feat: require operator sessions for privileged access (#258)

Closes #254

README.md

@@ -30,26 +30,48 @@ idempotency keys, so retrying after a timeout, reload, process restart, or hando
 another worker replays a confirmed result instead of posting duplicate content. Results
 are coordinated through a bounded SQLite ledger. Set `STACKCHAIN_STATE_DIR` to a
 persistent, writable service directory (or set `STACKCHAIN_IDEMPOTENCY_DB` to an explicit
-SQLite path); the local default is `.stackchain-state/idempotency.sqlite3`. Direct API callers should preserve the `Idempotency-Key`
-header with the unchanged route and payload until a `201` response is confirmed. Closing an assigned issue, native Comment,
+SQLite path); the local default is `.stackchain-state/idempotency.sqlite3`. Ledger reads and
+writes run outside the request event loop, and lock admission is bounded to 100 ms by
+default. Tune it with `STACKCHAIN_IDEMPOTENCY_LOCK_TIMEOUT_SECONDS`; keep the value below
+route deadlines. Reservation contention returns retryable HTTP 503 with `Retry-After: 1`.
+If contention occurs after the upstream mutation, the dashboard fails closed with
+`Retry-After: 5` and asks the caller to verify the result before retrying. Direct API callers
+should preserve the `Idempotency-Key` header with the unchanged route and payload until a
+`201` response is confirmed. Closing an assigned issue, native Comment,
 Approve, and Request changes reviews, and assigned-PR merge require repository
 write permission. Native Comment, Approve, and Request changes reviews support
 head-scoped draft comments anchored to changed lines; the dashboard validates each
 comment path and submits the summary, decision, and inline comments in one review
 request. The dashboard rechecks the current pull-request head, CI success, draft
 state, and mergeability immediately before every merge.
-Serve the dashboard
-only to trusted users on its own origin; cross-origin API
-access is intentionally disabled. Then start the API and bundled frontend:
+Serve the dashboard only to trusted users on its own origin; cross-origin API
+access is intentionally disabled. For any deployment not already behind an
+authenticated gateway, configure the built-in single-operator boundary with two
+independent high-entropy secrets. The access token is entered at `/login`; the
+browser receives only a short-lived signed session and CSRF proof. Generate the
+values in your secret manager (for example, `openssl rand -hex 32`) and inject
+them at runtime—never commit them:
 
 ```bash
 export GITEA_URL='https://forge.example.com'
 export GITEA_TOKEN='<read-notification-and-issue-write-token>'
+export STACKCHAIN_DASHBOARD_ACCESS_TOKEN='<operator-sign-in-secret>'
+export STACKCHAIN_DASHBOARD_SESSION_SECRET='<independent-cookie-signing-secret>'
+# Optional; defaults to eight hours.
+export STACKCHAIN_DASHBOARD_SESSION_TTL_SECONDS=28800
 uvicorn src.main:app --host 127.0.0.1 --port 8000
 ```
 
-Open `http://127.0.0.1:8000/` for the dashboard. To verify the backend and its
-Gitea connection directly, request
+Terminate TLS at the trusted reverse proxy: session cookies are deliberately
+`Secure`, `HttpOnly`, `SameSite=Strict`, and scoped to the deployment subpath.
+Use **Sign out & clear this device** on shared devices; it clears Stackchain's
+offline snapshots, drafts, outboxes, background IndexedDB, and PWA caches without
+removing unrelated forge preferences. Rotate either dashboard secret by replacing
+the injected value and restarting the service; changing the signing secret expires
+all sessions immediately.
+
+Open `http://127.0.0.1:8000/` only for an unprotected local development run. To
+verify the backend and its Gitea connection directly, sign in and request
 `http://127.0.0.1:8000/api/v1/context`; a successful response is JSON containing
 `user`, `repos`, `issues`, and `pull_requests`. Press `Ctrl/Cmd+K` in the dashboard
 to search commands plus issues and pull requests across every repository visible to
@@ -68,6 +90,16 @@ API process is running and does not contact Gitea. GET `/readyz` is the
 readiness check: it validates the configured Gitea credentials and returns
 HTTP 503 with an error when Gitea is unavailable or authentication fails.
 
+The application-lifetime Gitea transport bounds aggregate upstream traffic and
+coalesces identical concurrent GETs without caching completed responses. By
+default, at most eight requests run at once, with one slot reserved for authored
+mutations so polling and detail-read bursts cannot starve comments, reviews, or
+other writes. Requests that cannot enter within 250 ms fail as retryable HTTP
+503 responses. Tune these limits with `GITEA_MAX_CONCURRENCY` (minimum `2`) and
+`GITEA_ADMISSION_TIMEOUT_SECONDS` (minimum `0.001`); keep the admission timeout
+below the route deadlines. Streaming diff reads share the same read capacity,
+while POST, PATCH, PUT, and DELETE requests are never coalesced.
+
 ## Offline mobile shell
 
 At phone widths, a persistent bottom task dock keeps **Work**, **Find**, **New**,
@@ -76,6 +108,14 @@ filter, preserves the selected release lane, shows the current draft count, resp
 the device safe area, and moves out of the way while a full-screen task is open.
 Desktop layout is unchanged.
 
+My Work also has a local **Later** queue. **Later today** defers an item for four
+hours, while **Tomorrow** returns it at 09:00 in the device's local timezone.
+Deferred items leave normal and Attention queues without marking notifications read
+or changing any Gitea issue or pull request. They automatically return to their
+existing priority position at the wake time, and **Bring back now** restores them
+early. Later state is stored only in this browser, scoped to the confirmed Gitea
+login, and removed when fully loaded work confirms that an item no longer exists.
+
 After one successful online load, the installed dashboard precaches a versioned,
 subpath-scoped application shell. During a network outage or a dashboard HTTP
 `500`, `502`, `503`, or `504` response, navigation falls back to that shell when
@@ -95,15 +135,23 @@ data** deletes the snapshot, and opting out deletes it automatically.
 
 API responses and mutations are never cached by the service worker. New issue captures,
 issue comments, pull-request comments, and unread-update replies use bounded local
-outboxes when connectivity or a retryable server failure prevents delivery. Drafts
-shows queued and needs-attention messages with explicit send/discard controls; reconnect
-flushes messages sequentially with their original idempotency keys. Tabs coordinate each
-queue through the browser lock manager (with an expiring local lease fallback), so an
-installed PWA and a browser tab cannot submit the same operation concurrently. Queue
-changes are broadcast to other tabs and refresh Drafts without polling; an abandoned
-lease can be reclaimed after expiry. State-sensitive actions such as reviews, merges,
-closures, labels, milestones, and assignments are never queued. Service-worker upgrades
-are atomic and remove only older
+outboxes when connectivity or a retryable server failure prevents delivery. Issue
+captures and authored messages are also mirrored into account-bound IndexedDB lanes
+and registered with Background Sync, so a supporting installed browser can deliver
+new issues, issue comments, pull-request comments, and unread-update replies after
+every dashboard client has closed. The worker verifies the current Gitea login, shares
+an atomic delivery claim with the foreground path, and preserves the original
+idempotency key. Browsers without
+IndexedDB or Background Sync keep the foreground reconnect behavior. Drafts shows
+queued and needs-attention messages with explicit send/discard controls; reopening the
+dashboard reconciles worker completions and permanent failures into the visible outbox.
+Foreground delivery flushes messages sequentially with their original idempotency keys.
+Tabs coordinate each queue through the browser lock manager (with an expiring local
+lease fallback), so an installed PWA and a browser tab cannot submit the same operation
+concurrently. Queue changes are broadcast to other tabs and refresh Drafts without
+polling; an abandoned lease can be reclaimed after expiry. State-sensitive actions such
+as reviews, merges, closures, labels, milestones, and assignments are never queued.
+Service-worker upgrades are atomic and remove only older
 `stackchain-dashboard-*` caches, preserving unrelated caches on the same origin.
 
 Run the test suite with:

frontend/authored-outbox.js

@@ -1,4 +1,4 @@
-function createAuthoredOutbox({ storage, fetchJson, coordinator, getOwnerLogin = () => '', createOperationId, now = () => Date.now(), maxItems = 50 }) {
+function createAuthoredOutbox({ storage, fetchJson, coordinator, backgroundSync, getOwnerLogin = () => '', createOperationId, now = () => Date.now(), maxItems = 50 }) {
   const storageKey = 'stackchain.authored-outbox.v1';
   const makeId = createOperationId || (() =>
     globalThis.crypto?.randomUUID?.() || String(Date.now()) + '-' + Math.random().toString(16).slice(2)
@@ -17,6 +17,11 @@ function createAuthoredOutbox({ storage, fetchJson, coordinator, getOwnerLogin =
   function write(items) {
     storage?.setItem(storageKey, JSON.stringify({ version: 2, items }));
     coordinator?.notify('authored');
+    if (backgroundSync?.reconcile) {
+      Promise.resolve(backgroundSync.reconcile(items, 'authored'))
+        .then(() => items.length ? backgroundSync.requestSync?.() : undefined)
+        .catch(() => { /* Foreground reconnect remains the compatibility fallback. */ });
+    }
   }
 
   function enqueue(message) {
@@ -84,15 +89,27 @@ function createAuthoredOutbox({ storage, fetchJson, coordinator, getOwnerLogin =
     if (pending.has(item.id)) return pending.get(item.id);
     const request = (async () => {
       try {
-        const result = await fetchJson(endpoint(item), {
-          method: 'POST',
-          headers: {
-            Accept: 'application/json',
-            'Content-Type': 'application/json',
-            'Idempotency-Key': item.operationId,
-          },
-          body: JSON.stringify({ body: item.body }),
-        });
+        let result;
+        if (backgroundSync?.send) {
+          const delivery = await backgroundSync.send(item, currentLogin);
+          if (delivery.attention) {
+            const error = delivery.error || new Error('Message needs attention');
+            error.status = Number(error.status || 422);
+            throw error;
+          }
+          result = delivery.message;
+        } else {
+          result = await fetchJson(endpoint(item), {
+            method: 'POST',
+            headers: {
+              Accept: 'application/json',
+              'Content-Type': 'application/json',
+              'Idempotency-Key': item.operationId,
+            },
+            body: JSON.stringify({ body: item.body }),
+          });
+        }
+        if (!result) return { blocked: true };
         discard(item.id);
         return { result };
       } catch (error) {
@@ -149,7 +166,23 @@ function createAuthoredOutbox({ storage, fetchJson, coordinator, getOwnerLogin =
     return retryItem(id, currentLogin);
   }
 
-  return { enqueue, update, discard, flush, retry, list: () => read().map(item => ({ ...item })) };
+  function reconcileBackground(records) {
+    const statuses = new Map((records || []).map(item => [item.id, item]));
+    const items = read().flatMap(item => {
+      const background = statuses.get(item.id);
+      if (background?.status === 'sent') return [];
+      if (background?.status === 'attention') return [{
+        ...item,
+        status: 'attention',
+        error: String(background.error || 'Message needs attention').slice(0, 240),
+      }];
+      return [item];
+    });
+    write(items);
+    return items;
+  }
+
+  return { enqueue, update, discard, flush, retry, reconcileBackground, list: () => read().map(item => ({ ...item })) };
 }
 
 if (typeof module !== 'undefined' && module.exports) module.exports = createAuthoredOutbox;

frontend/background-issue-sync.js

@@ -0,0 +1,234 @@
+function createIndexedDbTransaction(indexedDB, dbName = 'stackchain-background-outbox-v1') {
+  let databasePromise;
+  function database() {
+    if (!databasePromise) databasePromise = new Promise((resolve, reject) => {
+      const request = indexedDB.open(dbName, 1);
+      request.onupgradeneeded = () => {
+        if (!request.result.objectStoreNames.contains('issues')) {
+          request.result.createObjectStore('issues', { keyPath: 'id' });
+        }
+      };
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    });
+    return databasePromise;
+  }
+  const requested = request => new Promise((resolve, reject) => {
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error);
+  });
+  return async work => {
+    const db = await database();
+    return new Promise((resolve, reject) => {
+      const transaction = db.transaction('issues', 'readwrite');
+      const objectStore = transaction.objectStore('issues');
+      let result;
+      let failed = false;
+      transaction.oncomplete = () => failed ? undefined : resolve(result);
+      transaction.onerror = () => reject(transaction.error);
+      transaction.onabort = () => reject(transaction.error || new Error('Issue outbox transaction aborted'));
+      Promise.resolve(work({
+        getAll: () => requested(objectStore.getAll()),
+        put: value => requested(objectStore.put(value)),
+        delete: id => requested(objectStore.delete(id)),
+      })).then(value => { result = value; }).catch(error => {
+        failed = true;
+        try { transaction.abort(); } catch (_abortError) { reject(error); }
+        reject(error);
+      });
+    });
+  };
+}
+
+function createIssueSyncStore({ transaction, indexedDB = globalThis.indexedDB, now = () => Date.now(), claimMs = 30000 } = {}) {
+  const transact = transaction || createIndexedDbTransaction(indexedDB);
+
+  async function reconcile(items, outboxLane = 'issue') {
+    return transact(async records => {
+      const existing = await records.getAll();
+      const incoming = new Map(items.map(item => [item.id, { ...item, outboxLane }]));
+      for (const current of existing) {
+        const currentLane = current.outboxLane || 'issue';
+        if (currentLane !== outboxLane) continue;
+        const replacement = incoming.get(current.id);
+        if (!replacement) {
+          if (current.status !== 'sending' || Number(current.claimUntil) <= Number(now())) {
+            await records.delete(current.id);
+          }
+          continue;
+        }
+        if ((current.status === 'sending' && Number(current.claimUntil) > Number(now())) ||
+            (current.status === 'attention' && replacement.status === 'attention') ||
+            current.status === 'sent') {
+          incoming.set(current.id, current);
+        }
+      }
+      for (const item of incoming.values()) await records.put(item);
+    });
+  }
+
+  async function claimNext(ownerLogin) {
+    return transact(async records => {
+      const timestamp = Number(now());
+      const items = await records.getAll();
+      const item = items.find(candidate => candidate.ownerLogin === ownerLogin &&
+        (candidate.status === 'queued' || candidate.status === 'sending') &&
+        (candidate.status !== 'sending' || Number(candidate.claimUntil) <= timestamp));
+      if (!item) return null;
+      const claimed = { ...item, status: 'sending', claimUntil: timestamp + claimMs };
+      await records.put(claimed);
+      return claimed;
+    });
+  }
+
+  async function claim(id, ownerLogin) {
+    return transact(async records => {
+      const timestamp = Number(now());
+      const item = (await records.getAll()).find(candidate => candidate.id === id);
+      if (!item || item.ownerLogin !== ownerLogin ||
+          !['queued', 'sending'].includes(item.status) ||
+          (item.status === 'sending' && Number(item.claimUntil) > timestamp)) return null;
+      const claimed = { ...item, status: 'sending', claimUntil: timestamp + claimMs };
+      await records.put(claimed);
+      return claimed;
+    });
+  }
+
+  async function upsert(item) {
+    return transact(async records => {
+      const current = (await records.getAll()).find(candidate => candidate.id === item.id);
+      if (current && ((current.status === 'sending' && Number(current.claimUntil) > Number(now())) ||
+          (current.status === 'attention' && item.status === 'attention') ||
+          current.status === 'sent')) return current;
+      await records.put({ ...item });
+      return item;
+    });
+  }
+
+  async function update(id, transform) {
+    return transact(async records => {
+      const item = (await records.getAll()).find(candidate => candidate.id === id);
+      if (item) await records.put(transform(item));
+    });
+  }
+
+  return {
+    reconcile,
+    upsert,
+    claim,
+    claimNext,
+    complete: id => update(id, item => ({ ...item, status: 'sent', claimUntil: 0 })),
+    release: id => update(id, item => ({ ...item, status: 'queued', claimUntil: 0 })),
+    fail: (id, error) => update(id, item => ({ ...item, status: 'attention', claimUntil: 0, error })),
+    snapshot: () => transact(records => records.getAll()),
+    countBlocked: ownerLogin => transact(async records =>
+      (await records.getAll()).filter(item => item.status !== 'sent' && item.ownerLogin !== ownerLogin).length),
+  };
+}
+
+function createBackgroundIssueSync({ store, fetchJson, base = '' }) {
+  function deliveryRequest(item) {
+    if (item.kind === 'update-reply') {
+      return authoredRequest('api/v1/notifications/' + encodeURIComponent(item.notificationId) + '/reply', item);
+    }
+    const repository = String(item.repository || '').split('/').map(encodeURIComponent).join('/');
+    if (item.kind === 'issue-comment' || item.kind === 'pull-comment') {
+      const resource = item.kind === 'pull-comment' ? 'pulls' : 'issues';
+      return authoredRequest(
+        'api/v1/repos/' + repository + '/' + resource + '/' + encodeURIComponent(item.number) + '/comments',
+        item,
+      );
+    }
+    return {
+      url: base + 'api/v1/repos/' + repository + '/issues',
+      options: {
+        method: 'POST',
+        headers: {
+          Accept: 'application/json',
+          'Content-Type': 'application/json',
+          'Idempotency-Key': item.operationId,
+        },
+        body: JSON.stringify({
+          title: item.title,
+          body: item.body,
+          label_ids: item.labelIds,
+          ...(item.milestoneId ? { milestone_id: item.milestoneId } : {}),
+          ...(item.dueDate ? { due_date: item.dueDate + 'T23:59:59Z' } : {}),
+        }),
+      },
+    };
+  }
+
+  function authoredRequest(url, item) {
+    return {
+      url: base + url,
+      options: {
+        method: 'POST',
+        headers: {
+          Accept: 'application/json',
+          'Content-Type': 'application/json',
+          'Idempotency-Key': item.operationId,
+        },
+        body: JSON.stringify({ body: item.body }),
+      },
+    };
+  }
+
+  async function deliver(item) {
+    const request = deliveryRequest(item);
+    try {
+      const delivered = await fetchJson(request.url, request.options);
+      await store.complete(item.id);
+      return item.kind ? { message: delivered } : { issue: delivered };
+    } catch (error) {
+      const status = Number(error?.status || 0);
+      if (status >= 400 && status < 500) {
+        await store.fail(item.id, String(error?.message || 'Issue needs attention').slice(0, 240));
+        return { attention: true, error };
+      }
+      await store.release(item.id);
+      throw error;
+    }
+  }
+
+  async function send(item, currentLogin) {
+    if (!currentLogin || item.ownerLogin !== currentLogin) return { blocked: true };
+    await store.upsert(item);
+    const claimed = await store.claim(item.id, currentLogin);
+    if (!claimed) return { busy: true };
+    return deliver(claimed);
+  }
+
+  async function flush() {
+    const identity = await fetchJson(base + 'api/v1/background-identity', {
+      headers: { Accept: 'application/json' }, cache: 'no-store',
+    });
+    const login = String(identity?.login || '').trim();
+    const confirmed = [];
+    let attention = 0;
+    if (!login) return { confirmed, blocked: 0, attention };
+    while (true) {
+      const item = await store.claimNext(login);
+      if (!item) break;
+      const result = await deliver(item);
+      if (result.issue) confirmed.push(result.issue);
+      if (result.message) confirmed.push(result.message);
+      if (result.attention) attention += 1;
+    }
+    const blocked = store.countBlocked ? await store.countBlocked(login) : 0;
+    return { confirmed, blocked, attention };
+  }
+
+  return {
+    flush, send,
+    reconcile: (items, outboxLane) => store.reconcile(items, outboxLane),
+    snapshot: () => store.snapshot(),
+  };
+}
+
+createBackgroundIssueSync.createIssueSyncStore = createIssueSyncStore;
+if (typeof module !== 'undefined' && module.exports) module.exports = createBackgroundIssueSync;
+if (typeof globalThis !== 'undefined') {
+  globalThis.createBackgroundIssueSync = createBackgroundIssueSync;
+  globalThis.createIssueSyncStore = createIssueSyncStore;
+}

frontend/detail-defer.js

@@ -0,0 +1,25 @@
+function createDetailDefer({
+  laterWork,
+  session,
+  close,
+  refresh,
+  focus,
+  announce,
+  formatTime = value => new Date(value).toLocaleString(),
+}) {
+  return {
+    defer(item, preset) {
+      if (!item) return false;
+      const until = laterWork.presetUntil(preset);
+      if (!laterWork.defer(item, until)) return false;
+      const inSession = session.active();
+      if (!inSession) close();
+      refresh();
+      announce('Deferred until ' + formatTime(until) + '. It stays unread and unchanged in Gitea.');
+      if (!inSession) focus();
+      return true;
+    },
+  };
+}
+
+if (typeof module !== 'undefined' && module.exports) module.exports = createDetailDefer;

frontend/index.html

@@ -82,6 +82,13 @@ textarea { resize: vertical; min-height: 120px; }
 .my-work-card-main.review-trigger { width:100%; text-align:left; font:inherit; }
 .my-work-card:hover { border-color:var(--accent); }
 .my-work-card-title { display:block; margin:5px 0; font-weight:650; }
+.later-actions { display:grid; grid-template-columns:repeat(auto-fit,minmax(120px,1fr)); gap:8px; }
+.later-actions button { min-height:44px; width:100%; }
+.detail-defer { grid-column:1/-1; max-width:100%; }
+.detail-defer summary, .detail-defer button { min-height:44px; display:flex; align-items:center; justify-content:center; }
+.detail-defer summary { cursor:pointer; border:1px solid #60a5fa; border-radius:10px; font-weight:700; }
+.detail-defer-options { display:grid; grid-template-columns:repeat(auto-fit,minmax(120px,1fr)); gap:8px; margin-top:8px; }
+.review-sheet-actions { position:sticky; bottom:0; z-index:3; padding:10px 4px; padding-bottom:calc(10px + env(safe-area-inset-bottom)); background:rgba(11,21,38,.98); border-top:1px solid #2a496e; }
 .mark-update-read { min-height:44px; width:100%; }
 .read-update { min-height:44px; width:100%; display:flex; align-items:center; justify-content:center; }
 .load-more-notifications { min-height:44px; width:100%; margin-top:10px; }
@@ -285,6 +292,7 @@ textarea { resize: vertical; min-height: 120px; }
   <div class="toolbar">
     <div class="status"><span class="dot"></span><span class="small" id="status">Live</span></div>
     <button id="refresh">Refresh</button>
+    <button id="sign-out" type="button">Sign out &amp; clear this device</button>
     <button id="open-palette">Command</button>
     <span class="small muted" id="clock"></span>
   </div>
@@ -312,6 +320,7 @@ textarea { resize: vertical; min-height: 120px; }
         <button class="work-filter" data-work-filter="pull" aria-pressed="false">PRs <span data-work-count="pull">0</span></button>
         <button class="work-filter" data-work-filter="review" aria-pressed="false">Reviews <span data-work-count="review">0</span></button>
         <button class="work-filter" data-work-filter="update" aria-pressed="false">Updates <span data-work-count="update">0</span></button>
+        <button class="work-filter" data-work-filter="later" aria-pressed="false">Later <span data-work-count="later">0</span></button>
         <button class="work-filter" data-work-filter="draft" aria-pressed="false">Drafts <span data-work-count="draft">0</span></button>
       </div>
       <label class="milestone-lane" for="work-milestone-filter"><span class="small">Release lane</span>
@@ -511,6 +520,7 @@ textarea { resize: vertical; min-height: 120px; }
       <button id="release-issue" type="button">Release assignment</button>
       <button id="close-issue" type="button">Close issue</button>
       <a id="open-issue-gitea" href="#" target="_blank" rel="noopener noreferrer">Open in Gitea</a>
+      <details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today">Later today</button><button type="button" data-detail-defer-preset="tomorrow">Tomorrow</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details>
     </div>
     <nav class="work-session-nav" aria-label="Work session" hidden>
       <span class="small" aria-live="polite" data-work-session-progress></span>
@@ -614,6 +624,7 @@ textarea { resize: vertical; min-height: 120px; }
       <button class="share-work-route" type="button">Share</button>
       <button id="mark-update-read-next" type="button">Mark read &amp; next</button>
       <a id="open-update-gitea" href="#" target="_blank" rel="noopener noreferrer">Open in Gitea</a>
+      <details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today">Later today</button><button type="button" data-detail-defer-preset="tomorrow">Tomorrow</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details>
     </div>
     <nav class="work-session-nav" aria-label="Work session" hidden>
       <span class="small" aria-live="polite" data-work-session-progress></span>
@@ -653,6 +664,7 @@ textarea { resize: vertical; min-height: 120px; }
     <div class="pull-sheet-actions">
       <button class="share-work-route" type="button">Share</button>
       <a id="open-pull-gitea" href="#" target="_blank" rel="noopener noreferrer">Open in Gitea</a>
+      <details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today">Later today</button><button type="button" data-detail-defer-preset="tomorrow">Tomorrow</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details>
     </div>
     <nav class="work-session-nav" aria-label="Work session" hidden>
       <span class="small" aria-live="polite" data-work-session-progress></span>
@@ -717,6 +729,7 @@ textarea { resize: vertical; min-height: 120px; }
     </section>
     <h2>Review history</h2>
     <div id="review-history" class="muted"></div>
+    <div class="review-sheet-actions"><details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today">Later today</button><button type="button" data-detail-defer-preset="tomorrow">Tomorrow</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details></div>
     <nav class="work-session-nav" aria-label="Work session" hidden>
       <span class="small" aria-live="polite" data-work-session-progress></span>
       <button type="button" data-work-session-previous>Previous</button>
@@ -735,16 +748,20 @@ textarea { resize: vertical; min-height: 120px; }
 
 <div class="footer">Creative AI-imbued UI • stackchain-dashboard</div>
 
+<script src="static/session.js"></script>
 <script src="static/markdown.js"></script>
 <script src="static/commands.js"></script>
 <script src="static/search-preview.js"></script>
 <script src="static/widgets.js"></script>
 <script src="static/drafts.js"></script>
 <script src="static/outbox-coordinator.js"></script>
+<script src="static/background-issue-sync.js"></script>
 <script src="static/issue-outbox.js"></script>
 <script src="static/authored-outbox.js"></script>
 <script src="static/offline-work.js"></script>
 <script src="static/my-work.js"></script>
+<script src="static/later-work.js"></script>
+<script src="static/detail-defer.js"></script>
 <script src="static/pick-work.js"></script>
 <script src="static/conversation.js"></script>
 <script src="static/issue-sheet.js"></script>
@@ -784,7 +801,7 @@ textarea { resize: vertical; min-height: 120px; }
   );
   const mobileTaskOverlays = Array.from(document.querySelectorAll('[role="dialog"], #whiteboard-modal, #markdown-modal'));
   function openMobileWork() {
-    const counts = countMyWork(lastMyWork);
+    const counts = countMyWork(activeMyWork);
     const filter = counts.attention ? 'attention' : 'all';
     qs('[data-work-filter="' + filter + '"]').click();
     qs('#my-work').scrollIntoView({block:'start'});
@@ -825,7 +842,7 @@ textarea { resize: vertical; min-height: 120px; }
   let selectedWorkMilestone = 'all';
   try {
     const savedFilter = sessionStorage.getItem(WORK_FILTER_KEY);
-    if (['all', 'attention', 'issue', 'pull', 'review', 'update', 'draft'].includes(savedFilter)) selectedWorkFilter = savedFilter;
+    if (['all', 'attention', 'issue', 'pull', 'review', 'update', 'later', 'draft'].includes(savedFilter)) selectedWorkFilter = savedFilter;
     const savedMilestone = sessionStorage.getItem(WORK_MILESTONE_KEY);
     if (savedMilestone) selectedWorkMilestone = savedMilestone;
   } catch (e) {
@@ -865,6 +882,19 @@ textarea { resize: vertical; min-height: 120px; }
   let editingOutboxId = null;
   let confirmedOwnerLogin = '';
   let activeFlushLogin = '';
+  let activeMyWork = [];
+  let laterMyWork = [];
+  const laterWork = createLaterWork({
+    storage: localStorage,
+    getLogin: () => confirmedOwnerLogin,
+    onWake: () => {
+      qs('#my-work-action-status').textContent = 'Deferred work is ready again.';
+      refreshMyWorkView();
+    },
+  });
+  document.addEventListener('visibilitychange', () => {
+    if (!document.hidden) refreshMyWorkView();
+  });
 
   async function fetchReviewJson(url, options) {
     const response = await fetch(url, options);
@@ -894,15 +924,35 @@ textarea { resize: vertical; min-height: 120px; }
     loadMilestones: item => issueController.loadMilestones(item),
   });
   const issueCapture = createIssueCapture({ fetchJson: fetchReviewJson, storage: localStorage });
+  let backgroundIssueSync = null;
+  if ('indexedDB' in window) {
+    const backgroundIssueStore = createIssueSyncStore();
+    backgroundIssueSync = createBackgroundIssueSync({
+      store: backgroundIssueStore, fetchJson: fetchReviewJson,
+    });
+    backgroundIssueSync.requestSync = async () => {
+      if (!('serviceWorker' in navigator)) return;
+      const registration = await navigator.serviceWorker.ready;
+      if (registration.sync) await registration.sync.register('stackchain-issue-outbox-v1');
+    };
+  }
   const outboxCoordinator = createOutboxCoordinator({ storage: localStorage });
   const issueOutbox = createIssueOutbox({
     storage: localStorage, fetchJson: fetchReviewJson, coordinator: outboxCoordinator,
+    backgroundSync: backgroundIssueSync,
     getOwnerLogin: () => confirmedOwnerLogin,
   });
   const authoredOutbox = createAuthoredOutbox({
     storage: localStorage, fetchJson: fetchReviewJson, coordinator: outboxCoordinator,
+    backgroundSync: backgroundIssueSync,
     getOwnerLogin: () => confirmedOwnerLogin,
   });
+  if (backgroundIssueSync) {
+    backgroundIssueSync.snapshot().then(records => {
+      issueOutbox.reconcileBackground(records);
+      authoredOutbox.reconcileBackground(records);
+    }).catch(() => { /* The foreground localStorage outboxes remain available. */ });
+  }
   const shareParams = new URLSearchParams(location.search);
   const sharedLaunch = {
     title: shareParams.get('title') || '',
@@ -1193,7 +1243,7 @@ textarea { resize: vertical; min-height: 120px; }
   }
 
   const workSession = createWorkSession({
-    getItems: () => lastMyWork,
+    getItems: () => activeMyWork,
     getFilter: () => selectedWorkFilter,
     getMilestone: () => selectedWorkMilestone,
     onOpen: openWorkSessionItem,
@@ -1217,6 +1267,30 @@ textarea { resize: vertical; min-height: 120px; }
     },
   });
 
+  const detailDefer = createDetailDefer({
+    laterWork,
+    session: workSession,
+    close: () => workRoute.close(),
+    refresh: refreshMyWorkView,
+    focus: () => qs('[data-work-filter="' + selectedWorkFilter + '"]')?.focus(),
+    announce: message => { qs('#my-work-action-status').textContent = message; },
+    formatTime: fmt,
+  });
+  document.querySelectorAll('[data-detail-defer-preset]').forEach(button => {
+    button.addEventListener('click', () => {
+      const item = selectedUpdate || selectedReview || selectedIssue || selectedPull;
+      button.closest('.detail-defer').open = false;
+      detailDefer.defer(item, button.dataset.detailDeferPreset);
+    });
+  });
+  document.querySelectorAll('[data-detail-defer-cancel]').forEach(button => {
+    button.addEventListener('click', () => {
+      const chooser = button.closest('.detail-defer');
+      chooser.open = false;
+      chooser.querySelector('summary')?.focus();
+    });
+  });
+
   function renderContextSnapshot(data) {
     liveMode = true;
     hasContextSnapshot = true;
@@ -1288,7 +1362,13 @@ textarea { resize: vertical; min-height: 120px; }
 
   function refreshMyWorkView() {
     lastDrafts = draftInbox.list();
-    const counts = countMyWork(lastMyWork);
+    const partitioned = laterWork.partition(lastMyWork, {
+      pruneMissing: !Object.values(workPagination).some(page => page?.has_more),
+    });
+    activeMyWork = partitioned.active;
+    laterMyWork = partitioned.later;
+    const counts = countMyWork(activeMyWork);
+    counts.later = laterMyWork.length;
     counts.draft = lastDrafts.length;
     Object.entries(counts).forEach(([filter, count]) => {
       const element = qs('[data-work-count="' + filter + '"]');
@@ -1311,7 +1391,8 @@ textarea { resize: vertical; min-height: 120px; }
     }
     qs('#my-work').removeAttribute('data-stale');
     qs('#my-work-status').textContent = lastMyWork.length ?
-      summarizeMyWork(lastMyWork) : 'No assigned work, review requests, or unread updates.';
+      summarizeMyWork(activeMyWork) + (laterMyWork.length ? ' · ' + laterMyWork.length + ' deferred' : '') :
+      'No assigned work, review requests, or unread updates.';
     updateWorkPaginationControls();
     renderMyWork();
     if (workSession.active()) workSession.reconcile();
@@ -1431,7 +1512,9 @@ textarea { resize: vertical; min-height: 120px; }
       qs('#load-more-notifications').hidden = true;
       return;
     }
-    const visible = filterMyWork(lastMyWork, selectedWorkFilter, selectedWorkMilestone);
+    const visible = selectedWorkFilter === 'later' ?
+      filterMyWork(laterMyWork, 'all', selectedWorkMilestone) :
+      filterMyWork(activeMyWork, selectedWorkFilter, selectedWorkMilestone);
     const incomplete = activeWorkStreams().some(stream => workPagination[stream]?.has_more);
     qs('#my-work-list').innerHTML = visible.length ? visible.map(item => {
       const index = lastMyWork.findIndex(candidate => candidate.key === item.key && candidate.kind === item.kind);
@@ -1444,24 +1527,28 @@ textarea { resize: vertical; min-height: 120px; }
       (item.milestone?.title ? ' <span class="pill milestone-badge">' + escapeHtml(item.milestone.title) + '</span>' : '') +
       (item.due_label ? ' <span class="pill due-badge">' + escapeHtml(item.due_label) + '</span>' : '') +
       (item.has_update ? ' <span class="pill">Unread update</span>' : '') +
+      (item.deferred_until ? '<span class="small">Deferred until ' + escapeHtml(fmt(item.deferred_until)) + '</span>' : '') +
       (item.updated_at ? '<span class="small"> · Updated ' + escapeHtml(fmt(item.updated_at)) + '</span>' : '');
       const markRead = item.has_update && Number.isInteger(item.notification_id) ?
         '<button class="mark-update-read" data-notification-id="' + item.notification_id + '">Mark read</button>' : '';
       const readUpdate = item.has_update && Number.isInteger(item.notification_id) ?
         '<a class="read-update" href="' + escAttr(createWorkRoute.serialize({ kind:'update', notification_id:item.notification_id })) + '" data-update-index="' + index + '">Read update</a>' : '';
+      const laterActions = selectedWorkFilter === 'later' ?
+        '<div class="later-actions"><button type="button" data-later-restore data-work-index="' + index + '">Bring back now</button></div>' :
+        '<div class="later-actions" aria-label="Defer this work"><button type="button" data-later-preset="today" data-work-index="' + index + '">Later today</button><button type="button" data-later-preset="tomorrow" data-work-index="' + index + '">Tomorrow</button></div>';
       if (item.is_review) {
-        return '<article class="my-work-card"><a class="my-work-card-main review-trigger" href="' + escAttr(routeHref) + '" data-review-index="' + index + '">' + contents + '</a>' + readUpdate + markRead + '</article>';
+        return '<article class="my-work-card"><a class="my-work-card-main review-trigger" href="' + escAttr(routeHref) + '" data-review-index="' + index + '">' + contents + '</a>' + readUpdate + markRead + laterActions + '</article>';
       }
       if (item.kind === 'issue') {
-        return '<article class="my-work-card"><a class="my-work-card-main issue-trigger" href="' + escAttr(routeHref) + '" data-issue-index="' + index + '">' + contents + '</a>' + readUpdate + markRead + '</article>';
+        return '<article class="my-work-card"><a class="my-work-card-main issue-trigger" href="' + escAttr(routeHref) + '" data-issue-index="' + index + '">' + contents + '</a>' + readUpdate + markRead + laterActions + '</article>';
       }
       if (item.kind === 'pull') {
-        return '<article class="my-work-card"><a class="my-work-card-main pull-trigger" href="' + escAttr(routeHref) + '" data-pull-index="' + index + '">' + contents + '</a>' + readUpdate + markRead + '</article>';
+        return '<article class="my-work-card"><a class="my-work-card-main pull-trigger" href="' + escAttr(routeHref) + '" data-pull-index="' + index + '">' + contents + '</a>' + readUpdate + markRead + laterActions + '</article>';
       }
-      return '<article class="my-work-card"><a class="my-work-card-main update-trigger" href="' + escAttr(routeHref) + '" data-update-index="' + index + '">' + contents + '</a>' + markRead + '</article>';
+      return '<article class="my-work-card"><a class="my-work-card-main update-trigger" href="' + escAttr(routeHref) + '" data-update-index="' + index + '">' + contents + '</a>' + markRead + laterActions + '</article>';
     }).join('') : '<div class="muted">' + (incomplete ?
       'More work is available. Load the next page.' :
-      'No ' + (selectedWorkFilter === 'attention' ? 'items need attention' : (selectedWorkFilter === 'review' ? 'reviews' : (selectedWorkFilter === 'update' ? 'unread updates' : (selectedWorkFilter === 'all' ? 'work' : selectedWorkFilter + ' items')))) + '.') + '</div>';
+      'No ' + (selectedWorkFilter === 'attention' ? 'items need attention' : (selectedWorkFilter === 'review' ? 'reviews' : (selectedWorkFilter === 'update' ? 'unread updates' : (selectedWorkFilter === 'later' ? 'deferred work' : (selectedWorkFilter === 'all' ? 'work' : selectedWorkFilter + ' items'))))) + '.') + '</div>';
     document.querySelectorAll('[data-review-index]').forEach(button => {
       button.addEventListener('click', event => { event.preventDefault(); openRoutedWork(lastMyWork[Number(button.dataset.reviewIndex)], button); });
     });
@@ -1493,6 +1580,22 @@ textarea { resize: vertical; min-height: 120px; }
         }
       });
     });
+    document.querySelectorAll('[data-later-preset]').forEach(button => {
+      button.addEventListener('click', () => {
+        const item = lastMyWork[Number(button.dataset.workIndex)];
+        if (!item || !laterWork.defer(item, laterWork.presetUntil(button.dataset.laterPreset))) return;
+        qs('#my-work-action-status').textContent = 'Deferred work stays unread and unchanged in Gitea.';
+        refreshMyWorkView();
+      });
+    });
+    document.querySelectorAll('[data-later-restore]').forEach(button => {
+      button.addEventListener('click', () => {
+        const item = lastMyWork[Number(button.dataset.workIndex)];
+        if (!item || !laterWork.restore(item)) return;
+        qs('#my-work-action-status').textContent = 'Work returned to its priority position.';
+        refreshMyWorkView();
+      });
+    });
     const allIds = notificationIds(visible);
     const ids = allIds.slice(0, Math.min(lastNotifications.length, 50));
     const bulkBar = qs('#bulk-mark-read-bar');

frontend/issue-outbox.js

@@ -1,4 +1,4 @@
-function createIssueOutbox({ storage, fetchJson, coordinator, getOwnerLogin = () => '', createOperationId, now = () => Date.now(), maxItems = 20 }) {
+function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, getOwnerLogin = () => '', createOperationId, now = () => Date.now(), maxItems = 20 }) {
   const storageKey = 'stackchain.issue-outbox.v1';
   const operationId = createOperationId || (() =>
     globalThis.crypto?.randomUUID?.() || String(Date.now()) + '-' + Math.random().toString(16).slice(2)
@@ -16,6 +16,11 @@ function createIssueOutbox({ storage, fetchJson, coordinator, getOwnerLogin = ()
   function write(items) {
     storage?.setItem(storageKey, JSON.stringify({ version: 2, items }));
     coordinator?.notify('issue');
+    if (backgroundSync?.reconcile) {
+      Promise.resolve(backgroundSync.reconcile(items))
+        .then(() => items.length ? backgroundSync.requestSync?.() : undefined)
+        .catch(() => { /* Foreground reconnect remains the compatibility fallback. */ });
+    }
   }
 
   function enqueue(draft) {
@@ -74,18 +79,30 @@ function createIssueOutbox({ storage, fetchJson, coordinator, getOwnerLogin = ()
     const repository = item.repository.split('/').map(encodeURIComponent).join('/');
     const request = (async () => {
       try {
-        const issue = await fetchJson('api/v1/repos/' + repository + '/issues', {
-          method: 'POST',
-          headers: {
-            Accept: 'application/json', 'Content-Type': 'application/json',
-            'Idempotency-Key': item.operationId,
-          },
-          body: JSON.stringify({
-            title: item.title, body: item.body, label_ids: item.labelIds,
-            ...(item.milestoneId ? { milestone_id: item.milestoneId } : {}),
-            ...(item.dueDate ? { due_date: item.dueDate + 'T23:59:59Z' } : {}),
-          }),
-        });
+        let issue;
+        if (backgroundSync?.send) {
+          const delivery = await backgroundSync.send(item, currentLogin);
+          if (delivery.attention) {
+            const error = delivery.error || new Error('Issue needs attention');
+            error.status = Number(error.status || 422);
+            throw error;
+          }
+          issue = delivery.issue;
+        } else {
+          issue = await fetchJson('api/v1/repos/' + repository + '/issues', {
+            method: 'POST',
+            headers: {
+              Accept: 'application/json', 'Content-Type': 'application/json',
+              'Idempotency-Key': item.operationId,
+            },
+            body: JSON.stringify({
+              title: item.title, body: item.body, label_ids: item.labelIds,
+              ...(item.milestoneId ? { milestone_id: item.milestoneId } : {}),
+              ...(item.dueDate ? { due_date: item.dueDate + 'T23:59:59Z' } : {}),
+            }),
+          });
+        }
+        if (!issue) return { blocked: true };
         discard(item.id);
         return { issue };
       } catch (error) {
@@ -139,7 +156,21 @@ function createIssueOutbox({ storage, fetchJson, coordinator, getOwnerLogin = ()
     return retryItem(id, currentLogin);
   }
 
-  return { enqueue, update, discard, flush, retry, list: () => read().map(item => ({ ...item })) };
+  function reconcileBackground(records) {
+    const statuses = new Map((records || []).map(item => [item.id, item]));
+    const items = read().flatMap(item => {
+      const background = statuses.get(item.id);
+      if (background?.status === 'sent') return [];
+      if (background?.status === 'attention') return [{
+        ...item, status: 'attention', error: String(background.error || 'Issue needs attention').slice(0, 240),
+      }];
+      return [item];
+    });
+    write(items);
+    return items;
+  }
+
+  return { enqueue, update, discard, flush, retry, reconcileBackground, list: () => read().map(item => ({ ...item })) };
 }
 
 if (typeof module !== 'undefined' && module.exports) module.exports = createIssueOutbox;

frontend/later-work.js

@@ -0,0 +1,113 @@
+function createLaterWork({ storage, getLogin, now = () => new Date(), setTimer = setTimeout, clearTimer = clearTimeout, onWake = () => {} }) {
+  const prefix = 'stackchain.later-work.v1.';
+  let timer = null;
+
+  function identity(item) {
+    if (!item) return '';
+    const kind = item.is_review ? 'review' : (item.kind || 'work');
+    const number = Number.isInteger(item.number) ? item.number : '';
+    const notification = Number.isInteger(item.notification_id) ? item.notification_id : '';
+    return [kind, item.repository || '', number, notification].join(':');
+  }
+
+  function storageKey() {
+    const login = String(getLogin?.() || '').trim().toLowerCase();
+    return login ? prefix + encodeURIComponent(login) : '';
+  }
+
+  function read() {
+    const key = storageKey();
+    if (!key || !storage) return {};
+    try {
+      const value = JSON.parse(storage.getItem(key) || '{}');
+      return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    } catch (_error) {
+      return {};
+    }
+  }
+
+  function write(records) {
+    const key = storageKey();
+    if (!key || !storage) return false;
+    try {
+      if (Object.keys(records).length) storage.setItem(key, JSON.stringify(records));
+      else storage.removeItem(key);
+      return true;
+    } catch (_error) {
+      return false;
+    }
+  }
+
+  function defer(item, until) {
+    const key = storageKey();
+    const id = identity(item);
+    const wake = new Date(until);
+    if (!key || !id || Number.isNaN(wake.getTime()) || wake <= now()) return false;
+    const records = read();
+    records[id] = wake.toISOString();
+    write(records);
+    return true;
+  }
+
+  function presetUntil(preset) {
+    const current = new Date(now());
+    if (preset === 'today') return new Date(current.getTime() + 4 * 60 * 60 * 1000);
+    if (preset === 'tomorrow') {
+      const wake = new Date(current);
+      wake.setDate(wake.getDate() + 1);
+      wake.setHours(9, 0, 0, 0);
+      return wake;
+    }
+    return new Date(NaN);
+  }
+
+  function restore(item) {
+    const id = identity(item);
+    const records = read();
+    if (!id || !Object.prototype.hasOwnProperty.call(records, id)) return false;
+    delete records[id];
+    write(records);
+    return true;
+  }
+
+  function schedule(wakeTimes, current) {
+    if (timer !== null) clearTimer(timer);
+    timer = null;
+    if (!wakeTimes.length) return;
+    const delay = Math.max(0, Math.min(...wakeTimes) - current);
+    timer = setTimer(() => {
+      timer = null;
+      onWake();
+    }, Math.min(delay, 2147483647));
+  }
+
+  function partition(items, { pruneMissing = true } = {}) {
+    const current = now().getTime();
+    const records = read();
+    const available = new Map((items || []).map(item => [identity(item), item]));
+    const retained = {};
+    const wakeTimes = [];
+
+    Object.entries(records).forEach(([id, wake]) => {
+      const wakeTime = new Date(wake).getTime();
+      if (!Number.isFinite(wakeTime) || wakeTime <= current) return;
+      if (pruneMissing && !available.has(id)) return;
+      retained[id] = new Date(wakeTime).toISOString();
+      wakeTimes.push(wakeTime);
+    });
+
+    if (JSON.stringify(retained) !== JSON.stringify(records)) write(retained);
+    schedule(wakeTimes, current);
+    const deferredIds = new Set(Object.keys(retained));
+    const active = (items || []).filter(item => !deferredIds.has(identity(item)));
+    const later = (items || []).flatMap(item => {
+      const wake = retained[identity(item)];
+      return wake ? [{ ...item, deferred_until: wake }] : [];
+    });
+    return { active, later };
+  }
+
+  return { identity, defer, restore, presetUntil, partition };
+}
+
+if (typeof module !== 'undefined' && module.exports) module.exports = createLaterWork;

frontend/service-worker.js

@@ -1,11 +1,13 @@
-const CACHE = 'stackchain-dashboard-shell-v11';
-const OUTAGE_STATUSES = new Set([500, 502, 503, 504]);
 const BASE = new URL('./', self.location.href).pathname;
+importScripts(BASE + 'static/background-issue-sync.js');
+const CACHE = 'stackchain-dashboard-shell-v16';
+const OUTAGE_STATUSES = new Set([500, 502, 503, 504]);
 const SHELL = [
   BASE,
   BASE + 'manifest.webmanifest',
   BASE + 'static/icons/stackchain-192.png',
   BASE + 'static/icons/stackchain-512.png',
+  BASE + 'static/session.js',
   BASE + 'static/markdown.js',
   BASE + 'static/commands.js',
   BASE + 'static/search-preview.js',
@@ -16,6 +18,8 @@ const SHELL = [
   BASE + 'static/authored-outbox.js',
   BASE + 'static/offline-work.js',
   BASE + 'static/my-work.js',
+  BASE + 'static/later-work.js',
+  BASE + 'static/detail-defer.js',
   BASE + 'static/pick-work.js',
   BASE + 'static/conversation.js',
   BASE + 'static/issue-sheet.js',
@@ -25,8 +29,41 @@ const SHELL = [
   BASE + 'static/work-route.js',
   BASE + 'static/context-poller.js',
   BASE + 'static/mobile-task-dock.js',
+  BASE + 'static/background-issue-sync.js',
 ];
 
+async function sessionCsrf() {
+  const response = await fetch(new URL(BASE + 'api/v1/session', self.location.origin), {
+    headers: { Accept: 'application/json' },
+  });
+  if (!response.ok) return '';
+  const payload = await response.json().catch(() => ({}));
+  return typeof payload.csrf_token === 'string' ? payload.csrf_token : '';
+}
+
+async function fetchJson(url, options = {}) {
+  const requestOptions = { ...options };
+  const method = String(options.method || 'GET').toUpperCase();
+  if (!['GET', 'HEAD', 'OPTIONS'].includes(method)) {
+    const headers = new Headers(options.headers || {});
+    const csrf = await sessionCsrf();
+    if (csrf) headers.set('X-CSRF-Token', csrf);
+    requestOptions.headers = headers;
+  }
+  const response = await fetch(new URL(url, self.location.origin), requestOptions);
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const error = new Error(payload.error || payload.detail || 'Background issue delivery failed.');
+    error.status = response.status;
+    throw error;
+  }
+  return payload;
+}
+
+const issueSync = self.__issueSync || createBackgroundIssueSync({
+  store: createIssueSyncStore(), fetchJson, base: BASE,
+});
+
 self.addEventListener('install', event => {
   event.waitUntil(caches.open(CACHE).then(cache => cache.addAll(SHELL)).then(() => self.skipWaiting()));
 });
@@ -38,6 +75,10 @@ self.addEventListener('activate', event => {
   )).then(() => self.clients.claim()));
 });
 
+self.addEventListener('sync', event => {
+  if (event.tag === 'stackchain-issue-outbox-v1') event.waitUntil(issueSync.flush());
+});
+
 self.addEventListener('fetch', event => {
   const request = event.request;
   if (request.method !== 'GET' || request.url.includes('/api/')) return;

frontend/session.js

@@ -0,0 +1,92 @@
+(function (root, factory) {
+  if (typeof module !== 'undefined' && module.exports) module.exports = factory;
+  else {
+    const base = new URL('./', root.location.href).pathname;
+    const originalFetch = root.fetch.bind(root);
+    const boundary = factory({
+      cookie: () => root.document.cookie,
+      origin: root.location.origin,
+      base,
+      fetchImpl: originalFetch,
+      localStorage: root.localStorage,
+      sessionStorage: root.sessionStorage,
+      indexedDB: root.indexedDB,
+      caches: root.caches,
+      location: root.location,
+      onExpired: () => root.dispatchEvent(new CustomEvent('stackchain:session-expired')),
+    });
+    root.fetch = boundary.fetch;
+    const attach = () => {
+      const button = root.document.getElementById('sign-out');
+      if (button) button.addEventListener('click', () => boundary.signOut());
+    };
+    if (root.document.readyState === 'loading') root.document.addEventListener('DOMContentLoaded', attach);
+    else attach();
+    root.stackchainSession = boundary;
+  }
+})(typeof window !== 'undefined' ? window : this, function createSessionBoundary({
+  cookie, origin, base, fetchImpl, localStorage, sessionStorage, indexedDB, caches, location,
+  onExpired = () => {},
+}) {
+  const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+
+  function csrfToken() {
+    const entry = String(cookie?.() || '').split(';')
+      .map(value => value.trim())
+      .find(value => value.startsWith('stackchain_csrf='));
+    return entry ? decodeURIComponent(entry.slice('stackchain_csrf='.length)) : '';
+  }
+
+  function isSameOrigin(input) {
+    try { return new URL(String(input?.url || input), origin).origin === origin; }
+    catch (_error) { return false; }
+  }
+
+  async function sessionFetch(input, options = {}) {
+    const method = String(options.method || input?.method || 'GET').toUpperCase();
+    const requestOptions = { ...options };
+    if (!SAFE_METHODS.has(method) && isSameOrigin(input)) {
+      const headers = new Headers(options.headers || input?.headers || {});
+      const csrf = csrfToken();
+      if (csrf) headers.set('X-CSRF-Token', csrf);
+      requestOptions.headers = headers;
+    }
+    const response = await fetchImpl(input, requestOptions);
+    if (response.status === 401) onExpired();
+    return response;
+  }
+
+  function removeDashboardStorage(storage) {
+    if (!storage) return;
+    const keys = [];
+    try {
+      for (let index = 0; index < storage.length; index += 1) {
+        const key = storage.key(index);
+        if (key?.startsWith('stackchain.')) keys.push(key);
+      }
+      keys.forEach(key => storage.removeItem(key));
+    } catch (_error) { /* Cookie invalidation still protects server data. */ }
+  }
+
+  async function clearPrivateDeviceData() {
+    removeDashboardStorage(localStorage);
+    if (sessionStorage !== localStorage) removeDashboardStorage(sessionStorage);
+    try { indexedDB?.deleteDatabase('stackchain-background-outbox-v1'); }
+    catch (_error) { /* Continue clearing other dashboard state. */ }
+    try {
+      const keys = await caches?.keys?.() || [];
+      await Promise.all(keys.filter(key => key.startsWith('stackchain-dashboard-')).map(key => caches.delete(key)));
+    } catch (_error) { /* A later service-worker activation can clear stale caches. */ }
+  }
+
+  async function signOut() {
+    try {
+      await sessionFetch(base + 'api/v1/session', { method: 'DELETE' });
+    } finally {
+      await clearPrivateDeviceData();
+      location.assign(base + 'login');
+    }
+  }
+
+  return { fetch: sessionFetch, signOut, clearPrivateDeviceData };
+});

src/dashboard_auth.py

@@ -0,0 +1,102 @@
+"""Signed, short-lived single-operator sessions for the dashboard boundary."""
+
+import base64
+import hashlib
+import hmac
+import json
+import os
+import secrets
+import time
+from dataclasses import dataclass
+
+from fastapi import Request
+
+SESSION_COOKIE = "stackchain_session"
+CSRF_COOKIE = "stackchain_csrf"
+DEFAULT_TTL_SECONDS = 8 * 60 * 60
+
+
+@dataclass(frozen=True)
+class Session:
+    csrf: str
+    expires_at: int
+
+
+def access_token() -> str:
+    return os.getenv("STACKCHAIN_DASHBOARD_ACCESS_TOKEN", "")
+
+
+def enabled() -> bool:
+    return bool(access_token())
+
+
+def _secret() -> bytes:
+    configured = os.getenv("STACKCHAIN_DASHBOARD_SESSION_SECRET", "")
+    if configured:
+        return configured.encode()
+    return hmac.new(
+        access_token().encode(), b"stackchain-dashboard-session-signing", hashlib.sha256
+    ).digest()
+
+
+def _encode(raw: bytes) -> str:
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+
+
+def _decode(value: str) -> bytes:
+    return base64.urlsafe_b64decode(value + "=" * (-len(value) % 4))
+
+
+def issue_session(now: int | None = None) -> tuple[str, Session]:
+    issued_at = int(time.time() if now is None else now)
+    ttl = int(os.getenv("STACKCHAIN_DASHBOARD_SESSION_TTL_SECONDS", str(DEFAULT_TTL_SECONDS)))
+    session = Session(csrf=secrets.token_urlsafe(24), expires_at=issued_at + max(1, ttl))
+    payload = json.dumps(
+        {"csrf": session.csrf, "exp": session.expires_at},
+        separators=(",", ":"),
+        sort_keys=True,
+    ).encode()
+    encoded = _encode(payload)
+    signature = _encode(hmac.new(_secret(), encoded.encode(), hashlib.sha256).digest())
+    return f"{encoded}.{signature}", session
+
+
+def verify_session(value: str | None, now: int | None = None) -> Session | None:
+    if not value or "." not in value or not enabled():
+        return None
+    encoded, supplied_signature = value.rsplit(".", 1)
+    expected = _encode(hmac.new(_secret(), encoded.encode(), hashlib.sha256).digest())
+    if not hmac.compare_digest(supplied_signature, expected):
+        return None
+    try:
+        payload = json.loads(_decode(encoded))
+        session = Session(csrf=payload["csrf"], expires_at=int(payload["exp"]))
+    except (ValueError, TypeError, KeyError, json.JSONDecodeError):
+        return None
+    current = int(time.time() if now is None else now)
+    if session.expires_at <= current or not isinstance(session.csrf, str) or not session.csrf:
+        return None
+    return session
+
+
+def request_session(request: Request) -> Session | None:
+    return verify_session(request.cookies.get(SESSION_COOKIE))
+
+
+def cookie_path(request: Request) -> str:
+    root_path = request.scope.get("root_path", "").rstrip("/")
+    return root_path or "/"
+
+
+def application_path(request: Request) -> str:
+    path = request.url.path
+    root_path = request.scope.get("root_path", "").rstrip("/")
+    if root_path and (path == root_path or path.startswith(root_path + "/")):
+        return path[len(root_path):] or "/"
+    return path
+
+
+def same_origin(request: Request) -> bool:
+    origin = request.headers.get("origin", "")
+    expected = f"{request.url.scheme}://{request.url.netloc}"
+    return bool(origin) and hmac.compare_digest(origin.rstrip("/"), expected)

src/gitea_proxy.py

@@ -2,6 +2,7 @@ import asyncio
 import os
 import re
 import shlex
+from contextlib import asynccontextmanager
 from typing import Any
 from urllib.parse import urlsplit
 
@@ -12,7 +13,116 @@ GITEA_TOKEN = os.getenv("GITEA_TOKEN", "")
 REVIEW_DIFF_MAX_BYTES = 64 * 1024
 REVIEW_DIFF_MAX_LINES = 400
 AVAILABLE_ISSUE_PAGE_CONCURRENCY = 3
-_client: httpx.AsyncClient | None = None
+_client: "GiteaTransport | None" = None
+
+
+class GiteaOverloadedError(RuntimeError):
+    """Raised when bounded transport admission expires before capacity is available."""
+
+
+class GiteaTransport:
+    """Application-lifetime HTTP transport with single-flight concurrent reads."""
+
+    def __init__(
+        self,
+        *,
+        max_concurrency: int = 8,
+        admission_timeout: float = 0.25,
+        **kwargs,
+    ) -> None:
+        max_concurrency = max(2, max_concurrency)
+        admission_timeout = max(0.001, admission_timeout)
+        self._http = httpx.AsyncClient(base_url=GITEA_URL, timeout=10, **kwargs)
+        self.max_concurrency = max_concurrency
+        self.admission_timeout = admission_timeout
+        self._request_slots = asyncio.Semaphore(max(2, max_concurrency))
+        self._read_slots = asyncio.Semaphore(max(1, max_concurrency - 1))
+        self._reads: dict[tuple, asyncio.Task[httpx.Response]] = {}
+
+    @property
+    def is_closed(self) -> bool:
+        return self._http.is_closed
+
+    def _read_key(self, url: str, kwargs: dict) -> tuple:
+        params = tuple(httpx.QueryParams(kwargs.get("params", {})).multi_items())
+        headers = tuple(sorted(httpx.Headers(kwargs.get("headers", {})).multi_items()))
+        return url, params, headers
+
+    async def _acquire(self, semaphore: asyncio.Semaphore) -> None:
+        try:
+            await asyncio.wait_for(semaphore.acquire(), timeout=self.admission_timeout)
+        except TimeoutError as exc:
+            raise GiteaOverloadedError("Gitea transport is saturated") from exc
+
+    async def _perform_get(self, url: str, kwargs: dict) -> httpx.Response:
+        await self._acquire(self._read_slots)
+        try:
+            await self._acquire(self._request_slots)
+            try:
+                return await self._http.get(url, **kwargs)
+            finally:
+                self._request_slots.release()
+        finally:
+            self._read_slots.release()
+
+    async def get(self, url: str, **kwargs) -> httpx.Response:
+        key = self._read_key(url, kwargs)
+        task = self._reads.get(key)
+        if task is None:
+            task = asyncio.create_task(self._perform_get(url, kwargs))
+            self._reads[key] = task
+            task.add_done_callback(
+                lambda completed, request_key=key: (
+                    self._reads.pop(request_key, None)
+                    if self._reads.get(request_key) is completed else None
+                )
+            )
+        return await asyncio.shield(task)
+
+    async def _mutate(self, method: str, url: str, kwargs: dict) -> httpx.Response:
+        await self._acquire(self._request_slots)
+        try:
+            return await self._http.request(method, url, **kwargs)
+        finally:
+            self._request_slots.release()
+
+    async def post(self, url: str, **kwargs) -> httpx.Response:
+        return await self._mutate("POST", url, kwargs)
+
+    async def patch(self, url: str, **kwargs) -> httpx.Response:
+        return await self._mutate("PATCH", url, kwargs)
+
+    async def put(self, url: str, **kwargs) -> httpx.Response:
+        return await self._mutate("PUT", url, kwargs)
+
+    async def delete(self, url: str, **kwargs) -> httpx.Response:
+        return await self._mutate("DELETE", url, kwargs)
+
+    @asynccontextmanager
+    async def stream(self, method: str, url: str, **kwargs):
+        await self._acquire(self._read_slots)
+        try:
+            await self._acquire(self._request_slots)
+            try:
+                async with self._http.stream(method, url, **kwargs) as response:
+                    yield response
+            finally:
+                self._request_slots.release()
+        finally:
+            self._read_slots.release()
+
+    def __getattr__(self, name: str):
+        return getattr(self._http, name)
+
+    async def aclose(self) -> None:
+        tasks = list(self._reads.values())
+        for task in tasks:
+            if not task.done():
+                task.cancel()
+        if tasks:
+            await asyncio.gather(*tasks, return_exceptions=True)
+        self._reads.clear()
+        await self._http.aclose()
 
 
 class WorkItems(list[dict]):
@@ -58,14 +168,19 @@ def _auth() -> dict[str, str]:
     return headers
 
 
-def start_client(**kwargs) -> httpx.AsyncClient:
+def start_client(**kwargs) -> GiteaTransport:
     """Create the application-lifetime Gitea transport."""
     global _client
-    _client = httpx.AsyncClient(base_url=GITEA_URL, timeout=10, **kwargs)
+    kwargs.setdefault("max_concurrency", int(os.getenv("GITEA_MAX_CONCURRENCY", "8")))
+    kwargs.setdefault(
+        "admission_timeout",
+        float(os.getenv("GITEA_ADMISSION_TIMEOUT_SECONDS", "0.25")),
+    )
+    _client = GiteaTransport(**kwargs)
     return _client
 
 
-def _get_client() -> httpx.AsyncClient:
+def _get_client() -> GiteaTransport:
     if _client is None or _client.is_closed:
         return start_client()
     return _client

src/idempotency.py

@@ -12,6 +12,10 @@ class Reservation:
     response: Any = None
 
 
+class IdempotencyLedgerBusy(RuntimeError):
+    """Raised when a durable completion cannot acquire the SQLite write lock."""
+
+
 class IdempotencyLedger:
     """Small durable ledger for replaying successful Gitea mutations."""
 
@@ -21,18 +25,22 @@ class IdempotencyLedger:
         *,
         ttl_seconds: float,
         max_entries: int,
+        lock_timeout_seconds: float = 0.1,
         clock: Callable[[], float] = time.time,
     ) -> None:
         self.path = Path(path)
         self.ttl_seconds = ttl_seconds
         self.max_entries = max_entries
+        self.lock_timeout_seconds = lock_timeout_seconds
         self.clock = clock
         self.path.parent.mkdir(parents=True, exist_ok=True)
         self._initialize()
 
     def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.path, timeout=5)
-        connection.execute("PRAGMA busy_timeout = 5000")
+        connection = sqlite3.connect(self.path, timeout=self.lock_timeout_seconds)
+        connection.execute(
+            f"PRAGMA busy_timeout = {max(1, int(self.lock_timeout_seconds * 1000))}"
+        )
         return connection
 
     def _initialize(self) -> None:
@@ -61,43 +69,48 @@ class IdempotencyLedger:
     def reserve(self, key: str, fingerprint: tuple[Any, ...]) -> Reservation:
         encoded = self._fingerprint(fingerprint)
         now = self.clock()
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            connection.execute(
-                "DELETE FROM idempotency_operations "
-                "WHERE status = 'completed' AND completed_at <= ?",
-                (now - self.ttl_seconds,),
-            )
-            row = connection.execute(
-                "SELECT fingerprint, status, response_json FROM idempotency_operations "
-                "WHERE key = ?",
-                (key,),
-            ).fetchone()
-            if row is not None:
-                if row[0] != encoded:
-                    return Reservation("conflict")
-                if row[1] == "completed":
-                    return Reservation("completed", json.loads(row[2]))
-                return Reservation("pending")
-            count = connection.execute(
-                "SELECT COUNT(*) FROM idempotency_operations"
-            ).fetchone()[0]
-            if count >= self.max_entries:
-                completed = connection.execute(
-                    "SELECT key FROM idempotency_operations "
-                    "WHERE status = 'completed' ORDER BY completed_at, rowid LIMIT 1"
-                ).fetchone()
-                if completed is None:
-                    return Reservation("busy")
+        try:
+            with self._connect() as connection:
+                connection.execute("BEGIN IMMEDIATE")
                 connection.execute(
-                    "DELETE FROM idempotency_operations WHERE key = ?",
-                    (completed[0],),
+                    "DELETE FROM idempotency_operations "
+                    "WHERE status = 'completed' AND completed_at <= ?",
+                    (now - self.ttl_seconds,),
                 )
-            connection.execute(
-                "INSERT INTO idempotency_operations "
-                "(key, fingerprint, status, created_at) VALUES (?, ?, 'pending', ?)",
-                (key, encoded, now),
-            )
+                row = connection.execute(
+                    "SELECT fingerprint, status, response_json FROM idempotency_operations "
+                    "WHERE key = ?",
+                    (key,),
+                ).fetchone()
+                if row is not None:
+                    if row[0] != encoded:
+                        return Reservation("conflict")
+                    if row[1] == "completed":
+                        return Reservation("completed", json.loads(row[2]))
+                    return Reservation("pending")
+                count = connection.execute(
+                    "SELECT COUNT(*) FROM idempotency_operations"
+                ).fetchone()[0]
+                if count >= self.max_entries:
+                    completed = connection.execute(
+                        "SELECT key FROM idempotency_operations "
+                        "WHERE status = 'completed' ORDER BY completed_at, rowid LIMIT 1"
+                    ).fetchone()
+                    if completed is None:
+                        return Reservation("busy")
+                    connection.execute(
+                        "DELETE FROM idempotency_operations WHERE key = ?",
+                        (completed[0],),
+                    )
+                connection.execute(
+                    "INSERT INTO idempotency_operations "
+                    "(key, fingerprint, status, created_at) VALUES (?, ?, 'pending', ?)",
+                    (key, encoded, now),
+                )
+        except sqlite3.OperationalError as exc:
+            if "locked" in str(exc).lower() or "busy" in str(exc).lower():
+                return Reservation("busy")
+            raise
         return Reservation("reserved")
 
     def clear(self) -> None:
@@ -106,9 +119,14 @@ class IdempotencyLedger:
 
     def complete(self, key: str, response: Any) -> None:
         encoded = json.dumps(response, separators=(",", ":"), sort_keys=True)
-        with self._connect() as connection:
-            connection.execute(
-                "UPDATE idempotency_operations SET status = 'completed', "
-                "response_json = ?, completed_at = ? WHERE key = ?",
-                (encoded, self.clock(), key),
-            )
+        try:
+            with self._connect() as connection:
+                connection.execute(
+                    "UPDATE idempotency_operations SET status = 'completed', "
+                    "response_json = ?, completed_at = ? WHERE key = ?",
+                    (encoded, self.clock(), key),
+                )
+        except sqlite3.OperationalError as exc:
+            if "locked" in str(exc).lower() or "busy" in str(exc).lower():
+                raise IdempotencyLedgerBusy from exc
+            raise

src/main.py

@@ -1,4 +1,5 @@
 import asyncio
+import hmac
 import math
 import os
 import time
@@ -8,12 +9,12 @@ from datetime import datetime
 from pathlib import Path
 from typing import Any, Literal
 
-from fastapi import FastAPI, Header, HTTPException, Path as PathParam, Query
-from fastapi.responses import JSONResponse
+from fastapi import FastAPI, Header, HTTPException, Path as PathParam, Query, Request, Response
+from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel, Field, PositiveInt, field_validator, model_validator
 
-from src import gitea_proxy
+from src import dashboard_auth, gitea_proxy
 from src.gitea_proxy import (
     activity_events,
     current_user,
@@ -26,7 +27,7 @@ from src.gitea_proxy import (
     pull_review_detail,
     repos,
 )
-from src.idempotency import IdempotencyLedger
+from src.idempotency import IdempotencyLedger, IdempotencyLedgerBusy
 from src.models import Issue, Milestone, PullRequest, Repo, User
 from src.suggestion_engine import compute
 from src.views import router as frontend_router
@@ -66,6 +67,9 @@ ISSUE_CREATION_IDEMPOTENCY_TTL_SECONDS = 600.0
 ISSUE_CREATION_IDEMPOTENCY_MAX_ENTRIES = 256
 AUTHORED_ACTION_IDEMPOTENCY_TTL_SECONDS = 600.0
 AUTHORED_ACTION_IDEMPOTENCY_MAX_ENTRIES = 256
+AUTHORED_ACTION_LEDGER_LOCK_TIMEOUT_SECONDS = float(
+    os.getenv("STACKCHAIN_IDEMPOTENCY_LOCK_TIMEOUT_SECONDS", "0.1")
+)
 NOTIFICATION_MUTATION_TIMEOUT_SECONDS = 5.0
 NOTIFICATION_PAGE_TIMEOUT_SECONDS = 5.0
 WORK_PAGE_TIMEOUT_SECONDS = 5.0
@@ -105,6 +109,7 @@ _idempotency_ledger = IdempotencyLedger(
         AUTHORED_ACTION_IDEMPOTENCY_MAX_ENTRIES
         + ISSUE_CREATION_IDEMPOTENCY_MAX_ENTRIES
     ),
+    lock_timeout_seconds=AUTHORED_ACTION_LEDGER_LOCK_TIMEOUT_SECONDS,
 )
 _available_issue_snapshot_task: asyncio.Task | None = None
 _available_issue_snapshot_value: list[dict] | None = None
@@ -120,6 +125,10 @@ class ReadinessPayloadError(ValueError):
     """Raised when Gitea returns a structurally invalid readiness payload."""
 
 
+class DashboardSignIn(BaseModel):
+    access_token: str = Field(min_length=1, max_length=1_024)
+
+
 class NotificationReadBatch(BaseModel):
     ids: list[PositiveInt] = Field(min_length=1, max_length=50)
 
@@ -264,7 +273,9 @@ async def _run_idempotent_authored_action(
     if not idempotency_key:
         return await asyncio.wait_for(operation, timeout=timeout)
 
-    reservation = _idempotency_ledger.reserve(idempotency_key, fingerprint)
+    reservation = await asyncio.to_thread(
+        _idempotency_ledger.reserve, idempotency_key, fingerprint
+    )
     if reservation.state == "conflict":
         operation.close()
         raise HTTPException(status_code=409, detail="Idempotency key already used")
@@ -294,7 +305,7 @@ async def _run_idempotent_authored_action(
     else:
         async def persist_result():
             result = await operation
-            _idempotency_ledger.complete(idempotency_key, result)
+            await asyncio.to_thread(_idempotency_ledger.complete, idempotency_key, result)
             return result
 
         task = asyncio.create_task(persist_result())
@@ -310,7 +321,14 @@ async def _run_idempotent_authored_action(
                 _authored_action_operations.pop(idempotency_key, None)
 
         task.add_done_callback(discard_completed)
-    return await asyncio.wait_for(asyncio.shield(task), timeout=timeout)
+    try:
+        return await asyncio.wait_for(asyncio.shield(task), timeout=timeout)
+    except IdempotencyLedgerBusy:
+        raise HTTPException(
+            status_code=503,
+            detail="This action may have completed; verify its result before retrying",
+            headers={"Retry-After": "5"},
+        )
 
 
 def _context_payload(user_data, repo_data, issues_data, prs_data) -> dict:
@@ -410,21 +428,63 @@ app.mount("/static", StaticFiles(directory=FRONTEND_DIR), name="static")
 app.include_router(frontend_router)
 
 
+@app.middleware("http")
+async def require_operator_session(request: Request, call_next):
+    if not dashboard_auth.enabled():
+        return await call_next(request)
+
+    path = dashboard_auth.application_path(request)
+    public = (
+        path in {"/healthz", "/readyz", "/login", "/manifest.webmanifest"}
+        or path.startswith("/static/")
+        or (path == "/api/v1/session" and request.method == "POST")
+    )
+    session = dashboard_auth.request_session(request)
+    if not public and session is None:
+        if path.startswith("/api/"):
+            return JSONResponse(
+                {"detail": "Authentication required"},
+                status_code=401,
+                headers={"Cache-Control": "no-store"},
+            )
+        return RedirectResponse("login", status_code=303, headers={"Cache-Control": "no-store"})
+
+    if not public and request.method not in {"GET", "HEAD", "OPTIONS"}:
+        supplied_csrf = request.headers.get("x-csrf-token", "")
+        if (
+            session is None
+            or not dashboard_auth.same_origin(request)
+            or not supplied_csrf
+            or not hmac.compare_digest(supplied_csrf, session.csrf)
+        ):
+            return JSONResponse(
+                {"detail": "Valid same-origin CSRF proof required"},
+                status_code=403,
+                headers={"Cache-Control": "no-store"},
+            )
+    request.state.dashboard_session = session
+    response = await call_next(request)
+    if path in {"/login", "/api/v1/session"}:
+        response.headers["Cache-Control"] = "no-store"
+    return response
+
+
 @app.middleware("http")
 async def prevent_live_api_caching(request, call_next):
     response = await call_next(request)
-    if request.url.path in {"/api/v1/context", "/api/v1/events", "/api/v1/live", "/api/v1/available-issues", "/api/v1/search", "/api/v1/work-route"} or request.url.path.startswith("/api/v1/work/") or (
-        request.url.path.startswith("/api/v1/repos/")
-        and request.url.path.endswith("/review")
-    ) or request.url.path.startswith("/api/v1/notifications") or (
-        request.url.path.startswith("/api/v1/repos/")
-        and ("/issues/" in request.url.path or "/pulls/" in request.url.path)
+    path = dashboard_auth.application_path(request)
+    if path in {"/api/v1/context", "/api/v1/background-identity", "/api/v1/events", "/api/v1/live", "/api/v1/available-issues", "/api/v1/search", "/api/v1/work-route"} or path.startswith("/api/v1/work/") or (
+        path.startswith("/api/v1/repos/")
+        and path.endswith("/review")
+    ) or path.startswith("/api/v1/notifications") or (
+        path.startswith("/api/v1/repos/")
+        and ("/issues/" in path or "/pulls/" in path)
     ) or (
-        request.url.path.startswith("/api/v1/repos/")
-        and request.url.path.endswith("/issues")
+        path.startswith("/api/v1/repos/")
+        and path.endswith("/issues")
     ) or (
-        request.url.path.startswith("/api/v1/repos/")
-        and request.url.path.endswith(("/labels", "/milestones"))
+        path.startswith("/api/v1/repos/")
+        and path.endswith(("/labels", "/milestones"))
     ):
         response.headers["Cache-Control"] = "no-store"
     return response
@@ -436,6 +496,68 @@ def health() -> dict[str, str]:
     return {"status": "ok", "service": "stackchain-dashboard"}
 
 
+@app.post("/api/v1/session")
+async def sign_in(payload: DashboardSignIn, request: Request, response: Response):
+    configured_token = dashboard_auth.access_token()
+    if not configured_token or not hmac.compare_digest(
+        payload.access_token, configured_token
+    ):
+        raise HTTPException(status_code=401, detail="Invalid access token")
+    signed, session = dashboard_auth.issue_session()
+    path = dashboard_auth.cookie_path(request)
+    max_age = max(1, session.expires_at - int(time.time()))
+    response.set_cookie(
+        dashboard_auth.SESSION_COOKIE,
+        signed,
+        max_age=max_age,
+        path=path,
+        secure=True,
+        httponly=True,
+        samesite="strict",
+    )
+    response.set_cookie(
+        dashboard_auth.CSRF_COOKIE,
+        session.csrf,
+        max_age=max_age,
+        path=path,
+        secure=True,
+        httponly=False,
+        samesite="strict",
+    )
+    response.headers["Cache-Control"] = "no-store"
+    return {"authenticated": True}
+
+
+@app.get("/api/v1/session")
+async def session_status(request: Request):
+    session = dashboard_auth.request_session(request)
+    return {
+        "authenticated": session is not None,
+        "csrf_token": session.csrf if session is not None else "",
+    }
+
+
+@app.delete("/api/v1/session")
+async def sign_out(request: Request, response: Response):
+    path = dashboard_auth.cookie_path(request)
+    response.delete_cookie(
+        dashboard_auth.SESSION_COOKIE,
+        path=path,
+        secure=True,
+        httponly=True,
+        samesite="strict",
+    )
+    response.delete_cookie(
+        dashboard_auth.CSRF_COOKIE,
+        path=path,
+        secure=True,
+        httponly=False,
+        samesite="strict",
+    )
+    response.headers["Cache-Control"] = "no-store"
+    return {"authenticated": False, "clear_private_device_data": True}
+
+
 @app.get("/readyz")
 async def readiness():
     """Return readiness after verifying the configured Gitea connection."""
@@ -469,11 +591,13 @@ async def readiness():
                 "Retry-After": str(max(1, math.ceil(READINESS_TIMEOUT_SECONDS)))
             } if timed_out else None,
         )
-    return {
+    payload = {
         "status": "ready",
         "service": "stackchain-dashboard",
-        "gitea_user": user["login"],
     }
+    if not dashboard_auth.enabled():
+        payload["gitea_user"] = user["login"]
+    return payload
 
 
 @app.get("/api/v1/context")
@@ -520,6 +644,23 @@ async def context() -> JSONResponse:
     return JSONResponse(_context_payload(user_data, repo_data, issues_data, prs_data))
 
 
+@app.get("/api/v1/background-identity")
+async def background_identity() -> JSONResponse:
+    """Return only the account key required to safely drain a browser outbox."""
+    try:
+        user = await current_user()
+        login = user.get("login") if isinstance(user, dict) else None
+        if not isinstance(login, str) or not login.strip():
+            raise ValueError("Gitea user response did not include a login")
+    except Exception:
+        return JSONResponse(
+            {"error": "Gitea identity is temporarily unavailable"},
+            status_code=503,
+            headers={"Retry-After": "1"},
+        )
+    return JSONResponse({"login": login})
+
+
 @app.get("/api/v1/search")
 async def global_search(
     q: str = Query(min_length=2, max_length=100),

src/views.py

@@ -8,6 +8,14 @@ DASHBOARD_FILE = Path(__file__).resolve().parent.parent / "frontend" / "index.ht
 MANIFEST_FILE = DASHBOARD_FILE.parent / "manifest.webmanifest"
 SERVICE_WORKER_FILE = DASHBOARD_FILE.parent / "service-worker.js"
 
+LOGIN_HTML = """<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Sign in · Stackchain Dashboard</title>
+<style>body{margin:0;background:#07111f;color:#eef6ff;font:16px system-ui;display:grid;min-height:100vh;place-items:center}main{width:min(90vw,24rem);padding:2rem;border:1px solid #29415d;border-radius:1rem;background:#0d1b2b}label,input,button{display:block;width:100%;box-sizing:border-box}input,button{min-height:48px;margin-top:.6rem;border-radius:.6rem;border:1px solid #49647f;padding:.75rem}button{margin-top:1rem;background:#55d6be;color:#06121b;font-weight:700}p{color:#a9bed3}</style></head>
+<body><main><h1>Operator sign in</h1><p>Enter the dashboard access token. It is exchanged for a private, short-lived session and is never stored on this device.</p>
+<form id="sign-in"><label>Access token<input name="access_token" type="password" autocomplete="current-password" required></label><button>Sign in</button><p id="status" role="status"></p></form></main>
+<script>document.getElementById('sign-in').addEventListener('submit',async(event)=>{event.preventDefault();const status=document.getElementById('status');status.textContent='Signing in…';const access_token=new FormData(event.currentTarget).get('access_token');const response=await fetch('api/v1/session',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({access_token})});if(response.ok){location.replace('./');return}status.textContent='Sign-in failed. Check the token and try again.';event.currentTarget.reset()});</script></body></html>"""
+
 
 class RevalidatingHTMLResponse(HTMLResponse):
     def __init__(self, content, status_code=200, headers=None, media_type=None, background=None):
@@ -21,6 +29,11 @@ async def dashboard() -> str:
     return DASHBOARD_FILE.read_text()
 
 
+@router.get("/login", response_class=RevalidatingHTMLResponse)
+async def login() -> str:
+    return LOGIN_HTML
+
+
 @router.get("/manifest.webmanifest", response_class=FileResponse)
 async def web_app_manifest() -> FileResponse:
     return FileResponse(MANIFEST_FILE, media_type="application/manifest+json")

tests/test_authored_idempotency.py

@@ -1,4 +1,7 @@
 import asyncio
+import sqlite3
+import threading
+import time
 
 import httpx
 import pytest
@@ -228,3 +231,170 @@ async def test_orphaned_pending_comment_fails_closed_without_upstream_retry(
         "This action may still be completing; verify its result before retrying"
     )
     assert calls == 0
+
+
+@pytest.mark.anyio
+async def test_slow_ledger_reservation_does_not_block_health_requests(monkeypatch):
+    async def assigned(_repository, _number):
+        return True
+
+    async def comment(_repository, _number, body):
+        return {"id": 248, "body": body}
+
+    started = threading.Event()
+    original_reserve = main._idempotency_ledger.reserve
+
+    def slow_reserve(key, fingerprint):
+        started.set()
+        time.sleep(0.2)
+        return original_reserve(key, fingerprint)
+
+    monkeypatch.setattr(main._idempotency_ledger, "reserve", slow_reserve)
+    monkeypatch.setattr(main.gitea_proxy, "is_assigned_issue", assigned)
+    monkeypatch.setattr(main.gitea_proxy, "comment_on_issue", comment)
+    transport = httpx.ASGITransport(app=main.app)
+
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        started_at = asyncio.get_running_loop().time()
+        authored = asyncio.create_task(client.post(
+            "/api/v1/repos/stackchain/api/issues/248/comments",
+            json={"body": "Keep the dashboard responsive"},
+            headers={"Idempotency-Key": "contention-248"},
+        ))
+        assert await asyncio.to_thread(started.wait, 1)
+        health = await client.get("/healthz")
+        health_elapsed = asyncio.get_running_loop().time() - started_at
+        authored_response = await authored
+
+    assert health.status_code == 200
+    assert health_elapsed < 0.15
+    assert authored_response.status_code == 201
+
+
+@pytest.mark.anyio
+async def test_locked_ledger_returns_bounded_retryable_response(monkeypatch, tmp_path):
+    upstream_calls = 0
+
+    async def assigned(_repository, _number):
+        return True
+
+    async def comment(_repository, _number, body):
+        nonlocal upstream_calls
+        upstream_calls += 1
+        return {"id": 248, "body": body}
+
+    database = tmp_path / "contended.sqlite3"
+    ledger = IdempotencyLedger(
+        database,
+        ttl_seconds=600,
+        max_entries=256,
+        lock_timeout_seconds=0.05,
+    )
+    monkeypatch.setattr(main, "_idempotency_ledger", ledger)
+    monkeypatch.setattr(main.gitea_proxy, "is_assigned_issue", assigned)
+    monkeypatch.setattr(main.gitea_proxy, "comment_on_issue", comment)
+    blocker = sqlite3.connect(database)
+    blocker.execute("BEGIN IMMEDIATE")
+    transport = httpx.ASGITransport(app=main.app)
+
+    try:
+        async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+            started_at = asyncio.get_running_loop().time()
+            response = await client.post(
+                "/api/v1/repos/stackchain/api/issues/248/comments",
+                json={"body": "Retry without freezing"},
+                headers={"Idempotency-Key": "locked-ledger-248"},
+            )
+            elapsed = asyncio.get_running_loop().time() - started_at
+    finally:
+        blocker.rollback()
+        blocker.close()
+
+    assert response.status_code == 503
+    assert response.headers["Retry-After"] == "1"
+    assert response.json()["detail"] == "Authored action queue is busy; please retry"
+    assert elapsed < 0.5
+    assert upstream_calls == 0
+
+
+@pytest.mark.anyio
+async def test_slow_ledger_completion_does_not_block_health_requests(monkeypatch):
+    async def assigned(_repository, _number):
+        return True
+
+    async def comment(_repository, _number, body):
+        return {"id": 249, "body": body}
+
+    started = threading.Event()
+    original_complete = main._idempotency_ledger.complete
+
+    def slow_complete(key, response):
+        started.set()
+        time.sleep(0.2)
+        return original_complete(key, response)
+
+    monkeypatch.setattr(main._idempotency_ledger, "complete", slow_complete)
+    monkeypatch.setattr(main.gitea_proxy, "is_assigned_issue", assigned)
+    monkeypatch.setattr(main.gitea_proxy, "comment_on_issue", comment)
+    transport = httpx.ASGITransport(app=main.app)
+
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        started_at = asyncio.get_running_loop().time()
+        authored = asyncio.create_task(client.post(
+            "/api/v1/repos/stackchain/api/issues/248/comments",
+            json={"body": "Persist without freezing"},
+            headers={"Idempotency-Key": "slow-completion-248"},
+        ))
+        assert await asyncio.to_thread(started.wait, 1)
+        health = await client.get("/healthz")
+        health_elapsed = asyncio.get_running_loop().time() - started_at
+        authored_response = await authored
+
+    assert health.status_code == 200
+    assert health_elapsed < 0.15
+    assert authored_response.status_code == 201
+
+
+@pytest.mark.anyio
+async def test_locked_completion_fails_closed_with_retry_guidance(monkeypatch, tmp_path):
+    database = tmp_path / "completion-contention.sqlite3"
+    ledger = IdempotencyLedger(
+        database, ttl_seconds=600, max_entries=256, lock_timeout_seconds=0.05
+    )
+    blocker = None
+
+    async def assigned(_repository, _number):
+        return True
+
+    async def comment(_repository, _number, body):
+        nonlocal blocker
+        blocker = sqlite3.connect(database)
+        blocker.execute("BEGIN IMMEDIATE")
+        return {"id": 250, "body": body}
+
+    monkeypatch.setattr(main, "_idempotency_ledger", ledger)
+    monkeypatch.setattr(main.gitea_proxy, "is_assigned_issue", assigned)
+    monkeypatch.setattr(main.gitea_proxy, "comment_on_issue", comment)
+    transport = httpx.ASGITransport(app=main.app)
+
+    try:
+        async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+            response = await client.post(
+                "/api/v1/repos/stackchain/api/issues/248/comments",
+                json={"body": "The upstream mutation may already exist"},
+                headers={"Idempotency-Key": "locked-completion-248"},
+            )
+    finally:
+        if blocker is not None:
+            blocker.rollback()
+            blocker.close()
+
+    assert response.status_code == 503
+    assert response.headers["Retry-After"] == "5"
+    assert response.json()["detail"] == (
+        "This action may have completed; verify its result before retrying"
+    )
+    assert ledger.reserve(
+        "locked-completion-248",
+        ("issue-comment", "stackchain/api", 248, "The upstream mutation may already exist"),
+    ).state == "pending"

tests/test_authored_outbox.py

@@ -152,6 +152,63 @@ process.stdout.write(JSON.stringify({{first,second,items:outbox.list()}}));
     assert len(output["items"]) == 1
 
 
+def test_authored_outbox_mirrors_to_background_sync_and_reconciles_worker_results():
+    script = f"""
+const createAuthoredOutbox = require({json.dumps(str(OUTBOX))});
+const values = new Map(); const mirrors=[]; let requested=0;
+const storage = {{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v)}};
+const backgroundSync = {{
+  reconcile: async (items, lane) => mirrors.push({{items:items.map(item=>({{...item}})),lane}}),
+  requestSync: async () => {{requested += 1;}},
+}};
+const outbox=createAuthoredOutbox({{storage,getOwnerLogin:()=>'timmy',backgroundSync}});
+const sent=outbox.enqueue({{kind:'issue-comment',repository:'o/r',number:1,body:'Sent',operationId:'sent'}});
+const failed=outbox.enqueue({{kind:'update-reply',notificationId:2,body:'Fix me',operationId:'failed'}});
+setTimeout(() => {{
+  const reconciled=outbox.reconcileBackground([
+    {{...sent,status:'sent'}},
+    {{...failed,status:'attention',error:'Reply rejected'}},
+  ]);
+  setTimeout(() => process.stdout.write(JSON.stringify({{mirrors,requested,reconciled}})), 0);
+}}, 0);
+"""
+    output = run_node(script)
+
+    assert output["mirrors"][0]["lane"] == "authored"
+    assert [item["operationId"] for item in output["mirrors"][-1]["items"]] == ["failed"]
+    assert output["requested"] >= 1
+    assert [(item["operationId"], item["status"]) for item in output["reconciled"]] == [
+        ("failed", "attention")
+    ]
+
+
+def test_authored_outbox_foreground_send_uses_atomic_background_delivery():
+    script = f"""
+const createAuthoredOutbox = require({json.dumps(str(OUTBOX))});
+const values = new Map(); let backgroundCalls=0; let directCalls=0;
+const storage = {{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v)}};
+const backgroundSync = {{
+  reconcile: async()=>{{}}, requestSync:async()=>{{}},
+  send: async (item, owner) => {{backgroundCalls += 1; return {{message:{{id:3,owner}}}};}},
+}};
+const outbox=createAuthoredOutbox({{
+  storage,getOwnerLogin:()=>'timmy',backgroundSync,
+  fetchJson:async()=>{{directCalls += 1; return {{id:4}};}},
+}});
+outbox.enqueue({{kind:'pull-comment',repository:'o/r',number:2,body:'Review',operationId:'once'}});
+(async()=>{{
+  const result=await outbox.flush('timmy');
+  process.stdout.write(JSON.stringify({{backgroundCalls,directCalls,result,remaining:outbox.list()}}));
+}})();
+"""
+    output = run_node(script)
+
+    assert output["backgroundCalls"] == 1
+    assert output["directCalls"] == 0
+    assert output["result"]["confirmed"] == [{"id": 3, "owner": "timmy"}]
+    assert output["remaining"] == []
+
+
 @pytest.mark.anyio
 async def test_mobile_dashboard_loads_and_operates_authored_message_outbox():
     html = await dashboard()
@@ -164,3 +221,5 @@ async def test_mobile_dashboard_loads_and_operates_authored_message_outbox():
     assert "authoredOutbox.retry(item.outbox_id, activeFlushLogin)" in html
     assert "authoredOutbox.discard(item.outbox_id)" in html
     assert "if (result?.queued)" in html
+    assert "backgroundSync: backgroundIssueSync" in html
+    assert "authoredOutbox.reconcileBackground(records)" in html

tests/test_background_issue_sync.py

@@ -0,0 +1,394 @@
+import json
+import subprocess
+from pathlib import Path
+
+import httpx
+import pytest
+
+from src import main
+from src.views import dashboard
+
+
+SYNC = Path(__file__).parents[1] / "frontend" / "background-issue-sync.js"
+
+
+def run_node(script: str) -> dict:
+    completed = subprocess.run(
+        ["node", "-e", script], capture_output=True, check=True, text=True
+    )
+    return json.loads(completed.stdout)
+
+
+def test_closed_app_sync_delivers_matching_issue_once_with_original_idempotency_key():
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+const item = {{
+  id:'capture-1', operationId:'capture-1', ownerLogin:'timmy', status:'queued',
+  repository:'stackchain/api', title:'Offline report', body:'Full context',
+  labelIds:[3], milestoneId:4, dueDate:'2026-08-09', queuedAt:100,
+}};
+const state = {{item, completed:[], released:[], failed:[], calls:[]}};
+const store = {{
+  claimNext: async owner => state.item && state.item.ownerLogin === owner ? {{...state.item}} : null,
+  complete: async id => {{ state.completed.push(id); state.item = null; }},
+  release: async id => state.released.push(id),
+  fail: async (id, message) => state.failed.push({{id,message}}),
+}};
+const fetchJson = async (url, options = {{}}) => {{
+  state.calls.push({{url,options}});
+  if (url === 'api/v1/background-identity') return {{login:'timmy'}};
+  return {{repository:'stackchain/api',number:251,title:'Offline report'}};
+}};
+(async () => {{
+  const sync = createBackgroundIssueSync({{store,fetchJson}});
+  const result = await sync.flush();
+  process.stdout.write(JSON.stringify({{state,result}}));
+}})();
+"""
+    output = run_node(script)
+
+    assert output["result"]["confirmed"][0]["number"] == 251
+    assert output["state"]["completed"] == ["capture-1"]
+    assert output["state"]["released"] == []
+    assert output["state"]["failed"] == []
+    assert output["state"]["calls"][0]["url"] == "api/v1/background-identity"
+    mutation = output["state"]["calls"][1]
+    assert mutation["url"] == "api/v1/repos/stackchain/api/issues"
+    assert mutation["options"]["headers"]["Idempotency-Key"] == "capture-1"
+    assert json.loads(mutation["options"]["body"]) == {
+        "title": "Offline report",
+        "body": "Full context",
+        "label_ids": [3],
+        "milestone_id": 4,
+        "due_date": "2026-08-09T23:59:59Z",
+    }
+
+
+@pytest.mark.parametrize(
+    ("item", "expected_url"),
+    [
+        (
+            {"kind": "issue-comment", "repository": "stackchain/api", "number": 7},
+            "api/v1/repos/stackchain/api/issues/7/comments",
+        ),
+        (
+            {"kind": "pull-comment", "repository": "stackchain/web", "number": 8},
+            "api/v1/repos/stackchain/web/pulls/8/comments",
+        ),
+        (
+            {"kind": "update-reply", "notificationId": 9},
+            "api/v1/notifications/9/reply",
+        ),
+    ],
+)
+def test_closed_app_sync_delivers_each_authored_message_kind(item, expected_url):
+    authored = {
+        "id": "message-op",
+        "operationId": "message-op",
+        "ownerLogin": "timmy",
+        "status": "queued",
+        "body": "Ship this reply",
+        **item,
+    }
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+let queued = {json.dumps(authored)};
+const calls = [];
+const store = {{
+  claimNext: async owner => queued?.ownerLogin === owner ? (queued = null, {json.dumps(authored)}) : null,
+  complete: async () => {{}}, release: async () => {{}}, fail: async () => {{}},
+  countBlocked: async () => 0,
+}};
+const fetchJson = async (url, options = {{}}) => {{
+  calls.push({{url, options}});
+  if (url === 'api/v1/background-identity') return {{login:'timmy'}};
+  return {{id:42}};
+}};
+(async () => {{
+  const result = await createBackgroundIssueSync({{store,fetchJson}}).flush();
+  process.stdout.write(JSON.stringify({{calls,result}}));
+}})();
+"""
+    output = run_node(script)
+
+    mutation = output["calls"][1]
+    assert mutation["url"] == expected_url
+    assert mutation["options"]["headers"]["Idempotency-Key"] == "message-op"
+    assert json.loads(mutation["options"]["body"]) == {"body": "Ship this reply"}
+    assert output["result"]["confirmed"] == [{"id": 42}]
+
+
+def test_reconciling_one_outbox_lane_preserves_the_other_lane():
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+const records=new Map();let tail=Promise.resolve();
+const transaction=work=>{{const run=tail.then(()=>work({{
+  getAll:async()=>[...records.values()].map(value=>({{...value}})),
+  put:async value=>records.set(value.id,{{...value}}),delete:async id=>records.delete(id),
+}}));tail=run.catch(()=>{{}});return run;}};
+(async()=>{{
+  const store=createBackgroundIssueSync.createIssueSyncStore({{transaction}});
+  await store.reconcile([{{id:'issue',ownerLogin:'timmy',status:'queued'}}], 'issue');
+  await store.reconcile([{{id:'message',kind:'issue-comment',ownerLogin:'timmy',status:'queued'}}], 'authored');
+  await store.reconcile([], 'issue');
+  process.stdout.write(JSON.stringify(await store.snapshot()));
+}})();
+"""
+    output = run_node(script)
+
+    assert output == [
+        {"id": "message", "kind": "issue-comment", "ownerLogin": "timmy", "status": "queued", "outboxLane": "authored"}
+    ]
+
+
+def test_closed_app_sync_leaves_another_accounts_issue_queued():
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+const state = {{owners:[],mutations:0}};
+const store = {{
+  claimNext: async owner => {{ state.owners.push(owner); return null; }},
+  countBlocked: async owner => owner === 'alexander' ? 1 : 0,
+  complete: async () => {{}},
+}};
+const fetchJson = async url => {{
+  if (url === 'api/v1/background-identity') return {{login:'alexander'}};
+  state.mutations += 1;
+}};
+(async () => {{
+  const result = await createBackgroundIssueSync({{store,fetchJson}}).flush();
+  process.stdout.write(JSON.stringify({{state,result}}));
+}})();
+"""
+    output = run_node(script)
+
+    assert output["state"] == {"owners": ["alexander"], "mutations": 0}
+    assert output["result"]["confirmed"] == []
+    assert output["result"]["blocked"] == 1
+
+
+def test_transient_delivery_failure_releases_claim_and_requests_another_sync():
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+let item = {{id:'capture-2',operationId:'capture-2',ownerLogin:'timmy',repository:'o/r',title:'Retry',body:'Later',labelIds:[]}};
+const state = {{released:[],completed:[]}};
+const store = {{
+  claimNext: async () => item ? (item = null, {{id:'capture-2',operationId:'capture-2',ownerLogin:'timmy',repository:'o/r',title:'Retry',body:'Later',labelIds:[]}}) : null,
+  release: async id => state.released.push(id),
+  complete: async id => state.completed.push(id),
+}};
+const fetchJson = async url => {{
+  if (url === 'api/v1/background-identity') return {{login:'timmy'}};
+  const error = new Error('Gitea unavailable'); error.status = 503; throw error;
+}};
+(async () => {{
+  let error = null;
+  try {{ await createBackgroundIssueSync({{store,fetchJson}}).flush(); }}
+  catch (caught) {{ error = caught.message; }}
+  process.stdout.write(JSON.stringify({{state,error}}));
+}})();
+"""
+    output = run_node(script)
+
+    assert output["state"]["released"] == ["capture-2"]
+    assert output["state"]["completed"] == []
+    assert output["error"] == "Gitea unavailable"
+
+
+def test_permanent_delivery_failure_marks_issue_for_foreground_attention():
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+let claimed = false;
+const state = {{failed:[],released:[]}};
+const store = {{
+  claimNext: async () => claimed ? null : (claimed = true, {{id:'capture-3',operationId:'capture-3',ownerLogin:'timmy',repository:'o/r',title:'Invalid',body:'',labelIds:[]}}),
+  fail: async (id, message) => state.failed.push({{id,message}}),
+  release: async id => state.released.push(id),
+  countBlocked: async () => 0,
+}};
+const fetchJson = async url => {{
+  if (url === 'api/v1/background-identity') return {{login:'timmy'}};
+  const error = new Error('Title is invalid'); error.status = 422; throw error;
+}};
+(async () => {{
+  const result = await createBackgroundIssueSync({{store,fetchJson}}).flush();
+  process.stdout.write(JSON.stringify({{state,result}}));
+}})();
+"""
+    output = run_node(script)
+
+    assert output["state"]["failed"] == [
+        {"id": "capture-3", "message": "Title is invalid"}
+    ]
+    assert output["state"]["released"] == []
+    assert output["result"]["attention"] == 1
+
+
+def test_issue_store_atomically_grants_one_delivery_claim():
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+const records = new Map();
+let tail = Promise.resolve();
+const transaction = work => {{
+  const run = tail.then(() => work({{
+    getAll: async () => [...records.values()].map(value => ({{...value}})),
+    put: async value => records.set(value.id, {{...value}}),
+    delete: async id => records.delete(id),
+  }}));
+  tail = run.catch(() => {{}});
+  return run;
+}};
+(async () => {{
+  const store = createBackgroundIssueSync.createIssueSyncStore({{transaction,now:()=>1000,claimMs:5000}});
+  await store.reconcile([{{id:'same',operationId:'same',ownerLogin:'timmy',status:'queued',repository:'o/r',title:'Once',labelIds:[]}}]);
+  const claims = await Promise.all([store.claimNext('timmy'),store.claimNext('timmy')]);
+  process.stdout.write(JSON.stringify({{claims,records:[...records.values()]}}));
+}})();
+"""
+    output = run_node(script)
+
+    assert sum(claim is not None for claim in output["claims"]) == 1
+    assert output["records"][0]["status"] == "sending"
+    assert output["records"][0]["claimUntil"] == 6000
+
+
+def test_foreground_and_worker_race_still_posts_one_issue():
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+const records = new Map(); let tail = Promise.resolve();
+const transaction = work => {{
+  const run = tail.then(() => work({{
+    getAll:async()=>[...records.values()].map(value=>({{...value}})),
+    put:async value=>records.set(value.id,{{...value}}), delete:async id=>records.delete(id),
+  }}));
+  tail=run.catch(()=>{{}}); return run;
+}};
+const item={{id:'race',operationId:'race',ownerLogin:'timmy',status:'queued',repository:'o/r',title:'Exactly once',body:'',labelIds:[]}};
+let mutations=0;
+const fetchJson=async url=>{{
+  if(url==='api/v1/background-identity') return {{login:'timmy'}};
+  mutations+=1; return {{number:77}};
+}};
+(async()=>{{
+  const store=createBackgroundIssueSync.createIssueSyncStore({{transaction}});
+  await store.reconcile([item]);
+  const sync=createBackgroundIssueSync({{store,fetchJson}});
+  const [foreground,worker]=await Promise.all([sync.send(item,'timmy'),sync.flush()]);
+  process.stdout.write(JSON.stringify({{foreground,worker,mutations,remaining:[...records.values()]}}));
+}})();
+"""
+    output = run_node(script)
+
+    assert output["mutations"] == 1
+    assert len(output["remaining"]) == 1
+    assert output["remaining"][0]["status"] == "sent"
+    delivered = int(bool(output["foreground"].get("issue"))) + len(
+        output["worker"]["confirmed"]
+    )
+    assert delivered == 1
+
+
+def test_foreground_send_upserts_before_claim_when_mirror_is_still_pending():
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+let record = null; const state={{upserts:0,mutations:0}};
+const store={{
+  upsert:async item=>{{state.upserts+=1;record={{...item}};}},
+  claim:async(id,owner)=>record?.id===id&&record?.ownerLogin===owner?{{...record}}:null,
+  complete:async()=>{{record=null;}}, release:async()=>{{}}, fail:async()=>{{}},
+}};
+const fetchJson=async()=>{{state.mutations+=1;return {{number:88}};}};
+(async()=>{{
+  const sync=createBackgroundIssueSync({{store,fetchJson}});
+  const result=await sync.send({{id:'early',operationId:'early',ownerLogin:'timmy',repository:'o/r',title:'Fast',body:'',labelIds:[]}},'timmy');
+  process.stdout.write(JSON.stringify({{state,result,record}}));
+}})();
+"""
+    output = run_node(script)
+
+    assert output["state"] == {"upserts": 1, "mutations": 1}
+    assert output["result"]["issue"]["number"] == 88
+    assert output["record"] is None
+
+
+def test_completed_delivery_leaves_non_replayable_tombstone_for_next_page():
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+const records=new Map();let tail=Promise.resolve();
+const transaction=work=>{{const run=tail.then(()=>work({{
+  getAll:async()=>[...records.values()].map(value=>({{...value}})),
+  put:async value=>records.set(value.id,{{...value}}),delete:async id=>records.delete(id),
+}}));tail=run.catch(()=>{{}});return run;}};
+(async()=>{{
+  const store=createBackgroundIssueSync.createIssueSyncStore({{transaction,now:()=>100}});
+  await store.reconcile([{{id:'done',ownerLogin:'timmy',status:'queued'}}]);
+  await store.claimNext('timmy');
+  await store.complete('done');
+  const replay=await store.claimNext('timmy');
+  const snapshot=await store.snapshot();
+  process.stdout.write(JSON.stringify({{replay,snapshot}}));
+}})();
+"""
+    output = run_node(script)
+
+    assert output["replay"] is None
+    assert output["snapshot"] == [
+        {"id": "done", "ownerLogin": "timmy", "status": "sent", "outboxLane": "issue", "claimUntil": 0}
+    ]
+
+
+def test_user_edit_resets_worker_attention_item_for_retry():
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+const records=new Map([['edit',{{id:'edit',ownerLogin:'timmy',status:'attention',title:'Bad',error:'Invalid'}}]]);
+let tail=Promise.resolve();
+const transaction=work=>{{const run=tail.then(()=>work({{
+  getAll:async()=>[...records.values()].map(value=>({{...value}})),
+  put:async value=>records.set(value.id,{{...value}}),delete:async id=>records.delete(id),
+}}));tail=run.catch(()=>{{}});return run;}};
+(async()=>{{
+  const store=createBackgroundIssueSync.createIssueSyncStore({{transaction,now:()=>100}});
+  await store.reconcile([{{id:'edit',ownerLogin:'timmy',status:'queued',title:'Fixed'}}]);
+  const claimed=await store.claimNext('timmy');
+  process.stdout.write(JSON.stringify(claimed));
+}})();
+"""
+    output = run_node(script)
+
+    assert output["title"] == "Fixed"
+    assert output["status"] == "sending"
+    assert "error" not in output
+
+
+@pytest.mark.anyio
+async def test_background_identity_is_lightweight_and_never_cacheable(monkeypatch):
+    calls = 0
+
+    async def user():
+        nonlocal calls
+        calls += 1
+        return {"id": 7, "login": "timmy", "email": "private@example.com"}
+
+    monkeypatch.setattr(main, "current_user", user)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.get("/api/v1/background-identity")
+
+    assert response.status_code == 200
+    assert response.json() == {"login": "timmy"}
+    assert response.headers["cache-control"] == "no-store"
+    assert calls == 1
+
+
+@pytest.mark.anyio
+async def test_dashboard_wires_indexeddb_outbox_and_background_sync_fallback():
+    html = await dashboard()
+
+    assert '<script src="static/background-issue-sync.js"></script>' in html
+    assert "const backgroundIssueStore = createIssueSyncStore();" in html
+    assert "createBackgroundIssueSync({" in html
+    assert "backgroundSync: backgroundIssueSync" in html
+    assert "registration.sync.register('stackchain-issue-outbox-v1')" in html
+    assert "backgroundIssueSync.snapshot().then(records => {" in html
+    assert "issueOutbox.reconcileBackground(records);" in html
+    assert "authoredOutbox.reconcileBackground(records);" in html
+    assert "if ('indexedDB' in window)" in html

tests/test_dashboard_auth.py

@@ -0,0 +1,186 @@
+import httpx
+import pytest
+
+from src import main
+
+
+@pytest.fixture
+def access_control(monkeypatch):
+    monkeypatch.setenv("STACKCHAIN_DASHBOARD_ACCESS_TOKEN", "correct horse battery staple")
+    monkeypatch.setenv("STACKCHAIN_DASHBOARD_SESSION_SECRET", "a-separate-session-signing-secret-with-enough-entropy")
+
+
+@pytest.mark.anyio
+async def test_anonymous_private_request_is_rejected_before_gitea(access_control, monkeypatch):
+    called = False
+
+    async def user():
+        nonlocal called
+        called = True
+        return {"id": 1, "login": "timmy"}
+
+    monkeypatch.setattr(main, "current_user", user)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        response = await client.get("/api/v1/context")
+
+    assert response.status_code == 401
+    assert response.json() == {"detail": "Authentication required"}
+    assert response.headers["cache-control"] == "no-store"
+    assert called is False
+
+
+@pytest.mark.anyio
+async def test_sign_in_creates_secure_session_without_echoing_access_token(access_control):
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        response = await client.post(
+            "/api/v1/session", json={"access_token": "correct horse battery staple"}
+        )
+
+    assert response.status_code == 200
+    assert response.json() == {"authenticated": True}
+    cookies = response.headers.get_list("set-cookie")
+    assert any("stackchain_session=" in value and "HttpOnly" in value and "Secure" in value and "SameSite=strict" in value for value in cookies)
+    assert any("stackchain_csrf=" in value and "Secure" in value and "SameSite=strict" in value and "HttpOnly" not in value for value in cookies)
+    assert "correct horse battery staple" not in response.text
+    assert response.headers["cache-control"] == "no-store"
+
+
+@pytest.mark.anyio
+async def test_authenticated_get_reaches_private_api(access_control, monkeypatch):
+    async def user():
+        return {"id": 1, "login": "timmy", "full_name": "", "email": ""}
+
+    async def empty():
+        return []
+
+    monkeypatch.setattr(main, "current_user", user)
+    monkeypatch.setattr(main, "repos", empty)
+    monkeypatch.setattr(main, "issues", empty)
+    monkeypatch.setattr(main, "pull_requests", empty)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        signed_in = await client.post(
+            "/api/v1/session", json={"access_token": "correct horse battery staple"}
+        )
+        response = await client.get("/api/v1/context")
+
+    assert signed_in.status_code == 200
+    assert response.status_code == 200
+    assert response.json()["user"]["login"] == "timmy"
+
+
+@pytest.mark.anyio
+async def test_authenticated_session_status_exposes_only_csrf_proof(access_control):
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        await client.post(
+            "/api/v1/session", json={"access_token": "correct horse battery staple"}
+        )
+        response = await client.get("/api/v1/session")
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "authenticated": True,
+        "csrf_token": client.cookies["stackchain_csrf"],
+    }
+    assert "correct horse battery staple" not in response.text
+
+
+@pytest.mark.anyio
+async def test_mutation_requires_same_origin_and_session_csrf(access_control, monkeypatch):
+    calls = 0
+
+    async def mark_read(notification_id):
+        nonlocal calls
+        calls += 1
+        return {"id": notification_id, "read": True}
+
+    monkeypatch.setattr(main, "mark_notification_read", mark_read)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        await client.post(
+            "/api/v1/session", json={"access_token": "correct horse battery staple"}
+        )
+        missing = await client.patch("/api/v1/notifications/7/read")
+        foreign = await client.patch(
+            "/api/v1/notifications/7/read",
+            headers={
+                "Origin": "https://evil.example",
+                "X-CSRF-Token": client.cookies["stackchain_csrf"],
+            },
+        )
+        valid = await client.patch(
+            "/api/v1/notifications/7/read",
+            headers={
+                "Origin": "https://test",
+                "X-CSRF-Token": client.cookies["stackchain_csrf"],
+            },
+        )
+
+    assert missing.status_code == 403
+    assert foreign.status_code == 403
+    assert valid.status_code == 200
+    assert calls == 1
+
+
+@pytest.mark.anyio
+async def test_logout_clears_session_and_blocks_private_routes(access_control):
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        await client.post(
+            "/api/v1/session", json={"access_token": "correct horse battery staple"}
+        )
+        csrf = client.cookies["stackchain_csrf"]
+        response = await client.delete(
+            "/api/v1/session",
+            headers={"Origin": "https://test", "X-CSRF-Token": csrf},
+        )
+        private = await client.get("/api/v1/background-identity")
+
+    assert response.status_code == 200
+    assert response.json() == {"authenticated": False, "clear_private_device_data": True}
+    assert private.status_code == 401
+    assert all("Max-Age=0" in value for value in response.headers.get_list("set-cookie"))
+
+
+@pytest.mark.anyio
+async def test_public_routes_remain_available_and_readiness_hides_identity(access_control, monkeypatch):
+    async def user():
+        return {"id": 1, "login": "timmy"}
+
+    monkeypatch.setattr(main, "current_user", user)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        health = await client.get("/healthz")
+        login = await client.get("/login")
+        ready = await client.get("/readyz")
+
+    assert health.status_code == 200
+    assert login.status_code == 200
+    assert 'name="access_token"' in login.text
+    assert ready.status_code == 200
+    assert ready.json() == {"status": "ready", "service": "stackchain-dashboard"}
+
+
+@pytest.mark.anyio
+async def test_subpath_deployment_scopes_routes_and_session_cookies(access_control):
+    transport = httpx.ASGITransport(app=main.app, root_path="/dashboard")
+    async with httpx.AsyncClient(
+        transport=transport, base_url="https://test/dashboard/"
+    ) as client:
+        login = await client.get("login")
+        signed_in = await client.post(
+            "api/v1/session",
+            json={"access_token": "correct horse battery staple"},
+        )
+        status = await client.get("api/v1/session")
+
+    assert login.status_code == 200
+    assert signed_in.status_code == 200
+    assert status.status_code == 200
+    assert any(
+        "stackchain_session=" in value and "Path=/dashboard" in value
+        for value in signed_in.headers.get_list("set-cookie")
+    )

tests/test_dashboard_session_frontend.py

@@ -0,0 +1,81 @@
+import json
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from src.views import dashboard
+
+
+ROOT = Path(__file__).resolve().parents[1]
+SESSION_JS = ROOT / "frontend" / "session.js"
+
+
+def run_session_scenario(scenario: str) -> dict:
+    harness = f"""
+const createSessionBoundary = require({json.dumps(str(SESSION_JS))});
+const state = {{ requests: [], removed: [], deletedDatabases: [], deletedCaches: [], assigned: '' }};
+const storage = {{
+  values: new Map([['stackchain.private', 'secret'], ['gitea.preference', 'keep']]),
+  get length() {{ return this.values.size; }},
+  key(index) {{ return Array.from(this.values.keys())[index] || null; }},
+  removeItem(key) {{ state.removed.push(key); this.values.delete(key); }},
+}};
+const boundary = createSessionBoundary({{
+  cookie: () => 'other=x; stackchain_csrf=csrf-proof; theme=dark',
+  origin: 'https://forge.example',
+  base: '/dashboard/',
+  fetchImpl: async (url, options = {{}}) => {{
+    state.requests.push({{ url: String(url), method: options.method || 'GET', headers: Object.fromEntries(new Headers(options.headers || {{}})) }});
+    return new Response('{{}}', {{ status: 200, headers: {{ 'Content-Type': 'application/json' }} }});
+  }},
+  localStorage: storage,
+  sessionStorage: storage,
+  indexedDB: {{ deleteDatabase: name => {{ state.deletedDatabases.push(name); return {{ onsuccess: null, onerror: null, onblocked: null }}; }} }},
+  caches: {{ keys: async () => ['stackchain-dashboard-shell-v15', 'gitea-assets'], delete: async key => {{ state.deletedCaches.push(key); }} }},
+  location: {{ assign: value => {{ state.assigned = value; }} }},
+}});
+(async () => {{ {scenario} }})().catch(error => {{ console.error(error); process.exit(1); }});
+"""
+    result = subprocess.run(["node", "-e", harness], text=True, capture_output=True, check=True)
+    return json.loads(result.stdout)
+
+
+def test_mutating_same_origin_fetch_receives_csrf_proof():
+    result = run_session_scenario(
+        """
+await boundary.fetch('/dashboard/api/v1/notifications/7/read', { method: 'PATCH' });
+process.stdout.write(JSON.stringify(state));
+"""
+    )
+
+    assert result["requests"][0]["headers"]["x-csrf-token"] == "csrf-proof"
+
+
+def test_sign_out_clears_only_dashboard_private_device_state():
+    result = run_session_scenario(
+        """
+await boundary.signOut();
+state.remaining = Array.from(storage.values.keys());
+process.stdout.write(JSON.stringify(state));
+"""
+    )
+
+    request = result["requests"][0]
+    assert request["url"] == "/dashboard/api/v1/session"
+    assert request["method"] == "DELETE"
+    assert request["headers"]["x-csrf-token"] == "csrf-proof"
+    assert "stackchain.private" in result["removed"]
+    assert result["remaining"] == ["gitea.preference"]
+    assert result["deletedDatabases"] == ["stackchain-background-outbox-v1"]
+    assert result["deletedCaches"] == ["stackchain-dashboard-shell-v15"]
+    assert result["assigned"] == "/dashboard/login"
+
+
+@pytest.mark.anyio
+async def test_dashboard_loads_session_boundary_first_and_offers_sign_out():
+    html = await dashboard()
+
+    assert '<script src="static/session.js"></script>' in html
+    assert html.index('static/session.js') < html.index('static/markdown.js')
+    assert '<button id="sign-out" type="button">Sign out &amp; clear this device</button>' in html

tests/test_gitea_transport.py

@@ -28,6 +28,198 @@ async def test_gitea_transport_is_reused_across_requests_and_closed():
     assert client.is_closed
 
 
+@pytest.mark.anyio
+async def test_gitea_transport_coalesces_identical_concurrent_gets():
+    calls = 0
+    release = asyncio.Event()
+
+    async def handler(request):
+        nonlocal calls
+        calls += 1
+        await release.wait()
+        return httpx.Response(200, json={"path": request.url.path})
+
+    gitea_proxy.start_client(
+        transport=httpx.MockTransport(handler),
+        max_concurrency=4,
+        admission_timeout=0.1,
+    )
+    try:
+        requests = [asyncio.create_task(gitea_proxy.fetch("user")) for _ in range(20)]
+        await asyncio.sleep(0)
+        release.set()
+        results = await asyncio.gather(*requests)
+    finally:
+        await gitea_proxy.stop_client()
+
+    assert calls == 1
+    assert results == [{"path": "/api/v1/user"}] * 20
+
+
+@pytest.mark.anyio
+async def test_cancelling_one_coalesced_waiter_keeps_the_shared_get_running():
+    started = asyncio.Event()
+    release = asyncio.Event()
+
+    async def handler(request):
+        started.set()
+        await release.wait()
+        return httpx.Response(200, json={"path": request.url.path})
+
+    gitea_proxy.start_client(transport=httpx.MockTransport(handler))
+    owner = asyncio.create_task(gitea_proxy.fetch("user"))
+    try:
+        await started.wait()
+        waiter = asyncio.create_task(gitea_proxy.fetch("user"))
+        await asyncio.sleep(0)
+        waiter.cancel()
+        with pytest.raises(asyncio.CancelledError):
+            await waiter
+        release.set()
+        assert await owner == {"path": "/api/v1/user"}
+    finally:
+        release.set()
+        await asyncio.gather(owner, return_exceptions=True)
+        await gitea_proxy.stop_client()
+
+
+@pytest.mark.anyio
+async def test_gitea_transport_rejects_reads_beyond_bounded_capacity():
+    active = 0
+    peak = 0
+    saturated = asyncio.Event()
+    release = asyncio.Event()
+
+    async def handler(request):
+        nonlocal active, peak
+        active += 1
+        peak = max(peak, active)
+        if active == 2:
+            saturated.set()
+        try:
+            await release.wait()
+            return httpx.Response(200, json={"path": request.url.path})
+        finally:
+            active -= 1
+
+    gitea_proxy.start_client(
+        transport=httpx.MockTransport(handler),
+        max_concurrency=3,
+        admission_timeout=0.02,
+    )
+    first = asyncio.create_task(gitea_proxy.fetch("first"))
+    second = asyncio.create_task(gitea_proxy.fetch("second"))
+    try:
+        await asyncio.wait_for(saturated.wait(), timeout=0.2)
+        with pytest.raises(gitea_proxy.GiteaOverloadedError):
+            await gitea_proxy.fetch("third")
+    finally:
+        release.set()
+        await asyncio.gather(first, second)
+        await gitea_proxy.stop_client()
+
+    assert peak == 2
+
+
+@pytest.mark.anyio
+async def test_gitea_transport_reserves_one_slot_for_mutations_and_bounds_them():
+    active = 0
+    peak = 0
+    reads_started = asyncio.Event()
+    mutation_started = asyncio.Event()
+    release = asyncio.Event()
+
+    async def handler(request):
+        nonlocal active, peak
+        active += 1
+        peak = max(peak, active)
+        if active == 2:
+            reads_started.set()
+        if request.method == "POST":
+            mutation_started.set()
+        try:
+            await release.wait()
+            return httpx.Response(200, json={"method": request.method})
+        finally:
+            active -= 1
+
+    client = gitea_proxy.start_client(
+        transport=httpx.MockTransport(handler),
+        max_concurrency=3,
+        admission_timeout=0.02,
+    )
+    reads = [
+        asyncio.create_task(gitea_proxy.fetch("first")),
+        asyncio.create_task(gitea_proxy.fetch("second")),
+    ]
+    mutation = None
+    try:
+        await asyncio.wait_for(reads_started.wait(), timeout=0.2)
+        mutation = asyncio.create_task(client.post("/api/v1/mutate", json={"value": 1}))
+        await asyncio.wait_for(mutation_started.wait(), timeout=0.2)
+        with pytest.raises(gitea_proxy.GiteaOverloadedError):
+            await asyncio.wait_for(
+                client.post("/api/v1/mutate", json={"value": 1}), timeout=0.1
+            )
+    finally:
+        release.set()
+        await asyncio.gather(*reads, *(task for task in [mutation] if task is not None))
+        await gitea_proxy.stop_client()
+
+    assert peak == 3
+
+
+@pytest.mark.anyio
+async def test_gitea_transport_reads_bulkhead_configuration_from_environment(monkeypatch):
+    monkeypatch.setenv("GITEA_MAX_CONCURRENCY", "12")
+    monkeypatch.setenv("GITEA_ADMISSION_TIMEOUT_SECONDS", "0.75")
+
+    client = gitea_proxy.start_client(
+        transport=httpx.MockTransport(lambda request: httpx.Response(200, json={}))
+    )
+    try:
+        assert client.max_concurrency == 12
+        assert client.admission_timeout == 0.75
+    finally:
+        await gitea_proxy.stop_client()
+
+
+@pytest.mark.anyio
+async def test_streaming_reads_share_the_same_bounded_read_capacity():
+    active = 0
+    saturated = asyncio.Event()
+    release = asyncio.Event()
+
+    async def handler(request):
+        nonlocal active
+        active += 1
+        if active == 2:
+            saturated.set()
+        try:
+            await release.wait()
+            return httpx.Response(200, content=b"diff")
+        finally:
+            active -= 1
+
+    gitea_proxy.start_client(
+        transport=httpx.MockTransport(handler),
+        max_concurrency=3,
+        admission_timeout=0.02,
+    )
+    streams = [
+        asyncio.create_task(gitea_proxy.fetch_text("first", 100)),
+        asyncio.create_task(gitea_proxy.fetch_text("second", 100)),
+    ]
+    try:
+        await asyncio.wait_for(saturated.wait(), timeout=0.2)
+        with pytest.raises(gitea_proxy.GiteaOverloadedError):
+            await asyncio.wait_for(gitea_proxy.fetch("third"), timeout=0.1)
+    finally:
+        release.set()
+        await asyncio.gather(*streams)
+        await gitea_proxy.stop_client()
+
+
 @pytest.mark.anyio
 async def test_application_lifespan_opens_and_closes_gitea_transport(monkeypatch):
     calls = []

tests/test_issue_outbox.py

@@ -163,6 +163,100 @@ Promise.all([reconnect,sendNow]).then(results => process.stdout.write(JSON.strin
     assert sum(len(result["confirmed"]) for result in output["results"]) >= 1
 
 
+def test_issue_outbox_mirrors_queue_and_registers_background_sync():
+    script = f"""
+const createIssueOutbox = require({json.dumps(str(OUTBOX))});
+const values = new Map();
+const storage = {{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v)}};
+const state = {{snapshots:[],syncs:0}};
+const backgroundSync = {{
+  reconcile: async items => state.snapshots.push(items.map(item => ({{...item}}))),
+  requestSync: async () => {{ state.syncs += 1; }},
+}};
+const outbox = createIssueOutbox({{
+  storage, backgroundSync, getOwnerLogin:()=> 'timmy', createOperationId:()=> 'background-1',
+}});
+outbox.enqueue({{repository:'stackchain/api',title:'Close the app',body:'Still deliver'}});
+setTimeout(() => process.stdout.write(JSON.stringify(state)), 0);
+"""
+    output = run_node(script)
+
+    assert output["snapshots"][0][0]["operationId"] == "background-1"
+    assert output["snapshots"][0][0]["ownerLogin"] == "timmy"
+    assert output["syncs"] == 1
+
+
+def test_foreground_delivery_uses_same_atomic_background_claim():
+    script = f"""
+const createIssueOutbox = require({json.dumps(str(OUTBOX))});
+const values = new Map();
+const storage = {{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v)}};
+const state = {{backgroundCalls:0,directCalls:0}};
+const backgroundSync = {{
+  reconcile: async () => {{}}, requestSync: async () => {{}},
+  send: async (item, login) => {{ state.backgroundCalls += 1; return {{issue:{{number:9}}, claimed:item.id + ':' + login}}; }},
+}};
+const outbox = createIssueOutbox({{
+  storage, backgroundSync, getOwnerLogin:()=> 'timmy', createOperationId:()=> 'shared-claim',
+  fetchJson:async () => {{ state.directCalls += 1; return {{number:10}}; }},
+}});
+outbox.enqueue({{repository:'o/r',title:'One owner'}});
+outbox.flush('timmy').then(result => process.stdout.write(JSON.stringify({{state,result,remaining:outbox.list()}})));
+"""
+    output = run_node(script)
+
+    assert output["state"] == {"backgroundCalls": 1, "directCalls": 0}
+    assert output["result"]["confirmed"][0]["number"] == 9
+    assert output["remaining"] == []
+
+
+def test_foreground_background_delivery_surfaces_permanent_failure_immediately():
+    script = f"""
+const createIssueOutbox = require({json.dumps(str(OUTBOX))});
+const values=new Map();const storage={{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v)}};
+const error=new Error('Title is invalid');error.status=422;
+const backgroundSync={{reconcile:async()=>{{}},requestSync:async()=>{{}},send:async()=>({{attention:true,error}})}};
+const outbox=createIssueOutbox({{storage,backgroundSync,getOwnerLogin:()=>'timmy',createOperationId:()=>'invalid'}});
+outbox.enqueue({{repository:'o/r',title:'Bad'}});
+outbox.flush('timmy').then(result=>process.stdout.write(JSON.stringify({{result,items:outbox.list()}})));
+"""
+    output = run_node(script)
+
+    assert output["items"][0]["status"] == "attention"
+    assert output["items"][0]["error"] == "Title is invalid"
+    assert output["result"]["confirmed"] == []
+
+
+def test_page_reconciles_worker_success_and_attention_into_visible_outbox():
+    script = f"""
+const createIssueOutbox = require({json.dumps(str(OUTBOX))});
+const values=new Map();
+const storage={{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v)}};
+values.set('stackchain.issue-outbox.v1',JSON.stringify({{version:2,items:[
+  {{id:'sent',operationId:'sent',ownerLogin:'timmy',status:'queued',title:'Done'}},
+  {{id:'bad',operationId:'bad',ownerLogin:'timmy',status:'queued',title:'Fix me'}},
+]}}));
+const outbox=createIssueOutbox({{storage}});
+outbox.reconcileBackground([
+  {{id:'sent',status:'sent'}},
+  {{id:'bad',status:'attention',error:'Title is invalid'}},
+]);
+process.stdout.write(JSON.stringify(outbox.list()));
+"""
+    output = run_node(script)
+
+    assert output == [
+        {
+            "id": "bad",
+            "operationId": "bad",
+            "ownerLogin": "timmy",
+            "status": "attention",
+            "title": "Fix me",
+            "error": "Title is invalid",
+        }
+    ]
+
+
 @pytest.mark.anyio
 async def test_mobile_dashboard_queues_offline_captures_and_exposes_outbox_actions():
     html = await dashboard()

tests/test_my_work.py

@@ -1,4 +1,5 @@
 import json
+import os
 import subprocess
 from pathlib import Path
 
@@ -8,6 +9,8 @@ from src.views import dashboard
 
 
 MY_WORK = Path(__file__).parents[1] / "frontend" / "my-work.js"
+LATER_WORK = Path(__file__).parents[1] / "frontend" / "later-work.js"
+DETAIL_DEFER = Path(__file__).parents[1] / "frontend" / "detail-defer.js"
 REVIEW_SHEET = Path(__file__).parents[1] / "frontend" / "review-sheet.js"
 ISSUE_SHEET = Path(__file__).parents[1] / "frontend" / "issue-sheet.js"
 CREATE_ISSUE_SHEET = Path(__file__).parents[1] / "frontend" / "create-issue-sheet.js"
@@ -677,6 +680,244 @@ process.stdout.write(JSON.stringify({{
     }
 
 
+def test_later_queue_defers_work_locally_and_scopes_it_to_confirmed_login():
+    script = f"""
+const createLaterWork = require({json.dumps(str(LATER_WORK))});
+const values = new Map();
+const storage = {{
+  getItem:key => values.get(key) || null,
+  setItem:(key,value) => values.set(key,value),
+  removeItem:key => values.delete(key),
+}};
+let login = 'timmy';
+const item = {{kind:'pull',is_review:true,repository:'stackchain/api',number:17,title:'Review me'}};
+const store = createLaterWork({{storage,getLogin:() => login,now:() => new Date('2026-08-08T12:00:00Z')}});
+const deferred = store.defer(item, new Date('2026-08-08T16:00:00Z'));
+const timmy = store.partition([item]);
+login = 'alexander';
+const alexander = store.partition([item]);
+process.stdout.write(JSON.stringify({{
+  deferred,
+  timmy:{{active:timmy.active.length,later:timmy.later}},
+  alexander:{{active:alexander.active.length,later:alexander.later.length}},
+  keys:Array.from(values.keys()),
+}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "deferred": True,
+        "timmy": {
+            "active": 0,
+            "later": [{
+                "kind": "pull", "is_review": True, "repository": "stackchain/api",
+                "number": 17, "title": "Review me", "deferred_until": "2026-08-08T16:00:00.000Z",
+            }],
+        },
+        "alexander": {"active": 1, "later": 0},
+        "keys": ["stackchain.later-work.v1.timmy"],
+    }
+
+
+def test_later_queue_prunes_missing_work_and_wakes_expired_items_without_reload():
+    script = f"""
+const createLaterWork = require({json.dumps(str(LATER_WORK))});
+const values = new Map();
+const storage = {{
+  getItem:key => values.get(key) || null,
+  setItem:(key,value) => values.set(key,value),
+  removeItem:key => values.delete(key),
+}};
+let clock = new Date('2026-08-08T12:00:00Z');
+let scheduled = null;
+let wakes = 0;
+const store = createLaterWork({{
+  storage, getLogin:() => 'timmy', now:() => clock,
+  setTimer:(callback, delay) => {{ scheduled = {{callback,delay}}; return 7; }},
+  clearTimer:() => {{}}, onWake:() => {{ wakes += 1; }},
+}});
+const kept = {{kind:'issue',repository:'stackchain/api',number:17,title:'Kept'}};
+const gone = {{kind:'issue',repository:'stackchain/api',number:18,title:'Gone'}};
+store.defer(kept, new Date('2026-08-08T13:00:00Z'));
+store.defer(gone, new Date('2026-08-09T13:00:00Z'));
+const before = store.partition([kept]);
+const persisted = JSON.parse(values.get('stackchain.later-work.v1.timmy'));
+clock = new Date('2026-08-08T13:00:01Z');
+scheduled.callback();
+const after = store.partition([kept]);
+process.stdout.write(JSON.stringify({{
+  before:{{active:before.active.length,later:before.later.length}},
+  persisted:Object.keys(persisted), delay:scheduled.delay, wakes,
+  after:{{active:after.active.map(item => item.title),later:after.later.length}},
+  storageEmpty:!values.has('stackchain.later-work.v1.timmy'),
+}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "before": {"active": 0, "later": 1},
+        "persisted": ["issue:stackchain/api:17:"],
+        "delay": 3600000,
+        "wakes": 1,
+        "after": {"active": ["Kept"], "later": 0},
+        "storageEmpty": True,
+    }
+
+
+def test_later_queue_preserves_rank_and_retains_unloaded_paginated_work():
+    script = f"""
+const createLaterWork = require({json.dumps(str(LATER_WORK))});
+const values = new Map();
+const storage = {{
+  getItem:key => values.get(key) || null,
+  setItem:(key,value) => values.set(key,value),
+  removeItem:key => values.delete(key),
+}};
+const store = createLaterWork({{
+  storage,getLogin:() => 'timmy',now:() => new Date('2026-08-08T12:00:00Z'),
+  setTimer:() => 1, clearTimer:() => {{}},
+}});
+const first = {{kind:'issue',repository:'stackchain/api',number:1,title:'Higher priority'}};
+const second = {{kind:'pull',repository:'stackchain/api',number:2,title:'Lower priority'}};
+store.defer(second, new Date('2026-08-09T12:00:00Z'));
+store.defer(first, new Date('2026-08-09T12:00:00Z'));
+store.partition([first], {{pruneMissing:false}});
+const visible = store.partition([first, second], {{pruneMissing:false}});
+process.stdout.write(JSON.stringify({{
+  titles:visible.later.map(item => item.title),
+  records:Object.keys(JSON.parse(values.get('stackchain.later-work.v1.timmy'))).length,
+}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "titles": ["Higher priority", "Lower priority"],
+        "records": 2,
+    }
+
+
+def test_later_queue_presets_and_bring_back_now_preserve_work_identity():
+    script = f"""
+const createLaterWork = require({json.dumps(str(LATER_WORK))});
+const values = new Map();
+const storage = {{
+  getItem:key => values.get(key) || null,
+  setItem:(key,value) => values.set(key,value),
+  removeItem:key => values.delete(key),
+}};
+const now = new Date('2026-08-08T12:00:00Z');
+const store = createLaterWork({{storage,getLogin:() => 'timmy',now:() => now}});
+const item = {{kind:'update',repository:'stackchain/api',number:17,notification_id:91}};
+const today = store.presetUntil('today');
+const tomorrow = store.presetUntil('tomorrow');
+store.defer(item, tomorrow);
+const removed = store.restore(item);
+process.stdout.write(JSON.stringify({{
+  today:today.toISOString(), tomorrow:tomorrow.toISOString(), removed,
+  partition:store.partition([item]),
+}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True,
+        env={**os.environ, "TZ": "UTC"},
+    )
+
+    assert json.loads(result.stdout) == {
+        "today": "2026-08-08T16:00:00.000Z",
+        "tomorrow": "2026-08-09T09:00:00.000Z",
+        "removed": True,
+        "partition": {"active": [{
+            "kind": "update", "repository": "stackchain/api", "number": 17,
+            "notification_id": 91,
+        }], "later": []},
+    }
+
+
+def test_detail_defer_closes_normal_triage_but_keeps_session_open_for_reconcile():
+    script = f"""
+const createDetailDefer = require({json.dumps(str(DETAIL_DEFER))});
+const calls = [];
+let sessionActive = false;
+const controller = createDetailDefer({{
+  laterWork: {{
+    presetUntil:preset => new Date(preset === 'today' ? '2026-08-08T16:00:00Z' : '2026-08-09T09:00:00Z'),
+    defer:(item, until) => {{ calls.push(['defer', item.title, until.toISOString()]); return true; }},
+  }},
+  session: {{ active:() => sessionActive }},
+  close:() => calls.push(['close']),
+  refresh:() => calls.push(['refresh']),
+  focus:() => calls.push(['focus']),
+  announce:message => calls.push(['announce', message]),
+  formatTime:value => value.toISOString(),
+}});
+const item = {{kind:'issue',repository:'stackchain/api',number:17,title:'Read first'}};
+const outside = controller.defer(item, 'today');
+sessionActive = true;
+const session = controller.defer(item, 'tomorrow');
+process.stdout.write(JSON.stringify({{outside,session,calls}}));
+"""
+
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "outside": True,
+        "session": True,
+        "calls": [
+            ["defer", "Read first", "2026-08-08T16:00:00.000Z"],
+            ["close"],
+            ["refresh"],
+            ["announce", "Deferred until 2026-08-08T16:00:00.000Z. It stays unread and unchanged in Gitea."],
+            ["focus"],
+            ["defer", "Read first", "2026-08-09T09:00:00.000Z"],
+            ["refresh"],
+            ["announce", "Deferred until 2026-08-09T09:00:00.000Z. It stays unread and unchanged in Gitea."],
+        ],
+    }
+
+
+@pytest.mark.anyio
+async def test_mobile_detail_sheets_offer_touch_safe_defer_without_a_gitea_mutation():
+    html = await dashboard()
+
+    assert '<script src="static/detail-defer.js"></script>' in html
+    assert html.count('class="detail-defer"') == 4
+    assert html.count('data-detail-defer-preset="today"') == 4
+    assert html.count('data-detail-defer-preset="tomorrow"') == 4
+    assert 'const detailDefer = createDetailDefer({' in html
+    assert 'selectedUpdate || selectedReview || selectedIssue || selectedPull' in html
+    assert "detailDefer.defer(item, button.dataset.detailDeferPreset)" in html
+    assert ".detail-defer summary, .detail-defer button { min-height:44px;" in html
+    assert "fetch(" not in DETAIL_DEFER.read_text()
+
+
+@pytest.mark.anyio
+async def test_mobile_my_work_wires_touch_safe_non_mutating_later_actions():
+    html = await dashboard()
+
+    assert '<script src="static/later-work.js"></script>' in html
+    assert 'data-work-filter="later"' in html
+    assert 'data-work-count="later"' in html
+    assert 'const laterWork = createLaterWork({' in html
+    assert 'getLogin: () => confirmedOwnerLogin' in html
+    assert 'laterWork.partition(lastMyWork,' in html
+    assert 'data-later-preset="today"' in html
+    assert 'data-later-preset="tomorrow"' in html
+    assert 'data-later-restore' in html
+    assert "Deferred until ' + escapeHtml(fmt(item.deferred_until))" in html
+    assert "laterWork.defer(item, laterWork.presetUntil(button.dataset.laterPreset))" in html
+    assert 'laterWork.restore(item)' in html
+    assert '.later-actions button { min-height:44px;' in html
+    assert 'Deferred work stays unread and unchanged in Gitea.' in html
+
+
 def test_milestone_lane_composes_with_type_filter_and_updates_confirmed_snapshot():
     payload = {
         "issues": [
@@ -2676,7 +2917,8 @@ async def test_mobile_filters_wrap_show_counts_and_persist_for_the_session():
     assert 'data-work-count="pull"' in html
     assert 'data-work-count="review"' in html
     assert 'data-work-count="update"' in html
-    assert "['all', 'attention', 'issue', 'pull', 'review', 'update', 'draft'].includes(savedFilter)" in html
+    assert 'data-work-count="later"' in html
+    assert "['all', 'attention', 'issue', 'pull', 'review', 'update', 'later', 'draft'].includes(savedFilter)" in html
     assert 'data-work-count="draft"' in html
     assert 'sessionStorage.getItem(WORK_FILTER_KEY)' in html
     assert 'sessionStorage.setItem(WORK_FILTER_KEY, selectedWorkFilter)' in html

tests/test_service_worker.py

@@ -13,7 +13,7 @@ def run_worker_scenario(scenario: str) -> dict:
 const fs = require('fs');
 const vm = require('vm');
 const listeners = {{}};
-const state = {{ added: [], deleted: [], claimed: false, skipped: false, fetches: [], puts: [], failFetch: false, fetchStatus: 200, cachedBody: null }};
+const state = {{ added: [], deleted: [], claimed: false, skipped: false, fetches: [], puts: [], backgroundFlushes: 0, failFetch: false, fetchStatus: 200, cachedBody: null }};
 const cache = {{
   addAll: async urls => {{ state.added = urls; }},
   match: async request => state.cachedBody === null ? null : new Response(state.cachedBody),
@@ -27,7 +27,9 @@ const context = {{
     addEventListener: (name, handler) => {{ listeners[name] = handler; }},
     skipWaiting: async () => {{ state.skipped = true; }},
     clients: {{ claim: async () => {{ state.claimed = true; }} }},
+    __issueSync: {{ flush: async () => {{ state.backgroundFlushes += 1; }} }},
   }},
+  importScripts: () => {{}},
   caches: {{
     open: async () => cache,
     keys: async () => ['stackchain-dashboard-old', 'another-app-cache'],
@@ -53,6 +55,11 @@ async function dispatch(name, request) {{
   if (pending) await pending;
   return response ? await response : null;
 }}
+async function dispatchSync(tag) {{
+  let pending;
+  listeners.sync({{ tag, waitUntil: promise => {{ pending = promise; }} }});
+  if (pending) await pending;
+}}
 (async () => {{
 {scenario}
 }})().catch(error => {{ console.error(error); process.exit(1); }});
@@ -63,10 +70,30 @@ async function dispatch(name, request) {{
     return json.loads(completed.stdout)
 
 
-def test_mobile_attention_queue_ships_in_a_new_shell_cache():
+def test_operator_session_boundary_ships_in_a_new_shell_cache():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v11" in source
+    assert "stackchain-dashboard-shell-v16" in source
+
+
+def test_background_sync_event_flushes_closed_app_issue_outbox_only_for_its_tag():
+    result = run_worker_scenario(
+        """
+  await dispatchSync('stackchain-issue-outbox-v1');
+  await dispatchSync('another-app-sync');
+  process.stdout.write(JSON.stringify(state));
+"""
+    )
+
+    assert result["backgroundFlushes"] == 1
+
+
+def test_background_mutations_obtain_session_bound_csrf_proof():
+    source = WORKER.read_text()
+
+    assert "async function sessionCsrf()" in source
+    assert "BASE + 'api/v1/session'" in source
+    assert "headers.set('X-CSRF-Token', csrf)" in source
 
 
 def test_install_precaches_complete_subpath_scoped_app_shell():
@@ -84,6 +111,7 @@ def test_install_precaches_complete_subpath_scoped_app_shell():
         "/dashboard/manifest.webmanifest",
         "/dashboard/static/icons/stackchain-192.png",
         "/dashboard/static/icons/stackchain-512.png",
+        "/dashboard/static/session.js",
         "/dashboard/static/markdown.js",
         "/dashboard/static/commands.js",
         "/dashboard/static/search-preview.js",
@@ -94,6 +122,8 @@ def test_install_precaches_complete_subpath_scoped_app_shell():
         "/dashboard/static/authored-outbox.js",
         "/dashboard/static/offline-work.js",
         "/dashboard/static/my-work.js",
+        "/dashboard/static/later-work.js",
+        "/dashboard/static/detail-defer.js",
         "/dashboard/static/pick-work.js",
         "/dashboard/static/conversation.js",
         "/dashboard/static/issue-sheet.js",
@@ -103,6 +133,7 @@ def test_install_precaches_complete_subpath_scoped_app_shell():
         "/dashboard/static/work-route.js",
         "/dashboard/static/context-poller.js",
         "/dashboard/static/mobile-task-dock.js",
+        "/dashboard/static/background-issue-sync.js",
     }