feat: compress dashboard shell over HTTP (#417)

Closes #415

README.md

@@ -21,7 +21,11 @@ inspect/comment on assigned pull
 requests, merge assigned pull requests, and submit pull-request reviews.
 Pull-request replies and mobile My Work issue and PR comments use Gitea's
 issue-comment API; mobile issue capture requires issue
-creation and assignment permission. The New issue sheet can optionally select an open
+creation and assignment permission. Once a repository and meaningful title are selected,
+the New issue sheet checks for similar open issues in that repository. Candidate links keep
+the draft intact; the first create attempt pauses until the operator reviews them or explicitly
+chooses **Create anyway**. This check is advisory and never blocks offline capture or capture
+when search is unavailable. The sheet can also optionally select an open
 repository milestone and due date; the dashboard validates both and sends them with
 self-assignment in the single create request, so planned work appears in its release
 lane immediately. On a cold offline launch, **Save for filing** stores up to 20
@@ -33,10 +37,18 @@ the private content. Issue capture and authored mobile actions (issue
 comments, pull-request comments, notification replies, and reviews) persist per-draft
 idempotency keys, so retrying after a timeout, reload, process restart, or handoff to
 another worker replays a confirmed result instead of posting duplicate content. The ordered,
-five-item Today plan syncs across the operator's devices. Server revisions prevent delayed
+five-item Today plan syncs across the operator's devices. Starting a Today work session also
+stores an account-bound checkpoint on the current device. After a reload or installed-app
+restart, **Resume Today** reopens the saved item (or the next surviving item if work changed);
+finishing or choosing **End session** clears only the checkpoint and leaves the Today plan
+unchanged. Another or unconfirmed account cannot see or resume it. Server revisions prevent delayed
 responses from replacing a newer plan; same-account browser tabs exchange fresh snapshots,
 and reconnecting or returning to the dashboard refreshes server truth after replaying queued
-offline operations. After a healthy, fully paginated
+offline operations. Planning edits can remain offline for up to 30 days. After that, the
+expired edit is discarded visibly and the account plan is kept rather than replaying stale
+intent. The server retains no more than 4,096 operation receipts per account and removes
+receipts older than the same 30-day window; client base revisions keep a pruned replay from
+changing a newer Today or Later plan. After a healthy, fully paginated
 My Work refresh proves that an item is complete or otherwise no longer eligible, Stackchain
 queues an idempotent retirement before removing it locally; partial and degraded refreshes
 leave the plan unchanged, and offline retirements replay after reconnect. When
@@ -49,7 +61,12 @@ triageable offline: **Queue read & next** writes an account-bound, notification-
 deduplicated acknowledgement to the durable background delivery system, removes the
 update from the local queue immediately, and opens the next saved conversation. A cold
 offline reload suppresses acknowledgements still waiting to sync; reconnect uses the
-authenticated notification-read endpoint and keeps transient failures queued. Installed-app
+authenticated notification-read endpoint and keeps transient failures queued. Every foreground
+same-origin dashboard API request also has a 15-second browser deadline, including fresh-
+authorization and step-up retries. Read timeouts settle with retry guidance even if the browser's
+fetch ignores abort; mutation timeouts instead tell the operator to refresh and verify the server
+outcome before retrying. Caller cancellation still takes precedence, and cross-origin fetches are
+not changed by this session boundary. Installed-app
 navigations are also deadline-bounded: after four seconds without a network response,
 Stackchain aborts the request and opens the cached dashboard shell. If the shell has not
 been installed yet, it returns explicit HTTP 504 reconnect guidance instead of hanging.
@@ -156,7 +173,10 @@ Every response also defines the browser execution boundary with a Content Securi
 Policy that allows scripts only from the dashboard origin, denies framing and
 plugins, and blocks unused browser capabilities. Keep these response headers when
 proxying; do not add inline scripts or broaden `script-src`. The dashboard bootstrap
-and stylesheet are same-origin static assets included in the offline PWA shell.
+is assembled in source order into one content-addressed JavaScript response. Dashboard
+HTML and the offline worker reference that exact fingerprint, while the runtime receives
+immutable caching and HTML/worker responses remain revalidated. The stylesheet and
+fingerprinted runtime are same-origin assets included atomically in the offline PWA shell.
 Use **Sign out & clear this device** on shared devices; it clears Stackchain's
 offline snapshots, drafts, outboxes, background IndexedDB, and PWA caches without
 removing unrelated forge preferences. Rotate either dashboard secret by replacing
@@ -198,10 +218,12 @@ below the route deadlines. Streaming diff reads share the same read capacity,
 while POST, PATCH, PUT, and DELETE requests are never coalesced.
 
 Live snapshots expose independent `context`, `events`, and `notifications`
-revisions. The browser sends its known revisions on later polls, so `/api/v1/live`
-can omit unchanged section bodies while still returning current freshness and
-retry metadata. The client retains omitted data and only rebuilds or persists the
-sections that changed.
+revision tokens. Each bounded opaque token includes a per-process generation, so a token
+from another worker or from before a restart cannot suppress different content. The browser
+sends its known tokens on later polls, so `/api/v1/live` can omit unchanged section bodies
+while still returning current freshness and retry metadata. The client retains omitted data
+and only rebuilds or persists the sections that changed. Malformed or oversized tokens are
+rejected before any upstream work.
 
 ## Offline mobile shell
 
@@ -212,14 +234,19 @@ the device safe area, and moves out of the way while a full-screen task is open.
 Desktop layout is unchanged.
 
 My Work also has an account-synced **Later** queue. **Later today** defers an item for four
-hours, while **Tomorrow** returns it at 09:00 in the device's local timezone.
+hours, while **Tomorrow** returns it at 09:00 in the device's local timezone. **Choose date & time**
+accepts a valid future local date and time and returns the item at that exact instant; the picker
+shows the device timezone and rejects empty, normalized, invalid, or past values before saving.
 Deferred items leave normal and Attention queues without marking notifications read
 or changing any Gitea issue or pull request. They automatically return to their
 existing priority position at the wake time, and **Bring back now** restores them
 early. Later wake times are scoped to the confirmed Gitea login and synchronize
 across signed-in tabs and devices. Offline changes apply immediately, survive reload,
-and replay after reconnect; `STACKCHAIN_LATER_DB` can override the default durable
-store at `.stackchain-state/later.sqlite3`.
+and replay after reconnect. Each queued edit carries the account revision it was based
+on; if another device has since changed the same item, Stackchain keeps the newer
+account plan and reports the conflict instead of silently overwriting it. Unrelated
+items continue syncing in the same batch. `STACKCHAIN_LATER_DB` can override the
+default durable store at `.stackchain-state/later.sqlite3`.
 
 After one successful online load, the installed dashboard precaches a versioned,
 subpath-scoped application shell. During a network outage or a dashboard HTTP

frontend/assign-and-start.js

@@ -0,0 +1,49 @@
+function createAssignAndStart({ available, claim, start, queue, recover, announce }) {
+  let request = null;
+
+  function run(item, { alreadyOwned = false, destination = 'start' } = {}) {
+    if (request) return request;
+    if (!available()) {
+      announce('Today is full—remove an item before assigning this issue.');
+      return Promise.resolve('full');
+    }
+    request = Promise.resolve()
+      .then(() => alreadyOwned ? item : claim(item))
+      .then(confirmed => {
+        const outcome = destination === 'queue' ? queue(confirmed) : start(confirmed);
+        if (outcome === 'queued') {
+          announce(alreadyOwned ? 'Queued in Today. Keep finding work when ready.' :
+            'Assigned and queued in Today. Keep finding work when ready.');
+          return outcome;
+        }
+        if (outcome === 'started') {
+          announce(alreadyOwned ? 'Added to Today and ready to work.' :
+            'Assigned, added to Today, and ready to work.');
+          return outcome;
+        }
+        if (destination === 'queue') {
+          if (outcome === 'sync-unavailable') {
+            announce(alreadyOwned ?
+              'Saved in Today on this device, but account sync is unavailable. The issue is open so you can recover.' :
+              'Assigned and saved in Today on this device, but account sync is unavailable. The issue is open so you can recover.');
+          } else {
+            announce(alreadyOwned ?
+              'Today could not be queued. The issue is open so you can recover.' :
+              'Assigned to you, but Today could not be queued. The issue is open so you can recover.');
+          }
+        } else {
+          announce(alreadyOwned ?
+            'Today could not start. The issue is open so you can recover.' :
+            'Assigned to you, but Today could not start. The issue is open so you can recover.');
+        }
+        recover(confirmed);
+        return 'recovery';
+      })
+      .finally(() => { request = null; });
+    return request;
+  }
+
+  return { run };
+}
+
+if (typeof module !== 'undefined' && module.exports) module.exports = createAssignAndStart;

frontend/background-issue-sync.js

@@ -180,7 +180,10 @@ function createIssueSyncStore({ transaction, indexedDB = globalThis.indexedDB, n
     claim,
     claimNext,
     claimBatch,
-    complete: id => update(id, item => ({ ...item, status: 'sent', claimUntil: 0 })),
+    complete: (id, deliveredIssue) => update(id, item => ({
+      ...item, status: 'sent', claimUntil: 0,
+      ...(item.completionIntent === 'create-and-start' && deliveredIssue ? { deliveredIssue } : {}),
+    })),
     release: id => update(id, item => ({ ...item, status: 'queued', claimUntil: 0 })),
     fail: (id, error, deliveryState) => update(id, item => ({
       ...item, status: 'attention', claimUntil: 0, error,
@@ -303,7 +306,7 @@ function createBackgroundIssueSync({
     const request = deliveryRequest(item);
     try {
       const delivered = await requestJson(request.url, request.options);
-      await store.complete(item.id);
+      await store.complete(item.id, delivered);
       const receipt = receiptFor(item, 'confirmed', delivered);
       return item.kind ? { message: delivered, receipt } : { issue: delivered, receipt };
     } catch (error) {

frontend/card-planning.js

@@ -0,0 +1,39 @@
+(function (root, factory) {
+  if (typeof module !== 'undefined' && module.exports) module.exports = factory;
+  else root.createCardPlanning = factory;
+})(typeof self !== 'undefined' ? self : this, function createCardPlanning(root) {
+  function sync(disclosure) {
+    disclosure.querySelector('summary')?.setAttribute(
+      'aria-expanded', String(disclosure.open)
+    );
+  }
+
+  function wire() {
+    const disclosures = Array.from(root.querySelectorAll('[data-card-planning]'));
+    disclosures.forEach(disclosure => {
+      if (disclosure.dataset.cardPlanningBound === 'true') return;
+      disclosure.dataset.cardPlanningBound = 'true';
+      sync(disclosure);
+      disclosure.addEventListener('toggle', () => {
+        if (disclosure.open) {
+          disclosures.forEach(other => {
+            if (other === disclosure || !other.open) return;
+            other.open = false;
+            sync(other);
+          });
+        }
+        sync(disclosure);
+      });
+      disclosure.addEventListener('keydown', event => {
+        if (event.key !== 'Escape' || !disclosure.open) return;
+        disclosure.open = false;
+        sync(disclosure);
+        disclosure.querySelector('summary')?.focus();
+        event.preventDefault();
+        event.stopPropagation();
+      });
+    });
+  }
+
+  return { wire };
+});

frontend/context-poller.js

@@ -1,3 +1,15 @@
+function buildLiveRevisionQuery(revisions = {}) {
+  const params = new URLSearchParams();
+  const tokenPattern = /^[0-9a-f]{16}\.[0-9]{1,20}$/;
+  ['context', 'events', 'notifications'].forEach((section) => {
+    const revision = revisions[section];
+    if (typeof revision === 'string' && tokenPattern.test(revision)) {
+      params.set(section + '_revision', revision);
+    }
+  });
+  return params.toString();
+}
+
 function createContextPoller({
   fetchContext,
   onSnapshot,
@@ -123,6 +135,8 @@ function createContextPoller({
   };
 }
 
+createContextPoller.buildRevisionQuery = buildLiveRevisionQuery;
+
 if (typeof module !== 'undefined' && module.exports) {
   module.exports = createContextPoller;
 }

frontend/create-and-start.js

@@ -0,0 +1,36 @@
+function createCreateAndStart({ todayWork, todaySync, refresh, warm, start, announce }) {
+  const completed = new Set();
+
+  function available() {
+    return todayWork.read().length < todayWork.limit;
+  }
+
+  function complete(issue) {
+    const identity = todayWork.identity(issue);
+    if (!identity || completed.has(identity)) return 'exists';
+    const added = todayWork.add(issue);
+    if (added === 'full') {
+      announce('Created, but Today changed—remove an item, then add this issue.');
+      return 'full';
+    }
+    if (added !== 'added' && added !== 'exists') {
+      announce('Created, but Today could not be saved on this device.');
+      return 'unavailable';
+    }
+    if (!todaySync.enqueue('add', identity)) {
+      announce('Created and saved to Today on this device, but account sync is unavailable.');
+      return 'sync-unavailable';
+    }
+    completed.add(identity);
+    refresh();
+    todaySync.flush();
+    warm();
+    start(issue);
+    announce('Created, added to Today, and ready to work.');
+    return 'started';
+  }
+
+  return { available, complete };
+}
+
+if (typeof module !== 'undefined' && module.exports) module.exports = createCreateAndStart;

frontend/create-issue-sheet.js

@@ -23,6 +23,10 @@ function createIssueCapture({ fetchJson, storage, createOperationId = newIssueOp
   const storageKey = 'stackchain.issue-capture.v1';
   const sharedStorageKey = 'stackchain.issue-share.v1';
   let pending = null;
+  let duplicateRequest = 0;
+  let duplicateState = {status: 'idle', key: '', candidates: []};
+  let acknowledgedDuplicateKey = '';
+  const repositoryPageRequests = new Map();
   const safeLabelIds = value => Array.from(new Set(
     (Array.isArray(value) ? value : []).filter(id => Number.isInteger(id) && id > 0)
   )).slice(0, 20);
@@ -140,6 +144,66 @@ function createIssueCapture({ fetchJson, storage, createOperationId = newIssueOp
     );
   }
 
+  function loadRepositoryPage(page) {
+    const safePage = Math.max(1, Math.floor(Number(page) || 1));
+    if (repositoryPageRequests.has(safePage)) return repositoryPageRequests.get(safePage);
+    const request = fetchJson('api/v1/repositories?page=' + safePage + '&limit=50')
+      .then(payload => ({
+        items: Array.isArray(payload?.items) ? payload.items : [],
+        page: Number(payload?.page) || safePage,
+        total: Math.max(0, Number(payload?.total) || 0),
+        has_more: payload?.has_more === true,
+      }))
+      .finally(() => repositoryPageRequests.delete(safePage));
+    repositoryPageRequests.set(safePage, request);
+    return request;
+  }
+
+  function duplicateKey(draft) {
+    const repository = String(draft?.repository || '').trim();
+    const title = String(draft?.title || '').replace(/\s+/g, ' ').trim();
+    return { repository, title, key: repository + '\n' + title.toLowerCase() };
+  }
+
+  async function findDuplicates(draft) {
+    const input = duplicateKey(draft);
+    const request = ++duplicateRequest;
+    if (!input.repository || input.title.length < 4) {
+      duplicateState = {status: 'idle', key: input.key, candidates: []};
+      return duplicateState;
+    }
+    try {
+      const payload = await fetchJson('api/v1/search?q=' + encodeURIComponent(input.title) + '&limit=10');
+      if (request !== duplicateRequest) return {status: 'stale', key: input.key, candidates: []};
+      duplicateState = {
+        status: 'ready',
+        key: input.key,
+        partial: payload?.partial === true,
+        candidates: (Array.isArray(payload?.items) ? payload.items : []).filter(item =>
+          item?.kind === 'issue' && item?.state === 'open' && item?.repository === input.repository
+        ).slice(0, 3),
+      };
+      return duplicateState;
+    } catch (error) {
+      if (request !== duplicateRequest) return {status: 'stale', key: input.key, candidates: []};
+      duplicateState = {status: 'failed', key: input.key, candidates: [], error};
+      return duplicateState;
+    }
+  }
+
+  function needsDuplicateAcknowledgement(draft) {
+    const {key} = duplicateKey(draft);
+    return duplicateState.status === 'ready' && duplicateState.partial !== true && duplicateState.key === key &&
+      duplicateState.candidates.length > 0 && acknowledgedDuplicateKey !== key;
+  }
+
+  function acknowledgeDuplicates(draft) {
+    const {key} = duplicateKey(draft);
+    if (duplicateState.status === 'ready' && duplicateState.key === key && duplicateState.candidates.length) {
+      acknowledgedDuplicateKey = key;
+    }
+  }
+
   function submit(draft) {
     if (pending) return pending;
     const saved = saveDraft(draft);
@@ -166,7 +230,8 @@ function createIssueCapture({ fetchJson, storage, createOperationId = newIssueOp
   }
 
   return {
-    saveDraft, loadDraft, clearDraft, loadLabels, loadMilestones, submit,
+    saveDraft, loadDraft, clearDraft, loadLabels, loadMilestones, loadRepositoryPage, findDuplicates,
+    needsDuplicateAcknowledgement, acknowledgeDuplicates, submit,
     stageSharedContent, pendingSharedContent, acceptSharedContent, discardSharedContent,
   };
 }

frontend/dashboard.css

@@ -82,6 +82,24 @@ textarea { resize: vertical; min-height: 120px; }
 .event { padding: 8px 0; border-bottom: 1px solid #1b2d45; }
 .event:last-child { border-bottom: 0; }
 .my-work { grid-column: 1 / -1; }
+.plan-today-sheet { position:fixed; inset:0; z-index:75; display:flex; justify-content:flex-end; background:rgba(5,12,21,.78); backdrop-filter:blur(4px); }
+.plan-today-sheet[hidden] { display:none; }
+.plan-today-panel { box-sizing:border-box; width:min(620px,100%); height:100%; overflow:auto; overflow-x:hidden; padding:18px; background:#0b1526; border-left:1px solid #2a496e; }
+.plan-today-header { display:flex; align-items:flex-start; justify-content:space-between; gap:12px; }
+.plan-today-header h2, .plan-today-header p { margin-top:0; }
+.plan-today-header button, .plan-today-list button, .plan-today-candidates button { min-height:44px; }
+.plan-today-capacity { position:sticky; top:0; z-index:2; margin:8px 0; padding:10px 12px; border:1px solid #31577f; border-radius:10px; background:#10233a; font-weight:700; }
+.plan-today-error { min-height:1.4em; color:#fca5a5; }
+.plan-today-list, .plan-today-candidates { display:grid; gap:8px; }
+.plan-today-item { display:grid; grid-template-columns:minmax(0,1fr) auto; gap:8px; align-items:center; padding:10px; border:1px solid #1f3a5f; border-radius:12px; background:#0f1d33; }
+.plan-today-item-copy { min-width:0; overflow-wrap:anywhere; }
+.plan-today-item-actions { display:flex; gap:6px; flex-wrap:wrap; justify-content:flex-end; }
+.plan-today-candidate-actions { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:6px; }
+.plan-preview-actions { position:fixed; z-index:76; right:16px; bottom:calc(16px + env(safe-area-inset-bottom)); display:grid; grid-template-columns:1fr 1fr; gap:8px; width:min(420px,calc(100vw - 32px)); padding:10px; border:1px solid #31577f; border-radius:12px; background:rgba(11,21,38,.98); box-shadow:0 12px 36px rgba(0,0,0,.45); }
+.plan-preview-actions[hidden] { display:none; }
+.plan-preview-actions button { min-height:44px; }
+.plan-today-actions { position:sticky; bottom:0; display:grid; grid-template-columns:1fr 1fr; gap:8px; margin:16px -6px -6px; padding:12px 6px; padding-bottom:calc(12px + env(safe-area-inset-bottom)); background:rgba(11,21,38,.98); border-top:1px solid #2a496e; }
+.plan-today-actions button { min-height:44px; width:100%; }
 .my-work-header { display:flex; align-items:center; justify-content:space-between; gap:10px; flex-wrap:wrap; }
 .work-settings { width:100%; }
 .work-settings > summary { display:none; }
@@ -96,7 +114,9 @@ textarea { resize: vertical; min-height: 120px; }
 .draft-preview { color:var(--muted); overflow-wrap:anywhere; }
 .draft-actions { display:grid; grid-template-columns:repeat(auto-fit,minmax(120px,1fr)); gap:8px; }
 .draft-actions button { min-height:44px; width:100%; }
-.create-issue-actions button { min-height:44px; max-width:100%; }
+.create-issue-actions { display:grid; grid-template-columns:repeat(auto-fit,minmax(140px,1fr)); gap:8px; padding-bottom:env(safe-area-inset-bottom); }
+.create-issue-actions button { min-height:44px; max-width:100%; width:100%; }
+.create-issue-actions #create-issue-status { grid-column:1/-1; }
 .my-work-card { min-height: 44px; display:grid; gap:8px; padding:12px; border:1px solid #1f3a5f; border-radius:12px; background:#0f1d33; color:var(--text); }
 .my-work-card-main { display:block; width:100%; color:var(--text); text-align:left; font:inherit; background:transparent; border:0; padding:0; }
 .my-work-card-main.review-trigger { width:100%; text-align:left; font:inherit; }
@@ -105,10 +125,22 @@ textarea { resize: vertical; min-height: 120px; }
 .later-actions, .today-actions { display:grid; grid-template-columns:repeat(auto-fit,minmax(120px,1fr)); gap:8px; }
 .later-actions button { min-height:44px; width:100%; }
 .today-actions button { min-height:44px; width:100%; }
+.card-planning { min-width:0; }
+.card-planning > summary { display:none; }
+.card-planning:not([open]) > .card-planning-actions { display:grid; }
+.card-planning-actions { display:grid; gap:8px; min-width:0; }
 .detail-defer { grid-column:1/-1; max-width:100%; }
 .detail-defer summary, .detail-defer button { min-height:44px; display:flex; align-items:center; justify-content:center; }
 .detail-defer summary { cursor:pointer; border:1px solid #60a5fa; border-radius:10px; font-weight:700; }
 .detail-defer-options { display:grid; grid-template-columns:repeat(auto-fit,minmax(120px,1fr)); gap:8px; margin-top:8px; }
+.later-picker { box-sizing:border-box; width:100%; height:100%; max-width:none; max-height:none; margin:0; padding:0; border:0; position:fixed; inset:0; z-index:90; display:flex; align-items:flex-end; justify-content:center; background:rgba(5,12,21,.78); backdrop-filter:blur(4px); }
+.later-picker[hidden] { display:none; }
+.later-picker-panel { box-sizing:border-box; width:min(560px,100%); max-height:100%; overflow:auto; display:grid; gap:12px; padding:18px; padding-bottom:calc(18px + env(safe-area-inset-bottom)); border:1px solid #2a496e; border-radius:18px 18px 0 0; background:#0b1526; }
+.later-picker-header { display:flex; align-items:center; justify-content:space-between; gap:12px; }
+.later-picker-header h2 { margin:0; }
+.later-picker input, .later-picker button { box-sizing:border-box; width:100%; min-height:44px; }
+.later-picker input { padding:10px; border:1px solid #2a496e; border-radius:10px; color:var(--text); background:#08111f; color-scheme:dark; font:inherit; }
+.later-picker-error { min-height:1.4em; color:#fca5a5; }
 .review-sheet-actions { position:sticky; bottom:0; z-index:3; padding:10px 4px; padding-bottom:calc(10px + env(safe-area-inset-bottom)); background:rgba(11,21,38,.98); border-top:1px solid #2a496e; }
 .mark-update-read { min-height:44px; width:100%; }
 .read-update { min-height:44px; width:100%; display:flex; align-items:center; justify-content:center; }
@@ -218,6 +250,7 @@ textarea { resize: vertical; min-height: 120px; }
 .find-work-action { min-height:44px; }
 .my-work-actions { display:flex; flex-wrap:wrap; gap:8px; }
 .start-work-session { min-height:44px; }
+.resume-today-session, .end-today-session { min-height:44px; }
 .work-session-nav { position:sticky; bottom:0; z-index:5; display:grid; grid-template-columns:1fr 1fr; gap:8px; margin-top:12px; padding:10px 4px; padding-bottom:calc(10px + env(safe-area-inset-bottom)); background:rgba(11,21,38,.98); border-top:1px solid #2a496e; }
 .work-session-nav[hidden] { display:none; }
 .work-session-nav [data-work-session-progress] { grid-column:1 / -1; text-align:center; }
@@ -230,6 +263,8 @@ textarea { resize: vertical; min-height: 120px; }
 .find-work-list { display:grid; gap:10px; }
 .find-work-card { display:grid; gap:8px; padding:12px; border:1px solid #2a496e; border-radius:12px; background:#101f36; overflow-wrap:anywhere; }
 .find-work-card button { width:100%; font-weight:700; }
+.find-work-claim-actions { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:8px; }
+.find-work-claim-actions [data-claim-start-index] { grid-column:1 / -1; }
 .find-work-detail { min-width:0; display:grid; gap:10px; padding:10px; border-radius:10px; background:#0b1526; }
 .find-work-description { margin:0; white-space:pre-wrap; overflow-wrap:anywhere; }
 .find-work-detail a { display:flex; align-items:center; justify-content:center; border:1px solid #60a5fa; border-radius:10px; font-weight:700; }
@@ -240,6 +275,7 @@ textarea { resize: vertical; min-height: 120px; }
 .search-preview-header button, .search-preview-actions button, .search-preview-actions a { min-height:44px; }
 .search-preview-body { margin:0; white-space:pre-wrap; overflow-wrap:anywhere; }
 .search-preview-actions { position:sticky; bottom:0; display:grid; gap:8px; padding:10px 0; padding-bottom:calc(10px + env(safe-area-inset-bottom)); background:#0b1526; }
+.search-preview-primary-actions { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:8px; }
 .search-preview-actions a { display:flex; align-items:center; justify-content:center; border:1px solid #60a5fa; border-radius:10px; font-weight:700; }
 .markdown-content { min-width:0; max-width:100%; overflow-wrap:anywhere; white-space:normal; }
 .markdown-content > :first-child { margin-top:0; }
@@ -260,12 +296,19 @@ textarea { resize: vertical; min-height: 120px; }
 .create-issue-header { display:flex; align-items:center; justify-content:space-between; gap:10px; }
 .create-issue-header button, .create-issue-actions button { min-height:44px; }
 .create-issue-form { display:grid; gap:12px; }
+.create-issue-repository-more { min-height:44px; width:100%; }
 .create-issue-form label { display:grid; gap:6px; }
 .create-issue-form select, .create-issue-form input[type="date"] { min-height:44px; padding:8px; border-radius:8px; border:1px solid #1f3a5f; background:#0b1526; color:#e5e7eb; }
 .create-issue-labels { display:grid; gap:8px; margin:0; padding:0; border:0; }
 .create-issue-label-list { display:grid; grid-template-columns:repeat(auto-fit,minmax(140px,1fr)); gap:8px; }
 .create-issue-label-option { min-height:44px; display:flex !important; grid-template-columns:auto 1fr !important; align-items:center; gap:8px; padding:8px 10px; border:1px solid #2a496e; border-radius:10px; background:#10213a; }
 .create-issue-label-option input { width:20px; height:20px; margin:0; }
+.create-issue-duplicates { display:grid; gap:8px; min-width:0; padding:12px; border:1px solid #f59e0b; border-radius:10px; background:#2b210f; }
+.create-issue-duplicates[hidden] { display:none; }
+.create-issue-duplicate-list { display:grid; gap:8px; min-width:0; }
+.create-issue-duplicate-card { display:grid; gap:4px; min-width:0; padding:10px; border:1px solid #6b5220; border-radius:10px; background:#171d29; overflow-wrap:anywhere; }
+.create-issue-duplicate-card a, #create-issue-anyway { display:flex; align-items:center; min-height:44px; max-width:100%; }
+.create-issue-duplicate-card a { color:#93c5fd; }
 .create-issue-actions { position:sticky; bottom:0; display:grid; gap:8px; padding:10px 0; padding-bottom:calc(10px + env(safe-area-inset-bottom)); background:#0b1526; }
 .shared-content-conflict { display:grid; gap:8px; padding:12px; border:1px solid #8b5cf6; border-radius:10px; background:#16142b; }
 .shared-content-actions { display:grid; grid-template-columns:1fr 1fr; gap:8px; }
@@ -321,6 +364,16 @@ textarea { resize: vertical; min-height: 120px; }
   .work-settings:not([open]) > .work-settings-panel { display:none; }
   .work-settings-panel { display:grid; gap:10px; margin-top:8px; }
   .my-work-list { grid-template-columns:1fr; }
+  .my-work-card { min-width:0; overflow-x:hidden; }
+  .card-planning > summary { min-height:44px; display:flex; align-items:center; justify-content:center; cursor:pointer; border:1px solid #60a5fa; border-radius:10px; font-weight:700; list-style:none; }
+  .card-planning > summary::-webkit-details-marker { display:none; }
+  .card-planning:not([open]) > .card-planning-actions { display:none; }
+  .card-planning[open] > .card-planning-actions { display:grid; margin-top:8px; }
+  .plan-today-panel { width:100%; border-left:0; padding:14px; }
+  .plan-today-item { grid-template-columns:1fr; }
+  .plan-today-item-actions { display:grid; grid-template-columns:repeat(3,1fr); width:100%; }
+  .plan-today-candidate-actions { grid-template-columns:repeat(2,1fr); width:100%; }
+  .plan-today-item-actions button { min-width:0; padding-inline:4px; }
   .work-filters { width:100%; }
   .work-filter { flex:1 1 calc(50% - 8px); }
   .review-sheet-panel { width:100%; border-left:0; padding:14px; }

frontend/detail-defer.js

@@ -8,21 +8,23 @@ function createDetailDefer({
   formatTime = value => new Date(value).toLocaleString(),
 }) {
   return {
-    defer(item, preset) {
+    deferUntil(item, until, { closeSheet = true, restoreFocus = true } = {}) {
       if (!item) return false;
-      const until = laterWork.presetUntil(preset);
       const result = laterWork.defer(item, until);
       if (result !== 'deferred') {
         announce(result === 'invalid' ? 'Choose a valid future time.' : 'Could not save Later on this device.');
         return false;
       }
       const inSession = session.active();
-      if (!inSession) close();
+      if (!inSession && closeSheet) close();
       refresh();
       announce('Deferred until ' + formatTime(until) + '. It stays unread and unchanged in Gitea.');
-      if (!inSession) focus();
+      if (!inSession && restoreFocus) focus();
       return true;
     },
+    defer(item, preset) {
+      return this.deferUntil(item, laterWork.presetUntil(preset));
+    },
   };
 }
 

frontend/drafts.js

@@ -101,7 +101,7 @@ function createDraftInbox({ storage, getCurrentLogin = () => '', now = () => Dat
   function parseOutbox(raw) {
     try {
       const record = JSON.parse(raw);
-      if (![1, 2].includes(record?.version) || !Array.isArray(record.items)) return [];
+      if (![1, 2, 3].includes(record?.version) || !Array.isArray(record.items)) return [];
       const currentLogin = String(getCurrentLogin() || '').trim();
       return record.items.filter(item =>
         item && typeof item.id === 'string' && typeof item.repository === 'string' && typeof item.title === 'string'
@@ -112,9 +112,11 @@ function createDraftInbox({ storage, getCurrentLogin = () => '', now = () => Dat
         id: 'stackchain.issue-outbox.v1:' + item.id,
         outbox_id: item.id,
         kind: 'issue-outbox',
-        status: item.status === 'attention' ? 'attention' : 'queued',
+        status: item.status === 'completion' ? 'completion' : (item.status === 'attention' ? 'attention' : 'queued'),
         label: item.deliveryState === 'uncertain' ? 'Verify delivery' :
-          (item.status === 'attention' ? 'Needs attention' : 'Queued issue'),
+          (item.status === 'completion' ? 'Created · ready to start' :
+            (item.status === 'attention' ? 'Needs attention' : 'Queued issue')),
+        continuation: item.status === 'completion' && item.completionIntent === 'create-and-start',
         delivery_state: item.deliveryState,
         repository: item.repository,
         title: textPreview(item.title) || 'Untitled queued issue',

frontend/index.html

@@ -48,7 +48,10 @@
         <div class="small" id="my-work-status" aria-live="polite">Loading assigned work…</div>
       </div>
       <div class="my-work-actions">
+        <button class="plan-today" id="plan-today" type="button">Plan Today</button>
         <button class="start-work-session" id="start-work-session" type="button">Start work</button>
+        <button class="resume-today-session" id="resume-today-session" type="button" hidden>Resume Today</button>
+        <button class="end-today-session" id="end-today-session" type="button" hidden>End session</button>
         <button class="find-work-action" id="find-work" type="button">Find work</button>
         <button class="new-issue" id="new-issue" type="button">New issue</button>
       </div>
@@ -170,6 +173,34 @@
   </aside>
 </main>
 
+<div class="plan-today-sheet" id="plan-today-sheet" role="dialog" aria-modal="true" aria-labelledby="plan-today-title" hidden>
+  <section class="plan-today-panel">
+    <div class="plan-today-header">
+      <div><h2 id="plan-today-title">Plan Today</h2><p class="small muted">Choose and order the work you want to finish next.</p></div>
+      <button id="cancel-plan-today" type="button">Cancel</button>
+    </div>
+    <div class="plan-today-capacity" id="plan-today-capacity" role="status" aria-live="polite">0 of 5 selected</div>
+    <div class="small plan-today-error" id="plan-today-error" role="alert"></div>
+    <section aria-labelledby="today-plan-heading">
+      <h3 id="today-plan-heading">Today, in order</h3>
+      <div class="plan-today-list" id="plan-today-list"></div>
+    </section>
+    <section aria-labelledby="today-candidates-heading">
+      <h3 id="today-candidates-heading">Available My Work</h3>
+      <div class="plan-today-candidates" id="plan-today-candidates"></div>
+    </section>
+    <div class="plan-today-actions">
+      <button id="save-today-plan" type="button">Save plan</button>
+      <button id="save-and-start-today" type="button">Save &amp; start</button>
+    </div>
+  </section>
+</div>
+
+<div class="plan-preview-actions" id="plan-preview-actions" hidden>
+  <button id="back-to-plan" type="button">Back to plan</button>
+  <button id="add-plan-preview" type="button">Add to Today &amp; back</button>
+</div>
+
 <div id="cmd-palette" role="dialog" aria-label="Command palette">
   <div class="cmd-palette-header">
     <strong>Search work</strong>
@@ -192,7 +223,10 @@
     <div id="search-preview-meta" class="row"></div>
     <div id="search-preview-body" class="search-preview-body markdown-content"></div>
     <div class="search-preview-actions">
-      <button id="claim-search-result" type="button" hidden>Assign to me</button>
+      <div class="search-preview-primary-actions">
+        <button id="claim-search-result" type="button" hidden>Assign to me</button>
+        <button id="start-search-result" type="button" hidden>Assign &amp; start</button>
+      </div>
       <a id="open-search-result-gitea" href="#" target="_blank" rel="noopener noreferrer">Open in Gitea</a>
     </div>
   </section>
@@ -294,7 +328,7 @@
       <button id="release-issue" type="button">Release assignment</button>
       <button id="close-issue" type="button">Close issue</button>
       <a id="open-issue-gitea" href="#" target="_blank" rel="noopener noreferrer">Open in Gitea</a>
-      <details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today" disabled data-planning-disabled>Later today</button><button type="button" data-detail-defer-preset="tomorrow" disabled data-planning-disabled>Tomorrow</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details>
+      <details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today" disabled data-planning-disabled>Later today</button><button type="button" data-detail-defer-preset="tomorrow" disabled data-planning-disabled>Tomorrow</button><button type="button" data-detail-defer-custom disabled data-planning-disabled>Choose date &amp; time</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details>
     </div>
     <nav class="work-session-nav" aria-label="Work session" hidden>
       <span class="small" aria-live="polite" data-work-session-progress></span>
@@ -335,6 +369,8 @@
       <label for="create-issue-repository">Repository
         <select id="create-issue-repository" required></select>
       </label>
+      <button class="create-issue-repository-more" id="load-more-issue-repositories" type="button" hidden>Load more repositories</button>
+      <div id="create-issue-repository-status" class="small" aria-live="polite"></div>
       <label for="create-issue-title">Title
         <input id="create-issue-title" type="text" maxlength="255" required autocomplete="off" />
       </label>
@@ -355,10 +391,17 @@
         <div class="small" id="create-issue-label-status" aria-live="polite">Choose a repository to load labels.</div>
         <div class="create-issue-label-list" id="create-issue-label-list"></div>
       </fieldset>
+      <section class="create-issue-duplicates" id="create-issue-duplicates" aria-live="polite" hidden>
+        <strong>Possible existing issues</strong>
+        <div id="create-issue-duplicate-status" class="small"></div>
+        <div id="create-issue-duplicate-list" class="create-issue-duplicate-list"></div>
+        <button id="create-issue-anyway" type="button" hidden>Create anyway</button>
+      </section>
       <div class="small">The issue will be assigned to you.</div>
       <div class="create-issue-actions">
         <button id="save-unfiled-issue" type="button">Save for filing</button>
         <button id="submit-new-issue" type="submit">Create &amp; assign to me</button>
+        <button id="create-and-start-issue" type="submit">Create &amp; start</button>
         <div id="create-issue-status" class="small" aria-live="assertive"></div>
       </div>
     </form>
@@ -400,7 +443,7 @@
       <button class="share-work-route" type="button">Share</button>
       <button id="mark-update-read-next" type="button">Mark read &amp; next</button>
       <a id="open-update-gitea" href="#" target="_blank" rel="noopener noreferrer">Open in Gitea</a>
-      <details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today" disabled data-planning-disabled>Later today</button><button type="button" data-detail-defer-preset="tomorrow" disabled data-planning-disabled>Tomorrow</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details>
+      <details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today" disabled data-planning-disabled>Later today</button><button type="button" data-detail-defer-preset="tomorrow" disabled data-planning-disabled>Tomorrow</button><button type="button" data-detail-defer-custom disabled data-planning-disabled>Choose date &amp; time</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details>
     </div>
     <nav class="work-session-nav" aria-label="Work session" hidden>
       <span class="small" aria-live="polite" data-work-session-progress></span>
@@ -440,7 +483,7 @@
     <div class="pull-sheet-actions">
       <button class="share-work-route" type="button">Share</button>
       <a id="open-pull-gitea" href="#" target="_blank" rel="noopener noreferrer">Open in Gitea</a>
-      <details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today" disabled data-planning-disabled>Later today</button><button type="button" data-detail-defer-preset="tomorrow" disabled data-planning-disabled>Tomorrow</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details>
+      <details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today" disabled data-planning-disabled>Later today</button><button type="button" data-detail-defer-preset="tomorrow" disabled data-planning-disabled>Tomorrow</button><button type="button" data-detail-defer-custom disabled data-planning-disabled>Choose date &amp; time</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details>
     </div>
     <nav class="work-session-nav" aria-label="Work session" hidden>
       <span class="small" aria-live="polite" data-work-session-progress></span>
@@ -505,7 +548,7 @@
     </section>
     <h2>Review history</h2>
     <div id="review-history" class="muted"></div>
-    <div class="review-sheet-actions"><details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today" disabled data-planning-disabled>Later today</button><button type="button" data-detail-defer-preset="tomorrow" disabled data-planning-disabled>Tomorrow</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details></div>
+    <div class="review-sheet-actions"><details class="detail-defer"><summary>Defer</summary><div class="detail-defer-options"><button type="button" data-detail-defer-preset="today" disabled data-planning-disabled>Later today</button><button type="button" data-detail-defer-preset="tomorrow" disabled data-planning-disabled>Tomorrow</button><button type="button" data-detail-defer-custom disabled data-planning-disabled>Choose date &amp; time</button><button type="button" data-detail-defer-cancel>Cancel</button></div></details></div>
     <nav class="work-session-nav" aria-label="Work session" hidden>
       <span class="small" aria-live="polite" data-work-session-progress></span>
       <button type="button" data-work-session-previous>Previous</button>
@@ -514,8 +557,20 @@
   </section>
 </div>
 
+<dialog class="later-picker" id="later-picker" role="dialog" aria-modal="true" aria-labelledby="later-picker-heading" hidden>
+  <form class="later-picker-panel" id="later-picker-form">
+    <div class="later-picker-header"><h2 id="later-picker-heading">Choose return time</h2><button id="cancel-later-picker" type="button">Cancel</button></div>
+    <p class="small">The item stays unread and unchanged in Gitea.</p>
+    <label for="later-picker-time">Return this work at</label>
+    <input id="later-picker-time" type="datetime-local" required />
+    <div class="small" id="later-picker-timezone"></div>
+    <div class="small later-picker-error" id="later-picker-error" aria-live="assertive"></div>
+    <button id="confirm-later-picker" type="submit">Defer until…</button>
+  </form>
+</dialog>
+
 <nav class="mobile-task-dock" id="mobile-task-dock" aria-label="Primary tasks">
-  <button class="mobile-task-action" data-mobile-task="work" type="button" aria-current="page">Work <span class="mobile-task-count" id="mobile-attention-count" hidden>0</span></button>
+  <button class="mobile-task-action" data-mobile-task="work" type="button" aria-current="page"><span id="mobile-work-label">Work</span> <span class="mobile-task-count" id="mobile-attention-count" hidden>0</span></button>
   <button class="mobile-task-action" data-mobile-task="find" type="button">Find</button>
   <button class="mobile-task-action" data-mobile-task="new" type="button">New</button>
   <button class="mobile-task-action" data-mobile-task="search" type="button">Search</button>
@@ -539,22 +594,30 @@
 <script src="static/offline-work.js"></script>
 <script src="static/offline-today.js"></script>
 <script src="static/my-work.js"></script>
+<script src="static/card-planning.js"></script>
 <script src="static/today-work.js"></script>
+<script src="static/plan-today.js"></script>
+<script src="static/plan-today-preview.js"></script>
 <script src="static/today-sync.js"></script>
 <script src="static/update-ownership.js"></script>
 <script src="static/later-work.js"></script>
 <script src="static/later-sync.js"></script>
 <script src="static/detail-defer.js"></script>
+<script src="static/later-picker.js"></script>
 <script src="static/pick-work.js"></script>
 <script src="static/conversation.js"></script>
 <script src="static/issue-sheet.js"></script>
 <script src="static/create-issue-sheet.js"></script>
+<script src="static/create-and-start.js"></script>
+<script src="static/assign-and-start.js"></script>
+<script src="static/queue-today.js"></script>
 <script src="static/pull-sheet.js"></script>
 <script src="static/review-sheet.js"></script>
 <script src="static/work-route.js"></script>
 <script src="static/task-overlay-history.js"></script>
 <script src="static/context-poller.js"></script>
 <script src="static/mobile-task-dock.js"></script>
+<script src="static/mobile-work-entry.js"></script>
 <script src="static/mobile-launch.js"></script>
 <script src="static/install-app.js"></script>
 <script src="static/mobile-search-viewport.js"></script>

frontend/issue-outbox.js

@@ -8,13 +8,13 @@ function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, ge
   function read() {
     try {
       const record = JSON.parse(storage?.getItem(storageKey) || 'null');
-      if (![1, 2].includes(record?.version) || !Array.isArray(record.items)) return [];
+      if (![1, 2, 3].includes(record?.version) || !Array.isArray(record.items)) return [];
       return record.items.filter(item => item && typeof item === 'object');
     } catch (_error) { return []; }
   }
 
   function write(items, mirror = true) {
-    storage?.setItem(storageKey, JSON.stringify({ version: 2, items }));
+    storage?.setItem(storageKey, JSON.stringify({ version: 3, items }));
     coordinator?.notify('issue');
     if (mirror && backgroundSync?.reconcile) {
       Promise.resolve(backgroundSync.reconcile(items))
@@ -39,6 +39,7 @@ function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, ge
       status: 'queued',
       queuedAt: Number(now()),
     };
+    if (draft?.completionIntent === 'create-and-start') item.completionIntent = 'create-and-start';
     item.operationId = item.id;
     if (Number.isInteger(Number(draft?.milestoneId)) && Number(draft.milestoneId) > 0) {
       item.milestoneId = Number(draft.milestoneId);
@@ -86,6 +87,8 @@ function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, ge
         operationId: changed ? String(operationId()).slice(0, 128) : item.operationId,
         status: 'queued',
       };
+      if (draft?.completionIntent === 'create-and-start') updated.completionIntent = 'create-and-start';
+      else delete updated.completionIntent;
       if (nextMilestoneId === undefined) delete updated.milestoneId;
       if (nextDueDate === undefined) delete updated.dueDate;
       delete updated.error;
@@ -147,7 +150,7 @@ function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, ge
         }
         if (!issue) return { blocked: true };
         discard(item.id);
-        return { issue };
+        return { issue, item };
       } catch (error) {
         const status = Number(error?.status || 0);
         if (status >= 400 && status < 500) {
@@ -166,16 +169,26 @@ function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, ge
 
   async function flushQueue(currentLogin) {
     const confirmed = [];
+    const completions = [];
     let blocked = 0;
     currentLogin = String(currentLogin || '').trim();
     for (const item of read()) {
-      if (item.status === 'attention') continue;
+      if (item.status === 'attention' || item.status === 'completion') continue;
       if (!currentLogin || item.ownerLogin !== currentLogin) { blocked += 1; continue; }
       const result = await sendItem(item, currentLogin);
-      if (result.issue) confirmed.push(result.issue);
+      if (result.issue) {
+        confirmed.push(result.issue);
+        if (result.item?.completionIntent) completions.push({
+          id: result.item.id,
+          intent: result.item.completionIntent,
+          ownerLogin: result.item.ownerLogin,
+          operationId: result.item.operationId,
+          issue: result.issue,
+        });
+      }
       if (result.transient) break;
     }
-    return { confirmed, remaining: read(), blocked };
+    return { confirmed, completions, remaining: read(), blocked };
   }
 
   async function flush(currentLogin) {
@@ -202,7 +215,17 @@ function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, ge
       write(read().map(candidate => candidate.id === id ? queued : candidate));
     }
     const result = await sendItem(queued, currentLogin);
-    return { confirmed: result.issue ? [result.issue] : [], remaining: read(), blocked: 0 };
+    return {
+      confirmed: result.issue ? [result.issue] : [],
+      completions: result.issue && result.item?.completionIntent ? [{
+        id: result.item.id,
+        intent: result.item.completionIntent,
+        ownerLogin: result.item.ownerLogin,
+        operationId: result.item.operationId,
+        issue: result.issue,
+      }] : [],
+      remaining: read(), blocked: 0,
+    };
   }
 
   async function retry(id, currentLogin) {
@@ -214,7 +237,12 @@ function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, ge
     const statuses = new Map((records || []).map(item => [item.id, item]));
     const items = read().flatMap(item => {
       const background = statuses.get(item.id);
-      if (background?.status === 'sent') return [];
+      if (background?.status === 'sent') {
+        if (item.completionIntent === 'create-and-start' && background.deliveredIssue) return [{
+          ...item, status: 'completion', deliveredIssue: background.deliveredIssue,
+        }];
+        return [];
+      }
       if (background?.status === 'attention') return [{
         ...item, status: 'attention', error: String(background.error || 'Issue needs attention').slice(0, 240),
         ...(background.deliveryState ? { deliveryState: background.deliveryState } : {}),
@@ -225,7 +253,32 @@ function createIssueOutbox({ storage, fetchJson, coordinator, backgroundSync, ge
     return items;
   }
 
-  return { enqueue, enqueueDurably, update, updateDurably, discard, flush, retry, reconcileBackground, list: () => read().map(item => ({ ...item })) };
+  function pendingCompletions(currentLogin) {
+    const login = String(currentLogin || '').trim();
+    if (!login) return [];
+    return read().filter(item => item.status === 'completion' && item.ownerLogin === login &&
+      item.completionIntent === 'create-and-start' && item.deliveredIssue).map(item => ({
+        id: item.id,
+        intent: item.completionIntent,
+        ownerLogin: item.ownerLogin,
+        operationId: item.operationId,
+        issue: item.deliveredIssue,
+      }));
+  }
+
+  function completeIntent(id, currentLogin) {
+    const login = String(currentLogin || '').trim();
+    const items = read();
+    const matched = items.some(item => item.id === id && item.status === 'completion' && item.ownerLogin === login);
+    if (!matched) return false;
+    write(items.filter(item => item.id !== id));
+    return true;
+  }
+
+  return {
+    enqueue, enqueueDurably, update, updateDurably, discard, flush, retry, reconcileBackground,
+    pendingCompletions, completeIntent, list: () => read().map(item => ({ ...item })),
+  };
 }
 
 if (typeof module !== 'undefined' && module.exports) module.exports = createIssueOutbox;

frontend/later-picker.js

@@ -0,0 +1,104 @@
+function createLaterPicker({
+  now = () => new Date(),
+  history = null,
+  eventTarget = null,
+  onState = () => {},
+  onConfirm = () => false,
+} = {}) {
+  let active = false;
+  let item = null;
+  let trigger = null;
+  let context = null;
+  let afterClose = null;
+  let committed = false;
+  let started = false;
+
+  function parse(input) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})$/.exec(String(input || ''));
+    if (!match) return { ok:false, message:'Choose a valid local date and time.' };
+    const parts = match.slice(1).map(Number);
+    const value = new Date(parts[0], parts[1] - 1, parts[2], parts[3], parts[4], 0, 0);
+    const sameLocalTime = value.getFullYear() === parts[0] &&
+      value.getMonth() === parts[1] - 1 && value.getDate() === parts[2] &&
+      value.getHours() === parts[3] && value.getMinutes() === parts[4];
+    if (!sameLocalTime) return { ok:false, message:'Choose a valid local date and time.' };
+    if (value <= now()) return { ok:false, message:'Choose a future date and time.' };
+    return { ok:true, value };
+  }
+
+  function formatLocal(value) {
+    const pad = part => String(part).padStart(2, '0');
+    return value.getFullYear() + '-' + pad(value.getMonth() + 1) + '-' + pad(value.getDate()) +
+      'T' + pad(value.getHours()) + ':' + pad(value.getMinutes());
+  }
+
+  function deactivate() {
+    if (!active) return false;
+    const restore = trigger;
+    active = false;
+    item = null;
+    trigger = null;
+    context = null;
+    committed = false;
+    onState({ open:false, message:'' });
+    restore?.focus?.();
+    const cleanup = afterClose;
+    afterClose = null;
+    cleanup?.();
+    return true;
+  }
+
+  function start() {
+    if (started || !eventTarget) return;
+    started = true;
+    eventTarget.addEventListener('popstate', event => {
+      if (active && !event.state?.laterPicker) deactivate();
+    });
+    eventTarget.addEventListener('keydown', event => {
+      if (active && event.key === 'Escape') {
+        event.preventDefault?.();
+        close();
+      }
+    });
+  }
+
+  function open(nextItem, nextTrigger, nextContext = 'card') {
+    if (!nextItem || active) return false;
+    active = true;
+    item = nextItem;
+    trigger = nextTrigger || null;
+    context = nextContext;
+    committed = false;
+    const suggested = new Date(now().getTime() + 60 * 60 * 1000);
+    suggested.setMinutes(Math.ceil(suggested.getMinutes() / 15) * 15, 0, 0);
+    if (history) history.pushState({ ...(history.state || {}), laterPicker:true }, '');
+    onState({ open:true, message:'', value:formatLocal(suggested) });
+    return true;
+  }
+
+  function close() {
+    if (!active) return false;
+    if (history?.state?.laterPicker) history.back();
+    else deactivate();
+    return true;
+  }
+
+  function submit(input) {
+    if (!active || committed) return false;
+    const result = parse(input);
+    if (!result.ok) {
+      onState({ open:true, message:result.message, value:String(input || '') });
+      return false;
+    }
+    const confirmed = onConfirm(item, result.value, context);
+    if (confirmed !== true && typeof confirmed !== 'function') return false;
+    committed = true;
+    afterClose = typeof confirmed === 'function' ? confirmed : null;
+    close();
+    return true;
+  }
+
+  return { parse, start, open, close, submit, current:() => active };
+}
+
+if (typeof module !== 'undefined' && module.exports) module.exports = createLaterPicker;

frontend/later-sync.js

@@ -1,5 +1,6 @@
-function createLaterSync({ storage, getLogin, fetchJson, onRemoteRecords, onStatus, createOperationId, createChannel,
-  setTimer = globalThis.setTimeout, clearTimer = globalThis.clearTimeout, retryBaseMs = 1000, retryMaxMs = 30000 }) {
+function createLaterSync({ storage, getLogin, fetchJson, onRemoteRecords, onStatus, createOperationId, createChannel, coordinator,
+  setTimer = globalThis.setTimeout, clearTimer = globalThis.clearTimeout, retryBaseMs = 1000, retryMaxMs = 30000,
+  now = Date.now, maxOfflineMs = 30 * 24 * 60 * 60 * 1000 }) {
   const prefix = 'stackchain.later-sync.v1.';
   const migrationPrefix = 'stackchain.later-sync-migrated.v1.';
   const snapshotPrefix = 'stackchain.later-sync-snapshot.v1.';
@@ -8,6 +9,8 @@ function createLaterSync({ storage, getLogin, fetchJson, onRemoteRecords, onStat
   let channelKey = '';
   let retryTimer = null;
   let retryAttempt = 0;
+  let expiredCount = 0;
+  const knownOperationKeys = new Set();
 
   function cancelRetry() {
     if (retryTimer !== null) clearTimer?.(retryTimer);
@@ -84,25 +87,67 @@ function createLaterSync({ storage, getLogin, fetchJson, onRemoteRecords, onStat
   function pending() {
     const storageKey = key();
     if (!storageKey || !storage) return [];
+    const recordPrefix = storageKey + '.operation.';
     try {
-      const value = JSON.parse(storage.getItem(storageKey) || '[]');
-      return Array.isArray(value) ? value.filter(operation =>
-        operation && typeof operation.operation_id === 'string' &&
-        ['defer', 'restore'].includes(operation.action) &&
-        typeof operation.item_id === 'string' &&
-        (operation.action === 'restore' || typeof operation.wake_at === 'string')
-      ) : [];
+      const legacy = JSON.parse(storage.getItem(storageKey) || '[]');
+      if (Array.isArray(legacy)) {
+        legacy.forEach((operation, index) => {
+          if (!operation?.operation_id) return;
+          const recordKey = recordPrefix + encodeURIComponent(operation.operation_id);
+          storage.setItem(recordKey, JSON.stringify({ operation, queued_at: index }));
+          knownOperationKeys.add(recordKey);
+        });
+        if (legacy.length) storage.removeItem(storageKey);
+      }
+      const keys = new Set([...knownOperationKeys].filter(candidate => candidate.startsWith(recordPrefix)));
+      for (let index = 0; index < Number(storage.length || 0); index += 1) {
+        const candidate = storage.key?.(index);
+        if (candidate?.startsWith(recordPrefix)) keys.add(candidate);
+      }
+      const records = [...keys].map(recordKey => {
+        const record = JSON.parse(storage.getItem(recordKey) || 'null');
+        return record ? { ...record, recordKey } : null;
+      }).filter(record => record?.operation);
+      const expired = records.filter(record => Number(record.queued_at) >= 1_000_000_000_000 &&
+        now() - Number(record.queued_at) > maxOfflineMs);
+      expired.forEach(record => {
+        storage.removeItem(record.recordKey);
+        knownOperationKeys.delete(record.recordKey);
+      });
+      if (expired.length) {
+        expiredCount += expired.length;
+        onStatus?.('expired', { count: expiredCount });
+      }
+      const activeRecords = records.filter(record => !expired.includes(record))
+        .sort((left, right) => Number(left.queued_at || 0) - Number(right.queued_at || 0) ||
+          left.operation.operation_id.localeCompare(right.operation.operation_id));
+      const latestByItem = new Map();
+      activeRecords.forEach(record => latestByItem.set(record.operation.item_id, record));
+      activeRecords.filter(record => latestByItem.get(record.operation.item_id) !== record).forEach(record => {
+        storage.removeItem(record.recordKey);
+        knownOperationKeys.delete(record.recordKey);
+      });
+      return activeRecords.filter(record => latestByItem.get(record.operation.item_id) === record)
+        .map(record => ({
+          ...record.operation,
+          base_revision: Number.isInteger(record.operation.base_revision)
+            ? record.operation.base_revision : 0,
+        })).filter(operation =>
+          operation && typeof operation.operation_id === 'string' &&
+          ['defer', 'restore'].includes(operation.action) && typeof operation.item_id === 'string' &&
+          (operation.action === 'restore' || typeof operation.wake_at === 'string'));
     } catch (_error) {
       return [];
     }
   }
 
-  function save(operations) {
+  function removeOperation(operationId) {
     const storageKey = key();
     if (!storageKey || !storage) return false;
+    const recordKey = storageKey + '.operation.' + encodeURIComponent(operationId);
     try {
-      if (operations.length) storage.setItem(storageKey, JSON.stringify(operations));
-      else storage.removeItem(storageKey);
+      storage.removeItem(recordKey);
+      knownOperationKeys.delete(recordKey);
       return true;
     } catch (_error) {
       return false;
@@ -118,9 +163,22 @@ function createLaterSync({ storage, getLogin, fetchJson, onRemoteRecords, onStat
   function enqueue(action, itemId, wakeAt = null) {
     if (!['defer', 'restore'].includes(action) || !itemId ||
         (action === 'defer' && typeof wakeAt !== 'string')) return false;
-    const operations = pending().filter(operation => operation.item_id !== itemId);
-    operations.push({ operation_id: operationId(), action, item_id: itemId, wake_at: wakeAt });
-    const saved = save(operations);
+    pending().filter(operation => operation.item_id === itemId)
+      .forEach(operation => removeOperation(operation.operation_id));
+    const operation = {
+      operation_id: operationId(), action, item_id: itemId, wake_at: wakeAt,
+      base_revision: Math.max(0, savedRevision()),
+    };
+    const storageKey = key();
+    if (!storageKey || !storage) return false;
+    const recordKey = storageKey + '.operation.' + encodeURIComponent(operation.operation_id);
+    let saved = false;
+    try {
+      storage.setItem(recordKey, JSON.stringify({ operation, queued_at: now() }));
+      knownOperationKeys.add(recordKey);
+      saved = true;
+      coordinator?.notify('later');
+    } catch (_error) { /* Report the persistence failure below. */ }
     onStatus?.(saved ? 'pending' : 'error');
     return saved;
   }
@@ -145,26 +203,41 @@ function createLaterSync({ storage, getLogin, fetchJson, onRemoteRecords, onStat
     const ownerKey = key();
     if (!ownerKey) return false;
     ensureChannel();
+    expiredCount = 0;
     try {
-      let plan = await fetchJson('api/v1/later');
       let operations = pending();
+      let plan;
+      let conflictCount = 0;
+      if (!operations.length) plan = await fetchJson('api/v1/later');
       while (operations.length) {
         if (key() !== ownerKey) return false;
-        const operation = operations[0];
+        const batch = operations.slice(0, 50);
         plan = await fetchJson('api/v1/later', {
           method: 'PATCH',
           headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify(operation),
+          body: JSON.stringify({ operations: batch }),
         });
-        const remaining = pending();
-        const delivered = remaining.findIndex(candidate => candidate.operation_id === operation.operation_id);
-        if (delivered >= 0 && !save(remaining.filter((_, index) => index !== delivered))) {
-          throw new Error('Could not persist Later delivery receipt');
+        const hasReceipts = Array.isArray(plan.accepted_operation_ids) ||
+          Array.isArray(plan.duplicate_operation_ids) || Array.isArray(plan.rejected_operations);
+        const received = hasReceipts ? [
+          ...(plan.accepted_operation_ids || []),
+          ...(plan.duplicate_operation_ids || []),
+          ...(plan.rejected_operations || []).map(item => item.operation_id),
+        ] : batch.map(item => item.operation_id);
+        conflictCount += (plan.rejected_operations || [])
+          .filter(item => item.reason === 'stale_intent').length;
+        for (const operationId of received) {
+          if (pending().some(candidate => candidate.operation_id === operationId) &&
+              !removeOperation(operationId)) {
+            throw new Error('Could not persist Later delivery receipt');
+          }
         }
         operations = pending();
       }
       adopt(plan);
-      onStatus?.(pending().length ? 'pending' : 'saved');
+      onStatus?.(pending().length ? 'pending' :
+        (conflictCount ? 'conflict' : expiredCount ? 'expired' : 'saved'),
+        conflictCount ? { count: conflictCount } : expiredCount ? { count: expiredCount } : {});
       retryAttempt = 0;
       cancelRetry();
       return true;
@@ -176,7 +249,10 @@ function createLaterSync({ storage, getLogin, fetchJson, onRemoteRecords, onStat
   }
 
   function flush() {
-    if (!flushing) flushing = run().finally(() => { flushing = null; });
+    if (!flushing) {
+      const delivery = coordinator ? coordinator.runExclusive('later', run) : run();
+      flushing = Promise.resolve(delivery).finally(() => { flushing = null; });
+    }
     return flushing;
   }
 
@@ -187,6 +263,10 @@ function createLaterSync({ storage, getLogin, fetchJson, onRemoteRecords, onStat
     );
   }
 
+  coordinator?.subscribe(change => {
+    if (change.queue === 'later' && pending().length) flush();
+  });
+
   return { enqueue, migrate, flush, pending, startLifecycle };
 }
 

frontend/mobile-task-dock.js

@@ -7,6 +7,7 @@
   const overlays = options.overlays || [];
   let launcher = null;
   let wasHidden = false;
+  let workMode = 'work';
 
   function select(name) {
     Object.entries(buttons).forEach(([key, button]) => {
@@ -34,9 +35,17 @@
     refreshVisibility();
   }
 
-  function updateAttention(count) {
+  function updateWork(mode, count) {
+    const labels = {
+      continue: ['Continue', 'Continue Today'],
+      resume: ['Resume', 'Resume Today'],
+      start: ['Start', 'Start Today'],
+      work: ['Work', 'Work'],
+    };
+    workMode = labels[mode] ? mode : 'work';
     const total = Math.max(0, Number(count) || 0);
     const badge = options.attentionBadge;
+    if (options.workLabel) options.workLabel.textContent = labels[workMode][0];
     if (badge) {
       badge.textContent = String(total);
       badge.hidden = total === 0;
@@ -44,10 +53,14 @@
     if (buttons.work) {
       buttons.work.setAttribute(
         'aria-label',
-        total ? 'Work, ' + total + ' items need attention' : 'Work'
+        labels[workMode][1] + (total ? ', ' + total + ' items need attention' : '')
       );
     }
   }
 
-  return {start, refreshVisibility, updateAttention};
+  function updateAttention(count) {
+    updateWork(workMode, count);
+  }
+
+  return {start, refreshVisibility, updateAttention, updateWork};
 });

frontend/mobile-work-entry.js

@@ -0,0 +1,22 @@
+(function (root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory;
+  else root.createMobileWorkEntry = factory;
+})(typeof self !== 'undefined' ? self : this, function createMobileWorkEntry(options) {
+  function mode() {
+    if (options.isTodayActive()) return 'continue';
+    if (options.getTodayCount() > 0 && options.isTodayResumable()) return 'resume';
+    if (options.getTodayCount() > 0) return 'start';
+    return 'work';
+  }
+
+  function open() {
+    const current = mode();
+    if (current === 'continue') options.continueToday();
+    else if (current === 'resume') options.resumeToday();
+    else if (current === 'start') options.startToday();
+    else options.openFallback();
+    return current;
+  }
+
+  return {mode, open};
+});

frontend/my-work.js

@@ -472,10 +472,67 @@ function workIdentity(item) {
   return [kind, repository, number, notification].join(':');
 }
 
-function createWorkSession({ getItems, getFilter, getMilestone = () => 'all', onOpen, onProgress, onFinish }) {
+function createWorkSessionCheckpoint({
+  storage,
+  getLogin,
+  onError = () => {},
+  key = 'stackchain.today-session.v1',
+}) {
+  const login = () => String(getLogin() || '').trim();
+  let errorReported = false;
+  const reportError = error => {
+    if (errorReported) return;
+    errorReported = true;
+    onError(error);
+  };
+  const read = () => {
+    const owner = login();
+    if (!owner) return null;
+    try {
+      const value = JSON.parse(storage.getItem(key) || 'null');
+      if (value?.version !== 1 || value.login !== owner || typeof value.identity !== 'string' ||
+          !Number.isInteger(value.index) || value.index < 0) return null;
+      return value;
+    } catch (error) {
+      reportError(error);
+      return null;
+    }
+  };
+  return {
+    read,
+    save(identity, index) {
+      const owner = login();
+      if (!owner) return false;
+      try {
+        storage.setItem(key, JSON.stringify({ version:1, login:owner, identity, index }));
+        return true;
+      } catch (error) {
+        reportError(error);
+        return false;
+      }
+    },
+    clear() {
+      if (!read()) return false;
+      try {
+        storage.removeItem(key);
+        return true;
+      } catch (error) {
+        reportError(error);
+        return false;
+      }
+    },
+  };
+}
+
+function createWorkSession({
+  getItems, getFilter, getMilestone = () => 'all', checkpoint = null,
+  checkpointEnabled = () => true,
+  onOpen, onProgress, onFinish,
+}) {
   let currentIdentity = '';
   let currentIndex = -1;
   let running = false;
+  let durable = false;
 
   const queue = () => filterMyWork(getItems() || [], getFilter(), getMilestone());
   const report = (items, index) => onProgress({
@@ -485,9 +542,12 @@ function createWorkSession({ getItems, getFilter, getMilestone = () => 'all', on
     can_next: index < items.length - 1,
   });
   const finish = () => {
+    const clearCheckpoint = durable;
     running = false;
+    durable = false;
     currentIdentity = '';
     currentIndex = -1;
+    if (clearCheckpoint) checkpoint?.clear();
     onFinish();
     return false;
   };
@@ -495,6 +555,7 @@ function createWorkSession({ getItems, getFilter, getMilestone = () => 'all', on
     if (!items.length || index < 0 || index >= items.length) return finish();
     currentIndex = index;
     currentIdentity = workIdentity(items[index]);
+    if (durable) checkpoint?.save(currentIdentity, currentIndex);
     report(items, index);
     onOpen(items[index]);
     return true;
@@ -502,11 +563,36 @@ function createWorkSession({ getItems, getFilter, getMilestone = () => 'all', on
 
   return {
     active: () => running,
-    start() {
+    checkpointed: () => running && durable,
+    end: () => finish(),
+    resumable: () => Boolean(checkpoint?.read()),
+    reopen() {
+      if (!running) return false;
+      const items = queue();
+      const index = items.findIndex(item => workIdentity(item) === currentIdentity);
+      if (index < 0) return false;
+      currentIndex = index;
+      report(items, index);
+      onOpen(items[index]);
+      return true;
+    },
+    resume() {
+      const saved = checkpoint?.read();
+      if (!saved) return false;
+      durable = true;
       const items = queue();
       if (!items.length) return finish();
       running = true;
-      return openAt(items, 0);
+      const exact = items.findIndex(item => workIdentity(item) === saved.identity);
+      return openAt(items, exact >= 0 ? exact : Math.min(saved.index, items.length - 1));
+    },
+    start(item = null) {
+      const items = queue();
+      if (!items.length) return finish();
+      running = true;
+      durable = Boolean(checkpoint && checkpointEnabled());
+      const requested = item ? items.findIndex(candidate => workIdentity(candidate) === workIdentity(item)) : 0;
+      return openAt(items, requested >= 0 ? requested : 0);
     },
     reconcile() {
       if (!running) return false;
@@ -611,6 +697,7 @@ if (typeof module !== 'undefined' && module.exports) {
   buildMyWork.filterMyWork = filterMyWork;
   buildMyWork.milestoneLanes = milestoneLanes;
   buildMyWork.createWorkSession = createWorkSession;
+  buildMyWork.createWorkSessionCheckpoint = createWorkSessionCheckpoint;
   buildMyWork.workIdentity = workIdentity;
   buildMyWork.replaceIssueLabels = replaceIssueLabels;
   buildMyWork.replaceIssueContent = replaceIssueContent;

frontend/outbox-coordinator.js

@@ -15,7 +15,7 @@ function createOutboxCoordinator({
   let sequence = 0;
 
   function validChange(value) {
-    return value && (value.queue === 'issue' || value.queue === 'authored') ? value : null;
+    return value && ['issue', 'authored', 'today', 'later'].includes(value.queue) ? value : null;
   }
 
   function publish(change) {

frontend/plan-today-preview.js

@@ -0,0 +1,45 @@
+(function (root, factory) {
+  const api = factory();
+  if (typeof module === 'object' && module.exports) module.exports = api;
+  else root.createPlanTodayPreview = api;
+})(typeof globalThis !== 'undefined' ? globalThis : this, function () {
+  'use strict';
+
+  return function createPlanTodayPreview({
+    planner,
+    identity,
+    getScroll = () => 0,
+    setScroll = () => {},
+    onOpen = () => {},
+    onClose = () => {},
+  }) {
+    let current = null;
+
+    function open(item, trigger = null) {
+      if (!item || !identity?.(item) || !planner?.snapshot().open) return false;
+      current = { item, trigger, scroll:Number(getScroll()) || 0 };
+      onOpen(item, trigger);
+      return true;
+    }
+
+    function close({ add = false } = {}) {
+      if (!current) return 'closed';
+      const { item, trigger, scroll } = current;
+      let result = 'returned';
+      if (add) {
+        const id = identity(item);
+        result = planner.snapshot().ids.includes(id) ? 'already-added' : planner.toggle(item);
+      }
+      current = null;
+      setScroll(scroll);
+      onClose(item, trigger);
+      return result;
+    }
+
+    function snapshot() {
+      return current ? { open:true, item:current.item, trigger:current.trigger, scroll:current.scroll } : { open:false };
+    }
+
+    return { open, close, snapshot };
+  };
+});

frontend/plan-today.js

@@ -0,0 +1,85 @@
+function createPlanToday({ identity, save, start, limit = 5 }) {
+  let openState = false;
+  let draftIds = [];
+  let itemsById = new Map();
+
+  function cleanItems(items) {
+    const unique = new Map();
+    for (const item of items || []) {
+      const id = identity?.(item);
+      if (id && !unique.has(id)) unique.set(id, item);
+    }
+    return unique;
+  }
+
+  function open(selectedItems, candidates) {
+    itemsById = cleanItems([...(selectedItems || []), ...(candidates || [])]);
+    draftIds = [];
+    for (const item of selectedItems || []) {
+      const id = identity?.(item);
+      if (id && itemsById.has(id) && !draftIds.includes(id) && draftIds.length < limit) draftIds.push(id);
+    }
+    openState = true;
+    return snapshot();
+  }
+
+  function toggle(item) {
+    if (!openState) return 'closed';
+    const id = identity?.(item);
+    if (!id) return 'unavailable';
+    itemsById.set(id, item);
+    const index = draftIds.indexOf(id);
+    if (index >= 0) {
+      draftIds.splice(index, 1);
+      return 'removed';
+    }
+    if (draftIds.length >= limit) return 'full';
+    draftIds.push(id);
+    return 'added';
+  }
+
+  function move(id, direction) {
+    const index = draftIds.indexOf(id);
+    const target = direction === 'up' ? index - 1 : direction === 'down' ? index + 1 : -1;
+    if (!openState || index < 0 || target < 0 || target >= draftIds.length) return false;
+    [draftIds[index], draftIds[target]] = [draftIds[target], draftIds[index]];
+    return true;
+  }
+
+  function close() {
+    openState = false;
+    draftIds = [];
+    itemsById = new Map();
+  }
+
+  function cancel() {
+    close();
+    return true;
+  }
+
+  function commit({ start: startAfterSave = false } = {}) {
+    if (!openState) return 'closed';
+    const ids = [...draftIds];
+    if (save?.(ids) === false) return 'unavailable';
+    const first = ids.length ? itemsById.get(ids[0]) : null;
+    close();
+    if (startAfterSave && first) start?.(first);
+    return 'saved';
+  }
+
+  function snapshot() {
+    return { open: openState, ids: [...draftIds], count: draftIds.length, limit };
+  }
+
+  function item(id) {
+    return itemsById.get(id) || null;
+  }
+
+  function candidates() {
+    return [...itemsById.entries()].filter(([id]) => !draftIds.includes(id)).map(([, value]) => value);
+  }
+
+  return { open, toggle, move, cancel, commit, snapshot, item, candidates };
+}
+
+if (typeof module !== 'undefined' && module.exports) module.exports = createPlanToday;

frontend/queue-today.js

@@ -0,0 +1,17 @@
+function createQueueToday({ todayWork, todaySync, refresh, warm }) {
+  return function queueToday(issue) {
+    const added = todayWork.add(issue);
+    if (added !== 'added' && added !== 'exists') return added;
+    if (added === 'added' && !todaySync.enqueue('add', todayWork.identity(issue))) {
+      refresh();
+      warm();
+      return 'sync-unavailable';
+    }
+    refresh();
+    if (added === 'added') todaySync.flush();
+    warm();
+    return 'queued';
+  };
+}
+
+if (typeof module !== 'undefined' && module.exports) module.exports = createQueueToday;

frontend/service-worker.js

@@ -1,6 +1,7 @@
 const BASE = new URL('./', self.location.href).pathname;
 importScripts(BASE + 'static/background-issue-sync.js');
-const CACHE = 'stackchain-dashboard-shell-v49';
+const CACHE = 'stackchain-dashboard-shell-v67';
+const OFFLINE_LEASE_URL = new URL(BASE + '__offline-session-lease', self.location.origin).href;
 const OUTAGE_STATUSES = new Set([500, 502, 503, 504]);
 const NAVIGATION_TIMEOUT_MS = self.__STACKCHAIN_NAVIGATION_TIMEOUT_MS || 4000;
 const SHELL = [
@@ -24,22 +25,30 @@ const SHELL = [
   BASE + 'static/offline-work.js',
   BASE + 'static/offline-today.js',
   BASE + 'static/my-work.js',
+  BASE + 'static/card-planning.js',
   BASE + 'static/today-work.js',
+  BASE + 'static/plan-today.js',
+  BASE + 'static/plan-today-preview.js',
   BASE + 'static/today-sync.js',
   BASE + 'static/update-ownership.js',
   BASE + 'static/later-work.js',
   BASE + 'static/later-sync.js',
   BASE + 'static/detail-defer.js',
+  BASE + 'static/later-picker.js',
   BASE + 'static/pick-work.js',
   BASE + 'static/conversation.js',
   BASE + 'static/issue-sheet.js',
   BASE + 'static/create-issue-sheet.js',
+  BASE + 'static/create-and-start.js',
+  BASE + 'static/assign-and-start.js',
+  BASE + 'static/queue-today.js',
   BASE + 'static/pull-sheet.js',
   BASE + 'static/review-sheet.js',
   BASE + 'static/work-route.js',
   BASE + 'static/task-overlay-history.js',
   BASE + 'static/context-poller.js',
   BASE + 'static/mobile-task-dock.js',
+  BASE + 'static/mobile-work-entry.js',
   BASE + 'static/mobile-launch.js',
   BASE + 'static/install-app.js',
   BASE + 'static/mobile-search-viewport.js',
@@ -100,6 +109,41 @@ async function purgeRevokedSessionData() {
   clients.forEach(client => client.postMessage?.({ type: 'stackchain-session-revoked' }));
 }
 
+async function storeOfflineLease(expiresAt) {
+  if (!Number.isInteger(expiresAt) || expiresAt <= 0) return;
+  const cache = await caches.open(CACHE);
+  await cache.put(OFFLINE_LEASE_URL, new Response(
+    JSON.stringify({ expires_at: expiresAt }),
+    { headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' } },
+  ));
+}
+
+async function validOfflineLease(cache) {
+  const response = await cache.match(OFFLINE_LEASE_URL);
+  const payload = await response?.json?.().catch(() => ({})) || {};
+  return Number.isInteger(payload.expires_at)
+    && payload.expires_at > Math.floor(Date.now() / 1000);
+}
+
+async function expiredOfflineResponse() {
+  await issueSync.purge();
+  const keys = await caches.keys();
+  await Promise.all(
+    keys.filter(key => key.startsWith('stackchain-dashboard-')).map(key => caches.delete(key))
+  );
+  const clients = await self.clients.matchAll({ type: 'window', includeUncontrolled: true });
+  clients.forEach(client => client.postMessage?.({ type: 'stackchain-session-expired' }));
+  return new Response(
+    'Your Stackchain session expired. Reconnect and sign in.',
+    { status: 401, headers: { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store' } },
+  );
+}
+
+async function cachedShellWithValidLease(cache) {
+  if (!await validOfflineLease(cache)) return expiredOfflineResponse();
+  return cache.match(BASE);
+}
+
 async function fetchJson(url, options = {}) {
   const requestOptions = { ...options };
   const method = String(options.method || 'GET').toUpperCase();
@@ -173,6 +217,9 @@ self.addEventListener('sync', event => {
 
 self.addEventListener('message', event => {
   if (event.data?.type === 'stackchain-resume-outbox') event.waitUntil(flushAndNotify());
+  if (event.data?.type === 'stackchain-session-lease') {
+    event.waitUntil(storeOfflineLease(event.data.expiresAt));
+  }
   if (event.data?.type === 'stackchain-purge-outbox') event.waitUntil((async () => {
     try {
       await issueSync.purge();
@@ -211,13 +258,13 @@ self.addEventListener('fetch', event => {
         if (response.ok && !response.redirected && isDashboardShell) {
           await cache.put(BASE, response.clone());
         } else if (OUTAGE_STATUSES.has(response.status)) {
-          const cached = await cache.match(BASE);
+          const cached = await cachedShellWithValidLease(cache);
           if (cached) return cached;
         }
         return response;
       }).catch(async () => {
         const cache = await caches.open(CACHE);
-        const cached = await cache.match(BASE);
+        const cached = await cachedShellWithValidLease(cache);
         return cached || new Response(
           'Stackchain is offline and the dashboard is not cached yet. Reconnect and try again.',
           { status: 504, headers: { 'Content-Type': 'text/plain; charset=utf-8' } },

frontend/session.js

@@ -81,7 +81,9 @@
         devicesSheet.hidden = true;
         devicesButton?.focus();
       });
-      boundary.resumeQueuedWork();
+      boundary.refreshOfflineLease().then(valid => {
+        if (valid) boundary.resumeQueuedWork();
+      });
     };
     root.navigator?.serviceWorker?.addEventListener?.('message', event => boundary.handleServiceWorkerMessage(event));
     if (root.document.readyState === 'loading') root.document.addEventListener('DOMContentLoaded', attach);
@@ -93,6 +95,9 @@
   promptAuthorization = () => null,
   onExpired = () => {},
   onClearError = () => {},
+  requestTimeoutMs = 15000,
+  now = () => Date.now(),
+  setTimer = (callback, delay) => setTimeout(callback, delay),
 }) {
   const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
   let expirationStarted = false;
@@ -104,10 +109,38 @@
     location.replace(base + 'login?reason=session-revoked');
   }
 
+  async function handleSessionExpiry() {
+    if (expirationStarted) return;
+    expirationStarted = true;
+    await clearPrivateDeviceData();
+    onExpired();
+    location.replace(base + 'login?reason=session-expired');
+  }
+
   async function handleServiceWorkerMessage(event) {
     if (event?.data?.type === 'stackchain-session-revoked') {
       await handleRemoteRevocation();
     }
+    if (event?.data?.type === 'stackchain-session-expired') {
+      await handleSessionExpiry();
+    }
+  }
+
+  function storedOfflineLease() {
+    const value = Number(localStorage?.getItem?.('stackchain.session-expires-at'));
+    return Number.isInteger(value) && value > 0 ? value : 0;
+  }
+
+  function scheduleOfflineExpiry(expiresAt) {
+    const delay = Math.max(0, expiresAt * 1000 - now());
+    setTimer(() => handleSessionExpiry(), delay);
+  }
+
+  async function publishOfflineLease(expiresAt) {
+    localStorage?.setItem?.('stackchain.session-expires-at', String(expiresAt));
+    scheduleOfflineExpiry(expiresAt);
+    const registration = await serviceWorker?.ready;
+    registration?.active?.postMessage({ type: 'stackchain-session-lease', expiresAt });
   }
 
   function csrfToken() {
@@ -122,6 +155,56 @@
     catch (_error) { return false; }
   }
 
+  function isDashboardApi(input) {
+    try {
+      const url = new URL(String(input?.url || input), origin);
+      return url.origin === origin && url.pathname.startsWith(base + 'api/v1/');
+    } catch (_error) { return false; }
+  }
+
+  async function fetchWithDeadline(input, options, method, phase = 'request') {
+    if (!isDashboardApi(input)) return fetchImpl(input, options);
+    const controller = new AbortController();
+    const callerSignal = options.signal || input?.signal;
+    let timeout;
+    let rejectCancellation;
+    const cancellation = new Promise((_resolve, reject) => { rejectCancellation = reject; });
+    const cancelFromCaller = () => {
+      const error = callerSignal.reason || new DOMException('The request was aborted.', 'AbortError');
+      error.source = 'caller';
+      controller.abort(error);
+      rejectCancellation(error);
+    };
+    if (callerSignal?.aborted) cancelFromCaller();
+    else callerSignal?.addEventListener?.('abort', cancelFromCaller, { once: true });
+    const deadline = new Promise((_resolve, reject) => {
+      timeout = setTimeout(() => {
+        const error = new Error(
+          SAFE_METHODS.has(method)
+            ? 'Request timed out. Try again.'
+            : 'Request timed out. Refresh to verify the outcome before retrying.'
+        );
+        error.name = 'TimeoutError';
+        error.method = method;
+        error.outcome = 'unknown';
+        error.safeToRetry = SAFE_METHODS.has(method);
+        error.phase = phase;
+        controller.abort(error);
+        reject(error);
+      }, requestTimeoutMs);
+    });
+    try {
+      return await Promise.race([
+        Promise.resolve().then(() => fetchImpl(input, { ...options, signal: controller.signal })),
+        deadline,
+        cancellation,
+      ]);
+    } finally {
+      clearTimeout(timeout);
+      callerSignal?.removeEventListener?.('abort', cancelFromCaller);
+    }
+  }
+
   async function sessionFetch(input, options = {}, allowStepUp = true) {
     const method = String(options.method || input?.method || 'GET').toUpperCase();
     const requestOptions = { ...options };
@@ -131,7 +214,7 @@
       if (csrf) headers.set('X-CSRF-Token', csrf);
       requestOptions.headers = headers;
     }
-    const response = await fetchImpl(input, requestOptions);
+    const response = await fetchWithDeadline(input, requestOptions, method);
     if (response.status === 428 && isSameOrigin(input) && allowStepUp) {
       const payload = await response.clone().json().catch(() => ({}));
       const detail = payload?.detail || {};
@@ -147,7 +230,7 @@
         });
         const csrf = csrfToken();
         if (csrf) authorizationHeaders.set('X-CSRF-Token', csrf);
-        const authorization = await fetchImpl(base + 'api/v1/fresh-authorization', {
+        const authorization = await fetchWithDeadline(base + 'api/v1/fresh-authorization', {
           method: 'POST',
           headers: authorizationHeaders,
           body: JSON.stringify({
@@ -155,7 +238,7 @@
             action: detail.action,
             target: detail.target,
           }),
-        });
+        }, 'POST', 'fresh-authorization');
         if (!authorization.ok) return authorization;
         const grant = await authorization.json().catch(() => ({}));
         if (!grant.grant) return response;
@@ -171,13 +254,32 @@
         expirationStarted = false;
         await handleRemoteRevocation();
       } else {
-        onExpired();
-        location.replace(base + 'login?reason=session-expired');
+        expirationStarted = false;
+        await handleSessionExpiry();
       }
     }
     return response;
   }
 
+  async function refreshOfflineLease() {
+    try {
+      const response = await sessionFetch(base + 'api/v1/session');
+      if (!response.ok) return false;
+      const payload = await response.json().catch(() => ({}));
+      if (!payload.authenticated || !Number.isInteger(payload.expires_at)) return false;
+      await publishOfflineLease(payload.expires_at);
+      return true;
+    } catch (_error) {
+      const expiresAt = storedOfflineLease();
+      if (expiresAt * 1000 > now()) {
+        scheduleOfflineExpiry(expiresAt);
+        return true;
+      }
+      if (expiresAt) await handleSessionExpiry();
+      return false;
+    }
+  }
+
   function removeDashboardStorage(storage) {
     if (!storage) return;
     const keys = [];
@@ -287,6 +389,7 @@
     revokeActiveDevice,
     clearPrivateDeviceData,
     handleServiceWorkerMessage,
+    refreshOfflineLease,
     resumeQueuedWork,
   };
 });

frontend/task-overlay-history.js

@@ -5,7 +5,7 @@
 })(typeof globalThis !== 'undefined' ? globalThis : this, function () {
   'use strict';
 
-  const allowed = new Set(['new', 'find', 'search', 'search-preview']);
+  const allowed = new Set(['new', 'find', 'search', 'search-preview', 'plan-today', 'plan-today-preview']);
 
   return function createTaskOverlayHistory({ history, eventTarget, onChange }) {
     let active = allowed.has(history.state?.taskOverlay) ? history.state.taskOverlay : null;

frontend/today-sync.js

@@ -1,5 +1,6 @@
-function createTodaySync({ storage, getLogin, fetchJson, onRemoteIds, onStatus, createOperationId, createChannel,
-  setTimer = globalThis.setTimeout, clearTimer = globalThis.clearTimeout, retryBaseMs = 1000, retryMaxMs = 30000 }) {
+function createTodaySync({ storage, getLogin, fetchJson, onRemoteIds, onStatus, createOperationId, createChannel, coordinator,
+  setTimer = globalThis.setTimeout, clearTimer = globalThis.clearTimeout, retryBaseMs = 1000, retryMaxMs = 30000,
+  now = Date.now, maxOfflineMs = 30 * 24 * 60 * 60 * 1000 }) {
   const prefix = 'stackchain.today-sync.v1.';
   const migrationPrefix = 'stackchain.today-sync-migrated.v1.';
   const snapshotPrefix = 'stackchain.today-sync-snapshot.v1.';
@@ -8,6 +9,8 @@ function createTodaySync({ storage, getLogin, fetchJson, onRemoteIds, onStatus,
   let channelKey = '';
   let retryTimer = null;
   let retryAttempt = 0;
+  let expiredCount = 0;
+  const knownOperationKeys = new Set();
 
   function cancelRetry() {
     if (retryTimer !== null) clearTimer?.(retryTimer);
@@ -79,24 +82,59 @@ function createTodaySync({ storage, getLogin, fetchJson, onRemoteIds, onStatus,
   function pending() {
     const storageKey = key();
     if (!storageKey || !storage) return [];
+    const recordPrefix = storageKey + '.operation.';
     try {
-      const value = JSON.parse(storage.getItem(storageKey) || '[]');
-      return Array.isArray(value) ? value.filter(operation =>
-        operation && typeof operation.operation_id === 'string' &&
-        ['add', 'remove', 'move'].includes(operation.action) &&
-        typeof operation.item_id === 'string'
-      ) : [];
+      const legacy = JSON.parse(storage.getItem(storageKey) || '[]');
+      if (Array.isArray(legacy)) {
+        legacy.forEach((operation, index) => {
+          if (!operation?.operation_id) return;
+          const recordKey = recordPrefix + encodeURIComponent(operation.operation_id);
+          storage.setItem(recordKey, JSON.stringify({ operation, queued_at: index }));
+          knownOperationKeys.add(recordKey);
+        });
+        if (legacy.length) storage.removeItem(storageKey);
+      }
+      const keys = new Set([...knownOperationKeys].filter(candidate => candidate.startsWith(recordPrefix)));
+      for (let index = 0; index < Number(storage.length || 0); index += 1) {
+        const candidate = storage.key?.(index);
+        if (candidate?.startsWith(recordPrefix)) keys.add(candidate);
+      }
+      const records = [...keys].map(recordKey => {
+        const record = JSON.parse(storage.getItem(recordKey) || 'null');
+        return record ? { ...record, recordKey } : null;
+      }).filter(record => record?.operation);
+      const expired = records.filter(record => Number(record.queued_at) >= 1_000_000_000_000 &&
+        now() - Number(record.queued_at) > maxOfflineMs);
+      expired.forEach(record => {
+        storage.removeItem(record.recordKey);
+        knownOperationKeys.delete(record.recordKey);
+      });
+      if (expired.length) {
+        expiredCount += expired.length;
+        onStatus?.('expired', { count: expiredCount });
+      }
+      return records.filter(record => !expired.includes(record))
+        .sort((left, right) => Number(left.queued_at || 0) - Number(right.queued_at || 0) ||
+          left.operation.operation_id.localeCompare(right.operation.operation_id))
+        .map(record => ({
+          ...record.operation,
+          base_revision: Number.isInteger(record.operation.base_revision)
+            ? record.operation.base_revision : Math.max(0, savedRevision()),
+        }))
+        .filter(operation => operation && typeof operation.operation_id === 'string' &&
+          ['add', 'remove', 'move'].includes(operation.action) && typeof operation.item_id === 'string');
     } catch (_error) {
       return [];
     }
   }
 
-  function save(operations) {
+  function removeOperation(operationId) {
     const storageKey = key();
     if (!storageKey || !storage) return false;
+    const recordKey = storageKey + '.operation.' + encodeURIComponent(operationId);
     try {
-      if (operations.length) storage.setItem(storageKey, JSON.stringify(operations));
-      else storage.removeItem(storageKey);
+      storage.removeItem(recordKey);
+      knownOperationKeys.delete(recordKey);
       return true;
     } catch (_error) {
       return false;
@@ -117,8 +155,20 @@ function createTodaySync({ storage, getLogin, fetchJson, onRemoteIds, onStatus,
       onStatus?.('pending');
       return true;
     }
-    operations.push({ operation_id: operationId(), action, item_id: itemId, direction });
-    const saved = save(operations);
+    const operation = {
+      operation_id: operationId(), action, item_id: itemId, direction,
+      base_revision: Math.max(0, savedRevision()),
+    };
+    const storageKey = key();
+    if (!storageKey || !storage) return false;
+    const recordKey = storageKey + '.operation.' + encodeURIComponent(operation.operation_id);
+    let saved = false;
+    try {
+      storage.setItem(recordKey, JSON.stringify({ operation, queued_at: now() }));
+      knownOperationKeys.add(recordKey);
+      saved = true;
+      coordinator?.notify('today');
+    } catch (_error) { /* Report the persistence failure below. */ }
     onStatus?.(saved ? 'pending' : 'error');
     return saved;
   }
@@ -141,35 +191,42 @@ function createTodaySync({ storage, getLogin, fetchJson, onRemoteIds, onStatus,
     const ownerKey = key();
     if (!ownerKey) return false;
     ensureChannel();
+    expiredCount = 0;
     try {
-      let plan = await fetchJson('api/v1/today');
-      const operations = pending();
-      for (const operation of operations) {
+      let operations = pending();
+      let plan;
+      let hadConflict = false;
+      if (!operations.length) plan = await fetchJson('api/v1/today');
+      while (operations.length) {
         if (key() !== ownerKey) return false;
-        try {
-          plan = await fetchJson('api/v1/today', {
-            method: 'PATCH',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify(operation),
-          });
-        } catch (error) {
-          if (error?.status !== 409) throw error;
-          const rejected = pending();
-          save(rejected.filter(candidate => candidate.operation_id !== operation.operation_id));
-          adopt(plan);
-          onStatus?.('full');
-          retryAttempt = 0;
-          cancelRetry();
-          return false;
+        const batch = operations.slice(0, 50);
+        plan = await fetchJson('api/v1/today', {
+          method: 'PATCH',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ operations: batch }),
+        });
+        const hasReceipts = Array.isArray(plan.accepted_operation_ids) ||
+          Array.isArray(plan.duplicate_operation_ids) || Array.isArray(plan.rejected_operations);
+        const received = hasReceipts ? [
+          ...(plan.accepted_operation_ids || []),
+          ...(plan.duplicate_operation_ids || []),
+          ...(plan.rejected_operations || []).map(item => item.operation_id),
+        ] : batch.map(item => item.operation_id);
+        hadConflict = hadConflict || Boolean(plan.rejected_operations?.length);
+        for (const operationId of received) {
+          if (pending().some(candidate => candidate.operation_id === operationId) &&
+              !removeOperation(operationId)) {
+            throw new Error('Could not persist Today delivery receipt');
+          }
         }
-        const remaining = pending();
-        if (remaining[0]?.operation_id === operation.operation_id) save(remaining.slice(1));
+        operations = pending();
       }
       adopt(plan);
-      onStatus?.(pending().length ? 'pending' : 'saved');
+      onStatus?.(pending().length ? 'pending' : hadConflict ? 'full' :
+        expiredCount ? 'expired' : 'saved', expiredCount ? { count: expiredCount } : {});
       retryAttempt = 0;
       cancelRetry();
-      return true;
+      return !hadConflict;
     } catch (error) {
       if (pending().length) scheduleRetry(error, ownerKey);
       else onStatus?.('error');
@@ -178,7 +235,10 @@ function createTodaySync({ storage, getLogin, fetchJson, onRemoteIds, onStatus,
   }
 
   function flush() {
-    if (!flushing) flushing = run().finally(() => { flushing = null; });
+    if (!flushing) {
+      const delivery = coordinator ? coordinator.runExclusive('today', run) : run();
+      flushing = Promise.resolve(delivery).finally(() => { flushing = null; });
+    }
     return flushing;
   }
 
@@ -189,6 +249,10 @@ function createTodaySync({ storage, getLogin, fetchJson, onRemoteIds, onStatus,
     );
   }
 
+  coordinator?.subscribe(change => {
+    if (change.queue === 'today' && pending().length) flush();
+  });
+
   return { enqueue, migrate, flush, pending, startLifecycle };
 }
 

src/compression.py

@@ -0,0 +1,45 @@
+from starlette.datastructures import Headers
+from starlette.middleware.gzip import GZipResponder, IdentityResponder
+from starlette.types import ASGIApp, Receive, Scope, Send
+
+
+def _quality(accept_encoding: str, coding: str) -> float:
+    qualities: dict[str, float] = {}
+    for entry in accept_encoding.split(","):
+        parts = [part.strip() for part in entry.split(";")]
+        name = parts[0].lower()
+        if not name:
+            continue
+        quality = 1.0
+        for parameter in parts[1:]:
+            key, separator, value = parameter.partition("=")
+            if separator and key.strip().lower() == "q":
+                try:
+                    quality = float(value.strip())
+                except ValueError:
+                    quality = 0.0
+        qualities[name] = quality
+    return qualities.get(coding, qualities.get("*", 0.0))
+
+
+class NegotiatedGZipMiddleware:
+    """Compress substantial responses only when the client permits gzip."""
+
+    def __init__(self, app: ASGIApp, minimum_size: int = 500, compresslevel: int = 9):
+        self.app = app
+        self.minimum_size = minimum_size
+        self.compresslevel = compresslevel
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+
+        accepted = Headers(scope=scope).get("Accept-Encoding", "")
+        if _quality(accepted, "gzip") > 0:
+            responder: ASGIApp = GZipResponder(
+                self.app, self.minimum_size, compresslevel=self.compresslevel
+            )
+        else:
+            responder = IdentityResponder(self.app, self.minimum_size)
+        await responder(scope, receive, send)

src/frontend_bundle.py

@@ -0,0 +1,70 @@
+"""Build the content-addressed browser shell served by the dashboard."""
+
+from __future__ import annotations
+
+import hashlib
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+
+SCRIPT_TAG = re.compile(r'^<script src="(static/[^"?]+\.js)"></script>$', re.MULTILINE)
+WORKER_RUNTIME_SOURCE = "static/background-issue-sync.js"
+
+
+@dataclass(frozen=True)
+class FrontendBuild:
+    dashboard_html: str
+    runtime_bytes: bytes
+    runtime_digest: str
+    runtime_name: str
+    page_sources: tuple[str, ...]
+    service_worker_source: str
+
+
+def _bundle(frontend_dir: Path, sources: tuple[str, ...]) -> bytes:
+    chunks = []
+    for source in sources:
+        path = frontend_dir / source.removeprefix("static/")
+        chunks.append(f"/* {source} */\n".encode() + path.read_bytes() + b"\n;\n")
+    return b"".join(chunks)
+
+
+def build_frontend(frontend_dir: Path) -> FrontendBuild:
+    """Return one internally consistent HTML, runtime, and offline-worker build."""
+    source_html = (frontend_dir / "index.html").read_text()
+    sources = tuple(SCRIPT_TAG.findall(source_html))
+    if not sources:
+        raise ValueError("dashboard entry document has no page scripts")
+
+    runtime = _bundle(frontend_dir, sources)
+    digest = hashlib.sha256(runtime).hexdigest()[:16]
+    runtime_name = f"runtime-{digest}.js"
+    dashboard_html = SCRIPT_TAG.sub("", source_html)
+    dashboard_html = dashboard_html.replace(
+        "</body>", f'<script src="{runtime_name}"></script>\n</body>'
+    )
+
+    worker = (frontend_dir / "service-worker.js").read_text()
+    for source in sources:
+        if source != WORKER_RUNTIME_SOURCE:
+            worker = worker.replace(f"  BASE + '{source}',\n", "")
+    worker = worker.replace(
+        "  BASE + 'static/dashboard.css',\n",
+        f"  BASE + 'static/dashboard.css',\n  BASE + '{runtime_name}',\n",
+    )
+    worker = re.sub(
+        r"const CACHE = 'stackchain-dashboard-shell-v\d+';",
+        f"const CACHE = 'stackchain-dashboard-shell-{digest}';",
+        worker,
+        count=1,
+    )
+
+    return FrontendBuild(
+        dashboard_html=dashboard_html,
+        runtime_bytes=runtime,
+        runtime_digest=digest,
+        runtime_name=runtime_name,
+        page_sources=sources,
+        service_worker_source=worker,
+    )

src/gitea_proxy.py

@@ -133,6 +133,14 @@ class WorkItems(list[dict]):
         self.pagination = pagination
 
 
+class RepositoryItems(list[dict]):
+    """A list-compatible repository page carrying truthful pagination metadata."""
+
+    def __init__(self, items: list[dict], pagination: dict):
+        super().__init__(items)
+        self.pagination = pagination
+
+
 class WorkRouteUnavailableError(ValueError):
     """Raised when a shared route no longer belongs in the current user's queue."""
 
@@ -261,8 +269,48 @@ async def current_user() -> dict:
     return await fetch("user")
 
 
-async def repos() -> list[dict]:
-    return await fetch("user/repos?limit=50")
+async def repo_page(page: int = 1, limit: int = 50) -> dict:
+    """Load one bounded page of repositories available to the current user."""
+    response = await _get_client().get(
+        "/api/v1/user/repos",
+        headers=_auth(),
+        params={"page": page, "limit": limit},
+    )
+    response.raise_for_status()
+    payload = response.json()
+    if not isinstance(payload, list):
+        raise ValueError("Gitea repository response was not a list")
+    items = [item for item in payload if isinstance(item, dict)]
+    try:
+        total = max(len(items), int(response.headers.get("X-Total-Count", len(items))))
+    except (TypeError, ValueError):
+        total = len(items)
+    return {
+        "items": items,
+        "page": page,
+        "total": total,
+        "has_more": page * limit < total,
+    }
+
+
+async def repos() -> RepositoryItems:
+    result = await repo_page()
+    return RepositoryItems(
+        result["items"],
+        {key: result[key] for key in ("page", "total", "has_more")},
+    )
+
+
+async def repository_access(repository: str) -> dict | None:
+    """Return a repository only when the authenticated user can access it."""
+    response = await _get_client().get(
+        f"/api/v1/repos/{repository}", headers=_auth()
+    )
+    if response.status_code == 404:
+        return None
+    response.raise_for_status()
+    payload = response.json()
+    return payload if isinstance(payload, dict) else None
 
 
 WORK_SEARCHES = {

src/later_store.py

@@ -2,14 +2,26 @@
 
 import json
 import sqlite3
+import time
 from datetime import datetime
 from pathlib import Path
 
 
 class LaterStore:
-    def __init__(self, path: str | Path, *, timeout: float = 1.0):
+    def __init__(
+        self,
+        path: str | Path,
+        *,
+        timeout: float = 1.0,
+        operation_limit: int = 4096,
+        operation_retention_seconds: float = 30 * 24 * 60 * 60,
+        clock=time.time,
+    ):
         self.path = Path(path)
         self.timeout = timeout
+        self.operation_limit = operation_limit
+        self.operation_retention_seconds = operation_retention_seconds
+        self.clock = clock
 
     def _connect(self) -> sqlite3.Connection:
         self.path.parent.mkdir(parents=True, exist_ok=True)
@@ -29,12 +41,48 @@ class LaterStore:
             CREATE TABLE IF NOT EXISTS later_operations (
                 login TEXT NOT NULL,
                 operation_id TEXT NOT NULL,
+                created_at REAL NOT NULL,
                 PRIMARY KEY (login, operation_id)
             )
             """
         )
+        connection.execute(
+            """
+            CREATE TABLE IF NOT EXISTS later_item_revisions (
+                login TEXT NOT NULL,
+                item_id TEXT NOT NULL,
+                revision INTEGER NOT NULL,
+                PRIMARY KEY (login, item_id)
+            )
+            """
+        )
+        columns = {row[1] for row in connection.execute("PRAGMA table_info(later_operations)")}
+        if "created_at" not in columns:
+            connection.execute("ALTER TABLE later_operations ADD COLUMN created_at REAL")
+        connection.execute(
+            "UPDATE later_operations SET created_at = ? WHERE created_at IS NULL",
+            (self.clock(),),
+        )
+        connection.commit()
         return connection
 
+    def _record_operation(self, connection: sqlite3.Connection, login: str, operation_id: str) -> None:
+        now = self.clock()
+        connection.execute(
+            "INSERT INTO later_operations(login, operation_id, created_at) VALUES (?, ?, ?)",
+            (login, operation_id, now),
+        )
+        connection.execute(
+            "DELETE FROM later_operations WHERE login = ? AND created_at < ?",
+            (login, now - self.operation_retention_seconds),
+        )
+        connection.execute(
+            "DELETE FROM later_operations WHERE login = ? AND rowid NOT IN "
+            "(SELECT rowid FROM later_operations WHERE login = ? "
+            "ORDER BY created_at DESC, rowid DESC LIMIT ?)",
+            (login, login, self.operation_limit),
+        )
+
     @staticmethod
     def _normalize_login(login: str) -> str:
         normalized = login.strip().lower()
@@ -74,51 +122,110 @@ class LaterStore:
         item_id: str,
         *,
         wake_at: str | None = None,
+        base_revision: int | None = None,
     ) -> dict:
-        login = self._normalize_login(login)
-        if not operation_id or not item_id:
-            raise ValueError("operation_id and item_id are required")
-        if action not in {"defer", "restore"}:
-            raise ValueError("unsupported Later action")
-        if action == "defer":
-            wake_at = self._validate_wake_at(wake_at)
+        result = self.apply_batch(login, [{
+            "operation_id": operation_id,
+            "action": action,
+            "item_id": item_id,
+            "wake_at": wake_at,
+            "base_revision": base_revision,
+        }])
+        return {"revision": result["revision"], "records": result["records"]}
 
+    def apply_batch(self, login: str, operations: list[dict]) -> dict:
+        """Apply ordered deferrals with one SQLite write transaction."""
+        login = self._normalize_login(login)
         with self._connect() as connection:
             connection.execute("BEGIN IMMEDIATE")
             row = connection.execute(
                 "SELECT revision, records FROM later_plans WHERE login = ?", (login,)
             ).fetchone()
             snapshot = self._snapshot(row)
-            duplicate = connection.execute(
-                "SELECT 1 FROM later_operations WHERE login = ? AND operation_id = ?",
-                (login, operation_id),
-            ).fetchone()
-            if duplicate:
-                return snapshot
-
             records = dict(snapshot["records"])
-            before = records.get(item_id)
-            if action == "defer":
-                records[item_id] = wake_at
-                changed = before != wake_at
-            else:
-                changed = item_id in records
-                records.pop(item_id, None)
+            revision = snapshot["revision"]
+            accepted: list[str] = []
+            duplicates: list[str] = []
+            rejected: list[dict[str, str]] = []
+
+            # Existing databases predate per-item revisions. Conservatively mark
+            # active deferrals as changed at the latest known plan revision.
+            for item_id in records:
+                connection.execute(
+                    "INSERT OR IGNORE INTO later_item_revisions(login, item_id, revision) VALUES (?, ?, ?)",
+                    (login, item_id, revision),
+                )
+            item_revisions = dict(connection.execute(
+                "SELECT item_id, revision FROM later_item_revisions WHERE login = ?",
+                (login,),
+            ).fetchall())
+            batch_start_item_revisions = dict(item_revisions)
+
+            for operation in operations:
+                operation_id = operation.get("operation_id", "")
+                action = operation.get("action", "")
+                item_id = operation.get("item_id", "")
+                if not operation_id or not item_id:
+                    raise ValueError("operation_id and item_id are required")
+                if action not in {"defer", "restore"}:
+                    raise ValueError("unsupported Later action")
+                wake_at = operation.get("wake_at")
+                if action == "defer":
+                    wake_at = self._validate_wake_at(wake_at)
+                duplicate = connection.execute(
+                    "SELECT 1 FROM later_operations WHERE login = ? AND operation_id = ?",
+                    (login, operation_id),
+                ).fetchone()
+                if duplicate:
+                    duplicates.append(operation_id)
+                    continue
+
+                base_revision = operation.get("base_revision")
+                if base_revision is None:
+                    base_revision = snapshot["revision"]
+                if not isinstance(base_revision, int) or isinstance(base_revision, bool) or base_revision < 0:
+                    raise ValueError("base_revision must be a non-negative integer")
+                if batch_start_item_revisions.get(item_id, 0) > base_revision:
+                    self._record_operation(connection, login, operation_id)
+                    rejected.append({
+                        "operation_id": operation_id,
+                        "reason": "stale_intent",
+                    })
+                    continue
+
+                before = records.get(item_id)
+                if action == "defer":
+                    records[item_id] = wake_at
+                    changed = before != wake_at
+                else:
+                    changed = item_id in records
+                    records.pop(item_id, None)
+                revision += 1 if changed else 0
+                if changed:
+                    item_revisions[item_id] = revision
+                    connection.execute(
+                        "INSERT INTO later_item_revisions(login, item_id, revision) VALUES (?, ?, ?) "
+                        "ON CONFLICT(login, item_id) DO UPDATE SET revision = excluded.revision",
+                        (login, item_id, revision),
+                    )
+                self._record_operation(connection, login, operation_id)
+                accepted.append(operation_id)
 
-            revision = snapshot["revision"] + (1 if changed else 0)
             serialized = json.dumps(records, separators=(",", ":"), sort_keys=True)
             if row is None:
                 connection.execute(
                     "INSERT INTO later_plans(login, revision, records) VALUES (?, ?, ?)",
                     (login, revision, serialized),
                 )
-            elif changed:
+            elif accepted:
                 connection.execute(
                     "UPDATE later_plans SET revision = ?, records = ? WHERE login = ?",
                     (revision, serialized, login),
                 )
-            connection.execute(
-                "INSERT INTO later_operations(login, operation_id) VALUES (?, ?)",
-                (login, operation_id),
-            )
-            return {"revision": revision, "records": records}
+            return {
+                "revision": revision,
+                "records": records,
+                "accepted_operation_ids": accepted,
+                "duplicate_operation_ids": duplicates,
+                "rejected_operations": rejected,
+            }

src/main.py

@@ -2,6 +2,7 @@ import asyncio
 import hmac
 import math
 import os
+import secrets
 import sqlite3
 import time
 from collections.abc import Awaitable, Coroutine
@@ -18,6 +19,7 @@ from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel, Field, PositiveInt, field_validator, model_validator
 
 from src import dashboard_auth, gitea_proxy
+from src.compression import NegotiatedGZipMiddleware
 from src.gitea_proxy import (
     activity_events,
     current_user,
@@ -37,7 +39,7 @@ from src.request_boundary import RequestBodyLimitMiddleware, request_body_limit
 from src.suggestion_engine import compute
 from src.later_store import LaterStore
 from src.today_store import TodayPlanFull, TodayStore
-from src.views import router as frontend_router
+from src.views import FRONTEND_BUILD, router as frontend_router
 
 @asynccontextmanager
 async def lifespan(_app: FastAPI):
@@ -66,6 +68,7 @@ async def lifespan(_app: FastAPI):
 
 app = FastAPI(title="Stackchain Dashboard", lifespan=lifespan)
 app.add_middleware(RequestBodyLimitMiddleware, limit_for=request_body_limit)
+app.add_middleware(NegotiatedGZipMiddleware, minimum_size=1_024)
 CONTEXT_TIMEOUT_SECONDS = 5.0
 EVENT_STREAM_TIMEOUT_SECONDS = 5.0
 READINESS_TIMEOUT_SECONDS = 5.0
@@ -108,6 +111,7 @@ _live_snapshot_refreshing_sections: set[str] = set()
 _live_section_revisions: dict[str, int] = {
     section: 0 for section in LIVE_SNAPSHOT_SECTIONS
 }
+_live_revision_generation = secrets.token_hex(8)
 _read_notification_ids: set[int] = set()
 _authored_action_operations: dict[
     str, tuple[tuple[Any, ...], asyncio.Task, float]
@@ -207,6 +211,7 @@ class TodayOperation(BaseModel):
     action: Literal["add", "remove", "move"]
     item_id: str = Field(min_length=1, max_length=500)
     direction: Literal["up", "down"] | None = None
+    base_revision: int | None = Field(default=None, ge=0)
 
     @model_validator(mode="after")
     def require_move_direction(self):
@@ -222,6 +227,15 @@ class LaterOperation(BaseModel):
     action: Literal["defer", "restore"]
     item_id: str = Field(min_length=1, max_length=500)
     wake_at: str | None = Field(default=None, max_length=100)
+    base_revision: int | None = Field(default=None, ge=0)
+
+
+class TodayOperationBatch(BaseModel):
+    operations: list[TodayOperation] = Field(min_length=1, max_length=50)
+
+
+class LaterOperationBatch(BaseModel):
+    operations: list[LaterOperation] = Field(min_length=1, max_length=50)
 
 
 class NotificationReply(BaseModel):
@@ -490,6 +504,9 @@ def _context_payload(user_data, repo_data, issues_data, prs_data) -> dict:
         and all(field in p for field in ("id", "number", "title", "state", "html_url"))
     ]
     payload = compute(user_model, repo_models, issue_models, pr_models).model_dump()
+    repository_pagination = getattr(repo_data, "pagination", None)
+    if isinstance(repository_pagination, dict):
+        payload["repository_pagination"] = repository_pagination
     pagination = {}
     pagination.update(getattr(issues_data, "pagination", {}))
     pagination.update(getattr(prs_data, "pagination", {}))
@@ -579,7 +596,13 @@ async def require_operator_session(request: Request, call_next):
         return await call_next(request)
 
     public = (
-        path in {"/healthz", "/readyz", "/login", "/manifest.webmanifest"}
+        path in {
+            "/healthz",
+            "/readyz",
+            "/login",
+            "/manifest.webmanifest",
+            "/" + FRONTEND_BUILD.runtime_name,
+        }
         or path.startswith("/static/")
         or (path == "/api/v1/session" and request.method == "POST")
     )
@@ -857,10 +880,13 @@ async def fresh_authorization(payload: FreshAuthorization, request: Request):
 @app.get("/api/v1/session")
 async def session_status(request: Request):
     session = request.state.dashboard_session
-    return {
+    payload = {
         "authenticated": session is not None,
         "csrf_token": session.csrf if session is not None else "",
     }
+    if session is not None:
+        payload["expires_at"] = session.expires_at
+    return payload
 
 
 def _today_store() -> TodayStore:
@@ -904,9 +930,15 @@ async def get_today_plan():
 
 
 @app.patch("/api/v1/today")
-async def update_today_plan(payload: TodayOperation):
+async def update_today_plan(payload: TodayOperation | TodayOperationBatch):
     login = await _confirmed_login()
     try:
+        if isinstance(payload, TodayOperationBatch):
+            return await asyncio.to_thread(
+                _today_store().apply_batch,
+                login,
+                [operation.model_dump() for operation in payload.operations],
+            )
         return await asyncio.to_thread(
             _today_store().apply,
             login,
@@ -939,9 +971,15 @@ async def get_later_plan():
 
 
 @app.patch("/api/v1/later")
-async def update_later_plan(payload: LaterOperation):
+async def update_later_plan(payload: LaterOperation | LaterOperationBatch):
     login = await _confirmed_login()
     try:
+        if isinstance(payload, LaterOperationBatch):
+            return await asyncio.to_thread(
+                _later_store().apply_batch,
+                login,
+                [operation.model_dump() for operation in payload.operations],
+            )
         return await asyncio.to_thread(
             _later_store().apply,
             login,
@@ -949,6 +987,7 @@ async def update_later_plan(payload: LaterOperation):
             payload.action,
             payload.item_id,
             wake_at=payload.wake_at,
+            base_revision=payload.base_revision,
         )
     except ValueError as error:
         raise HTTPException(status_code=422, detail=str(error))
@@ -1179,6 +1218,36 @@ async def context() -> JSONResponse:
     return JSONResponse(_context_payload(user_data, repo_data, issues_data, prs_data))
 
 
+@app.get("/api/v1/repositories")
+async def repository_page(
+    page: int = Query(default=1, ge=1, le=1000),
+    limit: int = Query(default=50, ge=1, le=50),
+) -> JSONResponse:
+    """Return one bounded repository page for lazy issue-capture selection."""
+    try:
+        result = await asyncio.wait_for(
+            gitea_proxy.repo_page(page=page, limit=limit),
+            timeout=ISSUE_ACTION_TIMEOUT_SECONDS,
+        )
+        items = [
+            Repo(
+                id=item["id"], name=item["name"], full_name=item["full_name"],
+                description=item.get("description") or "", url=item["html_url"],
+                updated_at=item.get("updated_at", ""),
+            ).model_dump()
+            for item in result.get("items", [])
+            if isinstance(item, dict)
+            and all(field in item for field in ("id", "name", "full_name", "html_url"))
+        ]
+        return JSONResponse({**result, "items": items})
+    except Exception:
+        return JSONResponse(
+            {"error": "Repositories could not be loaded. Please retry."},
+            status_code=503,
+            headers={"Retry-After": "1"},
+        )
+
+
 @app.get("/api/v1/background-identity")
 async def background_identity() -> JSONResponse:
     """Return only the account key required to safely drain a browser outbox."""
@@ -1555,7 +1624,7 @@ def _live_snapshot_payload(
     *,
     stale: bool,
     revalidating: bool,
-    known_revisions: dict[str, int | None] | None = None,
+    known_revisions: dict[str, str | None] | None = None,
 ) -> dict:
     payload = dict(value)
     now = time.monotonic()
@@ -1588,9 +1657,13 @@ def _live_snapshot_payload(
         "retry_in_seconds": min(retries, default=0),
         "sections": section_freshness,
     }
-    payload["revisions"] = dict(_live_section_revisions)
+    revision_tokens = {
+        section: f"{_live_revision_generation}.{revision}"
+        for section, revision in _live_section_revisions.items()
+    }
+    payload["revisions"] = revision_tokens
     for section, known_revision in (known_revisions or {}).items():
-        if known_revision is None or known_revision != _live_section_revisions[section]:
+        if known_revision is None or known_revision != revision_tokens[section]:
             continue
         payload.pop(section, None)
         if section == "notifications":
@@ -1640,9 +1713,15 @@ def _without_read_notifications(snapshot: dict) -> dict:
 
 @app.get("/api/v1/live")
 async def live_snapshot(
-    context_revision: int | None = Query(default=None, ge=0),
-    events_revision: int | None = Query(default=None, ge=0),
-    notifications_revision: int | None = Query(default=None, ge=0),
+    context_revision: str | None = Query(
+        default=None, max_length=64, pattern=r"^[0-9a-f]{16}\.[0-9]{1,20}$"
+    ),
+    events_revision: str | None = Query(
+        default=None, max_length=64, pattern=r"^[0-9a-f]{16}\.[0-9]{1,20}$"
+    ),
+    notifications_revision: str | None = Query(
+        default=None, max_length=64, pattern=r"^[0-9a-f]{16}\.[0-9]{1,20}$"
+    ),
 ) -> JSONResponse:
     """Return a freshness-bounded snapshot and share identical upstream loads."""
     global _live_snapshot_task, _live_snapshot_value, _live_snapshot_created_at
@@ -2147,13 +2226,7 @@ async def repository_milestones(owner: str, repo: str):
     repository = f"{owner}/{repo}"
 
     async def load_milestones():
-        available = await gitea_proxy.repos()
-        accessible = {
-            item.get("full_name")
-            for item in (available if isinstance(available, list) else [])
-            if isinstance(item, dict)
-        }
-        if repository not in accessible:
+        if await gitea_proxy.repository_access(repository) is None:
             raise HTTPException(status_code=404, detail="Repository not found")
         return await gitea_proxy.repo_milestones(repository)
 
@@ -2176,13 +2249,7 @@ async def repository_labels(owner: str, repo: str):
     repository = f"{owner}/{repo}"
 
     async def load_labels():
-        available = await gitea_proxy.repos()
-        accessible = {
-            item.get("full_name")
-            for item in (available if isinstance(available, list) else [])
-            if isinstance(item, dict)
-        }
-        if repository not in accessible:
+        if await gitea_proxy.repository_access(repository) is None:
             raise HTTPException(status_code=404, detail="Repository not found")
         return await gitea_proxy.repo_labels(repository)
 
@@ -2208,16 +2275,11 @@ async def create_assigned_issue(
     repository = f"{owner}/{repo}"
 
     async def create_issue():
-        user, available = await asyncio.gather(
-            gitea_proxy.current_user(), gitea_proxy.repos()
+        user, accessible = await asyncio.gather(
+            gitea_proxy.current_user(), gitea_proxy.repository_access(repository)
         )
         login = user.get("login") if isinstance(user, dict) else None
-        accessible = {
-            item.get("full_name")
-            for item in (available if isinstance(available, list) else [])
-            if isinstance(item, dict)
-        }
-        if not login or repository not in accessible:
+        if not login or accessible is None:
             raise HTTPException(status_code=404, detail="Repository not found")
         if creation.label_ids:
             available_labels = await gitea_proxy.repo_labels(repository)

src/today_store.py

@@ -2,6 +2,7 @@
 
 import json
 import sqlite3
+import time
 from pathlib import Path
 
 
@@ -10,10 +11,22 @@ class TodayPlanFull(ValueError):
 
 
 class TodayStore:
-    def __init__(self, path: str | Path, *, limit: int = 5, timeout: float = 1.0):
+    def __init__(
+        self,
+        path: str | Path,
+        *,
+        limit: int = 5,
+        timeout: float = 1.0,
+        operation_limit: int = 4096,
+        operation_retention_seconds: float = 30 * 24 * 60 * 60,
+        clock=time.time,
+    ):
         self.path = Path(path)
         self.limit = limit
         self.timeout = timeout
+        self.operation_limit = operation_limit
+        self.operation_retention_seconds = operation_retention_seconds
+        self.clock = clock
 
     def _connect(self) -> sqlite3.Connection:
         self.path.parent.mkdir(parents=True, exist_ok=True)
@@ -33,12 +46,38 @@ class TodayStore:
             CREATE TABLE IF NOT EXISTS today_operations (
                 login TEXT NOT NULL,
                 operation_id TEXT NOT NULL,
+                created_at REAL NOT NULL,
                 PRIMARY KEY (login, operation_id)
             )
             """
         )
+        columns = {row[1] for row in connection.execute("PRAGMA table_info(today_operations)")}
+        if "created_at" not in columns:
+            connection.execute("ALTER TABLE today_operations ADD COLUMN created_at REAL")
+        connection.execute(
+            "UPDATE today_operations SET created_at = ? WHERE created_at IS NULL",
+            (self.clock(),),
+        )
+        connection.commit()
         return connection
 
+    def _record_operation(self, connection: sqlite3.Connection, login: str, operation_id: str) -> None:
+        now = self.clock()
+        connection.execute(
+            "INSERT INTO today_operations(login, operation_id, created_at) VALUES (?, ?, ?)",
+            (login, operation_id, now),
+        )
+        connection.execute(
+            "DELETE FROM today_operations WHERE login = ? AND created_at < ?",
+            (login, now - self.operation_retention_seconds),
+        )
+        connection.execute(
+            "DELETE FROM today_operations WHERE login = ? AND rowid NOT IN "
+            "(SELECT rowid FROM today_operations WHERE login = ? "
+            "ORDER BY created_at DESC, rowid DESC LIMIT ?)",
+            (login, login, self.operation_limit),
+        )
+
     @staticmethod
     def _normalize_login(login: str) -> str:
         normalized = login.strip().lower()
@@ -123,8 +162,93 @@ class TodayStore:
                     "UPDATE today_plans SET revision = ?, ids = ? WHERE login = ?",
                     (revision, json.dumps(ids, separators=(",", ":")), login),
                 )
-            connection.execute(
-                "INSERT INTO today_operations(login, operation_id) VALUES (?, ?)",
-                (login, operation_id),
-            )
+            self._record_operation(connection, login, operation_id)
             return {"revision": revision, "ids": ids}
+
+    def apply_batch(self, login: str, operations: list[dict]) -> dict:
+        """Apply an ordered batch with one lock and receipt per operation."""
+        login = self._normalize_login(login)
+        with self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            row = connection.execute(
+                "SELECT revision, ids FROM today_plans WHERE login = ?", (login,)
+            ).fetchone()
+            snapshot = self._snapshot(row)
+            ids = list(snapshot["ids"])
+            revision = snapshot["revision"]
+            accepted: list[str] = []
+            duplicates: list[str] = []
+            rejected: list[dict[str, str]] = []
+
+            for operation in operations:
+                operation_id = operation.get("operation_id", "")
+                action = operation.get("action", "")
+                item_id = operation.get("item_id", "")
+                direction = operation.get("direction")
+                if not operation_id or not item_id:
+                    raise ValueError("operation_id and item_id are required")
+                if action not in {"add", "remove", "move"}:
+                    raise ValueError("unsupported Today action")
+                if action == "move" and direction not in {"up", "down"}:
+                    raise ValueError("move direction must be up or down")
+                duplicate = connection.execute(
+                    "SELECT 1 FROM today_operations WHERE login = ? AND operation_id = ?",
+                    (login, operation_id),
+                ).fetchone()
+                if duplicate:
+                    duplicates.append(operation_id)
+                    continue
+
+                base_revision = operation.get("base_revision")
+                if base_revision is None:
+                    base_revision = snapshot["revision"]
+                if not isinstance(base_revision, int) or isinstance(base_revision, bool) or base_revision < 0:
+                    raise ValueError("base_revision must be a non-negative integer")
+                if base_revision < snapshot["revision"]:
+                    self._record_operation(connection, login, operation_id)
+                    rejected.append({"operation_id": operation_id, "reason": "stale_intent"})
+                    continue
+
+                changed = False
+                if action == "add":
+                    if item_id not in ids:
+                        if len(ids) >= self.limit:
+                            rejected.append({"operation_id": operation_id, "reason": "today_full"})
+                            continue
+                        ids.append(item_id)
+                        changed = True
+                elif action == "remove":
+                    if item_id in ids:
+                        ids.remove(item_id)
+                        changed = True
+                else:
+                    try:
+                        index = ids.index(item_id)
+                    except ValueError:
+                        index = -1
+                    target = index - 1 if direction == "up" else index + 1
+                    if index >= 0 and 0 <= target < len(ids):
+                        ids[index], ids[target] = ids[target], ids[index]
+                        changed = True
+                revision += 1 if changed else 0
+                self._record_operation(connection, login, operation_id)
+                accepted.append(operation_id)
+
+            serialized = json.dumps(ids, separators=(",", ":"))
+            if row is None:
+                connection.execute(
+                    "INSERT INTO today_plans(login, revision, ids) VALUES (?, ?, ?)",
+                    (login, revision, serialized),
+                )
+            elif accepted:
+                connection.execute(
+                    "UPDATE today_plans SET revision = ?, ids = ? WHERE login = ?",
+                    (revision, serialized, login),
+                )
+            return {
+                "revision": revision,
+                "ids": ids,
+                "accepted_operation_ids": accepted,
+                "duplicate_operation_ids": duplicates,
+                "rejected_operations": rejected,
+            }

src/views.py

@@ -1,12 +1,14 @@
 from pathlib import Path
 
-from fastapi import APIRouter
-from fastapi.responses import FileResponse, HTMLResponse
+from fastapi import APIRouter, HTTPException
+from fastapi.responses import FileResponse, HTMLResponse, Response
+
+from src.frontend_bundle import build_frontend
 
 router = APIRouter()
 DASHBOARD_FILE = Path(__file__).resolve().parent.parent / "frontend" / "index.html"
 MANIFEST_FILE = DASHBOARD_FILE.parent / "manifest.webmanifest"
-SERVICE_WORKER_FILE = DASHBOARD_FILE.parent / "service-worker.js"
+FRONTEND_BUILD = build_frontend(DASHBOARD_FILE.parent)
 
 LOGIN_HTML = """<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
@@ -26,7 +28,7 @@ class RevalidatingHTMLResponse(HTMLResponse):
 
 @router.get("/", response_class=RevalidatingHTMLResponse)
 async def dashboard() -> str:
-    return DASHBOARD_FILE.read_text()
+    return FRONTEND_BUILD.dashboard_html
 
 
 @router.get("/login", response_class=RevalidatingHTMLResponse)
@@ -39,10 +41,21 @@ async def web_app_manifest() -> FileResponse:
     return FileResponse(MANIFEST_FILE, media_type="application/manifest+json")
 
 
-@router.get("/service-worker.js", response_class=FileResponse)
-async def service_worker() -> FileResponse:
-    return FileResponse(
-        SERVICE_WORKER_FILE,
+@router.get("/service-worker.js")
+async def service_worker() -> Response:
+    return Response(
+        FRONTEND_BUILD.service_worker_source,
         media_type="application/javascript",
         headers={"Service-Worker-Allowed": "/", "Cache-Control": "no-cache"},
     )
+
+
+@router.get("/runtime-{digest}.js")
+async def runtime_bundle(digest: str) -> Response:
+    if digest != FRONTEND_BUILD.runtime_digest:
+        raise HTTPException(status_code=404, detail="Runtime revision not found")
+    return Response(
+        FRONTEND_BUILD.runtime_bytes,
+        media_type="application/javascript",
+        headers={"Cache-Control": "public, max-age=31536000, immutable"},
+    )

tests/dashboard_bundle.py

@@ -1,9 +1,17 @@
+import re
 from pathlib import Path
 
 from src.views import dashboard as dashboard_html
 
 
 FRONTEND = Path(__file__).resolve().parents[1] / "frontend"
+PAGE_SCRIPT_MANIFEST = "\n".join(
+    re.findall(
+        r'^<script src="static/[^\"]+\.js"></script>$',
+        (FRONTEND / "index.html").read_text(),
+        re.MULTILINE,
+    )
+)
 
 
 def dashboard_bundle_text() -> str:
@@ -18,11 +26,12 @@ def dashboard_bundle_text() -> str:
 
 
 async def dashboard() -> str:
-    # Exercise the real view lookup before adding its separately served assets.
+    # Exercise the real view lookup before adding its separately served bootstrap assets.
     html = await dashboard_html()
     return "\n".join(
         (
             html,
+            PAGE_SCRIPT_MANIFEST,
             (FRONTEND / "dashboard.css").read_text(),
             (FRONTEND / "dashboard.js").read_text(),
         )

tests/test_assign_and_start.py

@@ -0,0 +1,276 @@
+import json
+import subprocess
+from pathlib import Path
+
+
+ASSIGN_AND_START = Path(__file__).parents[1] / "frontend" / "assign-and-start.js"
+QUEUE_TODAY = Path(__file__).parents[1] / "frontend" / "queue-today.js"
+HTML = Path(__file__).parents[1] / "frontend" / "index.html"
+DASHBOARD = Path(__file__).parents[1] / "frontend" / "dashboard.js"
+CSS = Path(__file__).parents[1] / "frontend" / "dashboard.css"
+WORKER = Path(__file__).parents[1] / "frontend" / "service-worker.js"
+
+
+def run_node(script):
+    return json.loads(subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    ).stdout)
+
+
+def test_repeated_assign_and_start_taps_claim_once_then_start_confirmed_issue():
+    script = f"""
+const fs=require('fs');
+if (!fs.existsSync({json.dumps(str(ASSIGN_AND_START))})) {{
+  process.stdout.write(JSON.stringify({{available:false}}));
+}} else {{
+  const createAssignAndStart=require({json.dumps(str(ASSIGN_AND_START))});
+  const calls=[];
+  let release;
+  const claimResult=new Promise(resolve=>{{release=resolve;}});
+  const flow=createAssignAndStart({{
+    available:()=>true,
+    claim:item=>{{calls.push('claim:'+item.number);return claimResult;}},
+    start:item=>{{calls.push('start:'+item.number);return 'started';}},
+    recover:item=>calls.push('recover:'+item.number),
+    announce:message=>calls.push('announce:'+message),
+  }});
+  const issue={{repository:'stackchain/dashboard',number:411}};
+  const first=flow.run(issue);
+  const second=flow.run(issue);
+  release({{...issue,assignees:['timmy']}});
+  Promise.all([first,second]).then(results=>process.stdout.write(JSON.stringify({{available:true,calls,results,same:first===second}})));
+}}
+"""
+
+    assert run_node(script) == {
+        "available": True,
+        "calls": [
+            "claim:411",
+            "start:411",
+            "announce:Assigned, added to Today, and ready to work.",
+        ],
+        "results": ["started", "started"],
+        "same": True,
+    }
+
+
+def test_full_today_blocks_before_assignment_and_explains_recovery():
+    script = f"""
+const createAssignAndStart=require({json.dumps(str(ASSIGN_AND_START))});
+const calls=[];
+const flow=createAssignAndStart({{
+  available:()=>false,
+  claim:()=>{{calls.push('claim');return Promise.resolve({{}});}},
+  start:()=>calls.push('start'),
+  recover:()=>calls.push('recover'),
+  announce:message=>calls.push('announce:'+message),
+}});
+flow.run({{repository:'stackchain/dashboard',number:411}}).then(result=>
+  process.stdout.write(JSON.stringify({{result,calls}}))
+);
+"""
+
+    assert run_node(script) == {
+        "result": "full",
+        "calls": ["announce:Today is full—remove an item before assigning this issue."],
+    }
+
+
+def test_confirmed_assignment_recovers_in_issue_detail_when_today_start_fails():
+    script = f"""
+const createAssignAndStart=require({json.dumps(str(ASSIGN_AND_START))});
+const calls=[];
+const issue={{repository:'stackchain/dashboard',number:411,assignees:['timmy']}};
+const flow=createAssignAndStart({{
+  available:()=>true,
+  claim:()=>Promise.resolve(issue),
+  start:()=> 'sync-unavailable',
+  recover:item=>calls.push('recover:'+item.number),
+  announce:message=>calls.push('announce:'+message),
+}});
+flow.run(issue).then(result=>process.stdout.write(JSON.stringify({{result,calls}})));
+"""
+
+    assert run_node(script) == {
+        "result": "recovery",
+        "calls": [
+            "announce:Assigned to you, but Today could not start. The issue is open so you can recover.",
+            "recover:411",
+        ],
+    }
+
+
+def test_failed_assignment_does_not_start_today_and_can_be_retried():
+    script = f"""
+const createAssignAndStart=require({json.dumps(str(ASSIGN_AND_START))});
+const calls=[];let attempt=0;
+const issue={{repository:'stackchain/dashboard',number:411}};
+const flow=createAssignAndStart({{
+  available:()=>true,
+  claim:()=>{{attempt+=1;calls.push('claim:'+attempt);return attempt===1 ? Promise.reject(new Error('conflict')) : Promise.resolve(issue);}},
+  start:()=>{{calls.push('start');return 'started';}},
+  recover:()=>calls.push('recover'),
+  announce:message=>calls.push('announce:'+message),
+}});
+flow.run(issue).catch(error=>{{
+  calls.push('error:'+error.message);
+  return flow.run(issue);
+}}).then(result=>process.stdout.write(JSON.stringify({{result,calls}})));
+"""
+
+    assert run_node(script) == {
+        "result": "started",
+        "calls": [
+            "claim:1",
+            "error:conflict",
+            "claim:2",
+            "start",
+            "announce:Assigned, added to Today, and ready to work.",
+        ],
+    }
+
+
+def test_already_owned_search_result_starts_without_claiming():
+    script = f"""
+const createAssignAndStart=require({json.dumps(str(ASSIGN_AND_START))});
+const calls=[];
+const issue={{repository:'stackchain/dashboard',number:413,assigned_to_me:true}};
+const flow=createAssignAndStart({{
+  available:()=>true,
+  claim:()=>{{calls.push('claim');return Promise.resolve(issue);}},
+  start:item=>{{calls.push('start:'+item.number);return 'started';}},
+  recover:item=>calls.push('recover:'+item.number),
+  announce:message=>calls.push('announce:'+message),
+}});
+flow.run(issue, {{alreadyOwned:true}}).then(result=>
+  process.stdout.write(JSON.stringify({{result,calls}}))
+);
+"""
+
+    assert run_node(script) == {
+        "result": "started",
+        "calls": [
+            "start:413",
+            "announce:Added to Today and ready to work.",
+        ],
+    }
+
+
+def test_queue_today_claims_once_without_starting_the_active_session():
+    script = f"""
+const createAssignAndStart=require({json.dumps(str(ASSIGN_AND_START))});
+const calls=[];
+let release;
+const claimResult=new Promise(resolve=>{{release=resolve;}});
+const issue={{repository:'stackchain/dashboard',number:415}};
+const flow=createAssignAndStart({{
+  available:()=>true,
+  claim:item=>{{calls.push('claim:'+item.number);return claimResult;}},
+  start:item=>{{calls.push('start:'+item.number);return 'started';}},
+  queue:item=>{{calls.push('queue:'+item.number);return 'queued';}},
+  recover:item=>calls.push('recover:'+item.number),
+  announce:message=>calls.push('announce:'+message),
+}});
+const first=flow.run(issue, {{destination:'queue'}});
+const second=flow.run(issue, {{destination:'queue'}});
+release({{...issue,assignees:['timmy']}});
+Promise.all([first,second]).then(results=>process.stdout.write(JSON.stringify({{
+  calls,results,same:first===second
+}})));
+"""
+
+    assert run_node(script) == {
+        "calls": [
+            "claim:415",
+            "queue:415",
+            "announce:Assigned and queued in Today. Keep finding work when ready.",
+        ],
+        "results": ["queued", "queued"],
+        "same": True,
+    }
+
+
+def test_queue_today_persists_syncs_and_warms_without_a_session_side_effect():
+    script = f"""
+const fs=require('fs');
+if (!fs.existsSync({json.dumps(str(QUEUE_TODAY))})) {{
+  process.stdout.write(JSON.stringify({{available:false}}));
+}} else {{
+  const createQueueToday=require({json.dumps(str(QUEUE_TODAY))});
+  const calls=[];
+  const issue={{kind:'issue',repository:'stackchain/dashboard',number:415}};
+  const queue=createQueueToday({{
+    todayWork:{{identity:()=> 'issue:stackchain/dashboard:415:',add:()=>{{calls.push('add');return 'added';}}}},
+    todaySync:{{enqueue:(action,id)=>{{calls.push(action+':'+id);return true;}},flush:()=>calls.push('flush')}},
+    refresh:()=>calls.push('refresh'),
+    warm:()=>calls.push('warm'),
+  }});
+  process.stdout.write(JSON.stringify({{available:true,result:queue(issue),calls}}));
+}}
+"""
+
+    assert run_node(script) == {
+        "available": True,
+        "result": "queued",
+        "calls": [
+            "add",
+            "add:issue:stackchain/dashboard:415:",
+            "refresh",
+            "flush",
+            "warm",
+        ],
+    }
+
+
+def test_queue_today_reports_assignment_when_local_planning_needs_recovery():
+    script = f"""
+const createAssignAndStart=require({json.dumps(str(ASSIGN_AND_START))});
+const calls=[];
+const issue={{repository:'stackchain/dashboard',number:415,assignees:['timmy']}};
+const flow=createAssignAndStart({{
+  available:()=>true,
+  claim:()=>Promise.resolve(issue),
+  start:()=> 'started',
+  queue:()=> 'sync-unavailable',
+  recover:item=>calls.push('recover:'+item.number),
+  announce:message=>calls.push('announce:'+message),
+}});
+flow.run(issue, {{destination:'queue'}}).then(result=>
+  process.stdout.write(JSON.stringify({{result,calls}}))
+);
+"""
+
+    assert run_node(script) == {
+        "result": "recovery",
+        "calls": [
+            "announce:Assigned and saved in Today on this device, but account sync is unavailable. The issue is open so you can recover.",
+            "recover:415",
+        ],
+    }
+
+
+def test_find_work_renders_phone_safe_assign_and_start_and_wires_offline_shell():
+    html = HTML.read_text()
+    dashboard = DASHBOARD.read_text()
+    css = CSS.read_text()
+    worker = WORKER.read_text()
+
+    assert "data-claim-start-index" in dashboard
+    assert "data-claim-queue-index" in dashboard
+    assert ">Start now</button>" in dashboard
+    assert ">Queue Today</button>" in dashboard
+    assert "const assignAndStart = createAssignAndStart({" in dashboard
+    assert "assignAndStart.run(item)" in dashboard
+    assert "assignAndStart.run(item, { destination:'queue' })" in dashboard
+    assert "queue: confirmed =>" in dashboard
+    assert "const queueToday = createQueueToday({" in dashboard
+    assert "return queueToday(claimed)" in dashboard
+    assert "createAndStart.available" in dashboard
+    assert "createAndStart.complete" in dashboard
+    assert ".find-work-claim-actions" in css
+    assert "grid-template-columns:repeat(2,minmax(0,1fr))" in css
+    assert ".find-work-claim-actions [data-claim-start-index]" in css
+    assert "grid-column:1 / -1" in css
+    assert "BASE + 'static/assign-and-start.js'" in worker
+    assert "BASE + 'static/queue-today.js'" in worker
+    assert '<script src="static/queue-today.js"></script>' in html

tests/test_background_issue_sync.py

@@ -64,6 +64,38 @@ const fetchJson = async (url, options = {{}}) => {{
     }
 
 
+def test_closed_app_sync_retains_created_issue_for_create_and_start_recovery():
+    script = f"""
+const createBackgroundIssueSync = require({json.dumps(str(SYNC))});
+const item = {{
+  id:'capture-start',operationId:'capture-start',ownerLogin:'timmy',status:'queued',
+  repository:'stackchain/dashboard',title:'Resume',body:'',labelIds:[],
+  completionIntent:'create-and-start',
+}};
+let queued = item;
+const state = {{completed:[]}};
+const store = {{
+  claimNext:async () => queued ? (queued=null,{{...item}}) : null,
+  complete:async (id, deliveredIssue) => state.completed.push({{id,deliveredIssue}}),
+  release:async()=>{{}},fail:async()=>{{}},countBlocked:async()=>0,
+}};
+const fetchJson = async url => url === 'api/v1/background-identity' ? {{login:'timmy'}} :
+  {{repository:'stackchain/dashboard',number:389,title:'Resume'}};
+(async()=>{{
+  await createBackgroundIssueSync({{store,fetchJson}}).flush();
+  process.stdout.write(JSON.stringify(state));
+}})();
+"""
+    output = run_node(script)
+
+    assert output["completed"] == [{
+        "id": "capture-start",
+        "deliveredIssue": {
+            "repository": "stackchain/dashboard", "number": 389, "title": "Resume"
+        },
+    }]
+
+
 def test_closed_app_sync_returns_privacy_safe_actionable_delivery_receipts():
     script = f"""
 const createBackgroundIssueSync = require({json.dumps(str(SYNC))});

tests/test_command_palette.py

@@ -243,6 +243,18 @@ def test_assigned_issue_preview_hands_off_to_existing_my_work_sheet():
     assert "openPreviewIssueInMyWork" in html
 
 
+def test_search_preview_offers_assign_and_start_for_eligible_issues():
+    html = dashboard_bundle_text()
+    css = (FRONTEND / "dashboard.css").read_text()
+
+    assert 'id="start-search-result"' in html
+    assert "startButton.textContent = detail.assigned_to_me ? 'Start in Today' : 'Assign & start'" in html
+    assert "const searchAssignAndStart = createAssignAndStart({" in html
+    assert "searchAssignAndStart.run(detail, { alreadyOwned: detail.assigned_to_me })" in html
+    assert ".search-preview-primary-actions" in css
+    assert "grid-template-columns:repeat(2,minmax(0,1fr))" in css
+
+
 def test_mobile_search_viewport_tracks_keyboard_geometry_without_leaking_listeners():
     script = f"""
 const createMobileSearchViewport = require({json.dumps(str(MOBILE_SEARCH_VIEWPORT))});

tests/test_context_polling.py

@@ -116,6 +116,23 @@ const poller = createContextPoller({{
     }
 
 
+def test_live_revision_query_preserves_bounded_opaque_tokens():
+    script = f"""
+const createContextPoller = require({json.dumps(str(POLLER))});
+const query = createContextPoller.buildRevisionQuery({{
+  context: '0123456789abcdef.12',
+  events: 'fedcba9876543210.3',
+  notifications: 'not-a-token',
+  extra: '0123456789abcdef.1',
+}});
+process.stdout.write(JSON.stringify({{ query }}));
+"""
+
+    assert run_node(script) == {
+        "query": "context_revision=0123456789abcdef.12&events_revision=fedcba9876543210.3"
+    }
+
+
 def test_context_poller_aborts_a_stalled_request_and_recovers_on_schedule():
     script = f"""
 const createContextPoller = require({json.dumps(str(POLLER))});

tests/test_create_and_start.py

@@ -0,0 +1,127 @@
+import json
+import subprocess
+from pathlib import Path
+
+
+CREATE_AND_START = Path(__file__).parents[1] / "frontend" / "create-and-start.js"
+HTML = Path(__file__).parents[1] / "frontend" / "index.html"
+DASHBOARD = Path(__file__).parents[1] / "frontend" / "dashboard.js"
+CSS = Path(__file__).parents[1] / "frontend" / "dashboard.css"
+WORKER = Path(__file__).parents[1] / "frontend" / "service-worker.js"
+
+
+def run_node(script):
+    return json.loads(subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    ).stdout)
+
+
+def test_confirmed_issue_is_planned_synced_warmed_and_started_once():
+    script = f"""
+const fs = require('fs');
+if (!fs.existsSync({json.dumps(str(CREATE_AND_START))})) {{
+  process.stdout.write(JSON.stringify({{available:false}}));
+}} else {{
+  const createCreateAndStart = require({json.dumps(str(CREATE_AND_START))});
+  const calls = [];
+  const issue = {{kind:'issue', repository:'stackchain/dashboard', number:387}};
+  const flow = createCreateAndStart({{
+    todayWork: {{limit:5, read:()=>[], identity:item=>'issue:'+item.repository+':'+item.number+':', add:()=>{{calls.push('add');return 'added';}}}},
+    todaySync: {{enqueue:(action,id)=>{{calls.push(action+':'+id);return true;}}, flush:()=>calls.push('flush')}},
+    refresh:()=>calls.push('refresh'), warm:()=>calls.push('warm'), start:item=>calls.push('start:'+item.number),
+    announce:message=>calls.push('announce:'+message),
+  }});
+  const result = flow.complete(issue);
+  flow.complete(issue);
+  process.stdout.write(JSON.stringify({{available:true,result,calls}}));
+}}
+"""
+
+    assert run_node(script) == {
+        "available": True,
+        "result": "started",
+        "calls": [
+            "add",
+            "add:issue:stackchain/dashboard:387:",
+            "refresh",
+            "flush",
+            "warm",
+            "start:387",
+            "announce:Created, added to Today, and ready to work.",
+        ],
+    }
+
+
+def test_mobile_capture_wires_distinct_create_and_start_intent_into_the_offline_shell():
+    html = HTML.read_text()
+    dashboard = DASHBOARD.read_text()
+    css = CSS.read_text()
+    worker = WORKER.read_text()
+
+    assert '<button id="create-and-start-issue" type="submit">Create &amp; start</button>' in html
+    assert '<script src="static/create-and-start.js"></script>' in html
+    assert "const createAndStart = createCreateAndStart({" in dashboard
+    assert "event.submitter?.id === 'create-and-start-issue'" in dashboard
+    assert "createAndStart.complete(created)" in dashboard
+    assert ".create-issue-actions" in css and "grid-template-columns" in css
+    assert "BASE + 'static/create-and-start.js'" in worker
+
+
+def test_create_and_start_intent_is_durable_and_has_a_one_tap_relaunch_continuation():
+    dashboard = DASHBOARD.read_text()
+
+    assert "completionIntent: 'create-and-start'" in dashboard
+    assert "result.completions || []" in dashboard
+    assert "(result.completions || []).forEach(completion =>" in dashboard
+    assert "issueOutbox.pendingCompletions(activeFlushLogin)" in dashboard
+    assert "issueOutbox.completeIntent(completion.id, activeFlushLogin)" in dashboard
+    assert 'class="draft-continue"' in dashboard
+    assert "Continue created work" in dashboard
+
+
+def test_create_and_start_stops_before_session_when_today_sync_cannot_be_queued():
+    script = f"""
+const createCreateAndStart = require({json.dumps(str(CREATE_AND_START))});
+const calls = [];
+const issue = {{kind:'issue', repository:'stackchain/dashboard', number:388}};
+const flow = createCreateAndStart({{
+  todayWork: {{limit:5, read:()=>[], identity:()=> 'issue:stackchain/dashboard:388:', add:()=> 'added'}},
+  todaySync: {{enqueue:()=>false, flush:()=>calls.push('flush')}},
+  refresh:()=>calls.push('refresh'), warm:()=>calls.push('warm'), start:()=>calls.push('start'),
+  announce:message=>calls.push(message),
+}});
+process.stdout.write(JSON.stringify({{result:flow.complete(issue), calls}}));
+"""
+
+    assert run_node(script) == {
+        "result": "sync-unavailable",
+        "calls": ["Created and saved to Today on this device, but account sync is unavailable."],
+    }
+
+
+def test_create_and_start_can_resume_after_today_sync_admission_recovers():
+    script = f"""
+const createCreateAndStart = require({json.dumps(str(CREATE_AND_START))});
+const calls=[];let admitted=false;let added=false;
+const issue={{kind:'issue',repository:'stackchain/dashboard',number:389}};
+const flow=createCreateAndStart({{
+  todayWork:{{limit:5,read:()=>[],identity:()=> 'issue:stackchain/dashboard:389:',add:()=>{{
+    const outcome=added?'exists':'added';added=true;return outcome;
+  }}}},
+  todaySync:{{enqueue:()=>admitted,flush:()=>calls.push('flush')}},
+  refresh:()=>calls.push('refresh'),warm:()=>calls.push('warm'),start:()=>calls.push('start'),
+  announce:message=>calls.push(message),
+}});
+const first=flow.complete(issue);
+admitted=true;
+const second=flow.complete(issue);
+process.stdout.write(JSON.stringify({{first,second,calls}}));
+"""
+    output = run_node(script)
+
+    assert output["first"] == "sync-unavailable"
+    assert output["second"] == "started"
+    assert output["calls"][-5:] == [
+        "refresh", "flush", "warm", "start",
+        "Created, added to Today, and ready to work.",
+    ]

tests/test_dashboard_auth.py

@@ -7,6 +7,7 @@ import pytest
 
 from src import main
 from src.session_store import SessionStoreError
+from src.views import FRONTEND_BUILD
 
 
 @pytest.fixture
@@ -253,12 +254,16 @@ async def test_session_status_reuses_the_middleware_validation(access_control, m
         response = await client.get("/api/v1/session")
 
     assert response.status_code == 200
-    assert response.json()["authenticated"] is True
+    payload = response.json()
+    assert payload["authenticated"] is True
+    assert isinstance(payload["expires_at"], int)
+    assert payload["expires_at"] > int(time.time())
+    assert response.headers["cache-control"] == "no-store"
     assert lookups == 1
 
 
 @pytest.mark.anyio
-async def test_authenticated_session_status_exposes_only_csrf_proof(access_control):
+async def test_authenticated_session_status_exposes_csrf_proof_and_offline_lease(access_control):
     transport = httpx.ASGITransport(app=main.app)
     async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
         await client.post(
@@ -266,14 +271,26 @@ async def test_authenticated_session_status_exposes_only_csrf_proof(access_contr
         )
         response = await client.get("/api/v1/session")
 
+    payload = response.json()
     assert response.status_code == 200
-    assert response.json() == {
-        "authenticated": True,
-        "csrf_token": client.cookies["stackchain_csrf"],
-    }
+    assert payload["authenticated"] is True
+    assert payload["csrf_token"] == client.cookies["stackchain_csrf"]
+    assert payload["expires_at"] > int(time.time())
     assert "correct horse battery staple" not in response.text
 
 
+@pytest.mark.anyio
+async def test_anonymous_session_status_discloses_no_offline_lease(access_control):
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        response = await client.get("/api/v1/session")
+
+    assert response.status_code == 401
+    assert response.json() == {"detail": "Authentication required"}
+    assert "expires_at" not in response.text
+    assert response.headers["cache-control"] == "no-store"
+
+
 @pytest.mark.anyio
 async def test_merge_requires_single_use_fresh_authorization_bound_to_exact_target(
     access_control, monkeypatch
@@ -956,9 +973,16 @@ async def test_public_routes_skip_session_registry_validation(access_control, mo
         login = await client.get("/login")
         manifest = await client.get("/manifest.webmanifest")
         static = await client.get("/static/session.js")
+        runtime = await client.get("/" + FRONTEND_BUILD.runtime_name)
 
     assert signed_in.status_code == 200
-    assert [login.status_code, manifest.status_code, static.status_code] == [200, 200, 200]
+    assert [login.status_code, manifest.status_code, static.status_code, runtime.status_code] == [
+        200,
+        200,
+        200,
+        200,
+    ]
+    assert runtime.headers["cache-control"] == "public, max-age=31536000, immutable"
 
 
 @pytest.mark.anyio

tests/test_dashboard_session_frontend.py

@@ -14,11 +14,13 @@ SESSION_JS = ROOT / "frontend" / "session.js"
 def run_session_scenario(scenario: str) -> dict:
     harness = f"""
 const createSessionBoundary = require({json.dumps(str(SESSION_JS))});
-const state = {{ requests: [], removed: [], deletedDatabases: [], deletionCompleted: false, deletedCaches: [], assigned: '', replaced: [], assignedAfterDeletion: false, workerMessages: [], confirmations: [], prompts: [], clearErrors: [], responseStatus: 200, responsePayload: {{}}, responses: [] }};
+const state = {{ requests: [], removed: [], deletedDatabases: [], deletionCompleted: false, deletedCaches: [], assigned: '', replaced: [], assignedAfterDeletion: false, replacedAfterDeletion: false, expiredAfterDeletion: false, workerMessages: [], confirmations: [], prompts: [], clearErrors: [], responseStatus: 200, responsePayload: {{}}, responses: [] }};
 const storage = {{
   values: new Map([['stackchain.private', 'secret'], ['gitea.preference', 'keep']]),
   get length() {{ return this.values.size; }},
   key(index) {{ return Array.from(this.values.keys())[index] || null; }},
+  getItem(key) {{ return this.values.get(key) || null; }},
+  setItem(key, value) {{ this.values.set(key, String(value)); }},
   removeItem(key) {{ state.removed.push(key); this.values.delete(key); }},
 }};
 const boundary = createSessionBoundary({{
@@ -27,6 +29,7 @@ const boundary = createSessionBoundary({{
   base: '/dashboard/',
   fetchImpl: async (url, options = {{}}) => {{
     state.requests.push({{ url: String(url), method: options.method || 'GET', headers: Object.fromEntries(new Headers(options.headers || {{}})), body: options.body || null }});
+    if (state.failFetch) throw new Error('offline');
     const configured = state.responses.length ? state.responses.shift() : {{ status: state.responseStatus, payload: state.responsePayload }};
     return new Response(JSON.stringify(configured.payload), {{ status: configured.status, headers: {{ 'Content-Type': 'application/json' }} }});
   }},
@@ -53,6 +56,8 @@ const boundary = createSessionBoundary({{
     replace: value => state.replaced.push(value),
   }},
   onClearError: error => state.clearErrors.push(error.message),
+  onExpired: () => {{ state.expiredAfterDeletion = state.deletionCompleted; }},
+  setTimer: (_callback, delay) => {{ state.leaseDelay = delay; return 1; }},
   confirmAction: message => {{ state.confirmations.push(message); return true; }},
   promptAuthorization: details => {{ state.prompts.push(details); return 'correct horse battery staple'; }},
 }});
@@ -62,6 +67,160 @@ const boundary = createSessionBoundary({{
     return json.loads(result.stdout)
 
 
+def test_same_origin_api_fetch_times_out_even_when_fetch_ignores_abort():
+    script = f"""
+const createSessionBoundary = require({json.dumps(str(SESSION_JS))});
+let aborted = false;
+const boundary = createSessionBoundary({{
+  cookie: () => '',
+  origin: 'https://forge.example',
+  base: '/dashboard/',
+  requestTimeoutMs: 10,
+  fetchImpl: (_url, options = {{}}) => new Promise(resolve => {{
+    options.signal?.addEventListener('abort', () => {{ aborted = true; }});
+    setTimeout(() => resolve(new Response('{{}}', {{status:200}})), 80);
+  }}),
+  location: {{ replace: () => {{}} }},
+}});
+(async () => {{
+  const started = Date.now();
+  try {{ await boundary.fetch('/dashboard/api/v1/context'); }}
+  catch (error) {{
+    process.stdout.write(JSON.stringify({{
+      name:error.name, message:error.message, method:error.method,
+      outcome:error.outcome, aborted, elapsed:Date.now()-started,
+    }}));
+  }}
+}})().catch(error => {{ console.error(error); process.exit(1); }});
+"""
+    result = subprocess.run(
+        ["node", "-e", script], text=True, capture_output=True, check=True, timeout=2
+    )
+    output = json.loads(result.stdout)
+
+    assert output["name"] == "TimeoutError"
+    assert output["message"] == "Request timed out. Try again."
+    assert output["method"] == "GET"
+    assert output["outcome"] == "unknown"
+    assert output["aborted"] is True
+    assert output["elapsed"] < 70
+
+
+def test_caller_abort_cancels_same_origin_api_fetch_without_waiting_for_deadline():
+    script = f"""
+const createSessionBoundary = require({json.dumps(str(SESSION_JS))});
+const caller = new AbortController();
+let requestAborted = false;
+const boundary = createSessionBoundary({{
+  cookie: () => '', origin:'https://forge.example', base:'/dashboard/', requestTimeoutMs:1000,
+  fetchImpl: (_url, options = {{}}) => new Promise(() => {{
+    options.signal.addEventListener('abort', () => {{ requestAborted = true; }});
+  }}),
+  location: {{ replace: () => {{}} }},
+}});
+(async () => {{
+  const started = Date.now();
+  const pending = boundary.fetch('/dashboard/api/v1/context', {{signal:caller.signal}});
+  setTimeout(() => caller.abort(new DOMException('Superseded', 'AbortError')), 10);
+  try {{ await pending; }} catch (error) {{
+    process.stdout.write(JSON.stringify({{name:error.name, message:error.message, source:error.source, requestAborted, elapsed:Date.now()-started}}));
+  }}
+}})().catch(error => {{ console.error(error); process.exit(1); }});
+"""
+    result = subprocess.run(
+        ["node", "-e", script], text=True, capture_output=True, check=True, timeout=2
+    )
+    output = json.loads(result.stdout)
+
+    assert output["name"] == "AbortError"
+    assert output["message"] == "Superseded"
+    assert output["source"] == "caller"
+    assert output["requestAborted"] is True
+    assert output["elapsed"] < 100
+
+
+def test_request_object_abort_signal_is_composed_with_the_api_deadline():
+    script = f"""
+const createSessionBoundary = require({json.dumps(str(SESSION_JS))});
+const caller = new AbortController();
+const boundary = createSessionBoundary({{
+  cookie: () => '', origin:'https://forge.example', base:'/dashboard/', requestTimeoutMs:1000,
+  fetchImpl: () => new Promise(() => {{}}), location: {{replace:() => {{}}}},
+}});
+(async () => {{
+  const request = new Request('https://forge.example/dashboard/api/v1/context', {{signal:caller.signal}});
+  const pending = boundary.fetch(request);
+  setTimeout(() => caller.abort(new DOMException('Request superseded', 'AbortError')), 5);
+  try {{ await pending; }} catch (error) {{
+    process.stdout.write(JSON.stringify({{name:error.name, message:error.message, source:error.source}}));
+  }}
+}})().catch(error => {{ console.error(error); process.exit(1); }});
+"""
+    result = subprocess.run(
+        ["node", "-e", script], text=True, capture_output=True, check=True, timeout=2
+    )
+
+    assert json.loads(result.stdout) == {
+        "name": "AbortError",
+        "message": "Request superseded",
+        "source": "caller",
+    }
+
+
+def test_mutation_timeout_warns_that_the_server_outcome_may_be_ambiguous():
+    script = f"""
+const createSessionBoundary = require({json.dumps(str(SESSION_JS))});
+const boundary = createSessionBoundary({{
+  cookie: () => 'stackchain_csrf=proof', origin:'https://forge.example', base:'/dashboard/', requestTimeoutMs:5,
+  fetchImpl: () => new Promise(() => {{}}), location: {{replace:() => {{}}}},
+}});
+(async () => {{
+  try {{ await boundary.fetch('/dashboard/api/v1/repos/stackchain/app/issues/9', {{method:'PATCH'}}); }}
+  catch (error) {{ process.stdout.write(JSON.stringify({{name:error.name, message:error.message, method:error.method, safeToRetry:error.safeToRetry}})); }}
+}})().catch(error => {{ console.error(error); process.exit(1); }});
+"""
+    result = subprocess.run(
+        ["node", "-e", script], text=True, capture_output=True, check=True, timeout=2
+    )
+    output = json.loads(result.stdout)
+
+    assert output == {
+        "name": "TimeoutError",
+        "message": "Request timed out. Refresh to verify the outcome before retrying.",
+        "method": "PATCH",
+        "safeToRetry": False,
+    }
+
+
+def test_fresh_authorization_request_uses_the_same_deadline_boundary():
+    script = f"""
+const createSessionBoundary = require({json.dumps(str(SESSION_JS))});
+let calls = 0;
+const boundary = createSessionBoundary({{
+  cookie: () => 'stackchain_csrf=proof', origin:'https://forge.example', base:'/dashboard/', requestTimeoutMs:5,
+  fetchImpl: () => {{
+    calls += 1;
+    if (calls === 1) return Promise.resolve(new Response(JSON.stringify({{detail:{{code:'step_up_required', action:'merge_pull', target:'stackchain/app#9'}}}}), {{status:428, headers:{{'Content-Type':'application/json'}}}}));
+    return new Promise(() => {{}});
+  }},
+  promptAuthorization: async () => 'operator-token', location: {{replace:() => {{}}}},
+}});
+(async () => {{
+  try {{ await boundary.fetch('/dashboard/api/v1/repos/stackchain/app/pulls/9/merge', {{method:'POST'}}); }}
+  catch (error) {{ process.stdout.write(JSON.stringify({{name:error.name, phase:error.phase, calls}})); }}
+}})().catch(error => {{ console.error(error); process.exit(1); }});
+"""
+    result = subprocess.run(
+        ["node", "-e", script], text=True, capture_output=True, check=True, timeout=2
+    )
+
+    assert json.loads(result.stdout) == {
+        "name": "TimeoutError",
+        "phase": "fresh-authorization",
+        "calls": 2,
+    }
+
+
 def test_mutating_same_origin_fetch_receives_csrf_proof():
     result = run_session_scenario(
         """
@@ -73,6 +232,46 @@ process.stdout.write(JSON.stringify(state));
     assert result["requests"][0]["headers"]["x-csrf-token"] == "csrf-proof"
 
 
+def test_authenticated_session_status_persists_offline_lease_for_worker_and_expiry_timer():
+    result = run_session_scenario(
+        """
+state.responsePayload = {authenticated:true, csrf_token:'csrf-proof', expires_at:4102444800};
+const valid = await boundary.refreshOfflineLease();
+state.valid = valid;
+state.savedExpiry = storage.getItem('stackchain.session-expires-at');
+process.stdout.write(JSON.stringify(state));
+"""
+    )
+
+    assert result["valid"] is True
+    assert result["savedExpiry"] == "4102444800"
+    assert result["workerMessages"] == [
+        {"type": "stackchain-session-lease", "expiresAt": 4102444800}
+    ]
+    assert result["leaseDelay"] > 0
+
+
+def test_expired_stored_lease_purges_private_work_when_session_status_is_offline():
+    result = run_session_scenario(
+        """
+storage.setItem('stackchain.session-expires-at', '1');
+state.failFetch = true;
+const valid = await boundary.refreshOfflineLease();
+state.valid = valid;
+state.remaining = Array.from(storage.values.keys());
+state.replacedAfterDeletion = state.deletionCompleted && state.replaced.length === 1;
+process.stdout.write(JSON.stringify(state));
+"""
+    )
+
+    assert result["valid"] is False
+    assert result["remaining"] == ["gitea.preference"]
+    assert result["deletedDatabases"] == ["stackchain-background-outbox-v1"]
+    assert result["deletedCaches"] == ["stackchain-dashboard-shell-v15"]
+    assert result["replaced"] == ["/dashboard/login?reason=session-expired"]
+    assert result["replacedAfterDeletion"] is True
+
+
 def test_high_impact_fetch_prompts_once_and_retries_original_request_with_grant():
     result = run_session_scenario(
         """
@@ -106,7 +305,7 @@ process.stdout.write(JSON.stringify(state));
     assert result["requests"][2]["body"] == result["requests"][0]["body"]
 
 
-def test_same_origin_unauthorized_response_replaces_dashboard_once_without_clearing_private_work():
+def test_same_origin_unauthorized_response_purges_private_work_before_replacing_dashboard_once():
     result = run_session_scenario(
         """
 state.responseStatus = 401;
@@ -115,6 +314,7 @@ await Promise.all([
   boundary.fetch('https://forge.example/dashboard/api/v1/context'),
 ]);
 state.remaining = Array.from(storage.values.keys());
+state.replacedAfterDeletion = state.deletionCompleted && state.replaced.length === 1;
 process.stdout.write(JSON.stringify(state));
 """
     )
@@ -122,9 +322,12 @@ process.stdout.write(JSON.stringify(state));
     assert result["replaced"] == [
         "/dashboard/login?reason=session-expired"
     ]
-    assert result["remaining"] == ["stackchain.private", "gitea.preference"]
-    assert result["deletedDatabases"] == []
-    assert result["deletedCaches"] == []
+    assert result["remaining"] == ["gitea.preference"]
+    assert result["deletedDatabases"] == ["stackchain-background-outbox-v1"]
+    assert result["deletedCaches"] == ["stackchain-dashboard-shell-v15"]
+    assert result["workerMessages"] == [{"type": "stackchain-purge-outbox"}]
+    assert result["expiredAfterDeletion"] is True
+    assert result["replacedAfterDeletion"] is True
 
 
 def test_remotely_revoked_response_clears_private_work_before_replacing_dashboard():
@@ -160,6 +363,21 @@ process.stdout.write(JSON.stringify(state));
     assert result["replaced"] == ["/dashboard/login?reason=session-revoked"]
 
 
+def test_worker_expiry_message_clears_window_storage_before_expired_login():
+    result = run_session_scenario(
+        """
+await boundary.handleServiceWorkerMessage({data:{type:'stackchain-session-expired'}});
+state.remaining = Array.from(storage.values.keys());
+state.replacedAfterDeletion = state.deletionCompleted && state.replaced.length === 1;
+process.stdout.write(JSON.stringify(state));
+"""
+    )
+
+    assert result["remaining"] == ["gitea.preference"]
+    assert result["replaced"] == ["/dashboard/login?reason=session-expired"]
+    assert result["replacedAfterDeletion"] is True
+
+
 def test_cross_origin_unauthorized_response_does_not_expire_dashboard_session():
     result = run_session_scenario(
         """

tests/test_drafts.py

@@ -121,6 +121,26 @@ process.stdout.write(JSON.stringify(drafts));
     assert output[1]["label"] == "Queued issue"
 
 
+def test_draft_inbox_exposes_created_issue_waiting_for_create_and_start_continuation():
+    script = f"""
+const createDraftInbox = require({json.dumps(str(DRAFTS))});
+const values = new Map([['stackchain.issue-outbox.v1', JSON.stringify({{version:3,items:[{{
+  id:'continue-1',operationId:'continue-1',repository:'stackchain/dashboard',
+  title:'Resume this issue',body:'',ownerLogin:'timmy',status:'completion',queuedAt:200,
+  completionIntent:'create-and-start',deliveredIssue:{{repository:'stackchain/dashboard',number:389,title:'Resume this issue'}}
+}}]}})]]);
+const storage = {{get length(){{return values.size}},key:i=>Array.from(values.keys())[i]||null,getItem:k=>values.get(k)||null}};
+const item = createDraftInbox({{storage,getCurrentLogin:()=>'timmy'}}).list()[0];
+process.stdout.write(JSON.stringify(item));
+"""
+    output = run_node(script)
+
+    assert output["status"] == "completion"
+    assert output["label"] == "Created · ready to start"
+    assert output["continuation"] is True
+    assert output["quarantined"] is False
+
+
 def test_draft_inbox_exposes_uncertain_delivery_for_explicit_user_verification():
     script = f"""
 const createDraftInbox = require({json.dumps(str(DRAFTS))});
@@ -175,7 +195,7 @@ async def test_mobile_dashboard_exposes_touch_safe_draft_recovery_lane():
     assert 'Discard this unfinished draft?' in html
     assert '.draft-actions button { min-height:44px;' in html
     assert 'createDraftInbox({ storage: localStorage' in html
-    assert "captureDraft.repository && !repositories.includes(captureDraft.repository)" in html
+    assert "captureDraft.repository && !issueCaptureRepositories.includes(captureDraft.repository)" in html
     assert "Verified not posted — retry" in html
     assert "payload.detail?.message" in html
     assert "error.code = payload.detail?.code" in html

tests/test_frontend_bundle.py

@@ -0,0 +1,120 @@
+import gzip
+import re
+import shutil
+from pathlib import Path
+
+import httpx
+import pytest
+
+from src import main
+from src.frontend_bundle import build_frontend
+from src.views import dashboard, runtime_bundle, service_worker
+
+
+FRONTEND = Path(__file__).resolve().parents[1] / "frontend"
+PAGE_SCRIPT = re.compile(r'<script src="(static/[^"]+\.js)"></script>')
+
+
+def test_page_runtime_is_one_deterministic_content_addressed_bundle(tmp_path):
+    first = build_frontend(FRONTEND)
+    second = build_frontend(FRONTEND)
+
+    assert first.runtime_name == second.runtime_name
+    assert first.runtime_bytes == second.runtime_bytes
+    assert PAGE_SCRIPT.findall(first.dashboard_html) == []
+    assert first.dashboard_html.count("<script src=") == 1
+    assert f'<script src="{first.runtime_name}"></script>' in first.dashboard_html
+    assert first.runtime_name.startswith("runtime-")
+    assert first.runtime_name.endswith(".js")
+    assert len(gzip.compress(first.runtime_bytes, mtime=0)) <= 100 * 1024
+
+    changed_frontend = tmp_path / "frontend"
+    shutil.copytree(FRONTEND, changed_frontend)
+    (changed_frontend / "widgets.js").write_text(
+        (changed_frontend / "widgets.js").read_text() + "\n// changed\n"
+    )
+
+    changed = build_frontend(changed_frontend)
+    assert changed.runtime_name != first.runtime_name
+    assert changed.runtime_bytes != first.runtime_bytes
+
+
+@pytest.mark.anyio
+async def test_runtime_is_transferred_as_gzip_when_the_client_accepts_it():
+    transport = httpx.ASGITransport(app=main.app)
+
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.get(
+            f"/{main.FRONTEND_BUILD.runtime_name}",
+            headers={"Accept-Encoding": "gzip"},
+        )
+
+    assert response.status_code == 200
+    assert response.headers["content-encoding"] == "gzip"
+    assert response.headers["vary"] == "Accept-Encoding"
+    assert int(response.headers["content-length"]) <= 100 * 1024
+    assert response.content == main.FRONTEND_BUILD.runtime_bytes
+    assert response.headers["cache-control"] == "public, max-age=31536000, immutable"
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize("accept_encoding", ["identity", "gzip;q=0, identity;q=1"])
+async def test_runtime_stays_unencoded_when_the_client_declines_gzip(accept_encoding):
+    transport = httpx.ASGITransport(app=main.app)
+
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.get(
+            f"/{main.FRONTEND_BUILD.runtime_name}",
+            headers={"Accept-Encoding": accept_encoding},
+        )
+
+    assert response.status_code == 200
+    assert "content-encoding" not in response.headers
+    assert int(response.headers["content-length"]) == len(main.FRONTEND_BUILD.runtime_bytes)
+    assert response.content == main.FRONTEND_BUILD.runtime_bytes
+
+
+@pytest.mark.anyio
+async def test_dashboard_shell_is_compressed_without_losing_response_policies():
+    transport = httpx.ASGITransport(app=main.app)
+
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        page = await client.get("/", headers={"Accept-Encoding": "gzip"})
+        stylesheet = await client.get(
+            "/static/dashboard.css", headers={"Accept-Encoding": "gzip"}
+        )
+        health = await client.get("/healthz", headers={"Accept-Encoding": "gzip"})
+
+    assert page.headers["content-encoding"] == "gzip"
+    assert page.headers["cache-control"] == "no-cache"
+    assert page.headers["content-security-policy"]
+    assert main.FRONTEND_BUILD.runtime_name in page.text
+    assert stylesheet.headers["content-encoding"] == "gzip"
+    assert "mobile-task-dock" in stylesheet.text
+    assert health.json() == {"service": "stackchain-dashboard", "status": "ok"}
+    assert "content-encoding" not in health.headers
+
+
+def test_offline_shell_precaches_exact_runtime_without_superseded_page_modules():
+    build = build_frontend(FRONTEND)
+
+    assert f"BASE + '{build.runtime_name}'" in build.service_worker_source
+    for source in build.page_sources:
+        if source == "static/background-issue-sync.js":
+            continue
+        assert f"BASE + '{source}'" not in build.service_worker_source
+
+
+@pytest.mark.anyio
+async def test_runtime_asset_is_immutable_while_html_and_worker_revalidate():
+    build = build_frontend(FRONTEND)
+
+    html = await dashboard()
+    bundle = await runtime_bundle(build.runtime_digest)
+    worker = await service_worker()
+
+    assert build.runtime_name in html
+    assert bundle.body == build.runtime_bytes
+    assert bundle.headers["cache-control"] == "public, max-age=31536000, immutable"
+    assert worker.headers["cache-control"] == "no-cache"
+    assert build.runtime_name.encode() in worker.body

tests/test_issue_api.py

@@ -8,6 +8,13 @@ from src import gitea_proxy, main
 from src.idempotency import IdempotencyLedger
 
 
+async def repository_access_from(loader, repository):
+    repositories = await loader()
+    return next(
+        (item for item in repositories if item.get("full_name") == repository), None
+    )
+
+
 @pytest.mark.anyio
 async def test_gitea_milestone_update_revalidates_assignment_and_open_repository_milestone():
     requests = []
@@ -70,6 +77,10 @@ async def test_milestone_routes_are_repository_bounded_and_no_store(monkeypatch)
         }
 
     monkeypatch.setattr(main.gitea_proxy, "repos", available_repos)
+    monkeypatch.setattr(
+        main.gitea_proxy, "repository_access",
+        lambda repository: repository_access_from(available_repos, repository),
+    )
     monkeypatch.setattr(main.gitea_proxy, "repo_milestones", milestones, raising=False)
     monkeypatch.setattr(main.gitea_proxy, "update_assigned_issue_milestone", update, raising=False)
     transport = httpx.ASGITransport(app=main.app)
@@ -352,6 +363,10 @@ async def test_create_issue_endpoint_derives_self_assignment_and_returns_confirm
 
     monkeypatch.setattr(main.gitea_proxy, "current_user", user)
     monkeypatch.setattr(main.gitea_proxy, "repos", available_repos)
+    monkeypatch.setattr(
+        main.gitea_proxy, "repository_access",
+        lambda repository: repository_access_from(available_repos, repository),
+    )
     monkeypatch.setattr(main.gitea_proxy, "repo_labels", labels, raising=False)
     monkeypatch.setattr(main.gitea_proxy, "create_issue", create, raising=False)
     transport = httpx.ASGITransport(app=main.app)
@@ -373,6 +388,118 @@ async def test_create_issue_endpoint_derives_self_assignment_and_returns_confirm
     assert calls == [("stackchain/api", "Capture mobile work", "Context", "timmy", [3])]
 
 
+@pytest.mark.anyio
+async def test_repository_page_reports_more_results_and_targeted_access_uses_repository_route():
+    calls = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls.append((request.url.path, dict(request.url.params)))
+        if request.url.path.endswith("/user/repos"):
+            return httpx.Response(
+                200,
+                json=[{"id": 51, "name": "later", "full_name": "stackchain/later"}],
+                headers={"X-Total-Count": "51"},
+            )
+        if request.url.path.endswith("/repos/stackchain/later"):
+            return httpx.Response(200, json={"id": 51, "full_name": "stackchain/later"})
+        return httpx.Response(404)
+
+    gitea_proxy.start_client(transport=httpx.MockTransport(handler))
+    try:
+        page = await gitea_proxy.repo_page(page=2, limit=50)
+        first_page = await gitea_proxy.repos()
+        accessible = await gitea_proxy.repository_access("stackchain/later")
+        missing = await gitea_proxy.repository_access("stackchain/missing")
+    finally:
+        await gitea_proxy.stop_client()
+
+    assert page == {
+        "items": [{"id": 51, "name": "later", "full_name": "stackchain/later"}],
+        "page": 2,
+        "total": 51,
+        "has_more": False,
+    }
+    assert accessible["full_name"] == "stackchain/later"
+    assert missing is None
+    assert first_page.pagination == {"page": 1, "total": 51, "has_more": True}
+    assert calls == [
+        ("/api/v1/user/repos", {"page": "2", "limit": "50"}),
+        ("/api/v1/user/repos", {"page": "1", "limit": "50"}),
+        ("/api/v1/repos/stackchain/later", {}),
+        ("/api/v1/repos/stackchain/missing", {}),
+    ]
+
+
+@pytest.mark.anyio
+async def test_repository_page_endpoint_and_issue_creation_support_later_repository(monkeypatch):
+    access_calls = []
+    create_calls = []
+
+    async def page(page, limit):
+        assert (page, limit) == (2, 50)
+        return {
+            "items": [{
+                "id": 51, "name": "later", "full_name": "stackchain/later",
+                "description": "", "html_url": "https://forge.example/stackchain/later",
+                "updated_at": "2026-08-09T12:00:00Z",
+            }],
+            "page": 2, "total": 51, "has_more": False,
+        }
+
+    async def access(repository):
+        access_calls.append(repository)
+        return {"id": 51, "full_name": repository} if repository == "stackchain/later" else None
+
+    async def user():
+        return {"login": "timmy"}
+
+    async def create(repository, title, body, assignee, label_ids):
+        create_calls.append((repository, title, assignee))
+        return {
+            "id": 403, "number": 403, "title": title, "state": "open",
+            "repository": repository, "labels": [], "assignees": [assignee],
+            "updated_at": "2026-08-09T12:00:00Z",
+            "url": "https://forge.example/stackchain/later/issues/403",
+        }
+
+    monkeypatch.setattr(main.gitea_proxy, "repo_page", page)
+    monkeypatch.setattr(main.gitea_proxy, "repository_access", access)
+    monkeypatch.setattr(main.gitea_proxy, "current_user", user)
+    monkeypatch.setattr(main.gitea_proxy, "create_issue", create)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        listed = await client.get("/api/v1/repositories?page=2&limit=50")
+        created = await client.post(
+            "/api/v1/repos/stackchain/later/issues", json={"title": "Later-page work"}
+        )
+
+    assert listed.status_code == 200
+    assert listed.json()["items"][0]["full_name"] == "stackchain/later"
+    assert listed.json()["has_more"] is False
+    assert created.status_code == 201
+    assert access_calls == ["stackchain/later"]
+    assert create_calls == [("stackchain/later", "Later-page work", "timmy")]
+
+
+def test_context_exposes_truthful_repository_pagination():
+    repositories = gitea_proxy.RepositoryItems(
+        [{
+            "id": 1, "name": "api", "full_name": "stackchain/api",
+            "description": "", "html_url": "https://forge.example/stackchain/api",
+            "updated_at": "2026-08-09T12:00:00Z",
+        }],
+        {"page": 1, "total": 51, "has_more": True},
+    )
+
+    payload = main._context_payload(
+        {"id": 2, "login": "timmy"}, repositories, [], []
+    )
+
+    assert payload["repository_pagination"] == {
+        "page": 1, "total": 51, "has_more": True
+    }
+
+
 @pytest.mark.anyio
 async def test_create_issue_atomically_validates_and_sends_release_plan(monkeypatch):
     calls = []
@@ -400,6 +527,10 @@ async def test_create_issue_atomically_validates_and_sends_release_plan(monkeypa
 
     monkeypatch.setattr(main.gitea_proxy, "current_user", user)
     monkeypatch.setattr(main.gitea_proxy, "repos", available_repos)
+    monkeypatch.setattr(
+        main.gitea_proxy, "repository_access",
+        lambda repository: repository_access_from(available_repos, repository),
+    )
     monkeypatch.setattr(main.gitea_proxy, "repo_milestones", milestones)
     monkeypatch.setattr(main.gitea_proxy, "create_issue", create)
     transport = httpx.ASGITransport(app=main.app)
@@ -448,6 +579,10 @@ async def test_create_issue_replays_one_upstream_result_for_concurrent_idempoten
 
     monkeypatch.setattr(main.gitea_proxy, "current_user", user)
     monkeypatch.setattr(main.gitea_proxy, "repos", available_repos)
+    monkeypatch.setattr(
+        main.gitea_proxy, "repository_access",
+        lambda repository: repository_access_from(available_repos, repository),
+    )
     monkeypatch.setattr(main.gitea_proxy, "create_issue", create)
     transport = httpx.ASGITransport(app=main.app)
     headers = {"Idempotency-Key": "capture-177-concurrent"}
@@ -496,6 +631,10 @@ async def test_completed_issue_creation_replays_after_ledger_reconstruction(monk
     )
     monkeypatch.setattr(main.gitea_proxy, "current_user", user)
     monkeypatch.setattr(main.gitea_proxy, "repos", available_repos)
+    monkeypatch.setattr(
+        main.gitea_proxy, "repository_access",
+        lambda repository: repository_access_from(available_repos, repository),
+    )
     monkeypatch.setattr(main.gitea_proxy, "create_issue", create)
     transport = httpx.ASGITransport(app=main.app)
     headers = {"Idempotency-Key": "restart-create-201"}
@@ -544,6 +683,10 @@ async def test_create_issue_rejects_changed_payload_for_an_existing_idempotency_
 
     monkeypatch.setattr(main.gitea_proxy, "current_user", user)
     monkeypatch.setattr(main.gitea_proxy, "repos", available_repos)
+    monkeypatch.setattr(
+        main.gitea_proxy, "repository_access",
+        lambda repository: repository_access_from(available_repos, repository),
+    )
     monkeypatch.setattr(main.gitea_proxy, "create_issue", create)
     transport = httpx.ASGITransport(app=main.app)
     headers = {"Idempotency-Key": "capture-177-payload-conflict"}
@@ -585,6 +728,10 @@ async def test_create_issue_retry_recovers_result_after_the_first_request_times_
     monkeypatch.setattr(main, "ISSUE_ACTION_TIMEOUT_SECONDS", 0.01)
     monkeypatch.setattr(main.gitea_proxy, "current_user", user)
     monkeypatch.setattr(main.gitea_proxy, "repos", available_repos)
+    monkeypatch.setattr(
+        main.gitea_proxy, "repository_access",
+        lambda repository: repository_access_from(available_repos, repository),
+    )
     monkeypatch.setattr(main.gitea_proxy, "create_issue", create)
     transport = httpx.ASGITransport(app=main.app)
     headers = {"Idempotency-Key": "capture-177-timeout-recovery"}
@@ -627,6 +774,10 @@ async def test_create_issue_durable_ledger_evicts_completed_entry_at_size_limit(
     monkeypatch.setattr(main, "_idempotency_ledger", ledger)
     monkeypatch.setattr(main.gitea_proxy, "current_user", user)
     monkeypatch.setattr(main.gitea_proxy, "repos", available_repos)
+    monkeypatch.setattr(
+        main.gitea_proxy, "repository_access",
+        lambda repository: repository_access_from(available_repos, repository),
+    )
     monkeypatch.setattr(main.gitea_proxy, "create_issue", create)
     transport = httpx.ASGITransport(app=main.app)
     async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
@@ -735,6 +886,10 @@ async def test_repo_labels_endpoint_only_loads_labels_for_accessible_repository(
         return [{"id": 3, "name": "P0", "color": "d73a4a", "description": "Urgent"}]
 
     monkeypatch.setattr(main.gitea_proxy, "repos", available_repos)
+    monkeypatch.setattr(
+        main.gitea_proxy, "repository_access",
+        lambda repository: repository_access_from(available_repos, repository),
+    )
     monkeypatch.setattr(main.gitea_proxy, "repo_labels", labels)
     transport = httpx.ASGITransport(app=main.app)
     async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
@@ -811,6 +966,10 @@ async def test_create_issue_rejects_label_not_in_target_repository(monkeypatch):
 
     monkeypatch.setattr(main.gitea_proxy, "current_user", user)
     monkeypatch.setattr(main.gitea_proxy, "repos", available_repos)
+    monkeypatch.setattr(
+        main.gitea_proxy, "repository_access",
+        lambda repository: repository_access_from(available_repos, repository),
+    )
     monkeypatch.setattr(main.gitea_proxy, "repo_labels", labels)
     monkeypatch.setattr(main.gitea_proxy, "create_issue", create)
     transport = httpx.ASGITransport(app=main.app)

tests/test_issue_outbox.py

@@ -68,7 +68,57 @@ process.stdout.write(JSON.stringify({{items:reloaded, stored:JSON.parse(values.g
     ]
     assert [item["operationId"] for item in output["items"]] == ["op-1", "op-2"]
     assert all(item["status"] == "queued" for item in output["items"])
-    assert output["stored"]["version"] == 2
+    assert output["stored"]["version"] == 3
+
+
+def test_issue_outbox_persists_create_and_start_intent_and_returns_it_with_confirmation():
+    script = f"""
+const createIssueOutbox = require({json.dumps(str(OUTBOX))});
+const values = new Map();
+const storage = {{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v)}};
+const outbox = createIssueOutbox({{
+  storage, getOwnerLogin:()=> 'timmy', createOperationId:()=> 'create-start-1',
+  fetchJson:async () => ({{repository:'stackchain/dashboard',number:389,title:'Resume me'}}),
+}});
+outbox.enqueue({{
+  repository:'stackchain/dashboard',title:'Resume me',body:'',completionIntent:'create-and-start'
+}});
+const reloaded = createIssueOutbox({{
+  storage, fetchJson:async () => ({{repository:'stackchain/dashboard',number:389,title:'Resume me'}})
+}});
+reloaded.flush('timmy').then(result => process.stdout.write(JSON.stringify({{
+  persisted:JSON.parse(values.get('stackchain.issue-outbox.v1')),
+  result,
+}})));
+"""
+    output = run_node(script)
+
+    assert output["persisted"]["version"] == 3
+    completion = output["result"]["completions"][0]
+    assert completion["intent"] == "create-and-start"
+    assert completion["ownerLogin"] == "timmy"
+    assert completion["operationId"] == "create-start-1"
+    assert completion["issue"]["number"] == 389
+
+
+def test_editing_a_queued_issue_updates_its_completion_intent_without_rekeying_delivery():
+    script = f"""
+const createIssueOutbox = require({json.dumps(str(OUTBOX))});
+const values=new Map();let sequence=0;
+const storage={{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v)}};
+const outbox=createIssueOutbox({{
+  storage,getOwnerLogin:()=>'timmy',createOperationId:()=> 'intent-' + (++sequence)
+}});
+const queued=outbox.enqueue({{repository:'o/r',title:'Work',body:''}});
+const started=outbox.update(queued.id,{{...queued,completionIntent:'create-and-start'}});
+const ordinary=outbox.update(queued.id,{{...started,completionIntent:undefined}});
+process.stdout.write(JSON.stringify({{started,ordinary}}));
+"""
+    output = run_node(script)
+
+    assert output["started"]["completionIntent"] == "create-and-start"
+    assert "completionIntent" not in output["ordinary"]
+    assert output["started"]["operationId"] == output["ordinary"]["operationId"] == "intent-1"
 
 
 def test_issue_outbox_flushes_sequentially_and_keeps_transient_failures_queued():
@@ -384,13 +434,45 @@ process.stdout.write(JSON.stringify(outbox.list()));
     ]
 
 
+def test_page_preserves_background_create_and_start_until_the_matching_account_continues_it():
+    script = f"""
+const createIssueOutbox = require({json.dumps(str(OUTBOX))});
+const values=new Map();
+const storage={{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v)}};
+values.set('stackchain.issue-outbox.v1',JSON.stringify({{version:3,items:[{{
+  id:'resume',operationId:'resume',ownerLogin:'timmy',status:'queued',
+  repository:'stackchain/dashboard',title:'Resume',body:'',completionIntent:'create-and-start'
+}}]}}));
+const outbox=createIssueOutbox({{storage}});
+outbox.reconcileBackground([{{
+  id:'resume',status:'sent',ownerLogin:'timmy',completionIntent:'create-and-start',
+  deliveredIssue:{{repository:'stackchain/dashboard',number:389,title:'Resume'}}
+}}]);
+const blocked=outbox.pendingCompletions('alexander');
+const pending=outbox.pendingCompletions('timmy');
+const retained=outbox.list();
+outbox.completeIntent('resume','timmy');
+process.stdout.write(JSON.stringify({{blocked,pending,retained,remaining:outbox.list()}}));
+"""
+    output = run_node(script)
+
+    assert output["blocked"] == []
+    assert output["pending"] == [{
+        "id": "resume", "intent": "create-and-start", "ownerLogin": "timmy",
+        "operationId": "resume",
+        "issue": {"repository": "stackchain/dashboard", "number": 389, "title": "Resume"},
+    }]
+    assert output["retained"][0]["status"] == "completion"
+    assert output["remaining"] == []
+
+
 @pytest.mark.anyio
 async def test_mobile_dashboard_queues_offline_captures_and_exposes_outbox_actions():
     html = await dashboard()
 
     assert '<script src="static/issue-outbox.js"></script>' in html
     assert "const issueOutbox = createIssueOutbox({" in html
-    assert "await issueOutbox.enqueueDurably(captureDraft)" in html
+    assert "await issueOutbox.enqueueDurably(durableDraft)" in html
     assert "Saving for background delivery…" in html
     assert "Saved for next launch; background delivery unavailable." in html
     assert "throw new Error('Background Sync unavailable')" in html

tests/test_later_picker.py

@@ -0,0 +1,134 @@
+import json
+import subprocess
+from pathlib import Path
+
+
+LATER_PICKER = Path(__file__).parents[1] / "frontend" / "later-picker.js"
+
+
+def run_node(script: str) -> dict:
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+    return json.loads(result.stdout)
+
+
+def test_exact_local_time_is_validated_and_converted_to_an_instant():
+    script = f"""
+const createLaterPicker = require({json.dumps(str(LATER_PICKER))});
+const picker = createLaterPicker({{
+  now: () => new Date(2026, 7, 9, 14, 0, 0),
+}});
+const valid = picker.parse('2026-08-09T16:30');
+const past = picker.parse('2026-08-09T13:59');
+const invalid = picker.parse('2026-02-30T12:00');
+process.stdout.write(JSON.stringify({{
+  valid: {{ok:valid.ok, local:[valid.value.getFullYear(), valid.value.getMonth() + 1, valid.value.getDate(), valid.value.getHours(), valid.value.getMinutes()]}},
+  past, invalid,
+}}));
+"""
+    output = run_node(script)
+
+    assert output["valid"] == {"ok": True, "local": [2026, 8, 9, 16, 30]}
+    assert output["past"] == {
+        "ok": False,
+        "message": "Choose a future date and time.",
+    }
+    assert output["invalid"] == {
+        "ok": False,
+        "message": "Choose a valid local date and time.",
+    }
+
+
+def test_picker_uses_history_for_cancel_and_confirms_only_valid_future_time():
+    script = f"""
+const createLaterPicker = require({json.dumps(str(LATER_PICKER))});
+const listeners = {{}};
+const states = [];
+const confirmed = [];
+let focused = 0;
+const history = {{
+  state: {{workRoute:'issue'}},
+  pushState(state) {{ this.state = state; states.push(['push', state.laterPicker]); }},
+  back() {{ states.push(['back']); const previous = {{workRoute:'issue'}}; this.state = previous; listeners.popstate({{state:previous}}); }},
+}};
+const picker = createLaterPicker({{
+  now: () => new Date(2026, 7, 9, 14, 0, 0), history,
+  eventTarget: {{addEventListener:(name, callback) => {{ listeners[name] = callback; }}}},
+  onState: state => states.push([state.open, state.message || '']),
+  onConfirm: (item, value, context) => {{ confirmed.push([item.number, value.toISOString(), context]); return true; }},
+}});
+picker.start();
+picker.open({{number:17}}, {{focus:() => {{ focused += 1; }}}}, 'detail');
+const invalid = picker.submit('2026-08-09T13:00');
+const valid = picker.submit('2026-08-09T16:30');
+picker.submit('2026-08-09T17:30');
+process.stdout.write(JSON.stringify({{invalid, valid, confirmed, focused, current:picker.current(), states}}));
+"""
+    output = run_node(script)
+
+    assert output["invalid"] is False
+    assert output["valid"] is True
+    assert output["confirmed"] == [[17, "2026-08-09T16:30:00.000Z", "detail"]]
+    assert output["focused"] == 1
+    assert output["current"] is False
+    assert [False, "Choose a future date and time."] not in output["states"]
+    assert [True, "Choose a future date and time."] in output["states"]
+    assert ["back"] in output["states"]
+
+
+def test_picker_runs_detail_cleanup_only_after_its_history_entry_closes():
+    script = f"""
+const createLaterPicker = require({json.dumps(str(LATER_PICKER))});
+const listeners = {{}};
+const order = [];
+const history = {{
+  state: {{workRoute:'issue'}},
+  pushState(state) {{ this.state = state; }},
+  back() {{
+    order.push('picker-back');
+    this.state = {{workRoute:'issue'}};
+    listeners.popstate({{state:this.state}});
+  }},
+}};
+const picker = createLaterPicker({{
+  now:() => new Date(2026, 7, 9, 14, 0), history,
+  eventTarget:{{addEventListener:(name, callback) => {{ listeners[name] = callback; }}}},
+  onConfirm:() => () => order.push('detail-close'),
+}});
+picker.start();
+picker.open({{number:17}}, null, 'detail');
+const saved = picker.submit('2026-08-09T16:30');
+process.stdout.write(JSON.stringify({{saved, order}}));
+"""
+    output = run_node(script)
+
+    assert output == {"saved": True, "order": ["picker-back", "detail-close"]}
+
+
+def test_picker_ignores_a_second_submit_while_browser_back_is_pending():
+    script = f"""
+const createLaterPicker = require({json.dumps(str(LATER_PICKER))});
+const listeners = {{}};
+let popstate;
+let confirmations = 0;
+const history = {{
+  state:null,
+  pushState(state) {{ this.state = state; }},
+  back() {{ popstate = () => {{ this.state = {{}}; listeners.popstate({{state:this.state}}); }}; }},
+}};
+const picker = createLaterPicker({{
+  now:() => new Date(2026, 7, 9, 14, 0), history,
+  eventTarget:{{addEventListener:(name, callback) => {{ listeners[name] = callback; }}}},
+  onConfirm:() => {{ confirmations += 1; return true; }},
+}});
+picker.start();
+picker.open({{number:17}});
+const first = picker.submit('2026-08-09T16:30');
+const second = picker.submit('2026-08-09T16:30');
+popstate();
+process.stdout.write(JSON.stringify({{first, second, confirmations}}));
+"""
+    output = run_node(script)
+
+    assert output == {"first": True, "second": False, "confirmations": 1}

tests/test_later_store.py

@@ -65,6 +65,135 @@ def test_deferrals_are_durable_revisioned_idempotent_and_account_scoped(tmp_path
     ) == {"revision": 2, "records": {}}
 
 
+def test_batch_applies_in_one_ordered_idempotent_unit(tmp_path):
+    store = LaterStore(tmp_path / "later.sqlite3")
+    operations = [
+        {"operation_id": "first", "action": "defer", "item_id": "issue:r:1:", "wake_at": "2026-08-10T09:00:00.000Z"},
+        {"operation_id": "second", "action": "restore", "item_id": "issue:r:1:"},
+    ]
+
+    result = store.apply_batch("timmy", operations)
+    assert result == {
+        "revision": 2,
+        "records": {},
+        "accepted_operation_ids": ["first", "second"],
+        "duplicate_operation_ids": [],
+        "rejected_operations": [],
+    }
+    replay = store.apply_batch("timmy", operations)
+    assert replay["revision"] == 2
+    assert replay["accepted_operation_ids"] == []
+    assert replay["duplicate_operation_ids"] == ["first", "second"]
+
+
+def test_batch_rejects_stale_same_item_intent_without_blocking_other_items(tmp_path):
+    store = LaterStore(tmp_path / "later.sqlite3")
+    first = store.apply_batch("timmy", [{
+        "operation_id": "newer-device",
+        "action": "defer",
+        "item_id": "issue:r:1:",
+        "wake_at": "2026-08-12T09:00:00.000Z",
+        "base_revision": 0,
+    }])
+
+    replay = store.apply_batch("timmy", [
+        {
+            "operation_id": "stale-device",
+            "action": "defer",
+            "item_id": "issue:r:1:",
+            "wake_at": "2026-08-10T09:00:00.000Z",
+            "base_revision": 0,
+        },
+        {
+            "operation_id": "unrelated-item",
+            "action": "defer",
+            "item_id": "issue:r:2:",
+            "wake_at": "2026-08-11T09:00:00.000Z",
+            "base_revision": 0,
+        },
+    ])
+
+    assert first["revision"] == 1
+    assert replay == {
+        "revision": 2,
+        "records": {
+            "issue:r:1:": "2026-08-12T09:00:00.000Z",
+            "issue:r:2:": "2026-08-11T09:00:00.000Z",
+        },
+        "accepted_operation_ids": ["unrelated-item"],
+        "duplicate_operation_ids": [],
+        "rejected_operations": [
+            {"operation_id": "stale-device", "reason": "stale_intent"}
+        ],
+    }
+    duplicate = store.apply_batch("timmy", [{
+        "operation_id": "stale-device",
+        "action": "restore",
+        "item_id": "issue:r:2:",
+        "base_revision": 2,
+    }])
+    assert duplicate["duplicate_operation_ids"] == ["stale-device"]
+    assert duplicate["revision"] == 2
+    assert duplicate["records"] == replay["records"]
+
+
+def test_later_receipts_are_bounded_per_account_and_existing_schema_migrates(tmp_path):
+    path = tmp_path / "later.sqlite3"
+    with sqlite3.connect(path) as connection:
+        connection.execute(
+            "CREATE TABLE later_operations (login TEXT NOT NULL, operation_id TEXT NOT NULL, "
+            "PRIMARY KEY (login, operation_id))"
+        )
+        connection.execute(
+            "INSERT INTO later_operations(login, operation_id) VALUES ('timmy', 'legacy')"
+        )
+
+    store = LaterStore(path, operation_limit=2, clock=lambda: 1_000)
+    for index in range(4):
+        store.apply(
+            "timmy", f"op-{index}", "defer", f"issue:r:{index}:",
+            wake_at="2026-08-10T09:00:00.000Z",
+        )
+    store.apply(
+        "alexander", "other", "defer", "issue:r:99:",
+        wake_at="2026-08-10T09:00:00.000Z",
+    )
+
+    with sqlite3.connect(path) as connection:
+        columns = {row[1] for row in connection.execute("PRAGMA table_info(later_operations)")}
+        timmy = connection.execute(
+            "SELECT operation_id FROM later_operations WHERE login = 'timmy' ORDER BY rowid"
+        ).fetchall()
+        alexander = connection.execute(
+            "SELECT operation_id FROM later_operations WHERE login = 'alexander'"
+        ).fetchall()
+
+    assert "created_at" in columns
+    assert timmy == [("op-2",), ("op-3",)]
+    assert alexander == [("other",)]
+
+
+def test_later_receipt_age_pruning_is_account_scoped(tmp_path):
+    clock = [1_000.0]
+    path = tmp_path / "later.sqlite3"
+    store = LaterStore(path, operation_retention_seconds=60, clock=lambda: clock[0])
+    store.apply("timmy", "old", "restore", "issue:r:1:")
+    store.apply("alexander", "other-old", "restore", "issue:r:2:")
+    clock[0] += 61
+    store.apply("timmy", "fresh", "restore", "issue:r:3:")
+
+    with sqlite3.connect(path) as connection:
+        timmy = connection.execute(
+            "SELECT operation_id FROM later_operations WHERE login = 'timmy'"
+        ).fetchall()
+        alexander = connection.execute(
+            "SELECT operation_id FROM later_operations WHERE login = 'alexander'"
+        ).fetchall()
+
+    assert timmy == [("fresh",)]
+    assert alexander == [("other-old",)]
+
+
 @pytest.mark.anyio
 async def test_authenticated_later_api_uses_confirmed_account_and_csrf(monkeypatch, tmp_path):
     monkeypatch.setenv("STACKCHAIN_DASHBOARD_AUTH_MODE", "operator")
@@ -98,10 +227,25 @@ async def test_authenticated_later_api_uses_confirmed_account_and_csrf(monkeypat
         changed = await client.patch(
             "/api/v1/later",
             json={
-                "operation_id": "mobile-1",
-                "action": "defer",
-                "item_id": "issue:stackchain/dashboard:363:",
-                "wake_at": "2026-08-10T09:00:00.000Z",
+                "operations": [
+                    {"operation_id": "mobile-1", "action": "defer", "item_id": "issue:stackchain/dashboard:363:", "wake_at": "2026-08-10T09:00:00.000Z"},
+                    {"operation_id": "mobile-2", "action": "defer", "item_id": "issue:stackchain/dashboard:365:", "wake_at": "2026-08-11T09:00:00.000Z"},
+                ],
+            },
+            headers={
+                "Origin": "https://test",
+                "X-CSRF-Token": client.cookies["stackchain_csrf"],
+            },
+        )
+        stale = await client.patch(
+            "/api/v1/later",
+            json={
+                "operations": [{
+                    "operation_id": "offline-stale",
+                    "action": "restore",
+                    "item_id": "issue:stackchain/dashboard:363:",
+                    "base_revision": 0,
+                }],
             },
             headers={
                 "Origin": "https://test",
@@ -112,10 +256,22 @@ async def test_authenticated_later_api_uses_confirmed_account_and_csrf(monkeypat
 
     assert forbidden.status_code == 403
     assert changed.status_code == 200
-    assert changed.json() == fetched.json() == {
-        "revision": 1,
+    assert changed.json() == {
+        "revision": 2,
         "records": {
-            "issue:stackchain/dashboard:363:": "2026-08-10T09:00:00.000Z"
+            "issue:stackchain/dashboard:363:": "2026-08-10T09:00:00.000Z",
+            "issue:stackchain/dashboard:365:": "2026-08-11T09:00:00.000Z",
         },
+        "accepted_operation_ids": ["mobile-1", "mobile-2"],
+        "duplicate_operation_ids": [],
+        "rejected_operations": [],
     }
+    assert stale.json()["rejected_operations"] == [
+        {"operation_id": "offline-stale", "reason": "stale_intent"}
+    ]
+    assert stale.json()["revision"] == 2
+    assert fetched.json() == {"revision": 2, "records": {
+        "issue:stackchain/dashboard:363:": "2026-08-10T09:00:00.000Z",
+        "issue:stackchain/dashboard:365:": "2026-08-11T09:00:00.000Z",
+    }}
     assert fetched.headers["cache-control"] == "no-store"

tests/test_later_sync.py

@@ -9,6 +9,7 @@ from tests.dashboard_bundle import dashboard
 
 LATER_SYNC = Path(__file__).parents[1] / "frontend" / "later-sync.js"
 LATER_WORK = Path(__file__).parents[1] / "frontend" / "later-work.js"
+COORDINATOR = Path(__file__).parents[1] / "frontend" / "outbox-coordinator.js"
 
 
 def run_node(script):
@@ -19,6 +20,41 @@ def run_node(script):
     )
 
 
+def test_two_tabs_cannot_erase_each_others_later_edits_or_double_drain():
+    script = f"""
+const createLaterSync=require({json.dumps(str(LATER_SYNC))});
+const createCoordinator=require({json.dumps(str(COORDINATOR))});
+const values=new Map();const storage={{get length(){{return values.size}},key:i=>[...values.keys()][i]||null,getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}};
+const channels=[];const channelFactory=()=>{{const channel={{onmessage:null,postMessage:data=>channels.filter(x=>x!==channel).forEach(x=>x.onmessage?.({{data}})),close(){{}}}};channels.push(channel);return channel}};
+const held=new Set();const locks={{request:async(name,_options,work)=>{{if(held.has(name))return work(null);held.add(name);try{{return await work({{name}})}}finally{{held.delete(name)}}}}}};
+let sequence=0,releaseFirst;const delivered=[];
+const make=tab=>createLaterSync({{storage,getLogin:()=> 'timmy',createOperationId:()=>tab+'-'+(++sequence),coordinator:createCoordinator({{storage,locks,channelFactory,tabId:tab}}),fetchJson:async(_url,options={{}})=>{{if(!options.method)return {{revision:0,records:{{}}}};const operation=JSON.parse(options.body).operations[0];delivered.push(operation);if(delivered.length===1)await new Promise(resolve=>releaseFirst=resolve);return {{revision:delivered.length,records:{{[operation.item_id]:operation.wake_at}}}}}},onRemoteRecords:()=>{{}},onStatus:()=>{{}}}});
+const first=make('first'),second=make('second');first.enqueue('defer','issue:r:1:','2026-08-10T09:00:00.000Z');
+(async()=>{{const draining=first.flush();while(!releaseFirst)await Promise.resolve();second.enqueue('defer','issue:r:2:','2026-08-11T09:00:00.000Z');const competing=second.flush();releaseFirst();await Promise.all([draining,competing]);await first.flush();process.stdout.write(JSON.stringify({{delivered,pending:first.pending(),keys:[...values.keys()]}}));}})();
+"""
+    result = run_node(script)
+    assert sorted(operation["operation_id"] for operation in result["delivered"]) == ["first-1", "second-2"]
+    assert len(result["delivered"]) == 2
+    assert result["pending"] == []
+    assert not any(".operation." in key for key in result["keys"])
+
+
+def test_concurrent_later_records_for_one_item_deliver_only_the_newest_intent():
+    script = f"""
+const createLaterSync=require({json.dumps(str(LATER_SYNC))});
+const values=new Map();const storage={{get length(){{return values.size}},key:i=>[...values.keys()][i]||null,getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}};
+const prefix='stackchain.later-sync.v1.timmy.operation.';
+values.set(prefix+'old',JSON.stringify({{queued_at:100,operation:{{operation_id:'old',action:'defer',item_id:'issue:r:2:',wake_at:'2026-08-10T09:00:00.000Z'}}}}));
+values.set(prefix+'new',JSON.stringify({{queued_at:101,operation:{{operation_id:'new',action:'restore',item_id:'issue:r:2:',wake_at:null}}}}));
+const delivered=[];const sync=createLaterSync({{storage,getLogin:()=> 'timmy',fetchJson:async(_url,options={{}})=>{{if(!options.method)return {{revision:0,records:{{}}}};delivered.push(...JSON.parse(options.body).operations);return {{revision:1,records:{{}}}}}},onRemoteRecords:()=>{{}},onStatus:()=>{{}}}});
+(async()=>{{await sync.flush();process.stdout.write(JSON.stringify({{delivered,pending:sync.pending(),keys:[...values.keys()]}}));}})();
+"""
+    result = run_node(script)
+    assert [operation["operation_id"] for operation in result["delivered"]] == ["new"]
+    assert result["pending"] == []
+    assert not any(".operation." in key for key in result["keys"])
+
+
 def test_offline_deferral_replays_once_and_adopts_server_records():
     script = f"""
 const createLaterSync = require({json.dumps(str(LATER_SYNC))});
@@ -31,7 +67,7 @@ const sync = createLaterSync({{
   fetchJson:async (url,options={{}})=>{{
     requests.push({{url,body:options.body&&JSON.parse(options.body)}});
     if (!options.method) return remote;
-    const operation=JSON.parse(options.body);
+    const operation=JSON.parse(options.body).operations[0];
     remote={{revision:2,records:{{...remote.records,[operation.item_id]:operation.wake_at}}}};
     return remote;
   }},
@@ -48,19 +84,93 @@ sync.enqueue('defer','issue:r:2:','2026-08-10T09:00:00.000Z');
     assert [request["url"] for request in result["requests"]] == [
         "api/v1/later",
         "api/v1/later",
-        "api/v1/later",
     ]
-    assert result["requests"][1]["body"] == {
+    assert result["requests"][0]["body"] == {"operations": [{
         "operation_id": "offline-op",
         "action": "defer",
         "item_id": "issue:r:2:",
         "wake_at": "2026-08-10T09:00:00.000Z",
-    }
+        "base_revision": 0,
+    }]}
     assert result["records"]["issue:r:2:"] == "2026-08-10T09:00:00.000Z"
     assert result["status"] == "saved"
     assert result["pending"] == []
 
 
+def test_later_queue_expires_ancient_edits_before_replay():
+    script = f"""
+const createLaterSync=require({json.dumps(str(LATER_SYNC))});
+const values=new Map();const statuses=[];const requests=[];
+const storage={{get length(){{return values.size}},key:i=>[...values.keys()][i]||null,
+ getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}};
+const sync=createLaterSync({{storage,getLogin:()=> 'timmy',createOperationId:()=> 'old-later',
+ now:()=>1_800_000_000_000,maxOfflineMs:1000,
+ fetchJson:async(_url,options={{}})=>{{requests.push(options.method||'GET');return {{revision:4,records:{{}}}}}},
+ onRemoteRecords:()=>{{}},onStatus:(state,detail={{}})=>statuses.push([state,detail.count||0])}});
+(async()=>{{await sync.flush();sync.enqueue('restore','issue:r:2:');
+const key=[...values.keys()].find(value=>value.includes('.operation.'));
+const record=JSON.parse(values.get(key));record.queued_at=1_799_999_000_000;values.set(key,JSON.stringify(record));
+await sync.flush();process.stdout.write(JSON.stringify({{requests,statuses,pending:sync.pending()}}));}})();
+"""
+    result = run_node(script)
+
+    assert result["requests"] == ["GET", "GET"]
+    assert ["expired", 1] in result["statuses"]
+    assert result["statuses"][-1] == ["expired", 1]
+    assert result["pending"] == []
+
+
+def test_stale_receipt_adopts_server_truth_and_reports_another_device_conflict():
+    script = f"""
+const createLaterSync=require({json.dumps(str(LATER_SYNC))});
+const values=new Map();const requests=[];const statuses=[];const adopted=[];
+const storage={{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}};
+const sync=createLaterSync({{
+ storage,getLogin:()=> 'timmy',createOperationId:()=> 'offline-old',
+ fetchJson:async(_url,options={{}})=>{{
+   if(!options.method)return {{revision:3,records:{{'issue:r:1:':'2026-08-12T09:00:00.000Z'}}}};
+   const body=JSON.parse(options.body);requests.push(body);
+   return {{revision:4,records:{{'issue:r:1:':'2026-08-13T09:00:00.000Z'}},accepted_operation_ids:[],duplicate_operation_ids:[],rejected_operations:[{{operation_id:'offline-old',reason:'stale_intent'}}]}};
+ }},onRemoteRecords:records=>adopted.push(records),onStatus:(state,detail={{}})=>statuses.push([state,detail]),
+}});
+(async()=>{{await sync.flush();sync.enqueue('defer','issue:r:1:','2026-08-10T09:00:00.000Z');await sync.flush();
+process.stdout.write(JSON.stringify({{requests,statuses,adopted,pending:sync.pending()}}));}})();
+"""
+    result = run_node(script)
+    assert result["requests"] == [{"operations": [{
+        "operation_id": "offline-old",
+        "action": "defer",
+        "item_id": "issue:r:1:",
+        "wake_at": "2026-08-10T09:00:00.000Z",
+        "base_revision": 3,
+    }]}]
+    assert result["statuses"][-1] == ["conflict", {"count": 1}]
+    assert result["adopted"][-1] == {
+        "issue:r:1:": "2026-08-13T09:00:00.000Z"
+    }
+    assert result["pending"] == []
+
+
+def test_pending_later_edits_are_sent_as_one_batch_without_a_preflight_get():
+    script = f"""
+const createLaterSync=require({json.dumps(str(LATER_SYNC))});
+const values=new Map();const requests=[];let sequence=0;
+const sync=createLaterSync({{
+ storage:{{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}},
+ getLogin:()=> 'timmy',createOperationId:()=> 'op-'+(++sequence),
+ fetchJson:async(_url,options={{}})=>{{const body=JSON.parse(options.body);requests.push(body);return {{revision:2,records:{{}},accepted_operation_ids:body.operations.map(x=>x.operation_id),duplicate_operation_ids:[],rejected_operations:[]}}}},
+ onRemoteRecords:()=>{{}},onStatus:()=>{{}},
+}});
+sync.enqueue('defer','issue:r:1:','2026-08-10T09:00:00.000Z');
+sync.enqueue('restore','issue:r:2:');
+(async()=>{{await sync.flush();process.stdout.write(JSON.stringify({{requests,pending:sync.pending()}}));}})();
+"""
+    result=run_node(script)
+    assert len(result["requests"]) == 1
+    assert [item["operation_id"] for item in result["requests"][0]["operations"]] == ["op-1", "op-2"]
+    assert result["pending"] == []
+
+
 def test_latest_offline_intent_wins_and_failed_delivery_stays_pending():
     script = f"""
 const createLaterSync = require({json.dumps(str(LATER_SYNC))});
@@ -81,6 +191,7 @@ sync.enqueue('restore','issue:r:2:');
                 "action": "restore",
                 "item_id": "issue:r:2:",
                 "wake_at": None,
+                "base_revision": 0,
             }
         ],
         "status": "retrying",
@@ -109,7 +220,7 @@ sync.enqueue('defer','issue:r:2:','2026-08-10T09:00:00.000Z');
     assert run_node(script) == {
         "scheduledBeforeSwitch": 1,
         "timers": 1,
-        "requests": ["GET"],
+        "requests": ["PATCH"],
         "pendingForAlexander": [],
     }
 
@@ -123,7 +234,7 @@ const sync=createLaterSync({{
  getLogin:()=> 'timmy',createOperationId:()=> 'op-'+(++sequence),
  fetchJson:async (_url,options={{}})=>{{
    if (!options.method) return {{revision:0,records:{{}}}};
-   const operation=JSON.parse(options.body); actions.push(operation.action);
+   const operation=JSON.parse(options.body).operations[0]; actions.push(operation.action);
    if (operation.action==='defer') await new Promise(resolve=>releaseFirst=resolve);
    return {{revision:actions.length,records:operation.action==='defer'?{{[operation.item_id]:operation.wake_at}}:{{}}}};
  }},onRemoteRecords:r=>{{globalThis.records=r}},onStatus:()=>{{}},
@@ -178,7 +289,7 @@ sync.startLifecycle({{window:{{addEventListener:(n,h)=>handlers[n]=h}},document:
     assert run_node(script) == {
         "first": True,
         "second": False,
-        "requests": ["GET", "PATCH"],
+        "requests": ["PATCH"],
         "pending": [],
     }
 
@@ -228,10 +339,13 @@ async def test_dashboard_syncs_every_later_change_and_exposes_account_status():
     assert "laterSync.migrate(laterWork.read());" in html
     assert "laterSync.flush();" in html
     assert "Later saved to account." in html
+    assert "Another device changed this Later item" in html
+    assert "Today edit expired after 30 days offline" in html
+    assert "Later edit expired after 30 days offline" in html
 
 
 def test_later_sync_ships_atomically_in_the_offline_shell():
     source = (Path(__file__).parents[1] / "frontend" / "service-worker.js").read_text()
 
-    assert "stackchain-dashboard-shell-v49" in source
+    assert "stackchain-dashboard-shell-v67" in source
     assert "BASE + 'static/later-sync.js'" in source

tests/test_live_snapshot.py

@@ -1,6 +1,7 @@
 import asyncio
 import json
 
+import httpx
 import pytest
 
 from src import main
@@ -90,9 +91,9 @@ async def test_live_snapshot_fetches_user_once_and_updates_work_and_activity(mon
     assert result["sections"] == {
         "context": "fresh", "events": "fresh", "notifications": "fresh"
     }
-    assert result["revisions"] == {
-        "context": 1, "events": 1, "notifications": 1
-    }
+    assert set(result["revisions"]) == {"context", "events", "notifications"}
+    assert len(set(result["revisions"].values())) == 1
+    assert result["revisions"]["context"].endswith(".1")
 
 
 @pytest.mark.anyio
@@ -129,6 +130,56 @@ async def test_live_snapshot_omits_section_bodies_at_known_revisions(monkeypatch
     assert "freshness" in second
 
 
+@pytest.mark.anyio
+async def test_live_snapshot_token_from_another_worker_never_suppresses_content(monkeypatch):
+    async def user():
+        return {"id": 1, "login": "timmy"}
+
+    async def empty():
+        return []
+
+    monkeypatch.setattr(main, "current_user", user)
+    monkeypatch.setattr(main, "repos", empty)
+    monkeypatch.setattr(main, "issues", empty)
+    monkeypatch.setattr(main, "pull_requests", empty)
+    monkeypatch.setattr(main, "activity_events", lambda _user: empty())
+    monkeypatch.setattr(main, "notifications", empty)
+    monkeypatch.setattr(main, "_live_revision_generation", "worker-a")
+
+    worker_a = payload(await main.live_snapshot())
+    worker_a_token = worker_a["revisions"]["context"]
+
+    main._live_snapshot_value = None
+    main._live_snapshot_created_at = None
+    main._live_section_created_at = {
+        section: None for section in main.LIVE_SNAPSHOT_SECTIONS
+    }
+    main._live_section_revisions = {
+        section: 0 for section in main.LIVE_SNAPSHOT_SECTIONS
+    }
+    monkeypatch.setattr(main, "_live_revision_generation", "worker-b")
+
+    worker_b = payload(await main.live_snapshot(context_revision=worker_a_token))
+
+    assert worker_a_token == "worker-a.1"
+    assert worker_b["revisions"]["context"] == "worker-b.1"
+    assert worker_b["context"]["user"]["login"] == "timmy"
+
+
+@pytest.mark.anyio
+async def test_live_snapshot_rejects_malformed_revision_before_upstream_work(monkeypatch):
+    async def unexpected_user():
+        raise AssertionError("malformed revision reached upstream work")
+
+    monkeypatch.setattr(main, "current_user", unexpected_user)
+    transport = httpx.ASGITransport(app=main.app)
+
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        response = await client.get("/api/v1/live?context_revision=not-a-token")
+
+    assert response.status_code == 422
+
+
 @pytest.mark.anyio
 async def test_live_snapshot_keeps_fresh_context_when_activity_fails(monkeypatch):
     async def user():

tests/test_markdown_renderer.py

@@ -137,4 +137,4 @@ def test_markdown_work_bodies_are_mobile_safe_block_containers():
     assert ".markdown-content { min-width:0; max-width:100%; overflow-wrap:anywhere;" in css
     assert ".markdown-content pre { max-width:100%; overflow-x:auto;" in css
     assert ".markdown-content a { min-height:44px;" in css
-    assert "stackchain-dashboard-shell-v49" in worker
+    assert "stackchain-dashboard-shell-v67" in worker

tests/test_mobile_composer_integration.py

@@ -35,4 +35,4 @@ def test_offline_shell_contains_every_local_dashboard_runtime_asset():
     shell_assets = set(re.findall(r"BASE \+ '([^']+)'", worker.split("async function sessionCsrf", 1)[0]))
 
     assert local_assets <= shell_assets, f"Offline shell is missing: {sorted(local_assets - shell_assets)}"
-    assert "stackchain-dashboard-shell-v49" in worker
+    assert "stackchain-dashboard-shell-v67" in worker

tests/test_mobile_task_dock.py

@@ -8,6 +8,39 @@ from tests.dashboard_bundle import dashboard
 
 
 DOCK = Path(__file__).resolve().parents[1] / "frontend" / "mobile-task-dock.js"
+ENTRY = Path(__file__).resolve().parents[1] / "frontend" / "mobile-work-entry.js"
+
+
+def test_mobile_work_entry_prioritizes_continue_resume_start_then_fallback():
+    script = f"""
+const createEntry = require({json.dumps(str(ENTRY))});
+const state = {{active:true, resumable:true, today:2}};
+const calls = [];
+const entry = createEntry({{
+  isTodayActive: () => state.active,
+  isTodayResumable: () => state.resumable,
+  getTodayCount: () => state.today,
+  continueToday: () => calls.push('continue'),
+  resumeToday: () => calls.push('resume'),
+  startToday: () => calls.push('start'),
+  openFallback: () => calls.push('fallback'),
+}});
+const modes = [];
+modes.push(entry.open());
+state.active = false; modes.push(entry.open());
+state.resumable = false; modes.push(entry.open());
+state.today = 0; modes.push(entry.open());
+process.stdout.write(JSON.stringify({{modes, calls}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], capture_output=True, text=True
+    )
+
+    assert result.returncode == 0, result.stderr
+    assert json.loads(result.stdout) == {
+        "modes": ["continue", "resume", "start", "work"],
+        "calls": ["continue", "resume", "start", "fallback"],
+    }
 
 
 def test_mobile_task_dock_routes_actions_hides_for_overlays_and_restores_focus():
@@ -70,6 +103,43 @@ process.stdout.write(JSON.stringify({{
     }
 
 
+def test_mobile_task_dock_shows_contextual_work_label_with_attention_count():
+    script = f"""
+const createDock = require({json.dumps(str(DOCK))});
+const work = {{ attributes: {{}}, setAttribute(name, value) {{ this.attributes[name] = value; }} }};
+const workLabel = {{ textContent:'' }};
+const badge = {{ textContent:'', hidden:true }};
+const dock = createDock({{ nav:{{}}, buttons:{{work}}, workLabel, attentionBadge:badge }});
+dock.updateWork('continue', 3);
+const continuing = {{ text:workLabel.textContent, count:badge.textContent, hidden:badge.hidden, label:work.attributes['aria-label'] }};
+dock.updateWork('resume', 0);
+const resuming = {{ text:workLabel.textContent, hidden:badge.hidden, label:work.attributes['aria-label'] }};
+dock.updateWork('start', 0);
+const starting = {{ text:workLabel.textContent, label:work.attributes['aria-label'] }};
+dock.updateWork('work', 0);
+process.stdout.write(JSON.stringify({{
+  continuing, resuming, starting,
+  fallback:{{ text:workLabel.textContent, label:work.attributes['aria-label'] }},
+}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], capture_output=True, text=True
+    )
+
+    assert result.returncode == 0, result.stderr
+    assert json.loads(result.stdout) == {
+        "continuing": {
+            "text": "Continue",
+            "count": "3",
+            "hidden": False,
+            "label": "Continue Today, 3 items need attention",
+        },
+        "resuming": {"text": "Resume", "hidden": True, "label": "Resume Today"},
+        "starting": {"text": "Start", "label": "Start Today"},
+        "fallback": {"text": "Work", "label": "Work"},
+    }
+
+
 def test_mobile_task_dock_exposes_and_hides_deduplicated_attention_count():
     script = f"""
 const createDock = require({json.dumps(str(DOCK))});
@@ -95,6 +165,24 @@ process.stdout.write(JSON.stringify({{
     }
 
 
+@pytest.mark.anyio
+async def test_dashboard_wires_mobile_work_dock_into_today_session_lifecycle():
+    html = await dashboard()
+
+    assert 'id="mobile-work-label">Work</span>' in html
+    assert '<script src="static/mobile-work-entry.js"></script>' in html
+    assert "const mobileWorkEntry = createMobileWorkEntry({" in html
+    assert "isTodayActive: () => workSession.checkpointed()" in html
+    assert "isTodayResumable: () => workSession.resumable()" in html
+    assert "getTodayCount: () => todayMyWork.length" in html
+    assert "continueToday: continueTodaySession" in html
+    assert "resumeToday: resumeTodaySession" in html
+    assert "startToday: startTodaySession" in html
+    assert "work: () => mobileWorkEntry.open()" in html
+    assert "mobileTaskDock.updateWork(mobileWorkEntry.mode(), countMyWork(activeMyWork).attention)" in html
+    assert "workSession.reopen()" in html
+
+
 @pytest.mark.anyio
 async def test_dashboard_renders_and_wires_phone_safe_task_dock():
     html = await dashboard()
@@ -112,12 +200,12 @@ async def test_dashboard_renders_and_wires_phone_safe_task_dock():
     assert '.mobile-task-action { min-width:0; min-height:44px;' in html
     assert '<script src="static/mobile-task-dock.js"></script>' in html
     assert "createMobileTaskDock({" in html
-    assert "work: openMobileWork" in html
-    assert "counts.attention ? 'attention' : 'all'" in html
+    assert "work: () => mobileWorkEntry.open()" in html
+    assert "const filter = counts.attention ? 'attention' : 'all';" in html
     assert "qs('[data-work-filter=\"' + filter + '\"]').click()" in html
     assert "find: () => qs('#find-work').click()" in html
     assert "new: () => qs('#new-issue').click()" in html
     assert "search: () => qs('#open-palette').click()" in html
     assert "drafts: () => qs('[data-work-filter=\"draft\"]').click()" in html
     assert "draftCount.textContent = sourceDraftCount.textContent" in html
-    assert "mobileTaskDock.updateAttention(counts.attention)" in html
+    assert "mobileTaskDock.updateWork(mobileWorkEntry.mode(), countMyWork(activeMyWork).attention)" in html

tests/test_my_work.py

@@ -11,6 +11,7 @@ from tests.dashboard_bundle import dashboard
 MY_WORK = Path(__file__).parents[1] / "frontend" / "my-work.js"
 LATER_WORK = Path(__file__).parents[1] / "frontend" / "later-work.js"
 DETAIL_DEFER = Path(__file__).parents[1] / "frontend" / "detail-defer.js"
+LATER_PICKER = Path(__file__).parents[1] / "frontend" / "later-picker.js"
 REVIEW_SHEET = Path(__file__).parents[1] / "frontend" / "review-sheet.js"
 ISSUE_SHEET = Path(__file__).parents[1] / "frontend" / "issue-sheet.js"
 CREATE_ISSUE_SHEET = Path(__file__).parents[1] / "frontend" / "create-issue-sheet.js"
@@ -19,6 +20,87 @@ CONVERSATION = Path(__file__).parents[1] / "frontend" / "conversation.js"
 PICK_WORK = Path(__file__).parents[1] / "frontend" / "pick-work.js"
 WORK_ROUTE = Path(__file__).parents[1] / "frontend" / "work-route.js"
 UPDATE_OWNERSHIP = Path(__file__).parents[1] / "frontend" / "update-ownership.js"
+CARD_PLANNING = Path(__file__).parents[1] / "frontend" / "card-planning.js"
+
+
+def test_card_planning_disclosures_keep_one_open_and_escape_restores_focus():
+    script = f"""
+const createCardPlanning = require({json.dumps(str(CARD_PLANNING))});
+function disclosure(name) {{
+  const listeners = {{}};
+  const attrs = {{}};
+  const summary = {{
+    focusCount: 0,
+    setAttribute(key, value) {{ attrs[key] = value; }},
+    focus() {{ this.focusCount += 1; }},
+  }};
+  return {{
+    name, open: false, dataset: {{}}, summary, attrs,
+    querySelector(selector) {{ return selector === 'summary' ? summary : null; }},
+    addEventListener(type, listener) {{ listeners[type] = listener; }},
+    fire(type, event = {{}}) {{ listeners[type](event); }},
+  }};
+}}
+const first = disclosure('first');
+const second = disclosure('second');
+const controller = createCardPlanning({{
+  querySelectorAll() {{ return [first, second]; }},
+}});
+controller.wire();
+first.open = true;
+first.fire('toggle');
+second.open = true;
+second.fire('toggle');
+const escape = {{
+  key: 'Escape', prevented: 0, stopped: 0,
+  preventDefault() {{ this.prevented += 1; }},
+  stopPropagation() {{ this.stopped += 1; }},
+}};
+second.fire('keydown', escape);
+process.stdout.write(JSON.stringify({{
+  firstOpen: first.open,
+  firstExpanded: first.attrs['aria-expanded'],
+  secondOpen: second.open,
+  secondExpanded: second.attrs['aria-expanded'],
+  secondFocus: second.summary.focusCount,
+  prevented: escape.prevented,
+  stopped: escape.stopped,
+}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "firstOpen": False,
+        "firstExpanded": "false",
+        "secondOpen": False,
+        "secondExpanded": "false",
+        "secondFocus": 1,
+        "prevented": 1,
+        "stopped": 1,
+    }
+
+
+@pytest.mark.anyio
+async def test_my_work_cards_progressively_disclose_planning_on_phones():
+    html = await dashboard()
+    service_worker = (Path(__file__).parents[1] / "frontend" / "service-worker.js").read_text()
+
+    assert '<script src="static/card-planning.js"></script>' in html
+    assert "const cardPlanning = createCardPlanning(document);" in html
+    assert "cardPlanning.wire();" in html
+    assert (
+        '<details class="card-planning" data-card-planning>'
+        '<summary aria-expanded="false">Plan or defer</summary>'
+        '<div class="card-planning-actions">'
+    ) in html
+    assert '.card-planning > summary { display:none;' in html
+    assert '.card-planning:not([open]) > .card-planning-actions { display:grid;' in html
+    mobile = html.index('@media (max-width: 600px)')
+    assert '.card-planning > summary { min-height:44px; display:flex;' in html[mobile:]
+    assert '.card-planning:not([open]) > .card-planning-actions { display:none;' in html[mobile:]
+    assert "BASE + 'static/card-planning.js'" in service_worker
 
 
 def test_unassigned_issue_update_claims_once_and_becomes_today_ready():
@@ -1176,6 +1258,29 @@ async def test_mobile_my_work_wires_touch_safe_non_mutating_later_actions():
     assert "'Deferred until ' + fmt(until)" in html
 
 
+@pytest.mark.anyio
+async def test_mobile_later_actions_open_one_keyboard_safe_exact_time_dialog():
+    html = await dashboard()
+
+    assert '<script src="static/later-picker.js"></script>' in html
+    assert html.count('<button type="button" data-detail-defer-custom') == 4
+    assert 'data-later-custom' in html
+    assert 'id="later-picker"' in html
+    assert 'role="dialog"' in html
+    assert 'type="datetime-local"' in html
+    assert 'id="later-picker-timezone"' in html
+    assert 'id="later-picker-error"' in html
+    assert 'createLaterPicker({' in html
+    assert "laterPicker.open(item, button, 'detail')" in html
+    assert "laterPicker.open(item, button, 'card')" in html
+    assert "detailDefer.deferUntil(item, until, {" in html
+    assert "laterWork.defer(item, until)" in html
+    assert "fetch(" not in LATER_PICKER.read_text()
+    assert '.later-picker-panel' in html
+    assert '.later-picker { box-sizing:border-box; width:100%; height:100%;' in html
+    assert 'env(safe-area-inset-bottom)' in html
+
+
 def test_milestone_lane_composes_with_type_filter_and_updates_confirmed_snapshot():
     payload = {
         "issues": [
@@ -1323,6 +1428,200 @@ process.stdout.write(JSON.stringify({{finished,active:session.active()}}));
     assert json.loads(result.stdout) == {"finished": 1, "active": False}
 
 
+def test_active_today_session_reopens_current_item_without_restarting_checkpoint():
+    script = f"""
+const buildMyWork = require({json.dumps(str(MY_WORK))});
+let saves = 0;
+const checkpoint = {{
+  read: () => null,
+  save: () => {{ saves += 1; return true; }},
+  clear: () => true,
+}};
+const items = [1, 2].map(number => ({{
+  kind:'issue', repository:'stackchain/dashboard', number, title:'Item ' + number,
+}}));
+const opened = [];
+const progress = [];
+const session = buildMyWork.createWorkSession({{
+  getItems: () => items, getFilter: () => 'all', checkpoint,
+  onOpen: item => opened.push(item.number),
+  onProgress: state => progress.push(state.index), onFinish: () => {{}},
+}});
+session.start();
+session.next();
+const savesBeforeReopen = saves;
+const reopened = session.reopen();
+process.stdout.write(JSON.stringify({{
+  reopened, opened, progress, savesBeforeReopen, savesAfterReopen:saves,
+  todayActive:session.checkpointed(),
+}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], capture_output=True, text=True
+    )
+
+    assert result.returncode == 0, result.stderr
+    assert json.loads(result.stdout) == {
+        "reopened": True,
+        "opened": [1, 2, 2],
+        "progress": [1, 2, 2],
+        "savesBeforeReopen": 2,
+        "savesAfterReopen": 2,
+        "todayActive": True,
+    }
+
+
+def test_today_session_checkpoint_resumes_current_item_after_reload():
+    script = f"""
+const buildMyWork = require({json.dumps(str(MY_WORK))});
+const values = new Map();
+const storage = {{
+  getItem: key => values.has(key) ? values.get(key) : null,
+  setItem: (key, value) => values.set(key, value),
+  removeItem: key => values.delete(key),
+}};
+const items = [1, 2, 3].map(number => ({{
+  kind:'issue', repository:'stackchain/dashboard', number, title:'Item ' + number,
+}}));
+const opened = [];
+const firstCheckpoint = buildMyWork.createWorkSessionCheckpoint({{
+  storage, getLogin: () => 'timmy',
+}});
+const first = buildMyWork.createWorkSession({{
+  getItems: () => items, getFilter: () => 'all',
+  checkpoint: firstCheckpoint,
+  onOpen: item => opened.push('first:' + item.number),
+  onProgress: () => {{}}, onFinish: () => {{}},
+}});
+first.start();
+first.next();
+
+const secondCheckpoint = buildMyWork.createWorkSessionCheckpoint({{
+  storage, getLogin: () => 'timmy',
+}});
+const resumed = buildMyWork.createWorkSession({{
+  getItems: () => items, getFilter: () => 'all',
+  checkpoint: secondCheckpoint,
+  onOpen: item => opened.push('resumed:' + item.number),
+  onProgress: () => {{}}, onFinish: () => {{}},
+}});
+const available = resumed.resumable();
+const didResume = resumed.resume();
+process.stdout.write(JSON.stringify({{
+  available, didResume, opened, checkpoint:JSON.parse(values.values().next().value),
+}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "available": True,
+        "didResume": True,
+        "opened": ["first:1", "first:2", "resumed:2"],
+        "checkpoint": {
+            "version": 1,
+            "login": "timmy",
+            "identity": "issue:stackchain/dashboard:2:",
+            "index": 1,
+        },
+    }
+
+
+def test_today_session_checkpoint_is_account_bound_and_end_clears_it():
+    script = f"""
+const buildMyWork = require({json.dumps(str(MY_WORK))});
+let login = 'timmy';
+const values = new Map();
+const storage = {{
+  getItem: key => values.has(key) ? values.get(key) : null,
+  setItem: (key, value) => values.set(key, value),
+  removeItem: key => values.delete(key),
+}};
+const checkpoint = buildMyWork.createWorkSessionCheckpoint({{storage, getLogin:() => login}});
+const session = buildMyWork.createWorkSession({{
+  getItems: () => [{{kind:'issue',repository:'stackchain/dashboard',number:7}}],
+  getFilter: () => 'all', checkpoint,
+  onOpen: () => {{}}, onProgress: () => {{}}, onFinish: () => {{}},
+}});
+session.start();
+login = 'alexander';
+const visibleToOtherAccount = session.resumable();
+const retainedForOwner = values.size;
+login = 'timmy';
+session.end();
+process.stdout.write(JSON.stringify({{
+  visibleToOtherAccount, retainedForOwner, active:session.active(), stored:values.size,
+}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "visibleToOtherAccount": False,
+        "retainedForOwner": 1,
+        "active": False,
+        "stored": 0,
+    }
+
+
+def test_resuming_an_empty_today_plan_clears_the_stale_checkpoint():
+    script = f"""
+const buildMyWork = require({json.dumps(str(MY_WORK))});
+const values = new Map([['stackchain.today-session.v1', JSON.stringify({{
+  version:1, login:'timmy', identity:'issue:stackchain/dashboard:7:', index:0,
+}})]]);
+const storage = {{
+  getItem:key => values.get(key) || null,
+  setItem:(key,value) => values.set(key,value),
+  removeItem:key => values.delete(key),
+}};
+const checkpoint = buildMyWork.createWorkSessionCheckpoint({{storage,getLogin:() => 'timmy'}});
+const session = buildMyWork.createWorkSession({{
+  getItems:() => [], getFilter:() => 'all', checkpoint,
+  onOpen:() => {{}}, onProgress:() => {{}}, onFinish:() => {{}},
+}});
+const resumed = session.resume();
+process.stdout.write(JSON.stringify({{resumed, stored:values.size, available:session.resumable()}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {"resumed": False, "stored": 0, "available": False}
+
+
+def test_today_session_keeps_working_when_checkpoint_storage_fails():
+    script = f"""
+const buildMyWork = require({json.dumps(str(MY_WORK))});
+let errors = 0;
+const opened = [];
+const checkpoint = buildMyWork.createWorkSessionCheckpoint({{
+  storage:{{
+    getItem:() => null,
+    setItem:() => {{ throw new Error('quota'); }},
+    removeItem:() => {{ throw new Error('quota'); }},
+  }},
+  getLogin:() => 'timmy',
+  onError:() => {{ errors += 1; }},
+}});
+const session = buildMyWork.createWorkSession({{
+  getItems:() => [1,2].map(number => ({{kind:'issue',repository:'stackchain/dashboard',number}})),
+  getFilter:() => 'all', checkpoint,
+  onOpen:item => opened.push(item.number), onProgress:() => {{}}, onFinish:() => {{}},
+}});
+session.start();
+session.next();
+process.stdout.write(JSON.stringify({{errors,opened,active:session.active()}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {"errors": 1, "opened": [1, 2], "active": True}
+
+
 @pytest.mark.anyio
 async def test_mobile_work_session_renders_touch_safe_controls_for_every_work_sheet():
     html = await dashboard()
@@ -1337,6 +1636,23 @@ async def test_mobile_work_session_renders_touch_safe_controls_for_every_work_sh
     assert 'aria-live="polite" data-work-session-progress' in html
 
 
+@pytest.mark.anyio
+async def test_dashboard_offers_account_safe_resume_and_end_today_controls():
+    html = await dashboard()
+
+    assert 'id="resume-today-session"' in html
+    assert 'id="end-today-session"' in html
+    assert 'const sessionCheckpoint = createWorkSessionCheckpoint({' in html
+    assert 'getLogin: () => confirmedOwnerLogin' in html
+    assert 'checkpoint: sessionCheckpoint' in html
+    assert 'checkpointEnabled: () => selectedWorkFilter === \'today\'' in html
+    assert "qs('#resume-today-session').addEventListener('click'" in html
+    assert "qs('#end-today-session').addEventListener('click'" in html
+    assert "workSession.resume()" in html
+    assert "workSession.end()" in html
+    assert '.resume-today-session, .end-today-session { min-height:44px;' in html
+
+
 @pytest.mark.anyio
 async def test_dashboard_wires_work_session_to_existing_sheet_flows_and_completion_actions():
     html = await dashboard()
@@ -1352,6 +1668,97 @@ async def test_dashboard_wires_work_session_to_existing_sheet_flows_and_completi
         assert opener in html
 
 
+@pytest.mark.anyio
+async def test_closing_issue_advances_active_session_once_and_exposes_close_and_next():
+    html = await dashboard()
+
+    assert "qs('#close-issue').textContent = workSession.active() ? 'Close & next' : 'Close issue';" in html
+    close_handler = html.split("qs('#close-issue').addEventListener('click'", 1)[1].split(
+        "qs('#close-pull-sheet').addEventListener", 1
+    )[0]
+    assert "refreshMyWorkView({ reconcileSession:false });" in close_handler
+    assert "if (workSession.active()) workSession.complete();" in close_handler
+    assert close_handler.index("await issueController.close(selectedIssue)") < close_handler.index(
+        "if (workSession.active()) workSession.complete();"
+    )
+    assert close_handler.index("lastMyWork = lastMyWork.filter") < close_handler.index(
+        "if (workSession.active()) workSession.complete();"
+    )
+
+
+@pytest.mark.anyio
+async def test_merging_pull_advances_active_session_once_and_exposes_merge_and_next():
+    html = await dashboard()
+
+    assert "qs('#merge-pull').textContent = workSession.active() ? 'Merge & next' : 'Merge';" in html
+    merge_handler = html.split("qs('#merge-pull').addEventListener('click'", 1)[1].split(
+        "qs('#keep-update-unread').addEventListener", 1
+    )[0]
+    assert "refreshMyWorkView({ reconcileSession:false });" in merge_handler
+    assert "const continuingSession = workSession.active();" in merge_handler
+    assert "if (workSession.active()) workSession.complete();" in merge_handler
+    assert "merged. Next work item opened." in merge_handler
+    assert merge_handler.index("await pullController.merge") < merge_handler.index(
+        "if (workSession.active()) workSession.complete();"
+    )
+    assert merge_handler.index("lastMyWork = lastMyWork.filter") < merge_handler.index(
+        "if (workSession.active()) workSession.complete();"
+    )
+
+
+@pytest.mark.anyio
+async def test_pull_merge_keeps_non_session_copy_and_final_session_completion_announcement():
+    html = await dashboard()
+    merge_handler = html.split("qs('#merge-pull').addEventListener('click'", 1)[1].split(
+        "qs('#keep-update-unread').addEventListener", 1
+    )[0]
+
+    assert "else if (!continuingSession)" in merge_handler
+    assert "merging.key + ' merged.'" in merge_handler
+    assert "else if (continuingSession" not in merge_handler
+    assert "onFinish: () =>" in html
+    assert "qs('#my-work-action-status').textContent = 'Work session complete.';" in html
+
+
+@pytest.mark.anyio
+async def test_failed_pull_merge_does_not_remove_or_advance_the_session():
+    html = await dashboard()
+    merge_handler = html.split("qs('#merge-pull').addEventListener('click'", 1)[1].split(
+        "qs('#keep-update-unread').addEventListener", 1
+    )[0]
+    success_path, failure_path = merge_handler.split("} catch (error) {", 1)
+
+    assert "lastMyWork = lastMyWork.filter" in success_path
+    assert "workSession.complete()" in success_path
+    assert "lastMyWork = lastMyWork.filter" not in failure_path
+    assert "workSession.complete()" not in failure_path
+    assert "The pull request remains in My Work; refresh and retry." in failure_path
+    assert "button.disabled = false;" in failure_path
+
+
+def test_work_session_can_start_at_a_newly_created_item():
+    script = f"""
+const buildMyWork = require({json.dumps(str(MY_WORK))});
+const items = [1, 2, 3].map(number => ({{kind:'issue', repository:'stackchain/dashboard', number}}));
+const opened = [];
+const session = buildMyWork.createWorkSession({{
+  getItems: () => items,
+  getFilter: () => 'all',
+  getMilestone: () => '',
+  onOpen: item => opened.push(item.number),
+  onProgress: () => {{}},
+  onFinish: () => {{}},
+}});
+const started = session.start(items[2]);
+process.stdout.write(JSON.stringify({{started, opened}}));
+"""
+
+    output = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    ).stdout
+    assert json.loads(output) == {"started": True, "opened": [3]}
+
+
 def test_my_work_filter_counts_distinguish_prs_from_review_requests():
     items = [
         {"kind": "issue", "is_review": False},
@@ -1624,6 +2031,19 @@ async def test_mobile_my_work_exposes_truthful_work_pagination_control():
     assert '.load-more-work { min-height:44px;' in html
 
 
+@pytest.mark.anyio
+async def test_mobile_issue_capture_can_load_more_repositories_without_leaving_form():
+    html = await dashboard()
+
+    assert 'id="load-more-issue-repositories"' in html
+    assert '>Load more repositories<' in html
+    assert 'id="create-issue-repository-status" class="small" aria-live="polite"' in html
+    assert 'issueCapture.loadRepositoryPage(nextIssueRepositoryPage)' in html
+    assert 'lastContextSnapshot?.repository_pagination?.has_more === true' in html
+    assert 'appendIssueRepositories(payload.items)' in html
+    assert '.create-issue-repository-more { min-height:44px;' in html
+
+
 @pytest.mark.anyio
 async def test_mobile_assigned_issue_sheet_exposes_touch_sized_content_editor():
     html = await dashboard()
@@ -1726,6 +2146,52 @@ Promise.all([first, duplicate]).then(results => process.stdout.write(JSON.string
     assert output["results"][1]["number"] == 17
 
 
+def test_issue_capture_repository_pages_are_single_flight_and_retryable_without_touching_draft():
+    script = f"""
+const createIssueCapture = require({json.dumps(str(CREATE_ISSUE_SHEET))});
+const values = new Map();
+const storage = {{
+  getItem:key => values.get(key) || null,
+  setItem:(key,value) => values.set(key,value),
+  removeItem:key => values.delete(key),
+}};
+let calls = 0;
+let release;
+const capture = createIssueCapture({{
+  storage,
+  fetchJson: url => {{
+    calls += 1;
+    if (calls === 1) return Promise.reject(new Error('temporary'));
+    return new Promise(resolve => {{ release = () => resolve({{
+      items:[{{full_name:'stackchain/later'}}], page:2, total:51, has_more:false
+    }}); }});
+  }},
+}});
+capture.saveDraft({{repository:'stackchain/api', title:'Keep me', body:'Context', labelIds:[3]}});
+capture.loadRepositoryPage(2).catch(() => {{
+  const first = capture.loadRepositoryPage(2);
+  const duplicate = capture.loadRepositoryPage(2);
+  release();
+  Promise.all([first, duplicate]).then(results => process.stdout.write(JSON.stringify({{
+    calls, results, draft:capture.loadDraft()
+  }})));
+}});
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+    output = json.loads(result.stdout)
+
+    assert output["calls"] == 2
+    assert output["results"] == [
+        {"items": [{"full_name": "stackchain/later"}], "page": 2, "total": 51, "has_more": False},
+        {"items": [{"full_name": "stackchain/later"}], "page": 2, "total": 51, "has_more": False},
+    ]
+    assert output["draft"] == {
+        "repository": "stackchain/api", "title": "Keep me", "body": "Context", "labelIds": [3]
+    }
+
+
 def test_issue_capture_reuses_its_persisted_idempotency_key_after_reload():
     script = f"""
 const createIssueCapture = require({json.dumps(str(CREATE_ISSUE_SHEET))});
@@ -1942,6 +2408,113 @@ Promise.all([capture.loadMilestones('stackchain/api'), capture.submit(capture.lo
     assert output["stored"]["number"] == 221
 
 
+def test_issue_capture_finds_only_open_issue_duplicates_in_the_selected_repository():
+    script = f"""
+const createIssueCapture = require({json.dumps(str(CREATE_ISSUE_SHEET))});
+const calls = [];
+const capture = createIssueCapture({{
+  storage: {{getItem:()=>null, setItem:()=>{{}}, removeItem:()=>{{}}}},
+  fetchJson: url => {{
+    calls.push(url);
+    return Promise.resolve({{items:[
+      {{kind:'issue', state:'open', repository:'stackchain/api', number:7, title:'Investigate checkout latency'}},
+      {{kind:'pull', state:'open', repository:'stackchain/api', number:8, title:'Investigate checkout latency'}},
+      {{kind:'issue', state:'closed', repository:'stackchain/api', number:9, title:'Investigate checkout latency'}},
+      {{kind:'issue', state:'open', repository:'stackchain/web', number:10, title:'Investigate checkout latency'}},
+      {{kind:'issue', state:'open', repository:'stackchain/api', number:11, title:'Checkout latency alert'}},
+      {{kind:'issue', state:'open', repository:'stackchain/api', number:12, title:'Checkout latency follow-up'}},
+      {{kind:'issue', state:'open', repository:'stackchain/api', number:13, title:'Fourth match is bounded'}},
+    ]}});
+  }},
+}});
+capture.findDuplicates({{repository:'stackchain/api', title:'  Investigate checkout latency  '}}).then(state =>
+  process.stdout.write(JSON.stringify({{calls, state}}))
+);
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+    output = json.loads(result.stdout)
+
+    assert output["calls"] == [
+        "api/v1/search?q=Investigate%20checkout%20latency&limit=10"
+    ]
+    assert output["state"]["status"] == "ready"
+    assert [item["number"] for item in output["state"]["candidates"]] == [7, 11, 12]
+
+
+def test_issue_capture_ignores_stale_duplicate_results_and_resets_create_anyway_acknowledgement():
+    script = f"""
+const createIssueCapture = require({json.dumps(str(CREATE_ISSUE_SHEET))});
+const pending = [];
+const capture = createIssueCapture({{
+  storage: {{getItem:()=>null, setItem:()=>{{}}, removeItem:()=>{{}}}},
+  fetchJson: url => new Promise((resolve, reject) => pending.push({{url, resolve, reject}})),
+}});
+const firstDraft = {{repository:'stackchain/api', title:'Checkout latency'}};
+const latestDraft = {{repository:'stackchain/api', title:'Checkout latency alert'}};
+const first = capture.findDuplicates(firstDraft);
+const latest = capture.findDuplicates(latestDraft);
+pending[1].resolve({{items:[{{kind:'issue',state:'open',repository:'stackchain/api',number:22,title:'Checkout latency alert'}}]}});
+latest.then(latestState => {{
+  const blocked = capture.needsDuplicateAcknowledgement(latestDraft);
+  capture.acknowledgeDuplicates(latestDraft);
+  const allowed = capture.needsDuplicateAcknowledgement(latestDraft);
+  const changedDraft = {{...latestDraft,title:'Checkout latency alert today'}};
+  const changedSearch = capture.findDuplicates(changedDraft);
+  pending[2].resolve({{items:[{{kind:'issue',state:'open',repository:'stackchain/api',number:23,title:'Checkout latency alert today'}}]}});
+  changedSearch.then(() => {{
+    const changed = capture.needsDuplicateAcknowledgement(changedDraft);
+    pending[0].resolve({{items:[{{kind:'issue',state:'open',repository:'stackchain/api',number:21,title:'Old result'}}]}});
+    first.then(staleState => {{
+      const failure = capture.findDuplicates({{repository:'stackchain/api',title:'Network failure'}});
+      pending[3].reject(new Error('offline'));
+      failure.then(failedState => process.stdout.write(JSON.stringify({{
+        latestState, staleState, blocked, allowed, changed, failedState,
+        failureBlocks:capture.needsDuplicateAcknowledgement({{repository:'stackchain/api',title:'Network failure'}}),
+      }})));
+    }});
+  }});
+}});
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+    output = json.loads(result.stdout)
+
+    assert output["latestState"]["status"] == "ready"
+    assert output["staleState"]["status"] == "stale"
+    assert output["blocked"] is True
+    assert output["allowed"] is False
+    assert output["changed"] is True
+    assert output["failedState"]["status"] == "failed"
+    assert output["failureBlocks"] is False
+
+
+def test_issue_capture_keeps_partial_duplicate_search_advisory():
+    script = f"""
+const createIssueCapture = require({json.dumps(str(CREATE_ISSUE_SHEET))});
+const draft = {{repository:'stackchain/api', title:'Checkout latency'}};
+const capture = createIssueCapture({{
+  storage: {{getItem:()=>null, setItem:()=>{{}}, removeItem:()=>{{}}}},
+  fetchJson: () => Promise.resolve({{partial:true, items:[
+    {{kind:'issue',state:'open',repository:'stackchain/api',number:24,title:'Checkout latency'}},
+  ]}}),
+}});
+capture.findDuplicates(draft).then(state => process.stdout.write(JSON.stringify({{
+  state, blocked:capture.needsDuplicateAcknowledgement(draft),
+}})));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+    output = json.loads(result.stdout)
+
+    assert output["state"]["partial"] is True
+    assert [item["number"] for item in output["state"]["candidates"]] == [24]
+    assert output["blocked"] is False
+
+
 def test_unread_updates_enrich_matching_work_and_keep_unassigned_mentions_actionable():
     payload = {
         "user": {"login": "timmy"},
@@ -3124,6 +3697,25 @@ async def test_mobile_my_work_captures_new_issue_in_accessible_draft_safe_sheet(
     assert '.create-issue-label-option' in html and 'min-height:44px' in html
 
 
+@pytest.mark.anyio
+async def test_mobile_issue_capture_warns_before_queuing_a_possible_duplicate():
+    html = await dashboard()
+
+    assert 'id="create-issue-duplicates"' in html
+    assert 'id="create-issue-duplicate-list"' in html
+    assert 'aria-live="polite"' in html
+    assert 'id="create-issue-anyway"' in html and 'Create anyway' in html
+    assert "issueCapture.findDuplicates(draft)" in html
+    assert "issueCapture.needsDuplicateAcknowledgement(captureDraft)" in html
+    assert "issueCapture.acknowledgeDuplicates(captureDraft)" in html
+    assert html.index("issueCapture.needsDuplicateAcknowledgement(captureDraft)") < html.index(
+        "issueOutbox.enqueueDurably(durableDraft)"
+    )
+    assert ".create-issue-duplicate-card" in html
+    assert ".create-issue-duplicate-card a" in html and "min-height:44px" in html
+    assert "overflow-wrap:anywhere" in html
+
+
 @pytest.mark.anyio
 async def test_mobile_dashboard_puts_filterable_my_work_before_auxiliary_panels():
     html = await dashboard()

tests/test_outbox_coordinator.py

@@ -110,13 +110,15 @@ const seen=[];
 const unsubscribe=second.subscribe(change=>seen.push(change));
 first.notify('issue');
 first.notify('authored');
+first.notify('today');
+first.notify('later');
 unsubscribe();
 first.notify('issue');
 process.stdout.write(JSON.stringify({{seen,signal:JSON.parse(storage.getItem('stackchain.outbox-change.v1'))}}));
 """
     output = run_node(script)
 
-    assert [change["queue"] for change in output["seen"]] == ["issue", "authored"]
+    assert [change["queue"] for change in output["seen"]] == ["issue", "authored", "today", "later"]
     assert output["signal"]["queue"] == "issue"
     assert output["signal"]["tabId"] == "first"
 

tests/test_plan_today.py

@@ -0,0 +1,173 @@
+import json
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from tests.dashboard_bundle import dashboard
+
+
+PLAN_TODAY = Path(__file__).parents[1] / "frontend" / "plan-today.js"
+PLAN_TODAY_PREVIEW = Path(__file__).parents[1] / "frontend" / "plan-today-preview.js"
+SERVICE_WORKER = Path(__file__).parents[1] / "frontend" / "service-worker.js"
+
+
+def run_node(script: str) -> dict:
+    result = subprocess.run(["node", "-e", script], check=True, capture_output=True, text=True)
+    return json.loads(result.stdout)
+
+
+def test_plan_today_drafts_capacity_order_and_cancel_without_writing():
+    script = f"""
+const createPlanToday = require({json.dumps(str(PLAN_TODAY))});
+const item = number => ({{kind:'issue', repository:'stackchain/dashboard', number, title:'Issue ' + number}});
+const saved = [];
+const planner = createPlanToday({{
+  identity: value => 'issue:stackchain/dashboard:' + value.number + ':',
+  limit: 3,
+  save: ids => saved.push(ids),
+}});
+planner.open([item(1), item(2)], [item(1), item(2), item(3), item(4)]);
+const add = planner.toggle(item(3));
+const full = planner.toggle(item(4));
+const moved = planner.move('issue:stackchain/dashboard:3:', 'up');
+const snapshot = planner.snapshot();
+planner.cancel();
+process.stdout.write(JSON.stringify({{add, full, moved, snapshot, afterCancel:planner.snapshot(), saved}}));
+"""
+    assert run_node(script) == {
+        "add": "added",
+        "full": "full",
+        "moved": True,
+        "snapshot": {
+            "open": True,
+            "ids": [
+                "issue:stackchain/dashboard:1:",
+                "issue:stackchain/dashboard:3:",
+                "issue:stackchain/dashboard:2:",
+            ],
+            "count": 3,
+            "limit": 3,
+        },
+        "afterCancel": {"open": False, "ids": [], "count": 0, "limit": 3},
+        "saved": [],
+    }
+
+
+def test_plan_today_saves_exact_draft_and_starts_first_item_only_after_success():
+    script = f"""
+const createPlanToday = require({json.dumps(str(PLAN_TODAY))});
+const item = number => ({{kind:'issue', repository:'stackchain/dashboard', number, title:'Issue ' + number}});
+const calls = [];
+const planner = createPlanToday({{
+  identity: value => 'issue:stackchain/dashboard:' + value.number + ':',
+  save: ids => {{ calls.push(['save', ...ids]); return true; }},
+  start: first => calls.push(['start', first.number]),
+}});
+planner.open([item(1)], [item(1), item(2)]);
+planner.toggle(item(2));
+const result = planner.commit({{start:true}});
+process.stdout.write(JSON.stringify({{result, calls, snapshot:planner.snapshot()}}));
+"""
+    assert run_node(script) == {
+        "result": "saved",
+        "calls": [
+            ["save", "issue:stackchain/dashboard:1:", "issue:stackchain/dashboard:2:"],
+            ["start", 1],
+        ],
+        "snapshot": {"open": False, "ids": [], "count": 0, "limit": 5},
+    }
+
+
+def test_plan_today_preview_preserves_draft_scroll_and_adds_item_once_on_return():
+    script = f"""
+const createPlanToday = require({json.dumps(str(PLAN_TODAY))});
+const createPlanTodayPreview = require({json.dumps(str(PLAN_TODAY_PREVIEW))});
+const item = number => ({{kind:'issue', repository:'stackchain/dashboard', number, title:'Issue ' + number}});
+const events = [];
+let scroll = 318;
+const planner = createPlanToday({{
+  identity: value => 'issue:stackchain/dashboard:' + value.number + ':',
+  save: () => true,
+}});
+planner.open([item(1)], [item(1), item(2)]);
+const preview = createPlanTodayPreview({{
+  planner,
+  identity: value => 'issue:stackchain/dashboard:' + value.number + ':',
+  getScroll: () => scroll,
+  setScroll: value => {{ scroll = value; }},
+  onOpen: value => events.push(['open', value.number]),
+  onClose: (value, trigger) => events.push(['close', value.number, trigger]),
+}});
+preview.open(item(2), 'preview-2');
+scroll = 0;
+const first = preview.close({{add:true}});
+preview.open(item(2), 'preview-2');
+scroll = 0;
+const second = preview.close({{add:true}});
+process.stdout.write(JSON.stringify({{first, second, scroll, events, planner:planner.snapshot()}}));
+"""
+    assert run_node(script) == {
+        "first": "added",
+        "second": "already-added",
+        "scroll": 318,
+        "events": [
+            ["open", 2],
+            ["close", 2, "preview-2"],
+            ["open", 2],
+            ["close", 2, "preview-2"],
+        ],
+        "planner": {
+            "open": True,
+            "ids": ["issue:stackchain/dashboard:1:", "issue:stackchain/dashboard:2:"],
+            "count": 2,
+            "limit": 5,
+        },
+    }
+
+
+@pytest.mark.anyio
+async def test_mobile_dashboard_wires_focused_plan_today_sheet():
+    html = await dashboard()
+
+    assert '<script src="static/plan-today.js"></script>' in html
+    assert 'id="plan-today"' in html
+    assert 'id="plan-today-sheet" role="dialog"' in html
+    assert 'id="plan-today-capacity"' in html
+    assert 'id="save-and-start-today"' in html
+    assert "const planToday = createPlanToday({" in html
+    assert "todaySync.enqueue('remove'" in html
+    assert "todaySync.enqueue('add'" in html
+    assert "qs('#plan-today').addEventListener('click'" in html
+    assert ".plan-today-actions { position:sticky; bottom:0;" in html
+    assert ".plan-today-actions button { min-height:44px;" in html
+    assert "padding-bottom:calc(12px + env(safe-area-inset-bottom))" in html
+    assert ".plan-today-item { grid-template-columns:1fr; }" in html
+    assert ".plan-today-item-actions { display:grid; grid-template-columns:repeat(3,1fr);" in html
+    assert ".plan-preview-actions { position:fixed; z-index:76;" in html
+    assert '<script src="static/plan-today-preview.js"></script>' in html
+    assert 'data-plan-preview="' in html
+    assert 'id="add-plan-preview"' in html
+    assert "taskOverlayHistory.open('plan-today-preview')" in html
+    assert "planTodayPreview.close({ add:true })" in html
+    assert "Preview unavailable offline" in html
+
+
+@pytest.mark.anyio
+async def test_plan_today_wires_cancel_back_and_success_through_overlay_history():
+    html = await dashboard()
+
+    assert "taskOverlayHistory.open('plan-today')" in html
+    assert "previous === 'plan-today' && kind !== 'plan-today'" in html
+    assert "kind === 'plan-today' && previous !== 'plan-today'" in html
+    assert "openPlanToday(planTodayTrigger, false)" in html
+    assert "closePlanToday(false)" in html
+    assert "if (result === 'saved') taskOverlayHistory.leave();" in html
+
+
+def test_plan_today_controller_is_available_in_the_offline_shell():
+    source = SERVICE_WORKER.read_text()
+
+    assert "stackchain-dashboard-shell-v67" in source
+    assert "BASE + 'static/plan-today.js'" in source
+    assert "BASE + 'static/plan-today-preview.js'" in source

tests/test_readme.py

@@ -34,6 +34,14 @@ def test_readme_documents_liveness_and_gitea_readiness_checks():
     assert "HTTP 503" in text
 
 
+def test_readme_documents_exact_later_return_times():
+    text = " ".join(README.read_text().split())
+
+    assert "Choose date & time" in text
+    assert "valid future local date and time" in text
+    assert "exact instant" in text
+
+
 def test_readme_documents_bounded_offline_today_details_and_safe_actions():
     text = " ".join(README.read_text().split())
 
@@ -49,3 +57,12 @@ def test_readme_documents_offline_unread_update_conversations_and_boundaries():
     assert "previously opened unread update" in text
     assert "replies enter the account-bound durable outbox" in text
     assert "mark read, ownership, deferral, and older-message loading remain disabled" in text
+
+
+def test_readme_documents_planning_sync_retention_contract():
+    text = " ".join(README.read_text().split())
+
+    assert "30 days" in text
+    assert "4,096 operation receipts per account" in text
+    assert "expired edit" in text
+    assert "account plan is kept" in text

tests/test_service_worker.py

@@ -14,10 +14,23 @@ const fs = require('fs');
 const vm = require('vm');
 const listeners = {{}};
 const state = {{ added: [], deleted: [], claimed: false, skipped: false, fetches: [], puts: [], backgroundFlushes: 0, outboxPurges: 0, notifications: [], focused: [], opened: [], failFetch: false, stallFetch: false, lateFetch: false, fetchAborted: false, fetchStatus: 200, fetchRedirected: false, cachedBody: null }};
+const storedResponses = new Map();
+storedResponses.set(
+  'https://forge.example/dashboard/__offline-session-lease',
+  new Response(JSON.stringify({{expires_at: Math.floor(Date.now() / 1000) + 3600}})),
+);
 const cache = {{
   addAll: async urls => {{ state.added = urls; }},
-  match: async request => state.cachedBody === null ? null : new Response(state.cachedBody),
-  put: async (request, response) => {{ state.puts.push(String(request.url || request)); }},
+  match: async request => {{
+    const key = String(request.url || request);
+    if (storedResponses.has(key)) return storedResponses.get(key).clone();
+    return state.cachedBody === null ? null : new Response(state.cachedBody);
+  }},
+  put: async (request, response) => {{
+    const key = String(request.url || request);
+    state.puts.push(key);
+    storedResponses.set(key, response.clone());
+  }},
 }};
 const context = {{
   URL, Request, Response, Headers, AbortController,
@@ -105,10 +118,34 @@ async function dispatchNotificationClick(route) {{
     return json.loads(completed.stdout)
 
 
+def test_resumable_today_session_ships_in_a_new_offline_shell():
+    source = WORKER.read_text()
+
+    assert "stackchain-dashboard-shell-v67" in source
+    assert "BASE + 'static/my-work.js'" in source
+    assert "BASE + 'static/dashboard.js'" in source
+    assert "BASE + 'static/dashboard.css'" in source
+
+
+def test_duplicate_aware_capture_ships_in_a_new_offline_shell():
+    source = WORKER.read_text()
+
+    assert "stackchain-dashboard-shell-v67" in source
+    assert "BASE + 'static/create-issue-sheet.js'" in source
+    assert "BASE + 'static/dashboard.js'" in source
+
+
+def test_exact_later_picker_ships_atomically_in_a_new_offline_shell():
+    source = WORKER.read_text()
+
+    assert "stackchain-dashboard-shell-v67" in source
+    assert "BASE + 'static/later-picker.js'" in source
+
+
 def test_navigation_deadline_ships_in_a_new_shell_cache():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v49" in source
+    assert "stackchain-dashboard-shell-v67" in source
     assert "BASE + 'static/dashboard.css'" in source
     assert "BASE + 'static/dashboard.js'" in source
     assert "BASE + 'static/install-app.js'" in source
@@ -117,21 +154,21 @@ def test_navigation_deadline_ships_in_a_new_shell_cache():
 def test_today_convergence_ships_in_a_new_shell_cache():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v49" in source
+    assert "stackchain-dashboard-shell-v67" in source
     assert "BASE + 'static/today-sync.js'" in source
 
 
 def test_mobile_search_viewport_ships_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v49" in source
+    assert "stackchain-dashboard-shell-v67" in source
     assert "BASE + 'static/mobile-search-viewport.js'" in source
 
 
 def test_update_ownership_flow_ships_atomically_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v49" in source
+    assert "stackchain-dashboard-shell-v67" in source
     assert "BASE + 'static/update-ownership.js'" in source
 
 
@@ -294,6 +331,13 @@ def test_one_session_bound_csrf_proof_is_reused_for_a_background_drain():
     assert "batch: withSessionCsrf" in source
 
 
+def test_queue_today_ships_atomically_in_a_new_offline_shell():
+    source = WORKER.read_text()
+
+    assert "stackchain-dashboard-shell-v67" in source
+    assert "BASE + 'static/queue-today.js'" in source
+
+
 def test_install_precaches_complete_subpath_scoped_app_shell():
     result = run_worker_scenario(
         """
@@ -325,22 +369,30 @@ def test_install_precaches_complete_subpath_scoped_app_shell():
         "/dashboard/static/offline-work.js",
         "/dashboard/static/offline-today.js",
         "/dashboard/static/my-work.js",
+        "/dashboard/static/card-planning.js",
         "/dashboard/static/today-work.js",
+        "/dashboard/static/plan-today.js",
+        "/dashboard/static/plan-today-preview.js",
         "/dashboard/static/today-sync.js",
         "/dashboard/static/update-ownership.js",
         "/dashboard/static/later-work.js",
         "/dashboard/static/later-sync.js",
         "/dashboard/static/detail-defer.js",
+        "/dashboard/static/later-picker.js",
         "/dashboard/static/pick-work.js",
         "/dashboard/static/conversation.js",
         "/dashboard/static/issue-sheet.js",
         "/dashboard/static/create-issue-sheet.js",
+        "/dashboard/static/create-and-start.js",
+        "/dashboard/static/assign-and-start.js",
+        "/dashboard/static/queue-today.js",
         "/dashboard/static/pull-sheet.js",
         "/dashboard/static/review-sheet.js",
         "/dashboard/static/work-route.js",
         "/dashboard/static/task-overlay-history.js",
         "/dashboard/static/context-poller.js",
         "/dashboard/static/mobile-task-dock.js",
+        "/dashboard/static/mobile-work-entry.js",
         "/dashboard/static/mobile-launch.js",
         "/dashboard/static/install-app.js",
         "/dashboard/static/mobile-search-viewport.js",
@@ -380,6 +432,30 @@ def test_offline_navigation_returns_cached_shell_for_share_target_url():
     ]
 
 
+def test_expired_offline_lease_purges_private_worker_data_and_refuses_cached_shell():
+    result = run_worker_scenario(
+        """
+  await dispatchMessage({type:'stackchain-session-lease', expiresAt:1});
+  state.failFetch = true;
+  state.cachedBody = 'private cached dashboard';
+  const response = await dispatch('fetch', {
+    method:'GET', mode:'navigate', url:'https://forge.example/dashboard/',
+  });
+  process.stdout.write(JSON.stringify({
+    status: response.status,
+    body: await response.text(),
+    state,
+  }));
+"""
+    )
+
+    assert result["status"] == 401
+    assert result["body"] == "Your Stackchain session expired. Reconnect and sign in."
+    assert result["state"]["outboxPurges"] == 1
+    assert result["state"]["deleted"] == ["stackchain-dashboard-old"]
+    assert "private cached dashboard" not in result["body"]
+
+
 def test_stalled_navigation_is_aborted_and_returns_cached_shell_within_deadline():
     result = run_worker_scenario(
         """

tests/test_shared_context_snapshot.py

@@ -23,7 +23,7 @@ async def test_one_live_snapshot_updates_work_and_activity_on_one_timer():
 
     assert "fetch('api/v1/live'" in html
     assert "onSnapshot: renderLiveSnapshot" in html
-    assert "section + '_revision'" in html
+    assert "createContextPoller.buildRevisionQuery(revisions)" in html
     assert "workChanged = contextChanged || notificationsChanged" in html
     assert "renderContextSnapshot(snapshot.context)" in html
     assert "paintEventStream(snapshot.events)" in html

tests/test_task_overlay_history.py

@@ -117,6 +117,89 @@ process.stdout.write(JSON.stringify({{left, state:history.state, current:control
     }
 
 
+def test_plan_today_uses_one_history_layer_and_can_leave_after_save():
+    script = f"""
+const createTaskOverlayHistory = require({json.dumps(str(OVERLAY_HISTORY))});
+const listeners = {{}};
+const changes = [];
+const stack = [{{ page:'dashboard' }}];
+let cursor = 0;
+const history = {{
+  get state() {{ return stack[cursor]; }},
+  pushState(state) {{ stack.splice(cursor + 1); stack.push(state); cursor += 1; }},
+  replaceState(state) {{ stack[cursor] = state; }},
+  back() {{ cursor -= 1; listeners.popstate({{state:stack[cursor]}}); }},
+}};
+const controller = createTaskOverlayHistory({{
+  history,
+  eventTarget: {{ addEventListener(name, callback) {{ listeners[name] = callback; }} }},
+  onChange(kind, previous) {{ changes.push([kind, previous]); }},
+}});
+controller.start();
+const opened = controller.open('plan-today');
+const repeated = controller.open('plan-today');
+const left = controller.leave();
+process.stdout.write(JSON.stringify({{
+  opened, repeated, left, stack, cursor, current:controller.current(), changes,
+}}));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], capture_output=True, text=True
+    )
+
+    assert result.returncode == 0, result.stderr
+    assert json.loads(result.stdout) == {
+        "opened": True,
+        "repeated": True,
+        "left": True,
+        "stack": [
+            {"page": "dashboard"},
+            {"page": "dashboard"},
+        ],
+        "cursor": 1,
+        "current": None,
+        "changes": [["plan-today", None], [None, "plan-today"]],
+    }
+
+
+def test_plan_today_preview_is_a_nested_browser_history_layer():
+    script = f"""
+const createTaskOverlayHistory = require({json.dumps(str(OVERLAY_HISTORY))});
+const listeners = {{}};
+const changes = [];
+const stack = [{{ page:'dashboard' }}];
+let cursor = 0;
+const history = {{
+  get state() {{ return stack[cursor]; }},
+  pushState(state) {{ stack.splice(cursor + 1); stack.push(state); cursor += 1; }},
+  back() {{ cursor -= 1; listeners.popstate({{state:stack[cursor]}}); }},
+}};
+const controller = createTaskOverlayHistory({{
+  history,
+  eventTarget: {{ addEventListener(name, callback) {{ listeners[name] = callback; }} }},
+  onChange(kind, previous) {{ changes.push([kind, previous]); }},
+}});
+controller.start();
+controller.open('plan-today');
+const previewed = controller.open('plan-today-preview');
+controller.close();
+process.stdout.write(JSON.stringify({{previewed, cursor, current:controller.current(), changes}}));
+"""
+    result = subprocess.run(["node", "-e", script], capture_output=True, text=True)
+
+    assert result.returncode == 0, result.stderr
+    assert json.loads(result.stdout) == {
+        "previewed": True,
+        "cursor": 1,
+        "current": "plan-today",
+        "changes": [
+            ["plan-today", None],
+            ["plan-today-preview", "plan-today"],
+            ["plan-today", "plan-today-preview"],
+        ],
+    }
+
+
 def test_dashboard_routes_mobile_task_overlays_through_browser_history():
     html = dashboard_bundle_text()
 

tests/test_today_store.py

@@ -77,6 +77,126 @@ def test_limit_is_atomic_and_remove_frees_capacity(tmp_path):
     ]
 
 
+def test_batch_applies_ordered_operations_once_and_rejects_only_capacity_conflicts(tmp_path):
+    store = TodayStore(tmp_path / "today.sqlite3", limit=2)
+
+    result = store.apply_batch(
+        "timmy",
+        [
+            {"operation_id": "one", "action": "add", "item_id": "issue:r:1:"},
+            {"operation_id": "two", "action": "add", "item_id": "issue:r:2:"},
+            {"operation_id": "full", "action": "add", "item_id": "issue:r:3:"},
+            {"operation_id": "remove", "action": "remove", "item_id": "issue:r:1:"},
+            {"operation_id": "three", "action": "add", "item_id": "issue:r:3:"},
+        ],
+    )
+
+    assert result == {
+        "revision": 4,
+        "ids": ["issue:r:2:", "issue:r:3:"],
+        "accepted_operation_ids": ["one", "two", "remove", "three"],
+        "duplicate_operation_ids": [],
+        "rejected_operations": [{"operation_id": "full", "reason": "today_full"}],
+    }
+    replay = store.apply_batch("timmy", [
+        {"operation_id": "two", "action": "add", "item_id": "issue:r:2:"},
+        {"operation_id": "three", "action": "add", "item_id": "issue:r:3:"},
+    ])
+    assert replay["revision"] == 4
+    assert replay["accepted_operation_ids"] == []
+    assert replay["duplicate_operation_ids"] == ["two", "three"]
+
+
+def test_operation_receipts_are_bounded_per_account_and_existing_schema_migrates(tmp_path):
+    path = tmp_path / "today.sqlite3"
+    with sqlite3.connect(path) as connection:
+        connection.execute(
+            "CREATE TABLE today_operations (login TEXT NOT NULL, operation_id TEXT NOT NULL, "
+            "PRIMARY KEY (login, operation_id))"
+        )
+        connection.execute(
+            "INSERT INTO today_operations(login, operation_id) VALUES ('timmy', 'legacy')"
+        )
+
+    store = TodayStore(path, limit=20, operation_limit=3, clock=lambda: 1_000)
+    for index in range(5):
+        store.apply("timmy", f"op-{index}", "add", f"issue:r:{index}:")
+    store.apply("alexander", "other", "add", "issue:r:99:")
+
+    with sqlite3.connect(path) as connection:
+        columns = {row[1] for row in connection.execute("PRAGMA table_info(today_operations)")}
+        timmy = connection.execute(
+            "SELECT operation_id FROM today_operations WHERE login = 'timmy' ORDER BY rowid"
+        ).fetchall()
+        alexander = connection.execute(
+            "SELECT operation_id FROM today_operations WHERE login = 'alexander'"
+        ).fetchall()
+
+    assert "created_at" in columns
+    assert timmy == [("op-2",), ("op-3",), ("op-4",)]
+    assert alexander == [("other",)]
+
+
+def test_pruned_stale_today_operation_cannot_reorder_a_newer_plan(tmp_path):
+    store = TodayStore(tmp_path / "today.sqlite3", limit=5, operation_limit=1)
+    store.apply_batch("timmy", [
+        {"operation_id": "seed-1", "action": "add", "item_id": "issue:r:1:", "base_revision": 0},
+        {"operation_id": "seed-2", "action": "add", "item_id": "issue:r:2:", "base_revision": 0},
+    ])
+    store.apply_batch("timmy", [{
+        "operation_id": "offline-move", "action": "move", "item_id": "issue:r:2:",
+        "direction": "up", "base_revision": 2,
+    }])
+    newer = store.apply_batch("timmy", [{
+        "operation_id": "newer-move", "action": "move", "item_id": "issue:r:1:",
+        "direction": "up", "base_revision": 3,
+    }])
+
+    replay = store.apply_batch("timmy", [{
+        "operation_id": "offline-move", "action": "move", "item_id": "issue:r:2:",
+        "direction": "up", "base_revision": 2,
+    }])
+
+    assert replay["ids"] == newer["ids"] == ["issue:r:1:", "issue:r:2:"]
+    assert replay["revision"] == 4
+    assert replay["accepted_operation_ids"] == []
+    assert replay["rejected_operations"] == [
+        {"operation_id": "offline-move", "reason": "stale_intent"}
+    ]
+
+
+def test_today_receipt_age_pruning_is_account_scoped(tmp_path):
+    clock = [1_000.0]
+    path = tmp_path / "today.sqlite3"
+    store = TodayStore(
+        path, limit=5, operation_retention_seconds=60, clock=lambda: clock[0]
+    )
+    store.apply("timmy", "old", "add", "issue:r:1:")
+    store.apply("alexander", "other-old", "add", "issue:r:2:")
+    clock[0] += 61
+    store.apply("timmy", "fresh", "remove", "issue:r:1:")
+
+    with sqlite3.connect(path) as connection:
+        timmy = connection.execute(
+            "SELECT operation_id FROM today_operations WHERE login = 'timmy'"
+        ).fetchall()
+        alexander = connection.execute(
+            "SELECT operation_id FROM today_operations WHERE login = 'alexander'"
+        ).fetchall()
+
+    assert timmy == [("fresh",)]
+    assert alexander == [("other-old",)]
+
+
+def test_today_api_model_preserves_client_base_revision():
+    operation = main.TodayOperation(
+        operation_id="offline", action="move", item_id="issue:r:2:",
+        direction="up", base_revision=7,
+    )
+
+    assert operation.model_dump()["base_revision"] == 7
+
+
 @pytest.mark.anyio
 async def test_authenticated_today_api_uses_confirmed_account_and_csrf(monkeypatch, tmp_path):
     monkeypatch.setenv("STACKCHAIN_DASHBOARD_AUTH_MODE", "operator")
@@ -109,9 +229,10 @@ async def test_authenticated_today_api_uses_confirmed_account_and_csrf(monkeypat
         changed = await client.patch(
             "/api/v1/today",
             json={
-                "operation_id": "mobile-1",
-                "action": "add",
-                "item_id": "issue:stackchain/dashboard:357:",
+                "operations": [
+                    {"operation_id": "mobile-1", "action": "add", "item_id": "issue:stackchain/dashboard:357:"},
+                    {"operation_id": "mobile-2", "action": "add", "item_id": "issue:stackchain/dashboard:359:"},
+                ],
             },
             headers={
                 "Origin": "https://test",
@@ -122,8 +243,12 @@ async def test_authenticated_today_api_uses_confirmed_account_and_csrf(monkeypat
 
     assert forbidden.status_code == 403
     assert changed.status_code == 200
-    assert changed.json() == fetched.json() == {
-        "revision": 1,
-        "ids": ["issue:stackchain/dashboard:357:"],
+    assert changed.json() == {
+        "revision": 2,
+        "ids": ["issue:stackchain/dashboard:357:", "issue:stackchain/dashboard:359:"],
+        "accepted_operation_ids": ["mobile-1", "mobile-2"],
+        "duplicate_operation_ids": [],
+        "rejected_operations": [],
     }
+    assert fetched.json() == {"revision": 2, "ids": ["issue:stackchain/dashboard:357:", "issue:stackchain/dashboard:359:"]}
     assert fetched.headers["cache-control"] == "no-store"

tests/test_today_sync.py

@@ -4,6 +4,90 @@ from pathlib import Path
 
 
 TODAY_SYNC = Path(__file__).parents[1] / "frontend" / "today-sync.js"
+COORDINATOR = Path(__file__).parents[1] / "frontend" / "outbox-coordinator.js"
+
+
+def test_two_tabs_cannot_erase_each_others_today_edits_or_double_drain():
+    script = f"""
+const createTodaySync = require({json.dumps(str(TODAY_SYNC))});
+const createCoordinator = require({json.dumps(str(COORDINATOR))});
+const values = new Map();
+const storage = {{get length(){{return values.size}},key:i=>[...values.keys()][i]||null,
+ getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}};
+const channels=[]; const channelFactory=()=>{{const channel={{onmessage:null,postMessage:data=>channels.filter(x=>x!==channel).forEach(x=>x.onmessage?.({{data}})),close(){{}}}};channels.push(channel);return channel}};
+const held=new Set(); const locks={{request:async(name,_options,work)=>{{if(held.has(name))return work(null);held.add(name);try{{return await work({{name}})}}finally{{held.delete(name)}}}}}};
+let sequence=0,releaseFirst;const delivered=[];
+const make=tab=>createTodaySync({{storage,getLogin:()=> 'timmy',createOperationId:()=>tab+'-'+(++sequence),coordinator:createCoordinator({{storage,locks,channelFactory,tabId:tab}}),
+ fetchJson:async(_url,options={{}})=>{{if(!options.method)return {{revision:0,ids:[]}};const operation=JSON.parse(options.body).operations[0];delivered.push(operation.operation_id);if(delivered.length===1)await new Promise(resolve=>releaseFirst=resolve);return {{revision:delivered.length,ids:delivered}}}},onRemoteIds:()=>{{}},onStatus:()=>{{}}}});
+const first=make('first'),second=make('second');first.enqueue('add','issue:r:1:');
+(async()=>{{const draining=first.flush();while(!releaseFirst)await Promise.resolve();second.enqueue('add','issue:r:2:');const competing=second.flush();releaseFirst();await Promise.all([draining,competing]);await first.flush();process.stdout.write(JSON.stringify({{delivered,pending:first.pending(),keys:[...values.keys()]}}));}})();
+"""
+    result = json.loads(subprocess.run(["node", "-e", script], check=True, capture_output=True, text=True).stdout)
+    assert sorted(result["delivered"]) == ["first-1", "second-2"]
+    assert len(result["delivered"]) == 2
+    assert result["pending"] == []
+    assert not any(".operation." in key for key in result["keys"])
+
+
+def test_operations_enqueued_during_an_inflight_flush_are_drained_before_it_settles():
+    script = f"""
+const createTodaySync = require({json.dumps(str(TODAY_SYNC))});
+const values = new Map();
+const patches = [];
+let sequence = 0;
+let releaseFirstPatch;
+const firstPatchBlocked = new Promise(resolve => {{ globalThis.firstPatchStarted = resolve; }});
+const sync = createTodaySync({{
+  storage: {{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}},
+  getLogin: () => 'timmy', createOperationId: () => 'op-' + (++sequence),
+  fetchJson: async (_url, options={{}}) => {{
+    if (!options.method) return {{revision:0, ids:[]}};
+    const operation = JSON.parse(options.body).operations[0];
+    patches.push(operation);
+    if (patches.length === 1) {{
+      globalThis.firstPatchStarted();
+      await new Promise(resolve => {{ releaseFirstPatch = resolve; }});
+    }}
+    return {{revision:patches.length, ids:patches.map(item => item.item_id)}};
+  }},
+  onRemoteIds: ids => {{ globalThis.ids = ids; }},
+  onStatus: status => {{ globalThis.status = status; }},
+}});
+sync.enqueue('add', 'issue:r:1:');
+(async () => {{
+  const firstFlush = sync.flush();
+  await firstPatchBlocked;
+  sync.enqueue('add', 'issue:r:2:');
+  const sharedFlush = sync.flush();
+  const sharesInflight = firstFlush === sharedFlush;
+  releaseFirstPatch();
+  await sharedFlush;
+  process.stdout.write(JSON.stringify({{
+    sharesInflight, patches, pending:sync.pending(), ids:globalThis.ids, status:globalThis.status,
+  }}));
+}})();
+"""
+    result = json.loads(
+        subprocess.run(["node", "-e", script], check=True, capture_output=True, text=True).stdout
+    )
+
+    assert result == {
+        "sharesInflight": True,
+        "patches": [
+            {"operation_id": "op-1", "action": "add", "item_id": "issue:r:1:", "direction": None, "base_revision": 0},
+            {"operation_id": "op-2", "action": "add", "item_id": "issue:r:2:", "direction": None, "base_revision": 0},
+        ],
+        "pending": [],
+        "ids": ["issue:r:1:", "issue:r:2:"],
+        "status": "saved",
+    }
+
+
+def test_inflight_today_drain_ships_in_a_new_offline_shell():
+    source = (Path(__file__).parents[1] / "frontend" / "service-worker.js").read_text()
+
+    assert "stackchain-dashboard-shell-v67" in source
+    assert "BASE + 'static/today-sync.js'" in source
 
 
 def test_local_operations_replay_once_then_adopt_server_order():
@@ -24,7 +108,7 @@ const sync = createTodaySync({{
   fetchJson: async (url, options={{}}) => {{
     requests.push({{url, body: options.body && JSON.parse(options.body)}});
     if (!options.method) return remote;
-    remote = {{revision: remote.revision + 1, ids:['issue:r:9:', options.body && JSON.parse(options.body).item_id]}};
+    remote = {{revision: remote.revision + 1, ids:['issue:r:9:', JSON.parse(options.body).operations[0].item_id]}};
     return remote;
   }},
   onRemoteIds: ids => {{ globalThis.adopted = ids; }},
@@ -47,19 +131,66 @@ sync.enqueue('add', 'issue:r:2:');
     assert [request["url"] for request in result["requests"]] == [
         "api/v1/today",
         "api/v1/today",
-        "api/v1/today",
     ]
-    assert result["requests"][1]["body"] == {
+    assert result["requests"][0]["body"] == {"operations": [{
         "operation_id": "fixed-op",
         "action": "add",
         "item_id": "issue:r:2:",
         "direction": None,
-    }
+        "base_revision": 0,
+    }]}
     assert result["adopted"] == ["issue:r:9:", "issue:r:2:"]
     assert result["status"] == "saved"
     assert result["pending"] == []
 
 
+def test_today_operations_capture_server_revision_and_expire_before_replay():
+    script = f"""
+const createTodaySync = require({json.dumps(str(TODAY_SYNC))});
+const values = new Map(); const statuses=[]; const requests=[];
+const storage={{get length(){{return values.size}},key:i=>[...values.keys()][i]||null,
+ getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}};
+const sync=createTodaySync({{storage,getLogin:()=> 'timmy',createOperationId:()=> 'old-op',
+ now:()=>1_800_000_000_000,maxOfflineMs:1000,
+ fetchJson:async(_url,options={{}})=>{{requests.push(options.method||'GET');return {{revision:7,ids:['server']}}}},
+ onRemoteIds:()=>{{}},onStatus:(state,detail={{}})=>statuses.push([state,detail.count||0])}});
+(async()=>{{await sync.flush();sync.enqueue('move','issue:r:2:','up');
+const pendingBefore=sync.pending();
+const key=[...values.keys()].find(value=>value.includes('.operation.'));
+const record=JSON.parse(values.get(key));record.queued_at=1_799_999_000_000;values.set(key,JSON.stringify(record));
+await sync.flush();process.stdout.write(JSON.stringify({{pendingBefore,requests,statuses,pendingAfter:sync.pending()}}));}})();
+"""
+    result = json.loads(subprocess.run(["node", "-e", script], check=True, capture_output=True, text=True).stdout)
+
+    assert result["pendingBefore"] == [{
+        "operation_id": "old-op", "action": "move", "item_id": "issue:r:2:",
+        "direction": "up", "base_revision": 7,
+    }]
+    assert result["requests"] == ["GET", "GET"]
+    assert ["expired", 1] in result["statuses"]
+    assert result["statuses"][-1] == ["expired", 1]
+    assert result["pendingAfter"] == []
+
+
+def test_pending_today_edits_are_sent_as_one_batch_without_a_preflight_get():
+    script = f"""
+const createTodaySync = require({json.dumps(str(TODAY_SYNC))});
+const values = new Map(); const requests=[]; let sequence=0;
+const sync=createTodaySync({{
+ storage:{{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}},
+ getLogin:()=> 'timmy',createOperationId:()=> 'op-'+(++sequence),
+ fetchJson:async (_url,options={{}})=>{{const body=JSON.parse(options.body);requests.push(body);return {{revision:2,ids:['issue:r:1:','issue:r:2:'],accepted_operation_ids:body.operations.map(x=>x.operation_id),duplicate_operation_ids:[],rejected_operations:[]}}}},
+ onRemoteIds:()=>{{}},onStatus:()=>{{}},
+}});
+sync.enqueue('add','issue:r:1:');sync.enqueue('add','issue:r:2:');
+(async()=>{{await sync.flush();process.stdout.write(JSON.stringify({{requests,pending:sync.pending()}}));}})();
+"""
+    result = json.loads(subprocess.run(["node", "-e", script], check=True, capture_output=True, text=True).stdout)
+    assert len(result["requests"]) == 1
+    assert [item["operation_id"] for item in result["requests"][0]["operations"]] == ["op-1", "op-2"]
+    assert result["pending"] == []
+
+
 def test_failed_delivery_stays_pending_for_offline_replay():
     script = f"""
 const createTodaySync = require({json.dumps(str(TODAY_SYNC))});
@@ -82,6 +213,7 @@ sync.enqueue('move', 'issue:r:2:', 'up');
             "action": "move",
             "item_id": "issue:r:2:",
             "direction": "up",
+            "base_revision": 0,
         }],
         "status": "retrying",
     }
@@ -99,7 +231,7 @@ const sync = createTodaySync({{
   fetchJson:async (_url,options={{}})=>{{
     attempts += 1;
     if (attempts === 1) {{ const error = new Error('busy'); error.status=503; error.retryAfter=2; throw error; }}
-    if (options.method) patches.push(JSON.parse(options.body));
+    if (options.method) patches.push(...JSON.parse(options.body).operations);
     return options.method ? {{revision:1,ids:['issue:r:2:']}} : {{revision:0,ids:[]}};
   }},
   onRemoteIds:()=>{{}}, onStatus:(state,detail)=>statuses.push([state,detail?.delayMs||null]),
@@ -117,9 +249,9 @@ sync.enqueue('add','issue:r:2:');
     )
 
     assert result["scheduled"] == [2000]
-    assert result["attempts"] == 3
+    assert result["attempts"] == 2
     assert result["patches"] == [{
-        "operation_id": "stable-op", "action": "add", "item_id": "issue:r:2:", "direction": None,
+        "operation_id": "stable-op", "action": "add", "item_id": "issue:r:2:", "direction": None, "base_revision": 0,
     }]
     assert result["pending"] == []
     assert ["retrying", 2000] in result["statuses"]
@@ -152,6 +284,7 @@ process.stdout.write(JSON.stringify({{first, duplicate, pending:sync.pending(),
             "action": "remove",
             "item_id": "issue:r:1:",
             "direction": None,
+            "base_revision": 0,
         }],
         "statuses": ["pending", "pending"],
     }
@@ -178,8 +311,8 @@ process.stdout.write(JSON.stringify({{first, second, pending:sync.pending()}}));
         "first": True,
         "second": False,
         "pending": [
-            {"operation_id": "migration-1", "action": "add", "item_id": "issue:r:1:", "direction": None},
-            {"operation_id": "migration-2", "action": "add", "item_id": "issue:r:2:", "direction": None},
+            {"operation_id": "migration-1", "action": "add", "item_id": "issue:r:1:", "direction": None, "base_revision": 0},
+            {"operation_id": "migration-2", "action": "add", "item_id": "issue:r:2:", "direction": None, "base_revision": 0},
         ],
     }
 
@@ -193,8 +326,8 @@ const sync = createTodaySync({{
   storage: {{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}},
   getLogin: () => 'timmy', createOperationId: () => 'sixth',
   fetchJson: async (_url, options={{}}) => {{
-    if (options.method) {{ patch = true; const error = new Error('full'); error.status = 409; throw error; }}
-    return {{revision:5, ids:['1','2','3','4','5']}};
+    patch = true;
+    return {{revision:5, ids:['1','2','3','4','5'], accepted_operation_ids:[], duplicate_operation_ids:[], rejected_operations:[{{operation_id:'sixth',reason:'today_full'}}]}};
   }},
   onRemoteIds:ids=>{{globalThis.ids=ids}}, onStatus:value=>{{globalThis.status=value}},
 }});
@@ -212,6 +345,47 @@ sync.enqueue('add', '6');
     }
 
 
+def test_server_limit_conflict_drops_only_the_rejected_operation_and_drains_later_edits():
+    script = f"""
+const createTodaySync = require({json.dumps(str(TODAY_SYNC))});
+const values = new Map();
+const patches = [];
+let sequence = 0;
+const statuses = [];
+const sync = createTodaySync({{
+  storage: {{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}},
+  getLogin: () => 'timmy', createOperationId: () => 'op-' + (++sequence),
+  fetchJson: async (_url, options={{}}) => {{
+    const operations = JSON.parse(options.body).operations;
+    patches.push(...operations);
+    return {{revision:6, ids:['1','2','3','4'], accepted_operation_ids:['op-2'], duplicate_operation_ids:[], rejected_operations:[{{operation_id:'op-1',reason:'today_full'}}]}};
+  }},
+  onRemoteIds: ids => {{ globalThis.ids = ids; }},
+  onStatus: status => statuses.push(status),
+}});
+sync.enqueue('add', '6');
+sync.enqueue('remove', '5');
+(async()=>{{
+  const result = await sync.flush();
+  process.stdout.write(JSON.stringify({{result, patches, pending:sync.pending(), ids:globalThis.ids, statuses}}));
+}})();
+"""
+    result = json.loads(
+        subprocess.run(["node", "-e", script], check=True, capture_output=True, text=True).stdout
+    )
+
+    assert result == {
+        "result": False,
+        "patches": [
+            {"operation_id": "op-1", "action": "add", "item_id": "6", "direction": None, "base_revision": 0},
+            {"operation_id": "op-2", "action": "remove", "item_id": "5", "direction": None, "base_revision": 0},
+        ],
+        "pending": [],
+        "ids": ["1", "2", "3", "4"],
+        "statuses": ["pending", "pending", "full"],
+    }
+
+
 def test_tabs_ignore_an_older_response_after_a_newer_revision_is_broadcast():
     script = f"""
 const createTodaySync = require({json.dumps(str(TODAY_SYNC))});
@@ -286,7 +460,7 @@ sync.startLifecycle({{
         subprocess.run(["node", "-e", script], check=True, capture_output=True, text=True).stdout
     )
 
-    assert result == {"requests": ["GET", "PATCH"], "pending": []}
+    assert result == {"requests": ["PATCH"], "pending": []}
 
 
 def test_foregrounding_a_stale_tab_refreshes_the_saved_plan():

tests/test_today_work.py

@@ -161,7 +161,8 @@ async def test_dashboard_runs_the_curated_today_queue_as_a_mobile_work_flow():
     assert 'data-work-filter="today"' in html
     assert 'data-work-count="today"' in html
     assert "const todayWork = createTodayWork({" in html
-    assert "const filter = todayMyWork.length ? 'today' : (counts.attention ? 'attention' : 'all');" in html
+    assert "getTodayCount: () => todayMyWork.length" in html
+    assert "startToday: startTodaySession" in html
     assert "selectedWorkFilter === 'today' ? todayMyWork : activeMyWork" in html
     assert 'data-today-add' in html
     assert 'data-today-remove' in html

tests/test_views.py

@@ -2,7 +2,7 @@ from pathlib import Path
 
 import pytest
 
-from src.views import dashboard
+from src.views import FRONTEND_BUILD, dashboard
 
 
 @pytest.mark.anyio
@@ -28,7 +28,7 @@ async def test_dashboard_bootstrap_uses_csp_compatible_static_assets():
     html = await dashboard()
 
     assert '<link rel="stylesheet" href="static/dashboard.css" />' in html
-    assert '<script src="static/dashboard.js"></script>' in html
+    assert f'<script src="{FRONTEND_BUILD.runtime_name}"></script>' in html
     assert "<style>" not in html
     assert "<script>" not in html
 
@@ -42,7 +42,7 @@ async def test_global_search_preview_is_a_phone_safe_accessible_dialog():
     assert 'aria-labelledby="search-preview-title"' in html
     assert 'id="claim-search-result"' in html
     assert 'id="open-search-result-gitea"' in html
-    assert 'src="static/search-preview.js"' in html
+    assert "static/search-preview.js" in FRONTEND_BUILD.page_sources
     assert ".search-preview-panel" in css
     assert "height:100dvh" in css
     assert "env(safe-area-inset-bottom)" in css