terminaludskrift: det første øjet finder, når man leder efter
+	   hvor en kommando begynder. */
+	.page :global(.tok-prompt) {
+		color: #6fbf8f;
+		font-weight: 600;
 	}
 
 	.page :global(code) {

web/src/lib/components/Sidebar.svelte

@@ -1,7 +1,7 @@
 <script>
 	import { app, sidebar, projectName } from '$lib/stores.svelte.js';
 	import { api } from '$lib/api.js';
-	import { TASK, PROJECT, GROUP, startDrag, carries, dragged, accept } from '$lib/dnd.js';
+	import { TASK, PROJECT, GROUP, NOTE, startDrag, carries, dragged, accept } from '$lib/dnd.js';
 	import { COLORS, colorVar } from '$lib/colors.js';
 	import { focusOnMount } from '$lib/focus.js';
 	import { t } from '$lib/i18n.svelte.js';
@@ -131,7 +131,21 @@
 				: null,
 			// No href: the inbox is a project and is drawn by projectRow, which knows
 			// its id. It is in this list only so it can be dragged with the others.
-			{ key: 'inbox', label: 'nav.inbox' }
+			{ key: 'inbox', label: 'nav.inbox' },
+			// Noter hører til her, og bærer et ark frem for en prik.
+			//
+			// Den stod før for sig selv over en streg, hvilket sagde det rigtige og
+			// kostede halvfjerds pixels: en streg, luft over og luft under, og
+			// projekterne skubbet så langt ned, at de to første var alt, man så uden
+			// at rulle. Grunden til at skille den ud var, at den ellers læste som
+			// endnu et filter — men det, der gør den til et filter for øjet, er
+			// prikken, ikke pladsen. Et andet mærke siger "en anden slags ting" og
+			// koster ingenting.
+			//
+			// Sidst i rækken, fordi `navOrder` føjer en ukendt nøgle til bagest: står
+			// den et andet sted her, ser en ny konto én rækkefølge og alle
+			// eksisterende en anden.
+			{ key: 'notes', href: '/noter', label: 'notes.title' }
 		].filter(Boolean)
 	);
 
@@ -335,16 +349,27 @@
 	const canReceive = (project) => project.role === 'owner' || project.role === 'editor';
 
 	function onTaskDragOver(event, project) {
-		if (!carries(event, TASK) || !canReceive(project)) return;
+		if (!(carries(event, TASK) || carries(event, NOTE)) || !canReceive(project)) return;
 		accept(event);
 		overProject = project.id;
 	}
 
 	async function onTaskDrop(event, project) {
 		event.preventDefault();
-		const id = dragged(event, TASK);
 		overProject = null;
-		if (!id || !canReceive(project)) return;
+		if (!canReceive(project)) return;
+
+		// The same target takes both. A note dropped on a project is filed there,
+		// which is also how it gets shared — one gesture, one meaning, and the
+		// sidebar already reads as "put this here".
+		const noteID = dragged(event, NOTE);
+		if (noteID) {
+			await app.moveNoteToProject(noteID, project.id);
+			return;
+		}
+
+		const id = dragged(event, TASK);
+		if (!id) return;
 		await app.moveToProject(id, project.id);
 	}
 
@@ -452,7 +477,20 @@
 						ondragleave={() => (overToday = false)}
 						ondrop={(e) => item.key === 'today' && onDropOnToday(e)}
 					>
-						<span class="dot" class:today={item.key === 'today'} aria-hidden="true"></span>
+						{#if item.key === 'notes'}
+							<svg class="mark" viewBox="0 0 16 16" aria-hidden="true">
+								<path
+									d="M4 1.5h5.2L12.5 5v9.5H4z"
+									fill="none"
+									stroke="currentColor"
+									stroke-width="1.4"
+									stroke-linejoin="round"
+								/>
+								<path d="M9 1.7V5h3.3" fill="none" stroke="currentColor" stroke-width="1.4" />
+							</svg>
+						{:else}
+							<span class="dot" class:today={item.key === 'today'} aria-hidden="true"></span>
+						{/if}
 						{t(item.label)}
 					</a>
 				</div>
@@ -460,17 +498,6 @@
 		{/each}
 	</div>
 
-	<!-- Notes stand apart, with a rule above them.
-	     They are not a fourth way of looking at the same tasks, which is what
-	     everything above is; they are the other half of the program. Sitting in that
-	     run made them read as one more filter. -->
-	<div class="apart">
-		<a href="/noter" class:active={current === '/noter'} onclick={onnavigate}>
-			<span class="dot" aria-hidden="true"></span>
-			{t('notes.title')}
-		</a>
-	</div>
-
 	<!-- One row for every project the sidebar shows — your own, the Inbox and the
 	     shared ones — because all three are somewhere a task can be dropped, and
 	     three copies of that would be three chances to fix a bug in two of them.
@@ -481,14 +508,22 @@
 	     sidebar is already a drop target for tasks — a task dragged onto I dag
 	     stopped landing, because the row had claimed the gesture. A grip claims
 	     nothing until it is grabbed. -->
+	<!-- Håndtaget har ingen prik i sig længere.
+	     ⠿ sad i den to pixels brede rende til venstre for teksten og lå oven i
+	     rækkens egen kant — idéen var rigtig, pladsen var det ikke. Men elementet
+	     bliver: det er dét, der ejer trækket, og gjorde man i stedet hele rækken
+	     draggable, ville alt indeni også blive det — og en opgave trukket hen på
+	     I dag holdt op med at lande, fordi rækken havde taget gesten. Nu er
+	     håndtaget usynligt og lidt bredere, og hånden, der kommer ved hover,
+	     er hele forklaringen. -->
 	{#snippet grip(key)}
 		<span
 			class="grip"
 			draggable="true"
 			ondragstart={(e) => onNavDragStart(e, key)}
 			ondragend={clearNavDrag}
-			aria-hidden="true">⠿</span
-		>
+			aria-hidden="true"
+		></span>
 	{/snippet}
 
 	{#snippet projectRow(project, sortable)}
@@ -977,19 +1012,15 @@
 	   so nothing moves when it appears. */
 	.grip {
 		position: absolute;
-		left: -2px;
-		width: 12px;
-		text-align: center;
-		font-size: 10px;
-		line-height: 1;
-		color: var(--ink-faint);
+		left: 0;
+		top: 0;
+		bottom: 0;
+		width: 14px;
 		cursor: grab;
-		opacity: 0;
-		transition: opacity var(--fast) var(--ease);
 	}
 
-	.navrow:hover .grip {
-		opacity: 1;
+	.grip:active {
+		cursor: grabbing;
 	}
 
 	.navrow > :global(a) {
@@ -1014,15 +1045,20 @@
 		border-radius: 1px;
 	}
 
-	/* A rule and a little air, which is the whole of "separate". Notes are the other
-	   half of the program, not a fifth way of looking at the same tasks. */
-	.apart {
-		display: flex;
-		flex-direction: column;
-		gap: 1px;
-		margin: var(--s3) 0;
-		padding-top: var(--s3);
-		border-top: 1px solid var(--line);
+	/* Arket. Samme plads som prikken, så teksten står på linje med resten af runden
+	   — mærket skifter, kolonnen gør ikke. */
+	.mark {
+		width: 13px;
+		height: 13px;
+		/* Prikken er 6px bred, og et 13px mærke ville skubbe etiketten tre pixels ud
+		   af flugt med de andre. Negativ margen på hver side lægger det tilbage. */
+		margin: 0 -3.5px;
+		color: var(--ink-faint);
+		flex: none;
+	}
+
+	a.active .mark {
+		color: var(--accent);
 	}
 
 	.group-head {

web/src/lib/components/TaskDetail.svelte

@@ -43,6 +43,7 @@
 	let subtasks = $state([]);
 	let comments = $state([]);
 	let attachments = $state([]);
+	let notes = $state([]);
 	let reminders = $state([]);
 
 	let newSubtask = $state('');
@@ -80,6 +81,7 @@
 		subtasks = [];
 		comments = [];
 		attachments = [];
+		notes = [];
 		reminders = [];
 
 		const id = task.id;
@@ -96,6 +98,11 @@
 		api.listReminders(id)
 			.then((r) => id === seededId && (reminders = r.reminders))
 			.catch(() => {});
+		// Quietly, because a task with no notes is the ordinary case and a failure
+		// here must not put an error in front of somebody reading a task.
+		api.notesLinking('task', id)
+			.then((r) => id === seededId && (notes = r.notes ?? []))
+			.catch(() => {});
 	});
 
 	/**
@@ -540,6 +547,22 @@
 			</form>
 		</section>
 
+		<!-- What has been written about this task.
+		     The other direction of the same link: a note that mentions a task shows
+		     it, and this is the task showing the note. Without it the connection only
+		     works if you happen to be reading the note — which is the half nobody
+		     needs help with. -->
+		{#if notes.length}
+			<section class="linked-notes">
+				<h3>{t('notes.title')}</h3>
+				{#each notes as note (note.id)}
+					<a class="linked-note" href="/noter?note={note.id}">
+						<strong>{note.title || t('notes.untitled')}</strong>
+					</a>
+				{/each}
+			</section>
+		{/if}
+
 		<section>
 			<h3>{t('detail.comments')}</h3>
 
@@ -582,6 +605,24 @@
 </aside>
 
 <style>
+	.linked-note {
+		display: block;
+		padding: var(--s2);
+		border-radius: var(--radius);
+		color: var(--ink-muted);
+		text-decoration: none;
+	}
+
+	.linked-note:hover {
+		background: var(--surface);
+		color: var(--ink);
+	}
+
+	.linked-note strong {
+		font-size: var(--text-sm);
+		font-weight: 560;
+	}
+
 	.scrim {
 		position: fixed;
 		inset: 0;

web/src/lib/dnd.js

@@ -17,6 +17,7 @@
 export const TASK = 'application/x-verdande-task';
 export const PROJECT = 'application/x-verdande-project';
 export const GROUP = 'application/x-verdande-group';
+export const NOTE = 'application/x-verdande-note';
 
 /** Starts a drag carrying one id of the given kind. */
 export function startDrag(event, type, id) {

web/src/lib/highlight.js

@@ -0,0 +1,118 @@
+/**
+ * Farver til en kodeblok.
+ *
+ * Ikke et bibliotek: et fuldt syntaksbibliotek er hundredvis af kilobytes for at
+ * gøre nogle ord blå i en note. Det her er et lille sæt regler pr. sprog, der
+ * rammer det, øjet leder efter — strenge, tal, kommentarer, nøgleord — og som er
+ * ligeglad med resten. En farve for lidt er ingenting; en forkert er heller ikke
+ * meget, når teksten stadig står der, som den blev skrevet.
+ *
+ * Reglerne prøves i rækkefølge, og den første, der rammer, vinder. Strenge og
+ * kommentarer står derfor først: et nøgleord inde i en streng er ikke et nøgleord.
+ */
+
+const COMMON = {
+	string: /^("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`)/,
+	number: /^\b\d+(\.\d+)?\b/
+};
+
+const LANGUAGES = {
+	yaml: [
+		['comment', /^#[^\n]*/],
+		['string', COMMON.string],
+		// Nøglen, som er det, man scanner efter i en YAML-fil.
+		['key', /^[ \t]*[-\w.]+(?=\s*:)/],
+		['punct', /^[:\-|>]/],
+		['number', COMMON.number],
+		['bool', /^\b(true|false|null|yes|no|on|off)\b/i]
+	],
+	json: [
+		['string', COMMON.string],
+		['punct', /^[{}[\],:]/],
+		['number', COMMON.number],
+		['bool', /^\b(true|false|null)\b/]
+	],
+	bash: [
+		['comment', /^#[^\n]*/],
+		['string', COMMON.string],
+		// Prompten er ikke kode, men den er det første øjet finder i en udskrift.
+		['prompt', /^\S+@\S+:[^$#]*[$#]/],
+		['variable', /^\$\{?\w+\}?/],
+		['keyword', /^\b(if|then|else|fi|for|in|do|done|while|case|esac|function|return|export|local|sudo)\b/],
+		['flag', /^\s-{1,2}[\w-]+/],
+		['number', COMMON.number]
+	],
+	go: [
+		['comment', /^\/\/[^\n]*/],
+		['string', COMMON.string],
+		['keyword', /^\b(func|package|import|var|const|type|struct|interface|if|else|for|range|return|defer|go|chan|select|switch|case|default|map|nil|true|false)\b/],
+		['number', COMMON.number]
+	],
+	js: [
+		['comment', /^\/\/[^\n]*/],
+		['string', COMMON.string],
+		['keyword', /^\b(const|let|var|function|return|if|else|for|while|import|export|from|class|new|await|async|try|catch|throw|typeof|null|undefined|true|false)\b/],
+		['number', COMMON.number]
+	],
+	sql: [
+		['comment', /^--[^\n]*/],
+		['string', COMMON.string],
+		['keyword', /^\b(select|from|where|insert|into|values|update|set|delete|create|table|index|join|left|inner|on|and|or|not|null|primary|key|references|order|by|group|limit)\b/i],
+		['number', COMMON.number]
+	]
+};
+
+// Det, folk skriver, mod det, filen hedder.
+const ALIASES = {
+	sh: 'bash', shell: 'bash', zsh: 'bash', console: 'bash', terminal: 'bash',
+	yml: 'yaml', javascript: 'js', ts: 'js', typescript: 'js', golang: 'go'
+};
+
+const escape = (s) =>
+	s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+
+/**
+ * Gætter sproget, når blokken ikke siger det.
+ *
+ * Med vilje forsigtigt: at gætte forkert farver de forkerte ord, og en
+ * terminaludskrift uden farver er stadig læselig. Kun mønstre, der er svære at
+ * forveksle, tæller med.
+ */
+export function guessLanguage(code) {
+	if (/^\s*[{[]/.test(code) && /["}\]]\s*$/.test(code.trim())) return 'json';
+	if (/^\s*\S+@\S+:.*[$#]/m.test(code)) return 'bash';
+	if (/^\s*(package|func)\s+\w/m.test(code)) return 'go';
+	if (/^\s*[-\w.]+:\s*(\S|$)/m.test(code) && !/[;{}]/.test(code)) return 'yaml';
+	if (/^\s*(SELECT|INSERT|UPDATE|CREATE TABLE)\b/im.test(code)) return 'sql';
+	return '';
+}
+
+/** Kode til HTML med spans. Ukendt sprog giver teksten uændret, blot undsluppet. */
+export function highlight(code, language) {
+	const rules = LANGUAGES[ALIASES[language] ?? language];
+	if (!rules) return escape(code);
+
+	let out = '';
+	let rest = code;
+	let guard = 0;
+
+	while (rest && guard++ < 20000) {
+		let matched = false;
+		for (const [kind, re] of rules) {
+			const m = re.exec(rest);
+			if (!m || !m[0]) continue;
+			out += `<span class="tok-${kind}">${escape(m[0])}</span>`;
+			rest = rest.slice(m[0].length);
+			matched = true;
+			break;
+		}
+		if (!matched) {
+			// Ét tegn frem. Langsommere end at springe til næste interessante sted og
+			// umuligt at få til at gå i stå, hvilket er den rigtige byttehandel i noget,
+			// der kører på hvert tastetryk i en note, nogen sidder og skriver i.
+			out += escape(rest[0]);
+			rest = rest.slice(1);
+		}
+	}
+	return out + escape(rest);
+}

web/src/lib/locales/da.js

@@ -25,7 +25,28 @@ export const da = {
 	'notes.bold': 'Fed',
 	'notes.italic': 'Kursiv',
 	'notes.underline': 'Understreget',
+	'notes.sortBy': 'Rækkefølge',
+	'notes.sortUpdated': 'Senest rørt',
+	'notes.sortCreated': 'Oprettet',
+	'notes.sortTitle': 'Navn',
+	'beacon.title': 'Tælling af installationer',
+	'beacon.hint': 'Én gang i døgnet melder denne installation, at den findes, så projektet kan se hvor mange der bruger det. Der sendes **kun** de to værdier herunder — et tilfældigt id og versionen — og intet andet: ingen IP bliver gemt, ingen navne, ingen adresser, intet om hvad du bruger det til. Slået til som udgangspunkt, og du kan slå den fra her.',
+	'beacon.send': 'Send en anonym daglig melding',
+	'beacon.exactly': 'Præcis det her — ikke mere:',
+	'beacon.lastPing': 'Sidst sendt: {when}',
+	'beacon.collector': 'Modtagerens adresse',
+	'beacon.collectorHint': 'Hvor meldingen sendes hen. Lad den stå, medmindre du kører din egen tæller.',
+	'beacon.beCollector': 'Denne instans er tælleren',
+	'beacon.receiving': 'Modtager anonyme meldinger — id og version, aldrig en IP.',
+	'beacon.total': 'I alt',
+	'beacon.active7': 'Aktive 7 dage',
+	'beacon.active30': 'Aktive 30 dage',
+	'beacon.byVersion': 'Efter version (30 dage):',
+	'beacon.publish': 'Offentliggør tallet på /api/v1/beacon/count',
+	'beacon.publishHint': 'Uden login, mellemlagret et minut. Viser installationer set de seneste 30 dage — ikke et løbende total, som kun ville stige.',
 	'notes.strike': 'Gennemstreget',
+	'notes.showSource': 'Vis som kode',
+	'notes.source': 'Notens kildetekst',
 	'notes.styleTitle': 'Titel',
 	'notes.styleHeading': 'Overskrift',
 	'notes.styleSubheading': 'Underrubrik',
@@ -36,6 +57,9 @@ export const da = {
 	'notes.styleNumbered': 'Nummereret liste',
 	'notes.favourite': 'Gør til favorit',
 	'notes.unfavourite': 'Fjern som favorit',
+	'notes.syntaxProject': 'projekt',
+	'notes.syntaxNote': 'en anden note',
+	'notes.yesterday': 'i går',
 	'notes.title': 'Noter',
 	'notes.new': 'Ny note',
 	'notes.search': 'Søg i noter',
@@ -49,6 +73,9 @@ export const da = {
 	'notes.saved': 'Gemt',
 	'notes.delete': 'Slet',
 	'notes.deleteNote': 'Slet "{name}"? Den kan hentes tilbage fra papirkurven.',
+	'palette.project': 'Projekt',
+	'palette.task': 'Opgave',
+	'palette.note': 'Note',
 	'nav.today': 'I dag',
 	'nav.upcoming': 'Kommende',
 	'nav.delegated': 'Venter på andre',
@@ -363,6 +390,10 @@ export const da = {
 	'data.swept': 'ryddet væk',
 	'data.empty': 'tom',
 	'data.export': 'Eksport',
+	'data.importNotes': 'Importér noter (zip med Markdown-filer)',
+	'data.importNotesHint': 'Én .md-fil pr. note; første linje bliver titlen. Billeder, der ligger ved siden af, følger med og bliver hængt på noten. Scriptet i tools/ henter dine Apple Noter ud.',
+	'data.notesImported': '{n} noter og {files} filer hentet ind.',
+	'data.exportNotes': 'Alle noter som Markdown-filer',
 	'data.exportAccount': 'Hele kontoen som JSON',
 	'data.exportOne': 'Ét projekt',
 	'data.pickProject': 'Vælg et projekt',
@@ -467,6 +498,7 @@ export const da = {
 	'auth.forgot': 'Glemt adgangskode?',
 
 	// --- a task, opened ---------------------------------------------------------------
+	'detail.notFound': 'Opgaven findes ikke, eller den er ikke din.',
 	'detail.task': 'Opgave',
 	'detail.close': 'Luk',
 	'detail.text': 'Opgavens tekst',

web/src/lib/locales/en.js

@@ -21,7 +21,28 @@ export const en = {
 	'notes.bold': 'Bold',
 	'notes.italic': 'Italic',
 	'notes.underline': 'Underline',
+	'notes.sortBy': 'Order',
+	'notes.sortUpdated': 'Last touched',
+	'notes.sortCreated': 'Created',
+	'notes.sortTitle': 'Name',
+	'beacon.title': 'Counting installations',
+	'beacon.hint': 'Once a day this installation reports that it exists, so the project can see how many people run it. It sends **only** the two values below — a random id and the version — and nothing else: no IP is stored, no names, no addresses, nothing about what you use it for. On by default, and you can turn it off here.',
+	'beacon.send': 'Send an anonymous daily report',
+	'beacon.exactly': 'Exactly this — nothing more:',
+	'beacon.lastPing': 'Last sent: {when}',
+	'beacon.collector': 'Collector address',
+	'beacon.collectorHint': 'Where the report goes. Leave it unless you run your own collector.',
+	'beacon.beCollector': 'This instance is the collector',
+	'beacon.receiving': 'Receiving anonymous reports — id and version, never an IP.',
+	'beacon.total': 'Total',
+	'beacon.active7': 'Active 7 days',
+	'beacon.active30': 'Active 30 days',
+	'beacon.byVersion': 'By version (30 days):',
+	'beacon.publish': 'Publish the count at /api/v1/beacon/count',
+	'beacon.publishHint': 'No login, cached for a minute. Reports installations seen in the last 30 days — not a running total, which would only ever climb.',
 	'notes.strike': 'Strikethrough',
+	'notes.showSource': 'Show as code',
+	'notes.source': 'Note source',
 	'notes.styleTitle': 'Title',
 	'notes.styleHeading': 'Heading',
 	'notes.styleSubheading': 'Subheading',
@@ -32,6 +53,9 @@ export const en = {
 	'notes.styleNumbered': 'Numbered list',
 	'notes.favourite': 'Make a favourite',
 	'notes.unfavourite': 'Remove from favourites',
+	'notes.syntaxProject': 'project',
+	'notes.syntaxNote': 'another note',
+	'notes.yesterday': 'yesterday',
 	'notes.title': 'Notes',
 	'notes.new': 'New note',
 	'notes.search': 'Search notes',
@@ -45,6 +69,9 @@ export const en = {
 	'notes.saved': 'Saved',
 	'notes.delete': 'Delete',
 	'notes.deleteNote': 'Delete "{name}"? It can be brought back from the trash.',
+	'palette.project': 'Project',
+	'palette.task': 'Task',
+	'palette.note': 'Note',
 	'nav.today': 'Today',
 	'nav.upcoming': 'Upcoming',
 	'nav.delegated': 'Waiting on others',
@@ -358,6 +385,10 @@ export const en = {
 	'data.swept': 'swept away',
 	'data.empty': 'empty',
 	'data.export': 'Export',
+	'data.importNotes': 'Import notes (a zip of Markdown files)',
+	'data.importNotesHint': 'One .md file per note; the first line becomes the title. Pictures beside the files come with them and are attached to the note. The script in tools/ gets your Apple Notes out.',
+	'data.notesImported': '{n} notes and {files} files brought in.',
+	'data.exportNotes': 'Every note as Markdown files',
 	'data.exportAccount': 'The whole account as JSON',
 	'data.exportOne': 'One project',
 	'data.pickProject': 'Pick a project',
@@ -463,6 +494,7 @@ export const en = {
 	'auth.forgot': 'Forgotten your password?',
 
 	// --- a task, opened ---------------------------------------------------------------
+	'detail.notFound': 'That task does not exist, or it is not yours.',
 	'detail.task': 'Task',
 	'detail.close': 'Close',
 	'detail.text': 'The task’s text',

web/src/lib/richtext.js

@@ -37,14 +37,61 @@ const BLOCKS = [
 const escapeHtml = (s) =>
 	s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 
+/**
+ * En værdi, der skal stå inde i en attribut.
+ *
+ * escapeHtml er skrevet til tekst mellem to tags, hvor et anførselstegn ikke
+ * betyder noget, og lader dem derfor stå. Inde i en attribut lukker de den — og
+ * så står resten af strengen som markup. Det er den ene forskel, og den er hele
+ * forskellen mellem tekst og et onerror.
+ */
+const attr = (s) => escapeHtml(s).replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+
+/**
+ * Billeder løftes ud af teksten, før noget andet rører den.
+ *
+ * De stod før først i kæden, og så kørte de fire resterende regler hen over en
+ * streng, der nu indeholdt rigtig HTML — ind i den `alt`, der lige var lavet.
+ * Det gik godt, så længe ingen af erstatningerne indeholdt et anførselstegn, og
+ * det er en betingelse, der stod skrevet ingen steder: den dag nogen tilføjer en
+ * regel for links, er den brudt, og det er præcis den vej, XSS-en kom ind ad.
+ *
+ * Værre endnu var undslupningen. `escapeHtml` kørte på hele teksten, og `attr`
+ * kørte den igen på `alt` — så et og-tegn blev til en dobbelt undslupning, der
+ * voksede ved hver eneste åbning og gemning. En note med "Kaffe & te" i et
+ * billede blev længere, hver gang nogen så på den.
+ *
+ * En pladsholder løser begge dele. Billedet tages ud af den rå tekst, resten
+ * undslippes og formateres som altid, og billedet lægges tilbage til sidst med en
+ * `alt`, der er undsluppet nøjagtig én gang. Rækkefølgen af de øvrige regler kan
+ * så ikke længere betyde noget.
+ *
+ * Nul-tegnet som mærke, fordi det er det ene tegn, en note ikke kan indeholde:
+ * det overlever hverken en contenteditable eller en Markdown-fil.
+ */
+const IMAGE = /!\[([^\]]*)\]\((\/api\/v1\/attachments\/[0-9a-f-]+)\)/g;
+const MARK = "\u0000";
+
 /** Inline marks, innermost first so a bold word inside italics survives both. */
 function inlineToHtml(text) {
-	return escapeHtml(text)
+	// Kun vores egen adresse bliver til et billede. Et `![](http://…)` fra en
+	// indsat tekst ville ellers hente fra en fremmed vært, når noten åbnes, og
+	// fortælle den, at den er blevet læst — og en note er det sidste sted, man vil
+	// have en sporingspixel. Alt andet står som den tekst, det er.
+	const images = [];
+	const lifted = (text ?? '').replace(IMAGE, (_, alt, src) => {
+		images.push(`<img src="${src}" alt="${attr(alt)}">`);
+		return `${MARK}${images.length - 1}${MARK}`;
+	});
+
+	const marked = escapeHtml(lifted)
 		.replace(/&lt;u&gt;(.+?)&lt;\/u&gt;/g, '<u>$1</u>')
 		.replace(/`([^`]+)`/g, '<code>$1</code>')
 		.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
 		.replace(/~~(.+?)~~/g, '<s>$1</s>')
 		.replace(/(^|[^*])\*([^*]+)\*/g, '$1<em>$2</em>');
+
+	return marked.replace(new RegExp(MARK + '(\\d+)' + MARK, 'g'), (_, i) => images[Number(i)] ?? '');
 }
 
 /**
@@ -58,31 +105,113 @@ function inlineToHtml(text) {
 export function markdownToHtml(markdown) {
 	const lines = (markdown ?? '').split('\n');
 	const out = [];
-	let list = null;
+	let fence = null; // sproget, mens vi er inde i en ```-blok
 
-	const closeList = () => {
-		if (list) {
-			out.push(`</${list}>`);
-			list = null;
+	// Listeniveauerne, der står åbne lige nu — ét mærke pr. dybde.
+	//
+	// En stak frem for én `list`-variabel, fordi en punktliste kan ligge inde i en
+	// anden. Den flade udgave kunne kun beskrive ét niveau, så et indrykket punkt
+	// blev lagt ved siden af sit ophav og kom tilbage som søskende: indrykningen
+	// var væk efter én gemning.
+	//
+	// Underlisten lægges *inde i* sit `<li>`, ikke ved siden af. Browsere viser
+	// begge dele ens, men kun den ene er en liste i en liste, når den læses tilbage
+	// — og det er læsningen tilbage, der skriver filen.
+	const stack = [];
+	let liOpen = false;
+
+	const closeItem = () => {
+		if (liOpen) {
+			out.push('</li>');
+			liOpen = false;
 		}
 	};
 
-	for (const line of lines) {
-		const bullet = /^[-*+]\s+(.*)$/.exec(line);
-		const numbered = /^\d+\.\s+(.*)$/.exec(line);
+	const closeList = (toDepth = 0) => {
+		while (stack.length > toDepth) {
+			closeItem();
+			out.push(`</${stack.pop()}>`);
+			// Efter et niveau lukkes, står vi igen inde i ophavets `<li>`.
+			liOpen = stack.length > 0;
+		}
+		if (stack.length === 0) liOpen = false;
+	};
 
-		if (bullet || numbered) {
-			const want = bullet ? 'ul' : 'ol';
-			if (list !== want) {
-				closeList();
-				out.push(`<${want}>`);
-				list = want;
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i];
+		// Hegnede blokke først: alt indeni er tekst, ikke Markdown, og en linje der
+		// begynder med - inde i et shell-script er ikke et punkt i en liste.
+		const fenced = /^```(\w*)\s*$/.exec(line);
+		if (fence !== null) {
+			if (fenced) {
+				out.push('</code></pre>');
+				fence = null;
+			} else {
+				out.push(escapeHtml(line) + '\n');
 			}
-			out.push(`<li>${inlineToHtml((bullet ?? numbered)[1])}</li>`);
+			continue;
+		}
+		if (fenced) {
+			closeList();
+			fence = fenced[1] ?? '';
+			// attr, ikke escapeHtml: værdien står inde i en attribut. Den er sikker i
+			// dag alene fordi hegn-regexen er \w*, som ikke rummer anførselstegn — og
+			// den dag nogen udvider den for at tage imod "c++" eller "f#", er det en
+			// XSS. Undslupningen skal passe til stedet, ikke til det, der
+			// tilfældigvis kan stå der nu.
+			out.push(`<pre data-lang="${attr(fence)}"><code>`);
+			continue;
+		}
+
+		// Indrykning bærer niveauet: to mellemrum, eller en tabulator, er ét trin.
+		const item = /^([ \t]*)(?:([-*+])|(\d+)\.)\s+(.*)$/.exec(line);
+
+		if (item) {
+			const indent = item[1].replace(/\t/g, '  ').length;
+			const depth = Math.floor(indent / 2);
+			const want = item[2] ? 'ul' : 'ol';
+
+			// Dybere end vi står: luk ned til niveauet. Én ad gangen, så hvert
+			// `</ul>` lander inde i det `<li>`, det hører til.
+			closeList(depth + 1);
+
+			// Samme dybde, men den anden slags liste — en punktliste efterfulgt af en
+			// nummereret er to lister, ikke én med blandede mærker.
+			if (stack.length === depth + 1 && stack[depth] !== want) {
+				closeList(depth);
+			}
+
+			while (stack.length < depth + 1) {
+				// Nummeret tælles ikke om. Skrev nogen 10., 11., er det dét, der står i
+				// filen, og en liste, der begynder ved ti, skal begynde ved ti — ellers
+				// gør en gemning uden ændringer noten om.
+				const start = item[3] && item[3] !== '1' && stack.length === depth ? ` start="${Number(item[3])}"` : '';
+				out.push(`<${want}${want === 'ol' ? start : ''}>`);
+				stack.push(want);
+				liOpen = false;
+			}
+
+			closeItem();
+			out.push(`<li>${inlineToHtml(item[4])}`);
+			liOpen = true;
 			continue;
 		}
 		closeList();
 
+		// Et blokcitat, der rummer mere end én linje, læses som ét citat med
+		// indholdet indeni — samme vej tilbage som htmlToMarkdown skrev det. Uden
+		// det blev en liste i et citat til seks citater med et bindestreg i hver.
+		if (/^>(?: |$)/.test(line)) {
+			const inner = [];
+			while (i < lines.length && /^>(?: |$)/.test(lines[i])) {
+				inner.push(lines[i].replace(/^> ?/, ''));
+				i++;
+			}
+			i--;
+			out.push(`<blockquote>${markdownToHtml(inner.join('\n'))}</blockquote>`);
+			continue;
+		}
+
 		const block = BLOCKS.find((b) =>
 			b.prefix === '    ' ? line.startsWith('    ') : line.startsWith(b.prefix)
 		);
@@ -96,6 +225,7 @@ export function markdownToHtml(markdown) {
 		out.push(`<p>${line.trim() === '' ? '<br>' : inlineToHtml(line)}</p>`);
 	}
 	closeList();
+	if (fence !== null) out.push('</code></pre>');
 	return out.join('');
 }
 
@@ -106,6 +236,11 @@ function inlineToMarkdown(node) {
 
 	const inner = [...node.childNodes].map(inlineToMarkdown).join('');
 	switch (node.tagName) {
+		// Et billede har ingen tekst i sig, så uden det her læses det som ingenting
+		// — og den første gemning ville tage hvert billede ud af noten uden at
+		// nogen havde rørt det.
+		case 'IMG':
+			return `![${node.getAttribute('alt') ?? ''}](${node.getAttribute('src') ?? ''})`;
 		case 'STRONG':
 		case 'B':
 			return inner ? `**${inner}**` : '';
@@ -146,13 +281,25 @@ function inlineToMarkdown(node) {
  * browser will nest, split and re-wrap as somebody types, and a regular expression
  * over that is a guess.
  */
+/** The tags that are a block of their own, and must never be read as inline text. */
+const BLOCK_TAGS = /^(P|H[1-6]|UL|OL|LI|PRE|BLOCKQUOTE|DIV)$/;
+
+/** Whether an element holds blocks, in which case reading it as one line loses them. */
+const holdsBlocks = (el) => [...el.children].some((c) => BLOCK_TAGS.test(c.tagName));
+
 export function htmlToMarkdown(root) {
 	const lines = [];
 
-	const walk = (node) => {
+	/**
+	 * @param node  hvad der læses
+	 * @param emit  hvor linjerne lægges. Et blokcitat giver sin egen, som sætter
+	 *              `> ` foran alt, hvad der kommer indefra — sådan kan et citat
+	 *              indeholde afsnit og lister uden at de bliver til én linje.
+	 */
+	const walk = (node, emit) => {
 		for (const child of node.childNodes) {
 			if (child.nodeType === Node.TEXT_NODE) {
-				if (child.textContent.trim()) lines.push(child.textContent);
+				if (child.textContent.trim()) emit(child.textContent);
 				continue;
 			}
 			if (child.nodeType !== Node.ELEMENT_NODE) continue;
@@ -160,32 +307,93 @@ export function htmlToMarkdown(root) {
 			switch (child.tagName) {
 				case 'UL':
 				case 'OL': {
-					let n = 1;
-					for (const li of child.children) {
-						const text = inlineToMarkdown(li).trim();
-						lines.push(child.tagName === 'UL' ? `- ${text}` : `${n++}. ${text}`);
+					list(child, 0, emit);
+					break;
+				}
+
+				// Et citat kan rumme blokke. Læst som én streng blev "En", "To" til
+				// "EnTo", og en liste inde i et citat mistede hvert eneste punktmærke
+				// — det var sådan en note kom tilbage som én lang linje efter en
+				// gemning, uden at nogen havde rørt teksten.
+				case 'BLOCKQUOTE': {
+					if (holdsBlocks(child)) {
+						walk(child, (l) => emit(l.trim() === '' ? '>' : `> ${l}`));
+					} else {
+						emit('> ' + inlineToMarkdown(child));
 					}
 					break;
 				}
 				case 'DIV':
 					// The browser's own container when nothing else applies. Read through
 					// it rather than treating it as a block, or every paste adds a level.
-					if ([...child.children].some((c) => /^(P|H[1-3]|UL|OL|PRE|BLOCKQUOTE|DIV)$/.test(c.tagName))) {
-						walk(child);
+					if (holdsBlocks(child)) {
+						walk(child, emit);
 					} else {
-						lines.push(inlineToMarkdown(child));
+						emit(inlineToMarkdown(child));
 					}
 					break;
+				case 'PRE': {
+					// Back out as a fence, with the language it came in with. The old
+					// four-space form is still read on the way in; it is not written
+					// out any more, because a fence survives being pasted somewhere
+					// else and an indent does not.
+					const lang = child.getAttribute('data-lang') ?? '';
+					emit('```' + lang);
+					for (const l of (child.textContent ?? '').replace(/\n$/, '').split('\n')) {
+						emit(l);
+					}
+					emit('```');
+					break;
+				}
 				default: {
 					const block = BLOCKS.find((b) => b.tag === child.tagName.toLowerCase());
+					// En overskrift med en liste i sig er stadig en liste. Samme fælde som
+					// citatet: læst som én linje forsvandt hvert punktmærke.
+					if (holdsBlocks(child)) {
+						walk(child, emit);
+						break;
+					}
 					const text = inlineToMarkdown(child);
-					lines.push(block ? block.prefix + text : text);
+					emit(block ? block.prefix + text : text);
 				}
 			}
 		}
 	};
 
-	walk(root);
+	/**
+	 * Én liste, og de lister der ligger i den.
+	 *
+	 * `start` læses med, så en liste, der begynder ved ti, stadig gør det. Talt om
+	 * fra ét gjorde en gemning uden ændringer noten om — den slags er værre end en
+	 * fejl, fordi den sker uden at nogen har rørt noget.
+	 */
+	const list = (el, depth, emit) => {
+		let n = Number(el.getAttribute('start') || 1);
+		if (!Number.isFinite(n) || n < 1) n = 1;
+		const pad = '  '.repeat(depth);
+
+		for (const li of el.children) {
+			if (li.tagName !== 'LI') continue;
+
+			// Punktets egen tekst er alt undtagen de lister, der ligger under det.
+			const nested = [...li.children].filter((c) => c.tagName === 'UL' || c.tagName === 'OL');
+			let text;
+			if (nested.length) {
+				const clone = li.cloneNode(true);
+				for (const sub of [...clone.children]) {
+					if (sub.tagName === 'UL' || sub.tagName === 'OL') sub.remove();
+				}
+				text = inlineToMarkdown(clone).trim();
+			} else {
+				text = inlineToMarkdown(li).trim();
+			}
+
+			emit(el.tagName === 'UL' ? `${pad}- ${text}` : `${pad}${n++}. ${text}`);
+			for (const sub of nested) list(sub, depth + 1, emit);
+		}
+	};
+
+	walk(root, (l) => lines.push(l));
 	// Trailing blank lines are what an editor accumulates from people pressing
 	// return at the end; they are not content and they grow every time.
 	while (lines.length && lines[lines.length - 1].trim() === '') lines.pop();

web/src/lib/stores.svelte.js

@@ -49,6 +49,8 @@ class AppState {
 	 * small request against modelling a count in two places.
 	 */
 	labelsChanged = $state(0);
+	/** Bumped when a note moves, so a list showing them knows to look again. */
+	notesChanged = $state(0);
 
 	#socket = null;
 	#reconnectDelay = 1000;
@@ -421,6 +423,17 @@ class AppState {
 		}
 	}
 
+	/** Files a note under a project, which is what sharing it means. */
+	async moveNoteToProject(noteID, projectID) {
+		try {
+			await api.updateNote(noteID, { project_id: projectID });
+			this.notesChanged++;
+			this.toast(t('notes.filed'));
+		} catch (e) {
+			this.toast(humanMessage(e));
+		}
+	}
+
 	async refreshProjects() {
 		const { projects } = await api.listProjects();
 		this.projects = projects;

web/src/routes/faerdige/+page.svelte

@@ -35,10 +35,29 @@
 	 * A flat list of two hundred rows says when nothing. "I dag" and "I går" are
 	 * how anybody looking for something they just closed would describe it.
 	 */
+	/**
+	 * Dagen en opgave blev lukket, målt hvor personen står.
+	 *
+	 * Ikke `completed_at.slice(0, 10)`. Tidsstemplet er i UTC, og de ti første tegn
+	 * er derfor UTC's dato — mens overskriften nedenfor sammenligner med *lokal*
+	 * dato. I to timer efter midnat i dansk sommertid er de to ikke den samme dag,
+	 * så en opgave lukket 00.30 lå under "I går", indtil klokken blev to.
+	 *
+	 * Fundet af prøven, som kørte forbi midnat for første gang. Den havde været
+	 * grøn hver eneste gang før, fordi de to datoer er ens tyve timer i døgnet.
+	 */
+	const localDay = (iso) => {
+		if (!iso) return '';
+		const d = new Date(iso);
+		if (Number.isNaN(d.getTime())) return '';
+		const pad = (n) => String(n).padStart(2, '0');
+		return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+	};
+
 	let days = $derived.by(() => {
 		const groups = new Map();
 		for (const task of done) {
-			const key = (task.completed_at ?? '').slice(0, 10);
+			const key = localDay(task.completed_at);
 			if (!groups.has(key)) groups.set(key, []);
 			groups.get(key).push(task);
 		}

web/src/routes/indstillinger/data/+page.svelte

@@ -1,10 +1,33 @@
 <script>
+
 	/** Import, export and project templates. */
 	import { api, humanMessage } from '$lib/api.js';
 	import { app } from '$lib/stores.svelte.js';
 	import { goto } from '$app/navigation';
 	import { ago } from '$lib/when.js';
-	import { t } from '$lib/i18n.svelte.js';
+	import { t, tag } from '$lib/i18n.svelte.js';
+
+	// --- beaconet -----------------------------------------------------------------
+
+	// Hvad denne installation melder, og til hvem. Se internal/beacon for hvorfor
+	// den er slået til som udgangspunkt frem for at være obligatorisk.
+	let beacon = $state(null);
+
+	$effect(() => {
+		if (!app.user?.is_admin) return;
+		api.beacon().then((r) => (beacon = r)).catch(() => {});
+	});
+
+	async function saveBeacon(change) {
+		try {
+			beacon = await api.setBeacon(change);
+		} catch (e) {
+			app.toast(humanMessage(e));
+			// Læst forfra, så en afvist ændring ikke bliver stående som et flueben,
+			// der ikke svarer til, hvad serveren gør.
+			api.beacon().then((r) => (beacon = r)).catch(() => {});
+		}
+	}
 
 	// --- backups ---------------------------------------------------------------------
 
@@ -57,6 +80,34 @@
 	// --- Todoist import ------------------------------------------------------------
 
 	let importing = $state(false);
+	let importingNotes = $state(false);
+
+	/**
+	 * A zip of Markdown files becomes notes.
+	 *
+	 * The whole archive in one request rather than a file at a time: the pictures
+	 * have to be in the same request as the notes that name them, or the links
+	 * cannot be rewritten.
+	 */
+	async function importNotes(event) {
+		const file = event.currentTarget.files?.[0];
+		if (!file) return;
+		importingNotes = true;
+		try {
+			const result = await api.importNotes(file);
+			app.toast(
+				t('data.notesImported', {
+					n: result.created ?? 0,
+					files: result.files ?? 0
+				})
+			);
+		} catch (e) {
+			app.toast(humanMessage(e));
+		} finally {
+			importingNotes = false;
+			event.target.value = '';
+		}
+	}
 	let result = $state(null);
 
 	async function importTodoist(event) {
@@ -341,6 +392,22 @@
 		<!-- Plain links, not fetch: the browser's own download handling knows what to
 		     do with a Content-Disposition, and the session cookie rides along. -->
 		<a class="link" href={api.exportAccountURL()} download>{t('data.exportAccount')}</a>
+		<a class="link" href={api.exportNotesURL()} download>{t('data.exportNotes')}</a>
+	</div>
+
+	<!-- The way back in, and from anywhere else: a folder of Markdown is what
+	     Obsidian, Bear and iA Writer all produce, and what the Apple Notes script in
+	     tools/ writes. Pictures beside the files come with them. -->
+	<div class="field">
+		<label for="import-notes">{t('data.importNotes')}</label>
+		<input
+			id="import-notes"
+			type="file"
+			accept=".zip,application/zip"
+			onchange={importNotes}
+			disabled={importingNotes}
+		/>
+		<p class="hint">{t('data.importNotesHint')}</p>
 	</div>
 
 	<div class="field">
@@ -441,6 +508,95 @@
 	{/if}
 </section>
 
+<!-- Beaconet.
+     Under Data, fordi det er her alt om "hvad forlader denne instans" står — en
+     sikkerhedskopi, en eksport, en import. Telemetri hører til i samme rude som
+     dem, ikke gemt væk under en fane, ingen åbner. -->
+<section class="panel">
+	<header>
+		<h2>{t('beacon.title')}</h2>
+		<p class="hint">{t('beacon.hint')}</p>
+	</header>
+
+	{#if beacon}
+		<label class="check">
+			<input
+				type="checkbox"
+				checked={beacon.enabled}
+				onchange={(e) => saveBeacon({ enabled: e.currentTarget.checked })}
+			/>
+			<span>{t('beacon.send')}</span>
+		</label>
+
+		<!-- Hele beskeden, ord for ord. Et løfte om telemetri er præcis så meget
+		     værd som læserens mulighed for at efterprøve det, så den står her frem
+		     for som en sætning om, hvad der cirka bliver sendt. -->
+		<pre class="payload">{t('beacon.exactly')}
+{JSON.stringify({ instance_id: beacon.instance_id, version: beacon.version }, null, 2)}</pre>
+
+		{#if beacon.last_ping_at}
+			<p class="hint">{t('beacon.lastPing', { when: new Date(beacon.last_ping_at).toLocaleString(tag()) })}</p>
+		{/if}
+
+		<div class="field">
+			<label for="collector">{t('beacon.collector')}</label>
+			<input
+				id="collector"
+				value={beacon.collector_url}
+				onchange={(e) => saveBeacon({ collector_url: e.currentTarget.value })}
+			/>
+			<p class="hint">{t('beacon.collectorHint')}</p>
+		</div>
+
+		<label class="check">
+			<input
+				type="checkbox"
+				checked={beacon.is_collector}
+				onchange={(e) => saveBeacon({ is_collector: e.currentTarget.checked })}
+			/>
+			<span>{t('beacon.beCollector')}</span>
+		</label>
+
+		{#if beacon.is_collector && beacon.stats}
+			<p class="hint">{t('beacon.receiving')}</p>
+			<div class="counts">
+				<div class="count">
+					<strong>{beacon.stats.total}</strong>
+					<span>{t('beacon.total')}</span>
+				</div>
+				<div class="count">
+					<strong>{beacon.stats.active_7d}</strong>
+					<span>{t('beacon.active7')}</span>
+				</div>
+				<div class="count">
+					<strong>{beacon.stats.active_30d}</strong>
+					<span>{t('beacon.active30')}</span>
+				</div>
+			</div>
+
+			{#if Object.keys(beacon.stats.by_version ?? {}).length}
+				<p class="hint">
+					{t('beacon.byVersion')}
+					{Object.entries(beacon.stats.by_version)
+						.sort((a, b) => b[1] - a[1])
+						.map(([v, n]) => `${v} ×${n}`)
+						.join(', ')}
+				</p>
+			{/if}
+
+			<label class="check">
+				<input
+					type="checkbox"
+					checked={beacon.publish_count}
+					onchange={(e) => saveBeacon({ publish_count: e.currentTarget.checked })}
+				/>
+				<span>{t('beacon.publish')}</span>
+			</label>
+			<p class="hint">{t('beacon.publishHint')}</p>
+		{/if}
+	{/if}
+</section>
+
 <style>
 	/* The backup list, which is a list of rows with a right-hand action — the same
 	   shape the settings pages use elsewhere, said once here because this is the
@@ -551,4 +707,48 @@
 	.link:hover {
 		text-decoration: underline;
 	}
+
+	/* Beskeden som den sendes. Monospace, fordi den skal kunne sammenlignes tegn
+	   for tegn med det, der står i dokumentationen. */
+	.payload {
+		font-family: var(--font-mono);
+		font-size: var(--text-xs);
+		background: var(--surface-sunken);
+		border: 1px solid var(--line);
+		border-radius: var(--radius-sm);
+		padding: var(--s2) var(--s3);
+		overflow-x: auto;
+		margin: var(--s2) 0;
+		white-space: pre-wrap;
+		overflow-wrap: anywhere;
+	}
+
+	.counts {
+		display: flex;
+		gap: var(--s2);
+		margin: var(--s2) 0;
+		flex-wrap: wrap;
+	}
+
+	.count {
+		flex: 1 1 7rem;
+		display: flex;
+		flex-direction: column;
+		gap: 2px;
+		padding: var(--s3);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+	}
+
+	.count strong {
+		font-size: var(--text-xl);
+		line-height: 1;
+	}
+
+	.count span {
+		font-size: var(--text-xs);
+		color: var(--ink-faint);
+		text-transform: uppercase;
+		letter-spacing: 0.06em;
+	}
 </style>

web/src/routes/noter/+page.svelte

@@ -13,10 +13,56 @@
 	 */
 	import { api, humanMessage } from '$lib/api.js';
 	import { app } from '$lib/stores.svelte.js';
-	import { t } from '$lib/i18n.svelte.js';
+	import { page } from '$app/stores';
+	import { t, tag } from '$lib/i18n.svelte.js';
+	import { NOTE, startDrag } from '$lib/dnd.js';
 	import NoteEditor from '$lib/components/NoteEditor.svelte';
 
 	let notes = $state([]);
+
+	/**
+	 * Rækkefølgen, og hvorfor den kan vælges.
+	 *
+	 * Serveren svarer i én rækkefølge — senest rørt øverst — og det er den rigtige,
+	 * når man arbejder: den note, man var i gang med, er den, man skal tilbage til.
+	 * Den er også den eneste, der ikke kan svare på "hvad skrev jeg dengang".
+	 * Tolv hundrede noter flyttet ind fra et andet program er et arkiv, og et arkiv
+	 * læses efter, hvornår noget blev skrevet, og efter navn.
+	 *
+	 * Sorteret her frem for i en forespørgsel: hele listen er allerede hentet, den
+	 * fylder ingenting, og et valg, der ikke koster et kald, kan skiftes så hurtigt
+	 * som man kan ombestemme sig.
+	 */
+	const ORDERS = [
+		{ key: 'updated', label: 'notes.sortUpdated' },
+		{ key: 'created', label: 'notes.sortCreated' },
+		{ key: 'title', label: 'notes.sortTitle' }
+	];
+
+	let order = $state('updated');
+
+	$effect(() => {
+		const saved = localStorage.getItem('notes.order');
+		if (saved && ORDERS.some((o) => o.key === saved)) order = saved;
+	});
+
+	function setOrder(next) {
+		order = next;
+		localStorage.setItem('notes.order', next);
+	}
+
+	// Favoritter står øverst uanset rækkefølge. Det er hele meningen med at gøre en
+	// note til favorit, og en sortering, der blandede dem ind igen, ville tage den.
+	let ordered = $derived(
+		[...notes].sort((a, b) => {
+			if (a.pinned !== b.pinned) return a.pinned ? -1 : 1;
+			if (order === 'title') {
+				return (a.title || '').localeCompare(b.title || '', 'da', { sensitivity: 'base' });
+			}
+			const field = order === 'created' ? 'created_at' : 'updated_at';
+			return new Date(b[field]).getTime() - new Date(a[field]).getTime();
+		})
+	);
 	let selected = $state(null);
 	let query = $state('');
 	let status = $state('loading');
@@ -31,6 +77,16 @@
 		load(query);
 	});
 
+	// Arriving from somewhere that names a note — a task's panel, a project's page —
+	// opens it rather than dropping the person on a list to find it again.
+	let asked = $derived($page.url.searchParams.get('note'));
+	$effect(() => {
+		if (!asked || selected?.id === asked) return;
+		const found = notes.find((n) => n.id === asked);
+		if (found) open(found);
+		else api.note(asked).then(open).catch(() => {});
+	});
+
 	async function load(q) {
 		try {
 			notes = (await api.notes(q ? { q } : {})).notes ?? [];
@@ -57,6 +113,10 @@
 	 */
 	function plain(body) {
 		return (body ?? '')
+			// Et billede har ingen ord i sig. Uden det her stod der
+			// "![](/api/v1/attachments/01a0…" i uddraget af hver note med et foto i,
+			// hvilket er den eneste tekst i listen, ingen har skrevet.
+			.replace(/!\[[^\]]*\]\([^)]*\)/g, '')
 			.replace(/^#{1,6}\s+/gm, '')
 			.replace(/^\s*[-*+]\s+/gm, '')
 			.replace(/^\s*>\s?/gm, '')
@@ -71,6 +131,39 @@
 			.slice(0, 90);
 	}
 
+	/**
+	 * Hvornår, skrevet som man ville sige det.
+	 *
+	 * "i går" og et klokkeslæt i dag; en dato, når det er længere siden. En note
+	 * fra i formiddags og en fra i fjor skal ikke se ens ud i en liste, man skanner.
+	 */
+	function when(iso) {
+		if (!iso) return '';
+		const at = new Date(iso);
+		const now = new Date();
+		const sameDay = at.toDateString() === now.toDateString();
+		if (sameDay) return at.toLocaleTimeString(tag(), { hour: '2-digit', minute: '2-digit' });
+
+		const yesterday = new Date(now);
+		yesterday.setDate(now.getDate() - 1);
+		if (at.toDateString() === yesterday.toDateString()) return t('notes.yesterday');
+
+		return at.toLocaleDateString(tag(), { day: '2-digit', month: '2-digit', year: 'numeric' });
+	}
+
+	function projectName(id) {
+		return app.projects.find((p) => p.id === id)?.name ?? '';
+	}
+
+	// Trukket ind på et projekt i sidebjælken. Nyttelasten er notens id; sidebjælken
+	// kender allerede formen fra opgaver.
+	let dragging = $state(null);
+
+	function onDragStart(event, note) {
+		dragging = note.id;
+		startDrag(event, NOTE, note.id);
+	}
+
 	async function create() {
 		try {
 			const note = await api.createNote({ body: '' });
@@ -160,6 +253,22 @@
 		}
 	}
 
+	/**
+	 * What a link is called on screen.
+	 *
+	 * A project tag is stored folded, because it is a key — but showing the folded
+	 * key would mean a note that says #garageristeriet is labelled with a spelling
+	 * that appears nowhere, neither in the note nor on the project. The project's
+	 * own name is the right answer, and the fold is what makes it findable.
+	 */
+	function label(link) {
+		if (link.kind !== 'project') return link.target_id;
+		const project = app.projects.find(
+			(p) => p.name.toLowerCase() === link.target_id.toLowerCase()
+		);
+		return '#' + (project?.name ?? link.target_id);
+	}
+
 	// What the note points at, for the panel under the editor.
 	let links = $derived(selected?.links ?? []);
 
@@ -172,7 +281,22 @@
 	<aside>
 		<div class="head">
 			<h1>{t('notes.title')}</h1>
-			<button class="new" onclick={create} aria-label={t('notes.new')}>+</button>
+			<div class="tools">
+				<!-- En select frem for tre knapper: rækkefølgen vælges sjældent, og tre
+				     knapper ville tage plads fra listen hver eneste dag for at spare et
+				     klik en gang imellem. -->
+				<select
+					class="order"
+					value={order}
+					onchange={(e) => setOrder(e.currentTarget.value)}
+					aria-label={t('notes.sortBy')}
+				>
+					{#each ORDERS as o}
+						<option value={o.key}>{t(o.label)}</option>
+					{/each}
+				</select>
+				<button class="new" onclick={create} aria-label={t('notes.new')}>+</button>
+			</div>
 		</div>
 
 		<input
@@ -189,12 +313,28 @@
 			<p class="hint">{query ? t('notes.noneFound') : t('notes.noneYet')}</p>
 		{:else}
 			<ul>
-				{#each notes as note (note.id)}
+				{#each ordered as note (note.id)}
 					<li>
 						<div class="rowline">
-							<button class="row" class:on={selected?.id === note.id} onclick={() => open(note)}>
+							<button
+								class="row"
+								class:on={selected?.id === note.id}
+								onclick={() => open(note)}
+								draggable="true"
+								ondragstart={(e) => onDragStart(e, note)}
+								ondragend={() => (dragging = null)}
+							>
 								<strong>{note.title || t('notes.untitled')}</strong>
-								<span class="preview">{plain(note.body)}</span>
+								<!-- Dato og begyndelse på samme linje, som Apple Noter gør det: to
+								     linjer pr. note frem for tre, og datoen er dét, man skanner
+								     efter, når man leder efter noget, man skrev i tirsdags. -->
+								<span class="under">
+									<span class="when">{when(note.updated_at)}</span>
+									<span class="preview">{plain(note.body)}</span>
+								</span>
+								{#if note.project_id}
+									<span class="filed">{projectName(note.project_id)}</span>
+								{/if}
 							</button>
 							<button
 								class="star"
@@ -229,7 +369,7 @@
 				{#if links.length}
 					<span class="links">
 						{#each links as link}
-							<span class="link">{link.kind === 'project' ? '#' : ''}{link.target_id}</span>
+							<span class="link">{label(link)}</span>
 						{/each}
 					</span>
 				{/if}
@@ -262,10 +402,18 @@
 
 <style>
 	.notes {
+		/* En grid-kolonne er som udgangspunkt mindst så bred som sit bredeste
+		   indhold, og et API-token uden et mellemrum i er ét meget bredt ord. Uden
+		   min-width: 0 skubber sådan en note hele listen bredere, og editoren
+		   klemmes sammen — på en note man ikke engang har åben. */
+		min-width: 0;
+
 		/* Air on all sides. The heading, the search box and the list all sat flush
 		   against the sidebar's rule, which reads as a rendering fault rather than
 		   as a layout. */
-		padding: var(--s3) 0 0 var(--s4);
+		/* Luft hele vejen rundt om arket. Højre og bund var nul, dengang editoren
+		   ingen kant havde og ingenting kunne støde imod. */
+		padding: var(--s3) var(--s4) var(--s3) var(--s4);
 		display: grid;
 		grid-template-columns: minmax(220px, 300px) 1fr;
 		gap: var(--s4);
@@ -278,6 +426,7 @@
 		flex-direction: column;
 		gap: var(--s2);
 		min-height: 0;
+		min-width: 0;
 		border-right: 1px solid var(--line);
 		padding-right: var(--s3);
 	}
@@ -286,6 +435,23 @@
 		display: flex;
 		align-items: baseline;
 		justify-content: space-between;
+		gap: var(--s2);
+	}
+
+	.tools {
+		display: flex;
+		align-items: center;
+		gap: var(--s1);
+		min-width: 0;
+	}
+
+	.order {
+		font-size: var(--text-xs);
+		color: var(--ink-muted);
+		border: 0;
+		background: none;
+		padding: 2px var(--s1);
+		max-width: 13ch;
 	}
 
 	h1 {
@@ -303,8 +469,27 @@
 		color: var(--ink);
 	}
 
+	/* Tegnet af os, ikke af browseren.
+	   Safari giver type="search" sit eget udseende — pilleform og forstørrelsesglas
+	   — og skifter til det almindelige, så snart feltet får fokus: ikonet forsvandt
+	   og formen blev firkantet midt i et klik. Med appearance: none er der kun én
+	   udgave, og den ser ens ud hele tiden. */
 	.search {
 		width: 100%;
+		appearance: none;
+		-webkit-appearance: none;
+		padding-left: 30px;
+		border-radius: 999px;
+		background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%238b918d' stroke-width='2' stroke-linecap='round'%3E%3Ccircle cx='11' cy='11' r='7'/%3E%3Cpath d='M20 20l-3.5-3.5'/%3E%3C/svg%3E");
+		background-repeat: no-repeat;
+		background-position: 9px center;
+		background-size: 15px 15px;
+	}
+
+	/* Safaris egen ryd-knap ville sidde oven i vores egen form. */
+	.search::-webkit-search-decoration,
+	.search::-webkit-search-cancel-button {
+		-webkit-appearance: none;
 	}
 
 	ul {
@@ -344,9 +529,14 @@
 		flex: 1;
 		min-width: 0;
 		text-align: left;
-		padding: var(--s2);
+		padding: var(--s2) var(--s2) var(--s3);
 		border-radius: var(--radius);
 		color: var(--ink-muted);
+		border-bottom: 1px solid var(--line);
+	}
+
+	li:last-child .row {
+		border-bottom: 0;
 	}
 
 	.row:hover {
@@ -358,28 +548,79 @@
 		color: var(--ink);
 	}
 
+	/* Samme størrelse som en opgavetitel. En note og en opgave er to ting af samme
+	   slags — noget, der står på en liste og skal læses på et blik — og at give dem
+	   hver sin størrelse får den ene til at se mindre vigtig ud end den anden. */
 	.row strong {
 		display: block;
 		font-size: var(--text-sm);
-		font-weight: 560;
+		font-weight: 600;
+		line-height: 1.45;
 		overflow: hidden;
 		text-overflow: ellipsis;
 		white-space: nowrap;
 	}
 
+	/* Dato og begyndelse på samme linje, som Apple Noter gør det. To linjer pr.
+	   note frem for tre, og datoen først, fordi det er den, man skanner efter. */
+	.under {
+		display: flex;
+		gap: var(--s2);
+		min-width: 0;
+		font-size: var(--text-xs);
+		color: var(--ink-faint);
+	}
+
+	.when {
+		flex: none;
+		color: var(--ink-muted);
+	}
+
 	.preview {
-		display: block;
-		font-size: var(--text-xs);
-		color: var(--ink-faint);
+		min-width: 0;
 		overflow: hidden;
 		text-overflow: ellipsis;
 		white-space: nowrap;
 	}
 
+	/* Hvor den ligger, med en mappe foran — Apple Noters egen måde at sige det på,
+	   og den eneste linje her, der ikke er notens eget indhold. */
+	.filed {
+		display: block;
+		margin-top: 2px;
+		font-size: var(--text-xs);
+		color: var(--ink-faint);
+	}
+
+	.filed::before {
+		content: '▸ ';
+		opacity: 0.7;
+	}
+
+	/* Noten er et ark, ikke en flade i appen.
+	 *
+	 * Apple Notes skriver på hvidt, og det er ikke pynt: et ark, der holder op et
+	 * sted, fortæller hvor teksten hører til, og skiller det, man skriver, fra det
+	 * program, man skriver det i. Uden det flød noten ud i siden og lignede endnu
+	 * en rude.
+	 *
+	 * `--surface` frem for `#fff`, fordi der er fem temaer. Rollen er "arket løftet
+	 * fra grunden" — hvid i lyst, cremet i paper, en anelse lysere end grunden i de
+	 * mørke. Et hårdkodet hvidt ville være et blændende ark i mørkt tema. */
 	.editor {
 		display: flex;
 		flex-direction: column;
 		min-height: 0;
+		min-width: 0;
+		background: var(--surface);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+		/* Luft nok til at teksten ikke rører kanten.
+		 *
+		 * Vandret vokser den med ruden: på en bred skærm skal et ark have marginer,
+		 * ikke bare en kant — clamp holder den mellem en rimelig mindste og en, der
+		 * ikke bliver til et vindue med tekst i midten. */
+		padding: var(--s4) clamp(var(--s4), 3.5%, var(--s6));
 	}
 
 	/* Everything below exists to keep two layers in lockstep. The shared rules are

web/src/routes/opgave/[id]/+page.svelte

@@ -0,0 +1,50 @@
+<script>
+	/**
+	 * A task, by address.
+	 *
+	 * There was no such thing until a note wanted to point at one. Opening a task
+	 * shows a drawer over whatever list you were on and changes nothing in the URL,
+	 * which is right for a click and useless for a link — you cannot send somebody a
+	 * task, and a note that mentions one has nowhere to send them either.
+	 *
+	 * So this opens the drawer and then steps aside, replacing itself with the
+	 * task's own project. The person lands where the task lives, with it open, and
+	 * the back button does not walk them through a page that only ever redirected.
+	 */
+	import { page } from '$app/stores';
+	import { goto } from '$app/navigation';
+	import { api } from '$lib/api.js';
+	import { app } from '$lib/stores.svelte.js';
+	import { t } from '$lib/i18n.svelte.js';
+
+	let status = $state('loading');
+
+	$effect(() => {
+		open($page.params.id);
+	});
+
+	async function open(id) {
+		if (!id) return;
+		try {
+			const task = await api.getTask(id);
+			app.openDetail(id);
+			// replaceState, so Back goes where they came from rather than here.
+			await goto(task.project_id ? `/projekt/${task.project_id}` : '/', { replaceState: true });
+		} catch {
+			// 404 for both "no such task" and "not yours", so an id tells a stranger
+			// nothing about whether it exists.
+			status = 'missing';
+		}
+	}
+</script>
+
+{#if status === 'missing'}
+	<p class="clear">{t('detail.notFound')}</p>
+{/if}
+
+<style>
+	.clear {
+		padding: var(--s4);
+		color: var(--ink-faint);
+	}
+</style>