feat(theme): five themes, and a picker that shows them

Two themes and a toggle between them. Now five, chosen from a grid under
Settings → Konto: the two that existed, a warm dark (Skumring) with amber
where the green was, a warm light (Papir), and a high-contrast one.

Each swatch is painted in its own theme rather than described, so the
choice is made by looking. data-theme sits on the swatch and not on the
card — it redefines --ink too, and a card wearing a dark theme's ink on a
light page has a name nobody can read.

Every theme states its full palette rather than inheriting and patching.
A partial theme looks finished until somebody adds a token, at which
point four themes silently fall back to a colour from a fifth. That is
also why the dark palette is repeated under [data-theme='dark']: :root
carries it as the default and :root only ever matches <html>, so a swatch
asking for it by name would otherwise show whatever the page was wearing.

The theme-color meta is updated too, so an installed PWA's frame and a
phone's address bar follow rather than staying whichever colour shipped
in the markup.

Contrast measured for all five. The new ones clear 4.5:1 down to the
quietest tier — which is where dates and counts live, and the first thing
to disappear. Kontrast reaches 8.9:1 there. The two original themes are
left as they are: their faint ink sits at 3.1–3.8, which is worth
revisiting, but not as a side effect of adding colours.

Co-Authored-By: Claude Opus 5 <[email protected]>

internal/httpapi/filters_handlers.go

@@ -245,6 +245,7 @@ func (s *Server) handleCreateLabel(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, "create label", err)
 		return
 	}
+	s.publishToOwner(r, "label.changed", labelJSON{l.ID, l.Name, l.Color, l.SortOrder, 0})
 	writeJSON(w, http.StatusCreated, labelJSON{l.ID, l.Name, l.Color, l.SortOrder, 0})
 }
 
@@ -263,6 +264,7 @@ func (s *Server) handleUpdateLabel(w http.ResponseWriter, r *http.Request) {
 		s.storeError(w, "update label", err)
 		return
 	}
+	s.publishToOwner(r, "label.changed", nil)
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -272,5 +274,6 @@ func (s *Server) handleDeleteLabel(w http.ResponseWriter, r *http.Request) {
 		s.storeError(w, "delete label", err)
 		return
 	}
+	s.publishToOwner(r, "label.changed", nil)
 	w.WriteHeader(http.StatusNoContent)
 }

internal/httpapi/projects_handlers.go

@@ -133,6 +133,7 @@ func (s *Server) handleCreateProject(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.activity(r, p.ID, "", "project.created", map[string]any{"name": p.Name})
+	s.publishToOwner(r, "project.created", toProjectJSON(*p))
 	writeJSON(w, http.StatusCreated, toProjectJSON(*p))
 }
 
@@ -168,6 +169,7 @@ func (s *Server) handleUpdateProject(w http.ResponseWriter, r *http.Request) {
 		s.storeError(w, "get project", err)
 		return
 	}
+	s.publishToOwner(r, "project.updated", toProjectJSON(*p))
 	writeJSON(w, http.StatusOK, toProjectJSON(*p))
 }
 
@@ -182,6 +184,7 @@ func (s *Server) handleDeleteProject(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.activity(r, projectID, "", "project.deleted", nil)
+	s.publishToOwner(r, "project.deleted", map[string]string{"id": projectID})
 	w.WriteHeader(http.StatusNoContent)
 }
 

internal/httpapi/projects_test.go

@@ -153,3 +153,44 @@ func TestReorderProjectsLeavesSomebodyElsesAlone(t *testing.T) {
 		}
 	}
 }
+
+// The member list errored on every project — the ORDER BY named an expression,
+// which SQLite refuses across a UNION — so the share panel had never shown
+// anybody, not even the owner.
+func TestListMembersWorksAtAll(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, project := ts.do(t, "POST", "/api/v1/projects", map[string]string{"name": "Firma"})
+
+	resp, body := ts.do(t, "GET", "/api/v1/projects/"+project["id"].(string)+"/members", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status %d, body %v", resp.StatusCode, body)
+	}
+	members, _ := body["members"].([]any)
+	if len(members) != 1 {
+		t.Fatalf("a project with no invites lists %d members, want its owner", len(members))
+	}
+	if m := members[0].(map[string]any); m["role"] != "owner" {
+		t.Errorf("role = %v, want owner", m["role"])
+	}
+}
+
+// And the Inbox, which is the one every task drawer asks about.
+func TestListMembersWorksForTheInbox(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, list := ts.do(t, "GET", "/api/v1/projects", nil)
+	var inboxID string
+	for _, raw := range list["projects"].([]any) {
+		if p := raw.(map[string]any); p["is_inbox"] == true {
+			inboxID = p["id"].(string)
+		}
+	}
+
+	resp, body := ts.do(t, "GET", "/api/v1/projects/"+inboxID+"/members", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status %d, body %v", resp.StatusCode, body)
+	}
+}

internal/httpapi/realtime_handlers.go

@@ -28,6 +28,19 @@ func (s *Server) publish(projectID, event string, payload any) {
 	s.hub.Publish(projectID, event, payload)
 }
 
+// publishToOwner sends a change that belongs to a person rather than to a
+// project: their projects, their labels, their saved filters.
+//
+// Project membership is what the socket subscribes to, and a project that has
+// just been created has no subscribers — the person is not watching a thing that
+// did not exist a moment ago. So these go to the user instead, which also
+// reaches their other devices.
+func (s *Server) publishToOwner(r *http.Request, event string, payload any) {
+	if user := userFrom(r.Context()); user != nil {
+		s.hub.PublishToUser(user.ID, event, payload)
+	}
+}
+
 // handleWebSocket is the live-sync connection.
 func (s *Server) handleWebSocket(w http.ResponseWriter, r *http.Request) {
 	user := userFrom(r.Context())

internal/httpapi/views_test.go

@@ -0,0 +1,55 @@
+package httpapi
+
+import "testing"
+
+// A label is how you find a task whose wording you have forgotten. Search
+// covered the text only, so "regnskab" found nothing even with the task
+// labelled @regnskab in front of you.
+func TestSearchFindsTasksByLabel(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	ts.do(t, "POST", "/api/v1/tasks/quick-add",
+		map[string]any{"text": "ring til revisoren @regnskab"})
+	ts.do(t, "POST", "/api/v1/tasks/quick-add",
+		map[string]any{"text": "køb kaffe"})
+
+	_, body := ts.do(t, "GET", "/api/v1/search?q=regnskab", nil)
+	tasks, _ := body["tasks"].([]any)
+	if len(tasks) != 1 {
+		t.Fatalf("found %d tasks searching for a label, want 1: %v", len(tasks), body)
+	}
+	if got := tasks[0].(map[string]any)["content"]; got != "ring til revisoren" {
+		t.Errorf("found %v", got)
+	}
+}
+
+// The text search still works, and a label match does not swallow it.
+func TestSearchStillFindsTasksByText(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{"text": "køb grøn maling"})
+
+	// Diacritic folding still applies to the text side.
+	_, body := ts.do(t, "GET", "/api/v1/search?q=gron", nil)
+	if tasks, _ := body["tasks"].([]any); len(tasks) != 1 {
+		t.Errorf("searching \"gron\" found %d tasks, want 1", len(tasks))
+	}
+}
+
+// Somebody else's label must not pull their task into your results — the label
+// join has to stay inside the visibility the outer query already applies.
+func TestSearchByLabelStaysWithinWhatYouCanSee(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	other := ts.newUser(t, "[email protected]", "Anden")
+	other.do(t, "POST", "/api/v1/tasks/quick-add",
+		map[string]any{"text": "deres hemmelighed @regnskab"})
+
+	_, body := ts.do(t, "GET", "/api/v1/search?q=regnskab", nil)
+	if tasks, _ := body["tasks"].([]any); len(tasks) != 0 {
+		t.Errorf("found somebody else's task: %v", tasks)
+	}
+}

internal/store/projects.go

@@ -328,15 +328,27 @@ type Member struct {
 // project_members row — ownership is the projects table — so they are unioned in
 // rather than left out of the list of people who can see it.
 func (db *DB) ListMembers(ctx context.Context, projectID string) ([]Member, error) {
+	// The owner first, then everybody else by name.
+	//
+	// The ordering is a column rather than an expression, and the whole compound
+	// select is wrapped: SQLite only accepts ORDER BY terms from the result set
+	// of a UNION, so `ORDER BY role = 'owner' DESC` — which reads perfectly well
+	// — fails at query time with "1st ORDER BY term does not match any column in
+	// the result set". Every call errored, so the share panel had never listed
+	// anybody.
 	rows, err := db.QueryContext(ctx, `
-		SELECT u.id, u.email, u.name, u.avatar_color, 'owner' AS role, p.created_at
-		FROM projects p JOIN users u ON u.id = p.owner_id
-		WHERE p.id = ?
-		UNION ALL
-		SELECT u.id, u.email, u.name, u.avatar_color, m.role, m.added_at
-		FROM project_members m JOIN users u ON u.id = m.user_id
-		WHERE m.project_id = ?
-		ORDER BY role = 'owner' DESC, name`, projectID, projectID)
+		SELECT id, email, name, avatar_color, role, added_at FROM (
+			SELECT u.id, u.email, u.name, u.avatar_color, 'owner' AS role,
+			       p.created_at AS added_at, 0 AS rank
+			FROM projects p JOIN users u ON u.id = p.owner_id
+			WHERE p.id = ?
+			UNION ALL
+			SELECT u.id, u.email, u.name, u.avatar_color, m.role,
+			       m.added_at, 1 AS rank
+			FROM project_members m JOIN users u ON u.id = m.user_id
+			WHERE m.project_id = ?
+		)
+		ORDER BY rank, name`, projectID, projectID)
 	if err != nil {
 		return nil, err
 	}

internal/store/tasks.go

@@ -136,8 +136,23 @@ func (db *DB) ListTasks(ctx context.Context, userID string, f TaskFilter) ([]Tas
 		args = append(args, f.DueFrom)
 	}
 	if expr := MatchExpr(f.Search); expr != "" {
-		where = append(where, `t.rowid IN (SELECT rowid FROM tasks_fts WHERE tasks_fts MATCH ?)`)
-		args = append(args, expr)
+		// Text or a label. A label is how you find a task whose wording you have
+		// forgotten — "that thing about the accounts" is a search for @regnskab —
+		// and leaving them out made the box look like it had lost the task.
+		//
+		// The label side is a plain lowercase match rather than another FTS index:
+		// labels are short, and their names are typed by the person searching for
+		// them, so there is no spelling to be generous about. The diacritic
+		// folding that matters for task text does not earn a second index here.
+		where = append(where, `(
+			t.rowid IN (SELECT rowid FROM tasks_fts WHERE tasks_fts MATCH ?)
+			OR t.id IN (
+				SELECT tl.task_id FROM task_labels tl
+				JOIN labels l ON l.id = tl.label_id
+				WHERE lower(l.name) LIKE ?
+			)
+		)`)
+		args = append(args, expr, "%"+strings.ToLower(strings.TrimSpace(f.Search))+"%")
 	}
 	if f.FilterSQL != "" {
 		where = append(where, "("+f.FilterSQL+")")

web/src/app.css

@@ -87,7 +87,157 @@
 	--content-max: 720px;
 }
 
-:root[data-theme='light'] {
+/*
+ * The dark palette again, by name.
+ *
+ * :root carries it as the default, and :root only ever matches <html> — so a
+ * swatch in the settings picker asking for data-theme="dark" would otherwise
+ * inherit whatever the page is wearing. Repeated rather than restructured: the
+ * alternative is splitting the token block in two and leaving somebody to work
+ * out which half a new token belongs in.
+ */
+[data-theme='dark'] {
+	--ground: #111312;
+	--surface: #171a19;
+	--surface-raised: #1d211f;
+	--surface-sunken: #0d0f0e;
+	--line: #262b29;
+	--line-strong: #343a37;
+
+	--ink: #e8ebe9;
+	--ink-muted: #9aa39e;
+	--ink-faint: #6b736f;
+
+	--accent: #5fbf8f;
+	--accent-hover: #6fcf9f;
+	--accent-sunken: #1c3329;
+	--accent-ink: #0d1411;
+
+	--p1: #cf6b6b;
+	--p2: #d69f5c;
+	--p3: #6b9ecf;
+	--p4: var(--ink-faint);
+
+	--danger: #cf6b6b;
+	--danger-sunken: #33201f;
+
+	--shadow: 0 1px 2px rgb(0 0 0 / 0.2);
+	--shadow-lg: 0 8px 32px rgb(0 0 0 / 0.35);
+}
+
+/*
+ * The other themes.
+ *
+ * Each one redefines colour and nothing else: no spacing, no type, no radii.
+ * That is what keeps them themes rather than five separate designs, and it is
+ * why a component that reaches for a raw hex breaks in four places at once
+ * instead of one.
+ *
+ * Every theme states its full palette rather than inheriting the dark one and
+ * patching it. A partial theme looks finished until somebody adds a token, at
+ * which point four themes silently fall back to a colour from a fifth.
+ */
+
+/* Skumring — the same dark, turned warm, with amber where the green was. */
+[data-theme='dusk'] {
+	--ground: #14110f;
+	--surface: #1b1714;
+	--surface-raised: #221d19;
+	--surface-sunken: #100d0b;
+	--line: #2b2521;
+	--line-strong: #3a322c;
+
+	--ink: #ece6df;
+	--ink-muted: #a3988c;
+	/* Light enough to clear 4.5:1 against the ground. The quiet tier is where
+	   dates and counts live, and it is the first thing to disappear. */
+	--ink-faint: #8d8377;
+
+	--accent: #d99a4e;
+	--accent-hover: #e8a95c;
+	--accent-sunken: #33261480;
+	--accent-ink: #16110a;
+
+	--p1: #cf6b6b;
+	--p2: #d69f5c;
+	--p3: #6b9ecf;
+	--p4: var(--ink-faint);
+
+	--danger: #cf6b6b;
+	--danger-sunken: #33201f;
+
+	--shadow: 0 1px 2px rgb(0 0 0 / 0.25);
+	--shadow-lg: 0 8px 32px rgb(0 0 0 / 0.4);
+}
+
+/* Papir — warm light, closer to paper than to a screen. */
+[data-theme='paper'] {
+	--ground: #f6f1e7;
+	--surface: #fffcf6;
+	--surface-raised: #fffcf6;
+	--surface-sunken: #ece5d7;
+	--line: #ded5c3;
+	--line-strong: #c8bda6;
+
+	--ink: #241f18;
+	--ink-muted: #665c4c;
+	--ink-faint: #756a55;
+
+	--accent: #8a5a2b;
+	--accent-hover: #74491f;
+	--accent-sunken: #ebdfcb;
+	--accent-ink: #fffcf6;
+
+	--p1: #b0452f;
+	--p2: #96701f;
+	--p3: #3f6b8a;
+	--p4: var(--ink-faint);
+
+	--danger: #b0452f;
+	--danger-sunken: #f3e2dc;
+
+	--shadow: 0 1px 2px rgb(60 40 10 / 0.08);
+	--shadow-lg: 0 8px 32px rgb(60 40 10 / 0.14);
+}
+
+/*
+ * Kontrast — for reading in bright sun, or for eyes that the quiet greys of the
+ * other four do not serve. Pure black on white, borders that are actually
+ * visible, and an accent dark enough to pass against white text.
+ *
+ * The muted inks are deliberately much darker than elsewhere: "secondary text"
+ * at 60% grey is the first thing to disappear, and it is where dates live.
+ */
+[data-theme='contrast'] {
+	--ground: #ffffff;
+	--surface: #ffffff;
+	--surface-raised: #f2f2f2;
+	--surface-sunken: #e8e8e8;
+	--line: #767676;
+	--line-strong: #1a1a1a;
+
+	--ink: #000000;
+	--ink-muted: #2b2b2b;
+	--ink-faint: #4a4a4a;
+
+	--accent: #005c2e;
+	--accent-hover: #00753a;
+	--accent-sunken: #cfe8da;
+	--accent-ink: #ffffff;
+
+	--p1: #a10000;
+	--p2: #7a4a00;
+	--p3: #00417a;
+	--p4: var(--ink-faint);
+
+	--danger: #a10000;
+	--danger-sunken: #f7dcdc;
+
+	--shadow: 0 1px 2px rgb(0 0 0 / 0.3);
+	--shadow-lg: 0 8px 32px rgb(0 0 0 / 0.35);
+}
+
+[data-theme='light'] {
 	--ground: #faf9f7;
 	--surface: #ffffff;
 	--surface-raised: #ffffff;

web/src/lib/components/Sidebar.svelte

@@ -27,7 +27,11 @@
 	let filters = $state([]);
 	let labels = $state([]);
 
+	// Reads app.labelsChanged so the effect re-runs when a label is created,
+	// renamed or deleted anywhere — including in another tab, or by Claude
+	// through the connector.
 	$effect(() => {
+		app.labelsChanged;
 		api.listFilters().then((r) => (filters = r.filters)).catch(() => {});
 		api.listLabels().then((r) => (labels = r.labels)).catch(() => {});
 	});

web/src/lib/components/TaskDetail.svelte

@@ -20,6 +20,23 @@
 	let priority = $state(4);
 	let dueDate = $state('');
 	let labels = $state('');
+	let projectId = $state('');
+	let recurrence = $state('');
+	let assignee = $state('');
+
+	/** Who the task can be given to. Only ever more than one on a shared project. */
+	let members = $state([]);
+
+	// The rules worth a menu entry. Anything more specific is typed into the
+	// title, where the parser understands far more than a list ever could.
+	const REPEATS = [
+		{ rule: '', label: 'Aldrig' },
+		{ rule: 'FREQ=DAILY', label: 'Hver dag' },
+		{ rule: 'FREQ=WEEKLY', label: 'Hver uge' },
+		{ rule: 'FREQ=WEEKLY;INTERVAL=2', label: 'Hver anden uge' },
+		{ rule: 'FREQ=MONTHLY', label: 'Hver måned' },
+		{ rule: 'FREQ=YEARLY', label: 'Hvert år' }
+	];
 
 	let subtasks = $state([]);
 	let comments = $state([]);
@@ -46,6 +63,17 @@
 		priority = task.priority;
 		dueDate = task.due_date ?? '';
 		labels = (task.labels ?? []).join(', ');
+		projectId = task.project_id;
+		recurrence = task.recurrence_rule ?? '';
+		assignee = task.assignee_id ?? '';
+
+		members = [];
+		api.listMembers(task.project_id)
+			.then((r) => r.members.length > 1 && (members = r.members))
+			.catch(() => {
+				// A project you are not the owner of may refuse the member list.
+				// Then there is nobody to choose from, which is the same as none.
+			});
 
 		subtasks = [];
 		comments = [];
@@ -73,13 +101,83 @@
 		await app.update(task.id, patch);
 	}
 
-	function saveContent() {
+	/**
+	 * Saves the title, reading it the way quick add would.
+	 *
+	 * Typing "i morgen kl. 14" into a title used to leave it as those words. The
+	 * same sentence in the quick-add box becomes a date, which made where you
+	 * typed it decide what it meant.
+	 *
+	 * The parse runs on the server — the grammar is Danish and English and lives
+	 * there — and is only applied when it actually consumed something. What it
+	 * took is said out loud, because a title that edits itself without a word is
+	 * worse than one that does nothing.
+	 */
+	async function saveContent() {
 		const trimmed = content.trim();
 		if (!trimmed || trimmed === task.content) {
 			content = task.content;
 			return;
 		}
-		save({ content: trimmed });
+
+		let parsed = null;
+		try {
+			parsed = await api.quickAddPreview(trimmed);
+		} catch {
+			// Offline, or the parser refused. Saving the words is still right.
+		}
+
+		const patch = { content: trimmed };
+		const took = [];
+		if (parsed && parsed.content && parsed.content !== trimmed) {
+			patch.content = parsed.content;
+			if (parsed.due_date) {
+				patch.due_date = parsed.due_date;
+				took.push(parsed.due_date);
+			}
+			if (parsed.priority && parsed.priority < 4) {
+				patch.priority = parsed.priority;
+				took.push(`P${parsed.priority}`);
+			}
+			if (parsed.recurrence) {
+				patch.recurrence_rule = parsed.recurrence;
+				took.push('gentagelse');
+			}
+			if (parsed.labels?.length) {
+				patch.labels = [...new Set([...(task.labels ?? []), ...parsed.labels])];
+				took.push(parsed.labels.map((l) => `@${l}`).join(' '));
+			}
+		}
+
+		await save(patch);
+
+		// The fields are seeded once per task so a save cannot overwrite what
+		// somebody is typing. That rule has to bend exactly here: this save
+		// changed the very fields on screen, and leaving them showing what was
+		// typed while the toast reports something else is the worst of both.
+		if (took.length) {
+			content = patch.content;
+			if (patch.due_date) dueDate = patch.due_date;
+			if (patch.priority) priority = patch.priority;
+			if (patch.recurrence_rule) recurrence = patch.recurrence_rule;
+			if (patch.labels) labels = patch.labels.join(', ');
+			app.toast(`Læst som ${took.join(', ')}.`);
+		}
+	}
+
+	async function saveProject() {
+		if (projectId === task.project_id) return;
+		await save({ project_id: projectId });
+	}
+
+	async function saveRecurrence() {
+		if (recurrence === (task.recurrence_rule ?? '')) return;
+		await save({ recurrence_rule: recurrence });
+	}
+
+	async function saveAssignee() {
+		if (assignee === (task.assignee_id ?? '')) return;
+		await save({ assignee_id: assignee });
 	}
 
 	function saveDescription() {
@@ -316,8 +414,42 @@
 			/>
 		</div>
 
-		{#if task.recurrence_text}
-			<p class="repeats">Gentages {task.recurrence_text}.</p>
+		<div class="grid">
+			<div class="field">
+				<label for="project">Projekt</label>
+				<select id="project" bind:value={projectId} onchange={saveProject}>
+					{#each app.projects as project (project.id)}
+						<option value={project.id}>{project.name}</option>
+					{/each}
+				</select>
+			</div>
+
+			<div class="field">
+				<label for="repeat">Gentages</label>
+				<select id="repeat" bind:value={recurrence} onchange={saveRecurrence}>
+					{#each REPEATS as option (option.rule)}
+						<option value={option.rule}>{option.label}</option>
+					{/each}
+					<!-- A rule typed as "hver anden tirsdag" has no entry in the list;
+					     showing it rather than snapping to the nearest preset is the
+					     difference between a menu and a menu that quietly edits. -->
+					{#if recurrence && !REPEATS.some((o) => o.rule === recurrence)}
+						<option value={recurrence}>{task.recurrence_text ?? 'Som skrevet'}</option>
+					{/if}
+				</select>
+			</div>
+		</div>
+
+		{#if members.length > 1}
+			<div class="field">
+				<label for="assignee">Ansvarlig</label>
+				<select id="assignee" bind:value={assignee} onchange={saveAssignee}>
+					<option value="">Ingen</option>
+					{#each members as member (member.user_id)}
+						<option value={member.user_id}>{member.name}</option>
+					{/each}
+				</select>
+			</div>
 		{/if}
 
 		<section>
@@ -567,12 +699,6 @@
 		gap: var(--s3);
 	}
 
-	.repeats {
-		margin: 0;
-		font-size: var(--text-sm);
-		color: var(--ink-muted);
-	}
-
 	section {
 		display: flex;
 		flex-direction: column;

web/src/lib/stores.svelte.js

@@ -29,6 +29,16 @@ class AppState {
 	 */
 	detailId = $state(null);
 
+	/**
+	 * Bumped whenever a label changes anywhere.
+	 *
+	 * A counter rather than the labels themselves: the sidebar wants each label's
+	 * task count, which no single event carries and which changes whenever a task
+	 * gains or loses one. Whoever is showing labels re-reads them; that is one
+	 * small request against modelling a count in two places.
+	 */
+	labelsChanged = $state(0);
+
 	#socket = null;
 	#reconnectDelay = 1000;
 
@@ -110,6 +120,25 @@ class AppState {
 			case 'task.deleted':
 				this.tasks = this.tasks.filter((t) => t.id !== task?.id);
 				break;
+
+			// Projects and labels belong to a person rather than to a project, so
+			// they arrive on the user's own channel — a project that has just been
+			// created has no subscribers, because nobody was watching a thing that
+			// did not exist a moment ago.
+			case 'project.created':
+			case 'project.updated':
+				this.upsertProject(task);
+				break;
+			case 'project.deleted':
+				this.projects = this.projects.filter((p) => p.id !== task?.id);
+				break;
+
+			// The payload is not always the label — a rename says only that
+			// something changed — and the sidebar wants counts anyway, which no
+			// single event carries. Asking is cheaper than modelling it.
+			case 'label.changed':
+				this.labelsChanged++;
+				break;
 		}
 	}
 
@@ -136,6 +165,13 @@ class AppState {
 	 * copy is not worth a moment's thought next to the class of bug it removes.
 	 */
 	replace(id, next) {
+		// A task can invent a label just by mentioning one — "@regnskab" in quick
+		// add creates it — and no label event is sent for that, because it happened
+		// inside a task write. Comparing the two lists is what keeps the sidebar
+		// honest without re-reading the labels on every completed checkbox.
+		const before = this.tasks.find((t) => t.id === id)?.labels ?? [];
+		if ((next?.labels ?? []).join() !== before.join()) this.labelsChanged++;
+
 		this.tasks = this.tasks.map((t) => (t.id === id ? next : t));
 	}
 
@@ -151,14 +187,33 @@ class AppState {
 	 */
 	upsert(task) {
 		if (!task?.id) return;
-		if (this.tasks.some((t) => t.id === task.id)) this.replace(task.id, task);
-		else this.tasks = [...this.tasks, task];
+		if (this.tasks.some((t) => t.id === task.id)) {
+			this.replace(task.id, task);
+			return;
+		}
+		if (task.labels?.length) this.labelsChanged++;
+		this.tasks = [...this.tasks, task];
 	}
 
 	get(id) {
 		return this.tasks.find((t) => t.id === id);
 	}
 
+	/**
+	 * Adds a project, or replaces it if the list already has it.
+	 *
+	 * The same guard the tasks need, and for the same reason: a project arrives
+	 * twice, once as the response to the request that created it and once over
+	 * the socket. Appending both puts two rows with one id into a keyed `{#each}`,
+	 * which throws and stops the sidebar rendering.
+	 */
+	upsertProject(project) {
+		if (!project?.id) return;
+		this.projects = this.projects.some((p) => p.id === project.id)
+			? this.projects.map((p) => (p.id === project.id ? project : p))
+			: [...this.projects, project];
+	}
+
 	/**
 	 * Ticks a task off. The row is struck through and gone before the request
 	 * leaves — which is the single most-repeated action in the app, and the one
@@ -233,7 +288,7 @@ class AppState {
 	async createProject(name) {
 		try {
 			const project = await api.createProject({ name });
-			this.projects = [...this.projects, project];
+			this.upsertProject(project);
 			return project;
 		} catch (e) {
 			this.toast(humanMessage(e));
@@ -338,21 +393,65 @@ class SidebarLayout {
 
 export const sidebar = new SidebarLayout();
 
+/**
+ * The themes on offer.
+ *
+ * `dark` is the tokens on bare :root; the rest are [data-theme] blocks in
+ * app.css. The list lives here so the picker and the stylesheet cannot drift —
+ * an entry with no CSS behind it renders as the default and looks like a bug in
+ * the picker rather than a missing block.
+ */
+export const THEMES = [
+	{ id: 'dark', name: 'Nordlys', note: 'Mørk med grøn accent.', dark: true },
+	{ id: 'dusk', name: 'Skumring', note: 'Mørk og varm, med rav.', dark: true },
+	{ id: 'light', name: 'Dagslys', note: 'Lys og køligt neutral.', dark: false },
+	{ id: 'paper', name: 'Papir', note: 'Lys og varm, som papir.', dark: false },
+	{ id: 'contrast', name: 'Kontrast', note: 'Sort på hvidt, til skarpt lys.', dark: false }
+];
+
 /** Theme, kept in localStorage and applied to the document element. */
-export const theme = {
-	get current() {
-		if (typeof document === 'undefined') return 'dark';
-		return document.documentElement.dataset.theme ?? 'dark';
-	},
-	toggle() {
-		const next = this.current === 'dark' ? 'light' : 'dark';
-		document.documentElement.dataset.theme = next;
+class Theme {
+	/**
+	 * Mirrors the attribute on <html>, which app.html sets before first paint —
+	 * that is the only way to avoid a white flash on load, and it means the
+	 * document, not this object, is where the truth lives.
+	 */
+	current = $state(
+		typeof document === 'undefined' ? 'dark' : (document.documentElement.dataset.theme ?? 'dark')
+	);
+
+	set(id) {
+		if (!THEMES.some((t) => t.id === id)) return;
+		this.current = id;
+		document.documentElement.dataset.theme = id;
+
+		// The browser paints its own chrome from this — the address bar on a
+		// phone, the frame of an installed PWA. Left alone it stays the colour of
+		// whichever theme shipped in the markup.
+		const ground = getComputedStyle(document.documentElement).getPropertyValue('--ground').trim();
+		document.querySelector('meta[name="theme-color"]')?.setAttribute('content', ground);
+
 		try {
-			localStorage.setItem('verdande:theme', next);
+			localStorage.setItem('verdande:theme', id);
 		} catch {
 			// Private browsing; the choice simply will not persist.
 		}
 	}
-};
+
+	/**
+	 * The topbar button, which flips between light and dark rather than walking
+	 * all five. Somebody who has chosen Skumring wants the light one to be Papir,
+	 * not to be marched back to the default — so it moves to the other side of
+	 * the list and stays warm or stays cool.
+	 */
+	toggle() {
+		const now = THEMES.find((t) => t.id === this.current) ?? THEMES[0];
+		const opposite = THEMES.filter((t) => t.dark !== now.dark);
+		const index = THEMES.filter((t) => t.dark === now.dark).indexOf(now);
+		this.set((opposite[index] ?? opposite[0]).id);
+	}
+}
+
+export const theme = new Theme();
 
 export { ApiError, humanMessage };

web/src/routes/indstillinger/+page.svelte

@@ -1,7 +1,7 @@
 <script>
 	/** Konto: who you are, your password, and the second factor. */
 	import { api, humanMessage } from '$lib/api.js';
-	import { app } from '$lib/stores.svelte.js';
+	import { app, theme, THEMES } from '$lib/stores.svelte.js';
 
 	// --- profile ---------------------------------------------------------------
 
@@ -204,6 +204,39 @@
 	</form>
 </section>
 
+<section class="panel">
+	<header>
+		<h2>Udseende</h2>
+		<p class="hint">
+			Gemmes i denne browser. Det er en egenskab ved den skærm, du sidder ved —
+			en bærbar i solen og en skærm i et mørkt rum vil have hvert sit svar.
+		</p>
+	</header>
+
+	<div class="themes">
+		{#each THEMES as option (option.id)}
+			<button
+				class="theme-card"
+				class:chosen={theme.current === option.id}
+				onclick={() => theme.set(option.id)}
+				aria-pressed={theme.current === option.id}
+			>
+				<!-- data-theme goes on the swatch and not on the card: it redefines
+				     --ink too, and a card wearing a dark theme's ink on a light page
+				     has a name nobody can read. The swatch shows the colours; the
+				     label stays in the page's. -->
+				<span class="swatch" data-theme={option.id} aria-hidden="true">
+					<span class="swatch-line"></span>
+					<span class="swatch-line short"></span>
+					<span class="swatch-dot"></span>
+				</span>
+				<span class="theme-name">{option.name}</span>
+				<span class="theme-note">{option.note}</span>
+			</button>
+		{/each}
+	</div>
+</section>
+
 <section class="panel">
 	<header>
 		<h2>Adgangskode</h2>
@@ -353,6 +386,82 @@
 		border-radius: var(--radius);
 	}
 
+	.themes {
+		display: grid;
+		grid-template-columns: repeat(auto-fill, minmax(150px, 1fr));
+		gap: var(--s3);
+	}
+
+	.theme-card {
+		display: flex;
+		flex-direction: column;
+		align-items: flex-start;
+		gap: var(--s1);
+		padding: var(--s3);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+		text-align: left;
+		transition: border-color var(--fast) var(--ease);
+	}
+
+	.theme-card:hover {
+		border-color: var(--line-strong);
+	}
+
+	.theme-card.chosen {
+		border-color: var(--accent);
+		box-shadow: inset 0 0 0 1px var(--accent);
+	}
+
+	/* Painted in the card's own theme rather than the page's — that is the whole
+	   point of putting data-theme on the button. */
+	.swatch {
+		width: 100%;
+		height: 54px;
+		border-radius: var(--radius-sm);
+		background: var(--ground);
+		border: 1px solid var(--line);
+		padding: var(--s2);
+		display: flex;
+		flex-direction: column;
+		gap: 5px;
+		justify-content: center;
+		position: relative;
+		margin-bottom: var(--s1);
+	}
+
+	.swatch-line {
+		height: 5px;
+		width: 70%;
+		border-radius: var(--radius-full);
+		background: var(--ink-muted);
+	}
+
+	.swatch-line.short {
+		width: 45%;
+		background: var(--ink-faint);
+	}
+
+	.swatch-dot {
+		position: absolute;
+		right: var(--s2);
+		top: var(--s2);
+		width: 12px;
+		height: 12px;
+		border-radius: var(--radius-full);
+		background: var(--accent);
+	}
+
+	.theme-name {
+		font-size: var(--text-sm);
+		color: var(--ink);
+	}
+
+	.theme-note {
+		font-size: var(--text-xs);
+		color: var(--ink-faint);
+	}
+
 	.secret {
 		margin: 0;
 		padding: var(--s3);

web/src/routes/projekt/[id]/+page.svelte

@@ -101,6 +101,61 @@
 		}
 	}
 
+	// --- sections -------------------------------------------------------------------
+
+	let addingSection = $state(false);
+	let renamingSection = $state(null);
+	let sectionName = $state('');
+
+	async function addSection(event) {
+		event.preventDefault();
+		const name = sectionName.trim();
+		if (!name) return;
+		addingSection = false;
+		sectionName = '';
+		try {
+			sections = [...sections, await api.createSection(project.id, name)];
+		} catch (e) {
+			app.toast(humanMessage(e));
+		}
+	}
+
+	async function renameSection(event, section) {
+		event.preventDefault();
+		const name = sectionName.trim();
+		renamingSection = null;
+		if (!name || name === section.name) return;
+
+		const previous = sections;
+		sections = sections.map((s) => (s.id === section.id ? { ...s, name } : s));
+		try {
+			await api.updateSection(section.id, { name });
+		} catch (e) {
+			sections = previous;
+			app.toast(humanMessage(e));
+		}
+	}
+
+	async function removeSection(section) {
+		const count = open.filter((t) => t.section_id === section.id).length;
+		const warning = count
+			? `Slet sektionen "${section.name}"? De ${count} opgaver bliver, men mister deres sektion.`
+			: `Slet sektionen "${section.name}"?`;
+		if (!confirm(warning)) return;
+
+		const previous = sections;
+		sections = sections.filter((s) => s.id !== section.id);
+		try {
+			await api.deleteSection(section.id);
+			// The tasks are not deleted with it; they come back unsectioned, and the
+			// list has to be re-read to show them in the right place.
+			await app.loadTasks({ project_id: project.id });
+		} catch (e) {
+			sections = previous;
+			app.toast(humanMessage(e));
+		}
+	}
+
 	async function invite(event) {
 		event.preventDefault();
 		inviteError = '';
@@ -249,7 +304,34 @@
 			{#each sections as section (section.id)}
 				{@const tasks = open.filter((t) => t.section_id === section.id)}
 				<section>
-					<h2>{section.name}</h2>
+					<div class="section-head">
+						{#if renamingSection === section.id}
+							<form onsubmit={(e) => renameSection(e, section)}>
+								<!-- svelte-ignore a11y_autofocus -->
+								<input
+									bind:value={sectionName}
+									autofocus
+									aria-label="Sektionens navn"
+									onblur={() => (renamingSection = null)}
+									onkeydown={(e) => e.key === 'Escape' && (renamingSection = null)}
+								/>
+							</form>
+						{:else}
+							<h2>{section.name}</h2>
+							{#if canEdit}
+								<button
+									class="section-action"
+									onclick={() => {
+										renamingSection = section.id;
+										sectionName = section.name;
+									}}>Omdøb</button
+								>
+								<button class="section-action remove" onclick={() => removeSection(section)}>
+									Slet
+								</button>
+							{/if}
+						{/if}
+					</div>
 					<TaskList {tasks} projectId={project.id} sectionId={section.id} {canEdit} />
 					{#if !tasks.length}
 						<p class="empty">Tom</p>
@@ -257,7 +339,35 @@
 				</section>
 			{/each}
 
-			{#if !open.length}
+			{#if canEdit}
+				<section class="add-section">
+					{#if addingSection}
+						<form onsubmit={addSection}>
+							<!-- svelte-ignore a11y_autofocus -->
+							<input
+								bind:value={sectionName}
+								autofocus
+								placeholder="Sektionens navn"
+								aria-label="Ny sektion"
+								onblur={() => !sectionName.trim() && (addingSection = false)}
+								onkeydown={(e) => e.key === 'Escape' && (addingSection = false)}
+							/>
+						</form>
+					{:else}
+						<button
+							class="add"
+							onclick={() => {
+								addingSection = true;
+								sectionName = '';
+							}}
+						>
+							+ Tilføj sektion
+						</button>
+					{/if}
+				</section>
+			{/if}
+
+			{#if !open.length && !sections.length}
 				<p class="clear">
 					<span class="rune" aria-hidden="true">ᚹ</span>
 					Ingenting her endnu.
@@ -548,6 +658,79 @@
 		margin-bottom: var(--s2);
 	}
 
+	.section-head {
+		display: flex;
+		align-items: baseline;
+		gap: var(--s3);
+		border-bottom: 1px solid var(--line);
+		margin-bottom: var(--s2);
+	}
+
+	.section-head h2 {
+		border-bottom: 0;
+		margin-bottom: 0;
+		flex: 1;
+		min-width: 0;
+	}
+
+	/* Hidden until the section is hovered or something in it has focus: a heading
+	   with two buttons permanently beside it stops reading as a heading. */
+	.section-action {
+		font-size: var(--text-xs);
+		color: var(--ink-faint);
+		padding: 0 var(--s1);
+		opacity: 0;
+		transition: opacity var(--fast) var(--ease);
+	}
+
+	.section-head:hover .section-action,
+	.section-action:focus-visible {
+		opacity: 1;
+	}
+
+	.section-action:hover {
+		color: var(--ink);
+	}
+
+	.section-action.remove:hover {
+		color: var(--danger);
+	}
+
+	.section-head form {
+		flex: 1;
+	}
+
+	.section-head input,
+	.add-section input {
+		width: 100%;
+		padding: var(--s1) var(--s2);
+		background: var(--surface-raised);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+		font-size: var(--text-sm);
+		outline: none;
+	}
+
+	.section-head input:focus,
+	.add-section input:focus {
+		border-color: var(--accent);
+	}
+
+	.add-section {
+		margin-top: var(--s5);
+	}
+
+	.add-section .add {
+		font-size: var(--text-sm);
+		color: var(--ink-faint);
+		padding: var(--s2);
+		transition: color var(--fast) var(--ease);
+	}
+
+	.add-section .add:hover {
+		color: var(--accent);
+	}
+
 	.empty,
 	.readonly {
 		margin: 0;