Merge pull request #103 from kristianwind/alarm-i-saetningen

feat(opgaver): alarmen kan tales ind, og kan være standard

.gitea/workflows/ci.yml

@@ -97,7 +97,13 @@ jobs:
       # -race is the whole point of running tests in CI for a server with a
       # WebSocket fan-out: a data race is exactly the bug that passes locally.
       - name: Test
-        run: go test -race -count=1 ./...
+        # -timeout, fordi internal/httpapi nærmer sig Go's standardgrænse på 600s:
+        # 498s i CI på #95, 656s på udviklingsmaskinen. Når den krydser, er
+        # beskeden "panic: test timed out after 10m0s" plus et goroutine-dump, og
+        # det læser som en deadlock i koden frem for som en suite, der blev for
+        # stor. Grænsen er der stadig; den er bare sat et sted, hvor den betyder
+        # "noget hænger" i stedet for "maskinen var langsom i dag".
+        run: go test -race -count=1 -timeout 20m ./...
 
       - name: Build
         run: CGO_ENABLED=0 go build ./...
@@ -271,3 +277,17 @@ jobs:
           set -eu
           docker buildx create --use --name ci-verdande 2>/dev/null || docker buildx use ci-verdande
           docker buildx build --platform linux/amd64 --output type=cacheonly .
+          # Begge udgaver, fordi EDITION rører den sidste stage: en Dockerfile, der
+          # ikke længere bygger med den, skal fejle her og ikke på et mærkat.
+          docker buildx build --platform linux/amd64 --build-arg EDITION=notes --output type=cacheonly .
+
+      # Hvad der IKKE er her, og hvorfor, så den næste læser ikke tror det er glemt:
+      # GitHubs ci.yml har et trin, der henter begge images ind i daemonen og
+      # påstår, at de deler alle lag — altså at verdande og urd bærer samme binær.
+      # Det kræver `--load` to gange, og det er et halvt minut per image på en
+      # runner, der deles med Yggdrasils produktionscontainere og allerede har
+      # dræbt en kørsel på hukommelse (exit 137). Påstanden er den samme kode
+      # begge steder, så det er nok at evaluere den ét sted — og GitHub er
+      # autoritativ for de offentlige projekter.
+      #
+      # Det, der SKAL være her, er ovenstående: at begge varianter kan bygges.

.github/workflows/ci.yml

@@ -40,7 +40,13 @@ jobs:
       # -race is the whole point of running tests in CI for a server with a
       # WebSocket fan-out: a data race is exactly the bug that passes locally.
       - name: Test
-        run: go test -race -count=1 ./...
+        # -timeout, fordi internal/httpapi nærmer sig Go's standardgrænse på 600s:
+        # 498s i CI på #95, 656s på udviklingsmaskinen. Når den krydser, er
+        # beskeden "panic: test timed out after 10m0s" plus et goroutine-dump, og
+        # det læser som en deadlock i koden frem for som en suite, der blev for
+        # stor. Grænsen er der stadig; den er bare sat et sted, hvor den betyder
+        # "noget hænger" i stedet for "maskinen var langsom i dag".
+        run: go test -race -count=1 -timeout 20m ./...
 
       - name: Build
         run: CGO_ENABLED=0 go build ./...
@@ -117,9 +123,59 @@ jobs:
       # Build only — publishing happens on a tag, in release.yml. This job exists
       # so a Dockerfile that no longer builds fails on the pull request rather
       # than at release time.
+      #
+      # Loaded into the local daemon rather than discarded, because the step below
+      # has to inspect what came out.
       - uses: docker/build-push-action@v6
         with:
           context: .
           push: false
+          load: true
+          tags: verdande:ci
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          load: true
+          tags: urd:ci
+          build-args: EDITION=notes
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # The claim this repository makes about urd is that it is the same program,
+      # not a fork — and that claim is checkable rather than a sentence in a README.
+      #
+      # Stages 1 and 2 are identical for both builds, and the edition is set with
+      # ENV, which is image *config* rather than a layer. So the two images must
+      # have the same layer digests and differ only in that one variable. A change
+      # that made them diverge — a second COPY, a conditional RUN, a separate build
+      # of the binary — would quietly turn "one source" into two, and the only
+      # symptom would be a bug fixed in one product and not the other.
+      #
+      # This was impossible until the frontend build became deterministic: SvelteKit
+      # put Date.now() in version.json, so no two builds ever matched. See the note
+      # in web/svelte.config.js.
+      - name: The two images are one build
+        run: |
+          set -eu
+          layers() { docker image inspect "$1" --format '{{json .RootFS.Layers}}'; }
+          if [ "$(layers verdande:ci)" != "$(layers urd:ci)" ]; then
+            echo "The verdande and urd images do not share their layers:"
+            layers verdande:ci
+            layers urd:ci
+            echo "They are built from one source, so this is either a Dockerfile that"
+            echo "now builds the binary twice, or a stage that is no longer shared."
+            exit 1
+          fi
+          echo "Shared layers: $(layers verdande:ci | tr ',' '\n' | wc -l)"
+
+          # And the half that stops the check above from passing over two identical
+          # images: they must actually differ in the one way they are supposed to.
+          edition() { docker image inspect "$1" --format '{{json .Config.Env}}' | tr ',' '\n' | grep VERDANDE_EDITION; }
+          echo "verdande: $(edition verdande:ci)"
+          echo "urd:      $(edition urd:ci)"
+          edition verdande:ci | grep -q 'VERDANDE_EDITION=full'
+          edition urd:ci | grep -q 'VERDANDE_EDITION=notes'

.gitignore

@@ -44,6 +44,11 @@ node_modules.nosync/
 # End-to-end runs: the throwaway instance the suite starts, the saved session it
 # signs in with, and whatever a failure left behind.
 /web/.playwright-data/
+# Noter-udgavens egen instans i prøvekørslen. Den har sin egen database OG sin
+# egen secret.key, og den nåede at blive committet én gang: et mønster, der
+# nævner den ene mappe ved navn, dækker ikke den anden, selv om de er to kopier
+# af det samme.
+/web/.playwright-data-notes/
 /web/e2e/.auth/
 /web/test-results/
 /web/playwright-report/

Dockerfile

@@ -20,6 +20,14 @@ FROM --platform=$BUILDPLATFORM node:22-alpine AS web
 WORKDIR /src
 COPY web/ ./
 
+# Passed into the frontend build, because SvelteKit's default build version is
+# `Date.now()` — a millisecond that landed in version.json, in index.html and in
+# the service worker, changed the content hash of every chunk referencing them, and
+# so changed those chunks' filenames. Every build of one commit produced different
+# bytes. See the long note in web/svelte.config.js.
+ARG VERSION=dev
+ENV VERDANDE_VERSION=${VERSION}
+
 # The frontend is built when it is present. During backend-only development it is
 # not, and the build must still produce a working image rather than failing on a
 # missing directory — so this stage falls back to a placeholder page. The Go stage
@@ -58,6 +66,12 @@ ARG TARGETARCH=amd64
 # CGO off is what makes this binary static, and it is only possible because the
 # SQLite driver is pure Go. -trimpath and the empty buildid keep the output
 # reproducible; -s -w drop the symbol and DWARF tables, which is most of the size.
+#
+# "Reproducible" was false for a year and nobody read the sentence that said it:
+# the flags above do their job, and the frontend embedded below carried a
+# millisecond timestamp, so every build of one commit produced a different binary.
+# Fixed in web/svelte.config.js, and CI now asserts that the two images' layers
+# match rather than trusting this comment.
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build \
         -tags embedweb \
         -trimpath \
@@ -65,8 +79,27 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build \
         -o /verdande ./cmd/verdande
 
 # --- 3. what actually ships --------------------------------------------------
+#
+# Two images come out of this stage, and the only difference between them is one
+# environment variable:
+#
+#     docker build .                          → verdande
+#     docker build --build-arg EDITION=notes  → urd
+#
+# Stages 1 and 2 are byte-identical for both, so the binary in the two images is
+# the same build rather than a rebuild that happens to match. That is the point:
+# urd is not a fork, and "built from the same source" is a property of the layers
+# instead of a sentence in a README. ENV is image *config* rather than a layer, so
+# the two images share every layer digest and differ only in that config — which CI
+# asserts on every pull request.
 FROM gcr.io/distroless/static-debian12:nonroot
 
+# Declared here as well as used here: an ARG is scoped to the stage it appears in,
+# so one above the FROM above would be invisible down here. `full` by default,
+# because that is what this program has always been and an unqualified build must
+# not quietly produce the other product.
+ARG EDITION=full
+
 # SQLite writes timestamps and verdande resolves due dates in the user's timezone,
 # so the container needs a tz database and CA certificates for outbound SMTP.
 COPY --from=build /usr/local/go/lib/time/zoneinfo.zip /zoneinfo.zip
@@ -78,7 +111,8 @@ COPY --from=build /verdande /verdande
 # nightly backups.
 VOLUME ["/data"]
 ENV VERDANDE_DATA_DIR=/data \
-    VERDANDE_ADDR=:8080
+    VERDANDE_ADDR=:8080 \
+    VERDANDE_EDITION=${EDITION}
 
 EXPOSE 8080
 USER nonroot:nonroot

README.md

@@ -15,6 +15,23 @@
 Not what has been, and not what is fated to be: the thing you are in the middle of.
 Which is what a to-do list is.
 
+## Two editions: verdande and urd
+
+This repository builds one program with two faces. Start it with
+`VERDANDE_EDITION=notes` and it is **urd** — notes and nothing else: the task
+routes are not mounted, the sidebar has no way to them, and the program calls
+itself urd in its tab, its wordmark and its web manifest.
+
+Urðr is Verðandi's sister in Völuspá, and the poem has the Norns cutting marks into
+wood. Verdande is what is becoming; urd is what has become and was kept.
+
+Not a fork, because the two share everything that is hard — accounts, sharing,
+passkeys, the realtime socket, search, backups, migrations — and notes are about a
+twentieth of the Go here. A test walks both routers and fails in either direction,
+so "the task routes are not there" is measured rather than promised — 63 routes and
+five of nine MCP tools. See
+[Two editions](docs/editions.md).
+
 ## Status
 
 All six phases are built. See [What works today](#what-works-today) for what is

cmd/verdande/main.go

@@ -26,6 +26,9 @@ var version = "dev"
 
 func main() {
 	if err := run(); err != nil {
+		// Not the edition's name: this fires before the configuration is read, so
+		// the edition is not known yet — and one of the things it reports is a
+		// VERDANDE_EDITION the program refused.
 		fmt.Fprintf(os.Stderr, "verdande: %v\n", err)
 		os.Exit(1)
 	}
@@ -37,7 +40,9 @@ func run() error {
 		return err
 	}
 	log := httpapi.NewLogger(cfg.Dev)
-	log.Info("starting verdande", "version", version, "data_dir", cfg.DataDir, "base_url", cfg.BaseURL)
+	// The edition's own name, so an urd instance's log says urd. The full edition
+	// still logs "starting verdande", which is what the release check reads.
+	log.Info("starting "+cfg.ProductSlug(), "version", version, "data_dir", cfg.DataDir, "base_url", cfg.BaseURL, "edition", cfg.Edition)
 
 	// The data volume is the only state that matters; create the whole layout up
 	// front so a failure here is a startup error rather than a surprise at the

docs/beacon.md

@@ -1,6 +1,7 @@
 # The install count
 
-verdande reports that it exists. Two values, once a day:
+verdande reports that it exists — and so does urd, which is the same program in
+its [notes edition](editions.md). Two values, once a day:
 
 ```json
 {
@@ -11,7 +12,8 @@ verdande reports that it exists. Two values, once a day:
 
 That is the whole message. No IP is stored by the collector, no hostname, no
 domain, no account, no counts of anything you have made, nothing about what you
-use it for. The payload is small enough to be printed in full on the settings page,
+use it for — and not which of the two editions is running, so the count does not
+tell the two apart either. The payload is small enough to be printed in full on the settings page,
 and it is printed there — a promise about telemetry is worth exactly as much as
 your ability to check it.
 

docs/configuration.md

@@ -11,6 +11,7 @@ nowhere to put one that the operator would ever see.
 | `VERDANDE_ADDR` | `:8080` | Listen address. |
 | `VERDANDE_DATA_DIR` | `/data` | Database, uploaded files and backups. |
 | `VERDANDE_DEV` | `false` | Human-readable logs at debug level, and a relaxed origin check so a Vite dev server can connect. Never in production. |
+| `VERDANDE_EDITION` | `full` | Which of the two editions this instance is. `full` is verdande — tasks, projects and notes. `notes` is urd: the task routes are not mounted at all, and the program calls itself urd. Any other value refuses to start, by name. See [Two editions](editions.md). |
 
 ## Behind a proxy
 

docs/editions.md

@@ -0,0 +1,205 @@
+# Two editions: verdande and urd
+
+One program, built once, with two faces.
+
+| | **verdande** | **urd** |
+|---|---|---|
+| What it is | Tasks, projects and notes | Notes |
+| `VERDANDE_EDITION` | `full` (the default) | `notes` |
+| Routes served | 200 | 137 |
+| Mark | ᚹ | ᚢ |
+
+Set `VERDANDE_EDITION=notes` and the instance is urd: the task routes are not
+mounted, the sidebar has no way to them, search answers with notes only, and the
+program calls itself urd in its tab, its wordmark and its web manifest.
+
+## Running the notes edition
+
+There is one image. The edition is an environment variable on the container:
+
+```
+docker run -e VERDANDE_EDITION=notes -v urd-data:/data -p 8080:8080 \
+    ghcr.io/kristianwind/verdande:latest
+```
+
+No second image and no rune of its own, deliberately.
+
+The edition is for an operator who wants an instance that genuinely has no task
+routes — the routes are absent from the router, not hidden in the interface. It is
+**not** how urd is normally reached. That is the second door, below.
+
+Two details that surprise people who look inside:
+
+- **The binary is called `/verdande`** and the database file is `verdande.db`, in
+  both editions. Not an oversight: it is the same binary, and renaming the file per
+  edition would be a migration hazard in exchange for nothing a user sees.
+- **The icons for both editions ship in the one image.** The server decides which
+  to serve at `/icon.svg`, because Safari looks for `apple-touch-icon.png` by name
+  and never reads the manifest, so renaming paths would have left iOS with the
+  wrong mark.
+
+## The second door: two apps, one instance
+
+urd is normally reached at **`/urd`** on an ordinary verdande. One instance, one
+database, one login, one set of links between notes and tasks — and two things you
+can install.
+
+| | verdande | urd |
+|---|---|---|
+| entry | `/` | `/urd` |
+| manifest | `/manifest.webmanifest` | `/urd.webmanifest` |
+| manifest `id` | `/` | `/urd` |
+| tab and mark | verdande, ᚹ | urd, ð |
+| database, account, login | the same | the same |
+
+An operating system does not install a URL, it installs a **manifest**, and the
+identity of an installed app is that manifest's `id`. Two manifests on one origin
+with different ids are two apps; two URLs sharing one manifest are one app with a
+bookmark. That is the whole mechanism.
+
+The shell is served per door rather than patched by JavaScript after the page
+loads, because iOS reads the page's `<head>` when somebody taps Add to Home Screen
+— and Safari looks for `apple-touch-icon` **by name**, having historically ignored
+the manifest's icons altogether.
+
+urd's manifest is built from verdande's rather than written beside it, so the
+fields the two genuinely share — the colours, the display mode, the language —
+come from one place and cannot drift. Six keys are changed: `id`, `start_url`,
+`scope`, the two names and the icons. An icon in the built manifest that urd has no
+file for stops the server rather than being passed through, because the symptom
+would otherwise be urd's install prompt quietly showing Verdande's mark.
+
+### The face is a preference, not a gate
+
+Entering at `/urd` makes that **window** wear urd's face: its mark, its name, its
+tab. It is kept strictly apart from the notes edition in the code, and the
+distinction is the one thing worth reading twice:
+
+| | what it means | what follows |
+|---|---|---|
+| `notesOnly` | the server has no task routes | a **guard** — the interface must not fetch them, they answer 404 |
+| `urdFace` | this window came in through the urd door | a **preference** — the routes are there, the data is yours, only the name differs |
+
+Conflate them and the urd face starts hiding data rather than chrome: a notebook
+would stop showing its tasks because somebody chose a different entrance. A test
+asserts the opposite directly — the urd window still gets 200 from
+`/api/v1/tasks`.
+
+The face lives in `sessionStorage`, not `localStorage`, and that is what lets the
+two apps be two apps: they share an origin, so they share localStorage, cookies and
+the service worker. `sessionStorage` is per window, and an installed PWA is its own
+window. It survives a reload, which it must — after the first navigation the
+address is `/noter` and nobody passes through `/urd` again.
+
+!!! note "One thing the two doors cannot have separately"
+    Theme, typeface and text size are shared, because they are in the localStorage
+    the origin shares. That was a deliberate choice: splitting them per face would
+    mean migrating everybody's stored settings for a difference few people want.
+
+## Moving between the two, measured
+
+A `/data` directory moves between the editions in **both directions, losslessly**.
+Same binary, same schema, same migrations — so this is not a feature that was built,
+it is a property that was checked:
+
+| step | result |
+|---|---|
+| verdande creates a notebook, a note in it, and a task | 1 note, 1 task |
+| the same directory, `VERDANDE_EDITION=notes` | `needs_setup: false` — same account. The note keeps its title, its body **and its `project_id`**. `/api/v1/tasks` → 404 |
+| the same directory, back to `full` | the task is still there; so is the note |
+
+The ownership stayed at the panel's service account through all three.
+
+So the way to move notes is to change the variable. `GET /export/notes.zip` is for
+getting notes **into other programs** — it writes one `.md` per note and carries the
+body and nothing else: no notebook, no sharing, no attachments, no pinned flag. That
+is the right division of labour, because the database already holds those.
+
+!!! note "The task rows stay"
+    An instance run as `notes` still has its tasks in the database; they are simply
+    not served. Harmless on a fresh instance, dead weight on a converted one — and
+    worth knowing before handing a converted instance to somebody else.
+
+## Why one codebase and not a fork
+
+The two share everything that is hard: accounts, sessions, passkeys, sharing,
+invitations, the realtime socket, search, the backup format, the migrations. Notes
+are about a twentieth of the Go in this repository and reference no task type;
+tasks reference no note type. A fork would have duplicated the other nineteen
+twentieths in order to separate the one — and then every security fix would have
+needed applying twice, by hand, forever.
+
+So the split is a configuration value read in one place, and the thing that keeps
+it honest is a test rather than a convention: `TestNotesEditionServesOnlyItsOwnRoutes`
+walks both routers, compares them against a written-down list of the 63 withheld
+routes, and fails in **both** directions — a route that appears in the notes
+edition and a route that stops being withheld are both a failure.
+
+## An unknown value refuses to start
+
+`VERDANDE_EDITION=note`, `Notes` and `none` are all rejected at startup, by name,
+rather than being treated as "not notes".
+
+The silent direction is the dangerous one here. An operator who sets up an instance
+for notes and mistypes the value would otherwise get every task route served on it,
+with no error anywhere and no way to tell from the outside.
+
+## What urd does not have
+
+The 63 withheld routes:
+
+| | what |
+|---|---|
+| 29 | tasks, sub-tasks, labels, saved filters, reminders, the upcoming and delegated views |
+| 8 | the CalDAV server — every route in it reads or writes a VTODO |
+| 1 | `/.well-known/caldav`, which is a claim that a CalDAV server is here |
+| 1 | the ICS calendar feed, plus 2 for the token it is reached with |
+| 4 | the task exports: `tasks.ics`, `projects.zip`, and a project's `.csv` and `.ics` |
+| 2 | the Todoist and CSV imports, which create tasks |
+| 4 | project templates — a template is a project plus sections plus tasks |
+| 5 | sections, which group tasks: `section_id` is a column on `tasks` and not on `notes` |
+| 6 | the AI task features: split, tidy the inbox, and the day's plan |
+| 1 | the inbox hook, which pushes a line of text in as a task |
+
+Plus five of the nine MCP tools — `search_tasks`, `create_task`, `update_task`,
+`complete_task` and `add_comment`. The endpoint is still there; the tool list is
+shorter. A tool a model can call is a surface, and one that answers "there are no
+tasks" is worse than one that does not exist: the model tries it, gets an empty
+answer, and tells the person there is nothing to do.
+
+Everything else is the same program:
+
+- accounts, invitations, passkeys and two-factor
+- projects — which in urd are what a note belongs to
+- per-note sharing with other people, independent of projects
+- search, over notes
+- export, of notes
+- the mail, calendar and MCP surfaces, minus their task routes and task tools
+- AI settings, `ask`, and the note actions
+
+!!! warning "Still being decided"
+    Four connectors are reachable in urd today and have not been settled either
+    way, because each has a plausible notes reading and withholding them would be
+    deciding what this product is rather than closing a hole: the mail-in address,
+    IMAP mailboxes, Gmail, and Google Calendar. They currently file what they
+    receive as **tasks**, so in urd they connect and then have nowhere to put
+    anything. The same applies to one handler rather than a route:
+    `POST /api/v1/ai/notes/{noteID}/actions/apply` creates tasks from a note.
+
+## The name
+
+Verðandi and Urðr are two of the three Norns in Völuspá, and the poem has them
+cutting marks into wood — the act of writing something down. Verdande is what is
+becoming; Urd is what has become and was kept.
+
+An instance started without the task routes is a different product to the person
+using it, so it says a different name. That name is read from the configuration in
+one place (`Config.ProductName`), which is why there is no build-time flag and no
+second frontend: the frontend is byte-identical in both editions, and the server
+renames the two files a browser reads before any JavaScript runs — the HTML shell's
+title and the web manifest.
+
+!!! note "The beacon counts them separately"
+    Both editions report the same two values once a day — instance id and version
+    — and nothing else; see [The install count](beacon.md). The edition is not in
+    the payload, so the count does not distinguish them.

docs/openapi.yaml

@@ -53,7 +53,7 @@ paths:
   /api/v1/auth/setup:
     get:
       tags: [auth]
-      summary: Whether this instance still needs its first account.
+      summary: What this instance is, and whether it still needs its first account.
       security: []
       responses:
         "200":
@@ -64,6 +64,16 @@ paths:
                 type: object
                 properties:
                   needs_setup: { type: boolean }
+                  edition:
+                    type: string
+                    enum: [full, notes]
+                    description: >
+                      `full` is tasks, projects and notes together. `notes` is
+                      the notes half: the task routes are not mounted at all, so
+                      an instance that is not a task manager cannot be asked to
+                      be one through its API. The interface reads this before
+                      anybody is signed in, because it decides what there is to
+                      show rather than what this person may see.
     post:
       tags: [auth]
       summary: Create the first account, which becomes the administrator.
@@ -263,6 +273,49 @@ paths:
         "204": { description: Saved. }
         "400": { $ref: "#/components/responses/BadRequest" }
 
+  /api/v1/auth/default-reminder:
+    put:
+      tags: [auth]
+      summary: The account's standing alarm on tasks that have a clock.
+      description: |
+        Reminders have always had to be set one at a time: a task written as
+        "i morgen kl 9" got a time and no alarm, because nothing creates a reminder
+        by itself. That is the right default for a task with no clock — there is no
+        moment to ring at — and an errand you walk every time for a task with one.
+
+        `minutes` is relative to the due moment and **negative for before it**, the
+        same convention `reminders.offset_min` uses because that is the column the
+        value ends up in: the store adds it to the due time. `0` is exactly at the
+        due moment. `null` turns the default off, which is where every account
+        starts — switching it on for everybody in a migration would have meant
+        alarms nobody asked for, on tasks already lying there.
+
+        A positive number is refused. An alarm after the thing it is warning about
+        is not a reminder, and accepting one here would make the single mistake this
+        value can make — a sign the wrong way round — look like a choice.
+
+        The default never stacks on an alarm the task already has, and a task can
+        opt out as it is written with "ingen alarm" in the quick-add line.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                minutes:
+                  type: [integer, "null"]
+                  maximum: 0
+                  minimum: -10080
+                  description: |
+                    Minutes relative to the due moment, negative for before it.
+                    Null is off.
+                  example: -10
+      responses:
+        "204": { description: Saved. }
+        "400": { $ref: "#/components/responses/BadRequest" }
+        "422": { $ref: "#/components/responses/Validation" }
+
   /api/v1/auth/nav-order:
     put:
       tags: [auth]
@@ -848,6 +901,20 @@ paths:
                 project_id:
                   type: string
                   description: Where it goes when the text names no project.
+                section_id:
+                  type: string
+                  description: >
+                    The section the box was opened in. A "/section" in the text
+                    wins, because typing it is a choice and standing there is a
+                    circumstance.
+                parent_id:
+                  type: string
+                  description: >
+                    Makes it a sub-task. A sub-task lives in its parent's
+                    project, so a "#project" on the same line is not honoured —
+                    it comes back as `unknown_project` rather than being
+                    silently dropped. Dates, labels and priority are read the
+                    same way as for any other line.
       responses:
         "201":
           description: Created
@@ -3143,6 +3210,40 @@ paths:
                   to: { type: string, format: date }
         "422": { $ref: "#/components/responses/Validation" }
 
+  /api/v1/export/projects.zip:
+    get:
+      tags: [projects]
+      summary: Every project's tasks as a CSV, in a zip.
+      description: >
+        One CSV per project, in the column layout Todoist writes — so the files
+        import into Todoist and into anything else that reads that shape. A zip
+        rather than one wide file because that is the shape on the other side,
+        and because a single project can be lifted out of it without opening a
+        spreadsheet. The per-project link does the same for one project; this is
+        the whole account in one download.
+      responses:
+        "200":
+          description: A zip archive.
+          content:
+            application/zip:
+              schema: { type: string, format: binary }
+
+  /api/v1/export/tasks.ics:
+    get:
+      tags: [projects]
+      summary: Every dated task as a calendar of VTODOs.
+      description: >
+        One file, not a zip: a calendar is made to hold many things, and each
+        task carries its project with it, so nothing is lost by putting them
+        together. Tasks without a due date are left out — a VTODO with no date
+        is a line most readers drop on the floor.
+      responses:
+        "200":
+          description: An iCalendar file.
+          content:
+            text/calendar:
+              schema: { type: string }
+
   /api/v1/export/notes.zip:
     get:
       tags: [notes]
@@ -4743,6 +4844,17 @@ components:
             never null: a client that has to check for both an absent array and an
             empty one will one day check for only one of them.
           example: ["labels"]
+        default_reminder_min:
+          type: [integer, "null"]
+          description: |
+            The account's standing alarm on tasks that have a clock, as minutes
+            relative to the due moment and negative for before it. Null is off,
+            which is where every account starts.
+
+            A type union rather than a number with a sentinel, because zero is a
+            real setting here — an alarm exactly at the due moment — so "off" and
+            "at the time" have to stay different answers.
+          example: -10
         created_at: { type: string, format: date-time }
 
     RecoveryCodes:
@@ -4933,6 +5045,21 @@ components:
                 task is still created, in the Inbox — a thought is not thrown away
                 over a typo — but the caller is told, because the alternative is
                 that the name vanishes from the title and nothing says why.
+            unknown_section:
+              type: string
+              description: |
+                The same, for a `/section` that no section of the project the task
+                landed in answers to. The task is created without a section.
+            reminder_not_set:
+              type: string
+              description: |
+                Present when the line asked to be reminded and the task has
+                nothing to count back from — "mind mig en time før" on a task with
+                a day but no clock. The offset form of a reminder fires relative to
+                the due moment, so without one the row would sit in the table and
+                never go off. The task is created; the alarm is not, and this says
+                so. An alarm that silently never rings is the one way a reminder
+                must not fail, because nothing afterwards reveals it.
 
     ParsedTask:
       type: object
@@ -4944,6 +5071,28 @@ components:
         due_date: { type: string, format: date }
         due_datetime: { type: string, format: date-time }
         recurrence: { type: string }
+        reminder_offset_min:
+          type: integer
+          description: |
+            When to be told, as minutes relative to the due moment: negative for
+            before it, zero for at it. Absent when the line asked for no alarm.
+            Relative rather than absolute, so moving the task moves its alarm with
+            it. Mind the sign — the store adds this to the due time, so "an hour
+            before" is -60.
+        no_reminder:
+          type: boolean
+          description: |
+            The line said it wants no alarm on this one — "ingen alarm". It exists
+            because of the account-wide default: with alarms on for everything that
+            has a clock, there has to be a way to say "not this one" in the same
+            breath as writing it, rather than creating the task, opening it and
+            deleting the alarm just made.
+        reminder_at:
+          type: string
+          description: |
+            An absolute alarm, `YYYY-MM-DDTHH:MM`, set when the line gave the
+            reminder a clock of its own. It takes the day the task is due: "mind
+            mig kl 8" about something due Friday means Friday at eight.
         labels:
           type: array
           items: { type: string }

internal/config/config.go

@@ -38,6 +38,28 @@ type Config struct {
 	// Empty means a key file beside the data — see internal/secret.
 	SecretKey string
 
+	// Edition decides which half of the program this instance serves.
+	//
+	// "full" is tasks, projects and notes together — what Verdande has always
+	// been. "notes" mounts the notes half and the base underneath it, and leaves
+	// the task routes unmounted: not hidden in the interface, absent from the
+	// router, so an instance that is not a task manager cannot be asked to be one
+	// through its API.
+	//
+	// Notes already stand nearly alone — they reference no task type anywhere in
+	// the store, and the one link between the halves is a `note_links` row whose
+	// kind happens to be "task". What is NOT separable is everything underneath
+	// both: accounts, sessions, invites, sharing, notifications, attachments,
+	// search. Hence one program with two faces rather than two programs: the
+	// alternative is two copies of the base, and two copies of a thing is how the
+	// copies start to disagree.
+	//
+	// Projects stay mounted in both. In the notes edition a project is a
+	// notebook — the same column, the same sharing, a different word — because a
+	// second grouping concept beside `note_shares` would be a second thing to keep
+	// in step for a difference nobody can see.
+	Edition string
+
 	// UpdateCheck asks GitHub whether a newer release exists. Off unless asked
 	// for: a self-hosted app that reaches out without being told to has broken
 	// the deal its operator made by self-hosting.
@@ -136,6 +158,7 @@ func Load() (*Config, error) {
 		PanelServerID:      env("VERDANDE_PANEL_SERVER_ID", ""),
 		GmailClientSecret:  env("VERDANDE_GMAIL_CLIENT_SECRET", ""),
 		SecretKey:          env("VERDANDE_SECRET_KEY", ""),
+		Edition:            env("VERDANDE_EDITION", EditionFull),
 		UpdateCheck:        envBool("VERDANDE_UPDATE_CHECK", false),
 	}
 
@@ -171,6 +194,19 @@ func Load() (*Config, error) {
 		return nil, fmt.Errorf("VERDANDE_DATA_DIR: %w", err)
 	}
 
+	// Afvist frem for gætte. En stavefejl — "note", "Notes" — ville ellers falde
+	// tilbage til den fulde udgave og servere opgaveruterne på en instans, der
+	// blev sat op for ikke at have dem. Det er den stille retning af fejlen, og
+	// den eneste måde at opdage den på ville være at bemærke, at noget virker,
+	// som ikke burde.
+	switch c.Edition {
+	case EditionFull, EditionNotes:
+	case "":
+		c.Edition = EditionFull
+	default:
+		return nil, fmt.Errorf("VERDANDE_EDITION: %q is not %q or %q", c.Edition, EditionFull, EditionNotes)
+	}
+
 	c.RealIPHeader = env("VERDANDE_REAL_IP_HEADER", "X-Forwarded-For")
 	if c.TrustedProxies, err = parseTrustedProxies(env("VERDANDE_TRUSTED_PROXIES", "")); err != nil {
 		return nil, err

internal/config/edition.go

@@ -0,0 +1,46 @@
+package config
+
+// The two faces of the program. Strings rather than a bool, because a bool named
+// `NotesOnly` answers one question and this one will be asked again — and a
+// third edition would mean changing every reading of it rather than adding a case.
+const (
+	EditionFull  = "full"
+	EditionNotes = "notes"
+)
+
+// NotesOnly is the one question the router asks. Written as a method so the
+// comparison lives in one place: `cfg.Edition == "notes"` spelled out at twenty
+// call sites is twenty chances to typo a string the compiler does not check.
+func (c *Config) NotesOnly() bool { return c.Edition == EditionNotes }
+
+// ProductName and ProductSlug are the two forms of the name the running instance
+// calls itself: "Urd" in a sentence, "urd" in a window title, a wordmark and a
+// manifest.
+//
+// Two editions of one program, two names — which is the whole reason the name is
+// read from the configuration rather than written into the templates. Verdande is
+// what is happening now; Urd, its sister in Völuspá, is what was cut into the wood
+// and kept. An instance started without the task routes is a different product to
+// whoever uses it, and a product that calls itself by its sibling's name is not a
+// product, it is a flag somebody set.
+//
+// The lowercase form is deliberate and not a styling accident: the wordmark, the
+// repository and the window title are all lowercase, so the slug is the name and
+// ProductName is the one that gets a capital because it stands in prose.
+func (c *Config) ProductName() string {
+	if c.NotesOnly() {
+		return "Urd"
+	}
+	return "Verdande"
+}
+
+// ProductSlug is ProductName lowercased, kept as its own method rather than as
+// strings.ToLower at the call sites: the two are the same transformation today and
+// a name that does not lowercase cleanly would otherwise be a bug in every caller
+// at once.
+func (c *Config) ProductSlug() string {
+	if c.NotesOnly() {
+		return "urd"
+	}
+	return "verdande"
+}

internal/config/edition_test.go

@@ -0,0 +1,44 @@
+package config
+
+import (
+	"testing"
+)
+
+// A typo in VERDANDE_EDITION must stop the program, not fall through to the full
+// edition. That is the silent direction of this fault: an instance set up to be a
+// notes program would serve every task route, and the only way to notice would be
+// to spot that something works which should not.
+func TestUnknownEditionIsRefused(t *testing.T) {
+	for _, tc := range []struct {
+		value string
+		want  string // the edition we expect, or "" when Load must fail
+	}{
+		{"", EditionFull}, // unset is the full program, as it has always been
+		{EditionFull, EditionFull},
+		{EditionNotes, EditionNotes},
+		{"note", ""},  // a letter short
+		{"Notes", ""}, // the right word, the wrong case
+		{"none", ""},  // plausible and meaning nothing
+	} {
+		t.Setenv("VERDANDE_EDITION", tc.value)
+		t.Setenv("VERDANDE_DATA_DIR", t.TempDir())
+
+		got, err := Load()
+		if tc.want == "" {
+			if err == nil {
+				t.Errorf("VERDANDE_EDITION=%q was accepted and gave %q", tc.value, got.Edition)
+			}
+			continue
+		}
+		if err != nil {
+			t.Errorf("VERDANDE_EDITION=%q: %v", tc.value, err)
+			continue
+		}
+		if got.Edition != tc.want {
+			t.Errorf("VERDANDE_EDITION=%q gave %q, want %q", tc.value, got.Edition, tc.want)
+		}
+		if notes := got.NotesOnly(); notes != (tc.want == EditionNotes) {
+			t.Errorf("VERDANDE_EDITION=%q: NotesOnly() = %v", tc.value, notes)
+		}
+	}
+}

internal/httpapi/auth_handlers.go

@@ -33,7 +33,14 @@ type userJSON struct {
 	// opposite case and stays in localStorage.
 	SidebarCollapsed []string `json:"sidebar_collapsed"`
 	NavOrder         []string `json:"nav_order"`
-	CreatedAt        string   `json:"created_at"`
+	// DefaultReminderMin is the account's standing alarm on tasks that have a
+	// clock, as minutes relative to the due moment and negative for before it.
+	// Null is off, which is where every account starts.
+	//
+	// A pointer rather than a number with a sentinel, so that "off" and "at the
+	// due moment" stay different answers: zero is a real setting here.
+	DefaultReminderMin *int   `json:"default_reminder_min"`
+	CreatedAt          string `json:"created_at"`
 }
 
 func toUserJSON(u *store.User) userJSON {
@@ -51,7 +58,8 @@ func toUserJSON(u *store.User) userJSON {
 		ID: u.ID, Email: u.Email, Name: u.Name, AvatarColor: u.AvatarColor,
 		Timezone: u.Timezone, Locale: u.Locale, IsAdmin: u.IsAdmin,
 		TOTPEnabled: u.TOTPEnabled, SidebarCollapsed: collapsed, NavOrder: order,
-		CreatedAt: u.CreatedAt.Format(time.RFC3339),
+		DefaultReminderMin: u.DefaultReminderMin,
+		CreatedAt:          u.CreatedAt.Format(time.RFC3339),
 	}
 }
 
@@ -112,6 +120,40 @@ func (s *Server) handleSetNavOrder(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusNoContent)
 }
 
+// handleSetDefaultReminder turns the account's standing alarm on or off.
+//
+// `minutes` is relative to the due moment and negative for before it, which is the
+// convention reminders.offset_min uses because that is the column it lands in. Null
+// is off. A positive number is refused: an alarm AFTER the thing it is warning
+// about is not a reminder, and allowing it here would make the one mistake this
+// value can make — a sign the wrong way round — look like a choice.
+func (s *Server) handleSetDefaultReminder(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Minutes *int `json:"minutes"`
+	}
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	if req.Minutes != nil {
+		switch {
+		case *req.Minutes > 0:
+			writeFieldErrors(w, map[string]string{"minutes": "must be zero or negative — an alarm comes before"})
+			return
+		// A week is the outer edge of "remind me ahead of this"; beyond it the
+		// number is far more likely to be a unit mistake than an intention.
+		case *req.Minutes < -7*24*60:
+			writeFieldErrors(w, map[string]string{"minutes": "must be within a week of the due time"})
+			return
+		}
+	}
+	user := userFrom(r.Context())
+	if err := s.db.SetDefaultReminder(r.Context(), user.ID, req.Minutes); err != nil {
+		s.storeError(w, r, "set default reminder", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
 // --- sign in -----------------------------------------------------------------
 
 type loginRequest struct {
@@ -492,7 +534,14 @@ func (s *Server) handleSetupState(w http.ResponseWriter, r *http.Request) {
 		s.internal(w, r, "count users", err)
 		return
 	}
-	writeJSON(w, http.StatusOK, map[string]bool{"needs_setup": n == 0})
+	// Udgaven hører til her og ikke på /auth/me: den er en egenskab ved
+	// instansen, ikke ved den, der er logget ind, og fladen skal kende den, før
+	// nogen er. Det her er i forvejen kaldet, der spørger "hvad er det her for en
+	// instans", så den følger med uden en ekstra tur.
+	writeJSON(w, http.StatusOK, struct {
+		NeedsSetup bool   `json:"needs_setup"`
+		Edition    string `json:"edition"`
+	}{n == 0, s.edition()})
 }
 
 func (s *Server) startSession(w http.ResponseWriter, r *http.Request, user *store.User) {

internal/httpapi/csp.go

@@ -36,7 +36,18 @@ func scriptHashes(web fs.FS) []string {
 	if err != nil {
 		return nil
 	}
+	return scriptHashesIn(raw)
+}
 
+// scriptHashesIn is the same thing over bytes that are already in hand.
+//
+// It exists because the notes edition does not serve the index.html that is on
+// disk — it serves a renamed copy of it (see shell.go) — and the policy has to
+// describe the bytes that actually leave the server. Hashing the file while
+// serving something else is the shape of mistake that cannot be noticed locally:
+// the policy is not enforced for a page opened from a file, so the page is blank
+// in production and nowhere else.
+func scriptHashesIn(raw []byte) []string {
 	var out []string
 	seen := map[string]bool{}
 	for _, match := range inlineScript.FindAllStringSubmatchIndex(string(raw), -1) {

internal/httpapi/edition.go

@@ -0,0 +1,16 @@
+package httpapi
+
+import "github.com/kristianwind/verdande/internal/config"
+
+// edition is what this instance tells the world it is.
+//
+// Never the empty string, even when the config was built by hand in a test and
+// never went through config.Load: a flade that reads "" cannot tell "this is the
+// full program" from "this build forgot to say", and the first of those is the
+// answer that has always been true.
+func (s *Server) edition() string {
+	if s.cfg.NotesOnly() {
+		return config.EditionNotes
+	}
+	return config.EditionFull
+}

internal/httpapi/edition_test.go

@@ -0,0 +1,375 @@
+package httpapi
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/kristianwind/verdande/internal/config"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// The notes edition is a different program, and this is what makes that true.
+//
+// A gate in a route tree is the easiest thing in the world to believe and the
+// hardest to see: the code reads `if full {`, somebody confirms the mechanism
+// exists, and nothing ever asks whether it covers the routes it was written for.
+// So this does not check that a gate is *present*. It walks both routers and
+// compares the two sets of routes they actually serve.
+//
+// The difference is written down below. A route added later that differs between
+// the editions — in either direction — fails here until somebody says which half
+// it belongs to. That is the point: the list is the decision, and the walk is
+// what keeps the decision honest.
+func TestNotesEditionServesOnlyItsOwnRoutes(t *testing.T) {
+	full := routesOf(t, config.EditionFull)
+	notes := routesOf(t, config.EditionNotes)
+
+	// Every route the full edition has and the notes edition does not. Written as
+	// the whole list rather than a prefix rule: a prefix is a description of what
+	// somebody meant, and this has to be a description of what is there.
+	//
+	// And note what this list could NOT catch, because it is the shape of mistake
+	// that outlived the first version of this test. The list went green at 29
+	// routes for two merges while CalDAV, the ICS feed, the inbox hook, four task
+	// exports, both task imports, the project templates, the sections and six AI
+	// task endpoints were all still served by the notes edition — because the test
+	// compares the router against THIS LIST, and the list was written from the
+	// routes somebody had thought of. It is a drift check, and it cannot be an
+	// is-it-complete check.
+	//
+	// So when a route is added that one edition should not have, the question to
+	// ask is not "does the walk still pass" but "can this endpoint do anything at
+	// all without the half it is being withheld from". Three of the ones above were
+	// settled by reading rather than by the name: a template turned out to create
+	// tasks (CreateProjectFromTemplate), `section_id` turned out to exist on
+	// `tasks` and not on `notes`, and add_comment turned out to hang off a task.
+	withheld := map[string]bool{}
+	for _, r := range []string{
+		"DELETE /api/v1/filters/{filterID}",
+		"DELETE /api/v1/labels/{labelID}",
+		"DELETE /api/v1/reminders/{reminderID}",
+		"DELETE /api/v1/sections/{sectionID}",
+		"DELETE /api/v1/tasks/{taskID}",
+		"DELETE /api/v1/templates/{templateID}",
+		"DELETE /caldav/{userID}/{projectID}/{taskFile}",
+		"GET /.well-known/caldav",
+		"GET /api/v1/ai/plan",
+		"GET /api/v1/delegated",
+		"GET /api/v1/export/projects.zip",
+		"GET /api/v1/export/projects/{projectID}.csv",
+		"GET /api/v1/export/projects/{projectID}.ics",
+		"GET /api/v1/export/tasks.ics",
+		"GET /api/v1/feed",
+		"GET /api/v1/filters",
+		"GET /api/v1/filters/preview",
+		"GET /api/v1/filters/{filterID}/tasks",
+		"GET /api/v1/labels",
+		"GET /api/v1/projects/{projectID}/sections",
+		"GET /api/v1/tasks",
+		"GET /api/v1/tasks/quick-add/preview",
+		"GET /api/v1/tasks/{taskID}",
+		"GET /api/v1/tasks/{taskID}/comments",
+		"GET /api/v1/tasks/{taskID}/reminders",
+		"GET /api/v1/templates",
+		"GET /api/v1/upcoming",
+		"GET /caldav/{userID}/{projectID}/{taskFile}",
+		"GET /ics/{token}",
+		"OPTIONS /caldav/*",
+		"PATCH /api/v1/filters/{filterID}",
+		"PATCH /api/v1/labels/{labelID}",
+		"PATCH /api/v1/sections/{sectionID}",
+		"PATCH /api/v1/tasks/{taskID}",
+		"POST /api/v1/ai/inbox/tidy",
+		"POST /api/v1/ai/inbox/tidy/apply",
+		"POST /api/v1/ai/plan/now",
+		"POST /api/v1/ai/tasks/{taskID}/split",
+		"POST /api/v1/feed/rotate",
+		"POST /api/v1/filters",
+		"POST /api/v1/import/csv",
+		"POST /api/v1/import/todoist",
+		"POST /api/v1/labels",
+		"POST /api/v1/projects/{projectID}/sections",
+		"POST /api/v1/projects/{projectID}/sections/reorder",
+		"POST /api/v1/tasks",
+		"POST /api/v1/tasks/quick-add",
+		"POST /api/v1/tasks/{taskID}/attachments",
+		"POST /api/v1/tasks/{taskID}/comments",
+		"POST /api/v1/tasks/{taskID}/complete",
+		"POST /api/v1/tasks/{taskID}/move",
+		"POST /api/v1/tasks/{taskID}/reminders",
+		"POST /api/v1/tasks/{taskID}/reopen",
+		"POST /api/v1/tasks/{taskID}/snooze",
+		"POST /api/v1/templates",
+		"POST /api/v1/templates/{templateID}/use",
+		"POST /inbound/hook/{token}",
+		"PROPFIND /caldav",
+		"PROPFIND /caldav/{userID}",
+		"PROPFIND /caldav/{userID}/{projectID}",
+		"PUT /api/v1/ai/plan",
+		"PUT /caldav/{userID}/{projectID}/{taskFile}",
+		"REPORT /caldav/{userID}/{projectID}",
+	} {
+		withheld[r] = true
+	}
+
+	var unexpected, stillThere []string
+	for r := range full {
+		if notes[r] {
+			if withheld[r] {
+				stillThere = append(stillThere, r)
+			}
+			continue
+		}
+		if !withheld[r] {
+			unexpected = append(unexpected, r)
+		}
+	}
+	// And the other direction: the notes edition must not grow a route the full
+	// one lacks. A gate that adds is not a gate either.
+	var onlyInNotes []string
+	for r := range notes {
+		if !full[r] {
+			onlyInNotes = append(onlyInNotes, r)
+		}
+	}
+
+	sort.Strings(unexpected)
+	sort.Strings(stillThere)
+	sort.Strings(onlyInNotes)
+	for _, r := range unexpected {
+		t.Errorf("withheld from the notes edition but not written down here: %s", r)
+	}
+	for _, r := range stillThere {
+		t.Errorf("listed as withheld and still served by the notes edition: %s", r)
+	}
+	for _, r := range onlyInNotes {
+		t.Errorf("served only by the notes edition: %s", r)
+	}
+
+	// Printed on the green as well as the red. "The editions differ correctly" over
+	// zero withheld routes and over twenty-nine are the same pass, and only one of
+	// them means anything — so the number is on screen either way.
+	t.Logf("full: %d routes · notes: %d · withheld: %d", len(full), len(notes), len(full)-len(notes))
+
+	// The half that stops this being a deletion rather than a gate: what the notes
+	// edition is FOR has to still be there.
+	for _, must := range []string{
+		"GET /api/v1/notes",
+		"POST /api/v1/notes",
+		"PATCH /api/v1/notes/{noteID}",
+		"DELETE /api/v1/notes/{noteID}",
+		// Deling er hele grunden til at det er et selvstændigt produkt frem for en
+		// enkeltbrugers notesblok, så den halvdel skal navngives her.
+		"POST /api/v1/notes/{noteID}/shares",
+		"GET /api/v1/notes/{noteID}/shares",
+		"POST /api/v1/notes/{noteID}/attachments",
+		"POST /api/v1/notes/import",
+		"GET /api/v1/export/notes.zip",
+		"GET /api/v1/export/account",
+		"POST /api/v1/ai/notes/{noteID}/actions",
+		"GET /api/v1/projects", // a notebook, in this edition
+		"GET /api/v1/search",
+		"GET /api/v1/auth/me",
+		// 34 ruter blev lukket i den anden omgang af denne port. Den her linje er
+		// den, der afgør, at det var en port: MCP-endepunktet er stadig der, og det
+		// er værktøjslisten bagved, der er kortere.
+		"POST /api/v1/mcp",
+		"POST /mcp",
+	} {
+		if !notes[must] {
+			t.Errorf("the notes edition does not serve %s — that is a deletion, not a gate", must)
+		}
+	}
+}
+
+// routesOf builds a server at one edition and returns every route it serves.
+func routesOf(t *testing.T, edition string) map[string]bool {
+	t.Helper()
+
+	db, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+
+	srv := New(&config.Config{
+		BaseURL: "http://127.0.0.1", DataDir: t.TempDir(), Edition: edition,
+		SessionTTL: time.Hour, InviteTTL: time.Hour, ResetTTL: time.Hour,
+	}, db, slog.New(slog.NewTextHandler(io.Discard, nil)), nil)
+
+	out := map[string]bool{}
+	err = chi.Walk(srv.router,
+		func(method, route string, _ http.Handler, _ ...func(http.Handler) http.Handler) error {
+			if route != "/" {
+				route = strings.TrimSuffix(route, "/")
+			}
+			out[method+" "+route] = true
+			return nil
+		})
+	if err != nil {
+		t.Fatalf("walk routes: %v", err)
+	}
+	if len(out) < 50 {
+		// A walk that found almost nothing would make every comparison below pass.
+		t.Fatalf("only %d routes at edition %q — the walk found nothing to compare", len(out), edition)
+	}
+	return out
+}
+
+// The interface cannot gate itself on something it is not told, and it has to be
+// told before anybody is signed in — an instance's shape is not a permission.
+func TestSetupStateSaysWhichEdition(t *testing.T) {
+	for _, tc := range []struct{ edition, want string }{
+		{config.EditionFull, "full"},
+		{config.EditionNotes, "notes"},
+		{"", "full"}, // a config built by hand is the program as it has always been
+	} {
+		ts := newTestServerWith(t, func(c *config.Config) { c.Edition = tc.edition })
+
+		_, body := ts.do(t, "GET", "/api/v1/auth/setup", nil)
+		if got := body["edition"]; got != tc.want {
+			t.Errorf("edition %q reported as %v, want %q", tc.edition, got, tc.want)
+		}
+		// And the field it has always had is still there: adding one must not
+		// quietly replace the answer the sign-in screen depends on.
+		if _, ok := body["needs_setup"]; !ok {
+			t.Errorf("edition %q: needs_setup is gone from the answer", tc.edition)
+		}
+	}
+}
+
+// Search is mounted in both editions — notes and notebooks have to be findable —
+// so it is the one door that could still open onto the half the router just shut.
+//
+// Not a theoretical case. An instance converted from a full one still has the
+// tasks in its database, and ⌘K would be the only place they turned up.
+func TestNotesEditionSearchFindsNoTasks(t *testing.T) {
+	for _, tc := range []struct {
+		edition string
+		want    int
+	}{
+		{config.EditionFull, 1},
+		{config.EditionNotes, 0},
+	} {
+		ts := newTestServerWith(t, func(c *config.Config) { c.Edition = tc.edition })
+		ts.bootstrap(t)
+
+		_, me := ts.do(t, "GET", "/api/v1/auth/me", nil)
+		userID, _ := me["id"].(string)
+		if userID == "" {
+			t.Fatalf("no user: %v", me)
+		}
+
+		// Created through the store rather than the API: in the notes edition there
+		// is no route to create one, and the row this is about is the row that is
+		// already there.
+		inbox, err := ts.db.InboxID(context.Background(), userID)
+		if err != nil {
+			t.Fatal(err)
+		}
+		task := &store.Task{ProjectID: inbox, Content: "Kvartalsregnskabet", CreatedBy: userID}
+		if err := ts.db.CreateTask(context.Background(), task, nil); err != nil {
+			t.Fatal(err)
+		}
+
+		_, body := ts.do(t, "GET", "/api/v1/search?q=Kvartalsregnskabet", nil)
+		found, _ := body["tasks"].([]any)
+		if len(found) != tc.want {
+			t.Errorf("edition %q: search returned %d tasks, want %d", tc.edition, len(found), tc.want)
+		}
+		// The full edition's number is the control: a search that finds nothing at
+		// all would satisfy the notes case for the wrong reason.
+		if tc.edition == config.EditionFull && len(found) == 0 {
+			t.Errorf("the full edition found no tasks either — this proves nothing about the notes one")
+		}
+	}
+}
+
+// TestNotesEditionOffersNoTaskToolsOverMCP.
+//
+// The same hole as the routes, through a different door — and it was still open
+// after the first gate. An MCP server advertises its tools, so a model connected
+// to a notes instance would be told it can create_task, call it, get something
+// back, and tell the person their task was filed.
+//
+// Asked through tools/list rather than by reading the server's own slice: that is
+// what a client actually sees, and the slice is unexported for the same reason.
+func TestNotesEditionOffersNoTaskToolsOverMCP(t *testing.T) {
+	taskTools := []string{"search_tasks", "create_task", "update_task", "complete_task", "add_comment"}
+	noteTools := []string{"search_notes", "create_note", "update_note"}
+
+	for _, edition := range []string{config.EditionFull, config.EditionNotes} {
+		t.Run(edition, func(t *testing.T) {
+			names := mcpToolNames(t, edition)
+
+			// Both editions: the shared tool, and the notes half.
+			for _, want := range append([]string{"list_projects"}, noteTools...) {
+				if !names[want] {
+					t.Errorf("%s edition does not offer %s", edition, want)
+				}
+			}
+			for _, task := range taskTools {
+				switch edition {
+				case config.EditionFull:
+					if !names[task] {
+						t.Errorf("the full edition lost %s — that is a deletion, not a gate", task)
+					}
+				default:
+					if names[task] {
+						t.Errorf("the notes edition offers %s over MCP", task)
+					}
+				}
+			}
+			t.Logf("%s: %d tools", edition, len(names))
+		})
+	}
+}
+
+// mcpToolNames asks one edition's MCP server for its tool list.
+func mcpToolNames(t *testing.T, edition string) map[string]bool {
+	t.Helper()
+
+	db, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+
+	cfg := &config.Config{BaseURL: "http://localhost", DataDir: t.TempDir(), SessionTTL: time.Hour, Edition: edition}
+	srv := New(cfg, db, slog.New(slog.NewTextHandler(io.Discard, nil)), nil)
+
+	resp := srv.mcp.Handle(context.Background(), "nobody", []byte(`{"jsonrpc":"2.0","id":1,"method":"tools/list"}`))
+	if resp == nil {
+		t.Fatal("tools/list got no response")
+	}
+	raw, err := json.Marshal(resp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var parsed struct {
+		Result struct {
+			Tools []struct{ Name string } `json:"tools"`
+		} `json:"result"`
+	}
+	if err := json.Unmarshal(raw, &parsed); err != nil {
+		t.Fatalf("tools/list: %v — %s", err, raw)
+	}
+	if len(parsed.Result.Tools) == 0 {
+		t.Fatalf("tools/list returned no tools at all: %s", raw)
+	}
+	names := map[string]bool{}
+	for _, tool := range parsed.Result.Tools {
+		names[tool.Name] = true
+	}
+	return names
+}

internal/httpapi/import_handlers.go

@@ -1,6 +1,7 @@
 package httpapi
 
 import (
+	"archive/zip"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -272,6 +273,111 @@ func (s *Server) handleExportProject(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// handleExportAllCSV is every project at once, one CSV per project in a zip.
+//
+// A zip rather than one wide CSV with a project column: Todoist's own export is a
+// file per project, so that is the shape an importer on the other side expects —
+// and the shape somebody can pick a single project out of without opening a
+// spreadsheet. Same reasoning as the notes export, which is a folder of Markdown
+// rather than one long file.
+//
+// It exists because the per-project links are per project: fifteen projects meant
+// fifteen downloads to move your own tasks somewhere else, which is an export that
+// technically works and nobody uses.
+func (s *Server) handleExportAllCSV(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+
+	projects, err := s.db.ListProjects(r.Context(), user.ID, true)
+	if err != nil {
+		s.internal(w, r, "export projects", err)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/zip")
+	w.Header().Set("Content-Disposition",
+		`attachment; filename="verdande-opgaver-`+time.Now().Format("2006-01-02")+`.zip"`)
+
+	zw := zip.NewWriter(w)
+	defer zw.Close()
+
+	// Two projects can share a name — they are still two projects, and a zip with
+	// one entry written twice loses one of them. Same guard as the notes export.
+	used := map[string]int{}
+	for _, project := range projects {
+		exported, err := s.buildExport(r, user, &project)
+		if err != nil {
+			// The response is already streaming, so there is no status left to send.
+			// Stopping leaves a truncated zip, which a zip tool reports as truncated —
+			// better than a complete-looking file with a project missing from it.
+			s.log.Error("export projects", "err", err, "project", project.ID)
+			return
+		}
+
+		name := strings.TrimSuffix(ics.Filename(project.Name), ".ics")
+		used[name]++
+		if used[name] > 1 {
+			name = fmt.Sprintf("%s (%d)", name, used[name])
+		}
+
+		f, err := zw.CreateHeader(&zip.FileHeader{Name: name + ".csv", Method: zip.Deflate})
+		if err != nil {
+			s.log.Error("export projects", "err", err, "project", project.ID)
+			return
+		}
+		if err := todoist.Write(f, todoist.ToRows(exported)); err != nil {
+			s.log.Error("export projects", "err", err, "project", project.ID)
+			return
+		}
+	}
+}
+
+// handleExportAllICS is every dated task in one calendar.
+//
+// One file and not a zip, unlike the CSV above, because a calendar is made to hold
+// many things and every reader takes a file with hundreds of VTODOs. The project
+// travels with each task as its own field, so nothing is lost by merging them.
+func (s *Server) handleExportAllICS(w http.ResponseWriter, r *http.Request) {
+	user := userFrom(r.Context())
+	ctx := r.Context()
+
+	projects, err := s.db.ListProjects(ctx, user.ID, true)
+	if err != nil {
+		s.internal(w, r, "export ics", err)
+		return
+	}
+	names := map[string]string{}
+	for _, p := range projects {
+		names[p.ID] = p.Name
+	}
+
+	tasks, err := s.db.ListTasks(ctx, user.ID, store.TaskFilter{
+		IncludeCompleted: true, Limit: 5000,
+	})
+	if err != nil {
+		s.internal(w, r, "export ics", err)
+		return
+	}
+
+	cal := ics.Calendar{Name: s.cfg.ProductName(), Domain: feedDomain(s.cfg.BaseURL)}
+	for _, t := range tasks {
+		if t.DueDate == "" {
+			continue
+		}
+		cal.Tasks = append(cal.Tasks, ics.Task{
+			ID: t.ID, Content: t.Content, Description: t.Description,
+			ProjectName: names[t.ProjectID], DueDate: t.DueDate, DueDatetime: t.DueDatetime,
+			DurationMin: t.DurationMin, Priority: t.Priority, Recurrence: t.RecurrenceRule,
+			Completed: t.Completed(), CompletedAt: t.CompletedAt,
+			CreatedAt: t.CreatedAt, UpdatedAt: t.UpdatedAt,
+		})
+	}
+
+	w.Header().Set("Content-Type", "text/calendar; charset=utf-8")
+	w.Header().Set("Content-Disposition",
+		`attachment; filename="verdande-opgaver-`+time.Now().Format("2006-01-02")+`.ics"`)
+	w.Write([]byte(ics.Render(cal)))
+}
+
 // buildExport turns a stored project back into the neutral shape the CSV writer
 // takes, rebuilding the task tree from parent ids.
 func (s *Server) buildExport(r *http.Request, user *store.User, project *store.Project) (todoist.Project, error) {

internal/httpapi/mcp_handlers.go

@@ -23,7 +23,9 @@ import (
 // `search_tasks` and `list_projects` is answering "which of these gets me closer",
 // and a description that only names the endpoint gives it nothing to decide with.
 func (s *Server) buildMCP() *mcp.Server {
-	m := mcp.NewServer("verdande", "1")
+	// Udgavens eget navn: det er sådan, instansen står i klientens
+	// forbindelsesliste.
+	m := mcp.NewServer(s.cfg.ProductSlug(), "1")
 
 	m.Register(mcp.Tool{
 		Name: "list_projects",
@@ -34,72 +36,79 @@ func (s *Server) buildMCP() *mcp.Server {
 		}),
 	}, s.mcpListProjects)
 
-	m.Register(mcp.Tool{
-		Name: "search_tasks",
-		Description: "Find tasks by text, project, label, priority, due date or assignee. " +
-			"This is the tool for any question about what the user has to do — " +
-			"\"what is due today\", \"what is overdue\", \"anything about the tax return\". " +
-			"The query accepts the same filter language as the app: \"today & p1\", " +
-			"\"overdue\", \"#Firma & @regnskab\", \"7 days\", \"assigned to: me\".",
-		InputSchema: mcp.Schema(map[string]any{
-			"query":             mcp.Str("A filter expression, e.g. \"today & p1\" or \"overdue\"."),
-			"text":              mcp.Str("Free text to search task titles and descriptions for."),
-			"limit":             mcp.Int("How many tasks to return. Defaults to 50, maximum 200."),
-			"include_completed": mcp.Bool("Include tasks that are already done. Defaults to false."),
-		}),
-	}, s.mcpSearchTasks)
+	// De fem opgaveværktøjer. Udeladt i noter-udgaven af samme grund som ruterne:
+	// et værktøj, en model kan kalde, er en flade på instansen, og et værktøj der
+	// svarer "der er ingen opgaver" er værre end et, der ikke findes — modellen
+	// prøver det, får et tomt svar og fortæller brugeren, at der ikke er noget at
+	// lave. add_comment er med her: en kommentar hænger på en opgave.
+	if !s.cfg.NotesOnly() {
+		m.Register(mcp.Tool{
+			Name: "search_tasks",
+			Description: "Find tasks by text, project, label, priority, due date or assignee. " +
+				"This is the tool for any question about what the user has to do — " +
+				"\"what is due today\", \"what is overdue\", \"anything about the tax return\". " +
+				"The query accepts the same filter language as the app: \"today & p1\", " +
+				"\"overdue\", \"#Firma & @regnskab\", \"7 days\", \"assigned to: me\".",
+			InputSchema: mcp.Schema(map[string]any{
+				"query":             mcp.Str("A filter expression, e.g. \"today & p1\" or \"overdue\"."),
+				"text":              mcp.Str("Free text to search task titles and descriptions for."),
+				"limit":             mcp.Int("How many tasks to return. Defaults to 50, maximum 200."),
+				"include_completed": mcp.Bool("Include tasks that are already done. Defaults to false."),
+			}),
+		}, s.mcpSearchTasks)
 
-	m.Register(mcp.Tool{
-		Name: "create_task",
-		Description: "Create a task. Prefer passing the whole thing as natural language in " +
-			"`text` — \"betal moms i morgen kl 10 p1 #Firma @regnskab\" — because the app's own " +
-			"parser handles dates, times, priorities, projects, labels and recurrence in Danish " +
-			"and English. Use the explicit fields only when the user was explicit.",
-		InputSchema: mcp.Schema(map[string]any{
-			"text":        mcp.Str("The task as a sentence, parsed for date, time, priority, #project, @label and recurrence."),
-			"content":     mcp.Str("The task title, if not using `text`."),
-			"project_id":  mcp.Str("Which project. Defaults to the Inbox. Naming a project that does not exist is not an error — the task goes to the Inbox and the answer says so."),
-			"parent_id":   mcp.Str("Make this a sub-task of that task. It joins the parent's project. One level deep."),
-			"due_date":    mcp.Str("A date as YYYY-MM-DD."),
-			"priority":    mcp.Int("1 (highest) to 4 (none)."),
-			"description": mcp.Str("Longer notes on the task."),
-			"labels":      mcp.StrArray("Label names."),
-		}),
-	}, s.mcpCreateTask)
+		m.Register(mcp.Tool{
+			Name: "create_task",
+			Description: "Create a task. Prefer passing the whole thing as natural language in " +
+				"`text` — \"betal moms i morgen kl 10 p1 #Firma @regnskab\" — because the app's own " +
+				"parser handles dates, times, priorities, projects, labels and recurrence in Danish " +
+				"and English. Use the explicit fields only when the user was explicit.",
+			InputSchema: mcp.Schema(map[string]any{
+				"text":        mcp.Str("The task as a sentence, parsed for date, time, priority, #project, @label and recurrence."),
+				"content":     mcp.Str("The task title, if not using `text`."),
+				"project_id":  mcp.Str("Which project. Defaults to the Inbox. Naming a project that does not exist is not an error — the task goes to the Inbox and the answer says so."),
+				"parent_id":   mcp.Str("Make this a sub-task of that task. It joins the parent's project. One level deep."),
+				"due_date":    mcp.Str("A date as YYYY-MM-DD."),
+				"priority":    mcp.Int("1 (highest) to 4 (none)."),
+				"description": mcp.Str("Longer notes on the task."),
+				"labels":      mcp.StrArray("Label names."),
+			}),
+		}, s.mcpCreateTask)
 
-	m.Register(mcp.Tool{
-		Name: "update_task",
-		Description: "Change an existing task: its title, description, priority, due date or " +
-			"project. Only the fields given are changed. To move a due date, pass due_date; " +
-			"to clear it, pass an empty string.",
-		InputSchema: mcp.Schema(map[string]any{
-			"task_id":     mcp.Str("The task to change."),
-			"content":     mcp.Str("A new title."),
-			"description": mcp.Str("New notes."),
-			"priority":    mcp.Int("1 (highest) to 4 (none)."),
-			"due_date":    mcp.Str("A date as YYYY-MM-DD, or an empty string to remove the date."),
-			"project_id":  mcp.Str("Move the task to another project."),
-			"labels":      mcp.StrArray("Replace the task's labels."),
-		}, "task_id"),
-	}, s.mcpUpdateTask)
+		m.Register(mcp.Tool{
+			Name: "update_task",
+			Description: "Change an existing task: its title, description, priority, due date or " +
+				"project. Only the fields given are changed. To move a due date, pass due_date; " +
+				"to clear it, pass an empty string.",
+			InputSchema: mcp.Schema(map[string]any{
+				"task_id":     mcp.Str("The task to change."),
+				"content":     mcp.Str("A new title."),
+				"description": mcp.Str("New notes."),
+				"priority":    mcp.Int("1 (highest) to 4 (none)."),
+				"due_date":    mcp.Str("A date as YYYY-MM-DD, or an empty string to remove the date."),
+				"project_id":  mcp.Str("Move the task to another project."),
+				"labels":      mcp.StrArray("Replace the task's labels."),
+			}, "task_id"),
+		}, s.mcpUpdateTask)
 
-	m.Register(mcp.Tool{
-		Name: "complete_task",
-		Description: "Mark a task done. A repeating task advances to its next occurrence " +
-			"instead of closing, and the result says so.",
-		InputSchema: mcp.Schema(map[string]any{
-			"task_id": mcp.Str("The task to complete."),
-		}, "task_id"),
-	}, s.mcpCompleteTask)
+		m.Register(mcp.Tool{
+			Name: "complete_task",
+			Description: "Mark a task done. A repeating task advances to its next occurrence " +
+				"instead of closing, and the result says so.",
+			InputSchema: mcp.Schema(map[string]any{
+				"task_id": mcp.Str("The task to complete."),
+			}, "task_id"),
+		}, s.mcpCompleteTask)
 
-	m.Register(mcp.Tool{
-		Name:        "add_comment",
-		Description: "Add a comment to a task. Everyone else with access to the project is notified.",
-		InputSchema: mcp.Schema(map[string]any{
-			"task_id": mcp.Str("The task to comment on."),
-			"body":    mcp.Str("What to say."),
-		}, "task_id", "body"),
-	}, s.mcpAddComment)
+		m.Register(mcp.Tool{
+			Name:        "add_comment",
+			Description: "Add a comment to a task. Everyone else with access to the project is notified.",
+			InputSchema: mcp.Schema(map[string]any{
+				"task_id": mcp.Str("The task to comment on."),
+				"body":    mcp.Str("What to say."),
+			}, "task_id", "body"),
+		}, s.mcpAddComment)
+	}
 
 	s.registerNoteTools(m)
 	return m

internal/httpapi/server.go

@@ -3,6 +3,7 @@
 package httpapi
 
 import (
+	"bytes"
 	"encoding/json"
 	"errors"
 	"io/fs"
@@ -77,6 +78,20 @@ type Server struct {
 	// Computed once from the built index.html; see csp.go.
 	csp string
 
+	// The shell and the manifest with this edition's name in them, or nil to serve
+	// the built files unchanged. Only the notes edition needs them; see shell.go.
+	shell    []byte
+	manifest []byte
+
+	// Icon paths this edition serves from another file. Empty in the full edition.
+	assets map[string]string
+
+	// The second door: /urd and its own web manifest. Built on every instance,
+	// whatever the edition, because it is how the notes face is installed as its
+	// own app rather than a property of the instance. See shell.go.
+	urdShell    []byte
+	urdManifest []byte
+
 	router chi.Router
 }
 
@@ -86,7 +101,7 @@ type Server struct {
 func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server {
 	s := &Server{
 		cfg: cfg, db: db, log: log, web: web,
-		mail:         mail.New(cfg.SMTP, cfg.BaseURL, log),
+		mail:         mail.New(cfg.SMTP, cfg.BaseURL, cfg.ProductSlug(), log),
 		hub:          realtime.NewHub(log),
 		loginLimiter: newLimiter(10, 15*time.Minute),
 		// Generous on purpose: the caller is the mail server, one address delivering
@@ -101,8 +116,53 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 		// generous for a person and hopeless for a search through a million.
 		totpLimiter: newLimiter(10, time.Hour),
 	}
-	s.csp = contentSecurityPolicy(scriptHashes(web))
-	if w, err := auth.NewWebAuthn(cfg.BaseURL, "verdande"); err == nil {
+	// Before the CSP, deliberately: the policy has to describe the bytes that go
+	// out, and in the notes edition those are the renamed ones.
+	//
+	// A failure here is logged rather than fatal, and that is a judgement about
+	// this particular failure rather than a habit: an unknown VERDANDE_EDITION
+	// refuses to start, because serving task routes on an instance set up without
+	// them is a different kind of wrong. A shell whose title says the sibling's
+	// name is cosmetic — it must be loud, and it must not take the instance down.
+	// What makes it loud is not this line: the end-to-end suite reads the served
+	// title, so an anchor that falls out of app.html goes red there.
+	if web != nil && cfg.NotesOnly() {
+		shell, manifest, err := rebrandedAssets(web, cfg.ProductSlug(), notesShellDescription, notesManifestDescription)
+		if err != nil {
+			log.Error("the frontend could not be renamed for this edition; it will call itself verdande",
+				"edition", cfg.Edition, "err", err)
+		} else {
+			s.shell, s.manifest = shell, manifest
+		}
+
+		s.assets = resolveNotesAssets(web, func(name, alias string) {
+			log.Error("this edition has no icon of its own at that path; it will serve verdande's",
+				"path", name, "wanted", alias)
+		})
+	}
+
+	// The second door, on every edition. A notes instance already calls itself urd
+	// at the root; the door is still built there so the two addresses behave the
+	// same, and so a single test does not have to know which edition it is in.
+	if web != nil {
+		urdShell, urdManifest, err := urdDoorAssets(web)
+		if err != nil {
+			log.Error("the urd door could not be built; /urd will not be its own app", "err", err)
+		} else {
+			s.urdShell, s.urdManifest = urdShell, urdManifest
+		}
+	}
+
+	if s.shell != nil {
+		s.csp = contentSecurityPolicy(scriptHashesIn(s.shell))
+	} else {
+		s.csp = contentSecurityPolicy(scriptHashes(web))
+	}
+	// The second argument is WebAuthn's display name, not its relying party id —
+	// the id comes from BaseURL. So this is what the operating system's passkey
+	// prompt calls the site, and the slug keeps it identical to what every existing
+	// verdande instance already registered.
+	if w, err := auth.NewWebAuthn(cfg.BaseURL, cfg.ProductSlug()); err == nil {
 		s.passkeys = w
 	} else {
 		log.Warn("passkeys are unavailable", "err", err, "base_url", cfg.BaseURL)
@@ -125,13 +185,31 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 	// Docker both need this to answer before anyone has logged in.
 	r.Get("/healthz", s.handleHealth)
 
+	// The same question as inside /api/v1, asked again here because four of the
+	// task-only surfaces live outside it: the calendar feed, CalDAV, the inbox
+	// hook, and the well-known path CalDAV clients discover through. They are out
+	// here because their callers cannot hold a session, not because they are any
+	// less about tasks — and the first gate missed all four for exactly that
+	// reason. It read as complete because the /tasks tree was covered.
+	full := !s.cfg.NotesOnly()
+
 	// The calendar feed is outside /api/v1 and outside the session: a calendar
 	// client cannot log in, so the token in the path is the whole credential.
-	r.Get("/ics/{token}", s.handleICSFeed)
+	//
+	// A feed of VTODOs, so there is nothing for it to answer in the notes edition.
+	if full {
+		r.Get("/ics/{token}", s.handleICSFeed)
 
-	// CalDAV, outside /api/v1 because clients do well-known-path discovery
-	// against the root and authenticate with Basic rather than a session.
-	r.Get("/.well-known/caldav", s.wellKnownCalDAV)
+		// CalDAV, outside /api/v1 because clients do well-known-path discovery
+		// against the root and authenticate with Basic rather than a session.
+		//
+		// Withheld rather than left to answer an empty collection: the well-known
+		// path is a claim that a CalDAV server is here, and a client that believes
+		// it goes on to PROPFIND, authenticate, and sync nothing — reporting a
+		// broken calendar server on an instance that has none and needs none. Same
+		// reasoning as the /.well-known/ 404 in serveWeb.
+		r.Get("/.well-known/caldav", s.wellKnownCalDAV)
+	}
 
 	// Inbound mail. Delivered by the mail server rather than by a browser, and
 	// authenticated by the token in the recipient address.
@@ -156,8 +234,13 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 	//
 	// Sin egen kvote frem for postens: en travl integration skal ikke kunne lukke
 	// for den indgående post, og omvendt.
-	r.Method(http.MethodPost, "/inbound/hook/{token}",
-		s.rateLimit(s.hookLimiter, http.HandlerFunc(s.handleInboundHook)))
+	//
+	// Opgaver, efter sin egen beskrivelse ovenfor — den skubber en linje tekst ind
+	// i indbakken — så den findes ikke i noter-udgaven.
+	if full {
+		r.Method(http.MethodPost, "/inbound/hook/{token}",
+			s.rateLimit(s.hookLimiter, http.HandlerFunc(s.handleInboundHook)))
+	}
 
 	// MCP with the token in the query string, for clients that cannot send a
 	// header. Claude's custom-connector dialog takes a URL and nothing else, so
@@ -184,7 +267,10 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 		// Gmail connection with calendar tokens.
 		r.Get("/oauth/calendar/callback", s.handleCalendarCallback)
 	})
-	r.Route("/caldav", s.caldavRoutes)
+	// Hele CalDAV-træet: otte ruter, der alle læser eller skriver en VTODO.
+	if full {
+		r.Route("/caldav", s.caldavRoutes)
+	}
 
 	r.Route("/api/v1", func(r chi.Router) {
 		r.Use(s.requireCSRF)
@@ -242,6 +328,7 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				r.Patch("/me", s.handleUpdateProfile)
 				r.Put("/sidebar-sections", s.handleSetSidebarSections)
 				r.Put("/nav-order", s.handleSetNavOrder)
+				r.Put("/default-reminder", s.handleSetDefaultReminder)
 				r.Post("/logout", s.handleLogout)
 				r.Post("/password/change", s.handleChangePassword)
 				r.Get("/recovery-codes", s.handleRecoveryCodesCount)
@@ -285,6 +372,10 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 
 		// Everything past this point needs a complete login.
 		r.Group(func(r chi.Router) {
+			// Opgavehalvdelen monteres kun i den fulde udgave. Ikke skjult i
+			// fladen — fraværende fra routeren, så en instans, der ikke er et
+			// opgaveprogram, heller ikke kan bedes om at være det gennem sit API.
+			full := !s.cfg.NotesOnly()
 			r.Use(s.requireAuth)
 
 			r.Get("/ws", s.handleWebSocket)
@@ -294,17 +385,26 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 			r.Post("/mcp", s.handleMCP)
 
 			r.Get("/today", s.handleToday)
-			r.Get("/filters/preview", s.handlePreviewFilter)
+			if full {
+				r.Get("/filters/preview", s.handlePreviewFilter)
+			}
 
-			r.Route("/filters", func(r chi.Router) {
-				r.Get("/", s.handleListFilters)
-				r.Post("/", s.handleCreateFilter)
-				r.Get("/{filterID}/tasks", s.handleRunFilter)
-				r.Patch("/{filterID}", s.handleUpdateFilter)
-				r.Delete("/{filterID}", s.handleDeleteFilter)
-			})
+			if full {
+				r.Route("/filters", func(r chi.Router) {
+					r.Get("/", s.handleListFilters)
+					r.Post("/", s.handleCreateFilter)
+					r.Get("/{filterID}/tasks", s.handleRunFilter)
+					r.Patch("/{filterID}", s.handleUpdateFilter)
+					r.Delete("/{filterID}", s.handleDeleteFilter)
+				})
+			}
 
-			r.Get("/feed", s.handleGetFeed)
+			// Tokenet til ICS-feedet ovenfor. Et token til et feed, der ikke
+			// findes, er en indstillingsside, der tilbyder en adresse, intet
+			// svarer på.
+			if full {
+				r.Get("/feed", s.handleGetFeed)
+			}
 
 			r.Route("/notifications", func(r chi.Router) {
 				r.Get("/", s.handleListNotifications)
@@ -330,7 +430,9 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				r.Patch("/", s.handleUpdateComment)
 				r.Delete("/", s.handleDeleteComment)
 			})
-			r.Post("/feed/rotate", s.handleRotateFeed)
+			if full {
+				r.Post("/feed/rotate", s.handleRotateFeed)
+			}
 
 			r.Get("/mail-address", s.handleGetMailAddress)
 			r.Post("/mail-address/rotate", s.handleRotateMailAddress)
@@ -351,20 +453,24 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				r.Get("/settings", s.handleGetAISettings)
 				r.Put("/settings", s.handleSetAISettings)
 				r.Post("/summary", s.handleAISummary)
-				r.Post("/tasks/{taskID}/split", s.handleAISplit)
-				// Forslag, ikke skrivninger. De to første svarer med linjer i
-				// quick-add-syntaks, som fladen viser frem; de to sidste er dét,
-				// der sker, når nogen siger ja til én af dem.
-				r.Post("/inbox/tidy", s.handleAITidyInbox)
-				r.Post("/inbox/tidy/apply", s.handleAIApplyToTask)
+				if full {
+					r.Post("/tasks/{taskID}/split", s.handleAISplit)
+					// Forslag, ikke skrivninger. De to første svarer med linjer i
+					// quick-add-syntaks, som fladen viser frem; de to sidste er dét,
+					// der sker, når nogen siger ja til én af dem.
+					r.Post("/inbox/tidy", s.handleAITidyInbox)
+					r.Post("/inbox/tidy/apply", s.handleAIApplyToTask)
+				}
 				r.Post("/notes/{noteID}/actions", s.handleAINoteActions)
 				r.Post("/notes/{noteID}/actions/apply", s.handleAICreateFromNote)
 				// Dagens plan: indstillingen, og en knap til at se den nu. En
 				// indstilling, man skal vente til i morgen for at se virkningen af,
 				// er en indstilling, ingen tør slå til.
-				r.Get("/plan", s.handleGetPlanSettings)
-				r.Put("/plan", s.handleSetPlanSettings)
-				r.Post("/plan/now", s.handlePlanNow)
+				if full {
+					r.Get("/plan", s.handleGetPlanSettings)
+					r.Put("/plan", s.handleSetPlanSettings)
+					r.Post("/plan/now", s.handlePlanNow)
+				}
 				// Spørg om sine egne noter og opgaver i almindeligt sprog. Basen
 				// finder kandidaterne, modellen læser dem — og svaret bærer, hvad
 				// det er bygget på.
@@ -449,33 +555,53 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				r.Delete("/subscriptions/{id}", s.handleUnsubscribeCalendar)
 			})
 
-			r.Route("/import", func(r chi.Router) {
-				r.Post("/todoist", s.handleImportTodoist)
-				r.Post("/csv", s.handleImportCSV)
-			})
+			// Begge retninger laver eller læser opgaver: Todoist-importen laver
+			// dem, CSV-importen laver dem, og de fire opgave-eksporter skriver dem
+			// ud. De blev alle betjent i noter-udgaven indtil nu — de svarede tomt
+			// frem for at fejle, hvilket er den stille version af samme fejl.
+			if full {
+				r.Route("/import", func(r chi.Router) {
+					r.Post("/todoist", s.handleImportTodoist)
+					r.Post("/csv", s.handleImportCSV)
+				})
+			}
 
 			r.Get("/export/account", s.handleExportAccount)
 			r.Get("/export/notes.zip", s.handleExportNotes)
-			r.Get("/export/projects/{projectID}.csv", s.handleExportProject)
-			r.Get("/export/projects/{projectID}.ics", s.handleExportProjectICS)
+			if full {
+				r.Get("/export/projects.zip", s.handleExportAllCSV)
+				r.Get("/export/tasks.ics", s.handleExportAllICS)
+				r.Get("/export/projects/{projectID}.csv", s.handleExportProject)
+				r.Get("/export/projects/{projectID}.ics", s.handleExportProjectICS)
+			}
 
-			r.Route("/templates", func(r chi.Router) {
-				r.Get("/", s.handleListTemplates)
-				r.Post("/", s.handleSaveTemplate)
-				r.Post("/{templateID}/use", s.handleUseTemplate)
-				r.Delete("/{templateID}", s.handleDeleteTemplate)
-			})
+			// En skabelon er et projekt plus sektioner plus opgaver — læst i
+			// CreateProjectFromTemplate frem for gættet ud fra rutenavnet, som
+			// kun siger "projekt". Uden opgaver er den et tomt projekt med
+			// overskrifter i.
+			if full {
+				r.Route("/templates", func(r chi.Router) {
+					r.Get("/", s.handleListTemplates)
+					r.Post("/", s.handleSaveTemplate)
+					r.Post("/{templateID}/use", s.handleUseTemplate)
+					r.Delete("/{templateID}", s.handleDeleteTemplate)
+				})
+			}
 
-			r.Delete("/reminders/{reminderID}", s.handleDeleteReminder)
+			if full {
+				r.Delete("/reminders/{reminderID}", s.handleDeleteReminder)
+			}
 
-			r.Route("/labels", func(r chi.Router) {
-				r.Get("/", s.handleListLabels)
-				r.Post("/", s.handleCreateLabel)
-				r.Patch("/{labelID}", s.handleUpdateLabel)
-				r.Delete("/{labelID}", s.handleDeleteLabel)
-			})
-			r.Get("/upcoming", s.handleUpcoming)
-			r.Get("/delegated", s.handleDelegated)
+			if full {
+				r.Route("/labels", func(r chi.Router) {
+					r.Get("/", s.handleListLabels)
+					r.Post("/", s.handleCreateLabel)
+					r.Patch("/{labelID}", s.handleUpdateLabel)
+					r.Delete("/{labelID}", s.handleDeleteLabel)
+				})
+				r.Get("/upcoming", s.handleUpcoming)
+				r.Get("/delegated", s.handleDelegated)
+			}
 			r.Get("/people", s.handlePeople)
 			r.Get("/search", s.handleSearch)
 
@@ -491,7 +617,13 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 					r.Use(s.requireProject(store.RoleViewer))
 
 					r.Get("/", s.handleGetProject)
-					r.Get("/sections", s.handleListSections)
+					// Sektioner grupperer opgaver inde i et projekt, og det er
+					// afgjort af skemaet frem for af navnet: `section_id` står på
+					// `tasks` og findes ikke på `notes`. En sektion i en notesbog
+					// kan ikke indeholde noget.
+					if full {
+						r.Get("/sections", s.handleListSections)
+					}
 					r.Get("/members", s.handleListMembers)
 					// Uden for ejer-gruppen, fordi den nu dækker to ting: ejeren, der
 					// fjerner nogen, og den, der selv går. Handleren skiller dem ad.
@@ -500,8 +632,10 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 
 					r.Group(func(r chi.Router) {
 						r.Use(s.requireProject(store.RoleEditor))
-						r.Post("/sections", s.handleCreateSection)
-						r.Post("/sections/reorder", s.handleReorderSections)
+						if full {
+							r.Post("/sections", s.handleCreateSection)
+							r.Post("/sections/reorder", s.handleReorderSections)
+						}
 					})
 
 					r.Group(func(r chi.Router) {
@@ -576,32 +710,36 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 			r.Get("/trash/projects", s.handleListTrashedProjects)
 			r.Post("/trash/projects/{projectID}/restore", s.handleRestoreProject)
 
-			r.Route("/sections/{sectionID}", func(r chi.Router) {
-				r.Patch("/", s.handleUpdateSection)
-				r.Delete("/", s.handleDeleteSection)
-			})
-
-			r.Route("/tasks", func(r chi.Router) {
-				r.Get("/", s.handleListTasks)
-				r.Post("/", s.handleCreateTask)
-				r.Post("/quick-add", s.handleQuickAdd)
-				r.Get("/quick-add/preview", s.handleQuickAddPreview)
-
-				r.Route("/{taskID}", func(r chi.Router) {
-					r.Get("/", s.handleGetTask)
-					r.Patch("/", s.handleUpdateTask)
-					r.Delete("/", s.handleDeleteTask)
-					r.Get("/comments", s.handleListComments)
-					r.Post("/comments", s.handleCreateComment)
-					r.Post("/attachments", s.handleUploadAttachment)
-					r.Get("/reminders", s.handleListReminders)
-					r.Post("/reminders", s.handleCreateReminder)
-					r.Post("/complete", s.handleCompleteTask)
-					r.Post("/reopen", s.handleReopenTask)
-					r.Post("/move", s.handleMoveTask)
-					r.Post("/snooze", s.handleSnoozeTask)
+			if full {
+				r.Route("/sections/{sectionID}", func(r chi.Router) {
+					r.Patch("/", s.handleUpdateSection)
+					r.Delete("/", s.handleDeleteSection)
 				})
-			})
+			}
+
+			if full {
+				r.Route("/tasks", func(r chi.Router) {
+					r.Get("/", s.handleListTasks)
+					r.Post("/", s.handleCreateTask)
+					r.Post("/quick-add", s.handleQuickAdd)
+					r.Get("/quick-add/preview", s.handleQuickAddPreview)
+
+					r.Route("/{taskID}", func(r chi.Router) {
+						r.Get("/", s.handleGetTask)
+						r.Patch("/", s.handleUpdateTask)
+						r.Delete("/", s.handleDeleteTask)
+						r.Get("/comments", s.handleListComments)
+						r.Post("/comments", s.handleCreateComment)
+						r.Post("/attachments", s.handleUploadAttachment)
+						r.Get("/reminders", s.handleListReminders)
+						r.Post("/reminders", s.handleCreateReminder)
+						r.Post("/complete", s.handleCompleteTask)
+						r.Post("/reopen", s.handleReopenTask)
+						r.Post("/move", s.handleMoveTask)
+						r.Post("/snooze", s.handleSnoozeTask)
+					})
+				})
+			}
 		})
 	})
 
@@ -669,7 +807,7 @@ func (s *Server) serveWeb(w http.ResponseWriter, r *http.Request) {
 	if s.web == nil {
 		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("verdande — API is running. The web interface was not built into this binary.\n"))
+		w.Write([]byte(s.cfg.ProductSlug() + " — API is running. The web interface was not built into this binary.\n"))
 		return
 	}
 
@@ -678,6 +816,22 @@ func (s *Server) serveWeb(w http.ResponseWriter, r *http.Request) {
 		name = "index.html"
 	}
 
+	// The second door, before anything else touches the filesystem: /urd is not a
+	// file, so the fallback below would hand back the other door's shell.
+	if b := s.door(name); b != nil {
+		w.Header().Set("Content-Type", contentTypeFor(name))
+		w.Header().Set("Cache-Control", "no-cache")
+		http.ServeContent(w, r, name, time.Time{}, bytes.NewReader(b))
+		return
+	}
+
+	// This edition's own icon, where it has one. Before the Open rather than after,
+	// unlike the shell below: these are real files, so there is no fallback to get
+	// in the way, and resolveNotesAssets has already checked each one exists.
+	if alias, ok := s.assets[name]; ok {
+		name = alias
+	}
+
 	f, err := s.web.Open(name)
 	if errors.Is(err, fs.ErrNotExist) {
 		// A client-side route: hand back the shell and let the app route it.
@@ -690,6 +844,24 @@ func (s *Server) serveWeb(w http.ResponseWriter, r *http.Request) {
 	}
 	defer f.Close()
 
+	// Only here is `name` settled, and that matters: every client-side route —
+	// /noter and all the rest — arrives as a path with no file behind it and is
+	// resolved to index.html by the fallback above. Asking before the fallback
+	// would have renamed the shell for a request to "/" and handed back the built
+	// one for every other route in the app.
+	//
+	// These two assets never reach the filesystem: they are the built files with
+	// this edition's name in them, held in memory since startup. See shell.go.
+	if b := s.renamed(name); b != nil {
+		w.Header().Set("Content-Type", contentTypeFor(name))
+		// A zero modification time tells ServeContent to send no Last-Modified and
+		// to answer no conditional request — right for a shell that must never be
+		// cached, and the same thing the built shell gets below.
+		w.Header().Set("Cache-Control", "no-cache")
+		http.ServeContent(w, r, name, time.Time{}, bytes.NewReader(b))
+		return
+	}
+
 	info, err := f.Stat()
 	if err != nil || info.IsDir() {
 		writeJSON(w, http.StatusNotFound, map[string]string{"error": "not found"})

internal/httpapi/shell.go

@@ -0,0 +1,341 @@
+package httpapi
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io/fs"
+	"strings"
+)
+
+// The product name is in the built frontend as a literal in four places, because
+// all four are read before any JavaScript runs: the window title and the meta
+// description in the HTML shell, and the two names in the web manifest that decide
+// what an installed PWA is called on a home screen.
+//
+// They cannot be filled in by the app at runtime. The shell is parsed before the
+// first script executes, the manifest is fetched by the browser rather than by us,
+// and the edition is not known until /auth/setup-state has answered — so a frontend
+// that renamed itself after loading would show the sibling's name first and correct
+// itself a moment later, on every load, in the tab and on the install prompt.
+//
+// So the server does it, once at startup, on the way out. One frontend build, two
+// names: the build is identical in both editions and the bytes served differ.
+//
+// Each replacement is REQUIRED and the anchors are exact. A rewrite that quietly
+// matched nothing is the whole failure mode here — it leaves an Urd instance
+// calling itself verdande, which is cosmetic enough that nobody files it and
+// nothing else notices.
+type rebrand struct {
+	old, new string
+}
+
+// shellRebrands returns the replacements for index.html.
+//
+// Note what is NOT in here: `localStorage.getItem('verdande:theme')` and its two
+// neighbours in the inline theme script. Those keys are storage, not a name — the
+// rest of the app reads the same three, so renaming them here and nowhere else
+// would set the theme from one key and read it from another, and the only symptom
+// is the white flash that script exists to prevent. This is why the replacements
+// are written out as whole anchored strings rather than as a replace of the word
+// "verdande".
+func shellRebrands(slug, description string) []rebrand {
+	return []rebrand{
+		{"<title>verdande</title>", "<title>" + slug + "</title>"},
+		{
+			`<meta name="description" content="verdande — opgaver og projekter, delt." />`,
+			`<meta name="description" content="` + description + `" />`,
+		},
+	}
+}
+
+// manifestRebrands returns the replacements for manifest.webmanifest. The
+// manifest's own description is a sentence rather than the shell's "name — sentence"
+// form, so it is passed separately rather than derived.
+func manifestRebrands(slug, description string) []rebrand {
+	return []rebrand{
+		{`"name": "verdande"`, `"name": "` + slug + `"`},
+		{`"short_name": "verdande"`, `"short_name": "` + slug + `"`},
+		{`"description": "Opgaver og projekter, delt."`, `"description": "` + description + `"`},
+	}
+}
+
+// applyRebrands replaces every pair exactly once and fails on the first anchor it
+// cannot find, naming it. Failing loudly rather than returning what it managed is
+// the point: a partial rename is a page whose tab and whose install prompt disagree
+// about which program this is.
+func applyRebrands(raw []byte, pairs []rebrand) ([]byte, error) {
+	out := raw
+	for _, p := range pairs {
+		old := []byte(p.old)
+		if bytes.Count(out, old) != 1 {
+			return nil, fmt.Errorf("found %d occurrences of %q, want exactly 1", bytes.Count(out, old), p.old)
+		}
+		out = bytes.Replace(out, old, []byte(p.new), 1)
+	}
+	return out, nil
+}
+
+// rebrandedAssets reads index.html and manifest.webmanifest out of the built
+// frontend and returns them renamed for this edition.
+//
+// Both or neither: an instance serving a renamed shell beside the sibling's
+// manifest installs under the wrong name on a phone, which is the half nobody looks
+// at until it is on their home screen.
+func rebrandedAssets(web fs.FS, slug, shellDesc, manifestDesc string) (shell, manifest []byte, err error) {
+	raw, err := fs.ReadFile(web, "index.html")
+	if err != nil {
+		return nil, nil, fmt.Errorf("index.html: %w", err)
+	}
+	shell, err = applyRebrands(raw, shellRebrands(slug, shellDesc))
+	if err != nil {
+		return nil, nil, fmt.Errorf("index.html: %w", err)
+	}
+
+	raw, err = fs.ReadFile(web, "manifest.webmanifest")
+	if err != nil {
+		return nil, nil, fmt.Errorf("manifest.webmanifest: %w", err)
+	}
+	manifest, err = applyRebrands(raw, manifestRebrands(slug, manifestDesc))
+	if err != nil {
+		return nil, nil, fmt.Errorf("manifest.webmanifest: %w", err)
+	}
+	return shell, manifest, nil
+}
+
+// The descriptions for the notes edition. Kept beside the replacements they feed
+// rather than in the locale files, because these two strings are read by a browser
+// and a home screen before any locale has been chosen — the shell is in Danish for
+// the same reason the built app.html is.
+const (
+	notesShellDescription    = "urd — noter, delt."
+	notesManifestDescription = "Noter, delt."
+)
+
+// renamed returns the renamed bytes for `name`, or nil to serve the built file.
+//
+// Nil for everything in the full edition, which is what keeps that path exactly as
+// it was: one comparison per request against a nil slice.
+func (s *Server) renamed(name string) []byte {
+	switch name {
+	case "index.html":
+		return s.shell
+	case "manifest.webmanifest":
+		return s.manifest
+	}
+	return nil
+}
+
+// contentTypeFor names the type for the two assets served from memory.
+//
+// http.ServeContent sniffs from the extension, and it gets .html right and
+// .webmanifest wrong — Go's table does not have it, so the sniffer reads the first
+// bytes, sees JSON-ish text and answers text/plain. A manifest served as text/plain
+// is ignored by the browser without an error anywhere: the install prompt simply
+// does not appear.
+func contentTypeFor(name string) string {
+	// Any .webmanifest, not the one name — there are two of them now, and the
+	// second one was served as HTML for about four minutes because this read
+	// `name == "manifest.webmanifest"`. Nothing would have reported it: a manifest
+	// with the wrong type is ignored silently, and the only symptom is an install
+	// prompt that does not appear.
+	if strings.HasSuffix(name, ".webmanifest") {
+		return "application/manifest+json"
+	}
+	return "text/html; charset=utf-8"
+}
+
+// notesAssetAliases maps the icon paths the shell and the manifest already point
+// at to urd's own files. Both sets are in the binary; the server decides.
+//
+// Aliased rather than renamed in the manifest, and the reason is the third entry.
+// Safari ignores a manifest's icons entirely and looks for `apple-touch-icon.png`
+// BY NAME — so pointing the manifest at urd-icon-192.png would have left iOS with
+// Verdande's mark, or, if that file were renamed too, with a screenshot of the page
+// as its home-screen icon. Keeping the paths and swapping the bytes behind them
+// fixes all four at once, including the favicon in `app.html`, which is not in the
+// manifest either.
+var notesAssetAliases = map[string]string{
+	"icon.svg":             "urd-icon.svg",
+	"icon-192.png":         "urd-icon-192.png",
+	"icon-512.png":         "urd-icon-512.png",
+	"apple-touch-icon.png": "urd-apple-touch-icon.png",
+}
+
+// resolveNotesAssets returns the aliases that have a file behind them, and reports
+// the ones that do not.
+//
+// Resolved once at startup rather than per request, so a missing file is one loud
+// line in the log instead of a silent fallback on every page load. The fallback is
+// still to Verdande's icon rather than to nothing: an icon is the one asset whose
+// absence turns into a broken-image placeholder on the Updates screen — which is
+// exactly how four releases of nolimit-views shipped with no icon — so serving the
+// wrong mark beats serving none.
+func resolveNotesAssets(web fs.FS, missing func(name, alias string)) map[string]string {
+	out := map[string]string{}
+	for name, alias := range notesAssetAliases {
+		if _, err := fs.Stat(web, alias); err != nil {
+			missing(name, alias)
+			continue
+		}
+		out[name] = alias
+	}
+	return out
+}
+
+// ---------------------------------------------------------------------------
+// The second door.
+//
+// One instance, one database, one login — and two things you can install. urd is
+// reached at /urd, which serves the same single-page app under its own identity:
+// its own title, its own mark, and its own web manifest.
+//
+// The manifest is the part that matters and the part that is easy to get wrong.
+// An operating system does not install a URL, it installs a *manifest*, and the
+// identity of an installed app is the manifest's `id`. Two manifests on one origin
+// with different ids are two installable apps; two URLs sharing one manifest are
+// one app with a bookmark.
+//
+// And the shell has to be served per door rather than patched by JavaScript,
+// because iOS reads the page's <head> when somebody taps Add to Home Screen —
+// Safari looks for apple-touch-icon BY NAME and has historically ignored the
+// manifest's icons entirely. A head rewritten after load is a head that may or may
+// not be the one iOS read.
+// ---------------------------------------------------------------------------
+
+// urdDoorPath is the entry point, and it is also the manifest's id. One constant,
+// because those two being the same string is the whole mechanism.
+const urdDoorPath = "/urd"
+
+// urdShellRebrands rewrites the four things in the shell's <head> that decide what
+// this door is: what the tab says, what a crawler reads, which manifest the browser
+// fetches, and which icons it finds without the manifest.
+//
+// Note what is NOT in here, for the same reason as in shellRebrands above: the
+// three `verdande:` localStorage keys in the inline theme script. They are storage
+// rather than a name, the rest of the app reads them, and — now more than before —
+// the two doors share an origin and therefore share that storage. Renaming them
+// here would give the two apps different themes by accident and lose everybody's
+// setting on the way.
+func urdShellRebrands() []rebrand {
+	return []rebrand{
+		{"<title>verdande</title>", "<title>urd</title>"},
+		{
+			`<meta name="description" content="verdande — opgaver og projekter, delt." />`,
+			`<meta name="description" content="` + notesShellDescription + `" />`,
+		},
+		{
+			`<link rel="manifest" href="/manifest.webmanifest" />`,
+			`<link rel="manifest" href="/urd.webmanifest" />`,
+		},
+		{
+			`<link rel="icon" href="/icon.svg" type="image/svg+xml" />`,
+			`<link rel="icon" href="/urd-icon.svg" type="image/svg+xml" />`,
+		},
+		{
+			`<link rel="apple-touch-icon" href="/apple-touch-icon.png" />`,
+			`<link rel="apple-touch-icon" href="/urd-apple-touch-icon.png" />`,
+		},
+	}
+}
+
+// urdManifest builds the second door's manifest from the one the frontend build
+// produced, rather than writing a second one by hand.
+//
+// Transformed as JSON rather than by string replacement, which the shell above
+// does: a manifest needs keys the built one does not have — `id` and `start_url`
+// — so there is nothing to anchor a replacement on, and a hand-written copy would
+// drift on the fields the two genuinely share (the colours, the display mode, the
+// language).
+//
+// `id` is what makes this a second app rather than a bookmark. `scope` is spelled
+// out even though "/" is what the spec would default to from a start_url of
+// "/urd": an app whose scope did not cover the whole origin would open its own
+// links in a browser tab the first time somebody navigated out of /urd, and that
+// is a rule nobody should have to remember while reading this.
+func urdManifest(raw []byte) ([]byte, error) {
+	var m map[string]any
+	if err := json.Unmarshal(raw, &m); err != nil {
+		return nil, fmt.Errorf("the built manifest is not JSON: %w", err)
+	}
+
+	m["id"] = urdDoorPath
+	m["start_url"] = urdDoorPath
+	m["scope"] = "/"
+	m["name"] = "urd"
+	m["short_name"] = "urd"
+	m["description"] = notesManifestDescription
+
+	icons, ok := m["icons"].([]any)
+	if !ok || len(icons) == 0 {
+		return nil, fmt.Errorf("the built manifest has no icons to rewrite")
+	}
+	for i, entry := range icons {
+		icon, ok := entry.(map[string]any)
+		if !ok {
+			return nil, fmt.Errorf("icon %d is not an object", i)
+		}
+		src, _ := icon["src"].(string)
+		// Every icon must be one this door has a file for. Refusing an unknown one
+		// is the point: an icon added to the manifest and not to this map would
+		// otherwise leave urd's install prompt showing Verdande's mark, which is
+		// cosmetic enough that nobody files it.
+		swapped, ok := map[string]string{
+			"/icon.svg":     "/urd-icon.svg",
+			"/icon-192.png": "/urd-icon-192.png",
+			"/icon-512.png": "/urd-icon-512.png",
+		}[src]
+		if !ok {
+			return nil, fmt.Errorf("icon %d is %q, which urd has no file for", i, src)
+		}
+		icon["src"] = swapped
+	}
+
+	out, err := json.MarshalIndent(m, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	return append(out, '\n'), nil
+}
+
+// urdDoorAssets builds the second door from the files the frontend build produced.
+//
+// Both or neither, and loudly: a door whose shell points at /urd.webmanifest while
+// that manifest is not being served is an install prompt that silently falls back
+// to the other app's identity.
+func urdDoorAssets(web fs.FS) (shell, manifest []byte, err error) {
+	raw, err := fs.ReadFile(web, "index.html")
+	if err != nil {
+		return nil, nil, fmt.Errorf("index.html: %w", err)
+	}
+	shell, err = applyRebrands(raw, urdShellRebrands())
+	if err != nil {
+		return nil, nil, fmt.Errorf("index.html: %w", err)
+	}
+
+	raw, err = fs.ReadFile(web, "manifest.webmanifest")
+	if err != nil {
+		return nil, nil, fmt.Errorf("manifest.webmanifest: %w", err)
+	}
+	manifest, err = urdManifest(raw)
+	if err != nil {
+		return nil, nil, fmt.Errorf("manifest.webmanifest: %w", err)
+	}
+	return shell, manifest, nil
+}
+
+// door returns the bytes for the second door's two paths, or nil.
+//
+// Keyed on the requested path rather than on the resolved file, unlike `renamed`
+// below: /urd is not a file and never will be, so it has to be answered before the
+// fallback to index.html gets to it — which would serve the other door's shell
+// under this door's address, with no error anywhere.
+func (s *Server) door(name string) []byte {
+	switch name {
+	case "urd":
+		return s.urdShell
+	case "urd.webmanifest":
+		return s.urdManifest
+	}
+	return nil
+}

internal/httpapi/shell_test.go

@@ -0,0 +1,442 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"io"
+	"io/fs"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"testing/fstest"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/config"
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// serverWithWeb builds the real router around a frontend, which newTestServerWith
+// cannot do — it passes nil for the web filesystem, because every other test here
+// is about the API. The renaming only happens when there is something to rename.
+func serverWithWeb(t *testing.T, edition string, web fs.FS) *Server {
+	t.Helper()
+
+	db, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+
+	cfg := &config.Config{
+		BaseURL:    "http://localhost",
+		DataDir:    t.TempDir(),
+		SessionTTL: 24 * time.Hour,
+		Edition:    edition,
+	}
+	return New(cfg, db, slog.New(slog.NewTextHandler(io.Discard, nil)), web)
+}
+
+// The shell as the frontend build produces it, cut down to the parts that matter
+// here: the two anchors that get renamed, and the inline theme script that must
+// not be touched. TestAppHTMLStillCarriesTheAnchors below is what keeps this
+// honest against the real file.
+const builtShell = `<!doctype html>
+<html lang="da" data-theme="dark">
+	<head>
+		<meta name="description" content="verdande — opgaver og projekter, delt." />
+		<link rel="manifest" href="/manifest.webmanifest" />
+		<link rel="icon" href="/icon.svg" type="image/svg+xml" />
+		<link rel="apple-touch-icon" href="/apple-touch-icon.png" />
+		<title>verdande</title>
+		<script>
+			try {
+				const stored = localStorage.getItem('verdande:theme');
+				const look = localStorage.getItem('verdande:look');
+				if (look && look !== 'verdande') document.documentElement.dataset.look = look;
+			} catch (e) {}
+		</script>
+	</head>
+	<body></body>
+</html>
+`
+
+const builtManifest = `{
+  "name": "verdande",
+  "short_name": "verdande",
+  "description": "Opgaver og projekter, delt.",
+  "start_url": "/",
+  "display": "standalone",
+  "background_color": "#111312",
+  "theme_color": "#111312",
+  "lang": "da",
+  "icons": [
+    { "src": "/icon.svg", "sizes": "any", "type": "image/svg+xml", "purpose": "any" },
+    { "src": "/icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any" },
+    { "src": "/icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any" },
+    { "src": "/icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "maskable" }
+  ]
+}
+`
+
+func builtWeb() fstest.MapFS {
+	return fstest.MapFS{
+		"index.html":            {Data: []byte(builtShell)},
+		"manifest.webmanifest":  {Data: []byte(builtManifest)},
+		"_app/immutable/app.js": {Data: []byte("// app")},
+	}
+}
+
+// TestRenamingTheShellLeavesTheStorageKeysAlone is the one this file exists for.
+//
+// The product name and the localStorage prefix are the same word in app.html, and
+// they are not the same thing: the prefix is read back by the app itself, so
+// renaming it here and nowhere else sets the theme from one key and reads it from
+// another. The symptom is the white flash on load that the inline script exists to
+// prevent — which is to say, no error, nothing in a log, and nothing a test that
+// merely checked the title would see.
+func TestRenamingTheShellLeavesTheStorageKeysAlone(t *testing.T) {
+	shell, manifest, err := rebrandedAssets(builtWeb(), "urd", "urd — noter, delt.", "Noter, delt.")
+	if err != nil {
+		t.Fatalf("rebrandedAssets: %v", err)
+	}
+
+	got := string(shell)
+	for _, want := range []string{
+		"<title>urd</title>",
+		`content="urd — noter, delt."`,
+	} {
+		if !strings.Contains(got, want) {
+			t.Errorf("the shell does not contain %q", want)
+		}
+	}
+	// Named values rather than "no occurrences of verdande": the three keys are
+	// what has to survive, so the assertion says the three keys.
+	for _, want := range []string{
+		`localStorage.getItem('verdande:theme')`,
+		`localStorage.getItem('verdande:look')`,
+		`look !== 'verdande'`,
+	} {
+		if !strings.Contains(got, want) {
+			t.Errorf("renaming the shell changed a storage key: %q is gone", want)
+		}
+	}
+	if strings.Contains(got, "urd:theme") || strings.Contains(got, "urd:look") {
+		t.Error("renaming the shell rewrote a localStorage prefix; the app reads the verdande: ones")
+	}
+
+	gotManifest := string(manifest)
+	for _, want := range []string{`"name": "urd"`, `"short_name": "urd"`, `"description": "Noter, delt."`} {
+		if !strings.Contains(gotManifest, want) {
+			t.Errorf("the manifest does not contain %q", want)
+		}
+	}
+}
+
+// TestRenamingTheShellKeepsTheCSPHashValid pins the relationship between the two
+// files that is easy to break and impossible to notice: the policy names a hash of
+// the inline script, and the renamed shell is what gets served. If a replacement
+// ever reached inside the <script>, the hash would change, the browser would refuse
+// to run it, and the page would be blank — in production only, because the policy
+// is not enforced for a page opened from a file.
+func TestRenamingTheShellKeepsTheCSPHashValid(t *testing.T) {
+	shell, _, err := rebrandedAssets(builtWeb(), "urd", "urd — noter, delt.", "Noter, delt.")
+	if err != nil {
+		t.Fatalf("rebrandedAssets: %v", err)
+	}
+
+	before := scriptHashesIn([]byte(builtShell))
+	after := scriptHashesIn(shell)
+	if len(before) != 1 {
+		t.Fatalf("the fixture should have exactly one inline script, found %d", len(before))
+	}
+	if len(after) != len(before) || after[0] != before[0] {
+		t.Errorf("renaming changed the inline script: policy had %v, served shell hashes to %v", before, after)
+	}
+}
+
+// TestRenamingRefusesAMissingAnchor is the direction that matters more than the
+// happy path. A replacement that silently matched nothing leaves an Urd instance
+// calling itself verdande, which is cosmetic enough that nobody reports it — so the
+// rewrite has to say so rather than return what it managed.
+func TestRenamingRefusesAMissingAnchor(t *testing.T) {
+	cases := map[string]fstest.MapFS{
+		"no title": {
+			"index.html":           {Data: []byte(strings.Replace(builtShell, "<title>verdande</title>", "<title>something else</title>", 1))},
+			"manifest.webmanifest": {Data: []byte(builtManifest)},
+		},
+		"no description": {
+			"index.html":           {Data: []byte(strings.Replace(builtShell, `content="verdande — opgaver og projekter, delt."`, `content="other"`, 1))},
+			"manifest.webmanifest": {Data: []byte(builtManifest)},
+		},
+		"no manifest name": {
+			"index.html":           {Data: []byte(builtShell)},
+			"manifest.webmanifest": {Data: []byte(strings.Replace(builtManifest, `"name": "verdande"`, `"name": "other"`, 1))},
+		},
+		"no index.html at all": {
+			"manifest.webmanifest": {Data: []byte(builtManifest)},
+		},
+		"no manifest at all": {
+			"index.html": {Data: []byte(builtShell)},
+		},
+	}
+	for name, web := range cases {
+		t.Run(name, func(t *testing.T) {
+			if _, _, err := rebrandedAssets(web, "urd", "d", "m"); err == nil {
+				t.Error("renaming reported success over a shell it could not rename")
+			}
+		})
+	}
+}
+
+// TestAppHTMLStillCarriesTheAnchors is what stops the fixture above from becoming a
+// frozen copy of a file that has moved on.
+//
+// The anchors are exact strings in web/src/app.html, and that file is edited for
+// unrelated reasons — a meta tag, a new theme attribute. An edit that reformats the
+// title line or rewrites the description breaks the rename and nothing in Go would
+// know, because the Go build graph has never heard of app.html.
+//
+// Note the caching trap that comes with reading a non-Go file from a test: `go
+// test` will serve a cached green over a changed app.html. CI passes -count=1 in
+// both workflows; a local run needs it typed.
+func TestAppHTMLStillCarriesTheAnchors(t *testing.T) {
+	raw, err := os.ReadFile("../../web/src/app.html")
+	if err != nil {
+		t.Skipf("app.html is not reachable from here: %v", err)
+	}
+	src := string(raw)
+
+	// Both sets: the edition's rename and the second door's. The door was added
+	// after this test and its anchors were NOT covered, which is how its fixture
+	// came to be missing two <link> lines the real file has — caught only because
+	// applyRebrands refuses an anchor it cannot find.
+	for what, pairs := range map[string][]rebrand{
+		"the notes edition's rename": shellRebrands("urd", "d"),
+		"the urd door":               urdShellRebrands(),
+	} {
+		for _, pair := range pairs {
+			if n := strings.Count(src, pair.old); n != 1 {
+				t.Errorf("web/src/app.html contains %d occurrences of the anchor %q, want exactly 1 — %s replaces it",
+					n, pair.old, what)
+			}
+		}
+	}
+	// And the keys the rename must not touch, asserted here too: app.html is where
+	// somebody would rename them, and if they are renamed there they must be
+	// renamed in stores.svelte.js in the same commit.
+	if !strings.Contains(src, `localStorage.getItem('verdande:theme')`) {
+		t.Error("web/src/app.html no longer reads verdande:theme; check that the app reads the same key")
+	}
+	t.Logf("app.html: %d bytes, %d edition anchors, %d door anchors",
+		len(raw), len(shellRebrands("urd", "d")), len(urdShellRebrands()))
+}
+
+// TestTheFullEditionServesTheBuiltFilesUnchanged is the control. Everything above
+// is about the renamed path; this says the other edition does not go through it.
+func TestTheFullEditionServesTheBuiltFilesUnchanged(t *testing.T) {
+	for _, edition := range []string{"full", "notes"} {
+		t.Run(edition, func(t *testing.T) {
+			srv := serverWithWeb(t, edition, builtWeb())
+			if edition == "full" {
+				if srv.renamed("index.html") != nil || srv.renamed("manifest.webmanifest") != nil {
+					t.Error("the full edition renamed the shell")
+				}
+				return
+			}
+			if srv.renamed("index.html") == nil || srv.renamed("manifest.webmanifest") == nil {
+				t.Fatal("the notes edition did not rename the shell")
+			}
+			if !strings.Contains(string(srv.renamed("index.html")), "<title>urd</title>") {
+				t.Error("the notes edition's shell does not say urd")
+			}
+			if srv.renamed("_app/immutable/app.js") != nil {
+				t.Error("a build asset was served from memory; only the shell and the manifest are renamed")
+			}
+		})
+	}
+}
+
+// webWithIcons is builtWeb plus both editions' icons, as a real build has them.
+func webWithIcons() fstest.MapFS {
+	web := builtWeb()
+	for _, name := range []string{
+		"icon.svg", "icon-192.png", "icon-512.png", "apple-touch-icon.png",
+		"urd-icon.svg", "urd-icon-192.png", "urd-icon-512.png", "urd-apple-touch-icon.png",
+	} {
+		web[name] = &fstest.MapFile{Data: []byte("bytes of " + name)}
+	}
+	return web
+}
+
+// TestEachEditionServesItsOwnMark.
+//
+// Four paths, named one by one rather than counted: the favicon in app.html, the
+// manifest's two, and the one Safari looks for by name. The last is the reason
+// this is an alias rather than a rewritten manifest — Safari does not read the
+// manifest at all.
+func TestEachEditionServesItsOwnMark(t *testing.T) {
+	for _, tc := range []struct {
+		edition string
+		want    map[string]string
+	}{
+		{"notes", map[string]string{
+			"icon.svg":             "urd-icon.svg",
+			"icon-192.png":         "urd-icon-192.png",
+			"icon-512.png":         "urd-icon-512.png",
+			"apple-touch-icon.png": "urd-apple-touch-icon.png",
+		}},
+		// The control, and it is the half that stops this being a swap rather than
+		// a choice: the full edition must resolve nothing.
+		{"full", map[string]string{}},
+	} {
+		t.Run(tc.edition, func(t *testing.T) {
+			srv := serverWithWeb(t, tc.edition, webWithIcons())
+			if len(srv.assets) != len(tc.want) {
+				t.Errorf("%s edition aliases %d paths, want %d: %v", tc.edition, len(srv.assets), len(tc.want), srv.assets)
+			}
+			for path, alias := range tc.want {
+				if srv.assets[path] != alias {
+					t.Errorf("%s: %s resolves to %q, want %q", tc.edition, path, srv.assets[path], alias)
+				}
+			}
+			// And nothing else: an alias on a build asset would serve one file's
+			// bytes under another's hashed, immutable name.
+			for path := range srv.assets {
+				if _, ok := tc.want[path]; !ok {
+					t.Errorf("%s edition aliases %s, which is not an icon", tc.edition, path)
+				}
+			}
+			t.Logf("%s: %d aliased paths", tc.edition, len(srv.assets))
+		})
+	}
+}
+
+// TestAMissingMarkIsReportedAndFallsBack.
+//
+// The fallback is deliberate and it is the only place in this file that prefers
+// carrying on to failing: an icon's absence is a broken-image placeholder on the
+// one screen somebody reads before deciding whether to press update, so the wrong
+// mark beats no mark. What must not happen is it being quiet.
+func TestAMissingMarkIsReportedAndFallsBack(t *testing.T) {
+	web := webWithIcons()
+	delete(web, "urd-icon-512.png")
+
+	var reported []string
+	got := resolveNotesAssets(web, func(name, alias string) {
+		reported = append(reported, name+" → "+alias)
+	})
+
+	if len(reported) != 1 || reported[0] != "icon-512.png → urd-icon-512.png" {
+		t.Errorf("the missing icon was reported as %v, want exactly one naming both paths", reported)
+	}
+	if _, ok := got["icon-512.png"]; ok {
+		t.Error("a path with no file behind it was aliased anyway")
+	}
+	if got["icon.svg"] != "urd-icon.svg" {
+		t.Error("one missing icon took the other three with it")
+	}
+}
+
+// TestTheUrdDoorIsItsOwnApp.
+//
+// An operating system does not install a URL, it installs a manifest, and the
+// identity of an installed app is that manifest's `id`. So this asserts the two
+// things that decide whether /urd becomes a second icon on a home screen or just a
+// bookmark into the first one — and it asserts them as named values, because an
+// empty manifest, verdande's manifest and urd's all parse as JSON.
+func TestTheUrdDoorIsItsOwnApp(t *testing.T) {
+	srv := serverWithWeb(t, "full", webWithIcons())
+
+	if srv.door("urd") == nil || srv.door("urd.webmanifest") == nil {
+		t.Fatal("the full edition does not serve the urd door; it is a second face, not an edition")
+	}
+
+	shell := string(srv.door("urd"))
+	for _, want := range []string{
+		"<title>urd</title>",
+		`<link rel="manifest" href="/urd.webmanifest" />`,
+		// iOS reads this one by name and has historically ignored the manifest's
+		// icons entirely, which is why the shell is served per door rather than
+		// patched by script after load.
+		`<link rel="apple-touch-icon" href="/urd-apple-touch-icon.png" />`,
+		`<link rel="icon" href="/urd-icon.svg" type="image/svg+xml" />`,
+	} {
+		if !strings.Contains(shell, want) {
+			t.Errorf("the urd door's shell does not contain %q", want)
+		}
+	}
+	// The same trap as the edition shell: the two doors share an origin and
+	// therefore share localStorage, so renaming a storage key here would give the
+	// two apps different themes by accident.
+	if !strings.Contains(shell, `localStorage.getItem('verdande:theme')`) {
+		t.Error("the urd door's shell lost a storage key; the two doors share one origin and one localStorage")
+	}
+
+	var m map[string]any
+	if err := json.Unmarshal(srv.door("urd.webmanifest"), &m); err != nil {
+		t.Fatalf("the urd manifest is not JSON: %v", err)
+	}
+	for key, want := range map[string]any{
+		// id is the install identity. Without it, two manifests on one origin are
+		// one app with two start urls.
+		"id":         "/urd",
+		"start_url":  "/urd",
+		"scope":      "/",
+		"name":       "urd",
+		"short_name": "urd",
+	} {
+		if m[key] != want {
+			t.Errorf("the urd manifest has %s = %v, want %v", key, m[key], want)
+		}
+	}
+	// And the shared half, to prove it was transformed rather than written out: a
+	// hand-written copy would drift on exactly these.
+	var built map[string]any
+	raw, _ := fs.ReadFile(webWithIcons(), "manifest.webmanifest")
+	_ = json.Unmarshal(raw, &built)
+	for _, key := range []string{"display", "background_color", "theme_color", "lang"} {
+		if _, ok := built[key]; ok && m[key] != built[key] {
+			t.Errorf("the urd manifest lost the built one's %s: %v vs %v", key, m[key], built[key])
+		}
+	}
+
+	icons, _ := m["icons"].([]any)
+	if len(icons) == 0 {
+		t.Fatal("the urd manifest has no icons")
+	}
+	for i, entry := range icons {
+		src, _ := entry.(map[string]any)["src"].(string)
+		if !strings.HasPrefix(src, "/urd-") {
+			t.Errorf("icon %d is %q — the urd manifest points at verdande's mark", i, src)
+		}
+	}
+	t.Logf("urd door: shell %d bytes, manifest %d bytes, %d icons", len(srv.door("urd")), len(srv.door("urd.webmanifest")), len(icons))
+}
+
+// TestAnUnknownIconStopsTheUrdManifest is the direction that matters: an icon
+// added to the built manifest and not to urd's map would otherwise leave urd's
+// install prompt showing Verdande's mark, which nobody reports.
+func TestAnUnknownIconStopsTheUrdManifest(t *testing.T) {
+	raw := []byte(`{"name":"verdande","icons":[{"src":"/icon-1024.png","sizes":"1024x1024"}]}`)
+	if _, err := urdManifest(raw); err == nil {
+		t.Error("urdManifest accepted an icon it has no file for")
+	} else if !strings.Contains(err.Error(), "/icon-1024.png") {
+		t.Errorf("the error does not name the icon: %v", err)
+	}
+}
+
+// TestTheWebmanifestTypeCoversBothDoors. A manifest served as text/html is ignored
+// by the browser with no error anywhere; the only symptom is that the install
+// prompt does not appear. This read `name == "manifest.webmanifest"` when the
+// second door was added.
+func TestTheWebmanifestTypeCoversBothDoors(t *testing.T) {
+	for _, name := range []string{"manifest.webmanifest", "urd.webmanifest"} {
+		if got := contentTypeFor(name); got != "application/manifest+json" {
+			t.Errorf("%s is served as %q", name, got)
+		}
+	}
+	if got := contentTypeFor("index.html"); got != "text/html; charset=utf-8" {
+		t.Errorf("index.html is served as %q", got)
+	}
+}

internal/httpapi/tasks_handlers.go

@@ -243,6 +243,10 @@ func (s *Server) handleCreateTask(w http.ResponseWriter, r *http.Request) {
 	// The store wrote the labels; the struct it was handed does not know that, and
 	// the response has to describe the task that now exists.
 	t.Labels = req.Labels
+	if err := s.applyDefaultReminder(r.Context(), t, user); err != nil {
+		s.internal(w, r, "default reminder", err)
+		return
+	}
 	s.activity(r, t.ProjectID, t.ID, "task.created", map[string]any{"content": t.Content})
 	s.publish(t.ProjectID, "task.created", toTaskJSON(*t))
 	// Lavet til en anden med det samme. Det er den samme besked som at blive
@@ -337,6 +341,12 @@ func (s *Server) handleUpdateTask(w http.ResponseWriter, r *http.Request) {
 		s.storeError(w, r, "get task", err)
 		return
 	}
+	// Et klokkeslu00e6t kan ogsu00e5 komme til EFTER at opgaven er lavet, og det er den
+	// halvdel, der ellers mangler i et lu00f8fte om "alle opgaver med en dato og tid".
+	if err := s.applyDefaultReminder(r.Context(), t, user); err != nil {
+		s.internal(w, r, "default reminder", err)
+		return
+	}
 	s.activity(r, t.ProjectID, t.ID, "task.updated", nil)
 	s.publish(t.ProjectID, "task.updated", toTaskJSON(*t))
 	if req.AssigneeID != nil && t.AssigneeID != wasAssigned {
@@ -501,6 +511,18 @@ type quickAddRequest struct {
 	// the foot of one. Same rule as the project: a "/section" in the text wins,
 	// because typing it is a choice and standing there is a circumstance.
 	SectionID string `json:"section_id,omitempty"`
+
+	// ParentID makes the new task a sub-task of an existing one. It is what a
+	// pasted list uses for its indented lines, and what the sub-task field at the
+	// foot of a task uses — both want the same parsing of dates, #project and
+	// @labels that a top-level task gets, so they come through here rather than
+	// through a second, dumber path.
+	//
+	// A sub-task lives in its parent's project. Saying otherwise would describe a
+	// task whose parent is somewhere else, which the list views cannot draw and
+	// nobody means; a "#project" on an indented line is therefore not honoured,
+	// and the caller is told so the word does not just vanish.
+	ParentID string `json:"parent_id,omitempty"`
 }
 
 func (s *Server) handleQuickAdd(w http.ResponseWriter, r *http.Request) {
@@ -517,6 +539,18 @@ func (s *Server) handleQuickAdd(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// A parent decides the project before anything else is read: a sub-task
+	// somewhere other than its parent is not a shape this program has.
+	parent := (*store.Task)(nil)
+	if req.ParentID != "" {
+		found, err := s.db.GetTask(r.Context(), req.ParentID, user.ID)
+		if err != nil {
+			writeError(w, http.StatusNotFound, CodeNotFound, "not found")
+			return
+		}
+		parent = found
+	}
+
 	projectID := req.ProjectID
 	// Set when the text named a project that does not exist. The task is still
 	// created — see below — but the caller is told, because the alternative is
@@ -532,6 +566,14 @@ func (s *Server) handleQuickAdd(w http.ResponseWriter, r *http.Request) {
 			unknownProject = parsed.Project
 		}
 	}
+	// The parent has the last word, and the word it overrules is reported the same
+	// way an unknown project is — the task is created either way.
+	if parent != nil {
+		if parsed.Project != "" && projectID != parent.ProjectID {
+			unknownProject = parsed.Project
+		}
+		projectID = parent.ProjectID
+	}
 	if projectID == "" {
 		var err error
 		if projectID, err = s.db.InboxID(r.Context(), user.ID); err != nil {
@@ -570,6 +612,9 @@ func (s *Server) handleQuickAdd(w http.ResponseWriter, r *http.Request) {
 		Priority: parsed.Priority, CreatedBy: user.ID, DueDate: parsed.DueDate,
 		RecurrenceRule: parsed.Recurrence,
 	}
+	if parent != nil {
+		t.ParentID = parent.ID
+	}
 	if parsed.DueDate != "" {
 		_, when, err := resolveDue(parsed.DueDate, parsed.DueTime, user.Timezone)
 		if err == nil {
@@ -585,14 +630,55 @@ func (s *Server) handleQuickAdd(w http.ResponseWriter, r *http.Request) {
 	s.activity(r, t.ProjectID, t.ID, "task.created", map[string]any{"content": t.Content})
 	s.publish(t.ProjectID, "task.created", toTaskJSON(*t))
 
-	if unknownProject != "" || unknownSection != "" {
+	// The alarm the line asked for, after the task because a reminder needs its id.
+	//
+	// Set when the line asked to be reminded and the task has nothing to count back
+	// from. An offset is relative to the due moment, and DueReminders selects the
+	// offset form only `AND t.due_datetime IS NOT NULL` — so on a task with a day
+	// but no clock there is nothing to be an hour before, and the row would sit in
+	// the table forever without firing. Reported the same way an unknown project
+	// is: the task is created either way, and the caller is told what could not be
+	// honoured. An alarm that silently never rings is the one way a reminder must
+	// not fail, because nothing afterwards reveals it.
+	reminderNotSet := ""
+	switch {
+	case len(parsed.ReminderAt) == len("2006-01-02T15:04"):
+		day, clock := parsed.ReminderAt[:10], parsed.ReminderAt[11:]
+		if _, when, err := resolveDue(day, clock, user.Timezone); err == nil && when != nil {
+			if _, err := s.db.CreateReminder(r.Context(), t.ID, user.ID, when, nil); err != nil {
+				s.internal(w, r, "create reminder", err)
+				return
+			}
+		}
+	case parsed.ReminderOffsetMin != nil:
+		if t.DueDatetime == nil {
+			reminderNotSet = "no due time to count back from"
+		} else if _, err := s.db.CreateReminder(r.Context(), t.ID, user.ID, nil, parsed.ReminderOffsetMin); err != nil {
+			s.internal(w, r, "create reminder", err)
+			return
+		}
+	}
+
+	// Standarden til sidst, og efter den udtrykkelige: "mind mig en time fu00f8r" har
+	// allerede lagt sin, og applyDefaultReminder lu00e6gger ikke en oven pu00e5. "ingen
+	// alarm" er den anden vej ud u2014 den eneste mu00e5de at sige nej til standarden,
+	// mens man skriver opgaven, frem for at u00e5bne den bagefter og slette alarmen.
+	if !parsed.NoReminder {
+		if err := s.applyDefaultReminder(r.Context(), t, user); err != nil {
+			s.internal(w, r, "default reminder", err)
+			return
+		}
+	}
+
+	if unknownProject != "" || unknownSection != "" || reminderNotSet != "" {
 		// Alongside the task rather than instead of it: the task was created, and
 		// this says what could not be honoured while creating it.
 		writeJSON(w, http.StatusCreated, struct {
 			taskJSON
 			UnknownProject string `json:"unknown_project,omitempty"`
 			UnknownSection string `json:"unknown_section,omitempty"`
-		}{toTaskJSON(*t), unknownProject, unknownSection})
+			ReminderNotSet string `json:"reminder_not_set,omitempty"`
+		}{toTaskJSON(*t), unknownProject, unknownSection, reminderNotSet})
 		return
 	}
 	writeJSON(w, http.StatusCreated, toTaskJSON(*t))
@@ -769,3 +855,38 @@ func (s *Server) handleSnoozeTask(w http.ResponseWriter, r *http.Request) {
 	s.publish(t.ProjectID, "task.updated", toTaskJSON(*t))
 	writeJSON(w, http.StatusOK, toTaskJSON(*t))
 }
+
+// applyDefaultReminder gives a task the alarm the account asks for without being
+// asked each time.
+//
+// Three things make it a no-op, and each of them is the point rather than a guard:
+//
+//   - The account has the default off. That is where every account starts, and it
+//     stays there until somebody turns it on: switching it on in a migration would
+//     have given every existing user alarms they never asked for, on tasks already
+//     lying there, in software other people run themselves.
+//   - The task has no clock. A task due "tomorrow" has no moment to ring at, and
+//     DueReminders selects the offset form only `AND t.due_datetime IS NOT NULL` —
+//     so the row would sit there and never fire.
+//   - The task already has a reminder. The line may have asked for one itself, or
+//     the task may be being edited for the second time; either way the default is
+//     a default and must not stack a second alarm on top of a stated one.
+//
+// Called on every path a task can gain a clock — created, edited, or quick-added —
+// because a default that only applies to one of them is a setting that is true on
+// Tuesdays. CalDAV is deliberately not one of them: a task arriving from Apple
+// Reminders brings its own alarm, and two alarms for one task is worse than none.
+func (s *Server) applyDefaultReminder(ctx context.Context, t *store.Task, user *store.User) error {
+	if user.DefaultReminderMin == nil || t == nil || t.DueDatetime == nil {
+		return nil
+	}
+	existing, err := s.db.ListReminders(ctx, t.ID)
+	if err != nil {
+		return err
+	}
+	if len(existing) > 0 {
+		return nil
+	}
+	_, err = s.db.CreateReminder(ctx, t.ID, user.ID, nil, user.DefaultReminderMin)
+	return err
+}

internal/httpapi/tasks_test.go

@@ -1,6 +1,7 @@
 package httpapi
 
 import (
+	"archive/zip"
 	"bytes"
 	"encoding/json"
 	"io"
@@ -1562,6 +1563,178 @@ func TestImportTodoistCSV(t *testing.T) {
 }
 
 // The whole point of import and export together: what goes in comes back out.
+
+// TestQuickAddSubTask covers the parent a pasted list's indented lines use.
+//
+// The line still goes through the same parser as a top-level one — a sub-task
+// with a date is an ordinary thing to paste, and a second, dumber creation path
+// for indented lines would be a second place for "i morgen" to mean something
+// different.
+func TestQuickAddSubTask(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, parent := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "Flytte garagen",
+	})
+	parentID, _ := parent["id"].(string)
+	if parentID == "" {
+		t.Fatalf("no parent: %v", parent)
+	}
+
+	_, child := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "Rydde hylderne p1", "parent_id": parentID,
+	})
+	if got := child["parent_id"]; got != parentID {
+		t.Errorf("parent_id = %v, want %v", got, parentID)
+	}
+	// The line was parsed, not stored raw: the priority marker is gone from the
+	// text and present as a priority.
+	if got := child["content"]; got != "Rydde hylderne" {
+		t.Errorf("content = %v, want the line without its marker", got)
+	}
+	if got := child["priority"]; got != float64(1) {
+		t.Errorf("priority = %v, want 1", got)
+	}
+
+	t.Run("a sub-task cannot be put in another project", func(t *testing.T) {
+		_, other := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Andetsteds"})
+		otherID, _ := other["id"].(string)
+
+		_, moved := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+			"text": "Hente nøglen #Andetsteds", "parent_id": parentID,
+		})
+		if got := moved["project_id"]; got == otherID {
+			t.Errorf("the sub-task left its parent's project")
+		}
+		// And it is said out loud rather than the word just disappearing from the
+		// title — the failure this reports is exactly the one that used to be silent.
+		if got := moved["unknown_project"]; got != "Andetsteds" {
+			t.Errorf("unknown_project = %v, want the name that could not be honoured", got)
+		}
+	})
+}
+
+// raw fetches a download — a zip or a calendar — as bytes.
+//
+// `do` decodes JSON, which these two are not: it would report an empty body and a
+// parse error where the interesting thing is the bytes themselves.
+func (ts *testServer) raw(t *testing.T, path string) ([]byte, string) {
+	t.Helper()
+	req, _ := http.NewRequest("GET", ts.URL+path, nil)
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
+	resp, err := ts.client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("%s: status %d", path, resp.StatusCode)
+	}
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return body, resp.Header.Get("Content-Type")
+}
+
+// TestExportEverythingAtOnce covers the two whole-account exports.
+//
+// The per-project links worked and were unusable at any size: fifteen projects
+// meant fifteen downloads to move your own tasks somewhere else. These two are
+// the same data without the fifteen clicks.
+//
+// Asserted on the CONTENTS rather than on the status: a zip with no entries and a
+// calendar with no VTODOs are both 200 with a plausible Content-Type, and that is
+// exactly the shape an export bug takes.
+func TestExportEverythingAtOnce(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	// Two projects, so the zip has to hold more than the one that happens to be
+	// first — a loop that exports only the last project passes a one-project test.
+	_, first := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Firma"})
+	_, second := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Hjem"})
+	firstID, _ := first["id"].(string)
+	secondID, _ := second["id"].(string)
+
+	ts.do(t, "POST", "/api/v1/tasks", map[string]any{
+		"content": "Betal moms", "project_id": firstID, "due_date": "2026-11-03",
+	})
+	ts.do(t, "POST", "/api/v1/tasks", map[string]any{
+		"content": "Skifte daek", "project_id": secondID,
+	})
+
+	t.Run("csv zip holds one file per project", func(t *testing.T) {
+		body, ct := ts.raw(t, "/api/v1/export/projects.zip")
+		if ct != "application/zip" {
+			t.Fatalf("content-type %q", ct)
+		}
+		zr, err := zip.NewReader(bytes.NewReader(body), int64(len(body)))
+		if err != nil {
+			t.Fatalf("not a zip: %v", err)
+		}
+
+		found := map[string]string{}
+		for _, f := range zr.File {
+			rc, err := f.Open()
+			if err != nil {
+				t.Fatal(err)
+			}
+			text, _ := io.ReadAll(rc)
+			rc.Close()
+			found[f.Name] = string(text)
+		}
+		if len(found) < 2 {
+			t.Fatalf("want a file per project, got %d: %v", len(found), found)
+		}
+
+		// The task has to be IN the file named after its own project. A zip with the
+		// right filenames and every task in the wrong one is the failure this is for.
+		var sawMoms, sawDaek bool
+		for name, text := range found {
+			// Filenames are lower-cased by ics.Filename, so the comparison is too —
+			// asserting on the stored capitalisation would be asserting on a detail
+			// the exporter is free to change.
+			lower := strings.ToLower(name)
+			if strings.Contains(text, "Betal moms") {
+				sawMoms = true
+				if !strings.Contains(lower, "firma") {
+					t.Errorf("Betal moms landed in %q, not in Firma", name)
+				}
+			}
+			if strings.Contains(text, "Skifte daek") {
+				sawDaek = true
+				if !strings.Contains(lower, "hjem") {
+					t.Errorf("Skifte daek landed in %q, not in Hjem", name)
+				}
+			}
+		}
+		if !sawMoms || !sawDaek {
+			t.Errorf("a task is missing from the zip: moms=%v daek=%v", sawMoms, sawDaek)
+		}
+	})
+
+	t.Run("ics holds every dated task across projects", func(t *testing.T) {
+		body, ct := ts.raw(t, "/api/v1/export/tasks.ics")
+		if !strings.HasPrefix(ct, "text/calendar") {
+			t.Fatalf("content-type %q", ct)
+		}
+		text := string(body)
+		if n := strings.Count(text, "BEGIN:VTODO"); n != 1 {
+			t.Fatalf("want the one dated task, got %d VTODOs:\n%s", n, text)
+		}
+		if !strings.Contains(text, "Betal moms") {
+			t.Errorf("the dated task is missing:\n%s", text)
+		}
+		// Undated tasks are deliberately left out — a VTODO with no date is a line
+		// most readers drop. Asserted so the omission stays a decision.
+		if strings.Contains(text, "Skifte daek") {
+			t.Errorf("an undated task was exported:\n%s", text)
+		}
+	})
+}
+
 func TestTodoistImportExportRoundTrip(t *testing.T) {
 	ts := newTestServer(t)
 	ts.bootstrap(t)
@@ -1907,3 +2080,390 @@ func TestSnoozeSinksAndWakes(t *testing.T) {
 		t.Errorf("woken task did not return: order = %v", got)
 	}
 }
+
+// --- alarms written into the line ---------------------------------------------
+
+// A dictated sentence sets its own alarm, and the alarm actually goes off.
+//
+// The assertion is on DueReminders rather than on a row existing, and the
+// difference is the whole test: a reminder row with the offset the wrong way round
+// exists just as convincingly and rings an hour LATE. So the question asked here is
+// "would this fire, and when" — one minute before it is due it must not be in the
+// list, one minute after it must.
+func TestQuickAddSetsTheAlarmTheLineAskedFor(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ctx := t.Context()
+
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "ring til tandlægen i morgen kl 9 mind mig en time før",
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quick add: %d %v", resp.StatusCode, body)
+	}
+	if body["content"] != "ring til tandlægen" {
+		t.Errorf("content = %v, want %q", body["content"], "ring til tandlægen")
+	}
+	if body["reminder_not_set"] != nil {
+		t.Errorf("reminder_not_set = %v, want absent — the task has a clock", body["reminder_not_set"])
+	}
+
+	taskID, _ := body["id"].(string)
+	rems, err := ts.db.ListReminders(ctx, taskID)
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 1 {
+		t.Fatalf("got %d reminders, want 1", len(rems))
+	}
+	if rems[0].OffsetMin == nil {
+		t.Fatalf("reminder has no offset; it should not be absolute")
+	}
+	if *rems[0].OffsetMin != -60 {
+		t.Errorf("offset = %d, want -60 — the store ADDS this to the due time, so a "+
+			"positive number is an alarm an hour late", *rems[0].OffsetMin)
+	}
+
+	due, err := time.Parse(time.RFC3339, body["due_datetime"].(string))
+	if err != nil {
+		t.Fatalf("parse due_datetime %v: %v", body["due_datetime"], err)
+	}
+
+	early, err := ts.db.DueReminders(ctx, due.Add(-61*time.Minute))
+	if err != nil {
+		t.Fatalf("due reminders (early): %v", err)
+	}
+	if len(early) != 0 {
+		t.Errorf("61 minutes before it is due, %d reminders are already due", len(early))
+	}
+
+	ripe, err := ts.db.DueReminders(ctx, due.Add(-59*time.Minute))
+	if err != nil {
+		t.Fatalf("due reminders (ripe): %v", err)
+	}
+	if len(ripe) != 1 {
+		t.Fatalf("59 minutes before it is due, got %d reminders, want 1", len(ripe))
+	}
+	if ripe[0].TaskContent != "ring til tandlægen" {
+		t.Errorf("the reminder that came due is for %q", ripe[0].TaskContent)
+	}
+}
+
+// An alarm with nothing to count back from is refused out loud.
+//
+// "mind mig en time før" on a task with a day but no clock has no moment to be an
+// hour before, and DueReminders selects the offset form only when the task has a
+// due_datetime — so the row would sit there and never fire. The task is created and
+// the caller is told, the same way an unknown #project is reported. An alarm that
+// silently never rings is the one way a reminder must not fail.
+func TestQuickAddSaysWhenTheAlarmCannotFire(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ctx := t.Context()
+
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "køb mælk i morgen mind mig en time før",
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quick add: %d %v", resp.StatusCode, body)
+	}
+	if body["content"] != "køb mælk" {
+		t.Errorf("content = %v, want %q", body["content"], "køb mælk")
+	}
+	if body["reminder_not_set"] == nil {
+		t.Errorf("reminder_not_set is absent; the alarm could not be set and nothing says so")
+	}
+
+	taskID, _ := body["id"].(string)
+	rems, err := ts.db.ListReminders(ctx, taskID)
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 0 {
+		t.Errorf("got %d reminders, want 0 — a reminder that can never fire is worse "+
+			"than none, because nothing afterwards reveals it", len(rems))
+	}
+}
+
+// A reminder given a clock of its own is kept as an absolute moment.
+func TestQuickAddSetsAnAbsoluteAlarm(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ctx := t.Context()
+
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "ring til tandlægen i morgen kl 9 mind mig kl 8",
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quick add: %d %v", resp.StatusCode, body)
+	}
+
+	taskID, _ := body["id"].(string)
+	rems, err := ts.db.ListReminders(ctx, taskID)
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 1 {
+		t.Fatalf("got %d reminders, want 1", len(rems))
+	}
+	if rems[0].OffsetMin != nil {
+		t.Errorf("offset = %d, want none — a clock was written, so it is absolute", *rems[0].OffsetMin)
+	}
+
+	due, err := time.Parse(time.RFC3339, body["due_datetime"].(string))
+	if err != nil {
+		t.Fatalf("parse due_datetime %v: %v", body["due_datetime"], err)
+	}
+	// Due at nine, reminded at eight: one hour earlier, on the task's own day.
+	if want := due.Add(-time.Hour); !rems[0].RemindAt.Equal(want) {
+		t.Errorf("RemindAt = %v, want %v", rems[0].RemindAt, want)
+	}
+}
+
+// --- the account's standing alarm --------------------------------------------
+
+// turnOnDefaultAlarm switches the account's standing alarm on, so many minutes
+// before the due moment.
+func turnOnDefaultAlarm(t *testing.T, ts *testServer, minutes int) {
+	t.Helper()
+	resp, body := ts.do(t, "PUT", "/api/v1/auth/default-reminder", map[string]any{"minutes": minutes})
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("set default reminder: %d %v", resp.StatusCode, body)
+	}
+}
+
+// With the setting on, a task that has a clock gets its alarm without being asked.
+func TestDefaultAlarmAppliesToATaskWithAClock(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ctx := t.Context()
+	turnOnDefaultAlarm(t, ts, -10)
+
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "hente cyklen i morgen kl 16",
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quick add: %d %v", resp.StatusCode, body)
+	}
+
+	rems, err := ts.db.ListReminders(ctx, body["id"].(string))
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 1 {
+		t.Fatalf("got %d reminders, want 1", len(rems))
+	}
+	if rems[0].OffsetMin == nil || *rems[0].OffsetMin != -10 {
+		t.Errorf("offset = %v, want -10", rems[0].OffsetMin)
+	}
+}
+
+// And off is where every account starts. This is the control for the test above:
+// without it, an alarm appearing for any reason at all reads as the setting working.
+func TestNoDefaultAlarmUntilItIsTurnedOn(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ctx := t.Context()
+
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "hente cyklen i morgen kl 16",
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quick add: %d %v", resp.StatusCode, body)
+	}
+
+	rems, err := ts.db.ListReminders(ctx, body["id"].(string))
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 0 {
+		t.Errorf("got %d reminders on a fresh account, want 0 — turning a notification "+
+			"on for everybody is not a default anybody chose", len(rems))
+	}
+}
+
+// A task with a day but no clock gets nothing, because there is no moment to ring
+// at: DueReminders selects the offset form only when due_datetime is set, so the
+// row would be one that never fires.
+func TestDefaultAlarmNeedsAClockNotJustADay(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ctx := t.Context()
+	turnOnDefaultAlarm(t, ts, -10)
+
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "hente cyklen i morgen",
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quick add: %d %v", resp.StatusCode, body)
+	}
+
+	rems, err := ts.db.ListReminders(ctx, body["id"].(string))
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 0 {
+		t.Errorf("got %d reminders, want 0 — there is no clock to count back from", len(rems))
+	}
+}
+
+// The default does not stack on top of an alarm the line asked for.
+func TestDefaultAlarmDoesNotStackOnAStatedOne(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ctx := t.Context()
+	turnOnDefaultAlarm(t, ts, -10)
+
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "hente cyklen i morgen kl 16 mind mig en time før",
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quick add: %d %v", resp.StatusCode, body)
+	}
+
+	rems, err := ts.db.ListReminders(ctx, body["id"].(string))
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 1 {
+		t.Fatalf("got %d reminders, want 1 — the stated alarm, and no default on top", len(rems))
+	}
+	if rems[0].OffsetMin == nil || *rems[0].OffsetMin != -60 {
+		t.Errorf("offset = %v, want -60 — what the line said, not the default", rems[0].OffsetMin)
+	}
+}
+
+// "ingen alarm" is the way out of the default while writing the task.
+//
+// Without it the only way to have a timed task that does not ring is to create it,
+// open it, and delete the alarm that was just made — which is the omission a
+// default quietly creates.
+func TestNoAlarmInTheLineBeatsTheDefault(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ctx := t.Context()
+	turnOnDefaultAlarm(t, ts, -10)
+
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "hente cyklen i morgen kl 16 ingen alarm",
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quick add: %d %v", resp.StatusCode, body)
+	}
+	if body["content"] != "hente cyklen" {
+		t.Errorf("content = %v, want %q — the refusal should leave the title", body["content"], "hente cyklen")
+	}
+
+	rems, err := ts.db.ListReminders(ctx, body["id"].(string))
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 0 {
+		t.Errorf("got %d reminders, want 0 — the line said no alarm", len(rems))
+	}
+}
+
+// A clock added later gets the alarm too.
+//
+// This is the half a promise about "every task with a date and time" loses if the
+// default is only applied where tasks are created: a task written now and given a
+// time this afternoon is the same task.
+func TestDefaultAlarmAppliesWhenTheClockComesLater(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ctx := t.Context()
+	turnOnDefaultAlarm(t, ts, -10)
+
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "hente cyklen",
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quick add: %d %v", resp.StatusCode, body)
+	}
+	taskID := body["id"].(string)
+
+	rems, err := ts.db.ListReminders(ctx, taskID)
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 0 {
+		t.Fatalf("got %d reminders before there was a clock, want 0", len(rems))
+	}
+
+	resp, body = ts.do(t, "PATCH", "/api/v1/tasks/"+taskID, map[string]any{
+		"due_date": time.Now().AddDate(0, 0, 1).Format("2006-01-02"),
+		"due_time": "16:00",
+	})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("patch task: %d %v", resp.StatusCode, body)
+	}
+
+	rems, err = ts.db.ListReminders(ctx, taskID)
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 1 {
+		t.Fatalf("got %d reminders after the clock was added, want 1", len(rems))
+	}
+	if rems[0].OffsetMin == nil || *rems[0].OffsetMin != -10 {
+		t.Errorf("offset = %v, want -10", rems[0].OffsetMin)
+	}
+}
+
+// A positive offset is refused. An alarm after the thing it warns about is not a
+// reminder, and accepting one here would make the single mistake this value can
+// make — a sign the wrong way round — look like a choice somebody made.
+func TestDefaultAlarmRefusesAnOffsetAfterTheDueTime(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, body := ts.do(t, "PUT", "/api/v1/auth/default-reminder", map[string]any{"minutes": 10})
+	if resp.StatusCode != http.StatusUnprocessableEntity && resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("set default reminder with +10: %d %v, want a refusal", resp.StatusCode, body)
+	}
+}
+
+// Null turns it off again, and the alarms already made are left alone: a default is
+// what happens to the NEXT task, not a statement about the ones already written.
+func TestDefaultAlarmCanBeTurnedOffAgain(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ctx := t.Context()
+	turnOnDefaultAlarm(t, ts, -10)
+
+	resp, body := ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "hente cyklen i morgen kl 16",
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quick add: %d %v", resp.StatusCode, body)
+	}
+	kept := body["id"].(string)
+
+	resp, body = ts.do(t, "PUT", "/api/v1/auth/default-reminder", map[string]any{"minutes": nil})
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("turn off: %d %v", resp.StatusCode, body)
+	}
+
+	resp, body = ts.do(t, "POST", "/api/v1/tasks/quick-add", map[string]any{
+		"text": "hente bilen i morgen kl 17",
+	})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("quick add: %d %v", resp.StatusCode, body)
+	}
+	rems, err := ts.db.ListReminders(ctx, body["id"].(string))
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 0 {
+		t.Errorf("got %d reminders after turning the default off, want 0", len(rems))
+	}
+
+	rems, err = ts.db.ListReminders(ctx, kept)
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rems) != 1 {
+		t.Errorf("the alarm made while it was on is gone; turning a default off is not " +
+			"a statement about the tasks already written")
+	}
+}

internal/httpapi/views_handlers.go

@@ -206,13 +206,22 @@ func (s *Server) handleSearch(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	tasks, err := s.db.ListTasks(r.Context(), user.ID, store.TaskFilter{
-		Search: query,
-		// Completed tasks are included: "what was that thing I did last week" is
-		// a search, and excluding them makes the box feel broken.
-		IncludeCompleted: true,
-		Limit:            parseLimit(r.URL.Query().Get("limit"), 40, 100),
-	})
+	// Søgningen er monteret i begge udgaver, fordi man også skal kunne finde sine
+	// noter og notesbøger. Men opgaverne må ikke komme med i noter-udgaven, og det
+	// er ikke en teoretisk sag: en instans lavet om fra en fuld har opgaverne
+	// liggende i databasen endnu, og så ville ⌘K være den ene dør, der stod åben
+	// ind til den halvdel, resten af programmet lige har lukket.
+	var tasks []store.Task
+	var err error
+	if !s.cfg.NotesOnly() {
+		tasks, err = s.db.ListTasks(r.Context(), user.ID, store.TaskFilter{
+			Search: query,
+			// Completed tasks are included: "what was that thing I did last week" is
+			// a search, and excluding them makes the box feel broken.
+			IncludeCompleted: true,
+			Limit:            parseLimit(r.URL.Query().Get("limit"), 40, 100),
+		})
+	}
 	if err != nil {
 		s.internal(w, r, "search tasks", err)
 		return

internal/jobs/jobs_test.go

@@ -40,7 +40,7 @@ func newRunner(t *testing.T) (*Runner, *store.DB, *config.Config) {
 	t.Cleanup(func() { db.Close() })
 
 	log := slog.New(slog.NewTextHandler(io.Discard, nil))
-	return New(cfg, db, log, mail.New(cfg.SMTP, cfg.BaseURL, log), realtime.NewHub(log)), db, cfg
+	return New(cfg, db, log, mail.New(cfg.SMTP, cfg.BaseURL, cfg.ProductSlug(), log), realtime.NewHub(log)), db, cfg
 }
 
 func seedUser(t *testing.T, db *store.DB) *store.User {

internal/mail/mail.go

@@ -24,13 +24,19 @@ import (
 type Sender struct {
 	cfg config.SMTP
 	log *slog.Logger
-	// appName and baseURL appear in the body of every message.
+	// appName and baseURL appear in every message. appName is the edition's own
+	// name — an invite from an urd instance that said "verdande" would be a letter
+	// to somebody else's inbox about a program they are not being invited to.
+	//
+	// It was a field with a value and no reader until 2026-10-07: the three places
+	// that needed it had the word written out instead, and the comment above said
+	// it appeared in every message. It does now.
 	appName string
 	baseURL string
 }
 
-func New(cfg config.SMTP, baseURL string, log *slog.Logger) *Sender {
-	return &Sender{cfg: cfg, log: log, appName: "verdande", baseURL: baseURL}
+func New(cfg config.SMTP, baseURL, appName string, log *slog.Logger) *Sender {
+	return &Sender{cfg: cfg, log: log, appName: appName, baseURL: baseURL}
 }
 
 // Configured reports whether mail can actually be sent. Handlers use it to decide
@@ -38,7 +44,7 @@ func New(cfg config.SMTP, baseURL string, log *slog.Logger) *Sender {
 func (s *Sender) Configured() bool { return s.cfg.Configured() }
 
 func (s *Sender) SendInvite(ctx context.Context, to, inviterName, projectName, link string, ttl time.Duration) error {
-	what := "verdande"
+	what := s.appName
 	if projectName != "" {
 		what = "projektet “" + projectName + "”"
 	}
@@ -61,7 +67,7 @@ func (s *Sender) SendNoteInvite(ctx context.Context, to, inviterName, noteTitle,
 }
 
 func (s *Sender) sendInvite(ctx context.Context, to, inviterName, what, link string, ttl time.Duration) error {
-	subject := fmt.Sprintf("%s har delt noget med dig i verdande", inviterName)
+	subject := fmt.Sprintf("%s har delt noget med dig i %s", inviterName, s.appName)
 	body := fmt.Sprintf(`Hej
 
 %s har inviteret dig til %s.
@@ -71,9 +77,9 @@ Opret din konto her:
 
 Linket virker i %s. Hvis du ikke ved, hvad det her handler om, kan du roligt slette denne mail — der sker ikke noget, hvis du ikke bruger linket.
 
-— verdande
+— %s
 %s
-`, inviterName, what, link, humanDuration(ttl), s.baseURL)
+`, inviterName, what, link, humanDuration(ttl), s.appName, s.baseURL)
 
 	return s.send(ctx, to, subject, body)
 }
@@ -88,17 +94,17 @@ Du bad om en påmindelse om:
 
 %s
 
-— verdande
-`, name, task, link)
+— %s
+`, name, task, link, s.appName)
 
 	return s.send(ctx, to, subject, body)
 }
 
 func (s *Sender) SendPasswordReset(ctx context.Context, to, name, link string, ttl time.Duration) error {
-	subject := "Nulstil din adgangskode i verdande"
+	subject := "Nulstil din adgangskode i " + s.appName
 	body := fmt.Sprintf(`Hej %s
 
-Der er bedt om at nulstille adgangskoden til din verdande-konto.
+Der er bedt om at nulstille adgangskoden til din %s-konto.
 
 Vælg en ny adgangskode her:
 %s
@@ -107,9 +113,9 @@ Linket virker i %s og kan kun bruges én gang.
 
 Har du ikke selv bedt om det, behøver du ikke gøre noget — din nuværende adgangskode virker stadig, og linket udløber af sig selv.
 
-— verdande
+— %s
 %s
-`, name, link, humanDuration(ttl), s.baseURL)
+`, name, s.appName, link, humanDuration(ttl), s.appName, s.baseURL)
 
 	return s.send(ctx, to, subject, body)
 }

internal/mail/mail_test.go

@@ -0,0 +1,76 @@
+package mail
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kristianwind/verdande/internal/config"
+)
+
+// TestEveryMessageCarriesTheEditionsOwnName.
+//
+// These three letters are the only thing this program sends to an address its
+// operator does not control, and an invitation from an urd instance that says
+// "verdande" is a letter to a stranger about a program they are not being invited
+// to. The name was a field with a value and no reader until 2026-10-07 — the three
+// places that needed it had the word written out instead — so the assertion that
+// matters is not "it says urd" but "it does not say the other one".
+//
+// Measured through the unconfigured path on purpose: with no SMTP host, send()
+// logs the whole message at warn level and returns, so the subject and the body
+// can be read as the recipient would get them without a mail server in the test.
+func TestEveryMessageCarriesTheEditionsOwnName(t *testing.T) {
+	for _, tc := range []struct{ name, other string }{
+		{"verdande", "urd"},
+		{"urd", "verdande"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var buf bytes.Buffer
+			s := New(config.SMTP{}, "https://example.dk", tc.name,
+				slog.New(slog.NewTextHandler(&buf, &slog.HandlerOptions{Level: slog.LevelWarn})))
+
+			ctx := context.Background()
+			if err := s.SendInvite(ctx, "[email protected]", "Kristian", "", "https://example.dk/i/abc", time.Hour); err != nil {
+				t.Fatalf("SendInvite: %v", err)
+			}
+			if err := s.SendPasswordReset(ctx, "[email protected]", "Kristian", "https://example.dk/r/abc", time.Hour); err != nil {
+				t.Fatalf("SendPasswordReset: %v", err)
+			}
+			if err := s.SendReminder(ctx, "[email protected]", "Kristian", "Ring til tandlægen", "https://example.dk/opgave/1"); err != nil {
+				t.Fatalf("SendReminder: %v", err)
+			}
+
+			got := buf.String()
+			if n := strings.Count(got, `msg="no SMTP host configured`); n != 3 {
+				t.Fatalf("expected three logged messages, got %d — the test is reading the wrong thing", n)
+			}
+			if !strings.Contains(got, tc.name) {
+				t.Errorf("no message mentions %q", tc.name)
+			}
+			if strings.Contains(got, tc.other) {
+				t.Errorf("a message mentions %q on a %s instance; the name is hard-coded somewhere", tc.other, tc.name)
+			}
+			t.Logf("%s: %d bytes of mail across three messages", tc.name, len(got))
+		})
+	}
+}
+
+// TestAnInviteWithoutAProjectNamesTheProgram pins the one place the name is the
+// *subject* of the sentence rather than a signature: an invitation to the instance
+// itself, with no project, reads "has invited you to <program>".
+func TestAnInviteWithoutAProjectNamesTheProgram(t *testing.T) {
+	var buf bytes.Buffer
+	s := New(config.SMTP{}, "https://example.dk", "urd",
+		slog.New(slog.NewTextHandler(&buf, &slog.HandlerOptions{Level: slog.LevelWarn})))
+
+	if err := s.SendInvite(context.Background(), "[email protected]", "Kristian", "", "https://example.dk/i/abc", time.Hour); err != nil {
+		t.Fatalf("SendInvite: %v", err)
+	}
+	if !strings.Contains(buf.String(), "inviteret dig til urd") {
+		t.Errorf("the invite does not read \"inviteret dig til urd\":\n%s", buf.String())
+	}
+}

internal/quickadd/quickadd.go

@@ -37,6 +37,7 @@ const (
 	KindSection  Kind = "section"
 	KindLabel    Kind = "label"
 	KindRepeat   Kind = "repeat"
+	KindReminder Kind = "reminder"
 )
 
 // Span is a byte range of the input that was consumed, and what it was read as.
@@ -70,7 +71,28 @@ type Result struct {
 	Recurrence string `json:"recurrence_rule,omitempty"`
 	// RecurrenceText is that rule written back out in Danish, for the preview.
 	RecurrenceText string `json:"recurrence_text,omitempty"`
-	Spans          []Span `json:"spans,omitempty"`
+	// ReminderOffsetMin is when to be told, as minutes relative to the task's due
+	// moment: negative for before it, zero for at it. Nil when the line asked for
+	// no reminder.
+	//
+	// Relative rather than absolute, so that moving the task moves its alarm with
+	// it. Mind the sign: the store ADDS this to the due time
+	// (`due_datetime + offset_min * 60`), so "an hour before" is -60. Getting that
+	// backwards gives an alarm an hour late, which is the one direction a reminder
+	// must never be wrong in.
+	ReminderOffsetMin *int `json:"reminder_offset_min,omitempty"`
+	// ReminderAt is an absolute reminder, "YYYY-MM-DDTHH:MM", set when the line
+	// gave the reminder a clock of its own. It takes the day the task is due:
+	// "mind mig kl 8" about something due Friday means Friday at eight, not today.
+	ReminderAt string `json:"reminder_at,omitempty"`
+	// NoReminder is the line saying it wants no alarm on this one — "ingen alarm".
+	//
+	// It exists because of the account-wide default: with alarms on for everything
+	// that has a clock, there has to be a way to say "not this one" in the same
+	// breath as writing it. Without that the only way out is to create the task,
+	// open it, and delete the alarm that was just made.
+	NoReminder bool   `json:"no_reminder,omitempty"`
+	Spans      []Span `json:"spans,omitempty"`
 }
 
 // Parse reads input as of the moment `now`, which is also the timezone dates are
@@ -96,6 +118,20 @@ func Parse(input string, now time.Time, locale string) Result {
 	// mask keeps byte offsets intact, so spans still point into the original input.
 	masked := mask(input, spans)
 
+	// Reminders before the clock and the calendar, and that order is the whole
+	// trick: "mind mig en time før" has a duration in it and "mind mig kl 8" has a
+	// clock, and either one read by the time parser first becomes the task's own
+	// due time instead of its alarm. The phrase is anchored on a keyword the way a
+	// project is anchored on '#', so consuming it this early cannot take anything
+	// that was not offered to it.
+	// "No alarm" before "alarm", or the refusal leaves the very word the stage
+	// below is looking for standing in the line.
+	res.NoReminder, spans = extractNoReminder(masked, spans)
+	masked = mask(masked, spans)
+
+	rem, spans := extractReminder(masked, spans)
+	masked = mask(masked, spans)
+
 	// Recurrence before the date parser, and this order is load-bearing: "hver
 	// mandag" contains a weekday, and a date parser reading it first would claim
 	// Monday as a one-off due date and leave "hver" stranded in the title.
@@ -137,6 +173,21 @@ func Parse(input string, now time.Time, locale string) Result {
 		res.DueTime = pad2(hour) + ":" + pad2(minute)
 	}
 
+	// The reminder is resolved last, because an absolute one needs the due date the
+	// stages above just worked out.
+	if rem.found {
+		if rem.hasClock {
+			day := res.DueDate
+			if day == "" {
+				day = now.Format("2006-01-02")
+			}
+			res.ReminderAt = day + "T" + pad2(rem.hour) + ":" + pad2(rem.min)
+		} else {
+			off := rem.offsetMin
+			res.ReminderOffsetMin = &off
+		}
+	}
+
 	sort.Slice(spans, func(i, j int) bool { return spans[i].Start < spans[j].Start })
 	res.Spans = spans
 	res.Content = remove(input, spans)
@@ -687,3 +738,131 @@ func extractRecurrence(input string, spans []Span) (string, []Span) {
 	}
 	return "", spans
 }
+
+// --- reminders ----------------------------------------------------------------
+
+// reReminderLead finds the words that introduce an alarm. A reminder is anchored
+// on a keyword the way a project is anchored on '#': nothing becomes an alarm by
+// standing near a clock, because "ring til tandlægen kl 9" asks for a task at nine
+// and not to be woken before it.
+//
+// The trailing \b is load-bearing. Without it the pattern matches the first six
+// letters of "alarmen" and of "mind migrationen", takes them out of the title, and
+// sets an alarm nobody asked for.
+var reReminderLead = regexp.MustCompile(
+	`(?i)(?:^|\s)(mind\s+mig(?:\s+om\s+det)?|påmind(?:\s+mig)?|paamind(?:\s+mig)?` +
+		`|remind\s+me(?:\s+about\s+it)?|med\s+alarm)\b`)
+
+// reReminderOffset reads the tail as "this long before": "en time før", "10 min
+// før", "et kvarter før", "dagen før", "two days before".
+var reReminderOffset = regexp.MustCompile(
+	`(?i)^[\s,]*(?:om\s+)?(\d+|en|et|a|an|to|two|tre|three)?\s*` +
+		`(halv\s+time|halvtime|kvarter|minutter|minut|minutes|minute|min\.?` +
+		`|timer|time|hours|hour|dage|dagen|dag|days|day)\s*` +
+		`(?:før|foer|inden|before)`)
+
+// reReminderClock reads the tail as a clock of its own: "kl 8", "kl. 7.30", "at 7:30".
+var reReminderClock = regexp.MustCompile(`(?i)^[\s,]*(?:kl\.?|klokken|at)\s*(\d{1,2})(?:[.:](\d{2}))?`)
+
+// reminder is what the phrase said. OffsetMin is minutes relative to the due
+// moment and negative for "before"; zero means at the due moment, which is what a
+// bare "mind mig" asks for.
+type reminder struct {
+	found     bool
+	offsetMin int
+	hour, min int
+	hasClock  bool
+}
+
+// extractReminder reads the alarm out of the line.
+//
+// The lead-in is matched first and the tail interpreted afterwards, rather than in
+// one pattern, for the same reason the recurrence stage does it: a single
+// expression able to express all three endings — a duration, a clock, or nothing
+// at all — matches far more than the three things it is for.
+func extractReminder(input string, spans []Span) (reminder, []Span) {
+	m := reReminderLead.FindStringSubmatchIndex(input)
+	if m == nil {
+		return reminder{}, spans
+	}
+
+	rem := reminder{found: true}
+	start, end := m[2], m[3]
+	tail := input[end:]
+
+	if t := reReminderOffset.FindStringSubmatchIndex(tail); t != nil {
+		n := 1
+		if t[2] >= 0 {
+			n = spokenNumber(tail[t[2]:t[3]])
+		}
+		rem.offsetMin = -n * unitMinutes(tail[t[4]:t[5]])
+		end += t[1]
+	} else if t := reReminderClock.FindStringSubmatchIndex(tail); t != nil {
+		hour := atoi(tail, t[2], t[3])
+		minute := 0
+		if t[4] >= 0 {
+			minute = atoi(tail, t[4], t[5])
+		}
+		// An impossible clock is not a reminder. Saying nothing is better than
+		// setting one for 25:00, which the store would happily keep and never fire.
+		if !valid(hour, minute) {
+			return reminder{}, spans
+		}
+		rem.hour, rem.min, rem.hasClock = hour, minute, true
+		end += t[1]
+	}
+
+	return rem, append(spans, Span{Start: start, End: end, Kind: KindReminder})
+}
+
+// spokenNumber reads the count in front of a unit. People dictating say the word
+// rather than the digit, and "mind mig en time før" is the commonest form there is.
+func spokenNumber(w string) int {
+	switch strings.ToLower(w) {
+	case "en", "et", "a", "an":
+		return 1
+	case "to", "two":
+		return 2
+	case "tre", "three":
+		return 3
+	}
+	if n, err := strconv.Atoi(w); err == nil {
+		return n
+	}
+	return 1
+}
+
+// unitMinutes turns the unit into minutes. "halv time" and "kvarter" carry their
+// own count, so they come first: with a leading "en" they multiply by one and come
+// out as themselves.
+func unitMinutes(unit string) int {
+	u := strings.ToLower(strings.Join(strings.Fields(unit), " "))
+	switch {
+	case strings.HasPrefix(u, "halv"):
+		return 30
+	case strings.HasPrefix(u, "kvarter"):
+		return 15
+	case strings.HasPrefix(u, "min"):
+		return 1
+	case strings.HasPrefix(u, "time"), strings.HasPrefix(u, "hour"):
+		return 60
+	case strings.HasPrefix(u, "dag"), strings.HasPrefix(u, "day"):
+		return 1440
+	}
+	return 0
+}
+
+// reNoReminder finds the line asking not to be reminded. The account-wide default
+// gives every task with a clock an alarm, and this is how one task opts out while
+// it is being written rather than afterwards.
+var reNoReminder = regexp.MustCompile(
+	`(?i)(?:^|\s)(ingen\s+(?:alarm|påmindelse|paamindelse)|uden\s+alarm` +
+		`|no\s+alarm|no\s+reminder|without\s+an?\s+alarm)\b`)
+
+func extractNoReminder(input string, spans []Span) (bool, []Span) {
+	m := reNoReminder.FindStringSubmatchIndex(input)
+	if m == nil {
+		return false, spans
+	}
+	return true, append(spans, Span{Start: m[2], End: m[3], Kind: KindReminder})
+}

internal/quickadd/quickadd_test.go

@@ -636,3 +636,151 @@ func TestEveryOtherWeekdayIsARepetition(t *testing.T) {
 		}
 	}
 }
+
+// --- reminders ----------------------------------------------------------------
+
+// A dictated sentence can set its own alarm.
+//
+// The offset is negative because the store ADDS it to the due moment
+// (`due_datetime + offset_min * 60`). A positive number there is an alarm after
+// the thing it was meant to warn about, which is the one direction a reminder must
+// never be wrong in — so the sign is asserted here and not assumed.
+func TestParseReminderOffset(t *testing.T) {
+	now := ref(t)
+	cases := []struct {
+		in   string
+		want int
+	}{
+		{"ring til tandlægen i morgen kl 9 mind mig en time før", -60},
+		{"ring til tandlægen i morgen kl 9 mind mig 10 min før", -10},
+		{"ring til tandlægen i morgen kl 9 mind mig 10 minutter før", -10},
+		{"ring til tandlægen i morgen kl 9 mind mig et kvarter før", -15},
+		{"ring til tandlægen i morgen kl 9 mind mig en halv time før", -30},
+		{"møde i morgen kl 9 mind mig dagen før", -1440},
+		{"møde i morgen kl 9 mind mig to dage før", -2880},
+		{"møde i morgen kl 9 mind mig 2 timer før", -120},
+		// Det er talt ind, så kommaet hører til sætningen og ikke til syntaksen.
+		{"ring til tandlægen i morgen kl 9, mind mig en time før", -60},
+		{"ring til tandlægen i morgen kl 9, påmind mig en time før", -60},
+		{"ring til tandlægen i morgen kl 9, mind mig om det en time før", -60},
+		// Engelsk i samme linje, som resten af parseren gør det.
+		{"call the dentist tomorrow at 9 remind me an hour before", -60},
+		{"call the dentist tomorrow at 9 remind me 15 minutes before", -15},
+		{"call the dentist tomorrow at 9 remind me two days before", -2880},
+		// En bar påmindelse er på selve forfaldstidspunktet.
+		{"ring til tandlægen i morgen kl 9 mind mig", 0},
+		{"ring til tandlægen i morgen kl 9 med alarm", 0},
+	}
+	for _, c := range cases {
+		got := Parse(c.in, now, "da")
+		if got.ReminderOffsetMin == nil {
+			t.Errorf("Parse(%q): ReminderOffsetMin = nil, want %d", c.in, c.want)
+			continue
+		}
+		if *got.ReminderOffsetMin != c.want {
+			t.Errorf("Parse(%q): ReminderOffsetMin = %d, want %d", c.in, *got.ReminderOffsetMin, c.want)
+		}
+	}
+}
+
+// A reminder with a clock of its own takes the day the task is due.
+//
+// "mind mig kl 8" about something due Friday means Friday at eight. Resolving it
+// against today instead would fire the alarm days early, silently.
+func TestParseReminderClockTakesTheDueDay(t *testing.T) {
+	now := ref(t)
+	cases := []struct {
+		in   string
+		want string
+	}{
+		{"ring til tandlægen i morgen kl 9 mind mig kl 8", "2026-03-11T08:00"},
+		{"ring til tandlægen i morgen kl 9 mind mig kl. 7.30", "2026-03-11T07:30"},
+		{"ring til tandlægen i morgen kl 9, påmind kl 7:15", "2026-03-11T07:15"},
+		{"call the dentist tomorrow at 9 remind me at 8", "2026-03-11T08:00"},
+		// Ingen dato i linjen: så er det i dag, som en bar klokketid også er.
+		{"ring til tandlægen mind mig kl 23", "2026-03-10T23:00"},
+	}
+	for _, c := range cases {
+		got := Parse(c.in, now, "da")
+		if got.ReminderAt != c.want {
+			t.Errorf("Parse(%q): ReminderAt = %q, want %q", c.in, got.ReminderAt, c.want)
+		}
+		if got.ReminderOffsetMin != nil {
+			t.Errorf("Parse(%q): also set an offset (%d); a reminder is one or the other",
+				c.in, *got.ReminderOffsetMin)
+		}
+	}
+}
+
+// The alarm does not eat the task's own time, and the task's time does not eat the
+// alarm. This is the ordering the stage exists for.
+func TestReminderDoesNotTakeTheTasksOwnTime(t *testing.T) {
+	got := Parse("ring til tandlægen i morgen kl 9 mind mig kl 8", ref(t), "da")
+
+	if got.DueTime != "09:00" {
+		t.Errorf("DueTime = %q, want 09:00 — the reminder took the task's clock", got.DueTime)
+	}
+	if got.DueDate != "2026-03-11" {
+		t.Errorf("DueDate = %q, want 2026-03-11", got.DueDate)
+	}
+	if got.ReminderAt != "2026-03-11T08:00" {
+		t.Errorf("ReminderAt = %q, want 2026-03-11T08:00", got.ReminderAt)
+	}
+	if got.Content != "ring til tandlægen" {
+		t.Errorf("Content = %q, want %q", got.Content, "ring til tandlægen")
+	}
+}
+
+// Nothing becomes an alarm by standing near a clock.
+func TestNoReminderWhereNoneWasAskedFor(t *testing.T) {
+	now := ref(t)
+	for _, in := range []string{
+		"ring til tandlægen i morgen kl 9",
+		"betal moms i morgen kl 10 p1 #Firma @regnskab",
+		// The \b cases: these words merely begin with the keywords.
+		"skift batteri i alarmen",
+		"mind migrationen om at køre",
+		"vand planterne hver mandag kl 9",
+	} {
+		got := Parse(in, now, "da")
+		if got.ReminderOffsetMin != nil {
+			t.Errorf("Parse(%q): ReminderOffsetMin = %d, want none", in, *got.ReminderOffsetMin)
+		}
+		if got.ReminderAt != "" {
+			t.Errorf("Parse(%q): ReminderAt = %q, want none", in, got.ReminderAt)
+		}
+	}
+}
+
+// The phrase is highlighted, like every other thing the parser claims — see the
+// package comment: a parser you cannot see working is one you stop trusting.
+func TestReminderIsHighlighted(t *testing.T) {
+	in := "ring til tandlægen i morgen kl 9 mind mig en time før"
+	got := Parse(in, ref(t), "da")
+
+	var span *Span
+	for i := range got.Spans {
+		if got.Spans[i].Kind == KindReminder {
+			span = &got.Spans[i]
+		}
+	}
+	if span == nil {
+		t.Fatalf("no %q span in %v", KindReminder, got.Spans)
+	}
+	if marked := in[span.Start:span.End]; marked != "mind mig en time før" {
+		t.Errorf("highlighted %q, want %q", marked, "mind mig en time før")
+	}
+}
+
+// An impossible clock is not a reminder: the store would keep 25:00 and never fire
+// it, so saying nothing is the honest answer.
+func TestImpossibleReminderClockIsNotKept(t *testing.T) {
+	got := Parse("ring til tandlægen i morgen kl 9 mind mig kl 25", ref(t), "da")
+
+	if got.ReminderAt != "" {
+		t.Errorf("ReminderAt = %q, want none", got.ReminderAt)
+	}
+	if got.ReminderOffsetMin != nil {
+		t.Errorf("ReminderOffsetMin = %d, want none", *got.ReminderOffsetMin)
+	}
+}

internal/store/migrations/0036_alarm_som_standard.sql

@@ -0,0 +1,23 @@
+-- Alarm som standard på opgaver med et klokkeslæt.
+--
+-- Påmindelser har virket længe og skulle sættes én ad gangen: en opgave med
+-- "i morgen kl 9" fik en tid og ingen alarm, for intet skaber en påmindelse af sig
+-- selv. Det er den rigtige standard for en opgave UDEN klokkeslæt — der er intet
+-- tidspunkt at ringe på — men for en med et er det en omvej, man går hver gang.
+--
+-- Minutter i forhold til forfaldstiden, og NULL betyder slået fra. Én nullable
+-- kolonne frem for et flueben plus et tal, så tilstanden "slået til uden
+-- forskydning" ikke findes og derfor ikke kan blive uenig med sig selv.
+--
+-- Fortegnet er det samme som i reminders.offset_min, fordi det er den kolonne,
+-- værdien ender i: lageret LÆGGER tallet til forfaldstiden, så en alarm FØR er
+-- negativ og 0 er præcis på tidspunktet. To forskellige fortegnsregler for det
+-- samme begreb er den slags forskel, der kun viser sig som en alarm, der ringer
+-- på det forkerte tidspunkt.
+--
+-- NULL for alle, der findes i dag, og det er med vilje. At slå den til i en
+-- migrering ville give hver eksisterende bruger alarmer, de ikke har bedt om, på
+-- opgaver de har liggende — og det her er software, andre selv driver. En
+-- indstilling, man selv slår til, er en anden sag end en notifikation, der
+-- pludselig kommer.
+ALTER TABLE users ADD COLUMN default_reminder_min INTEGER;

internal/store/users.go

@@ -46,7 +46,22 @@ type User struct {
 	// NavOrder is the order this person wants the fixed views in, by key. Empty
 	// means the order the program ships with. Unknown keys are ignored and missing
 	// ones are appended, so adding a view later is not a migration.
-	NavOrder  []string
+	NavOrder []string
+
+	// DefaultReminderMin gives every task that has a clock an alarm without being
+	// asked, as minutes relative to the due moment: negative for before it, zero
+	// for at it. Nil is off, which is what every account starts as.
+	//
+	// The same sign convention as reminders.offset_min, because this is the column
+	// the value ends up in — the store ADDS it to the due time. Two sign rules for
+	// one idea is the kind of difference that only shows up as an alarm going off
+	// at the wrong moment.
+	//
+	// Only tasks with a clock. A task due "tomorrow" with no time has no moment to
+	// ring at, and DueReminders selects the offset form only when due_datetime is
+	// set, so an alarm there would be a row that never fires.
+	DefaultReminderMin *int
+
 	CreatedAt time.Time
 	UpdatedAt time.Time
 }
@@ -136,7 +151,8 @@ func (db *DB) UserByID(ctx context.Context, id string) (*User, error) {
 }
 
 const userColumns = `id, email, name, password_hash, totp_secret, totp_enabled,
-	avatar_color, timezone, locale, is_admin, sidebar_collapsed, nav_order, created_at, updated_at`
+	avatar_color, timezone, locale, is_admin, sidebar_collapsed, nav_order,
+	default_reminder_min, created_at, updated_at`
 
 func (db *DB) scanUser(ctx context.Context, query string, args ...any) (*User, error) {
 	var u User
@@ -145,10 +161,12 @@ func (db *DB) scanUser(ctx context.Context, query string, args ...any) (*User, e
 	var created, updated int64
 
 	var collapsed, navOrder string
+	var defaultReminder sql.NullInt64
 
 	err := db.QueryRowContext(ctx, query, args...).Scan(
 		&u.ID, &u.Email, &u.Name, &u.PasswordHash, &secret, &totpEnabled,
-		&u.AvatarColor, &u.Timezone, &u.Locale, &isAdmin, &collapsed, &navOrder, &created, &updated)
+		&u.AvatarColor, &u.Timezone, &u.Locale, &isAdmin, &collapsed, &navOrder,
+		&defaultReminder, &created, &updated)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, ErrNotFound
 	}
@@ -172,6 +190,10 @@ func (db *DB) scanUser(ctx context.Context, query string, args ...any) (*User, e
 	_ = json.Unmarshal([]byte(collapsed), &u.SidebarCollapsed)
 	u.NavOrder = []string{}
 	_ = json.Unmarshal([]byte(navOrder), &u.NavOrder)
+	if defaultReminder.Valid {
+		v := int(defaultReminder.Int64)
+		u.DefaultReminderMin = &v
+	}
 	u.CreatedAt = time.Unix(created, 0).UTC()
 	u.UpdatedAt = time.Unix(updated, 0).UTC()
 	return &u, nil
@@ -691,3 +713,22 @@ func (db *DB) UserByICSToken(ctx context.Context, token string) (*User, error) {
 	}
 	return db.scanUser(ctx, `SELECT `+userColumns+` FROM users WHERE ics_token = ?`, token)
 }
+
+// SetDefaultReminder records whether tasks with a clock get an alarm unasked, and
+// how far ahead of the due moment it rings. Nil turns it off.
+func (db *DB) SetDefaultReminder(ctx context.Context, userID string, minutes *int) error {
+	var value any
+	if minutes != nil {
+		value = *minutes
+	}
+	res, err := db.ExecContext(ctx,
+		`UPDATE users SET default_reminder_min = ?, updated_at = ? WHERE id = ?`,
+		value, time.Now().Unix(), userID)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}

mkdocs.yml

@@ -44,6 +44,7 @@ extra_css:
 nav:
   - Home: index.md
   - Setting it up:
+      - Two editions: editions.md
       - As a Rune: rune.md
       - With Docker: self-hosting.md
       - Configuration: configuration.md

site/index.html

@@ -819,6 +819,15 @@
 				color: var(--accent);
 			}
 		</style>
+		<!-- Besøgstælling for denne side — ikke for programmet, som melder det, der
+		     står under "It counts itself". Plausible på vores egen maskine: ingen
+		     cookie, ingen gemt adresse, ingen tredjepart, og derfor ingen bjælke at
+		     møde folk med. `defer`, så tælleren aldrig holder siden tilbage. -->
+		<script
+			defer
+			data-domain="verdandetodo.com"
+			src="https://plausible.yggdrasilpanel.com/js/script.outbound-links.js"
+		></script>
 	</head>
 
 	<body>

web/e2e/edition.spec.js

@@ -0,0 +1,272 @@
+import { test, expect } from '@playwright/test';
+import { watchForTrouble } from './trouble.js';
+
+/**
+ * Noter-udgaven, kørt som sit eget program.
+ *
+ * Egen server på sin egen port med `VERDANDE_EDITION=notes`, egen database og
+ * ingen lånt session: den her instans har aldrig set den konto, den fulde udgaves
+ * opsætning lavede, så den laver sin egen.
+ *
+ * Og det er hele grunden til at prøven findes som en separat server frem for som
+ * en indstilling, en prøve skruer på. En skakt, der kun er prøvet ved at kalde en
+ * funktion, er prøvet på det, nogen mente — det her måler programmet, som en
+ * bruger møder det.
+ */
+
+const KONTO = {
+	email: '[email protected]',
+	name: 'Noteskriver',
+	password: 'et langt kodeord til test'
+};
+
+test.beforeEach(async ({ page }) => {
+	await page.goto('/');
+	// Første konto, hvis den ikke er lavet endnu. Prøverne i filen deler instans,
+	// så den anden gang er det en almindelig login.
+	const opret = page.getByRole('button', { name: 'Opret konto' });
+	const login = page.getByRole('button', { name: 'Log ind' });
+	// Ventet på, at EN af de to er der, før der spørges hvilken. Spurgt før
+	// tegningen svarer begge nej, og så faldt prøven i den forkerte gren og ventede
+	// tredive sekunder på en knap, der aldrig kom.
+	await expect(opret.or(login)).toBeVisible();
+
+	if (await opret.isVisible()) {
+		await page.getByLabel(/Navn/).fill(KONTO.name);
+		await page.getByLabel(/E-mail/).fill(KONTO.email);
+		await page.getByLabel(/Adgangskode/).fill(KONTO.password);
+		await opret.click();
+		// Beaconens besked står øverst første gang; den er ikke det her prøvens
+		// ærinde, men den dækker for det, der er.
+		const besked = page.getByRole('region', { name: /melder, at den findes/ });
+		if (await besked.isVisible().catch(() => false)) {
+			await besked.getByRole('button', { name: 'Behold den' }).click();
+		}
+	} else {
+		await page.getByLabel(/E-mail/).fill(KONTO.email);
+		await page.getByLabel(/Adgangskode/).fill(KONTO.password);
+		await page.getByRole('button', { name: 'Log ind' }).click();
+	}
+	await expect(page.getByRole('navigation', { name: 'Hovedmenu' })).toBeVisible();
+});
+
+test('instansen siger selv, at den er noter-udgaven', async ({ page }) => {
+	// Fladen kan ikke lukke af for noget, den ikke får at vide, og den skal have
+	// det at vide, før nogen er logget ind.
+	const svar = await page.request.get('/api/v1/auth/setup');
+	expect((await svar.json()).edition).toBe('notes');
+});
+
+test('der er ingen vej til opgaverne i menuen', async ({ page }) => {
+	const menu = page.getByRole('navigation', { name: 'Hovedmenu' });
+	await expect(menu).toBeVisible();
+
+	// Udeladt, ikke gråtonet: ruterne bag dem er ikke monteret på serveren.
+	for (const navn of ['I dag', 'Kommende', 'Kalender', 'Uddelegeret']) {
+		await expect(menu.getByRole('link', { name: navn })).toHaveCount(0);
+	}
+
+	// Og det, udgaven ER til, står der. En menu uden opgaver OG uden noter ville
+	// også bestå prøven ovenfor, og den ville være en sletning frem for en skakt.
+	await expect(menu.getByRole('link', { name: 'Noter', exact: true })).toBeVisible();
+});
+
+test('forsiden er noterne, ikke en tom opgaveliste', async ({ page }) => {
+	await page.goto('/');
+	await expect(page).toHaveURL(/\/noter$/);
+});
+
+test('en gemt adresse til en opgaveside fører til noterne i stedet for et blindt spor', async ({
+	page
+}) => {
+	// Nogen, der har gemt et link fra en fuld instans, skal lande et sted, der
+	// giver mening. Der er ikke sket noget forkert — adressen hører bare til et
+	// andet program end det, der kører her.
+	for (const sti of ['/upcoming', '/kalender', '/uddelegeret', '/faerdige']) {
+		await page.goto(sti);
+		await expect(page).toHaveURL(/\/noter$/);
+	}
+});
+
+test('⌘K finder noter og ikke opgaver', async ({ page }) => {
+	await page.goto('/noter');
+	await page.getByRole('button', { name: 'Ny note' }).click();
+	const felt = page.getByRole('textbox', { name: 'Notens tekst' });
+	await expect(felt).toHaveText('');
+	await felt.click();
+	await page.keyboard.type('Kvartalsregnskabet');
+	await felt.blur();
+	await expect(page.locator('.notes button.row strong').filter({ hasText: /^Kvartalsregnskabet$/ })).toHaveCount(1);
+
+	await page.getByRole('button', { name: /Søg/ }).click();
+	const palette = page.getByRole('dialog');
+	await palette.getByRole('textbox').fill('Kvartalsregnskabet');
+
+	// Noten findes — ellers beviser det næste ingenting.
+	await expect(palette.locator('li button', { hasText: 'Kvartalsregnskabet' })).toBeVisible();
+	// Og søgningen på serveren svarer uden opgaver overhovedet.
+	const svar = await page.request.get('/api/v1/search?q=Kvartalsregnskabet');
+	expect((await svar.json()).tasks ?? []).toEqual([]);
+});
+
+test('opgaveruterne findes slet ikke på serveren', async ({ page }) => {
+	// Det her er forskellen på skjult og fraværende, målt udefra.
+	for (const sti of ['/api/v1/tasks', '/api/v1/labels', '/api/v1/upcoming', '/api/v1/filters']) {
+		const svar = await page.request.get(sti);
+		expect(svar.status(), `${sti} svarede ${svar.status()}`).toBe(404);
+	}
+	// Kontrollen: en rute, der ER monteret, svarer ikke 404 — ellers ville
+	// ovenstående bestå på en server, der var helt væk.
+	expect((await page.request.get('/api/v1/notes')).status()).toBe(200);
+});
+
+/**
+ * Navnet.
+ *
+ * To udgaver af ét program er to produkter, og det eneste sted en læser afgør
+ * hvilket af dem de ser på, er navnet: fanen, mærket i menuen, og det navn appen
+ * lægger sig under på en hjemmeskærm. De tre står i filer, browseren læser FØR
+ * noget JavaScript kører, så serveren skriver dem om på vejen ud — og derfor skal
+ * de måles her, på det der faktisk blev sendt, frem for i en funktion.
+ */
+test('fanen, mærket og manifestet siger alle urd', async ({ page }) => {
+	// Der er TO titler, og det blev opdaget her frem for i en Go-prøve: skallens,
+	// som browseren læser før noget JavaScript kører og som serveren skriver om,
+	// og rutens egen, som appen sætter i <svelte:head> når siden tegner. Den sidste
+	// overskriver den første — så en prøve, der kun læste den ene, ville være grøn
+	// over en fane, der sagde "Noter · verdande".
+	const skal = await (await page.request.get('/')).text();
+	expect(skal, 'skallens titel, før appen kører').toContain('<title>urd</title>');
+	await expect(page, 'rutens egen titel, efter appen har tegnet').toHaveTitle(/· urd$/);
+
+	const mærke = page.getByRole('navigation', { name: 'Hovedmenu' }).locator('.brand');
+	await expect(mærke.locator('.name')).toHaveText('urd');
+	// ð, ikke ᚹ wunjo og ikke ᚢ uruz. Begge de to er navngivne værdier frem for
+	// "der står noget": en tom span, Verdandes mærke og uruz-appens ser ens ud for
+	// en prøve, der kun spørger, om feltet er udfyldt.
+	await expect(mærke.locator('.rune')).toHaveText('ð');
+	await expect(mærke.locator('.rune')).not.toHaveText('ᚢ');
+
+	const manifest = await (await page.request.get('/manifest.webmanifest')).json();
+	expect(manifest.name).toBe('urd');
+	expect(manifest.short_name).toBe('urd');
+});
+
+test('manifestet bliver sendt som et manifest, ikke som tekst', async ({ page }) => {
+	// Go kender ikke .webmanifest, så uden en eksplicit type sniffes den til
+	// text/plain — og en browser ignorerer så manifestet uden at sige noget.
+	// Symptomet er at installationsknappen bare ikke er der.
+	const svar = await page.request.get('/manifest.webmanifest');
+	expect(svar.headers()['content-type']).toContain('application/manifest+json');
+});
+
+test('omdøbningen rørte ikke lagernøglerne', async ({ page }) => {
+	// Fælden i hele øvelsen: produktnavnet og localStorage-præfikset er samme ord
+	// i app.html, og de er ikke samme ting. Omdøbes præfikset her og ikke i
+	// resten af appen, bliver temaet sat fra én nøgle og læst fra en anden, og det
+	// eneste symptom er det hvide blink, det indlejrede script findes for at
+	// undgå. Målt på de bytes der blev sendt, ikke på kilden.
+	const skal = await (await page.request.get('/')).text();
+	expect(skal).toContain("localStorage.getItem('verdande:theme')");
+	expect(skal).toContain("localStorage.getItem('verdande:look')");
+	expect(skal).not.toContain('urd:theme');
+});
+
+test('navnet står også i teksterne, ikke kun i mærket', async ({ page }) => {
+	// `{product}`-pladsholderen, hele vejen gennem i18n og ud på skærmen. Udseendet
+	// "som du kender det" er opkaldt efter programmet, så det er det kort, der
+	// skifter navn med udgaven.
+	await page.goto('/indstillinger');
+	await expect(page.getByRole('button', { name: /^Urd\b/ })).toBeVisible();
+	await expect(page.getByRole('button', { name: /^Verdande\b/ })).toHaveCount(0);
+});
+
+/**
+ * Hver side, der KAN nås i noter-udgaven, må ikke kalde noget, der er lukket.
+ *
+ * Det er den halvdel, en port let glemmer, og den fejler stille: lukkes en rute,
+ * fladen stadig henter, svarer serveren 404, komponenten fanger det, og siden
+ * tegner uden den sektion — pænt, tomt, og uden at nogen får at vide, at noget
+ * manglede. Der er ingen fejlskærm at se.
+ *
+ * Målt på svarene frem for på det tegnede: en manglende sektion ser ud som en
+ * sektion, der ikke var noget i.
+ *
+ * Skrevet før ruterne blev lukket, og den fangede SYV — fire af dem fra den første
+ * port, som havde været i drift i to merges: sidebjælken hentede /filters og
+ * /labels ved hver navigation, notifikationssiden hentede /ai/plan, og
+ * notesbogens egen side hentede /tasks. Den sidste var ikke støj: kaldene samles i
+ * et Promise.all, så 404'eren kastede og siden viste `status = 'failed'` frem for
+ * notesbogens noter.
+ *
+ * Og den fangede én mere, som rettelsen selv lavede: da opgavekaldet holdt op med
+ * at fejle, kom en uendelig effekt-løkke frem, som 404'eren havde holdt låg på
+ * (effect_update_depth_exceeded). Derfor læser den konsollen og ikke kun svarene.
+ *
+ * Hvad den IKKE dækker, sagt her frem for underforstået: elleve sider plus ét
+ * projekt. En gruppe (/gruppe/{id}) og en åben note er ikke med, fordi begge
+ * kræver, at prøven først laver en — og skuffer og dialoger, der åbnes ved et
+ * klik, er slet ikke besøgt. En grøn her betyder "ingen af de tolv adresser",
+ * ikke "ingen flade".
+ */
+test('ingen side kalder en rute, udgaven ikke har', async ({ page }) => {
+	const trouble = watchForTrouble(page);
+
+	// Projektet skal med som en rigtig adresse: /projekt/{id} er en notesbog her,
+	// og den er den eneste side med en id i stien, der kan nås.
+	await page.goto('/noter');
+	const projekter = await (await page.request.get('/api/v1/projects')).json();
+	const id = (projekter.projects ?? projekter)[0]?.id;
+	expect(id, 'der skal findes mindst ét projekt at åbne').toBeTruthy();
+
+	const sider = [
+		'/noter',
+		'/genveje',
+		'/indstillinger',
+		'/indstillinger/ai',
+		'/indstillinger/brugere',
+		'/indstillinger/data',
+		'/indstillinger/fejl',
+		'/indstillinger/historik',
+		'/indstillinger/integrationer',
+		'/indstillinger/notifikationer',
+		'/indstillinger/tokens',
+		`/projekt/${id}`
+	];
+
+	for (const side of sider) {
+		await page.goto(side);
+		// Ventet på at fladen er tegnet, så de kald siden laver ved opstart er
+		// nået at komme afsted. Uden den her går løkken videre, før svarene er
+		// kommet, og prøven måler ingenting.
+		await expect(page.getByRole('navigation', { name: 'Hovedmenu' })).toBeVisible();
+		await page.waitForLoadState('networkidle');
+	}
+
+	// Tallet med på det grønne: elleve sider og et projekt, frem for "ingen fejl".
+	expect(trouble, `besøgte ${sider.length} sider`).toEqual([]);
+});
+
+test('ikonet er urds, hele vejen ud', async ({ page }) => {
+	// Målt på stregerne i SVG'en frem for på "der kom et billede": en tom
+	// respons, verdandes mærke og urds ser alle ens ud for en prøve, der kun
+	// spørger, om der står noget.
+	const svg = await (await page.request.get('/icon.svg')).text();
+	expect(svg, 'ð: skålen').toContain('cx="32" cy="42" r="12"');
+	expect(svg, 'ð: ascenderen').toContain('M44 36L27 10');
+	expect(svg, 'ð: tværstregen, som er det der skiller ð fra et d').toContain('M25 20h18');
+	expect(svg, 'og ikke ᚹ wunjos flag').not.toContain('M26 15l17');
+
+	// De tre PNG'er har ingen streger at læse, så de måles på at de er urds —
+	// sammenlignet med filen under sit eget navn, som ligger i samme byg.
+	for (const [sti, egen] of [
+		['/icon-192.png', '/urd-icon-192.png'],
+		['/icon-512.png', '/urd-icon-512.png'],
+		['/apple-touch-icon.png', '/urd-apple-touch-icon.png']
+	]) {
+		const a = await (await page.request.get(sti)).body();
+		const b = await (await page.request.get(egen)).body();
+		expect(a.length, `${sti} er tom`).toBeGreaterThan(1000);
+		expect(a.equals(b), `${sti} er ikke urds`).toBe(true);
+	}
+});

web/e2e/pastelist.spec.js

@@ -0,0 +1,83 @@
+import { test, expect } from '@playwright/test';
+import { readList } from '../src/lib/pastelist.js';
+
+/**
+ * Læsningen af en indsat liste, prøvet for sig.
+ *
+ * Reglerne er små og mange, og de er billigere at stille her end gennem en
+ * browser: hvad er et mærke, hvad er indhold, og hvor dybt står en linje. Flowet
+ * gennem fladen har sin egen prøve i smoke.spec.js — den viser, at det hænger
+ * sammen, ikke at hvert tilfælde er rigtigt.
+ */
+test.describe('en indsat liste læses som opgaver og underopgaver', () => {
+	test('mærker fjernes, teksten bliver', () => {
+		expect(readList('- køb mælk\n* ring til Per\n+ hent pakken\n')).toEqual([
+			{ depth: 0, text: 'køb mælk', done: false },
+			{ depth: 0, text: 'ring til Per', done: false },
+			{ depth: 0, text: 'hent pakken', done: false }
+		]);
+	});
+
+	test('nummererede lister er også lister', () => {
+		expect(readList('1. først\n2) så\n10. til sidst')).toEqual([
+			{ depth: 0, text: 'først', done: false },
+			{ depth: 0, text: 'så', done: false },
+			{ depth: 0, text: 'til sidst', done: false }
+		]);
+	});
+
+	test('en afkrydsning er indhold, ikke notation', () => {
+		// Det er hele grunden til at læse boksen: en halvt afkrydset liste, der
+		// kommer ind som lutter uløste opgaver, har tabt det, man indsatte den for.
+		expect(readList('- [x] betalt\n- [ ] ikke betalt\n- [X] også betalt')).toEqual([
+			{ depth: 0, text: 'betalt', done: true },
+			{ depth: 0, text: 'ikke betalt', done: false },
+			{ depth: 0, text: 'også betalt', done: true }
+		]);
+	});
+
+	test('indrykning bærer niveauet, uanset hvor bred den er', () => {
+		// To mellemrum i den ene liste, fire i den anden, en tabulator i den tredje:
+		// alle tre betyder ét niveau. Bredden gættes ikke, den læses af teksten.
+		const to = readList('a\n  b\nc');
+		const fire = readList('a\n    b\nc');
+		const tab = readList('a\n\tb\nc');
+		const want = [
+			{ depth: 0, text: 'a', done: false },
+			{ depth: 1, text: 'b', done: false },
+			{ depth: 0, text: 'c', done: false }
+		];
+		expect(to).toEqual(want);
+		expect(fire).toEqual(want);
+		expect(tab).toEqual(want);
+	});
+
+	test('en liste, der er rykket ind som helhed, begynder stadig på niveau nul', () => {
+		// Kopierer man fra et dokument, følger der ofte indrykning med på alle
+		// linjer. Den er ikke et niveau — der er ikke noget at være under.
+		expect(readList('    a\n      b')).toEqual([
+			{ depth: 0, text: 'a', done: false },
+			{ depth: 1, text: 'b', done: false }
+		]);
+	});
+
+	test('tomme linjer er luft i det kopierede, ikke punkter', () => {
+		// Og de nulstiller ikke niveauet: en liste med luft mellem punkterne er én
+		// liste.
+		expect(readList('a\n\n  b\n\n  c')).toEqual([
+			{ depth: 0, text: 'a', done: false },
+			{ depth: 1, text: 'b', done: false },
+			{ depth: 1, text: 'c', done: false }
+		]);
+	});
+
+	test('teksten røres ikke ud over mærket', () => {
+		// Datoer, #projekt og @etiket læses af quickadd på serveren, præcis som når
+		// linjen er skrevet i hånden. To steder at forstå en opgavelinje er ét for
+		// mange.
+		expect(readList('- betal moms i morgen #Firma p1\n- andet')).toEqual([
+			{ depth: 0, text: 'betal moms i morgen #Firma p1', done: false },
+			{ depth: 0, text: 'andet', done: false }
+		]);
+	});
+});

web/e2e/trouble.js

@@ -0,0 +1,38 @@
+/**
+ * Collects anything that went wrong quietly: a thrown exception, a console error,
+ * or an API call that came back a failure.
+ *
+ * Failed responses are recorded with their URL and status. "A console error
+ * happened" is not an actionable test failure — "PATCH /api/v1/tasks/x returned
+ * 500" is.
+ *
+ * Udskilt fra smoke.spec.js, så udgave-suiten kan bruge den samme — og den
+ * fortjente flytningen med det samme: lukker man en rute, fladen stadig kalder,
+ * står der en 404 på en side, der ser helt rigtig ud, og det her er det eneste,
+ * der ser den.
+ */
+export function watchForTrouble(page) {
+	const trouble = [];
+	page.on('console', (message) => {
+		// The browser logs its own line for every failed fetch. It carries no URL,
+		// so it is noise next to the response listener below.
+		if (message.type() === 'error' && !message.text().includes('Failed to load resource')) {
+			trouble.push(message.text());
+		}
+	});
+	page.on('pageerror', (error) => trouble.push(String(error)));
+	page.on('response', (response) => {
+		const url = response.url();
+		if (!url.includes('/api/') || response.ok()) return;
+
+		// A 401 from /auth/me is the app asking "am I signed in?" and being told no,
+		// which is the correct answer on the sign-in page and after signing out.
+		// Every other non-ok response is worth failing over — that is what this
+		// watcher is for.
+		const path = new URL(url).pathname;
+		if (path.endsWith('/auth/me') && response.status() === 401) return;
+
+		trouble.push(`${response.request().method()} ${path} → ${response.status()}`);
+	});
+	return trouble;
+}

web/playwright.config.js

@@ -20,6 +20,7 @@ import { dirname, join } from 'node:path';
 const here = dirname(fileURLToPath(import.meta.url));
 const repo = join(here, '..');
 const dataDir = join(here, '.playwright-data');
+const notesDataDir = join(here, '.playwright-data-notes');
 
 // A clean instance every run: the first test creates the first account, which only
 // works on an empty database.
@@ -31,9 +32,14 @@ const dataDir = join(here, '.playwright-data');
 // connection fail, with SQLITE_CANTOPEN. It looks exactly like a flaky auth bug.
 if (process.env.TEST_WORKER_INDEX === undefined) {
 	rmSync(dataDir, { recursive: true, force: true });
+	rmSync(notesDataDir, { recursive: true, force: true });
 }
 
 const PORT = 8097;
+// Noter-udgaven kører som sin egen server ved siden af den fulde. Den kan ikke
+// dele port, og den må ikke dele database: de to er to instanser, og en prøve der
+// lod dem skrive i den samme ville måle en tilstand, ingen af dem ejer.
+const NOTES_PORT = 8098;
 // `localhost`, not `127.0.0.1`. WebAuthn refuses an IP address as a relying party
 // id — `SecurityError: This is an invalid domain` — and localhost is the exception
 // every browser makes. The passkey test cannot run against a loopback address.
@@ -72,6 +78,10 @@ export default defineConfig({
 		{ name: 'setup', testMatch: /.*\.setup\.js/ },
 		{
 			name: 'chromium',
+			// Alt undtagen noter-udgaven, som har sin egen server på sin egen port.
+			// Uden den her linje kørte den prøve også her — mod den FULDE udgave, hvor
+			// den naturligvis fejler, og hvor fejlen læser som om skakten ikke virker.
+			testIgnore: /edition\.spec\.js/,
 			use: { ...devices['Desktop Chrome'], storageState: 'e2e/.auth/user.json' },
 			dependencies: ['setup']
 		},
@@ -95,6 +105,21 @@ export default defineConfig({
 		 *
 		 * WebKit here is the same engine Safari is, which is the whole point.
 		 */
+		/**
+		 * Noter-udgaven, som sit eget program.
+		 *
+		 * Egen server, egen port, egen database, og ingen `storageState`: den her
+		 * instans har aldrig set den konto, den fulde udgaves opsætning lavede, og
+		 * at låne dens cookie ville prøve to instanser som var de én.
+		 *
+		 * Den deler ikke `setup` af samme grund — den laver sin egen første konto.
+		 */
+		{
+			name: 'notes-edition',
+			testMatch: /edition\.spec\.js/,
+			use: { ...devices['Desktop Chrome'], baseURL: `http://127.0.0.1:${NOTES_PORT}` }
+		},
+
 		{
 			name: 'webkit-forms',
 			grep: /@forms/,
@@ -103,42 +128,64 @@ export default defineConfig({
 		}
 	],
 
-	webServer: {
-		// The whole chain, every run.
-		//
-		// The frontend is embedded in the binary at compile time, from a copy under
-		// cmd/verdande/webbuild — so a suite that merely started the server would
-		// test whatever frontend was copied there last, which during development is
-		// nearly always the wrong one. Testing a stale build is worse than not
-		// testing: it reports green on code that is not running.
-		command: [
-			'npm run build',
-			'rm -rf ../cmd/verdande/webbuild',
-			'cp -r build ../cmd/verdande/webbuild',
-			'cd .. && go run -tags embedweb ./cmd/verdande'
-		].join(' && '),
-		cwd: here,
-		url: `${baseURL}/healthz`,
-		reuseExistingServer: false,
-		// The first run compiles the binary and builds nothing else; a cold Go
-		// build on a CI runner is comfortably under two minutes.
-		timeout: 180_000,
-		stdout: 'pipe',
-		stderr: 'pipe',
-		env: {
-			VERDANDE_ADDR: `:${PORT}`,
-			// `localhost`, while the suite itself drives `127.0.0.1`. These are two
-			// different things: the suite's address is where the browser goes, and
-			// this one is what the server calls itself — which is now also the
-			// WebAuthn relying party id, and WebAuthn refuses an IP address.
+	webServer: [
+		{
+			// The whole chain, every run.
 			//
-			// The passkey test navigates to localhost explicitly so its origin
-			// matches. Everything else stays on the loopback address, where it has
-			// always been.
-			VERDANDE_BASE_URL: `http://localhost:${PORT}`,
-			VERDANDE_DATA_DIR: dataDir,
-			// Off: an update check would reach out to GitHub from a test run.
-			VERDANDE_UPDATE_CHECK: 'false'
+			// The frontend is embedded in the binary at compile time, from a copy under
+			// cmd/verdande/webbuild — so a suite that merely started the server would
+			// test whatever frontend was copied there last, which during development is
+			// nearly always the wrong one. Testing a stale build is worse than not
+			// testing: it reports green on code that is not running.
+			command: [
+				'npm run build',
+				'rm -rf ../cmd/verdande/webbuild',
+				'cp -r build ../cmd/verdande/webbuild',
+				'cd .. && go run -tags embedweb ./cmd/verdande'
+			].join(' && '),
+			cwd: here,
+			url: `${baseURL}/healthz`,
+			reuseExistingServer: false,
+			// The first run compiles the binary and builds nothing else; a cold Go
+			// build on a CI runner is comfortably under two minutes.
+			timeout: 180_000,
+			stdout: 'pipe',
+			stderr: 'pipe',
+			env: {
+				VERDANDE_ADDR: `:${PORT}`,
+				// `localhost`, while the suite itself drives `127.0.0.1`. These are two
+				// different things: the suite's address is where the browser goes, and
+				// this one is what the server calls itself — which is now also the
+				// WebAuthn relying party id, and WebAuthn refuses an IP address.
+				//
+				// The passkey test navigates to localhost explicitly so its origin
+				// matches. Everything else stays on the loopback address, where it has
+				// always been.
+				VERDANDE_BASE_URL: `http://localhost:${PORT}`,
+				VERDANDE_DATA_DIR: dataDir,
+				// Off: an update check would reach out to GitHub from a test run.
+				VERDANDE_UPDATE_CHECK: 'false'
+			}
+		},
+
+		// Den samme binær en gang til, med den anden udgave slået til. Bygningen er
+		// allerede lavet af serveren ovenfor — `go run` genbruger byggecachen — så
+		// det her koster en opstart og ikke en oversættelse.
+		{
+			command: 'cd .. && go run -tags embedweb ./cmd/verdande',
+			cwd: here,
+			url: `http://127.0.0.1:${NOTES_PORT}/healthz`,
+			reuseExistingServer: false,
+			timeout: 180_000,
+			stdout: 'pipe',
+			stderr: 'pipe',
+			env: {
+				VERDANDE_ADDR: `:${NOTES_PORT}`,
+				VERDANDE_BASE_URL: `http://localhost:${NOTES_PORT}`,
+				VERDANDE_DATA_DIR: notesDataDir,
+				VERDANDE_EDITION: 'notes',
+				VERDANDE_UPDATE_CHECK: 'false'
+			}
 		}
-	}
+	]
 });

web/scripts/generate-icons.js

@@ -1,40 +1,71 @@
 /**
- * Renders static/icon.svg to the PNGs the manifest and iOS need.
+ * Renders each edition's icon SVG to the PNGs the manifest and iOS need.
  *
  *     node scripts/generate-icons.js
  *
  * A script rather than a test, so CI never runs it and never rewrites a tracked
- * binary. Run it when the icon changes; the smoke test fetches every icon the
+ * binary. Run it when an icon changes; the smoke test fetches every icon the
  * manifest names, so a reference with no file behind it fails there.
  *
  * It drives Chromium because there is no SVG renderer on this machine — which is
  * why these references were once removed rather than left pointing at files that
  * did not exist. Playwright is a renderer, and it is already a dependency.
+ *
+ * Two sets, because there are two editions. Both ship in the one binary and the
+ * server decides which to serve at /icon.svg and friends — see
+ * internal/httpapi/shell.go. The alternative, rewriting the manifest to point at
+ * urd-icon-192.png, would have left `apple-touch-icon.png` behind: Safari looks
+ * for that one BY NAME and ignores the manifest entirely, so a renamed path there
+ * is a home-screen icon that is a screenshot of the page.
  */
 import { chromium } from '@playwright/test';
 import { readFileSync, writeFileSync } from 'node:fs';
 
+// The three sizes, and why each is here.
 const SIZES = [
 	// The two the manifest asks for: 192 for a launcher, 512 for a splash screen.
-	{ file: 'static/icon-192.png', size: 192 },
-	{ file: 'static/icon-512.png', size: 512 },
-	// And the one Safari wants by name. It ignores the manifest's icons entirely
-	// and looks for this, which is why an installed PWA on iOS otherwise gets a
-	// screenshot of the page as its home-screen icon.
-	{ file: 'static/apple-touch-icon.png', size: 180 }
+	{ suffix: '-192.png', size: 192 },
+	{ suffix: '-512.png', size: 512 },
+	// And the one Safari wants by name.
+	{ suffix: '-apple-touch.png', size: 180 }
+];
+
+// `out` is spelled out per set rather than built from the prefix, because
+// verdande's three were named before there was a second set and renaming them
+// would move the paths the manifest and app.html already point at.
+const SETS = [
+	{
+		source: 'static/icon.svg',
+		out: {
+			'-192.png': 'static/icon-192.png',
+			'-512.png': 'static/icon-512.png',
+			'-apple-touch.png': 'static/apple-touch-icon.png'
+		}
+	},
+	{
+		source: 'static/urd-icon.svg',
+		out: {
+			'-192.png': 'static/urd-icon-192.png',
+			'-512.png': 'static/urd-icon-512.png',
+			'-apple-touch.png': 'static/urd-apple-touch-icon.png'
+		}
+	}
 ];
 
-const svg = readFileSync('static/icon.svg', 'utf8');
 const browser = await chromium.launch();
 const page = await browser.newPage();
 
-for (const { file, size } of SIZES) {
-	await page.setViewportSize({ width: size, height: size });
-	await page.setContent(
-		`<style>html,body{margin:0;padding:0}svg{display:block;width:${size}px;height:${size}px}</style>${svg}`
-	);
-	writeFileSync(file, await page.locator('svg').screenshot());
-	console.log(`${file}  ${size}×${size}`);
+for (const set of SETS) {
+	const svg = readFileSync(set.source, 'utf8');
+	for (const { suffix, size } of SIZES) {
+		const file = set.out[suffix];
+		await page.setViewportSize({ width: size, height: size });
+		await page.setContent(
+			`<style>html,body{margin:0;padding:0}svg{display:block;width:${size}px;height:${size}px}</style>${svg}`
+		);
+		writeFileSync(file, await page.locator('svg').screenshot());
+		console.log(`${file}  ${size}×${size}`);
+	}
 }
 
 await browser.close();

web/src/lib/api.js

@@ -241,6 +241,9 @@ export const api = {
 	// a save button, and this writes on every click of a chevron.
 	setNavOrder: (order) => put('/auth/nav-order', { order }),
 	setSidebarSections: (sections) => put('/auth/sidebar-sections', { sections }),
+	// null slu00e5r den fra. Minutter i forhold til forfaldstiden, negativt for fu00f8r —
+	// samme fortegn som reminders.offset_min, fordi det er den kolonne, den ender i.
+	setDefaultReminder: (minutes) => put('/auth/default-reminder', { minutes }),
 	signup: (data) => post('/auth/signup', data),
 	forgotPassword: (email) => post('/auth/password/forgot', { email }),
 	resetPassword: (token, password) => post('/auth/password/reset', { token, password }),
@@ -365,8 +368,13 @@ export const api = {
 	moveTask: (id, data) => post(`/tasks/${id}/move`, data),
 	snoozeTask: (id, until) => post(`/tasks/${id}/snooze`, { until: until ?? '' }),
 
-	quickAdd: (text, projectId, sectionId) =>
-		post('/tasks/quick-add', { text, project_id: projectId, section_id: sectionId }),
+	quickAdd: (text, projectId, sectionId, parentId) =>
+		post('/tasks/quick-add', {
+			text,
+			project_id: projectId,
+			section_id: sectionId,
+			parent_id: parentId
+		}),
 	quickAddPreview: (text, signal) =>
 		get(`/tasks/quick-add/preview?text=${encodeURIComponent(text)}`, { signal }),
 
@@ -511,6 +519,8 @@ export const api = {
 	importCSV: (data) => post('/import/csv', data),
 	exportAccountURL: () => '/api/v1/export/account',
 	exportNotesURL: () => '/api/v1/export/notes.zip',
+	exportAllCSVURL: () => '/api/v1/export/projects.zip',
+	exportAllICSURL: () => '/api/v1/export/tasks.ics',
 	// Through `upload`, not `request`: a multipart body has to set its own boundary,
 	// and the browser only does that when nothing has claimed the header.
 	importNotes: (file) => upload('/notes/import', file),

web/src/lib/components/BeaconNotice.svelte

@@ -64,7 +64,7 @@
 {#if notice}
 	<aside class="notice" role="region" aria-label={t('beacon.noticeTitle')}>
 		<h2>{t('beacon.noticeTitle')}</h2>
-		<p>{t('beacon.noticeBody')}</p>
+		<p>{t('beacon.noticeBody', { product: app.productName })}</p>
 
 		<!-- Det, der bliver sendt, med de rigtige værdier i. Ikke et eksempel: det
 		     er selve meldingen, og den kan sammenholdes med indstillingssiden. -->

web/src/lib/components/CommandPalette.svelte

@@ -85,7 +85,11 @@
 		...settings.map((s) => ({ kind: 'setting', id: s.href, label: `${s.tab} · ${s.title}` })),
 		...projects.map((p) => ({ kind: 'project', id: p.id, label: p.name })),
 		...notes.map((n) => ({ kind: 'note', id: n.id, label: n.title || n.body.slice(0, 60) })),
-		...tasks.map((t) => ({
+		// Serveren sender ingen opgaver i noter-udgaven, så listen er alligevel tom.
+		// Spurgt her også, fordi en tom liste af den rigtige grund og en tom liste
+		// ved et tilfælde ser ens ud — og den dag nogen mounter søgningen anderledes,
+		// skal ⌘K ikke være stedet, det viser sig.
+		...(app.notesOnly ? [] : tasks).map((t) => ({
 			kind: 'task',
 			id: t.id,
 			label: t.content,

web/src/lib/components/DictateSheet.svelte

@@ -0,0 +1,243 @@
+<script>
+	/**
+	 * Tal en opgave ind.
+	 *
+	 * En stor rund knap i bunden af skærmen, inden for tommelfingerens rækkevidde.
+	 * Den åbner en skuffe med quick-add-feltet og sætter markøren i det, så
+	 * tastaturet kommer frem — og så trykker man mikrofonen på tastaturet.
+	 *
+	 * VI LAVER INGEN TALEGENKENDELSE, og det er et valg frem for en mangel. iOS'
+	 * egen diktering kører på enheden på nyere telefoner; en talegenkendelse bygget
+	 * ind her ville sende lyden fra et selvhostet program videre til Apple eller
+	 * Google, og det er en datavej, der skal forklares på privatlivssiden for at
+	 * spare ét tryk. Teksten lander i det felt, der i forvejen viser, hvad parseren
+	 * forstod — så "ring til tandlægen i morgen kl 10 p1" bliver læst, mens man ser
+	 * på det, og intet oprettes før man siger ja.
+	 *
+	 * Derfor hedder komponenten diktat og ikke tale: den gør ikke selv noget ved
+	 * lyden, den stiller feltet frem.
+	 */
+	import QuickAdd from './QuickAdd.svelte';
+	import { app } from '$lib/stores.svelte.js';
+	import { t } from '$lib/i18n.svelte.js';
+
+	let open = $state(false);
+	let box;
+	let sheet;
+
+	/**
+	 * Åbner og sætter fokus I SAMME HUG som klikket.
+	 *
+	 * Rækkefølgen her er hele funktionen. Safari på iOS åbner kun tastaturet, hvis
+	 * `focus()` kaldes inde i den brugerhandling, der bad om det — og Sveltes
+	 * opdateringer er asynkrone, så feltet kan ikke være betinget tegnet og få
+	 * fokus i samme omgang. Derfor er skuffen ALTID monteret og bare skubbet ud af
+	 * syne med `transform` og `opacity`: elementet findes, så det kan fokuseres nu
+	 * frem for efter næste opdatering.
+	 *
+	 * `display: none` og `visibility: hidden` ville begge gøre feltet ufokuserbart,
+	 * og `inert` ligeså. Det er grunden til, at den lukkede tilstand er gennemsigtig
+	 * og uden pointer-events frem for skjult.
+	 */
+	function start() {
+		// `inert` fjernes med hånden her, og det er ikke sjusk. Attributten sættes
+		// reaktivt af `inert={!open}` nedenfor, så den er der stadig i det øjeblik,
+		// klikket kører — Sveltes opdateringer er asynkrone. Og et inert element kan
+		// ikke fokuseres, så `focusField()` ville ramme ingenting, og iOS ville ikke
+		// åbne tastaturet.
+		//
+		// Den findes, fordi alternativet er værre: uden den kan skuffens knapper
+		// tabbes til, mens den er usynlig, på hver eneste side.
+		sheet?.removeAttribute('inert');
+		open = true;
+		box?.focusField();
+	}
+
+	function close() {
+		open = false;
+		// Tastaturet bliver stående, hvis feltet beholder fokus.
+		if (sheet?.contains(document.activeElement)) document.activeElement.blur();
+	}
+
+	function onkeydown(event) {
+		if (event.key === 'Escape' && open) {
+			event.preventDefault();
+			close();
+		}
+	}
+</script>
+
+<svelte:window {onkeydown} />
+
+<!-- Knappen tegnes ikke i urd-ansigtet: der er ingen opgaver at lægge noget i.
+     Og den er skjult over 820px i CSS frem for her, fordi en skærm, der skifter
+     bredde, ikke skal kunne tabe et felt, der har fokus. -->
+{#if !app.showsUrd}
+	<button class="fab" class:away={open} onclick={start} aria-label={t('task.speak')}>
+		<!-- En mikrofon, tegnet i samme streger som mærkerne: kapslen, bøjlen under
+		     den og foden. Ingen tekst i knappen — den er rund og tommelfingerstor,
+		     og navnet står i aria-label. -->
+		<svg viewBox="0 0 24 24" aria-hidden="true">
+			<rect x="9" y="2.5" width="6" height="11" rx="3" />
+			<path d="M5.5 11a6.5 6.5 0 0 0 13 0" />
+			<path d="M12 17.5V21" />
+		</svg>
+	</button>
+{/if}
+
+<div
+	class="scrim"
+	class:open
+	aria-hidden="true"
+	onclick={close}
+	role="presentation"
+></div>
+
+<div
+	class="sheet"
+	class:open
+	bind:this={sheet}
+	role="dialog"
+	aria-modal="false"
+	aria-label={t('task.speak')}
+	aria-hidden={!open}
+	inert={!open}
+>
+	<div class="grab" aria-hidden="true"></div>
+	<p class="hint">{t('task.speakHint')}</p>
+	<!-- `marked={false}`: den her må ikke være den, type-anywhere-genvejen finder.
+	     Se kommentaren ved `marked` i QuickAdd. -->
+	<QuickAdd bind:this={box} marked={false} label={t('task.speak')} onadded={close} />
+	<button class="done" onclick={close}>{t('detail.close')}</button>
+</div>
+
+<style>
+	.fab {
+		position: fixed;
+		right: max(var(--s4), env(safe-area-inset-right));
+		/* Over hjemmeindikatoren på en iPhone, ikke under den. */
+		bottom: calc(var(--s4) + env(safe-area-inset-bottom));
+		z-index: 40;
+
+		width: 64px;
+		height: 64px;
+		border: none;
+		border-radius: var(--radius-full);
+		background: var(--accent);
+		color: var(--accent-ink);
+		box-shadow: var(--shadow-lg);
+		display: grid;
+		place-items: center;
+		cursor: pointer;
+		transition:
+			transform var(--fast) var(--ease-out),
+			opacity var(--fast) var(--ease-out);
+	}
+
+	.fab svg {
+		width: 28px;
+		height: 28px;
+		fill: none;
+		stroke: currentColor;
+		stroke-width: 2;
+		stroke-linecap: round;
+		stroke-linejoin: round;
+	}
+
+	.fab:active {
+		transform: scale(0.94);
+	}
+
+	/* Væk, mens skuffen er åben: den ville ellers stå oven på feltet. */
+	.fab.away {
+		opacity: 0;
+		pointer-events: none;
+		transform: translateY(8px);
+	}
+
+	.scrim {
+		position: fixed;
+		inset: 0;
+		z-index: 44;
+		background: rgb(0 0 0 / 0.4);
+		opacity: 0;
+		pointer-events: none;
+		transition: opacity var(--medium) var(--ease-out);
+	}
+
+	.scrim.open {
+		opacity: 1;
+		pointer-events: auto;
+	}
+
+	.sheet {
+		position: fixed;
+		inset: auto 0 0 0;
+		z-index: 45;
+		padding: var(--s3) max(var(--s3), env(safe-area-inset-left))
+			calc(var(--s3) + env(safe-area-inset-bottom)) max(var(--s3), env(safe-area-inset-right));
+		background: var(--surface-raised);
+		border-top: 1px solid var(--line);
+		border-radius: var(--radius-lg) var(--radius-lg) 0 0;
+		box-shadow: var(--shadow-lg);
+		display: grid;
+		gap: var(--s2);
+
+		/* Lukket: gennemsigtig og skubbet ned, IKKE display:none — feltet skal kunne
+		   fokuseres i samme hug som klikket. Se `start()`. */
+		opacity: 0;
+		transform: translateY(100%);
+		pointer-events: none;
+		transition:
+			transform var(--medium) var(--ease-out),
+			opacity var(--medium) var(--ease-out);
+	}
+
+	.sheet.open {
+		opacity: 1;
+		transform: translateY(0);
+		pointer-events: auto;
+	}
+
+	.grab {
+		width: 36px;
+		height: 4px;
+		border-radius: var(--radius-full);
+		background: var(--line-strong);
+		justify-self: center;
+	}
+
+	.hint {
+		margin: 0;
+		color: var(--ink-muted);
+		font-size: 0.85rem;
+		text-align: center;
+	}
+
+	.done {
+		justify-self: center;
+		background: none;
+		border: none;
+		color: var(--ink-muted);
+		padding: var(--s2);
+		cursor: pointer;
+	}
+
+	/* En skrivebordsskærm har feltet fremme hele tiden og et tastatur at skrive
+	   på. Knappen er til tommelfingeren. */
+	@media (min-width: 821px) {
+		.fab,
+		.scrim,
+		.sheet {
+			display: none;
+		}
+	}
+
+	@media (prefers-reduced-motion: reduce) {
+		.fab,
+		.scrim,
+		.sheet {
+			transition: none;
+		}
+	}
+</style>

web/src/lib/components/NoConnection.svelte

@@ -0,0 +1,95 @@
+<script>
+	/**
+	 * What the app shows when it could not reach the server at all.
+	 *
+	 * Before this, an outage rendered the sign-in screen: the boot asks who you
+	 * are, the request never gets an answer, `user` stays null, and null means
+	 * "logged out" everywhere else. So the app blamed the session for the network
+	 * being down, and offered a password box that could not possibly work. That is
+	 * worse than an error message, because it looks like it might work — people
+	 * type the password, get nothing, and conclude their account is broken.
+	 *
+	 * It happened for real on 17 September 2026: the instance's DNS record was
+	 * deleted, and what the app showed was a slow-loading login page.
+	 *
+	 * The text says the data is safe, because that is the question somebody
+	 * actually has when their notes vanish behind a login box.
+	 */
+	import { t } from '$lib/i18n.svelte.js';
+	import { app } from '$lib/stores.svelte.js';
+
+	let trying = $state(false);
+
+	async function again() {
+		trying = true;
+		try {
+			await app.load();
+		} finally {
+			trying = false;
+		}
+	}
+</script>
+
+<div class="screen">
+	<div class="card">
+		<div class="brand">
+			<span class="rune" aria-hidden="true">ᚹ</span>
+			<h1>verdande</h1>
+		</div>
+
+		<h2>{t('net.downTitle')}</h2>
+		<p class="lede">{t('net.downBody', { product: app.productName })}</p>
+
+		<button onclick={again} disabled={trying}>
+			{trying ? t('net.reconnecting') : t('net.downRetry')}
+		</button>
+	</div>
+</div>
+
+<style>
+	.screen {
+		height: 100dvh;
+		display: grid;
+		place-items: center;
+		padding: var(--s4);
+		background: var(--ground);
+	}
+
+	.card {
+		width: 100%;
+		max-width: 340px;
+		display: flex;
+		flex-direction: column;
+		gap: var(--s4);
+		text-align: center;
+	}
+
+	.brand {
+		display: flex;
+		align-items: center;
+		gap: var(--s3);
+		justify-content: center;
+	}
+
+	.rune {
+		font-size: var(--text-2xl);
+		color: var(--accent);
+		line-height: 1;
+	}
+
+	h1 {
+		font-size: var(--text-xl);
+		margin: 0;
+	}
+
+	h2 {
+		font-size: var(--text-lg);
+		margin: 0;
+	}
+
+	.lede {
+		margin: 0;
+		color: var(--ink-soft);
+		line-height: 1.5;
+	}
+</style>

web/src/lib/components/NoteEditor.svelte

@@ -13,7 +13,7 @@
 	 * unforgivable. When the replacement (the EditContext API) is everywhere, this
 	 * is the file to change.
 	 */
-	import { markdownToHtml, htmlToMarkdown } from '$lib/richtext.js';
+	import { markdownToHtml, htmlToMarkdown, blockText } from '$lib/richtext.js';
 	import { highlight, guessLanguage } from '$lib/highlight.js';
 	import { t } from '$lib/i18n.svelte.js';
 	import { app } from '$lib/stores.svelte.js';
@@ -81,12 +81,55 @@
 			// fired.
 			editor.innerHTML = body.trim() ? markdownToHtml(body) : '<h1><br></h1>';
 			colourCode();
+			// Og markøren sættes DER.
+			//
+			// Indtil nu lavede linjen ovenfor kun titelblokken, så sætningen i
+			// kommentaren — "opens on its title" — handlede om, hvad der blev tegnet,
+			// ikke om hvor man kunne skrive. Noter-siden prøvede at råde bod på det
+			// med `document.querySelector('.editor textarea')?.focus()`, og der er
+			// ingen textarea: editoren er et contenteditable. Det kald har ramt
+			// ingenting, stille, siden editoren blev lavet om, og `?.` sørgede for,
+			// at det aldrig kastede.
+			//
+			// Her frem for på siden, så begge veje ind er dækket: noter-sidens egen
+			// opret-knap, og projektsidens, der sender videre med ?note=<id>.
+			if (!body.trim()) placeCaretInTitle();
 		} catch (e) {
 			editor.textContent = body;
 			console.error('verdande: noten kunne ikke tegnes', note.id, e);
 		}
 	});
 
+	/**
+	 * Sætter markøren i titlen på en tom note.
+	 *
+	 * En contenteditable har ikke et felt at fokusere — den har en markør, og den
+	 * skal placeres. `focus()` alene giver elementet tastaturfokus og lader
+	 * markøren stå, hvor browseren synes, hvilket for et tomt element er starten
+	 * på dokumentet frem for inde i overskriften.
+	 *
+	 * Fokus FØRST og så området: at fokusere et contenteditable kan nulstille
+	 * markeringen, så den omvendte rækkefølge sætter et område, der straks bliver
+	 * kasseret igen.
+	 *
+	 * Hvad den IKKE kan, sagt her frem for opdaget på en telefon: åbne tastaturet
+	 * på iOS. Det sker kun, når focus() kaldes inde i den brugerhandling, der bad
+	 * om det — og en ny note skal først oprettes på serveren, så der ligger et
+	 * `await` imellem. Markøren står rigtigt; på en telefon skal man stadig trykke
+	 * én gang for at få tastaturet frem.
+	 */
+	function placeCaretInTitle() {
+		const heading = editor?.querySelector('h1');
+		if (!heading) return;
+		editor.focus();
+		const range = document.createRange();
+		range.selectNodeContents(heading);
+		range.collapse(true);
+		const selection = window.getSelection();
+		selection?.removeAllRanges();
+		selection?.addRange(range);
+	}
+
 	const SYNTAX = [
 		{ mark: '#', what: 'notes.syntaxProject' },
 		{ mark: '[[', what: 'notes.syntaxNote' },
@@ -133,20 +176,78 @@
 		// `<pre>…<p>body</p></pre>` — so the text stays monospace and there is no way
 		// out of the block from the menu. Do any conversion that touches a <pre> by
 		// hand, replacing the element rather than reformatting inside it.
-		const block = currentBlock();
-		if (block && (block.tagName === 'PRE' || style.tag === 'pre')) {
-			replaceBlock(block, style.tag);
+		//
+		// Hele markeringen, ikke blokken markøren står i. Den her vej spurgte efter
+		// `currentBlock()`, og det er ét blok — så en markering over ti linjers
+		// terminaludskrift gjorde den første linje til kode og lod resten stå. Det
+		// er den slags, man ikke opdager med to linjer og ikke kan overse med ti.
+		const blocks = selectedBlocks();
+		if (!blocks.length) return apply('formatBlock', style.tag);
+
+		if (style.tag === 'pre') {
+			mergeToMono(blocks);
+			return;
+		}
+
+		// Ud af monotype igen: hver blok for sig, uden at røre markeringen —
+		// tekstknuderne flytter med over i de nye elementer, så den range, browseren
+		// holder på, stadig peger på noget, der er i dokumentet. Resten klarer
+		// formatBlock bagefter, nu hvor der ikke er en <pre> i vejen.
+		const pres = blocks.filter((b) => b.tagName === 'PRE');
+		for (const b of pres) swapTag(b, style.tag);
+		if (pres.length === blocks.length) {
+			readState();
+			changed();
 			return;
 		}
 		apply('formatBlock', style.tag);
 	}
 
 	/**
-	 * Replaces a block element with one of another tag, keeping its contents and the
-	 * caret. Used where execCommand cannot be trusted — converting to or from a
-	 * <pre>, which it either nests or ignores.
+	 * Alle de blokke, markeringen rører — ikke kun den, markøren står i.
+	 *
+	 * En sammenfaldet markering rører præcis ét blok, så den enkle sag opfører sig
+	 * som før.
 	 */
-	function replaceBlock(block, tag) {
+	function selectedBlocks() {
+		const selection = window.getSelection();
+		if (!selection || !selection.rangeCount || !editor) return [];
+		const range = selection.getRangeAt(0);
+		return [...editor.children].filter((b) => range.intersectsNode(b));
+	}
+
+	/**
+	 * Lægger flere blokke sammen til én monotypeblok.
+	 *
+	 * Én blok og ikke én pr. linje: en udskrift, man indsætter, er ét stykke kode.
+	 * Tre blokke ved siden af hinanden ser næsten ens ud på skærmen og bliver til
+	 * tre hegn i filen — og så kan de ikke rulles eller kopieres som det ene,
+	 * de er.
+	 */
+	function mergeToMono(blocks) {
+		const pre = document.createElement('pre');
+		// blockText og ikke textContent: et <br> har den tomme streng som
+		// textContent, og det er netop <br>, der står for et linjeskift inde i en
+		// blok. Samme grund som da en kodeblok ikke kunne gemme mere end én linje.
+		pre.textContent = blocks.map((b) => blockText(b)).join('\n');
+		if (!pre.textContent) pre.appendChild(document.createElement('br'));
+
+		blocks[0].replaceWith(pre);
+		for (const b of blocks.slice(1)) b.remove();
+
+		const range = document.createRange();
+		range.selectNodeContents(pre);
+		range.collapse(false);
+		const selection = window.getSelection();
+		selection.removeAllRanges();
+		selection.addRange(range);
+
+		readState();
+		changed();
+	}
+
+	/** Bytter et bloks tag ud og flytter indholdet med, uden at røre markøren. */
+	function swapTag(block, tag) {
 		// The copy button lives inside the <pre> so it can sit in its corner; it is
 		// not text and must not travel into a paragraph. addCopyButtons puts it back
 		// on the next render for any <pre> that still needs one.
@@ -156,6 +257,16 @@
 		while (block.firstChild) el.appendChild(block.firstChild);
 		if (!el.firstChild) el.appendChild(document.createElement('br'));
 		block.replaceWith(el);
+		return el;
+	}
+
+	/**
+	 * Replaces a block element with one of another tag, keeping its contents and the
+	 * caret. Used where execCommand cannot be trusted — converting to or from a
+	 * <pre>, which it either nests or ignores.
+	 */
+	function replaceBlock(block, tag) {
+		const el = swapTag(block, tag);
 
 		const range = document.createRange();
 		range.selectNodeContents(el);
@@ -380,7 +491,7 @@
 			btn.addEventListener('click', async (e) => {
 				e.preventDefault();
 				e.stopPropagation();
-				const text = codeTextOf(pre);
+				const text = blockText(pre);
 				try {
 					await navigator.clipboard.writeText(text.replace(/\n$/, ''));
 					btn.textContent = t('notes.copied');
@@ -394,19 +505,16 @@
 	}
 
 	/**
-	 * Teksten i en kodeblok, uden knapper og andet, editoren har lagt oven på den.
+	 * Teksten i en kodeblok kommer fra `blockText` i richtext.js — ÉT sted, hvilket
+	 * den her kommentar påstod i forvejen, mens der stod en kopi lige her.
 	 *
-	 * Ét sted, fordi to steder skal bruge det samme svar: farvelægningen, som
-	 * skriver resultatet tilbage i blokken, og oversættelsen til Markdown, som
-	 * skriver det i filen. Var de to uenige, ville forskellen ende i noten.
+	 * De to skal bruge det samme svar: farvelægningen, som skriver resultatet
+	 * tilbage i blokken, og oversættelsen til Markdown, som skriver det i filen. De
+	 * var uenige om ét tegn — kopien her læste `textContent`, og et <br> har den
+	 * tomme streng som textContent. Så en blok, man havde skrevet med shift+retur,
+	 * fik sine linjer skrevet sammen af farvelægningen, i det øjeblik man klikkede
+	 * væk fra den. På skærmen, ikke kun i filen.
 	 */
-	function codeTextOf(pre) {
-		const from = pre.querySelector('code') ?? pre;
-		return [...from.childNodes]
-			.filter((n) => n.nodeType !== Node.ELEMENT_NODE || !n.classList?.contains('copy'))
-			.map((n) => n.textContent ?? '')
-			.join('');
-	}
 
 	function colourCode() {
 		if (!editor) return;
@@ -419,7 +527,7 @@
 			// maler resultatet tilbage ind i blokken — så et klik på "Kopiér" skrev
 			// "Kopieret" ind i koden, og den næste gemning lagde det i filen. Knappen
 			// spiste den kode, den var sat der for at kopiere.
-			const code = codeTextOf(pre);
+			const code = blockText(pre);
 			const lang = pre.getAttribute('data-lang') || guessLanguage(code);
 			if (lang) pre.setAttribute('data-lang', lang);
 			const painted = highlight(code, lang);
@@ -756,23 +864,54 @@
 	 * the caret in another heading in most browsers, and a note where every line is
 	 * a title is a note with no title at all.
 	 */
-	function keepTitleFirst() {
-		const block = currentBlock();
-		if (!block) return;
+	function keepTitleFirst(split) {
+		if (!editor) return;
 
-		// A heading that is not the first line becomes body.
-		if (block.tagName === 'H1' && block !== editor.firstElementChild) {
-			document.execCommand('formatBlock', false, 'p');
-			return;
-		}
+		// Der hvor markøren står, gør execCommand det, for det er den, der lægger
+		// ændringen i browserens egen fortryd-historik — ⌘Z skal tage afsnittet tilbage,
+		// ligesom den tager et ord tilbage.
+		const caret = currentBlock();
+		if (caret && stray(caret)) document.execCommand('formatBlock', false, 'p');
 
-		// And the browser's own container becomes a paragraph. Chromium answers Enter
-		// with a bare <div>, which reads as body but is not styled as one — so the
-		// spacing between paragraphs quietly disappears the moment somebody presses
-		// return rather than choosing Brødtekst from the menu.
-		if (block.tagName === 'DIV') {
-			document.execCommand('formatBlock', false, 'p');
-		}
+		// Retur for enden af en overskrift efterlader endnu en overskrift i de fleste
+		// browsere, og markøren kan være løbet videre, inden rettelsen når frem. Kun den
+		// blok, delingen lige skabte: en <h1> andre steder i noten kan være en linje,
+		// nogen har valgt Titel til i menuen, og den er deres at beholde.
+		const lavet = split?.nextElementSibling;
+		if (lavet && lavet !== currentBlock() && stray(lavet)) swapTag(lavet, 'p');
+
+		// Og hver <div>, rettelsen ikke nåede.
+		//
+		// Den er udskudt ét hak, fordi der før delingen ikke er nogen ny blok at rette.
+		// Men et hak er nok: skriver man hurtigt, når næste retur igennem først, og så
+		// står markøren i den NÆSTE blok. Så rettede den den — to gange — og lod den
+		// blok, rettelsen var ment for, stå tilbage. Målt på en CI-runner, hvor "linje
+		// et" blev en <div> mens "linje to" og "linje tre" blev <p>: brødtekst uden
+		// afstand, hos netop de brugere der skriver hurtigst.
+		//
+		// Den spørger noten frem for et håndtag. Et håndtag holder ikke: når den første
+		// udskudte rettelse bytter tagget på en blok, peger den næstes håndtag på en
+		// node, der ikke længere sidder i dokumentet, og så bliver blokken midt i
+		// kæden aldrig rettet. En <div> er altid browserens egen beholder og aldrig
+		// nogens valg, så den kan fejes op hvor som helst uden at tage noget fra nogen.
+		const her = currentBlock();
+		for (const block of [...editor.children])
+			if (block !== her && block.tagName === 'DIV') swapTag(block, 'p');
+	}
+
+	/**
+	 * En blok, der ikke må stå, som den står.
+	 *
+	 * Browserens egen beholder: Chromium svarer på retur med en bar <div>, som læses
+	 * som brødtekst og ikke er formateret som en, så afstanden mellem afsnit stille
+	 * forsvinder. Eller en overskrift, der ikke er den første linje — en note, hvor
+	 * hver linje er en titel, er en note uden titel.
+	 */
+	function stray(block) {
+		if (block.parentNode !== editor) return false;
+		return (
+			block.tagName === 'DIV' || (block.tagName === 'H1' && block !== editor.firstElementChild)
+		);
 	}
 
 	/**
@@ -788,6 +927,17 @@
 		});
 	}
 
+	/**
+	 * Står markøren i en punktliste eller en nummereret liste?
+	 *
+	 * Spurgt gennem kommandotilstanden frem for ved at gå op gennem træet: det er
+	 * den samme kilde, værktøjslinjen allerede markerer knappen efter, så de to kan
+	 * ikke blive uenige om, hvad der er en liste.
+	 */
+	const inList = () =>
+		document.queryCommandState('insertUnorderedList') ||
+		document.queryCommandState('insertOrderedList');
+
 	function onkeydown(event) {
 		// The suggestion list owns the arrows and return while it is open, the way
 		// every other completion does. Escape closes it without choosing.
@@ -816,6 +966,15 @@
 			}
 		}
 
+		// Tab rykker et punkt ind og ud, som i enhver anden liste. Kun i en liste:
+		// alle andre steder er Tab den tast, der flytter fokus videre, og en editor,
+		// der stjæler den, er en editor, man ikke kan komme ud af med tastaturet.
+		if (event.key === 'Tab' && inList()) {
+			event.preventDefault();
+			apply(event.shiftKey ? 'outdent' : 'indent');
+			return;
+		}
+
 		if (event.key === 'Enter' && !event.shiftKey) {
 			// A code block is the one place the browser keeps the caret inside on
 			// Enter rather than starting a new block. Step out of it ourselves, or a
@@ -827,9 +986,10 @@
 				changed();
 				return;
 			}
-			// After the split, not before it.
+			// After the split, not before it — and with the block the split started from,
+			// because by the time this runs the caret may be two blocks further on.
 			setTimeout(() => {
-				keepTitleFirst();
+				keepTitleFirst(block);
 				changed();
 			}, 0);
 			return;

web/src/lib/components/Notifications.svelte

@@ -20,6 +20,31 @@
 	let open = $state(false);
 	let wrap = $state(null);
 
+	/**
+	 * Hvor panelet begynder på en telefon — målt, ikke regnet ud.
+	 *
+	 * På en bred skærm hænger panelet under klokken og hører til den. På en telefon
+	 * kan det ikke: klokken sidder tættere på højre kant end panelet er bredt, så et
+	 * panel, der er stillet op efter klokken, skydes ud over venstre side og bliver
+	 * klippet. Der stod tre en halv linje tekst uden for skærmen.
+	 *
+	 * Bredden kunne trækkes fra i CSS — der er en temaknap, et mellemrum og en
+	 * kantafstand til højre for klokken — men så ville den her fil kende sine
+	 * naboers størrelse, og næste knap i toplinjen ville lave fejlen om igen uden
+	 * at sige noget. Toplinjens underkant måles i stedet, og så spænder panelet over
+	 * skærmen med en kant i hver side.
+	 */
+	let below = $state(0);
+
+	function place() {
+		if (wrap) below = Math.round(wrap.getBoundingClientRect().bottom);
+	}
+
+	function toggle() {
+		open = !open;
+		if (open) place();
+	}
+
 	const KINDS = {
 		assigned: 'notif.assigned',
 		'note.changed': 'notif.noteChanged',
@@ -72,6 +97,7 @@
 
 <svelte:window
 	onclick={outside}
+	onresize={() => open && place()}
 	onkeydown={(e) => {
 		if (e.key === 'Escape' && open) open = false;
 	}}
@@ -81,7 +107,7 @@
 	<button
 		class="bell"
 		class:on={open}
-		onclick={() => (open = !open)}
+		onclick={toggle}
 		aria-expanded={open}
 		aria-haspopup="dialog"
 		aria-label={app.unread
@@ -101,7 +127,7 @@
 	</button>
 
 	{#if open}
-		<div class="panel" role="dialog" aria-label={t('notif.title')}>
+		<div class="panel" role="dialog" aria-label={t('notif.title')} style="--below: {below}px">
 			<header>
 				<span>{t('notif.title')}</span>
 				{#if app.unread}
@@ -193,6 +219,21 @@
 		box-shadow: var(--shadow-lg, 0 8px 30px rgb(0 0 0 / 0.25));
 	}
 
+	/* På en telefon hører panelet til skærmen, ikke til klokken. Se `below` i
+	   skriptet for hvorfor det måles frem for at blive regnet ud. Samme knæk som
+	   toplinjens egen menuknap, så de to skifter form samtidig. */
+	@media (max-width: 820px) {
+		.panel {
+			position: fixed;
+			top: calc(var(--below) + 6px);
+			left: var(--s3);
+			right: var(--s3);
+			width: auto;
+			max-height: calc(100dvh - var(--below) - var(--s3) * 2);
+			overscroll-behavior: contain;
+		}
+	}
+
 	.panel header {
 		display: flex;
 		align-items: center;

web/src/lib/components/QuickAdd.svelte

@@ -15,14 +15,54 @@
 	import { api } from '$lib/api.js';
 	import { app } from '$lib/stores.svelte.js';
 	import { t } from '$lib/i18n.svelte.js';
-	let { projectId = undefined, onadded = undefined, autofocus = false } = $props();
+	import { readList } from '$lib/pastelist.js';
+	let {
+		projectId = undefined,
+		onadded = undefined,
+		autofocus = false,
+		/**
+		 * Whether this box carries the `data-quickadd` marker.
+		 *
+		 * The layout's type-anywhere shortcut finds the field with
+		 * `document.querySelector('[data-quickadd]')`, which returns the FIRST match
+		 * in the document. So a second box on the page — the dictate sheet's — has
+		 * to stay unmarked, or the shortcut starts typing into a box nobody can see.
+		 */
+		marked = true,
+		/**
+		 * The field's accessible name.
+		 *
+		 * A prop because the dictate sheet puts a second one of these on the page,
+		 * and two fields answering to "Ny opgave" is a screen reader reading the
+		 * same name twice with no way to tell which is which. They are different
+		 * affordances — one is the box on the page, the other is the thing the
+		 * round button opens — so they say different names.
+		 */
+		label = undefined
+	} = $props();
+
+	let fieldLabel = $derived(label ?? t('task.new'));
 
 	let text = $state('');
 	let spans = $state([]);
 	let submitting = $state(false);
 	let input;
+	let mirror;
 	let focused = $state(false);
 
+	/**
+	 * Keeps the tint under the right characters when the line is longer than the
+	 * field.
+	 *
+	 * The input scrolls horizontally and the mirror has to scroll with it. Done on
+	 * both `scroll` and `input` because typing at the end of a long line moves the
+	 * caret — and therefore the scroll — without ever firing a scroll event in some
+	 * browsers.
+	 */
+	function syncScroll() {
+		if (mirror && input) mirror.scrollLeft = input.scrollLeft;
+	}
+
 	// Kept beside the parser's own vocabulary on purpose: a legend that promises
 	// something internal/quickadd cannot read is worse than no legend. These four
 	// are what Parse recognises as marks; dates it reads as prose, which is why the
@@ -71,6 +111,20 @@
 		if (autofocus && input) input.focus();
 	});
 
+	/**
+	 * Focus the field from outside, synchronously.
+	 *
+	 * This exists because of iOS and nothing else. Safari opens the on-screen
+	 * keyboard only when `focus()` is called INSIDE the user gesture that asked for
+	 * it — so the `autofocus` effect above, which runs after the click handler has
+	 * returned, gives the field a caret and no keyboard. For the dictate button that
+	 * is the whole feature failing quietly: the sheet opens, nothing to dictate
+	 * into, and there is no error anywhere.
+	 */
+	export function focusField() {
+		input?.focus();
+	}
+
 	/** Splits the raw text into highlighted and plain runs, by byte offset. */
 	let segments = $derived.by(() => {
 		if (!spans.length) return [{ text, kind: null }];
@@ -97,6 +151,60 @@
 		return out;
 	});
 
+	/**
+	 * En indsat liste bliver til opgaver frem for til én opgave med det hele i.
+	 *
+	 * Browseren smider linjeskiftene væk, når man indsætter i et `<input>`, så uden
+	 * det her blev en kopieret liste til én opgave med punkterne mast sammen. En
+	 * enkelt linje røres ikke — det er almindelig indsætning, og den skal opføre sig
+	 * som altid.
+	 *
+	 * Vist før den oprettes. Fyrre opgaver fra et fejlklik er ikke noget, man skal
+	 * opdage bagefter, og listen er også svaret på "forstod den indrykningen" —
+	 * stillet mens der stadig er en Fortryd-knap.
+	 */
+	let pending = $state([]);
+
+	function onpaste(event) {
+		const pasted = event.clipboardData?.getData('text/plain') ?? '';
+		if (!pasted.includes('\n')) return;
+
+		const rows = readList(pasted);
+		if (rows.length < 2) return;
+
+		event.preventDefault();
+		pending = rows;
+	}
+
+	async function createPending() {
+		if (submitting) return;
+		submitting = true;
+
+		// Den seneste opgave på hvert niveau, så en indrykket linje havner under den
+		// linje, den stod under — og ikke under den første, den bedste.
+		const parents = [];
+		let made = 0;
+		for (const row of pending) {
+			const parentId = row.depth > 0 ? parents[row.depth - 1] : undefined;
+			const task = await app.quickAdd(row.text, projectId, undefined, parentId);
+			// Stopper ved den første, der ikke kunne laves. At køre videre ville lægge
+			// resten af listen ind uden den, de hang under, og det er værre end at
+			// standse et sted, man kan se.
+			if (!task) break;
+			parents[row.depth] = task.id;
+			parents.length = row.depth + 1;
+			if (row.done) await app.complete(task.id);
+			onadded?.(task);
+			made++;
+		}
+
+		submitting = false;
+		// Det, der ikke nåede at blive lavet, bliver stående, så man kan se hvor langt
+		// den kom og prøve resten igen.
+		pending = pending.slice(made);
+		input?.focus();
+	}
+
 	async function submit(event) {
 		event?.preventDefault();
 		const value = text.trim();
@@ -142,7 +250,7 @@
 		<!-- The mirror sits behind the input and must match it exactly: same font,
 		     same padding, same wrapping. Any difference shows up as highlighting
 		     that drifts out of alignment as the line grows. -->
-		<div class="mirror" aria-hidden="true">
+		<div class="mirror" aria-hidden="true" bind:this={mirror}>
 			{#each segments as segment}
 				{#if segment.kind}
 					<mark data-kind={segment.kind}>{segment.text}</mark>
@@ -156,21 +264,42 @@
 			bind:this={input}
 			bind:value={text}
 			{onkeydown}
+			onscroll={syncScroll}
+			oninput={syncScroll}
 			onfocus={() => (focused = true)}
 			onblur={() => (focused = false)}
 			type="text"
-			data-quickadd
+			data-quickadd={marked ? '' : undefined}
 			placeholder={t('task.placeholder')}
-			aria-label={t('task.new')}
+			aria-label={fieldLabel}
 			autocomplete="off"
 			spellcheck="false"
+			{onpaste}
 		/>
 	</div>
 
-	{#if text.trim()}
+	{#if text.trim() && !pending.length}
 		<button type="submit" class="submit" disabled={submitting}>{t('task.add')}</button>
 	{/if}
 
+	{#if pending.length}
+		<div class="pasted" role="group" aria-label={t('task.pastedTitle')}>
+			<ul>
+				{#each pending as row, i (i)}
+					<li style="--depth: {row.depth}" class:done={row.done}>{row.text}</li>
+				{/each}
+			</ul>
+			<div class="actions">
+				<button type="button" class="submit" disabled={submitting} onclick={createPending}>
+					{t('task.pastedAdd', { n: String(pending.length) })}
+				</button>
+				<button type="button" class="cancel" onclick={() => (pending = [])}>
+					{t('task.pastedCancel')}
+				</button>
+			</div>
+		</div>
+	{/if}
+
 	<!-- What the parser understands, spelled out while somebody is typing into it.
 	     It was in the placeholder before, which is the one place a hint cannot be:
 	     the placeholder disappears at the first keystroke, so the help was gone
@@ -190,6 +319,57 @@
 </form>
 
 <style>
+	/* Den indsatte liste, før den bliver til opgaver. Ligger i flowet og ikke
+	   svævende: den skal kunne klikkes på, og den er noget, man læser færdig frem
+	   for et vink, der forsvinder. */
+	.pasted {
+		grid-column: 1 / -1;
+		margin-top: var(--s2);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+		background: var(--surface);
+		padding: var(--s2);
+	}
+
+	.pasted ul {
+		list-style: none;
+		margin: 0 0 var(--s2);
+		padding: 0;
+		max-height: 40vh;
+		overflow-y: auto;
+	}
+
+	.pasted li {
+		/* Indrykningen er hele pointen med visningen: den viser, hvad der bliver en
+		   underopgave, mens der stadig er en vej tilbage. */
+		padding: 2px 0 2px calc(var(--depth) * var(--s4));
+		font-size: var(--text-sm);
+		color: var(--ink);
+	}
+
+	.pasted li.done {
+		text-decoration: line-through;
+		color: var(--ink-muted);
+	}
+
+	.pasted .actions {
+		display: flex;
+		gap: var(--s2);
+		align-items: center;
+	}
+
+	.cancel {
+		border: none;
+		background: none;
+		padding: 0;
+		font: inherit;
+		color: var(--ink-muted);
+		cursor: pointer;
+	}
+	.cancel:hover {
+		text-decoration: underline;
+	}
+
 	/* Sits under the field it explains, in the same rhythm as a hint anywhere else. */
 	.syntax {
 		/* Nothing to click, and it floats over the first task in the list — which it
@@ -260,8 +440,16 @@
 		letter-spacing: normal;
 		padding: 0;
 		border: 0;
-		white-space: pre-wrap;
-		overflow-wrap: anywhere;
+		/* `pre`, not `pre-wrap`, and that is the whole alignment.
+		   
+		   An <input type="text"> is single-line by specification and cannot wrap
+		   whatever CSS says. So a wrapping mirror behind a non-wrapping input does
+		   not drift a little — it puts the tint on a second line that the input does
+		   not have, and the highlight ends up under empty space. Rare on a wide
+		   desktop field, constant in the dictate sheet on a 390px phone, where a
+		   spoken sentence overflows immediately. */
+		white-space: pre;
+		overflow-wrap: normal;
 	}
 
 	.mirror {
@@ -269,6 +457,10 @@
 		inset: 0;
 		pointer-events: none;
 		color: transparent;
+		/* Scrolled in step with the input by hand — see `syncScroll`. The overflow
+		   has to be hidden rather than visible, or the long tail of a line paints
+		   out past the field's edge. */
+		overflow: hidden;
 	}
 
 	/* The tint is behind the glyphs, not on them: colouring the text itself would

web/src/lib/components/Sidebar.svelte

@@ -73,6 +73,11 @@
 	// through the connector.
 	$effect(() => {
 		app.labelsChanged;
+		// Ikke i noter-udgaven: begge ruter findes slet ikke der, så de to kald var
+		// to 404'ere ved hver navigation — opslugt af .catch() og derfor usynlige.
+		// Fundet af vandringen i edition.spec.js, efter at porten havde været i
+		// drift i to merges.
+		if (app.notesOnly) return;
 		api.listFilters().then((r) => (filters = r.filters)).catch(() => {});
 		api.listLabels().then((r) => (labels = r.labels)).catch(() => {});
 	});
@@ -155,9 +160,12 @@
 	// entry is a question the sidebar keeps asking and answering "no".
 	let navItems = $derived(
 		[
-			{ key: 'today', href: '/', label: 'nav.today' },
-			{ key: 'upcoming', href: '/upcoming', label: 'nav.upcoming' },
-			app.projects.some((p) => p.shared)
+			// Opgavernes egne indgange findes ikke i noter-udgaven. Ikke gråtonet og
+			// ikke skjult med CSS — udeladt, fordi ruterne bag dem ikke er monteret
+			// på serveren. Et link til noget, der ikke findes, er ikke en skønhedsfejl.
+			app.notesOnly ? null : { key: 'today', href: '/', label: 'nav.today' },
+			app.notesOnly ? null : { key: 'upcoming', href: '/upcoming', label: 'nav.upcoming' },
+			!app.notesOnly && app.projects.some((p) => p.shared)
 				? { key: 'delegated', href: '/uddelegeret', label: 'nav.delegated' }
 				: null,
 			// No href: the inbox is a project and is drawn by projectRow, which knows
@@ -185,7 +193,7 @@
 			// Sidst i rækken, fordi `navOrder` føjer en ukendt nøgle til bagest: står
 			// den et andet sted her, ser en ny konto én rækkefølge og alle
 			// eksisterende en anden.
-			{ key: 'calendar', href: '/kalender', label: 'nav.calendar' }
+			app.notesOnly ? null : { key: 'calendar', href: '/kalender', label: 'nav.calendar' }
 		].filter(Boolean)
 	);
 
@@ -472,11 +480,15 @@
 
 <nav class="sidebar" aria-label={t('nav.main')}>
 	<div class="brand">
-		<!-- Verdande's mark: the rune Wunjo, which is the letter the Norn's name
-		     starts with in the elder futhark. One glyph, no wordmark beside it —
-		     the name is in the tab and everywhere else already. -->
-		<span class="rune" aria-hidden="true">ᚹ</span>
-		<span class="name">verdande</span>
+		<!-- The mark — ᚹ Wunjo for Verdande, ð for Urd. Not two runes, though it
+		     was meant to be: uruz is already another of this author's apps and
+		     carries that glyph. See web/static/urd-icon.svg.
+
+		     Both come from the store rather than from here, because the two editions
+		     of this program are two products with two names, and a wordmark is the
+		     one place a reader decides which one they are looking at. -->
+		<span class="rune" aria-hidden="true">{app.productMark}</span>
+		<span class="name">{app.productSlug}</span>
 	</div>
 
 	<div class="views">

web/src/lib/components/TaskDetail.svelte

@@ -14,7 +14,8 @@
 	import { app, projectName, clockOf } from '$lib/stores.svelte.js';
 	import { focusOnMount } from '$lib/focus.js';
 	import { t, tag } from '$lib/i18n.svelte.js';
-	import { REPEATS } from '$lib/when.js';
+	import { REPEATS, reminderOffsetLabel } from '$lib/when.js';
+	import { readList } from '$lib/pastelist.js';
 
 	let { task, onclose } = $props();
 
@@ -282,6 +283,73 @@
 
 	// --- sub-tasks ----------------------------------------------------------------
 
+	/**
+	 * En liste indsat i undertask-feltet bliver til undertasks under DEN her opgave.
+	 *
+	 * Det er den anden halvdel af "enten opgaver eller undertasks": hvor man
+	 * indsætter, afgør hvad linjerne bliver, uden at nogen skal vælge noget i en
+	 * menu. Indrykning i det indsatte giver stadig et niveau mere, så en liste med
+	 * punkter under punkter kommer ind som den stod.
+	 *
+	 * Som i quick-add vises den, før den oprettes — og af samme grund.
+	 */
+	let pastedSubtasks = $state([]);
+
+	function onPasteSubtasks(event) {
+		const pasted = event.clipboardData?.getData('text/plain') ?? '';
+		if (!pasted.includes('\n')) return;
+		const rows = readList(pasted);
+		if (rows.length < 2) return;
+		event.preventDefault();
+		pastedSubtasks = rows;
+	}
+
+	async function createPastedSubtasks() {
+		if (addingPasted) return;
+		addingPasted = true;
+
+		// Niveau nul hænger under den åbne opgave; dybere niveauer hænger under den
+		// seneste linje ovenfor, som i quick-add.
+		const parents = [task.id];
+		let made = 0;
+		for (const row of pastedSubtasks) {
+			const created = await app.quickAdd(row.text, task.project_id, undefined, parents[row.depth]);
+			if (!created) break;
+			parents[row.depth + 1] = created.id;
+			parents.length = row.depth + 2;
+			if (row.done) await app.complete(created.id);
+			// Kun dem, der hører direkte under den åbne opgave, står i listen her —
+			// resten hører under deres egen.
+			if (row.depth === 0) subtasks = [...subtasks, created];
+			made++;
+		}
+
+		addingPasted = false;
+		pastedSubtasks = pastedSubtasks.slice(made);
+		countSubtasks();
+	}
+
+	let addingPasted = $state(false);
+
+	/**
+	 * Rækkens tæller, når en undertask er kommet til eller er blevet lukket.
+	 *
+	 * Tallene bor på FORÆLDEREN og sendes med hver opgave, så listen kan sige
+	 * "1/4" uden at åbne noget. Serveren regner dem ud, når opgaverne hentes — den
+	 * sender ikke forælderen igen, fordi et barn blev lavet. Så uden det her stod
+	 * rækken bagved og sagde 1/2, mens ruden foran viste fire undertasks.
+	 *
+	 * Samme regel som resten af butikken: en lokal handling slår igennem med det
+	 * samme og bliver afstemt bagefter. Næste hentning henter serverens tal.
+	 */
+	function countSubtasks() {
+		app.upsert({
+			...task,
+			subtask_count: subtasks.length,
+			subtask_done: subtasks.filter((s) => s.completed).length
+		});
+	}
+
 	async function addSubtask(event) {
 		event.preventDefault();
 		const text = newSubtask.trim();
@@ -294,6 +362,7 @@
 				parent_id: task.id
 			});
 			subtasks = [...subtasks, created];
+			countSubtasks();
 		} catch (e) {
 			app.toast(humanMessage(e));
 		}
@@ -635,8 +704,31 @@
 			{/each}
 
 			<form onsubmit={addSubtask}>
-				<input bind:value={newSubtask} placeholder={t('detail.addSubtask')} aria-label={t('detail.newSubtask')} />
+				<input
+					bind:value={newSubtask}
+					onpaste={onPasteSubtasks}
+					placeholder={t('detail.addSubtask')}
+					aria-label={t('detail.newSubtask')}
+				/>
 			</form>
+
+			{#if pastedSubtasks.length}
+				<div class="pasted" role="group" aria-label={t('task.pastedTitle')}>
+					<ul>
+						{#each pastedSubtasks as row, i (i)}
+							<li style="--depth: {row.depth}" class:done={row.done}>{row.text}</li>
+						{/each}
+					</ul>
+					<div class="pasted-actions">
+						<button type="button" disabled={addingPasted} onclick={createPastedSubtasks}>
+							{t('task.pastedAdd', { n: String(pastedSubtasks.length) })}
+						</button>
+						<button type="button" class="plain" onclick={() => (pastedSubtasks = [])}>
+							{t('task.pastedCancel')}
+						</button>
+					</div>
+				</div>
+			{/if}
 		</section>
 
 		<section>
@@ -665,7 +757,9 @@
 
 			{#each reminders as reminder (reminder.id)}
 				<div class="reminder">
-					<span>{reminder.remind_at ? stamp(reminder.remind_at) : `${reminder.offset_min} min.`}</span>
+					<span>{reminder.remind_at
+							? stamp(reminder.remind_at)
+							: reminderOffsetLabel(reminder.offset_min)}</span>
 					{#if reminder.sent}<span class="sent">{t('detail.sent')}</span>{/if}
 					<button class="remove" onclick={() => removeReminder(reminder)} aria-label={t('detail.delete')}>
 						×
@@ -741,6 +835,43 @@
 </aside>
 
 <style>
+	/* Den indsatte liste, før den bliver til undertasks. Samme form som i
+	   quick-add — det er den samme beslutning, stillet samme sted i forløbet. */
+	.pasted {
+		margin-top: var(--s2);
+		border: 1px solid var(--line);
+		border-radius: var(--radius);
+		padding: var(--s2);
+	}
+	.pasted ul {
+		list-style: none;
+		margin: 0 0 var(--s2);
+		padding: 0;
+		max-height: 30vh;
+		overflow-y: auto;
+	}
+	.pasted li {
+		padding: 2px 0 2px calc(var(--depth) * var(--s4));
+		font-size: var(--text-sm);
+	}
+	.pasted li.done {
+		text-decoration: line-through;
+		color: var(--ink-muted);
+	}
+	.pasted-actions {
+		display: flex;
+		gap: var(--s2);
+		align-items: center;
+	}
+	.pasted-actions .plain {
+		border: none;
+		background: none;
+		padding: 0;
+		font: inherit;
+		color: var(--ink-muted);
+		cursor: pointer;
+	}
+
 	.linked-note {
 		display: block;
 		padding: var(--s2);

web/src/lib/locales/da.js

@@ -145,7 +145,7 @@ export const da = {
 	// læserens mulighed for at efterprøve det.
 	'beacon.noticeTitle': 'Denne installation melder, at den findes',
 	'beacon.noticeBody':
-		'Én gang i døgnet sender Verdande to værdier til projektet, så det kan ses, hvor mange installationer der er. Præcis de her to — intet andet, ingen IP bliver gemt, intet om hvad du bruger det til:',
+		'Én gang i døgnet sender {product} to værdier til projektet, så det kan ses, hvor mange installationer der er. Præcis de her to — intet andet, ingen IP bliver gemt, intet om hvad du bruger det til:',
 	'beacon.noticeTo': 'Sendes til {url}',
 	'beacon.noticeKeep': 'Behold den',
 	'beacon.noticeStop': 'Slå den fra',
@@ -237,6 +237,9 @@ export const da = {
 	'nav.offlineHint': 'Ændringer fra andre vises ikke lige nu',
 	'net.reconnecting': 'Genopretter forbindelse…',
 	'net.offline': 'Ingen forbindelse',
+	'net.downTitle': 'Ingen forbindelse',
+	'net.downBody': '{product} kan ikke nås herfra lige nu. Din tekst er ikke væk — den ligger på serveren, og den kommer igen, når forbindelsen gør.',
+	'net.downRetry': 'Prøv igen',
 	'nav.doItToday': 'Gør det i dag',
 
 	// --- the sidebar's own sections ------------------------------------------------
@@ -260,7 +263,17 @@ export const da = {
 
 	// --- a task in a list ----------------------------------------------------------
 	'task.add': 'Tilføj',
+	'task.pastedTitle': 'Indsat liste',
+	'task.pastedAdd': 'Opret {n} opgaver',
+	'task.pastedCancel': 'Fortryd',
 	'task.new': 'Ny opgave',
+	// Diktat, ikke tale: programmet laver ingen talegenkendelse, det stiller
+	// feltet frem, så tastaturets egen mikrofon kan bruges. Hjælpelinjen siger
+	// det, fordi en knap med en mikrofon på lover noget andet.
+	'task.alarmNeedsATime':
+		'Opgaven er oprettet. Alarmen er ikke — "en time før" skal have et klokkeslæt at regne tilbage fra.',
+	'task.speak': 'Tal en opgave ind',
+	'task.speakHint': 'Tryk mikrofonen på tastaturet, og sig hvad der skal gøres.',
 	'task.syntaxProject': 'projekt',
 	'task.syntaxSection': 'sektion',
 	'task.syntaxLabel': 'etiket',
@@ -347,7 +360,7 @@ export const da = {
 	'size.default': 'Standard',
 	'size.large': 'Stor',
 	'size.xl': 'Størst',
-	'look.verdande': 'Verdande',
+	'look.verdande': '{product}',
 	'look.verdandeNote': 'Som du kender den.',
 	'look.rolig': 'Rolig',
 	'look.roligNote': 'Serif, mere luft. Til at læse og skrive i.',
@@ -392,6 +405,18 @@ export const da = {
 	'account.recoveryLeftOne': '{n} gendannelseskode tilbage.',
 	'account.recoveryLeftMany': '{n} gendannelseskoder tilbage.',
 
+	// --- settings: alarm as standard -----------------------------------------------
+	'alarm.title': 'Alarm som standard',
+	'alarm.hint':
+		'Opgaver med bu00e5de en dato og et klokkeslu00e6t fu00e5r en alarm, uden at du beder om den. En opgave uden klokkeslu00e6t fu00e5r ingen — der er intet tidspunkt at ringe pu00e5. Skriv "ingen alarm" i linjen for at springe en enkelt over, eller "mind mig en time fu00f8r" for at give den sin egen.',
+	'alarm.on': 'Giv opgaver med et klokkeslu00e6t en alarm',
+	'alarm.when': 'Hvornu00e5r',
+	'alarm.atDue': 'Pu00e5 tidspunktet',
+	'alarm.minBefore': '{n} min. fu00f8r',
+	'alarm.hourBefore': '1 time fu00f8r',
+	'alarm.hoursBefore': '{n} timer fu00f8r',
+	'alarm.dayBefore': 'Dagen fu00f8r',
+
 	// --- settings: notifications ---------------------------------------------------
 	'push.title': 'Notifikationer på enheden',
 	'push.hint':
@@ -608,6 +633,8 @@ export const da = {
 	'data.importNotesHint': 'Én .md-fil pr. note; første linje bliver titlen. Billeder, der ligger ved siden af, følger med og bliver hængt på noten. Scriptet i tools/ henter dine Apple Noter ud.',
 	'data.notesImported': '{n} noter og {files} filer hentet ind.',
 	'data.exportNotes': 'Alle noter som Markdown-filer',
+	'data.exportAllCSV': 'Alle opgaver (CSV)',
+	'data.exportAllICS': 'Alle opgaver (kalender)',
 	'data.exportAccount': 'Hele kontoen som JSON',
 	'data.exportOne': 'Ét projekt',
 	'data.pickProject': 'Vælg et projekt',
@@ -749,6 +776,14 @@ export const da = {
 	'detail.newSubtask': 'Ny undertask',
 	'detail.files': 'Filer',
 	'detail.delete': 'Slet',
+	'detail.remindAtDue': 'På tidspunktet',
+	'detail.remindBefore': '{when} før',
+	'detail.remindAfter': '{when} efter',
+	'when.minuteMany': '{n} min.',
+	'when.hourOne': '1 time',
+	'when.hourMany': '{n} timer',
+	'when.dayOne': '1 dag',
+	'when.dayMany': '{n} dage',
 	'detail.reminders': 'Påmindelser',
 	'detail.newReminder': 'Ny påmindelse',
 	'detail.sent': 'sendt',

web/src/lib/locales/en.js

@@ -142,7 +142,7 @@ export const en = {
 	// the reader's ability to check it.
 	'beacon.noticeTitle': 'This installation reports that it exists',
 	'beacon.noticeBody':
-		'Once a day Verdande sends two values to the project, so it can see how many installations there are. Exactly these two — nothing else, no IP is stored, nothing about what you use it for:',
+		'Once a day {product} sends two values to the project, so it can see how many installations there are. Exactly these two — nothing else, no IP is stored, nothing about what you use it for:',
 	'beacon.noticeTo': 'Sent to {url}',
 	'beacon.noticeKeep': 'Keep it on',
 	'beacon.noticeStop': 'Turn it off',
@@ -234,6 +234,9 @@ export const en = {
 	'nav.offlineHint': 'Changes from other people are not showing right now',
 	'net.reconnecting': 'Reconnecting…',
 	'net.offline': 'No connection',
+	'net.downTitle': 'No connection',
+	'net.downBody': '{product} cannot be reached from here right now. Nothing you wrote is lost — it is on the server, and it comes back when the connection does.',
+	'net.downRetry': 'Try again',
 	'nav.doItToday': 'Do it today',
 
 	// --- the sidebar's own sections ------------------------------------------------
@@ -257,7 +260,14 @@ export const en = {
 
 	// --- a task in a list ----------------------------------------------------------
 	'task.add': 'Add',
+	'task.pastedTitle': 'Pasted list',
+	'task.pastedAdd': 'Add {n} tasks',
+	'task.pastedCancel': 'Cancel',
 	'task.new': 'New task',
+	'task.alarmNeedsATime':
+		'The task is created. The alarm is not — "an hour before" needs a time to count back from.',
+	'task.speak': 'Speak a task',
+	'task.speakHint': 'Tap the microphone on your keyboard and say what needs doing.',
 	'task.syntaxProject': 'project',
 	'task.syntaxSection': 'section',
 	'task.syntaxLabel': 'label',
@@ -344,7 +354,7 @@ export const en = {
 	'size.default': 'Default',
 	'size.large': 'Large',
 	'size.xl': 'Largest',
-	'look.verdande': 'Verdande',
+	'look.verdande': '{product}',
 	'look.verdandeNote': 'As you know it.',
 	'look.rolig': 'Calm',
 	'look.roligNote': 'Serif, more air. For reading and writing.',
@@ -389,6 +399,18 @@ export const en = {
 	'account.recoveryLeftOne': '{n} recovery code left.',
 	'account.recoveryLeftMany': '{n} recovery codes left.',
 
+	// --- settings: alarm as standard -----------------------------------------------
+	'alarm.title': 'Alarms by default',
+	'alarm.hint':
+		'Tasks with both a date and a time get an alarm without being asked. A task with no time gets none — there is no moment to ring at. Write "no alarm" in the line to skip a single one, or "remind me an hour before" to give it its own.',
+	'alarm.on': 'Give tasks with a time an alarm',
+	'alarm.when': 'When',
+	'alarm.atDue': 'At the time',
+	'alarm.minBefore': '{n} min before',
+	'alarm.hourBefore': '1 hour before',
+	'alarm.hoursBefore': '{n} hours before',
+	'alarm.dayBefore': 'The day before',
+
 	// --- settings: notifications ---------------------------------------------------
 	'push.title': 'Notifications on this device',
 	'push.hint':
@@ -604,6 +626,8 @@ export const en = {
 	'data.importNotesHint': 'One .md file per note; the first line becomes the title. Pictures beside the files come with them and are attached to the note. The script in tools/ gets your Apple Notes out.',
 	'data.notesImported': '{n} notes and {files} files brought in.',
 	'data.exportNotes': 'Every note as Markdown files',
+	'data.exportAllCSV': 'All tasks (CSV)',
+	'data.exportAllICS': 'All tasks (calendar)',
 	'data.exportAccount': 'The whole account as JSON',
 	'data.exportOne': 'One project',
 	'data.pickProject': 'Pick a project',
@@ -746,6 +770,14 @@ export const en = {
 	'detail.newSubtask': 'New sub-task',
 	'detail.files': 'Files',
 	'detail.delete': 'Delete',
+	'detail.remindAtDue': 'At the time',
+	'detail.remindBefore': '{when} before',
+	'detail.remindAfter': '{when} after',
+	'when.minuteMany': '{n} min',
+	'when.hourOne': '1 hour',
+	'when.hourMany': '{n} hours',
+	'when.dayOne': '1 day',
+	'when.dayMany': '{n} days',
 	'detail.reminders': 'Reminders',
 	'detail.newReminder': 'New reminder',
 	'detail.sent': 'sent',

web/src/lib/pastelist.js

@@ -0,0 +1,64 @@
+/**
+ * En indsat liste, læst som opgaver og underopgaver.
+ *
+ * Quick-add er ét felt på én linje, og en browser smider linjeskiftene væk, når
+ * man indsætter i et `<input>` — så en kopieret liste blev til én opgave med det
+ * hele mast sammen. Det her er den anden halvdel: hvad linjerne betyder.
+ *
+ * Indrykning bærer niveauet, samme regel som punktlisterne i noterne. Bredden
+ * læses af teksten selv frem for at være gættet til to eller fire: en liste fra
+ * Apple Noter rykker ind med ét antal mellemrum, en fra et Markdown-dokument med
+ * et andet, og begge dele skal give ét niveau. En stak over de indrykninger, der
+ * faktisk er set, klarer begge uden at kende tallet på forhånd.
+ *
+ * Mærkerne — `-`, `*`, `+`, `1.`, `1)` — fjernes, fordi de er listens notation og
+ * ikke en del af opgaven. En afkrydsningsboks er derimod indhold: `- [x]` siger,
+ * at punktet var gjort, og en halvt afkrydset liste, der kommer ind som lutter
+ * uløste opgaver, har tabt det, man indsatte den for.
+ *
+ * Teksten selv røres ikke ud over det. Datoer, `#projekt` og `@etiket` læses af
+ * quickadd på serveren, præcis som når linjen var skrevet i hånden — ét sted at
+ * forstå en opgavelinje, ikke to.
+ */
+
+/** `- `, `* `, `+ `, `1. `, `1) ` — listens egen notation, ikke opgavens navn. */
+const MARKER = /^(?:[-*+]|\d+[.)])\s+/;
+/** `[ ]`, `[x]`, `[X]` — står efter mærket, når der er et. */
+const BOX = /^\[([ xX])\]\s*/;
+
+/** Hvor bredt et stykke indrykning er, med en tabulator som to mellemrum. */
+function width(indent) {
+	return indent.replace(/\t/g, '  ').length;
+}
+
+export function readList(text) {
+	const out = [];
+	// De indrykningsbredder, der står åbne lige nu — én pr. niveau.
+	const levels = [];
+
+	for (const raw of (text ?? '').split(/\r?\n/)) {
+		const indent = /^[ \t]*/.exec(raw)[0];
+		let rest = raw.slice(indent.length).trim();
+		// En tom linje er et mellemrum i den, man kopierede, ikke et punkt. Den
+		// nulstiller ikke niveauet: en liste med luft mellem punkterne er én liste.
+		if (!rest) continue;
+
+		rest = rest.replace(MARKER, '');
+		let done = false;
+		const box = BOX.exec(rest);
+		if (box) {
+			done = box[1] !== ' ';
+			rest = rest.slice(box[0].length);
+		}
+		rest = rest.trim();
+		if (!rest) continue;
+
+		const w = width(indent);
+		while (levels.length && w < levels[levels.length - 1]) levels.pop();
+		if (!levels.length || w > levels[levels.length - 1]) levels.push(w);
+
+		out.push({ depth: levels.length - 1, text: rest, done });
+	}
+
+	return out;
+}

web/src/lib/richtext.js

@@ -314,6 +314,41 @@ const BLOCK_TAGS = /^(P|H[1-6]|UL|OL|LI|PRE|BLOCKQUOTE|DIV)$/;
 /** Whether an element holds blocks, in which case reading it as one line loses them. */
 const holdsBlocks = (el) => [...el.children].some((c) => BLOCK_TAGS.test(c.tagName));
 
+/**
+ * Teksten i et blok, med linjeskiftene i behold.
+ *
+ * `textContent` er ikke nok, og det er ikke en detalje: et <br> har den tomme
+ * streng som textContent, og <br> er præcis det, browseren lægger ind, når man
+ * trykker shift+retur i en blok. Blokken blev derfor skrevet ned som én linje —
+ * "first linesecond line" — så man kunne skrive flere linjer og ikke gemme dem.
+ * Det er usynligt indtil en genindlæsning, for på skærmen står de rigtigt hele
+ * tiden.
+ *
+ * Kopiér-knappen springes over. Den ligger inde i <pre> for at kunne sidde i
+ * hjørnet af den, og ellers stod ordet "Kopiér" i hver eneste kodeblok efter hver
+ * gemning.
+ *
+ * Rekursivt, fordi indholdet ligger i et <code> inde i blokken: en filtrering over
+ * <pre>'ens egne børn ser kun det ene element og spørger det om en textContent,
+ * der allerede har tabt linjeskiftet.
+ */
+export function blockText(node) {
+	let out = '';
+	for (const n of node.childNodes) {
+		if (n.nodeType !== Node.ELEMENT_NODE) {
+			out += n.textContent ?? '';
+			continue;
+		}
+		if (n.classList?.contains('copy')) continue;
+		if (n.tagName === 'BR') {
+			out += '\n';
+			continue;
+		}
+		out += blockText(n);
+	}
+	return out;
+}
+
 export function htmlToMarkdown(root) {
 	const lines = [];
 
@@ -366,14 +401,7 @@ export function htmlToMarkdown(root) {
 					// else and an indent does not.
 					const lang = child.getAttribute('data-lang') ?? '';
 					emit('```' + lang);
-					// Knapper og andet, editoren har lagt oven på blokken, hører ikke til
-					// i filen. Kopiér-knappen ligger inde i <pre> for at kunne placeres i
-					// hjørnet af den, og `textContent` ville ellers skrive ordet "Kopiér"
-					// ind i hver eneste kodeblok, hver gang noten blev gemt.
-					const code = [...child.childNodes]
-						.filter((n) => n.nodeType !== Node.ELEMENT_NODE || !n.classList?.contains('copy'))
-						.map((n) => n.textContent ?? '')
-						.join('');
+					const code = blockText(child);
 					for (const l of code.replace(/\n$/, '').split('\n')) {
 						emit(l);
 					}
@@ -408,6 +436,14 @@ export function htmlToMarkdown(root) {
 		const pad = '  '.repeat(depth);
 
 		for (const li of el.children) {
+			// En underliste, der ligger som SØSKENDE til punktet frem for inde i det.
+			// Browserne er uenige om, hvilken af de to former en indrykning laver, og
+			// de to ser ens ud på skærmen — men den her løkke sprang søskendeformen
+			// over uden lyd, så et indrykket punkt ville forsvinde ved gemningen.
+			if (li.tagName === 'UL' || li.tagName === 'OL') {
+				list(li, depth + 1, emit);
+				continue;
+			}
 			if (li.tagName !== 'LI') continue;
 
 			// Punktets egen tekst er alt undtagen de lister, der ligger under det.

web/src/lib/settingsindex.js

@@ -38,6 +38,7 @@ export const SETTINGS = [
 	// Notifikationer
 	{ path: '/indstillinger/notifikationer', anchor: 'dagens-plan', key: 'ai.plan', tab: 'settings.tab.notifications', words: 'plan morgen daily' },
 	{ path: '/indstillinger/notifikationer', anchor: 'push', key: 'push.title', tab: 'settings.tab.notifications', words: 'push besked notification badge' },
+	{ path: '/indstillinger/notifikationer', anchor: 'standard-alarm', key: 'alarm.title', tab: 'settings.tab.notifications', words: 'alarm pu00e5mindelse standard reminder default klokkeslu00e6t' },
 	{ path: '/indstillinger/notifikationer', anchor: 'seneste', key: 'push.recent', tab: 'settings.tab.notifications', words: 'log historik' },
 	{ path: '/indstillinger/notifikationer', anchor: 'version', key: 'push.version', tab: 'settings.tab.notifications', words: 'opdatering update version', admin: true },
 

web/src/lib/stores.svelte.js

@@ -29,6 +29,140 @@ class AppState {
 	people = $state([]);
 	tasks = $state([]);
 	loading = $state(true);
+
+	/**
+	 * True when the boot never reached the server — as opposed to reaching it and
+	 * being told the session is gone.
+	 *
+	 * The two are indistinguishable from `user === null`, and they are opposite
+	 * things to the person looking at the screen: one means "log ind", the other
+	 * means "der er intet at logge ind på herfra, og et kodeord hjælper ikke". A
+	 * total outage used to show the login screen, so the app blamed the user's
+	 * session for the network being down — and a login page that cannot possibly
+	 * work is worse than an error, because it looks like it might.
+	 */
+	unreachable = $state(false);
+
+	/**
+	 * Hvilken udgave af programmet den her instans er.
+	 *
+	 * `full` er opgaver, projekter og noter sammen. `notes` er notehalvdelen, hvor
+	 * opgaveruterne slet ikke er monteret på serveren — så fladen må ikke tilbyde
+	 * en vej til dem. Et link til en rute, der ikke findes, er ikke en skønhedsfejl:
+	 * det er en knap, der fører et sted hen, hvor der ikke er noget.
+	 *
+	 * Instansens form, ikke personens rettigheder. Derfor hentes den ved siden af
+	 * kontoen frem for efter den: den skal også være kendt, når ingen er logget ind.
+	 *
+	 * `full` som udgangspunkt, fordi det er det, programmet altid har været — en
+	 * instans, der ikke når at svare, skal ikke pludselig se ud som et andet
+	 * program.
+	 */
+	edition = $state('full');
+
+	get notesOnly() {
+		return this.edition === 'notes';
+	}
+
+	/**
+	 * Hvilken dør dette vindue kom ind ad.
+	 *
+	 * HOLDT ADSKILT FRA `notesOnly` med vilje, og det er den vigtigste linje i
+	 * filen her. De to ligner hinanden og betyder ikke det samme:
+	 *
+	 *   notesOnly — serveren HAR ingen opgaveruter. En vagt: fladen må ikke hente
+	 *               dem, for de svarer 404.
+	 *   urdFace   — personen kom ind ad urd-døren. En præference: ruterne er der,
+	 *               dataene er deres egne, og der er intet at holde tilbage.
+	 *
+	 * Slås de sammen, begynder urd-ansigtet at skjule data frem for pynt — en
+	 * notesbog ville holde op med at vise sine opgaver, selvom de ligger i samme
+	 * database og personen bare valgte en anden indgang.
+	 *
+	 * Læst fra sessionStorage frem for localStorage, fordi de to apps deler origin
+	 * og dermed deler localStorage. sessionStorage er per vindue, og en installeret
+	 * PWA er sit eget vindue.
+	 */
+	urdFace = $state(false);
+
+	enterUrd() {
+		this.setDoor('urd');
+	}
+
+	leaveUrd() {
+		this.setDoor('verdande');
+	}
+
+	/**
+	 * Hvilken dør dette vindue sidst kom ind ad.
+	 *
+	 * Symmetrisk med vilje: `/` er også en dør. Uden den halvdel bliver en fane,
+	 * der ÉN gang har set /urd, ved med at hedde urd — også på opgavesiderne, også
+	 * efter et link til forsiden. I den installerede app sker det aldrig, for dens
+	 * start_url er /urd og den anden apps er /; i en browserfane sker det hele
+	 * tiden.
+	 */
+	setDoor(door) {
+		this.urdFace = door === 'urd';
+		try {
+			sessionStorage.setItem('verdande:door', door);
+		} catch (e) {
+			// Privat browsing kan nægte. Ansigtet holder så vinduet ud alligevel,
+			// fordi det står i $state ovenfor — det er kun genindlæsningen, der
+			// mister det.
+		}
+	}
+
+	/**
+	 * Navnet instansen kalder sig selv — `Urd` i en sætning, `urd` i et mærke.
+	 *
+	 * To udgaver af ét program, to navne. Grunden til at det læses fra udgaven
+	 * frem for at stå skrevet i teksterne: for den der bruger en instans uden
+	 * opgaveruter er det et andet produkt, og et produkt, der kalder sig sin
+	 * søsters navn, er ikke et produkt — det er et flag, nogen har sat.
+	 *
+	 * Vinduets titel og manifestet står der IKKE. De læses af browseren, før
+	 * noget JavaScript kører, så serveren skriver dem om på vejen ud
+	 * (`internal/httpapi/shell.go`). Gjorde vi det her, ville hver indlæsning
+	 * vise søsterens navn et øjeblik og så rette sig selv.
+	 */
+	/**
+	 * Om DETTE vindue viser urd — enten fordi instansen ikke har opgaveruter, eller
+	 * fordi personen kom ind ad urd-døren.
+	 *
+	 * De to grunde er forskellige og må ikke slås sammen andre steder end her: det
+	 * her er navnet og mærket, altså pynt. `notesOnly` alene er vagten, der afgør,
+	 * om der overhovedet er en rute at hente fra.
+	 */
+	get showsUrd() {
+		return this.notesOnly || this.urdFace;
+	}
+
+	get productName() {
+		return this.showsUrd ? 'Urd' : 'Verdande';
+	}
+
+	get productSlug() {
+		return this.showsUrd ? 'urd' : 'verdande';
+	}
+
+	/**
+	 * Mærket: ᚹ wunjo for Verdande, ð for Urd.
+	 *
+	 * Ikke to runer, selvom det var meningen. Urds oplagte mærke var ᚢ uruz,
+	 * bogstavet navnet begynder med i den ældre futhark, præcis som Verdandes er
+	 * wunjo — og det blev tegnet sådan først. Men uruz er allerede et af husets
+	 * egne produkter, og dets `gen-icons.ts` tegner samme glyf i guld. To af samme
+	 * persons apps side om side på en hjemmeskærm, hvilket er nøjagtig det sted,
+	 * mærket skal kunne skelnes. ᚦ thurisaz blev forkastet et niveau nede af samme
+	 * grund: en stav med en trekant til højre, og det er ᚹ også.
+	 *
+	 * Så bogstavet frem for runen. Hele historien står i web/static/urd-icon.svg.
+	 */
+	get productMark() {
+		return this.showsUrd ? 'ð' : '\u16B9';
+	}
+
 	/** Transient messages: a failed save, a rolled-back change. */
 	toasts = $state([]);
 	connected = $state(false);
@@ -94,8 +228,29 @@ class AppState {
 
 	async load() {
 		this.loading = true;
+
+		// Døren, hvis dette vindue allerede er gået gennem den. Genindlæser nogen på
+		// /noter inde i urd-appen, kommer de ikke forbi /urd igen, og uden den her
+		// linje ville ansigtet falde af ved hvert F5.
+		try {
+			if (sessionStorage.getItem('verdande:door') === 'urd') this.urdFace = true;
+		} catch (e) {
+			// Privat browsing nægter. Så holder ansigtet vinduet ud og ikke længere.
+		}
+
+		// Formen hentes for sig, og en fejl på den tier. En 401 fra `me` må ikke
+		// tage udgaven med sig — login-skærmen er også en flade i en udgave — og
+		// en instans, der slet ikke svarer, melder `me` ordentligt nedenfor.
+		const shape = api
+			.setupState()
+			.then((state) => {
+				if (state?.edition) this.edition = state.edition;
+			})
+			.catch(() => {});
+
 		try {
 			this.user = await api.me();
+			this.unreachable = false;
 			// The interface's language follows the account, so it is set the moment
 			// the session is known — before anything has drawn a string.
 			i18n.set(this.user.locale);
@@ -111,7 +266,15 @@ class AppState {
 			this.loadNotifications();
 		} catch (e) {
 			this.user = null;
+			// `offline` is the one code the request layer makes up itself: it is what
+			// is thrown when the retry window ran out without any status ever
+			// arriving. A 401 is the server answering, and that is a real sign-out.
+			this.unreachable = e?.code === 'offline';
 		} finally {
+			// Afventet her, så fladen aldrig tegnes, før den ved hvilket program den
+			// er. Tegnet først og rettet bagefter ville vise opgaver i et sekund på
+			// en instans, der ikke har nogen.
+			await shape;
 			this.loading = false;
 		}
 	}
@@ -259,6 +422,21 @@ class AppState {
 	 * `completed: 'exclude'`.
 	 */
 	async loadTasks(params) {
+		// Noter-udgaven har ingen opgaveruter, så den her ville kaste en 404 — og
+		// kalderne samler den i et Promise.all, hvor én fejl tager hele siden med.
+		// Vagten står HER frem for ved de tre kaldesteder, fordi butikken er det
+		// ene sted, der kender udgaven: en vagt pr. kalder er tre steder at glemme
+		// den fjerde, og det var præcis sådan den her slap igennem.
+		if (this.notesOnly) {
+			// Skrevet kun hvis der ER noget at rydde. En ubetinget tilskrivning
+			// looper: projektsiden har en effekt, der læser app.tasks og kalder
+			// herind, så et skriv ved hvert kald er en uendelig runde —
+			// effect_update_depth_exceeded, ikke en 404. Før vagten kastede kaldet
+			// på 404'eren og nåede aldrig at skrive, så løkken var skjult bag en
+			// fejl.
+			if (this.tasks.length) this.tasks = [];
+			return this.tasks;
+		}
 		const { tasks } = await api.listTasks({
 			completed: completedView.shown ? 'include' : undefined,
 			...params
@@ -505,10 +683,14 @@ class AppState {
 	 * request is fast and the box clears immediately, which is where the
 	 * responsiveness actually needs to be.
 	 */
-	async quickAdd(text, projectId) {
+	async quickAdd(text, projectId, sectionId, parentId) {
 		try {
-			const task = await api.quickAdd(text, projectId);
+			const task = await api.quickAdd(text, projectId, sectionId, parentId);
 			this.upsert(task);
+			// Sagt højt frem for tabt. En alarm, der ikke kunne sættes, er den eneste
+			// slags påmindelse, hvis fejl intet bagefter afslører — der står ingen
+			// række at savne, og man opdager den først, da den ikke ringede.
+			if (task?.reminder_not_set) this.toast(t('task.alarmNeedsATime'));
 			return task;
 		} catch (e) {
 			this.toast(humanMessage(e));

web/src/lib/when.js

@@ -184,3 +184,37 @@ function every(interval, unit) {
 	if (interval === 2) return t(`repeat.everyOther.${unit}`);
 	return t(`repeat.everyN.${unit}`, { n: interval });
 }
+
+/**
+ * En påmindelses forskydning, skrevet som ord.
+ *
+ * Lageret LÆGGER tallet til forfaldstiden (`due_datetime + offset_min * 60`), så
+ * en alarm før er negativ. Rå blev det vist som "-60 min.": et fortegn, læseren
+ * selv skal oversætte, på netop den oplysning man skal kunne stole på uden at
+ * regne — og en alarm, man har misforstået, opdager man først, da den ringede på
+ * det forkerte tidspunkt.
+ *
+ * Retningen er skilt fra varigheden, så der kun er ét sæt enheder at vedligeholde.
+ * En positiv forskydning kan ikke laves hverken i hurtig tilføjelse eller i
+ * skærmbilledet — kun gennem API'et — men den har et ord her frem for at falde
+ * tilbage på et tal, for det er den slags gren, der står urørt indtil den en dag
+ * ikke gør.
+ */
+export function reminderOffsetLabel(minutes) {
+	if (minutes === 0) return t('detail.remindAtDue');
+	const span = durationLabel(Math.abs(minutes));
+	return minutes < 0 ? t('detail.remindBefore', { when: span }) : t('detail.remindAfter', { when: span });
+}
+
+/** Minutter som hele dage, hele timer eller minutter — den største, der går op. */
+function durationLabel(minutes) {
+	if (minutes % 1440 === 0) {
+		const days = minutes / 1440;
+		return days === 1 ? t('when.dayOne') : t('when.dayMany', { n: days });
+	}
+	if (minutes % 60 === 0) {
+		const hours = minutes / 60;
+		return hours === 1 ? t('when.hourOne') : t('when.hourMany', { n: hours });
+	}
+	return t('when.minuteMany', { n: minutes });
+}

web/src/routes/+layout.svelte

@@ -6,8 +6,10 @@
 	import { goto } from '$app/navigation';
 	import { page } from '$app/stores';
 	import Sidebar from '$lib/components/Sidebar.svelte';
+	import DictateSheet from '$lib/components/DictateSheet.svelte';
 	import CommandPalette from '$lib/components/CommandPalette.svelte';
 	import SignIn from '$lib/components/SignIn.svelte';
+	import NoConnection from '$lib/components/NoConnection.svelte';
 	import TaskDetail from '$lib/components/TaskDetail.svelte';
 	import { t } from '$lib/i18n.svelte.js';
 	import { setBadge } from '$lib/badge.js';
@@ -56,6 +58,58 @@
 		app.load();
 	});
 
+	/**
+	 * Hvilken dør dette vindue er inde ad.
+	 *
+	 * To døre, og reglen er én sætning: den, du sidst kom ind ad, bestemmer
+	 * ansigtet. `/urd` sætter urd, `/` sætter verdande, og alt derimellem rører
+	 * det ikke — så et klik videre til en note eller en opgave beholder det navn,
+	 * vinduet åbnede med.
+	 *
+	 * Symmetrien er det, der gør det forudsigeligt. Uden `/`-halvdelen ville en
+	 * fane, der én gang havde set /urd, blive ved med at hedde urd, også på
+	 * opgavesiderne. I de installerede apps sker det aldrig — deres start_url er
+	 * hver sin dør — men en browserfane springer mellem dem hele tiden.
+	 */
+	$effect(() => {
+		const here = $page.url.pathname;
+		if (here === '/urd') app.enterUrd();
+		else if (here === '/') app.leaveUrd();
+	});
+
+	/**
+	 * Opgavernes sider findes ikke i noter-udgaven.
+	 *
+	 * Ét sted frem for en vagt i hver rute: listen ER beslutningen, og en vagt pr.
+	 * fil er syv steder at glemme den ottende. Skrevet som præfikser, fordi
+	 * `/opgave/<id>` og `/filter/<id>` er sider under dem.
+	 *
+	 * Sendt til noterne og ikke til en fejlside: der er ikke sket noget forkert.
+	 * Adressen hører bare til et andet program end det, der kører her — og nogen,
+	 * der har gemt et link fra en fuld instans, skal lande et sted, der giver
+	 * mening frem for i en blindgyde.
+	 *
+	 * `replaceState`, så Tilbage ikke fører hen til den side, man lige blev sendt
+	 * væk fra, og derfra tilbage igen.
+	 */
+	const TASK_PAGES = [
+		'/',
+		'/upcoming',
+		'/uddelegeret',
+		'/kalender',
+		'/faerdige',
+		'/opgave',
+		'/filter',
+		'/etiket'
+	];
+
+	$effect(() => {
+		if (!app.notesOnly) return;
+		const here = $page.url.pathname;
+		const taskPage = TASK_PAGES.some((p) => here === p || (p !== '/' && here.startsWith(p + '/')));
+		if (taskPage) goto('/noter', { replaceState: true });
+	});
+
 	/**
 	 * Links ud af programmet, åbnet i den browser, maskinen er sat op til.
 	 *
@@ -129,8 +183,20 @@
 		// Folding the sidebar had a button and nothing else, and a rectangle with a
 		// line down it is not a word: somebody who wanted the menu out of the way
 		// asked for the feature that was already there. ⌘B is where an editor puts
-		// it. Works while typing as well — it moves nothing in the field.
-		if ((event.metaKey || event.ctrlKey) && (event.key === 'b' || event.key === 'B')) {
+		// it.
+		//
+		// Men ikke i en rig editor. Her stod der "works while typing as well — it
+		// moves nothing in the field", og det passer for et <input>, hvor ⌘B ikke
+		// gør noget. I en contenteditable ER ⌘B fed tekst, og `preventDefault()`
+		// nedenfor stoppede browseren i at gøre den — så i noterne foldede
+		// sidebjælken sig i stedet for at gøre ordet fedt. Feltet, markøren står i,
+		// har førsteret til en tast, det selv bruger.
+		const writing = el?.isContentEditable || el?.closest?.('[contenteditable="true"]');
+		if (
+			(event.metaKey || event.ctrlKey) &&
+			(event.key === 'b' || event.key === 'B') &&
+			!writing
+		) {
 			event.preventDefault();
 			sidebar.toggle();
 			return;
@@ -166,6 +232,10 @@
 	<div class="booting"></div>
 {:else if standalone}
 	{@render children()}
+{:else if app.unreachable}
+	<!-- Ikke login-skærmen: en total udfald er ikke en udløbet session, og et
+	     kodeord hjælper ikke mod en manglende forbindelse. -->
+	<NoConnection />
 {:else if !app.user}
 	<SignIn />
 {:else}
@@ -245,6 +315,15 @@
 				tabindex="-1"
 			></button>
 		{/if}
+
+		<!-- Tal en opgave ind. Kun på telefonen, og kun hvor der er opgaver — se
+		     komponenten.
+
+		     UBETINGET monteret, og det er ikke en forglemmelse: feltet inde i den
+		     skal kunne få fokus i samme hug som klikket, ellers åbner iOS ikke
+		     tastaturet. Et `{#if}` her ville tage feltet ud af DOM'en og gøre det
+		     umuligt. Menuen dækker den i stedet, fordi den har højere z-index. -->
+		<DictateSheet />
 	</div>
 
 	<CommandPalette bind:open={paletteOpen} />

web/src/routes/faerdige/+page.svelte

@@ -75,7 +75,7 @@
 	}
 </script>
 
-<svelte:head><title>{t('done.title')} — verdande</title></svelte:head>
+<svelte:head><title>{t('done.title')} — {app.productSlug}</title></svelte:head>
 
 <div class="view">
 	<header>

web/src/routes/gruppe/[id]/+page.svelte

@@ -126,7 +126,7 @@
 	}
 </script>
 
-<svelte:head><title>{group?.name ?? t('group.projects')} — verdande</title></svelte:head>
+<svelte:head><title>{group?.name ?? t('group.projects')} — {app.productSlug}</title></svelte:head>
 
 <div class="view">
 	{#if status === 'denied'}

web/src/routes/indstillinger/+page.svelte

@@ -379,7 +379,10 @@
 					<!-- Each card is written in the face it selects, because that is the
 					     only part of the choice a name cannot carry. -->
 					<span class="look-sample" data-look={option.id} aria-hidden="true">Aa</span>
-					<span class="theme-name">{t(option.name)}</span>
+					<!-- The product name is passed to every look, and only one of them has a
+					     place for it: the look named after the program. The other three
+					     carry no placeholder, so the parameter is ignored. -->
+					<span class="theme-name">{t(option.name, { product: app.productName })}</span>
 					<span class="theme-note">{t(option.note)}</span>
 				</button>
 			{/each}

web/src/routes/indstillinger/data/+page.svelte

@@ -141,6 +141,13 @@
 	let startDate = $state('');
 
 	$effect(() => {
+		// Skabeloner er projekt plus sektioner plus opgaver, så ruten findes ikke i
+		// noter-udgaven — og den her fangede fejlen i en toast, altså en synlig
+		// fejlbesked på indstillingssiden frem for en tom liste.
+		if (app.notesOnly) {
+			loadingTemplates = false;
+			return;
+		}
 		api
 			.listTemplates()
 			.then((r) => (templates = r.templates))
@@ -393,6 +400,8 @@
 		     do with a Content-Disposition, and the session cookie rides along. -->
 		<a class="link" href={api.exportAccountURL()} download>{t('data.exportAccount')}</a>
 		<a class="link" href={api.exportNotesURL()} download>{t('data.exportNotes')}</a>
+		<a class="link" href={api.exportAllCSVURL()} download>{t('data.exportAllCSV')}</a>
+		<a class="link" href={api.exportAllICSURL()} download>{t('data.exportAllICS')}</a>
 	</div>
 
 	<!-- The way back in, and from anywhere else: a folder of Markdown is what
@@ -410,6 +419,8 @@
 		<p class="hint">{t('data.importNotesHint')}</p>
 	</div>
 
+	<!-- Vælgeren bliver stående ved siden af "alle": den er stadig vejen til ét
+	     projekt, og det er en anden opgave end at flytte hele kontoen. -->
 	<div class="field">
 		<label for="export-project">{t('data.exportOne')}</label>
 		<select id="export-project" bind:value={exportProject}>

web/src/routes/indstillinger/integrationer/+page.svelte

@@ -296,7 +296,11 @@
 	let mailConfigured = $state(null);
 
 	$effect(() => {
-		api.feed().then((r) => (feedURL = r.url)).catch(() => {});
+		// Feedet er en kalender af opgaver, så adressen findes ikke i
+		// noter-udgaven.
+		if (!app.notesOnly) {
+			api.feed().then((r) => (feedURL = r.url)).catch(() => {});
+		}
 		api
 			.getMailAddress()
 			.then((r) => {

web/src/routes/indstillinger/notifikationer/+page.svelte

@@ -5,6 +5,39 @@
 	import * as push from '$lib/push.js';
 	import { t, plural } from '$lib/i18n.svelte.js';
 
+	// --- alarm som standard -------------------------------------------------------
+
+	// Minutter i forhold til forfaldstiden, negativt for fu00f8r. Samme fortegn som
+	// reminders.offset_min, fordi det er den kolonne, vu00e6rdien ender i — to
+	// fortegnsregler for det samme begreb viser sig kun som en alarm pu00e5 et forkert
+	// tidspunkt.
+	const ALARM_CHOICES = [0, -5, -10, -15, -30, -60, -120, -1440];
+
+	// Valgt, nu00e5r indstillingen slu00e5s til igen. Pu00e5 tidspunktet er sju00e6ldent det, man
+	// mener med en alarm: der er ingen varsel i at blive mindet om noget, mens det
+	// sker.
+	const ALARM_DEFAULT = -10;
+
+	function alarmLabel(minutes) {
+		if (minutes === 0) return t('alarm.atDue');
+		const n = Math.abs(minutes);
+		if (n === 1440) return t('alarm.dayBefore');
+		if (n === 60) return t('alarm.hourBefore');
+		if (n % 60 === 0) return t('alarm.hoursBefore', { n: n / 60 });
+		return t('alarm.minBefore', { n });
+	}
+
+	async function saveAlarm(minutes) {
+		try {
+			await api.setDefaultReminder(minutes);
+			// Kontoen genlu00e6ses frem for at blive gu00e6ttet lokalt: serveren er den, der
+			// afviser et positivt tal, su00e5 det, der vises, skal vu00e6re det, der blev gemt.
+			app.user = await api.me();
+		} catch (e) {
+			app.toast(humanMessage(e));
+		}
+	}
+
 	// --- web push ----------------------------------------------------------------
 
 	let pushState = $state('loading');
@@ -92,6 +125,8 @@
 	let planBusy = $state(false);
 
 	$effect(() => {
+		// Dagens plan er dagens opgaver.
+		if (app.notesOnly) return;
 		api
 			.planSettings()
 			.then((p) => (plan = p))
@@ -252,6 +287,37 @@
 	{/if}
 </section>
 
+<section class="panel" id="standard-alarm">
+	<header>
+		<h2>{t('alarm.title')}</h2>
+		<p class="hint">{t('alarm.hint')}</p>
+	</header>
+
+	<label class="check">
+		<input
+			type="checkbox"
+			checked={app.user?.default_reminder_min != null}
+			onchange={(e) => saveAlarm(e.currentTarget.checked ? ALARM_DEFAULT : null)}
+		/>
+		<span>{t('alarm.on')}</span>
+	</label>
+
+	{#if app.user?.default_reminder_min != null}
+		<div class="field">
+			<label for="alarmwhen">{t('alarm.when')}</label>
+			<select
+				id="alarmwhen"
+				value={app.user.default_reminder_min}
+				onchange={(e) => saveAlarm(Number(e.currentTarget.value))}
+			>
+				{#each ALARM_CHOICES as minutes (minutes)}
+					<option value={minutes}>{alarmLabel(minutes)}</option>
+				{/each}
+			</select>
+		</div>
+	{/if}
+</section>
+
 <section class="panel" id="push">
 	<header>
 		<h2>{t('push.title')}</h2>

web/src/routes/invite/+page.svelte

@@ -12,8 +12,12 @@
 	 * and it reads the token out of the URL itself.
 	 */
 	import SignIn from '$lib/components/SignIn.svelte';
+	// Udgavens navn i titlen. Siden her tegner først, når layoutets `app.load()`
+	// har svaret, så udgaven er kendt — også uden en session, hvilket er hele
+	// pointen med den her rute.
+	import { app } from '$lib/stores.svelte.js';
 </script>
 
-<svelte:head><title>Invitation · verdande</title></svelte:head>
+<svelte:head><title>Invitation · {app.productSlug}</title></svelte:head>
 
 <SignIn />

web/src/routes/noter/+page.svelte

@@ -14,8 +14,8 @@
 	import { api, humanMessage } from '$lib/api.js';
 	import { app } from '$lib/stores.svelte.js';
 	import { page } from '$app/stores';
-	import { untrack } from 'svelte';
-	import { goto, replaceState } from '$app/navigation';
+	import { onMount, untrack } from 'svelte';
+	import { afterNavigate, goto } from '$app/navigation';
 	import { t, tag } from '$lib/i18n.svelte.js';
 	import { NOTE, startDrag } from '$lib/dnd.js';
 	import { colorVar } from '$lib/colors.js';
@@ -485,65 +485,94 @@
 	});
 
 	/**
-	 * En søgning, man kommer med, og en søgning, man kan gå videre med.
+	 * En søgning, man kommer med.
 	 *
-	 * ⌘K viste noter, der passede, i sin egen liste — og når man valgte en, åbnede
-	 * den noten på en side, hvis liste stod uændret. Så var de andre træffere væk,
-	 * og det eneste sted, de havde været, var en popup, der lige var lukket. "Jeg
-	 * får kun præsenteret en popup med resultater, og trykker jeg retur, kommer jeg
-	 * tilbage til den normale liste."
+	 * ⌘K sender `?note=…&q=…`, så listen ved siden af den åbne note er de andre
+	 * træffere frem for den almindelige liste.
 	 *
-	 * Nu bærer adressen søgningen, så listen ved siden af den åbne note er de andre
-	 * træffere. Og den skrives tilbage, når feltet ændres, så adressen kan gemmes og
-	 * deles — og frem for alt ikke lyver, når man har tømt feltet.
+	 * Læst, aldrig skrevet. Den første udgave skrev også søgningen tilbage i
+	 * adressen ved hvert tastetryk, så den kunne gemmes og deles — og det kostede
+	 * bogstaver. `replaceState` opdaterer `$page.url` et øjeblik efter, den kaldes,
+	 * så to hurtige tastetryk gav en effekt, der læste den *forrige* adresse, fandt
+	 * den uenig med det skrevne, og skrev den gamle værdi tilbage i feltet. Man
+	 * skrev "verd", og der stod "nde". Målt på en skærmoptagelse, ikke gættet.
 	 *
-	 * `settled` er det, de to retninger er blevet enige om — og den læses med
-	 * `untrack`, hvilket er hele forskellen på at virke og ikke.
-	 *
-	 * Uden den: den nederste effekt sætter `settled`, det vækker den øverste, og
-	 * `replaceState` har endnu ikke opdateret `$page.url`. Den øverste læser derfor
-	 * den *gamle* adresse, finder en søgning, der ikke er enig med `settled`, og
-	 * skriver den tilbage i feltet. Man tømmer søgefeltet, og ordet kommer igen.
-	 * Hver effekt skal reagere på sin egen kilde — adressen og feltet — og aldrig
-	 * på den fælles markør.
+	 * En markør, der skal holde to retninger enige, er en markør, der taber
+	 * kapløbet et sted. Adressen skrives derfor kun af navigation, og det her er
+	 * den eneste, der læser den.
 	 */
-	let settled = $state(null);
+	let cameWith = $state(null);
 
 	$effect(() => {
 		const inURL = $page.url.searchParams.get('q') ?? '';
-		if (inURL === untrack(() => settled)) return;
-		settled = inURL;
+		if (inURL === untrack(() => cameWith)) return;
+		cameWith = inURL;
 		draftQuery = inURL;
 		query = inURL;
 	});
 
-	$effect(() => {
-		const now = query;
-		if (now === untrack(() => settled)) return;
-		settled = now;
-		const url = new URL(untrack(() => $page.url));
-		if (now) url.searchParams.set('q', now);
-		else url.searchParams.delete('q');
-		replaceState(url, {});
-	});
-
-	// Arriving from somewhere that names a note — a task's panel, a project's page —
-	// opens it rather than dropping the person on a list to find it again.
-	let asked = $derived($page.url.searchParams.get('note'));
-	$effect(() => {
-		if (!asked || selectedId === asked) return;
-		const found = notes.find((n) => n.id === asked);
+	/**
+	 * En note, man kommer MED — en besked fra klokken, et link fra en opgave, en
+	 * træffer i ⌘K. Den åbnes, så man ikke bliver sat af på en liste og skal finde
+	 * den igen.
+	 *
+	 * Bundet til selve navigationen og ikke til adressens indhold, og det er hele
+	 * pointen. Siden skriver aldrig adressen — det blev fjernet, fordi det kostede
+	 * bogstaver ud af søgefeltet — så `?note=` bliver stående på den, man kom med,
+	 * uanset hvad man klikker bagefter. En effekt, der læste den igen, hver gang
+	 * noget ændrede sig, så derfor `selectedId` uenig med adressen og åbnede den
+	 * gamle igen: man kunne søge og ikke vælge, for hvert klik på en anden række
+	 * sprang tilbage til den første.
+	 *
+	 * En adresse, der ikke følger med, er ikke en tilstand at holde sig enig med.
+	 * Den er en besked, der kommer én gang — så den læses ved ankomsten frem for
+	 * ved hver ændring.
+	 */
+	function openFromURL(url) {
+		const id = url?.searchParams.get('note');
+		if (!id || id === selectedId) return;
+		const found = notes.find((n) => n.id === id);
 		if (found) open(found);
-		else api.note(asked).then(open).catch(() => {});
-	});
+		else api.note(id).then(open).catch(() => {});
+	}
+
+	// To veje ind, fordi der er to måder at ankomme på, og hver af dem er blind for
+	// den anden.
+	//
+	// `afterNavigate` alene rækker ikke: layoutet tegner ingenting, mens kontoen
+	// hentes, så den her side bliver monteret EFTER den første navigation er forbi.
+	// En lytter, der registreres der, hører den aldrig — `/noter?note=<id>` tastet
+	// eller fulgt udefra åbnede så ingenting.
+	//
+	// Og `onMount` alene rækker heller ikke: går man til en anden note inde i
+	// programmet, monteres siden ikke om.
+	onMount(() => openFromURL($page.url));
+	afterNavigate((nav) => openFromURL(nav?.to?.url ?? $page.url));
+
+	/**
+	 * Hvilken hentning der gælder.
+	 *
+	 * To søgninger kan være undervejs på én gang, og den langsomste kan lande
+	 * sidst. Uden det her betød det, at listen viste svaret på et spørgsmål, der
+	 * ikke længere blev stillet — på optagelsen stod resultaterne for "verdande" i
+	 * listen, efter feltet var tømt. Pausen på 250 ms gjorde det sjældnere og kunne
+	 * ikke gøre det umuligt.
+	 */
+	let newest = 0;
 
 	async function load(q) {
+		const mine = ++newest;
 		try {
 			const params = q ? { q } : showArchive ? { archived: '1' } : {};
-			notes = (await api.notes(params)).notes ?? [];
+			const got = (await api.notes(params)).notes ?? [];
+			// Et svar, der er blevet overhalet, kastes væk. Det er ikke forkert —
+			// det er bare ikke længere svaret på det, der blev spurgt om.
+			if (mine !== newest) return;
+			notes = got;
 			status = 'ready';
 			if (selectedId && !notes.some((n) => n.id === selectedId)) open(notes[0] ?? null);
 		} catch (e) {
+			if (mine !== newest) return;
 			status = 'failed';
 			app.toast(humanMessage(e));
 		}
@@ -560,7 +589,17 @@
 	 * Derfor hentes den hele her. Rækken vises med det samme, så det ikke føles som
 	 * at vente; teksten kommer, når den er der.
 	 */
-	async function open(note) {
+	/**
+	 * `whole` siger, at noten allerede er hel, og at der ikke skal hentes.
+	 *
+	 * En tom krop bruges ellers som tegn på, at det her er en listerække — serveren
+	 * tømmer `body` på dem med vilje. Men en *nyoprettet* note er også tom, og den
+	 * er hel. Uden det her blev den lukket ud som en halv note: editoren blev pillet
+	 * af skærmen, noten hentet igen, og editoren sat op på ny. I det hul står
+	 * `selected` som null, og `save()` går tavst tilbage uden at gemme — så tekst
+	 * skrevet der forsvandt sporløst.
+	 */
+	async function open(note, { whole = false } = {}) {
 		clearTimeout(timer);
 		if (!note) {
 			selectedId = null;
@@ -576,9 +615,9 @@
 		// id'et være det samme begge gange, så den anden aldrig blev vist. Man ville
 		// sidde med en tom note, der lige havde haft en titel.
 		selectedId = note.id;
-		if (note.body) {
+		if (whole || note.body) {
 			selected = note;
-			draft = note.body;
+			draft = note.body ?? '';
 			return;
 		}
 		selected = null;
@@ -690,8 +729,11 @@
 		try {
 			const note = await api.createNote({ body: '' });
 			notes = [note, ...notes];
-			open(note);
-			document.querySelector('.editor textarea')?.focus();
+			// Svaret er hele noten, så den skal ikke hentes igen — se open().
+			// Markøren sættes af editoren selv, når noten er tom — se
+			// placeCaretInTitle i NoteEditor. Her stod en focus() på
+			// `.editor textarea`, og editoren har ingen textarea.
+			await open(note, { whole: true });
 		} catch (e) {
 			app.toast(humanMessage(e));
 		}
@@ -893,7 +935,7 @@
 
 </script>
 
-<svelte:head><title>{t('notes.title')} · verdande</title></svelte:head>
+<svelte:head><title>{t('notes.title')} · {app.productSlug}</title></svelte:head>
 
 <svelte:window
 	onclick={onShareOutside}

web/src/routes/projekt/[id]/+page.svelte

@@ -88,9 +88,14 @@
 		if (!projectId) return;
 		status = 'loading';
 		try {
+			// Sektioner findes ikke i noter-udgaven, hvor et projekt er en notesbog
+			// — og det er ikke bare støj: Promise.all kaster på den første, der
+			// fejler, så en 404 herfra satte status = 'failed', og siden viste en
+			// fejlskærm frem for notesbogens noter. `loadTasks` vogter sig selv i
+			// butikken, fordi den har tre kaldesteder her.
 			const [p, s] = await Promise.all([
 				api.getProject(projectId),
-				api.listSections(projectId),
+				app.notesOnly ? Promise.resolve({ sections: [] }) : api.listSections(projectId),
 				app.loadTasks({ project_id: projectId })
 			]);
 			project = p;

web/src/routes/reset/+page.svelte

@@ -8,8 +8,12 @@
 	 * fill in. Same shape as the invite link, and found the same way.
 	 */
 	import SignIn from '$lib/components/SignIn.svelte';
+	// Udgavens navn i titlen. Siden her tegner først, når layoutets `app.load()`
+	// har svaret, så udgaven er kendt — også uden en session, hvilket er hele
+	// pointen med den her rute.
+	import { app } from '$lib/stores.svelte.js';
 </script>
 
-<svelte:head><title>Ny adgangskode · verdande</title></svelte:head>
+<svelte:head><title>Ny adgangskode · {app.productSlug}</title></svelte:head>
 
 <SignIn />

web/src/routes/urd/+page.svelte

@@ -0,0 +1,26 @@
+<script>
+	/**
+	 * Urds dør.
+	 *
+	 * Serveren svarer på /urd med sin egen skal — egen titel, eget mærke og et link
+	 * til sit eget manifest — og det er dét, styresystemet installerer. Siden her er
+	 * hvad appen gør, når den så er startet: husker hvilken dør den kom ind ad, og
+	 * går videre til noterne.
+	 *
+	 * Ansigtet sættes ikke her, men i layoutet, hvor begge døre står ved siden af
+	 * hinanden — `/urd` sætter urd og `/` sætter verdande. Delt op, fordi en regel
+	 * med to halvdele, der ligger i hver sin fil, er en regel, hvor kun den ene
+	 * halvdel bliver vedligeholdt.
+	 *
+	 * `replaceState`, så telefonens tilbage-gestus ikke fører tilbage til en side,
+	 * der kun omdirigerer.
+	 */
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+
+	onMount(() => goto('/noter', { replaceState: true }));
+</script>
+
+<!-- Bevidst tom. Omdirigeringen sker i samme hug som tegningen, så alt her ville
+     være et glimt af noget, ingen nåede at læse. -->
+<svelte:head><title>urd</title></svelte:head>

web/static/urd-icon.svg

@@ -0,0 +1,42 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <!-- Urd's mark: ð, the eth in Urðr. Drawn in Verdande's strokes so the two read
+       as one family — same width, same round caps, same plate.
+
+       NOT a rune, and that is the whole story of this file. The obvious mark was
+       ᚢ uruz, the letter the name begins with in the elder futhark, exactly as
+       Verdande's is ᚹ wunjo. It was drawn that way first. Then: uruz is already
+       one of this author's products, and uruz/scripts/gen-icons.ts says in its own
+       comment that it "draws the Uruz rune (ᚢ) in rune-gold" with "a tall left
+       vertical, a shoulder across the top, and a shorter" one — the same glyph,
+       the same construction, differing only in colour. Two of one person's apps
+       side by side on a home screen, which is precisely where this mark is meant
+       to be distinguishable.
+
+       ᚦ thurisaz was considered next, for the ð itself, and rejected for the same
+       reason one level down: it is a stave with a triangle on its right, and so is
+       ᚹ. At 16px they are one shape.
+
+       So the letter rather than the rune. ð is unmistakably Nordic, nothing else
+       here uses it, and it is a closed bowl where both neighbours are open staves.
+
+       Centred by counting painted pixels — white on black, headless Chromium, the
+       plate removed so the card is not what gets measured — rather than from the
+       path numbers, because a centred box is not a centred glyph:
+
+         verdande ᚹ   ink x  53–108  centre 80.5   ·  y  18–131  centre 74.5
+         urd      ð   ink x  39–110  centre 74.5   ·  y  15–134  centre 74.5
+
+       Verdande's +5.5 in x is its own deliberate nudge: a heavy stave beside a
+       light flag has to sit right of centre for the ink to look centred. ð is
+       symmetric enough not to need it, and the two agree exactly in y.
+
+       Legibility, measured rather than hoped: it reads as ð at 32px and above. At
+       16px it is a blob — and so is ᚹ, and a favicon is not what tells two
+       installed apps apart in a dock. -->
+  <rect width="64" height="64" rx="14" fill="#111312"/>
+  <g fill="none" stroke="#5fbf8f" stroke-width="6.5" stroke-linecap="round" stroke-linejoin="round">
+    <circle cx="32" cy="42" r="12"/>
+    <path d="M44 36L27 10"/>
+    <path d="M25 20h18"/>
+  </g>
+</svg>

web/svelte.config.js

@@ -14,6 +14,37 @@ export default {
 		}),
 		alias: {
 			$lib: 'src/lib'
+		},
+
+		/**
+		 * The build's own version string, which SvelteKit puts in
+		 * `_app/version.json` and the service worker reads to decide whether a new
+		 * version has been deployed.
+		 *
+		 * Its default is `Date.now()`, and that made every build of this frontend
+		 * produce different bytes: the millisecond lands in version.json, in
+		 * index.html and in service-worker.js, which changes the content hash of
+		 * every chunk that references them, which changes those chunks' filenames.
+		 * So two builds of the same commit had different file names in them.
+		 *
+		 * That is not an aesthetic problem, and it had two costs. The Dockerfile
+		 * said `-trimpath` and an empty buildid "keep the output reproducible", and
+		 * that sentence had been false for a year — the flags did their job and the
+		 * frontend embedded in the binary carried a millisecond. And the Dockerfile
+		 * builds one binary into two images, verdande and urd, where the claim is
+		 * that they are the same program rather than a fork; with a timestamp in the
+		 * build, that claim could not be checked, because no two builds ever
+		 * matched. CI checks it now.
+		 *
+		 * Measured by building twice and diffing the tree, before and after.
+		 *
+		 * `dev` when nothing sets it, so a local build is stable too. The cost is
+		 * that a local `npm run build` no longer looks like a new version to the
+		 * service worker — which only matters on a deployed instance, where the
+		 * release workflow passes the real tag.
+		 */
+		version: {
+			name: process.env.VERDANDE_VERSION ?? 'dev'
 		}
 	}
 };