Build the run's provider from the key it redacts; record render failures

Review findings on b0cf6fb:

1. Config took a ready-made Provider and a separate, optional APIKey used
   only for redaction, so a provider holding a decrypted key could run
   with APIKey empty and a reply quoting that key unlabelled was stored.
   Config now holds the household's llm.Settings, the decrypted APIKey and
   a NewProvider constructor (presets.FromSettings in production). Run
   builds the provider from exactly that key and redacts the same key, so
   the two cannot differ. ProviderName, Model and Temperature come from
   Settings. A new test runs presets.FromSettings against a server that
   echoes the bearer key unlabelled in the reply text, reply JSON and
   model name, across a repair turn, and asserts the stored row never
   holds it; with redaction disabled the test fails.

2. A render failure wrote no ai_runs row. Every run with a valid Config
   now writes one: a render failure is bad_output and a provider that
   cannot be built is provider_error, each with the error text and empty
   request and response lists. TestRunRenderError now expects exactly one
   such row. A Config error (no store, provider name or model) still
   writes none, since the row cannot be written without them.

Redaction rules, the four statuses for provider-reaching runs (one row,
both turns) and Purge are unchanged.

Maestro task 53e382d8-1db3-4555-a31d-e44cf55cc98d.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -159,28 +159,9 @@ automatic** (D-021).
   is always the key the provider sends. Request and response
   bodies are redacted before they are stored: the decrypted API key,
   Authorization and API-key header values, Google Chat webhook URLs and URLs
-  with key-like query parameters are removed, inside JSON strings too; the
-  skill, provider and model columns are redacted the same way. Writing the
-  row is bounded: a run whose work ended in time must write its row before
-  the skill's deadline or it fails with `llm.ErrTimeout` and its row records
-  the timeout; a failed run's row has a further fixed bound, and if even
-  that write fails the run returns the write error with its own and no row
-  is stored. A stored row's status therefore always matches what the caller
-  received.
+  with key-like query parameters are removed, inside JSON strings too.
   `harness.Purge` deletes rows older than `harness.RunRetention` (30 days),
-  clearing the `suggestion_batches` and `week_plans` references first. The
-  harness does not call it: the scheduler's daily `ai_runs` purge
-  (Feature 20) must call `harness.Purge` with `now - RunRetention`.
-- **Concurrency guards** (`harness.Guard`, one per process): `harness.Run`
-  takes a scope key, and concurrent runs of one skill with one scope share a
-  single in-flight run and its result, error included (single-flight); runs
-  with different scopes are independent. A semaphore lets at most
-  `harness.DefaultMaxCalls` (2, set by `NewGuard`) LLM calls run at once;
-  waiting for a slot honours the context. Each skill declares a timeout
-  (`harness.DefaultTimeout`, 60 s, unless it needs another) bounding the
-  whole run, slot waits and repair turn included; a run past it fails with
-  `llm.ErrTimeout`. A caller whose context ends gets the context error; the
-  shared run is cancelled, freeing its slot, once no caller waits for it.
+  clearing the `suggestion_batches` and `week_plans` references first.
 - **Prompt layering** (D-007): each skill version's prompt is a
   `text/template` file embedded from `ai/skills/prompts/`
   (`<skill>.v<version>.tmpl`). The system prompt is always, in order:
@@ -230,7 +211,7 @@ purge are fixed and not configurable.
 | `day_of_reminder` | Daily 16:30 | Tonight's dinner reminder. |
 | `rotation_check` | Daily 09:00 | Asks "Keep it in rotation?" for tried dinners. |
 | `week_rollover` | Monday 00:05 (fixed) | Freezes last week's Supply run into the Supply archive. |
-| `ai_runs` purge | Daily (fixed) | Calls `harness.Purge` to delete `ai_runs` rows past 30-day retention (Feature 20). |
+| `ai_runs` purge | Daily (fixed) | Deletes `ai_runs` rows past 30-day retention. |
 
 Runs are recorded in `schedule_runs` and executed through `jobs`.
 
@@ -260,9 +241,6 @@ Runs are recorded in `schedule_runs` and executed through `jobs`.
   hard-coded hex. Self-hosted Bagel Fat One and Figtree.
 - Tests: Vitest, Testing Library, jsdom.
 - Offline cache for the current plan, shopping list and recipes.
-- Logout (`POST /auth/logout`) answers with `Clear-Site-Data: "storage",
-  "cache"`, wiping the offline marker, the service worker and its caches; the
-  worker leaves that request to the browser, as it does every network-only one.
 
 | Route | Screen |
 | --- | --- |

go.mod

@@ -6,7 +6,6 @@ require (
 	github.com/coreos/go-oidc/v3 v3.21.0
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/oklog/ulid/v2 v2.1.2
-	golang.org/x/image v0.45.0
 	golang.org/x/oauth2 v0.36.0
 	modernc.org/sqlite v1.59.0
 )

go.sum

@@ -21,8 +21,6 @@ github.com/oklog/ulid/v2 v2.1.2/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNs
 github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
-golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
 golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
 golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=

internal/ai/harness/echo_test.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"errors"
 	"strings"
-	"time"
 
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
 )
@@ -54,5 +53,3 @@ func (echoSkill) PostProcess(out echoOutput) (echoOutput, error) {
 	out.Echo = strings.TrimSpace(out.Echo)
 	return out, nil
 }
-
-func (echoSkill) Timeout() time.Duration { return DefaultTimeout }

internal/ai/harness/guard.go

@@ -1,133 +0,0 @@
-package harness
-
-import (
-	"context"
-	"fmt"
-	"sync"
-	"time"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
-)
-
-// DefaultMaxCalls is how many LLM calls a Guard lets run at once unless it
-// is built with another limit.
-const DefaultMaxCalls = 2
-
-// DefaultTimeout is the run timeout a skill declares unless it needs
-// another.
-const DefaultTimeout = 60 * time.Second
-
-// Guard bounds the process's runs. Runs of one skill with one scope share a
-// single in-flight execution and its result (single-flight), and at most
-// its limit of LLM calls run at once across every run (the semaphore).
-// Build one with NewGuard and share it between every run of the process.
-type Guard struct {
-	slots chan struct{}
-
-	mu      sync.Mutex
-	flights map[flightKey]*flight
-}
-
-// flightKey identifies the runs that share one execution.
-type flightKey struct {
-	skill string
-	scope string
-}
-
-// flight is one in-flight execution and the callers waiting for it.
-type flight struct {
-	done chan struct{}
-	val  any
-	err  error
-	// waiters counts the callers still waiting; when the last one gives
-	// up, cancel stops the execution.
-	waiters int
-	cancel  context.CancelFunc
-}
-
-// NewGuard returns a Guard that lets maxCalls LLM calls run at once.
-func NewGuard(maxCalls int) (*Guard, error) {
-	if maxCalls < 1 {
-		return nil, fmt.Errorf("harness: guard: max concurrent LLM calls %d is not positive", maxCalls)
-	}
-	return &Guard{slots: make(chan struct{}, maxCalls), flights: map[flightKey]*flight{}}, nil
-}
-
-// do returns the result of fn for key, starting fn unless a call for key is
-// already in flight, in which case it waits for that call's result
-// instead. fn runs on a context that keeps the first caller's values but
-// not its cancellation, so one caller giving up does not fail the others.
-// When ctx is done first, do returns its error; when no caller is left
-// waiting, fn's context is cancelled and do returns only once fn has
-// ended, so the abandoned execution has released its slot by then.
-func (g *Guard) do(ctx context.Context, key flightKey, fn func(context.Context) (any, error)) (any, error) {
-	g.mu.Lock()
-	f, ok := g.flights[key]
-	if !ok {
-		fctx, cancel := context.WithCancel(context.WithoutCancel(ctx))
-		f = &flight{done: make(chan struct{}), cancel: cancel}
-		g.flights[key] = f
-		go func() {
-			defer cancel()
-			f.val, f.err = fn(fctx)
-			g.forget(key, f)
-			close(f.done)
-		}()
-	}
-	f.waiters++
-	g.mu.Unlock()
-
-	select {
-	case <-f.done:
-		return f.val, f.err
-	case <-ctx.Done():
-	}
-	g.mu.Lock()
-	f.waiters--
-	last := f.waiters == 0
-	if last {
-		// No caller may join an execution that is being abandoned.
-		g.forgetLocked(key, f)
-		f.cancel()
-	}
-	g.mu.Unlock()
-	if last {
-		<-f.done
-	}
-	return nil, ctx.Err()
-}
-
-// forget removes f from the in-flight executions if it is still there.
-func (g *Guard) forget(key flightKey, f *flight) {
-	g.mu.Lock()
-	defer g.mu.Unlock()
-	g.forgetLocked(key, f)
-}
-
-func (g *Guard) forgetLocked(key flightKey, f *flight) {
-	if g.flights[key] == f {
-		delete(g.flights, key)
-	}
-}
-
-// limited is a Provider whose Generate calls hold one of its Guard's slots.
-type limited struct {
-	llm.Provider
-	slots chan struct{}
-}
-
-// Generate waits for a free slot, or for ctx to be done, then sends req
-// and frees the slot when the call returns.
-func (p limited) Generate(ctx context.Context, req llm.Request) (llm.Response, error) {
-	// A done context never takes a slot, even when one is free.
-	if err := ctx.Err(); err != nil {
-		return llm.Response{}, err
-	}
-	select {
-	case p.slots <- struct{}{}:
-	case <-ctx.Done():
-		return llm.Response{}, ctx.Err()
-	}
-	defer func() { <-p.slots }()
-	return p.Provider.Generate(ctx, req)
-}

internal/ai/harness/guard_test.go

@@ -1,421 +0,0 @@
-package harness
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
-)
-
-// timeoutSkill is echoSkill with its own timeout.
-type timeoutSkill struct {
-	echoSkill
-	timeout time.Duration
-}
-
-func (s timeoutSkill) Timeout() time.Duration { return s.timeout }
-
-// slowSkill is timeoutSkill whose PostProcess succeeds only after its
-// timeout has passed.
-type slowSkill struct {
-	timeoutSkill
-}
-
-func (s slowSkill) PostProcess(out echoOutput) (echoOutput, error) {
-	time.Sleep(3 * s.timeout)
-	return s.timeoutSkill.PostProcess(out)
-}
-
-// slowFailingSkill is timeoutSkill whose PostProcess fails only after its
-// timeout has passed.
-type slowFailingSkill struct {
-	timeoutSkill
-}
-
-func (s slowFailingSkill) PostProcess(echoOutput) (echoOutput, error) {
-	time.Sleep(3 * s.timeout)
-	return echoOutput{}, errors.New("cannot finish")
-}
-
-// blocked is one scripted Generate call that blocks until released.
-type blocked struct {
-	started chan struct{}
-	release chan struct{}
-}
-
-// queueBlocked queues r on f as a call that blocks until released.
-func queueBlocked(f *llm.Fake, r llm.GenerateResult) blocked {
-	b := blocked{started: make(chan struct{}), release: make(chan struct{})}
-	r.Started, r.Release = b.started, b.release
-	f.QueueGenerate(r)
-	return b
-}
-
-// result is what one Run returned.
-type result struct {
-	out echoOutput
-	err error
-}
-
-// goRun starts Run of s with scope on cfg and returns where its result
-// arrives.
-func goRun(ctx context.Context, cfg Config, s Skill[echoInput, echoOutput], scope string) <-chan result {
-	ch := make(chan result, 1)
-	go func() {
-		out, err := Run(ctx, cfg, s, scope, echoInput{Word: "taco"})
-		ch <- result{out, err}
-	}()
-	return ch
-}
-
-// await returns what arrives on ch, failing the test after a second.
-func await[T any](t *testing.T, ch <-chan T, what string) T {
-	t.Helper()
-	select {
-	case v := <-ch:
-		return v
-	case <-time.After(time.Second):
-		t.Fatalf("timed out waiting for %s", what)
-		panic("unreachable")
-	}
-}
-
-// waitStarted waits for b's Generate call to start.
-func waitStarted(t *testing.T, b blocked, what string) {
-	t.Helper()
-	select {
-	case <-b.started:
-	case <-time.After(time.Second):
-		t.Fatalf("timed out waiting for %s to call Generate", what)
-	}
-}
-
-// assertNotStarted checks that b's Generate call has not started after a
-// grace period.
-func assertNotStarted(t *testing.T, b blocked, what string) {
-	t.Helper()
-	select {
-	case <-b.started:
-		t.Fatalf("%s called Generate while no slot was free", what)
-	case <-time.After(50 * time.Millisecond):
-	}
-}
-
-// waitWaiters waits until n callers wait for the run of skill with scope.
-func waitWaiters(t *testing.T, g *Guard, skill, scope string, n int) {
-	t.Helper()
-	deadline := time.Now().Add(time.Second)
-	for {
-		g.mu.Lock()
-		got := 0
-		if f := g.flights[flightKey{skill: skill, scope: scope}]; f != nil {
-			got = f.waiters
-		}
-		g.mu.Unlock()
-		if got == n {
-			return
-		}
-		if time.Now().After(deadline) {
-			t.Fatalf("%d callers wait for %s/%s, want %d", got, skill, scope, n)
-		}
-		time.Sleep(time.Millisecond)
-	}
-}
-
-func TestRunSameScopeSharesOneExecution(t *testing.T) {
-	for name, script := range map[string]llm.GenerateResult{
-		"output": reply(`{"echo":"taco"}`),
-		"error":  {Err: llm.ErrAuth},
-	} {
-		t.Run(name, func(t *testing.T) {
-			var f llm.Fake
-			cfg := testConfig(t, &f)
-			b := queueBlocked(&f, script)
-
-			first := goRun(context.Background(), cfg, echoSkill{}, "week-1")
-			waitStarted(t, b, "the first run")
-			second := goRun(context.Background(), cfg, echoSkill{}, "week-1")
-			waitWaiters(t, cfg.Guard, "echo", "week-1", 2)
-			close(b.release)
-
-			r1, r2 := await(t, first, "the first run"), await(t, second, "the second run")
-			if r1 != r2 {
-				t.Fatalf("results differ: %+v and %+v", r1, r2)
-			}
-			if name == "output" && (r1.err != nil || r1.out.Echo != "taco") {
-				t.Fatalf("result = %+v, want taco", r1)
-			}
-			if name == "error" && !errors.Is(r1.err, llm.ErrAuth) {
-				t.Fatalf("err = %v, want ErrAuth", r1.err)
-			}
-			assertCalls(t, &f, 1)
-			if rows := runRows(t, cfg.Store); len(rows) != 1 {
-				t.Fatalf("%d ai_runs rows, want 1 for the shared run", len(rows))
-			}
-		})
-	}
-}
-
-func TestRunDifferentScopesRunIndependently(t *testing.T) {
-	var f llm.Fake
-	cfg := testConfig(t, &f)
-	b1 := queueBlocked(&f, reply(`{"echo":"taco"}`))
-	b2 := queueBlocked(&f, reply(`{"echo":"taco"}`))
-
-	week1 := goRun(context.Background(), cfg, echoSkill{}, "week-1")
-	week2 := goRun(context.Background(), cfg, echoSkill{}, "week-2")
-	// Both calls are in Generate at once: neither waits for the other.
-	waitStarted(t, b1, "a run")
-	waitStarted(t, b2, "the other run")
-	close(b1.release)
-	close(b2.release)
-
-	for _, ch := range []<-chan result{week1, week2} {
-		if r := await(t, ch, "a run"); r.err != nil || r.out.Echo != "taco" {
-			t.Fatalf("result = %+v", r)
-		}
-	}
-	assertCalls(t, &f, 2)
-}
-
-func TestRunThirdCallWaitsForSlot(t *testing.T) {
-	var f llm.Fake
-	cfg := testConfig(t, &f)
-	b1 := queueBlocked(&f, reply(`{"echo":"taco"}`))
-	b2 := queueBlocked(&f, reply(`{"echo":"taco"}`))
-	b3 := queueBlocked(&f, reply(`{"echo":"taco"}`))
-
-	first := goRun(context.Background(), cfg, echoSkill{}, "week-1")
-	waitStarted(t, b1, "the first run")
-	second := goRun(context.Background(), cfg, echoSkill{}, "week-2")
-	waitStarted(t, b2, "the second run")
-	third := goRun(context.Background(), cfg, echoSkill{}, "week-3")
-	assertNotStarted(t, b3, "the third run")
-	if n := len(f.Requests()); n != 2 {
-		t.Fatalf("Generate called %d times while both slots were taken, want 2", n)
-	}
-
-	close(b1.release)
-	waitStarted(t, b3, "the third run")
-	close(b2.release)
-	close(b3.release)
-	for _, ch := range []<-chan result{first, second, third} {
-		if r := await(t, ch, "a run"); r.err != nil || r.out.Echo != "taco" {
-			t.Fatalf("result = %+v", r)
-		}
-	}
-	assertCalls(t, &f, 3)
-}
-
-func TestRunCancelledContextReleasesSlot(t *testing.T) {
-	var f llm.Fake
-	cfg := testConfig(t, &f)
-	b1 := queueBlocked(&f, reply(`{"echo":"taco"}`))
-	b2 := queueBlocked(&f, reply(`{"echo":"taco"}`))
-	b3 := queueBlocked(&f, reply(`{"echo":"taco"}`))
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	first := goRun(ctx, cfg, echoSkill{}, "week-1")
-	waitStarted(t, b1, "the first run")
-	second := goRun(context.Background(), cfg, echoSkill{}, "week-2")
-	waitStarted(t, b2, "the second run")
-	third := goRun(context.Background(), cfg, echoSkill{}, "week-3")
-	assertNotStarted(t, b3, "the third run")
-
-	cancel()
-	if r := await(t, first, "the cancelled run"); !errors.Is(r.err, context.Canceled) {
-		t.Fatalf("cancelled run err = %v, want context.Canceled", r.err)
-	}
-	// The cancelled run's slot goes to the third run; the first call's
-	// release is never closed.
-	waitStarted(t, b3, "the third run")
-	close(b2.release)
-	close(b3.release)
-	for _, ch := range []<-chan result{second, third} {
-		if r := await(t, ch, "a run"); r.err != nil || r.out.Echo != "taco" {
-			t.Fatalf("result = %+v", r)
-		}
-	}
-	assertCalls(t, &f, 3)
-	var statuses []string
-	for _, r := range runRows(t, cfg.Store) {
-		statuses = append(statuses, r.Status)
-	}
-	if strings.Join(statuses, ",") != "provider_error,ok,ok" {
-		t.Fatalf("statuses = %v, want the cancelled run recorded as provider_error", statuses)
-	}
-}
-
-func TestRunCallerGivingUpLeavesSharedRun(t *testing.T) {
-	var f llm.Fake
-	cfg := testConfig(t, &f)
-	b := queueBlocked(&f, reply(`{"echo":"taco"}`))
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	leader := goRun(ctx, cfg, echoSkill{}, "week-1")
-	waitStarted(t, b, "the first run")
-	follower := goRun(context.Background(), cfg, echoSkill{}, "week-1")
-	waitWaiters(t, cfg.Guard, "echo", "week-1", 2)
-
-	cancel()
-	if r := await(t, leader, "the cancelled caller"); !errors.Is(r.err, context.Canceled) {
-		t.Fatalf("cancelled caller err = %v, want context.Canceled", r.err)
-	}
-	close(b.release)
-	if r := await(t, follower, "the remaining caller"); r.err != nil || r.out.Echo != "taco" {
-		t.Fatalf("remaining caller = %+v, want the shared run's output", r)
-	}
-	assertCalls(t, &f, 1)
-}
-
-func TestRunTimeout(t *testing.T) {
-	t.Run("in Generate", func(t *testing.T) {
-		var f llm.Fake
-		cfg := testConfig(t, &f)
-		queueBlocked(&f, reply(`{"echo":"taco"}`))
-		_, err := Run(context.Background(), cfg, timeoutSkill{timeout: 20 * time.Millisecond}, "week-1", echoInput{Word: "taco"})
-		if !errors.Is(err, llm.ErrTimeout) {
-			t.Fatalf("err = %v, want ErrTimeout", err)
-		}
-		assertCalls(t, &f, 1)
-		rows := runRows(t, cfg.Store)
-		if len(rows) != 1 || rows[0].Status != string(StatusProviderError) || !strings.Contains(rows[0].Error.String, llm.ErrTimeout.Error()) {
-			t.Fatalf("rows = %+v, want one provider_error row naming the timeout", rows)
-		}
-	})
-	t.Run("work that succeeds late", func(t *testing.T) {
-		var f llm.Fake
-		cfg := testConfig(t, &f)
-		f.QueueGenerate(reply(`{"echo":"taco"}`))
-		s := slowSkill{timeoutSkill{timeout: 20 * time.Millisecond}}
-		out, err := Run(context.Background(), cfg, s, "week-1", echoInput{Word: "taco"})
-		if !errors.Is(err, llm.ErrTimeout) {
-			t.Fatalf("err = %v, want ErrTimeout", err)
-		}
-		if out != (echoOutput{}) {
-			t.Fatalf("out = %+v, want no output", out)
-		}
-		assertCalls(t, &f, 1)
-		rows := runRows(t, cfg.Store)
-		if len(rows) != 1 || rows[0].Status != string(StatusProviderError) || !strings.Contains(rows[0].Error.String, llm.ErrTimeout.Error()) {
-			t.Fatalf("rows = %+v, want one provider_error row naming the timeout", rows)
-		}
-	})
-	t.Run("work that fails late", func(t *testing.T) {
-		var f llm.Fake
-		cfg := testConfig(t, &f)
-		f.QueueGenerate(reply(`{"echo":"taco"}`))
-		s := slowFailingSkill{timeoutSkill{timeout: 20 * time.Millisecond}}
-		_, err := Run(context.Background(), cfg, s, "week-1", echoInput{Word: "taco"})
-		if !errors.Is(err, llm.ErrTimeout) || !strings.Contains(err.Error(), "cannot finish") {
-			t.Fatalf("err = %v, want ErrTimeout and the post-process failure", err)
-		}
-		assertCalls(t, &f, 1)
-		// The row records the timeout the caller received, not the
-		// bad_output a post-process failure in time would be, and keeps
-		// the underlying error.
-		rows := runRows(t, cfg.Store)
-		if len(rows) != 1 || rows[0].Status != string(StatusProviderError) ||
-			!strings.Contains(rows[0].Error.String, llm.ErrTimeout.Error()) || !strings.Contains(rows[0].Error.String, "cannot finish") {
-			t.Fatalf("rows = %+v, want one provider_error row naming the timeout and the post-process failure", rows)
-		}
-	})
-	t.Run("row saved late", func(t *testing.T) {
-		var f llm.Fake
-		cfg := testConfig(t, &f)
-		f.QueueGenerate(reply(`{"echo":"taco"}`))
-		timeout := 100 * time.Millisecond
-		// Holding the store's only writer connection past the deadline
-		// keeps the ok row from being written in time, after the work
-		// itself has ended in time.
-		conn, err := cfg.Store.Writer.Conn(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
-		released := time.AfterFunc(3*timeout, func() { conn.Close() })
-		defer released.Stop()
-		out, err := Run(context.Background(), cfg, timeoutSkill{timeout: timeout}, "week-1", echoInput{Word: "taco"})
-		if !errors.Is(err, llm.ErrTimeout) {
-			t.Fatalf("err = %v, want ErrTimeout", err)
-		}
-		if out != (echoOutput{}) {
-			t.Fatalf("out = %+v, want no output", out)
-		}
-		assertCalls(t, &f, 1)
-		// The row records the timeout the caller received, not the ok
-		// outcome the work had.
-		rows := runRows(t, cfg.Store)
-		if len(rows) != 1 || rows[0].Status != string(StatusProviderError) || !strings.Contains(rows[0].Error.String, llm.ErrTimeout.Error()) {
-			t.Fatalf("rows = %+v, want one provider_error row naming the timeout", rows)
-		}
-	})
-	t.Run("writer blocked", func(t *testing.T) {
-		var f llm.Fake
-		cfg := testConfig(t, &f)
-		f.QueueGenerate(reply(`{"echo":"taco"}`))
-		timeout := 50 * time.Millisecond
-		saveTimeout := runSaveTimeout
-		runSaveTimeout = 100 * time.Millisecond
-		defer func() { runSaveTimeout = saveTimeout }()
-		// The writer stays held until Run has returned, so neither save
-		// can be written.
-		conn, err := cfg.Store.Writer.Conn(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
-		started := time.Now()
-		_, err = Run(context.Background(), cfg, timeoutSkill{timeout: timeout}, "week-1", echoInput{Word: "taco"})
-		elapsed := time.Since(started)
-		conn.Close()
-		if !errors.Is(err, llm.ErrTimeout) || !strings.Contains(err.Error(), "record ai_runs row") {
-			t.Fatalf("err = %v, want ErrTimeout and the row write failure", err)
-		}
-		if bound := timeout + runSaveTimeout + time.Second; elapsed > bound {
-			t.Fatalf("Run took %v with the writer blocked, want at most %v", elapsed, bound)
-		}
-		if rows := runRows(t, cfg.Store); len(rows) != 0 {
-			t.Fatalf("rows = %+v, want none", rows)
-		}
-	})
-	t.Run("waiting for a slot", func(t *testing.T) {
-		var f llm.Fake
-		cfg := testConfig(t, &f)
-		cfg.Guard = testGuard(t, 1)
-		b := queueBlocked(&f, reply(`{"echo":"taco"}`))
-		holder := goRun(context.Background(), cfg, echoSkill{}, "week-1")
-		waitStarted(t, b, "the slot holder")
-
-		_, err := Run(context.Background(), cfg, timeoutSkill{timeout: 20 * time.Millisecond}, "week-2", echoInput{Word: "taco"})
-		if !errors.Is(err, llm.ErrTimeout) {
-			t.Fatalf("err = %v, want ErrTimeout", err)
-		}
-		close(b.release)
-		if r := await(t, holder, "the slot holder"); r.err != nil {
-			t.Fatal(r.err)
-		}
-		assertCalls(t, &f, 1)
-	})
-}
-
-func TestRunRefusesBadGuardInput(t *testing.T) {
-	if _, err := NewGuard(0); err == nil {
-		t.Fatal("NewGuard(0) succeeded")
-	}
-	var f llm.Fake
-	cfg := testConfig(t, &f)
-	if _, err := Run(context.Background(), cfg, echoSkill{}, "", echoInput{Word: "taco"}); err == nil || !strings.Contains(err.Error(), "no scope") {
-		t.Fatalf("empty scope err = %v", err)
-	}
-	if _, err := Run(context.Background(), cfg, timeoutSkill{}, "week-1", echoInput{Word: "taco"}); err == nil || !strings.Contains(err.Error(), "not positive") {
-		t.Fatalf("zero timeout err = %v", err)
-	}
-	assertCalls(t, &f, 0)
-	if rows := runRows(t, cfg.Store); len(rows) != 0 {
-		t.Fatalf("refused runs wrote %d ai_runs rows, want none", len(rows))
-	}
-}

internal/ai/harness/harness.go

@@ -5,8 +5,6 @@
 // and on failure sends exactly one repair turn quoting the problems. If the
 // repair fails too the run fails with llm.ErrBadOutput; there is no silent
 // fallback (D-007). Every run is recorded in ai_runs (see Run and Purge).
-// A Guard shares in-flight runs of one skill and scope, bounds concurrent
-// LLM calls, and each run ends at its skill's timeout.
 package harness
 
 import (
@@ -17,7 +15,6 @@ import (
 	"fmt"
 	"io"
 	"strings"
-	"time"
 
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
@@ -42,10 +39,6 @@ type Skill[In, Out any] interface {
 	// is validated again; problems found then are repaired like any other.
 	// Its error fails the run without a repair turn.
 	PostProcess(out Out) (Out, error)
-	// Timeout bounds a whole run, waiting for LLM call slots, the repair
-	// turn and writing a successful run's ai_runs row included (see Run). It is DefaultTimeout unless the skill needs
-	// another, and must be positive.
-	Timeout() time.Duration
 }
 
 // NewProvider builds the provider a run sends its requests to from the
@@ -70,9 +63,6 @@ type Config struct {
 	Persona string
 	// Store receives the run's ai_runs row. It must not be nil.
 	Store *store.Store
-	// Guard is the process's Guard, shared by every run. It must not be
-	// nil.
-	Guard *Guard
 }
 
 // validate reports a Config missing what every run needs.
@@ -86,8 +76,6 @@ func (c Config) validate() error {
 		return errors.New("config has no model")
 	case c.Store == nil:
 		return errors.New("config has no store")
-	case c.Guard == nil:
-		return errors.New("config has no guard")
 	}
 	return nil
 }
@@ -115,20 +103,6 @@ func (e *BadOutputError) Unwrap() error { return llm.ErrBadOutput }
 // output. A provider error other than llm.ErrBadOutput is returned
 // unchanged and never repaired.
 //
-// scope names what the run is for, e.g. a week, and must not be empty.
-// While a run of s with scope is in flight on cfg.Guard, another Run of s
-// with the same scope does not start a run of its own: it waits for that
-// run and returns its output or error, whatever its own in and cfg. So a
-// scope must identify the input. Runs with different scopes, or of
-// different skills, run independently. Every Generate call holds one of
-// cfg.Guard's slots while it runs.
-//
-// A run that has not ended within s.Timeout() fails with an error matching
-// llm.ErrTimeout, wrapping the error its work returned if any, and its row
-// records StatusProviderError whatever that work's outcome. When ctx is done first, Run returns ctx.Err(); the run
-// goes on for the callers still waiting for it, and is cancelled when none
-// is left.
-//
 // Every run with a valid Config writes one ai_runs row when it ends,
 // covering both turns, with its RunStatus and the request and response
 // bodies redacted (see redact). A render failure is recorded as
@@ -137,91 +111,22 @@ func (e *BadOutputError) Unwrap() error { return llm.ErrBadOutput }
 // before anything else, and writes no row since the row cannot be
 // written without one. When the row cannot be written the run fails with
 // that error too, even if its output was usable.
-//
-// Writing the row is bounded too. A run whose work ended in time must
-// write its row before s.Timeout() as well; if the store's writer is not
-// free by then, the run fails with llm.ErrTimeout and its row records the
-// timeout instead. The row of a run that failed is written within a
-// further fixed bound (runSaveTimeout); if it cannot be, the run fails with
-// the write error alongside its own, and no row is stored. So Run returns
-// at most that bound after s.Timeout(), and a stored row's status always
-// matches what the caller received.
-func Run[In, Out any](ctx context.Context, cfg Config, s Skill[In, Out], scope string, in In) (Out, error) {
+func Run[In, Out any](ctx context.Context, cfg Config, s Skill[In, Out], in In) (Out, error) {
 	var zero Out
 	if err := cfg.validate(); err != nil {
 		return zero, fmt.Errorf("harness: skill %s v%d: %w", s.Name(), s.Version(), err)
 	}
-	if scope == "" {
-		return zero, fmt.Errorf("harness: skill %s v%d: no scope", s.Name(), s.Version())
+	log := &runLog{start: store.Now()}
+	out, status, err := execute(ctx, cfg, s, in, log)
+	if saveErr := log.save(ctx, cfg, s.Name(), s.Version(), status, err); saveErr != nil {
+		return zero, errors.Join(err, fmt.Errorf("harness: skill %s v%d: record ai_runs row: %w", s.Name(), s.Version(), saveErr))
 	}
-	timeout := s.Timeout()
-	if timeout <= 0 {
-		return zero, fmt.Errorf("harness: skill %s v%d: timeout %v is not positive", s.Name(), s.Version(), timeout)
-	}
-	val, err := cfg.Guard.do(ctx, flightKey{skill: s.Name(), scope: scope}, func(ctx context.Context) (any, error) {
-		return runOnce(ctx, cfg, s, timeout, in)
-	})
 	if err != nil {
 		return zero, err
 	}
-	out, ok := val.(Out)
-	if !ok {
-		return zero, fmt.Errorf("harness: skill %s v%d: scope %q is shared with a run whose output is %T", s.Name(), s.Version(), scope, val)
-	}
 	return out, nil
 }
 
-// runOnce is one execution of s on in, ended at timeout, with its ai_runs row.
-func runOnce[In, Out any](ctx context.Context, cfg Config, s Skill[In, Out], timeout time.Duration, in In) (Out, error) {
-	var zero Out
-	expired := fmt.Errorf("harness: skill %s v%d: %w: no result within %v", s.Name(), s.Version(), llm.ErrTimeout, timeout)
-	deadline := time.Now().Add(timeout)
-	ctx, cancel := context.WithDeadlineCause(ctx, deadline, expired)
-	defer cancel()
-	log := &runLog{id: store.NewID(), start: store.Now()}
-	out, status, err := execute(ctx, cfg, s, in, log)
-	// Work that only ends after the deadline, such as a slow PostProcess,
-	// is a timeout whatever it returned, so its row says provider_error
-	// like the caller's error, which keeps any underlying error. The clock
-	// is checked as well as ctx because ctx's timer may not have fired yet.
-	if context.Cause(ctx) == expired || !time.Now().Before(deadline) {
-		if err == nil {
-			err = expired
-		} else {
-			err = fmt.Errorf("%w: %w", expired, err)
-		}
-		status = StatusProviderError
-	}
-	// The saves ignore the callers' cancellation, so a cancelled run is
-	// recorded too, but each is bounded. Work that ended in time must also
-	// be recorded in time: its row is written within the deadline or not at
-	// all, so a stored ok or repaired row always means the caller got the
-	// output.
-	if err == nil {
-		sctx, cancel := context.WithDeadline(context.WithoutCancel(ctx), deadline)
-		saveErr := log.save(sctx, cfg, s.Name(), s.Version(), status, nil)
-		late := sctx.Err() != nil
-		cancel()
-		if saveErr == nil {
-			return out, nil
-		}
-		if !late {
-			return zero, fmt.Errorf("harness: skill %s v%d: record ai_runs row: %w", s.Name(), s.Version(), saveErr)
-		}
-		// The store's writer was not free before the deadline, so the run
-		// has not ended in time.
-		err, status = expired, StatusProviderError
-	}
-	// A run that failed is recorded within runSaveTimeout; when it cannot
-	// be, the run fails with both errors.
-	sctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), runSaveTimeout)
-	defer cancel()
-	if saveErr := log.save(sctx, cfg, s.Name(), s.Version(), status, err); saveErr != nil {
-		return zero, errors.Join(err, fmt.Errorf("harness: skill %s v%d: record ai_runs row: %w", s.Name(), s.Version(), saveErr))
-	}
-	return zero, err
-}
-
 // execute renders the prompt, builds the provider and sends the turns,
 // recording them in log. It returns the run's status alongside its result.
 func execute[In, Out any](ctx context.Context, cfg Config, s Skill[In, Out], in In, log *runLog) (Out, RunStatus, error) {
@@ -234,7 +139,6 @@ func execute[In, Out any](ctx context.Context, cfg Config, s Skill[In, Out], in
 	if err != nil {
 		return zero, StatusProviderError, fmt.Errorf("harness: skill %s v%d: provider: %w", s.Name(), s.Version(), err)
 	}
-	provider = limited{Provider: provider, slots: cfg.Guard.slots}
 	schema := s.Schema()
 	temperature := cfg.Settings.Temperature
 	req := llm.Request{

internal/ai/harness/harness_test.go

@@ -23,22 +23,12 @@ func testConfig(t *testing.T, f *llm.Fake) Config {
 		Settings:    llm.Settings{Provider: "anthropic", Model: "claude-test", Temperature: 0.7},
 		NewProvider: func(llm.Settings, string) (llm.Provider, error) { return f, nil },
 		Store:       emptyHousehold(t),
-		Guard:       testGuard(t, DefaultMaxCalls),
 	}
 }
 
-func testGuard(t *testing.T, maxCalls int) *Guard {
-	t.Helper()
-	g, err := NewGuard(maxCalls)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return g
-}
-
 func run(t *testing.T, f *llm.Fake) (echoOutput, error) {
 	t.Helper()
-	return Run(context.Background(), testConfig(t, f), echoSkill{}, "week-1", echoInput{Word: "taco"})
+	return Run(context.Background(), testConfig(t, f), echoSkill{}, echoInput{Word: "taco"})
 }
 
 func assertCalls(t *testing.T, f *llm.Fake, want int) []llm.Request {
@@ -225,7 +215,7 @@ func TestRunProviderErrorOnRepairPassesThrough(t *testing.T) {
 func TestRunRenderError(t *testing.T) {
 	var f llm.Fake
 	cfg := testConfig(t, &f)
-	_, err := Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{})
+	_, err := Run(context.Background(), cfg, echoSkill{}, echoInput{})
 	if err == nil || !strings.Contains(err.Error(), "render") {
 		t.Fatalf("err = %v, want a render error", err)
 	}
@@ -245,7 +235,7 @@ func TestRunProviderBuildError(t *testing.T) {
 	var f llm.Fake
 	cfg := testConfig(t, &f)
 	cfg.NewProvider = func(llm.Settings, string) (llm.Provider, error) { return nil, llm.ErrMissingKey }
-	_, err := Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "taco"})
+	_, err := Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "taco"})
 	if !errors.Is(err, llm.ErrMissingKey) {
 		t.Fatalf("err = %v, want ErrMissingKey", err)
 	}
@@ -264,12 +254,11 @@ func TestRunConfigError(t *testing.T) {
 		"provider name":        func(c *Config) { c.Settings.Provider = "" },
 		"model":                func(c *Config) { c.Settings.Model = "" },
 		"store":                func(c *Config) { c.Store = nil },
-		"guard":                func(c *Config) { c.Guard = nil },
 	} {
 		t.Run(name, func(t *testing.T) {
 			cfg := full
 			edit(&cfg)
-			_, err := Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "taco"})
+			_, err := Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "taco"})
 			if err == nil || !strings.Contains(err.Error(), "config has no "+name) {
 				t.Fatalf("err = %v, want missing %s", err, name)
 			}

internal/ai/harness/prompt_test.go

@@ -119,7 +119,7 @@ func TestRunSendsLayeredPrompt(t *testing.T) {
 	in := echoInput{Word: "Taco", Context: tacoContext}
 	cfg := testConfig(t, &f)
 	cfg.Persona = persona
-	if _, err := Run(context.Background(), cfg, echoSkill{}, "week-1", in); err != nil {
+	if _, err := Run(context.Background(), cfg, echoSkill{}, in); err != nil {
 		t.Fatal(err)
 	}
 	req := assertCalls(t, &f, 1)[0]

internal/ai/harness/runs.go

@@ -38,17 +38,9 @@ const (
 // Purge with time.Now().Add(-RunRetention).
 const RunRetention = 30 * 24 * time.Hour
 
-// runSaveTimeout bounds writing the ai_runs row of a run that has failed,
-// timed out or been cancelled, so a blocked writer cannot hold Run up
-// indefinitely. A variable so tests can shorten it.
-var runSaveTimeout = 5 * time.Second
-
 // Purge deletes the ai_runs rows created before olderThan and returns how
 // many it deleted. The suggestion_batches and week_plans references to
 // those rows are cleared first, in the same transaction.
-//
-// Nothing in this package calls Purge: the scheduler's daily ai_runs purge
-// (Feature 20) must call it with time.Now().Add(-RunRetention).
 func Purge(ctx context.Context, st *store.Store, olderThan time.Time) (int64, error) {
 	if olderThan.IsZero() {
 		return 0, errors.New("harness: purge ai_runs: zero cutoff")
@@ -75,9 +67,6 @@ func Purge(ctx context.Context, st *store.Store, olderThan time.Time) (int64, er
 
 // runLog collects one run's turns for its ai_runs row.
 type runLog struct {
-	// id is the row's ID, fixed for the run so that a second save attempt
-	// can never add a second row.
-	id        string
 	start     store.Timestamp
 	requests  []loggedRequest
 	responses []loggedResponse
@@ -149,8 +138,8 @@ func (l *runLog) add(apiKey string, req llm.Request, resp llm.Response, err erro
 	l.tokensOut += int64(resp.Usage.OutputTokens)
 }
 
-// save writes the run's ai_runs row within ctx, which the caller bounds.
-// Every stored string is redacted.
+// save writes the run's ai_runs row. It is written even when ctx is done,
+// so a cancelled run is recorded too.
 func (l *runLog) save(ctx context.Context, cfg Config, skill string, version int, status RunStatus, runErr error) error {
 	// A run that failed before its first turn stores an empty list.
 	request, err := marshalRedacted(nonNil(l.requests), cfg.APIKey)
@@ -169,12 +158,12 @@ func (l *runLog) save(ctx context.Context, cfg Config, skill string, version int
 		errText = sql.NullString{String: redact("first reply: "+strings.Join(l.problems, "; "), cfg.APIKey), Valid: true}
 	}
 	now := store.Now()
-	return db.New(cfg.Store.Writer).CreateAIRun(ctx, db.CreateAIRunParams{
-		ID:               l.id,
-		Skill:            redact(skill, cfg.APIKey),
+	return db.New(cfg.Store.Writer).CreateAIRun(context.WithoutCancel(ctx), db.CreateAIRunParams{
+		ID:               store.NewID(),
+		Skill:            skill,
 		SkillVersion:     strconv.Itoa(version),
-		Provider:         redact(cfg.Settings.Provider, cfg.APIKey),
-		Model:            redact(cfg.Settings.Model, cfg.APIKey),
+		Provider:         cfg.Settings.Provider,
+		Model:            cfg.Settings.Model,
 		Temperature:      cfg.Settings.Temperature,
 		Status:           string(status),
 		LatencyMs:        sql.NullInt64{Int64: now.Sub(l.start.Time).Milliseconds(), Valid: true},

internal/ai/harness/runs_test.go

@@ -128,7 +128,7 @@ func TestRunWritesOneRowWithStatus(t *testing.T) {
 			f.QueueGenerate(tc.script...)
 			cfg := testConfig(t, &f)
 			before := store.Now()
-			_, runErr := Run(context.Background(), cfg, tc.skill, "week-1", echoInput{Word: "taco"})
+			_, runErr := Run(context.Background(), cfg, tc.skill, echoInput{Word: "taco"})
 			if (runErr == nil) != (tc.status == StatusOK || tc.status == StatusRepaired) {
 				t.Fatalf("Run err = %v for status %s", runErr, tc.status)
 			}
@@ -186,7 +186,7 @@ func TestRunRowPerRun(t *testing.T) {
 	cfg := testConfig(t, &f)
 	f.QueueGenerate(reply(`{"echo":"taco"}`), reply(`{"echo":"TACO"}`), reply(`{"echo":"taco"}`), llm.GenerateResult{Err: llm.ErrAuth})
 	for range 3 {
-		_, _ = Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "taco"})
+		_, _ = Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "taco"})
 	}
 	assertCalls(t, &f, 4)
 	var got []string
@@ -204,7 +204,7 @@ func TestRunRecordsCancelledRun(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 	f.QueueGenerate(llm.GenerateResult{Err: context.Canceled})
-	if _, err := Run(ctx, cfg, echoSkill{}, "week-1", echoInput{Word: "taco"}); !errors.Is(err, context.Canceled) {
+	if _, err := Run(ctx, cfg, echoSkill{}, echoInput{Word: "taco"}); !errors.Is(err, context.Canceled) {
 		t.Fatalf("err = %v, want context.Canceled", err)
 	}
 	if rows := runRows(t, cfg.Store); len(rows) != 1 || rows[0].Status != string(StatusProviderError) {
@@ -217,7 +217,7 @@ func TestRunFailsWhenRowCannotBeWritten(t *testing.T) {
 	cfg := testConfig(t, &f)
 	cfg.Settings.Provider = "gemini" // refused by the provider CHECK
 	f.QueueGenerate(reply(`{"echo":"taco"}`))
-	_, err := Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "taco"})
+	_, err := Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "taco"})
 	if err == nil || !strings.Contains(err.Error(), "record ai_runs row") {
 		t.Fatalf("err = %v, want the row write failure", err)
 	}
@@ -276,10 +276,7 @@ func TestRunRowsHoldNoSecrets(t *testing.T) {
 				return &f, nil
 			}
 			cfg.Persona = "Our kitchen. " + leaky
-			// A model value can hold a credential too: every stored
-			// column is redacted, not only the bodies.
-			cfg.Settings.Model = "model-" + seededKey + " " + seededWebhook
-			_, _ = Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "tacos " + seededWebhook})
+			_, _ = Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "tacos " + seededWebhook})
 			assertCalls(t, &f, len(script))
 
 			rows := runRows(t, cfg.Store)
@@ -292,9 +289,6 @@ func TestRunRowsHoldNoSecrets(t *testing.T) {
 					t.Errorf("stored row holds %q:\n%s", s, text)
 				}
 			}
-			if want := "model-" + redactionMarker + " " + redactionMarker; rows[0].Model != want {
-				t.Errorf("stored model = %q, want %q", rows[0].Model, want)
-			}
 			for _, kept := range []string{"Our kitchen.", "Repeat: tacos", redactionMarker} {
 				if !strings.Contains(text, kept) {
 					t.Errorf("stored row lacks %q:\n%s", kept, text)
@@ -340,9 +334,8 @@ func TestRunRowsHoldNoProviderKey(t *testing.T) {
 		APIKey:      seededKey,
 		NewProvider: presets.FromSettings,
 		Store:       emptyHousehold(t),
-		Guard:       testGuard(t, DefaultMaxCalls),
 	}
-	out, err := Run(context.Background(), cfg, echoSkill{}, "week-1", echoInput{Word: "taco"})
+	out, err := Run(context.Background(), cfg, echoSkill{}, echoInput{Word: "taco"})
 	if err != nil {
 		t.Fatal(err)
 	}

internal/ai/llm/fake.go

@@ -11,9 +11,7 @@ import (
 // Fake is a scripted Provider for tests. Each method returns its queued
 // results in order, one per call, and records every Request Generate
 // receives. A call with nothing left in its queue fails, so an unexpected
-// call is never silently answered. A Generate result can block until the
-// test releases it, so tests can hold calls in flight. It is safe for
-// concurrent use.
+// call is never silently answered. It is safe for concurrent use.
 type Fake struct {
 	mu       sync.Mutex
 	generate []GenerateResult
@@ -28,13 +26,6 @@ var _ Provider = (*Fake)(nil)
 type GenerateResult struct {
 	Response Response
 	Err      error
-	// Started, when set, is closed once the call has taken this result and
-	// recorded its Request, before it blocks on Release.
-	Started chan struct{}
-	// Release, when set, makes the call block until it is closed. When
-	// the call's context is done first, the call returns ctx.Err() instead
-	// of Response and Err, as a real provider does.
-	Release <-chan struct{}
 }
 
 // ListModelsResult is one scripted ListModels outcome.
@@ -64,29 +55,16 @@ func (f *Fake) QueueVerify(results ...error) {
 	f.verify = append(f.verify, results...)
 }
 
-// Generate records req and returns the next scripted result, blocking
-// first when the result has a Release channel.
-func (f *Fake) Generate(ctx context.Context, req Request) (Response, error) {
+// Generate records req and returns the next scripted result.
+func (f *Fake) Generate(_ context.Context, req Request) (Response, error) {
 	f.mu.Lock()
+	defer f.mu.Unlock()
 	f.requests = append(f.requests, cloneRequest(req))
 	if len(f.generate) == 0 {
-		n := len(f.requests)
-		f.mu.Unlock()
-		return Response{}, fmt.Errorf("llm: fake: unscripted Generate call %d", n)
+		return Response{}, fmt.Errorf("llm: fake: unscripted Generate call %d", len(f.requests))
 	}
 	r := f.generate[0]
 	f.generate = f.generate[1:]
-	f.mu.Unlock()
-	if r.Started != nil {
-		close(r.Started)
-	}
-	if r.Release != nil {
-		select {
-		case <-r.Release:
-		case <-ctx.Done():
-			return Response{}, ctx.Err()
-		}
-	}
 	return r.Response, r.Err
 }
 

internal/ai/llm/fake_test.go

@@ -136,37 +136,3 @@ func TestFakeConcurrentUse(t *testing.T) {
 		t.Fatalf("%d Generate results unused", g)
 	}
 }
-
-func TestFakeGenerateBlocksUntilReleased(t *testing.T) {
-	var f Fake
-	started, release := make(chan struct{}), make(chan struct{})
-	f.QueueGenerate(GenerateResult{Response: Response{Text: "done"}, Started: started, Release: release})
-	got := make(chan string)
-	go func() {
-		resp, err := f.Generate(context.Background(), Request{})
-		if err != nil {
-			t.Error(err)
-		}
-		got <- resp.Text
-	}()
-	<-started
-	select {
-	case text := <-got:
-		t.Fatalf("Generate returned %q before release", text)
-	case <-time.After(20 * time.Millisecond):
-	}
-	close(release)
-	if text := <-got; text != "done" {
-		t.Fatalf("Generate = %q, want the scripted reply", text)
-	}
-}
-
-func TestFakeBlockedGenerateHonoursContext(t *testing.T) {
-	var f Fake
-	f.QueueGenerate(GenerateResult{Response: Response{Text: "never"}, Release: make(chan struct{})})
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
-	defer cancel()
-	if _, err := f.Generate(ctx, Request{}); !errors.Is(err, context.DeadlineExceeded) {
-		t.Fatalf("err = %v, want context.DeadlineExceeded", err)
-	}
-}

internal/ai/llm/retry.go

@@ -30,8 +30,7 @@ const (
 // rate limit that names no wait, waits a jittered exponential backoff. The Request's Timeout, or DefaultTimeout, is one
 // deadline for the whole call, retries and waits included; a caller's
 // earlier context deadline wins. A retry whose wait would not end before
-// that deadline is not made: the last error is returned at once. A wait
-// cut short by cancellation or the deadline returns the context's error.
+// that deadline is not made: the last error is returned at once.
 // ListModels and Verify pass straight through.
 type Retrying struct {
 	Provider
@@ -84,8 +83,8 @@ func (r *Retrying) Generate(ctx context.Context, req Request) (Response, error)
 		if !r.now().Add(wait).Before(deadline) {
 			return resp, err
 		}
-		if err := r.sleep(ctx, wait); err != nil {
-			return Response{}, err
+		if serr := r.sleep(ctx, wait); serr != nil {
+			return resp, err
 		}
 	}
 }

internal/ai/llm/retry_test.go

@@ -240,43 +240,6 @@ func TestRetryingStopsWhenContextDone(t *testing.T) {
 	assertConsumed(t, f, 1)
 }
 
-func TestRetryingWaitInterruptedReturnsContextError(t *testing.T) {
-	t.Run("cancelled", func(t *testing.T) {
-		r, f, _ := newTestRetrying()
-		ctx, cancel := context.WithCancel(context.Background())
-		defer cancel()
-		r.sleep = func(ctx context.Context, d time.Duration) error {
-			cancel()
-			return sleep(ctx, d)
-		}
-		f.QueueGenerate(fail(NewRateLimitedError(3*time.Second, "")))
-
-		_, err := r.Generate(ctx, retryReq)
-		if !errors.Is(err, context.Canceled) || errors.Is(err, ErrRateLimited) {
-			t.Fatalf("err = %v, want context.Canceled", err)
-		}
-		assertConsumed(t, f, 1)
-	})
-	t.Run("deadline", func(t *testing.T) {
-		r, f, _ := newTestRetrying()
-		// The fake clock stands still, so the 500ms backoff fits before
-		// the caller's deadline; the real wait outlasts it.
-		r.jitter = func(time.Duration) time.Duration { return 0 }
-		r.sleep = func(ctx context.Context, _ time.Duration) error {
-			return sleep(ctx, time.Hour)
-		}
-		ctx, cancel := context.WithTimeout(context.Background(), 600*time.Millisecond)
-		defer cancel()
-		f.QueueGenerate(fail(NewRateLimitedError(0, "")))
-
-		_, err := r.Generate(ctx, retryReq)
-		if !errors.Is(err, context.DeadlineExceeded) || errors.Is(err, ErrRateLimited) {
-			t.Fatalf("err = %v, want context.DeadlineExceeded", err)
-		}
-		assertConsumed(t, f, 1)
-	})
-}
-
 // slowProvider is a Provider whose every attempt takes d on clock c,
 // records the deadline of the context it received, and times out.
 type slowProvider struct {

internal/auth/auth.go

@@ -327,13 +327,8 @@ func (a *Auth) callback(w http.ResponseWriter, r *http.Request) {
 
 // logout ends the session, clears the cookie and sends the browser to the
 // provider's end_session_endpoint to end the provider session as well.
-// Clear-Site-Data wipes this origin's storage and caches — the PWA's
-// verified-session marker in localStorage and the service worker's cached API
-// and media responses — so an offline visit after logout cannot reopen
-// household data.
 func (a *Auth) logout(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Cache-Control", "no-store")
-	w.Header().Set("Clear-Site-Data", `"storage", "cache"`)
 	if err := a.sessions.EndSession(w, r); err != nil {
 		a.logger.ErrorContext(r.Context(), "end session", "error", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)

internal/auth/session_test.go

@@ -440,9 +440,6 @@ func TestLogout(t *testing.T) {
 	if !strings.HasPrefix(raw, SessionCookieName+"=;") || !strings.Contains(raw, "Max-Age=0") {
 		t.Errorf("logout Set-Cookie = %q, want the cookie cleared", raw)
 	}
-	if got := resp.Header.Get("Clear-Site-Data"); got != `"storage", "cache"` {
-		t.Errorf("logout Clear-Site-Data = %q, want the PWA's storage and caches cleared", got)
-	}
 
 	rows := h.rows(t)
 	if len(rows) != 1 || rows[0].idHash != sha256Hex(other.Value) {
@@ -464,9 +461,6 @@ func TestLogoutWithoutSession(t *testing.T) {
 		t.Errorf("logout = %d to %q, want 303 to the end session endpoint", resp.StatusCode, resp.Header.Get("Location"))
 	}
 	assertSessionCookieAttributes(t, sessionSetCookie(t, resp))
-	if got := resp.Header.Get("Clear-Site-Data"); got != `"storage", "cache"` {
-		t.Errorf("logout Clear-Site-Data = %q, want the PWA's storage and caches cleared", got)
-	}
 }
 
 func TestLogoutIsPostOnly(t *testing.T) {

web/index.html

@@ -3,8 +3,6 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <meta name="theme-color" content="#5a358c" />
-    <link rel="apple-touch-icon" href="/apple-touch-icon.png" />
     <title>MealQuest</title>
   </head>
   <body>

web/manifest.json

@@ -1,19 +0,0 @@
-{
-  "name": "MealQuest",
-  "short_name": "MealQuest",
-  "start_url": "/",
-  "scope": "/",
-  "display": "standalone",
-  "theme_color": "#5a358c",
-  "background_color": "#f9f6f1",
-  "icons": [
-    { "src": "/icons/icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any" },
-    { "src": "/icons/icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any" },
-    {
-      "src": "/icons/icon-maskable-512.png",
-      "sizes": "512x512",
-      "type": "image/png",
-      "purpose": "maskable"
-    }
-  ]
-}

web/package.json

@@ -5,9 +5,9 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "npm run lint:colors && npm run typecheck && vite build && npm run check:dist-fonts",
+    "build": "npm run lint:colors && tsc --noEmit && vite build && npm run check:dist-fonts",
     "preview": "vite preview",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.sw.json",
+    "typecheck": "tsc --noEmit",
     "test": "npm run lint:colors && vitest run",
     "lint:colors": "node scripts/lint-colors.mjs",
     "check:dist-fonts": "node scripts/check-dist-fonts.mjs"
@@ -29,7 +29,6 @@
     "jsdom": "^30.1.1",
     "typescript": "^7.0.2",
     "vite": "^8.3.2",
-    "vite-plugin-pwa": "^2.0.0",
     "vitest": "^5.0.3"
   }
 }

web/scripts/generate-icons/main.go

@@ -1,186 +0,0 @@
-// Command generate-icons writes the PWA icons in web/public from the
-// MealQuest logo. Run it from the repository root:
-//
-//	go run ./web/scripts/generate-icons
-//
-// The logo fills the regular icons edge to edge. The maskable icon shrinks it
-// onto the colour of its own parchment, so the banner stays inside the
-// circular safe zone (radius 40% of the icon) that launchers may crop to.
-package main
-
-import (
-	"fmt"
-	"image"
-	"image/color"
-	"image/png"
-	"math"
-	"os"
-	"path/filepath"
-	"slices"
-
-	"golang.org/x/image/draw"
-)
-
-const (
-	source        = "design/logos/logo_v1_2Oct2026.jpg"
-	public        = "web/public"
-	maskableScale = 0.66
-)
-
-func main() {
-	if err := run(); err != nil {
-		fmt.Fprintln(os.Stderr, "generate-icons:", err)
-		os.Exit(1)
-	}
-}
-
-func run() error {
-	logo, err := load(source)
-	if err != nil {
-		return err
-	}
-	if b := logo.Bounds(); b.Dx() != b.Dy() {
-		return fmt.Errorf("%s is %dx%d; the logo must be square", source, b.Dx(), b.Dy())
-	}
-	outputs := []struct {
-		path  string
-		image *image.RGBA
-	}{
-		{"icons/icon-192.png", resized(logo, 192)},
-		{"icons/icon-512.png", resized(logo, 512)},
-		{"icons/icon-maskable-512.png", maskable(logo, 512)},
-		{"apple-touch-icon.png", resized(logo, 180)},
-	}
-	for _, out := range outputs {
-		path := filepath.Join(public, out.path)
-		if err := save(path, out.image); err != nil {
-			return err
-		}
-		fmt.Printf("wrote %s (%dx%d)\n", path, out.image.Rect.Dx(), out.image.Rect.Dy())
-	}
-	return nil
-}
-
-// load decodes the logo. The file is a PNG despite its .jpg name, so the
-// format is sniffed rather than taken from the extension.
-func load(path string) (image.Image, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-	img, _, err := image.Decode(f)
-	if err != nil {
-		return nil, fmt.Errorf("decode %s: %w", path, err)
-	}
-	return img, nil
-}
-
-func save(path string, img image.Image) error {
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		return err
-	}
-	f, err := os.Create(path)
-	if err != nil {
-		return err
-	}
-	enc := png.Encoder{CompressionLevel: png.BestCompression}
-	if err := enc.Encode(f, img); err != nil {
-		f.Close()
-		return fmt.Errorf("encode %s: %w", path, err)
-	}
-	return f.Close()
-}
-
-func resized(logo image.Image, size int) *image.RGBA {
-	dst := image.NewRGBA(image.Rect(0, 0, size, size))
-	draw.CatmullRom.Scale(dst, dst.Rect, logo, logo.Bounds(), draw.Src, nil)
-	return dst
-}
-
-func maskable(logo image.Image, size int) *image.RGBA {
-	// The padding is the median colour of the logo's top edge, which is bare
-	// parchment; a feathered edge hides the seam.
-	b := logo.Bounds()
-	canvas := image.NewRGBA(image.Rect(0, 0, size, size))
-	draw.Draw(canvas, canvas.Rect, image.NewUniform(medianColour(logo, image.Rect(b.Min.X, b.Min.Y, b.Max.X, b.Min.Y+b.Dy()/40))), image.Point{}, draw.Src)
-	inner := int(math.Round(float64(size) * maskableScale))
-	offset := (size - inner) / 2
-	margin := inner / 24
-	at := image.Rect(offset, offset, offset+inner, offset+inner)
-	draw.DrawMask(canvas, at, resized(logo, inner), image.Point{}, feather(inner, margin), image.Point{}, draw.Over)
-	return canvas
-}
-
-// medianColour is the per-channel median of the pixels in r.
-func medianColour(img image.Image, r image.Rectangle) color.RGBA {
-	var channels [3][]uint8
-	for y := r.Min.Y; y < r.Max.Y; y++ {
-		for x := r.Min.X; x < r.Max.X; x++ {
-			c := color.RGBAModel.Convert(img.At(x, y)).(color.RGBA)
-			channels[0] = append(channels[0], c.R)
-			channels[1] = append(channels[1], c.G)
-			channels[2] = append(channels[2], c.B)
-		}
-	}
-	var median [3]uint8
-	for i, values := range channels {
-		slices.Sort(values)
-		median[i] = values[len(values)/2]
-	}
-	return color.RGBA{R: median[0], G: median[1], B: median[2], A: 0xff}
-}
-
-// feather is an opaque square inset by margin on a size×size mask, its edge
-// softened by a Gaussian blur with a standard deviation of margin/2.
-func feather(size, margin int) *image.Alpha {
-	values := make([]float64, size*size)
-	for y := margin; y <= size-margin && y < size; y++ {
-		for x := margin; x <= size-margin && x < size; x++ {
-			values[y*size+x] = 255
-		}
-	}
-	kernel := gaussian(float64(margin) / 2)
-	values = blur(values, size, kernel, 1, size)
-	values = blur(values, size, kernel, size, 1)
-	mask := image.NewAlpha(image.Rect(0, 0, size, size))
-	for i, v := range values {
-		mask.Pix[i] = uint8(math.Round(min(max(v, 0), 255)))
-	}
-	return mask
-}
-
-// gaussian is a normalised kernel reaching three standard deviations.
-func gaussian(sigma float64) []float64 {
-	radius := int(math.Ceil(3 * sigma))
-	kernel := make([]float64, 2*radius+1)
-	var sum float64
-	for i := range kernel {
-		d := float64(i - radius)
-		kernel[i] = math.Exp(-d * d / (2 * sigma * sigma))
-		sum += kernel[i]
-	}
-	for i := range kernel {
-		kernel[i] /= sum
-	}
-	return kernel
-}
-
-// blur convolves each line of a size×size grid with kernel: step is the
-// distance between neighbours along a line and stride between lines. Samples
-// beyond the edge repeat the edge.
-func blur(values []float64, size int, kernel []float64, step, stride int) []float64 {
-	radius := len(kernel) / 2
-	out := make([]float64, len(values))
-	for line := range size {
-		for i := range size {
-			var v float64
-			for k, w := range kernel {
-				j := min(max(i+k-radius, 0), size-1)
-				v += w * values[line*stride+j*step]
-			}
-			out[line*stride+i*step] = v
-		}
-	}
-	return out
-}

web/src/App.test.tsx

@@ -1,28 +1,23 @@
-import { act, render, screen } from '@testing-library/react'
+import { render, screen } from '@testing-library/react'
 import { MemoryRouter } from 'react-router'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { createApiClient, createVerifiedSession } from './api/index.ts'
-import { createNetworkStatus } from './pwa/networkStatus.ts'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createApiClient } from './api/index.ts'
 import { mockViewport } from './test/matchMedia.ts'
 import { errorResponse, fakeLocation, jsonResponse, ME, request, stubFetch } from './test/fetchStub.ts'
 import App, { routes } from './App.tsx'
 
 afterEach(() => {
   Reflect.deleteProperty(window, 'matchMedia')
-  vi.restoreAllMocks()
   vi.unstubAllGlobals()
 })
 
 function renderAt(path: string, location = fakeLocation(path)) {
-  return { location, ...renderAppAt(path, location) }
-}
-
-function renderAppAt(path: string, location = fakeLocation(path)) {
-  return render(
+  render(
     <MemoryRouter initialEntries={[path]}>
-      <App api={createApiClient(location, createNetworkStatus(window), createVerifiedSession(localStorage))} serviceWorker={undefined} />
+      <App api={createApiClient(location)} />
     </MemoryRouter>,
   )
+  return location
 }
 
 describe('App routes', () => {
@@ -75,7 +70,7 @@ describe('App bootstrap', () => {
 
   it('sends a signed-out visitor to sign-in and never renders the routes', async () => {
     const fetchMock = stubFetch(errorResponse(401, 'unauthenticated'))
-    const { location } = renderAt('/discover', fakeLocation('/discover', '?swipe=1'))
+    const location = renderAt('/discover', fakeLocation('/discover', '?swipe=1'))
 
     await vi.waitFor(() => expect(location.assign).toHaveBeenCalledWith('/auth/login?return=%2Fdiscover%3Fswipe%3D1'))
     expect(fetchMock).toHaveBeenCalledTimes(1)
@@ -85,7 +80,7 @@ describe('App bootstrap', () => {
 
   it('shows the not-in-this-household screen on a 403', async () => {
     const fetchMock = stubFetch(errorResponse(403, 'forbidden'))
-    const { location } = renderAt('/')
+    const location = renderAt('/')
 
     expect(await screen.findByText(/not in this household/)).toBeInTheDocument()
     expect(screen.getByRole('heading', { name: 'Not in this household' })).toBeInTheDocument()
@@ -104,93 +99,3 @@ describe('App bootstrap', () => {
     expect(await screen.findByRole('heading', { level: 1, name: 'Home' })).toBeInTheDocument()
   })
 })
-
-describe('App offline bootstrap', () => {
-  let onLine: boolean
-
-  function goOffline() {
-    onLine = false
-    vi.stubGlobal('fetch', vi.fn<typeof fetch>().mockRejectedValue(new TypeError('Failed to fetch')))
-  }
-
-  // visitOnline is an earlier online visit on this device: /me answers with a
-  // member, then the app is closed.
-  async function visitOnline() {
-    stubFetch(jsonResponse(200, ME))
-    const { unmount } = renderAt('/')
-    expect(await screen.findByRole('heading', { level: 1, name: 'Home' })).toBeInTheDocument()
-    unmount()
-  }
-
-  beforeEach(() => {
-    mockViewport(390)
-    onLine = true
-    vi.spyOn(navigator, 'onLine', 'get').mockImplementation(() => onLine)
-  })
-
-  it.each([
-    ['/plan', 'Plan'],
-    ['/dinner/01J9ZK', 'Dinner'],
-  ])('an offline reload of %s after an online visit opens the saved page', async (path, title) => {
-    await visitOnline()
-    goOffline()
-    renderAt(path)
-
-    expect(await screen.findByRole('heading', { level: 1, name: title })).toBeInTheDocument()
-    expect(screen.getByRole('navigation', { name: 'Primary' })).toBeInTheDocument()
-    expect(screen.getByRole('status')).toHaveTextContent('Offline — showing saved data')
-    expect(screen.queryByRole('alert')).not.toBeInTheDocument()
-  })
-
-  it('opens the saved pages when the server is unreachable but the browser reports online', async () => {
-    await visitOnline()
-    vi.stubGlobal('fetch', vi.fn<typeof fetch>().mockRejectedValue(new TypeError('Failed to fetch')))
-    renderAt('/plan')
-
-    expect(await screen.findByRole('heading', { level: 1, name: 'Plan' })).toBeInTheDocument()
-    expect(screen.getByRole('status')).toHaveTextContent('Offline — showing saved data')
-  })
-
-  it('reports the failure offline when this device never verified a session', async () => {
-    goOffline()
-    renderAt('/plan')
-
-    expect(await screen.findByRole('alert')).toHaveTextContent('MealQuest could not load: Failed to fetch')
-    expect(screen.queryByRole('navigation', { name: 'Primary' })).not.toBeInTheDocument()
-  })
-
-  it('reports the failure offline after the session was refused', async () => {
-    await visitOnline()
-    stubFetch(errorResponse(401, 'unauthenticated'))
-    const { location, unmount } = renderAt('/plan')
-    await vi.waitFor(() => expect(location.assign).toHaveBeenCalled())
-    unmount()
-
-    goOffline()
-    renderAt('/plan')
-    expect(await screen.findByRole('alert')).toHaveTextContent('MealQuest could not load: Failed to fetch')
-    expect(screen.queryByRole('navigation', { name: 'Primary' })).not.toBeInTheDocument()
-  })
-
-  it('loads /me again on reconnect and refuses writes until it has', async () => {
-    await visitOnline()
-    goOffline()
-    const api = createApiClient(fakeLocation('/plan'), createNetworkStatus(window), createVerifiedSession(localStorage))
-    render(
-      <MemoryRouter initialEntries={['/plan']}>
-        <App api={api} serviceWorker={undefined} />
-      </MemoryRouter>,
-    )
-    expect(await screen.findByRole('heading', { level: 1, name: 'Plan' })).toBeInTheDocument()
-    await expect(api.apiFetch('/api/v1/plans', { method: 'POST', body: {} })).rejects.toThrow(/no CSRF token/)
-
-    const fetchMock = stubFetch(jsonResponse(200, ME))
-    onLine = true
-    act(() => {
-      window.dispatchEvent(new Event('online'))
-    })
-    await vi.waitFor(() => expect(request(fetchMock, 0)).toMatchObject({ path: '/api/v1/me', method: 'GET' }))
-    await vi.waitFor(() => expect(screen.queryByRole('status')).toBeNull())
-    expect(screen.getByRole('heading', { level: 1, name: 'Plan' })).toBeInTheDocument()
-  })
-})

web/src/App.tsx

@@ -4,8 +4,6 @@ import { Route, Routes } from 'react-router'
 import { ApiProvider, createQueryClient, type ApiClient } from './api/index.ts'
 import { AuthBootstrap } from './AuthBootstrap.tsx'
 import { PlaceholderPage } from './pages/PlaceholderPage.tsx'
-import { OfflinePill } from './pwa/OfflinePill.tsx'
-import { UpdatePrompt, type UpdateContainer } from './pwa/UpdatePrompt.tsx'
 import { AppShell } from './shell/AppShell.tsx'
 
 // Every route the app serves, with the heading its placeholder page shows.
@@ -42,17 +40,11 @@ export function AppRoutes() {
 
 export type AppProps = {
   api: ApiClient
-  // navigator.serviceWorker, or undefined where there is none (and in tests).
-  serviceWorker: UpdateContainer | undefined
-}
-
-function reloadPage() {
-  window.location.reload()
 }
 
 // App expects to be rendered inside a router (BrowserRouter in main.tsx,
 // MemoryRouter in tests).
-export default function App({ api, serviceWorker }: AppProps) {
+export default function App({ api }: AppProps) {
   const [queryClient] = useState(createQueryClient)
   return (
     <ApiProvider client={api}>
@@ -60,8 +52,6 @@ export default function App({ api, serviceWorker }: AppProps) {
         <AuthBootstrap>
           <AppRoutes />
         </AuthBootstrap>
-        <OfflinePill />
-        <UpdatePrompt container={serviceWorker} reload={reloadPage} />
       </QueryClientProvider>
     </ApiProvider>
   )

web/src/AuthBootstrap.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useSyncExternalStore, type ReactNode } from 'react'
+import { useSyncExternalStore, type ReactNode } from 'react'
 import { useQuery } from '@tanstack/react-query'
 import { ApiError, ME_PATH, useApi } from './api/index.ts'
 import { NotInHouseholdPage } from './pages/NotInHouseholdPage.tsx'
@@ -11,29 +11,13 @@ export const meQueryKey = [ME_PATH] as const
 // AuthBootstrap loads GET /api/v1/me before rendering children. A 401 is
 // already navigating to sign-in, so the skeleton stays up; an account outside
 // the household sees only the "not in this household" screen.
-//
-// When /me cannot reach the server and it last answered with a member on this
-// device, the saved pages open read-only: the service worker answers their
-// reads from its cache, and every write is refused for want of a CSRF token.
-// /me runs even while the browser reports offline, so that case fails fast
-// instead of waiting, and it is fetched again when the browser is back online.
 export function AuthBootstrap({ children }: { children: ReactNode }) {
   const api = useApi()
   const forbidden = useSyncExternalStore(api.subscribe, api.forbidden)
-  const me = useQuery({ queryKey: meQueryKey, queryFn: api.loadMe, staleTime: Infinity, networkMode: 'always' })
-  // fetch rejects with a TypeError only when the network fails.
-  const savedPages = me.isError && me.error instanceof TypeError && api.session.verified()
-  const { refetch } = me
-
-  useEffect(() => {
-    if (!savedPages) return
-    return api.network.subscribe(() => {
-      if (!api.network.offline()) void refetch()
-    })
-  }, [savedPages, api, refetch])
+  const me = useQuery({ queryKey: meQueryKey, queryFn: api.loadMe, staleTime: Infinity })
 
   if (forbidden) return <NotInHouseholdPage />
-  if (me.isSuccess || savedPages) return children
+  if (me.isSuccess) return children
   if (me.isError && !(me.error instanceof ApiError && me.error.status === 401)) {
     return (
       <main className={styles.screen}>

web/src/api/client.test.ts

@@ -1,18 +1,15 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { errorResponse, fakeLocation, jsonResponse, ME, request, stubFetch } from '../test/fetchStub.ts'
-import { ApiError, createApiClient, createVerifiedSession, CSRF_HEADER, VERIFIED_SESSION_KEY } from './index.ts'
-import { cacheFallbackHeader } from '../sw/routes.ts'
-import { createNetworkStatus } from '../pwa/networkStatus.ts'
+import { ApiError, createApiClient, CSRF_HEADER } from './index.ts'
 
 afterEach(() => {
-  vi.restoreAllMocks()
   vi.unstubAllGlobals()
 })
 
 describe('apiFetch', () => {
   it('sends same-origin JSON and the cached CSRF token on non-GET requests only', async () => {
     const fetchMock = stubFetch(jsonResponse(200, ME), jsonResponse(200, { ok: 1 }), jsonResponse(200, { ok: 2 }))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(fakeLocation())
     await api.loadMe()
 
     await expect(api.apiFetch('/api/v1/settings/household')).resolves.toEqual({ ok: 1 })
@@ -32,7 +29,7 @@ describe('apiFetch', () => {
 
   it('refuses a non-GET request before /me has loaded', async () => {
     const fetchMock = stubFetch()
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(fakeLocation())
     await expect(api.apiFetch('/api/v1/jobs', { method: 'POST', body: {} })).rejects.toThrow(/no CSRF token/)
     expect(fetchMock).not.toHaveBeenCalled()
   })
@@ -50,7 +47,7 @@ describe('apiFetch', () => {
     'api/v1/me',
   ])('refuses %s without sending it or the CSRF token', async (path) => {
     const fetchMock = stubFetch(jsonResponse(200, ME))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(fakeLocation())
     await api.loadMe()
 
     await expect(api.apiFetch(path, { method: 'POST', body: {} })).rejects.toThrow(
@@ -63,7 +60,7 @@ describe('apiFetch', () => {
 
   it('rejects with a typed ApiError from the error body', async () => {
     stubFetch(errorResponse(503, 'unavailable', true))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(fakeLocation())
     const error = await api.apiFetch('/api/v1/jobs/j1').catch((e: unknown) => e)
     expect(error).toBeInstanceOf(ApiError)
     expect(error).toMatchObject({ status: 503, code: 'unavailable', message: 'unavailable message', retryable: true })
@@ -71,14 +68,14 @@ describe('apiFetch', () => {
 
   it('rejects a response without the API error body', async () => {
     stubFetch(new Response('<html>bad gateway</html>', { status: 502 }))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(fakeLocation())
     await expect(api.apiFetch('/api/v1/jobs/j1')).rejects.toThrow('GET /api/v1/jobs/j1: 502 response is not JSON')
   })
 
   it('on 401 navigates to sign-in with the current path and search to return to', async () => {
     stubFetch(errorResponse(401, 'unauthenticated'))
     const location = fakeLocation('/plan/shopping', '?week=2026-10-05')
-    const api = createApiClient(location, createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(location)
 
     await expect(api.apiFetch('/api/v1/settings/household')).rejects.toMatchObject({ status: 401 })
     expect(location.assign).toHaveBeenCalledExactlyOnceWith(
@@ -93,7 +90,7 @@ describe('apiFetch', () => {
       jsonResponse(200, { ...ME, csrfToken: 'token-2' }),
       jsonResponse(201, { id: 'j1' }),
     )
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(fakeLocation())
     await api.loadMe()
 
     await expect(api.apiFetch('/api/v1/jobs', { method: 'POST', body: { kind: 'noop' } })).resolves.toEqual({
@@ -114,7 +111,7 @@ describe('apiFetch', () => {
       jsonResponse(200, { ...ME, csrfToken: 'token-2' }),
       errorResponse(403, 'csrf'),
     )
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(fakeLocation())
     await api.loadMe()
 
     await expect(api.apiFetch('/api/v1/jobs', { method: 'POST', body: {} })).rejects.toMatchObject({
@@ -127,7 +124,7 @@ describe('apiFetch', () => {
 
   it('marks any other 403 as not in this household and notifies subscribers', async () => {
     const fetchMock = stubFetch(errorResponse(403, 'forbidden'))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(fakeLocation())
     const listener = vi.fn()
     api.subscribe(listener)
 
@@ -139,14 +136,14 @@ describe('apiFetch', () => {
 
   it('does not take a 403 without the API error body as not in this household', async () => {
     stubFetch(new Response('<html>denied by proxy</html>', { status: 403 }))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(fakeLocation())
     await expect(api.apiFetch('/api/v1/me')).rejects.toThrow('GET /api/v1/me: 403 response is not JSON')
     expect(api.forbidden()).toBe(false)
   })
 
   it('does not refresh /me for a csrf 403 on a GET, which carries no token', async () => {
     const fetchMock = stubFetch(errorResponse(403, 'csrf'))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(fakeLocation())
     await expect(api.loadMe()).rejects.toMatchObject({ status: 403, code: 'csrf' })
     expect(fetchMock).toHaveBeenCalledTimes(1)
   })
@@ -155,74 +152,7 @@ describe('apiFetch', () => {
 describe('loadMe', () => {
   it('rejects a /me response without a CSRF token', async () => {
     stubFetch(jsonResponse(200, { ...ME, csrfToken: '' }))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+    const api = createApiClient(fakeLocation())
     await expect(api.loadMe()).rejects.toThrow('response is not a member with a CSRF token')
   })
 })
-
-describe('verified session', () => {
-  it('is remembered when /me answers with a member', async () => {
-    stubFetch(jsonResponse(200, ME))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
-    expect(api.session.verified()).toBe(false)
-    await api.loadMe()
-    expect(api.session.verified()).toBe(true)
-    expect(localStorage.getItem(VERIFIED_SESSION_KEY)).toBe('1')
-  })
-
-  it('stores nothing from the /me response', async () => {
-    stubFetch(jsonResponse(200, ME))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
-    await api.loadMe()
-    expect(Object.keys(localStorage)).toEqual([VERIFIED_SESSION_KEY])
-    expect(JSON.stringify({ ...localStorage })).not.toContain(ME.csrfToken)
-  })
-
-  it('is not remembered for a /me response that is not a member', async () => {
-    stubFetch(jsonResponse(200, { ...ME, csrfToken: '' }))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
-    await expect(api.loadMe()).rejects.toThrow()
-    expect(api.session.verified()).toBe(false)
-  })
-
-  it('is forgotten on a 401', async () => {
-    stubFetch(jsonResponse(200, ME), errorResponse(401, 'unauthenticated'))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
-    await api.loadMe()
-    await expect(api.apiFetch('/api/v1/plans')).rejects.toMatchObject({ status: 401 })
-    expect(api.session.verified()).toBe(false)
-  })
-
-  it('is forgotten when the account is not in this household', async () => {
-    stubFetch(jsonResponse(200, ME), errorResponse(403, 'forbidden'))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
-    await api.loadMe()
-    await expect(api.apiFetch('/api/v1/plans')).rejects.toMatchObject({ status: 403 })
-    expect(api.session.verified()).toBe(false)
-  })
-
-  it('is kept when a request fails with a network error', async () => {
-    stubFetch(jsonResponse(200, ME))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
-    await api.loadMe()
-    vi.stubGlobal('fetch', vi.fn<typeof fetch>().mockRejectedValue(new TypeError('Failed to fetch')))
-    await expect(api.loadMe()).rejects.toThrow(TypeError)
-    expect(api.session.verified()).toBe(true)
-  })
-})
-
-describe('network status', () => {
-  it('counts a response the service worker answered from its cache as offline', async () => {
-    vi.spyOn(navigator, 'onLine', 'get').mockReturnValue(true)
-    const cached = jsonResponse(200, { id: '01J9ZR' })
-    cached.headers.set(cacheFallbackHeader, '1')
-    stubFetch(cached, jsonResponse(200, { id: '01J9ZR' }))
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
-
-    await expect(api.apiFetch('/api/v1/recipes/01J9ZR')).resolves.toEqual({ id: '01J9ZR' })
-    expect(api.network.offline()).toBe(true)
-
-    await expect(api.apiFetch('/api/v1/recipes/01J9ZR')).resolves.toEqual({ id: '01J9ZR' })
-    expect(api.network.offline()).toBe(false)
-  })
-})

web/src/api/client.ts

@@ -1,7 +1,4 @@
-import type { NetworkStatus } from '../pwa/networkStatus.ts'
-import { cacheFallbackHeader } from '../sw/routes.ts'
 import { ApiError, isRecord, parseApiError } from './errors.ts'
-import type { VerifiedSession } from './verifiedSession.ts'
 
 // CSRF_HEADER carries the session's CSRF token on every non-GET request.
 export const CSRF_HEADER = 'X-MealQuest-CSRF'
@@ -39,7 +36,7 @@ export type ApiLocation = Pick<Location, 'origin' | 'pathname' | 'search' | 'ass
 
 export type ApiRequest = {
   method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'
-  // Sent as JSON. A GET must not have one.
+  // Sent as JSON.
   body?: unknown
 }
 
@@ -54,18 +51,11 @@ export type ApiClient = {
   // account is not in this household; subscribe is notified when it changes.
   forbidden(): boolean
   subscribe(listener: () => void): () => void
-  // network learns of every request that failed with a network error or was
-  // answered from the service worker's cache, and of every request the
-  // server answered.
-  network: NetworkStatus
-  // session remembers, on this device, whether /me last answered with a
-  // member; offline, AuthBootstrap opens the saved pages only if it did.
-  session: VerifiedSession
 }
 
 // createApiClient builds the app's API client. location is window.location in
 // the app: a 401 sends it to /auth/login with the current path to return to.
-export function createApiClient(location: ApiLocation, network: NetworkStatus, session: VerifiedSession): ApiClient {
+export function createApiClient(location: ApiLocation): ApiClient {
   let csrfToken: string | null = null
   let refreshing: Promise<Me> | null = null
   let forbidden = false
@@ -80,28 +70,12 @@ export function createApiClient(location: ApiLocation, network: NetworkStatus, s
       }
       headers[CSRF_HEADER] = csrfToken
     }
-    // Serialize before fetching so a body that cannot be sent is its own error
-    // and never counts as a network failure.
-    let json: string | undefined
-    try {
-      json = body === undefined ? undefined : JSON.stringify(body)
-    } catch (error) {
-      throw new Error(`${method} ${path}: request body is not serializable as JSON`, { cause: error })
-    }
-    let response: Response
-    try {
-      response = await fetch(path, { method, headers, credentials: 'same-origin', body: json })
-    } catch (error) {
-      // fetch rejects with a TypeError when the network fails; an abort is a
-      // DOMException and says nothing about the network.
-      if (error instanceof TypeError) network.requestFailed()
-      throw error
-    }
-    // The service worker marks a response it answered from its cache because
-    // the server could not be reached in time.
-    if (response.headers.has(cacheFallbackHeader)) network.requestFailed()
-    else network.requestSucceeded()
-    return response
+    return fetch(path, {
+      method,
+      headers,
+      credentials: 'same-origin',
+      body: body === undefined ? undefined : JSON.stringify(body),
+    })
   }
 
   // refreshMe shares one in-flight /me request between every request that
@@ -116,11 +90,6 @@ export function createApiClient(location: ApiLocation, network: NetworkStatus, s
   async function apiFetch<T>(path: string, request: ApiRequest = {}): Promise<T> {
     const method = request.method ?? 'GET'
     const url = apiURL(location.origin, method, path)
-    // fetch refuses a GET with a body by rejecting with a TypeError, the same
-    // error as a network failure, so refuse it here before anything is sent.
-    if (method === 'GET' && request.body !== undefined) {
-      throw new Error(`GET ${path}: a GET request cannot carry a body`)
-    }
     let response = await send(method, url, request.body)
     if (response.status === 403) {
       const error = await parseForbidden(method, path, response)
@@ -144,14 +113,12 @@ export function createApiClient(location: ApiLocation, network: NetworkStatus, s
 
   function markForbidden() {
     if (forbidden) return
-    session.forget()
     forbidden = true
     listeners.forEach((listener) => listener())
   }
 
   async function decode<T>(method: string, path: string, response: Response): Promise<T> {
     if (response.status === 401) {
-      session.forget()
       location.assign(`/auth/login?return=${encodeURIComponent(location.pathname + location.search)}`)
     }
     if (!response.ok) throw await parseApiError(method, path, response)
@@ -173,7 +140,6 @@ export function createApiClient(location: ApiLocation, network: NetworkStatus, s
       throw new Error(`GET ${ME_PATH}: response is not a member with a CSRF token`)
     }
     csrfToken = me.csrfToken
-    session.remember()
     return me as Me
   }
 
@@ -185,7 +151,5 @@ export function createApiClient(location: ApiLocation, network: NetworkStatus, s
       listeners.add(listener)
       return () => listeners.delete(listener)
     },
-    network,
-    session,
   }
 }

web/src/api/index.ts

@@ -2,5 +2,4 @@ export { ApiProvider, useApi } from './ApiContext.tsx'
 export { createApiClient, CSRF_HEADER, ME_PATH, type ApiClient, type ApiLocation, type ApiRequest, type Me } from './client.ts'
 export { ApiError } from './errors.ts'
 export { createQueryClient, shouldRetry } from './queryClient.ts'
-export { createVerifiedSession, VERIFIED_SESSION_KEY, type VerifiedSession } from './verifiedSession.ts'
 export { useJob, type Job, type JobState, type JobStatus } from './useJob.ts'

web/src/api/useJob.test.tsx

@@ -2,8 +2,7 @@ import { act, renderHook } from '@testing-library/react'
 import type { ReactNode } from 'react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { errorResponse, fakeLocation, jsonResponse, request, stubFetch } from '../test/fetchStub.ts'
-import { ApiProvider, createApiClient, createVerifiedSession, useJob } from './index.ts'
-import { createNetworkStatus } from '../pwa/networkStatus.ts'
+import { ApiProvider, createApiClient, useJob } from './index.ts'
 
 type Draft = { dinners: string[] }
 
@@ -12,7 +11,7 @@ function job(status: string, result: Draft | null, error: string | null = null)
 }
 
 function renderJob(jobId: string | null) {
-  const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
+  const api = createApiClient(fakeLocation())
   const wrapper = ({ children }: { children: ReactNode }) => <ApiProvider client={api}>{children}</ApiProvider>
   return renderHook(({ id }) => useJob<Draft>(id), { wrapper, initialProps: { id: jobId } })
 }

web/src/api/verifiedSession.ts

@@ -1,24 +0,0 @@
-// VERIFIED_SESSION_KEY is the localStorage key marking that GET /api/v1/me
-// last answered with a household member on this device. It holds only "1" —
-// never the /me response, its CSRF token or anything from /auth.
-export const VERIFIED_SESSION_KEY = 'mealquest.verified-session'
-
-export type VerifiedSession = {
-  // verified reports whether /me last answered with a member on this device.
-  verified(): boolean
-  // remember records a /me that answered with a member.
-  remember(): void
-  // forget records that the server refused the session (401) or the account
-  // (not in this household).
-  forget(): void
-}
-
-// createVerifiedSession keeps the marker in storage (window.localStorage in
-// the app). A storage failure is thrown to the caller.
-export function createVerifiedSession(storage: Storage): VerifiedSession {
-  return {
-    verified: () => storage.getItem(VERIFIED_SESSION_KEY) === '1',
-    remember: () => storage.setItem(VERIFIED_SESSION_KEY, '1'),
-    forget: () => storage.removeItem(VERIFIED_SESSION_KEY),
-  }
-}

web/src/main.tsx

@@ -4,20 +4,19 @@ import { BrowserRouter } from 'react-router'
 import './styles/tokens.css'
 import './styles/base.css'
 import App from './App.tsx'
-import { createApiClient, createVerifiedSession } from './api/index.ts'
-import { createNetworkStatus } from './pwa/networkStatus.ts'
+import { createApiClient } from './api/index.ts'
 
 const root = document.getElementById('root')
 if (!root) {
   throw new Error('MealQuest: #root element missing from index.html')
 }
 
-const api = createApiClient(window.location, createNetworkStatus(window), createVerifiedSession(window.localStorage))
+const api = createApiClient(window.location)
 
 createRoot(root).render(
   <StrictMode>
     <BrowserRouter>
-      <App api={api} serviceWorker={'serviceWorker' in navigator ? navigator.serviceWorker : undefined} />
+      <App api={api} />
     </BrowserRouter>
   </StrictMode>,
 )

web/src/pwa.test.ts

@@ -1,157 +0,0 @@
-// @vitest-environment node
-// Builds the app with the production config and serves the result, so the
-// assertions cover what ships in dist: the web manifest, the service worker,
-// every icon, and the service worker registration that only builds include.
-import { afterAll, beforeAll, describe, expect, it } from 'vitest'
-import { build, createServer, preview, type PreviewServer, type ViteDevServer } from 'vite'
-import tokens from './styles/tokens.css?raw'
-
-const outDir = 'node_modules/.tmp/pwa-test-dist'
-
-const icons = [
-  { path: '/icons/icon-192.png', size: 192 },
-  { path: '/icons/icon-512.png', size: 512 },
-  { path: '/icons/icon-maskable-512.png', size: 512 },
-  { path: '/apple-touch-icon.png', size: 180 },
-]
-
-function token(name: string): string {
-  const value = tokens.match(new RegExp(`^\\s*${name}:\\s*([^;\\s]+);`, 'm'))?.[1]
-  if (!value) throw new Error(`${name} is not defined in tokens.css`)
-  return value
-}
-
-// Width and height from a PNG's IHDR chunk, which follows the 8-byte
-// signature, the chunk length and the chunk type.
-// The precache list vite-plugin-pwa injects into sw.js: a JSON array of
-// { revision, url } entries.
-function precacheEntries(sw: string): Array<{ revision: string | null; url: string }> {
-  const start = sw.indexOf('[{"revision":')
-  expect(start, 'injected precache list').toBeGreaterThanOrEqual(0)
-  return JSON.parse(sw.slice(start, sw.indexOf('}]', start) + 2))
-}
-
-function pngSize(bytes: Uint8Array): { width: number; height: number } {
-  const signature = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]
-  expect(Array.from(bytes.subarray(0, 8))).toEqual(signature)
-  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)
-  return { width: view.getUint32(16), height: view.getUint32(20) }
-}
-
-describe('production build', () => {
-  let server: PreviewServer
-  let origin: string
-
-  async function get(path: string): Promise<Response> {
-    const response = await fetch(new URL(path, origin))
-    expect(response.status, path).toBe(200)
-    return response
-  }
-
-  beforeAll(async () => {
-    await build({ logLevel: 'error', build: { outDir, emptyOutDir: true } })
-    server = await preview({
-      logLevel: 'error',
-      build: { outDir },
-      preview: { port: 0, strictPort: false, host: '127.0.0.1' },
-    })
-    const url = server.resolvedUrls?.local[0]
-    if (!url) throw new Error('preview server did not report a URL')
-    origin = url
-  }, 60_000)
-
-  afterAll(async () => {
-    await server?.close()
-  })
-
-  it('emits manifest.webmanifest with the MealQuest identity', async () => {
-    const manifest = await (await get('/manifest.webmanifest')).json()
-    expect(manifest).toMatchObject({
-      name: 'MealQuest',
-      short_name: 'MealQuest',
-      start_url: '/',
-      scope: '/',
-      display: 'standalone',
-      // --color-accent and --color-bg hold the manifest colours; hex colours
-      // may not be written outside tokens.css.
-      theme_color: token('--color-accent'),
-      background_color: token('--color-bg'),
-    })
-    expect(manifest.icons).toEqual([
-      { src: '/icons/icon-192.png', sizes: '192x192', type: 'image/png', purpose: 'any' },
-      { src: '/icons/icon-512.png', sizes: '512x512', type: 'image/png', purpose: 'any' },
-      {
-        src: '/icons/icon-maskable-512.png',
-        sizes: '512x512',
-        type: 'image/png',
-        purpose: 'maskable',
-      },
-    ])
-  })
-
-  it.each(icons)('ships $path as a $size px square PNG', async ({ path, size }) => {
-    const bytes = new Uint8Array(await (await get(path)).arrayBuffer())
-    expect(pngSize(bytes)).toEqual({ width: size, height: size })
-  })
-
-  it('emits sw.js with the precache list injected', async () => {
-    const sw = await (await get('/sw.js')).text()
-    expect(sw).not.toContain('self.__WB_MANIFEST')
-    expect(sw).toContain('"url":"index.html"')
-    for (const { path } of icons.slice(0, 3)) {
-      expect(sw).toContain(`"url":"${path.slice(1)}"`)
-    }
-  })
-
-  it('precaches the shell, JS, CSS and every self-hosted font', async () => {
-    const entries = precacheEntries(await (await get('/sw.js')).text())
-    const urls = entries.map((entry) => entry.url)
-    // index.html keeps its URL across builds, so it carries a content
-    // revision; the other assets have content hashes in their names.
-    expect(entries.find((entry) => entry.url === 'index.html')?.revision).toMatch(/^[0-9a-f]{32}$/)
-    expect(urls.some((url) => url.endsWith('.js'))).toBe(true)
-    expect(urls.some((url) => url.endsWith('.css'))).toBe(true)
-    for (const font of [
-      'BagelFatOne-LatinExt',
-      'BagelFatOne-Latin',
-      'Figtree-Regular',
-      'Figtree-SemiBold',
-      'Figtree-Bold',
-    ]) {
-      expect(urls.some((url) => url.startsWith(`assets/${font}`) && url.endsWith('.woff2'))).toBe(true)
-    }
-  })
-
-  it('links the manifest, theme colour and apple-touch-icon from index.html', async () => {
-    const html = await (await get('/')).text()
-    expect(html.match(/<link rel="manifest" href="\/manifest\.webmanifest">/g)).toHaveLength(1)
-    expect(html).toContain(`<meta name="theme-color" content="${token('--color-accent')}" />`)
-    expect(html).toContain('<link rel="apple-touch-icon" href="/apple-touch-icon.png" />')
-  })
-
-  it('registers /sw.js at scope / from index.html', async () => {
-    const html = await (await get('/')).text()
-    expect(html).toContain('<script id="vite-plugin-pwa:register-sw" src="/registerSW.js"></script>')
-    const register = await (await get('/registerSW.js')).text()
-    expect(register).toContain("navigator.serviceWorker.register('/sw.js', { scope: '/' })")
-  })
-})
-
-describe('dev server', () => {
-  let server: ViteDevServer
-
-  beforeAll(async () => {
-    server = await createServer({ logLevel: 'error', server: { middlewareMode: true } })
-  })
-
-  afterAll(async () => {
-    await server?.close()
-  })
-
-  it('does not register a service worker', async () => {
-    const html = await server.transformIndexHtml('/', '<html><head></head><body></body></html>')
-    expect(html).not.toContain('registerSW')
-    expect(html).not.toContain('serviceWorker')
-    expect(html).not.toContain('rel="manifest"')
-  })
-})

web/src/pwa/InstallHint.module.css

@@ -1,18 +0,0 @@
-.hint {
-  display: flex;
-  align-items: center;
-  gap: var(--space-3);
-}
-
-.icon {
-  color: var(--color-accent);
-}
-
-.message {
-  flex: 1;
-  margin: 0;
-  font-family: var(--font-body);
-  font-size: 15px;
-  font-weight: 600;
-  line-height: 1.35;
-}

web/src/pwa/InstallHint.test.tsx

@@ -1,146 +0,0 @@
-import { fireEvent, render, screen } from '@testing-library/react'
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { DISMISSED_KEY, InstallHint } from './InstallHint.tsx'
-
-const IPHONE_SAFARI =
-  'Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1'
-const IPAD_SAFARI =
-  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15'
-const MAC_SAFARI = IPAD_SAFARI
-const IPHONE_CHROME =
-  'Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/138.0.7204.119 Mobile/15E148 Safari/604.1'
-const IPHONE_FIREFOX =
-  'Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/141.0 Mobile/15E148 Safari/605.1.15'
-const IPHONE_EDGE =
-  'Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 EdgiOS/138.3351.83 Mobile/15E148 Safari/605.1.15'
-const IPHONE_OPERA =
-  'Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1 OPT/5.4.0'
-const IPHONE_MQQBROWSER =
-  'Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 MQQBrowser/11.3.5 Mobile/15E148 Safari/604.1'
-const ANDROID_CHROME =
-  'Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36'
-const DESKTOP_CHROME =
-  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36'
-
-const copy = 'Tap Share, then Add to Home Screen to get notifications'
-
-type Device = {
-  userAgent: string
-  maxTouchPoints?: number
-  // display-mode: standalone
-  displayStandalone?: boolean
-  // navigator.standalone (Safari only; undefined elsewhere)
-  navigatorStandalone?: boolean
-}
-
-// mockDevice pretends to be a browser with the given user agent and
-// display mode; jsdom has no matchMedia, navigator.maxTouchPoints or
-// navigator.standalone.
-function mockDevice({ userAgent, maxTouchPoints = 0, displayStandalone = false, navigatorStandalone }: Device) {
-  vi.spyOn(navigator, 'userAgent', 'get').mockReturnValue(userAgent)
-  Object.defineProperty(navigator, 'maxTouchPoints', { configurable: true, value: maxTouchPoints })
-  Object.defineProperty(navigator, 'standalone', { configurable: true, value: navigatorStandalone })
-  vi.stubGlobal('matchMedia', (query: string) => {
-    if (query !== '(display-mode: standalone)') throw new Error(`unexpected media query ${query}`)
-    return { matches: displayStandalone, media: query } as MediaQueryList
-  })
-}
-
-afterEach(() => {
-  vi.restoreAllMocks()
-  vi.unstubAllGlobals()
-  Reflect.deleteProperty(navigator, 'maxTouchPoints')
-  Reflect.deleteProperty(navigator, 'standalone')
-  localStorage.clear()
-})
-
-describe('InstallHint', () => {
-  it('shows on iPhone Safari in a browser tab', () => {
-    mockDevice({ userAgent: IPHONE_SAFARI, maxTouchPoints: 5, navigatorStandalone: false })
-    render(<InstallHint />)
-    expect(screen.getByRole('note')).toHaveTextContent(copy)
-  })
-
-  it('shows on iPadOS Safari, which reports itself as a Mac with a touch screen', () => {
-    mockDevice({ userAgent: IPAD_SAFARI, maxTouchPoints: 5, navigatorStandalone: false })
-    render(<InstallHint />)
-    expect(screen.getByRole('note')).toHaveTextContent(copy)
-  })
-
-  it('is hidden when navigator.standalone is true', () => {
-    mockDevice({ userAgent: IPHONE_SAFARI, maxTouchPoints: 5, navigatorStandalone: true })
-    render(<InstallHint />)
-    expect(screen.queryByRole('note')).toBeNull()
-  })
-
-  it('is hidden when display-mode is standalone', () => {
-    mockDevice({ userAgent: IPHONE_SAFARI, maxTouchPoints: 5, displayStandalone: true })
-    render(<InstallHint />)
-    expect(screen.queryByRole('note')).toBeNull()
-  })
-
-  it.each([
-    ['Android Chrome', { userAgent: ANDROID_CHROME, maxTouchPoints: 5 }],
-    ['desktop Chrome', { userAgent: DESKTOP_CHROME }],
-    ['desktop Safari on a Mac', { userAgent: MAC_SAFARI }],
-    ['Chrome on iPhone', { userAgent: IPHONE_CHROME, maxTouchPoints: 5 }],
-    ['Firefox on iPhone', { userAgent: IPHONE_FIREFOX, maxTouchPoints: 5 }],
-    ['Edge on iPhone', { userAgent: IPHONE_EDGE, maxTouchPoints: 5 }],
-    ['Opera on iPhone', { userAgent: IPHONE_OPERA, maxTouchPoints: 5 }],
-    ['MQQBrowser on iPhone', { userAgent: IPHONE_MQQBROWSER, maxTouchPoints: 5 }],
-  ])('is hidden on %s', (_name, device: Device) => {
-    mockDevice(device)
-    render(<InstallHint />)
-    expect(screen.queryByRole('note')).toBeNull()
-  })
-
-  it('stays dismissed on this device', () => {
-    mockDevice({ userAgent: IPHONE_SAFARI, maxTouchPoints: 5, navigatorStandalone: false })
-    const first = render(<InstallHint />)
-    fireEvent.click(screen.getByRole('button', { name: 'Dismiss' }))
-    expect(screen.queryByRole('note')).toBeNull()
-    expect(localStorage.getItem(DISMISSED_KEY)).toBe('1')
-
-    first.unmount()
-    render(<InstallHint />)
-    expect(screen.queryByRole('note')).toBeNull()
-  })
-
-  it('stays up and reports the error when the dismissal cannot be saved', () => {
-    mockDevice({ userAgent: IPHONE_SAFARI, maxTouchPoints: 5, navigatorStandalone: false })
-    const setItem = vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
-      throw new DOMException('quota exceeded', 'QuotaExceededError')
-    })
-
-    render(<InstallHint />)
-    fireEvent.click(screen.getByRole('button', { name: 'Dismiss' }))
-    expect(screen.getByRole('note')).toHaveTextContent(copy)
-    expect(screen.getByRole('alert')).toHaveTextContent(
-      'Could not remember on this device that this hint was dismissed: QuotaExceededError: quota exceeded',
-    )
-
-    setItem.mockRestore()
-    fireEvent.click(screen.getByRole('button', { name: 'Retry' }))
-    expect(screen.queryByRole('note')).toBeNull()
-    expect(screen.queryByRole('alert')).toBeNull()
-    expect(localStorage.getItem(DISMISSED_KEY)).toBe('1')
-  })
-
-  it('shows and reports the error when storage cannot be read', () => {
-    mockDevice({ userAgent: IPHONE_SAFARI, maxTouchPoints: 5, navigatorStandalone: false })
-    const getItem = vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
-      throw new DOMException('storage blocked', 'SecurityError')
-    })
-
-    render(<InstallHint />)
-    expect(screen.getByRole('note')).toHaveTextContent(copy)
-    expect(screen.getByRole('alert')).toHaveTextContent(
-      'Could not check whether this hint was dismissed on this device: SecurityError: storage blocked',
-    )
-
-    getItem.mockRestore()
-    fireEvent.click(screen.getByRole('button', { name: 'Retry' }))
-    expect(screen.getByRole('note')).toHaveTextContent(copy)
-    expect(screen.queryByRole('alert')).toBeNull()
-  })
-})

web/src/pwa/InstallHint.tsx

@@ -1,97 +0,0 @@
-import { useState } from 'react'
-import { Share, X } from 'lucide-react'
-import { Card } from '../ui/Card.tsx'
-import { ErrorBanner } from '../ui/ErrorBanner.tsx'
-import { Icon } from '../ui/Icon.tsx'
-import { IconButton } from '../ui/IconButton.tsx'
-import styles from './InstallHint.module.css'
-
-// DISMISSED_KEY is the localStorage key remembering, on this device, that the
-// household dismissed the hint.
-export const DISMISSED_KEY = 'mealquest.installHint.dismissed'
-
-// Safari's user agent ends "(KHTML, like Gecko) Version/<v> Mobile/<build>
-// Safari/<v>" (iPadOS leaves out Mobile/). Every other iOS browser and in-app
-// web view adds its own token (CriOS, FxiOS, EdgiOS, OPiOS, MQQBrowser, GSA,
-// ...) or drops Version/ or Safari/, so only this exact tail is Safari.
-const SAFARI_TAIL = /\(KHTML, like Gecko\) Version\/[\d.]+ (?:Mobile\/\w+ )?Safari\/[\d.]+$/
-
-// isIosSafari reports whether the page is open in Safari on iPhone, iPod or
-// iPad. iPadOS 13+ asks for the desktop site and reports itself as a Mac, so
-// a "Macintosh" with a touch screen is an iPad.
-export function isIosSafari(nav: Pick<Navigator, 'userAgent' | 'maxTouchPoints'>): boolean {
-  const ua = nav.userAgent
-  const ios = /iPhone|iPod|iPad/.test(ua) || (/Macintosh/.test(ua) && nav.maxTouchPoints > 1)
-  return ios && SAFARI_TAIL.test(ua)
-}
-
-// isStandalone reports whether the app is running from the Home Screen.
-// Safari sets navigator.standalone; other browsers answer the display-mode
-// media query.
-export function isStandalone(): boolean {
-  const legacy = (navigator as Navigator & { standalone?: boolean }).standalone
-  return legacy === true || window.matchMedia('(display-mode: standalone)').matches
-}
-
-// HintState is whether the household dismissed the hint on this device, and
-// the storage failure, if any, that stopped us reading or saving that.
-type HintState = {
-  dismissed: boolean
-  failure: { action: 'read' | 'write'; message: string } | null
-}
-
-// Storage can be unavailable (blocked by the browser or privacy settings), in
-// which case using it throws. The failure is reported, never treated as a
-// remembered dismissal.
-function readDismissed(): HintState {
-  try {
-    return { dismissed: window.localStorage.getItem(DISMISSED_KEY) === '1', failure: null }
-  } catch (err) {
-    return { dismissed: false, failure: { action: 'read', message: String(err) } }
-  }
-}
-
-function writeDismissed(): HintState {
-  try {
-    window.localStorage.setItem(DISMISSED_KEY, '1')
-    return { dismissed: true, failure: null }
-  } catch (err) {
-    return { dismissed: false, failure: { action: 'write', message: String(err) } }
-  }
-}
-
-const failureText = {
-  read: 'Could not check whether this hint was dismissed on this device',
-  write: 'Could not remember on this device that this hint was dismissed',
-}
-
-// InstallHint tells iOS and iPadOS Safari users how to install the app, which
-// iOS requires before it delivers Web Push. It shows only in a Safari browser
-// tab, never once installed, and stays dismissed on this device. If storage
-// fails, the hint stays up with an error saying so. Used by onboarding step 3
-// and the Notifications screen.
-export function InstallHint() {
-  const [eligible] = useState(() => isIosSafari(navigator) && !isStandalone())
-  const [state, setState] = useState<HintState>(() =>
-    eligible ? readDismissed() : { dismissed: false, failure: null },
-  )
-  if (!eligible || state.dismissed) return null
-
-  const { failure } = state
-  return (
-    <>
-      <Card tone="muted" role="note" className={styles.hint}>
-        <Icon icon={Share} className={styles.icon} />
-        <p className={styles.message}>Tap Share, then Add to Home Screen to get notifications</p>
-        <IconButton label="Dismiss" onClick={() => setState(writeDismissed())}>
-          <Icon icon={X} />
-        </IconButton>
-      </Card>
-      {failure && (
-        <ErrorBanner onRetry={() => setState(failure.action === 'read' ? readDismissed() : writeDismissed())}>
-          {failureText[failure.action]}: {failure.message}
-        </ErrorBanner>
-      )}
-    </>
-  )
-}

web/src/pwa/OfflinePill.module.css

@@ -1,22 +0,0 @@
-.pill {
-  position: fixed;
-  top: calc(var(--space-3) + env(safe-area-inset-top));
-  left: 50%;
-  z-index: 20;
-  transform: translateX(-50%);
-  display: inline-flex;
-  align-items: center;
-  gap: var(--space-2);
-  margin: 0;
-  padding: 6px 14px;
-  border-radius: var(--radius-pill);
-  background: var(--color-neutral-800);
-  color: var(--on-accent);
-  box-shadow: var(--shadow-md);
-  font-family: var(--font-body);
-  font-size: 13px;
-  font-weight: 700;
-  line-height: 1.2;
-  white-space: nowrap;
-  pointer-events: none;
-}

web/src/pwa/OfflinePill.test.tsx

@@ -1,150 +0,0 @@
-import { act, render, screen } from '@testing-library/react'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { ApiProvider, createApiClient, createVerifiedSession, type ApiClient } from '../api/index.ts'
-import { fakeLocation, jsonResponse, ME, stubFetch } from '../test/fetchStub.ts'
-import { cacheFallbackHeader } from '../sw/routes.ts'
-import { createNetworkStatus } from './networkStatus.ts'
-import { OfflinePill } from './OfflinePill.tsx'
-
-const copy = 'Offline — showing saved data'
-
-let onLine: boolean
-
-beforeEach(() => {
-  onLine = true
-  vi.spyOn(navigator, 'onLine', 'get').mockImplementation(() => onLine)
-})
-
-afterEach(() => {
-  vi.restoreAllMocks()
-  vi.unstubAllGlobals()
-})
-
-function goOffline() {
-  onLine = false
-  window.dispatchEvent(new Event('offline'))
-}
-
-function goOnline() {
-  onLine = true
-  window.dispatchEvent(new Event('online'))
-}
-
-function renderPill(): ApiClient {
-  const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
-  render(
-    <ApiProvider client={api}>
-      <OfflinePill />
-    </ApiProvider>,
-  )
-  return api
-}
-
-describe('OfflinePill', () => {
-  it('is hidden while online', () => {
-    renderPill()
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('shows while the browser is offline when it renders', () => {
-    onLine = false
-    renderPill()
-    expect(screen.getByRole('status')).toHaveTextContent(copy)
-  })
-
-  it('appears on the offline event and disappears on the online event', () => {
-    renderPill()
-    act(goOffline)
-    expect(screen.getByRole('status')).toHaveTextContent(copy)
-    act(goOnline)
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('appears when a request fails with a network error', async () => {
-    const api = renderPill()
-    vi.stubGlobal('fetch', vi.fn<typeof fetch>().mockRejectedValue(new TypeError('Failed to fetch')))
-    await act(() => expect(api.apiFetch('/api/v1/plan')).rejects.toThrow(TypeError))
-    expect(screen.getByRole('status')).toHaveTextContent(copy)
-
-    act(goOnline)
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('disappears when a later request gets a response', async () => {
-    const api = renderPill()
-    vi.stubGlobal('fetch', vi.fn<typeof fetch>().mockRejectedValue(new TypeError('Failed to fetch')))
-    await act(() => expect(api.apiFetch('/api/v1/plan')).rejects.toThrow(TypeError))
-    expect(screen.getByRole('status')).toBeInTheDocument()
-
-    stubFetch(jsonResponse(200, {}))
-    await act(() => api.apiFetch('/api/v1/plan'))
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('shows while online when the service worker answers from its cache', async () => {
-    const api = renderPill()
-    const cached = jsonResponse(200, { id: '01J9ZR' })
-    cached.headers.set(cacheFallbackHeader, '1')
-    stubFetch(cached, jsonResponse(200, { id: '01J9ZR' }))
-
-    await act(() => api.apiFetch('/api/v1/recipes/01J9ZR'))
-    expect(navigator.onLine).toBe(true)
-    expect(screen.getByRole('status')).toHaveTextContent(copy)
-
-    // The server answers again.
-    await act(() => api.apiFetch('/api/v1/recipes/01J9ZR'))
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('ignores a request body that cannot be serialized', async () => {
-    const api = renderPill()
-    const fetchMock = stubFetch(jsonResponse(200, ME))
-    await act(() => api.loadMe())
-    const body: Record<string, unknown> = {}
-    body.self = body
-
-    await act(() =>
-      expect(api.apiFetch('/api/v1/plan', { method: 'PUT', body })).rejects.toThrow(
-        'PUT /api/v1/plan: request body is not serializable as JSON',
-      ),
-    )
-    expect(fetchMock).toHaveBeenCalledTimes(1)
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('ignores a GET request with a body, which fetch would refuse to send', async () => {
-    const api = renderPill()
-    const fetchMock = stubFetch()
-
-    await act(() =>
-      expect(api.apiFetch('/api/v1/plan', { body: { week: 1 } })).rejects.toThrow(
-        'GET /api/v1/plan: a GET request cannot carry a body',
-      ),
-    )
-    expect(fetchMock).not.toHaveBeenCalled()
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('ignores an aborted request', async () => {
-    const api = renderPill()
-    vi.stubGlobal('fetch', vi.fn<typeof fetch>().mockRejectedValue(new DOMException('aborted', 'AbortError')))
-    await act(() => expect(api.apiFetch('/api/v1/plan')).rejects.toThrow('aborted'))
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('removes its online and offline listeners on unmount', () => {
-    const add = vi.spyOn(window, 'addEventListener')
-    const remove = vi.spyOn(window, 'removeEventListener')
-    const api = createApiClient(fakeLocation(), createNetworkStatus(window), createVerifiedSession(localStorage))
-    const { unmount } = render(
-      <ApiProvider client={api}>
-        <OfflinePill />
-      </ApiProvider>,
-    )
-    const added = add.mock.calls.filter(([type]) => type === 'online' || type === 'offline')
-    expect(added.map(([type]) => type).sort()).toEqual(['offline', 'online'])
-
-    unmount()
-    for (const [type, listener] of added) expect(remove).toHaveBeenCalledWith(type, listener)
-  })
-})

web/src/pwa/OfflinePill.tsx

@@ -1,19 +0,0 @@
-import { useSyncExternalStore } from 'react'
-import { WifiOff } from 'lucide-react'
-import { useApi } from '../api/index.ts'
-import { Icon } from '../ui/Icon.tsx'
-import styles from './OfflinePill.module.css'
-
-// OfflinePill tells the household that what they see came from the cache
-// while the browser is offline or the server cannot be reached.
-export function OfflinePill() {
-  const { network } = useApi()
-  const offline = useSyncExternalStore(network.subscribe, network.offline)
-  if (!offline) return null
-  return (
-    <p role="status" className={styles.pill}>
-      <Icon icon={WifiOff} />
-      Offline — showing saved data
-    </p>
-  )
-}

web/src/pwa/UpdatePrompt.module.css

@@ -1,22 +0,0 @@
-.toast {
-  position: fixed;
-  left: 50%;
-  bottom: calc(110px + env(safe-area-inset-bottom));
-  z-index: 20;
-  transform: translateX(-50%);
-  display: flex;
-  align-items: center;
-  gap: var(--space-3);
-  width: max-content;
-  max-width: calc(100vw - 2 * var(--space-4));
-  padding: var(--space-2) var(--space-2) var(--space-2) var(--space-4);
-  box-shadow: var(--shadow-lg);
-}
-
-.message {
-  margin: 0;
-  font-family: var(--font-body);
-  font-size: 15px;
-  font-weight: 600;
-  line-height: 1.35;
-}

web/src/pwa/UpdatePrompt.test.tsx

@@ -1,165 +0,0 @@
-import { act, render, screen } from '@testing-library/react'
-import { describe, expect, it, vi } from 'vitest'
-import { SKIP_WAITING, UpdatePrompt, type UpdateContainer } from './UpdatePrompt.tsx'
-
-// FakeWorker is a ServiceWorker whose state the test moves along.
-class FakeWorker extends EventTarget {
-  state: ServiceWorkerState = 'installing'
-  postMessage = vi.fn()
-  setState(state: ServiceWorkerState) {
-    this.state = state
-    this.dispatchEvent(new Event('statechange'))
-  }
-}
-
-class FakeRegistration extends EventTarget {
-  installing: FakeWorker | null = null
-  waiting: FakeWorker | null = null
-  // install starts a new worker, as the browser does on finding an update.
-  install(): FakeWorker {
-    const worker = new FakeWorker()
-    this.installing = worker
-    this.dispatchEvent(new Event('updatefound'))
-    return worker
-  }
-  // finishInstall moves the installing worker to waiting.
-  finishInstall(worker: FakeWorker) {
-    this.installing = null
-    this.waiting = worker
-    worker.setState('installed')
-  }
-}
-
-class FakeContainer extends EventTarget {
-  controller: object | null = {}
-  registration = new FakeRegistration()
-  ready = Promise.resolve(this.registration)
-  // takeOver makes the waiting worker the controller.
-  takeOver() {
-    const worker = this.registration.waiting
-    this.registration.waiting = null
-    this.controller = worker
-    worker?.setState('activated')
-    this.dispatchEvent(new Event('controllerchange'))
-  }
-}
-
-async function renderPrompt(container: FakeContainer | undefined) {
-  const reload = vi.fn()
-  const view = render(<UpdatePrompt container={container as unknown as UpdateContainer} reload={reload} />)
-  await act(async () => {
-    await container?.ready
-  })
-  return { reload, ...view }
-}
-
-const copy = 'New version ready · Reload'
-
-describe('UpdatePrompt', () => {
-  it('shows nothing without a service worker', async () => {
-    await renderPrompt(undefined)
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('shows nothing while no worker is waiting', async () => {
-    const container = new FakeContainer()
-    await renderPrompt(container)
-    act(() => {
-      container.registration.install()
-    })
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('shows nothing for a waiting worker when the page has no controller', async () => {
-    const container = new FakeContainer()
-    container.controller = null
-    container.registration.waiting = new FakeWorker()
-    await renderPrompt(container)
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('shows the toast for a worker already waiting when the page loads', async () => {
-    const container = new FakeContainer()
-    container.registration.waiting = new FakeWorker()
-    await renderPrompt(container)
-    expect(screen.getByRole('status')).toHaveTextContent(copy)
-  })
-
-  it('shows the toast when an update finishes installing', async () => {
-    const container = new FakeContainer()
-    await renderPrompt(container)
-    act(() => container.registration.finishInstall(container.registration.install()))
-    expect(screen.getByRole('status')).toHaveTextContent(copy)
-  })
-
-  it('sends SKIP_WAITING on Reload and reloads once the new worker controls the page', async () => {
-    const container = new FakeContainer()
-    const { reload } = await renderPrompt(container)
-    const worker = container.registration.install()
-    act(() => container.registration.finishInstall(worker))
-
-    act(() => screen.getByRole('button', { name: 'Reload' }).click())
-    expect(worker.postMessage).toHaveBeenCalledExactlyOnceWith(SKIP_WAITING)
-    expect(screen.queryByRole('status')).toBeNull()
-    expect(reload).not.toHaveBeenCalled()
-
-    act(() => container.takeOver())
-    expect(reload).toHaveBeenCalledOnce()
-    // A later controller change (another tab's update) does not reload again.
-    act(() => container.dispatchEvent(new Event('controllerchange')))
-    expect(reload).toHaveBeenCalledOnce()
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('does not reappear for the worker the household chose to reload into', async () => {
-    const container = new FakeContainer()
-    container.registration.waiting = new FakeWorker()
-    await renderPrompt(container)
-    act(() => screen.getByRole('button', { name: 'Reload' }).click())
-    // The worker reports another state change before it takes over.
-    act(() => container.registration.waiting?.setState('installed'))
-    expect(screen.queryByRole('status')).toBeNull()
-  })
-
-  it('hides when dismissed until the next update is waiting', async () => {
-    const container = new FakeContainer()
-    const { reload } = await renderPrompt(container)
-    const first = container.registration.install()
-    act(() => container.registration.finishInstall(first))
-
-    act(() => screen.getByRole('button', { name: 'Dismiss' }).click())
-    expect(screen.queryByRole('status')).toBeNull()
-    expect(first.postMessage).not.toHaveBeenCalled()
-    act(() => first.setState('installed'))
-    expect(screen.queryByRole('status')).toBeNull()
-
-    act(() => container.registration.finishInstall(container.registration.install()))
-    expect(screen.getByRole('status')).toHaveTextContent(copy)
-    expect(reload).not.toHaveBeenCalled()
-  })
-
-  it('hides when another tab activates the waiting worker', async () => {
-    const container = new FakeContainer()
-    container.registration.waiting = new FakeWorker()
-    const { reload } = await renderPrompt(container)
-    act(() => container.takeOver())
-    expect(screen.queryByRole('status')).toBeNull()
-    expect(reload).not.toHaveBeenCalled()
-  })
-
-  it('removes its listeners on unmount', async () => {
-    const container = new FakeContainer()
-    const worker = new FakeWorker()
-    container.registration.waiting = worker
-    const { reload, unmount } = await renderPrompt(container)
-    const removeRegistration = vi.spyOn(container.registration, 'removeEventListener')
-    const removeWorker = vi.spyOn(worker, 'removeEventListener')
-    act(() => screen.getByRole('button', { name: 'Reload' }).click())
-
-    unmount()
-    expect(removeRegistration).toHaveBeenCalledWith('updatefound', expect.any(Function))
-    expect(removeWorker).toHaveBeenCalledWith('statechange', expect.any(Function))
-    container.takeOver()
-    expect(reload).not.toHaveBeenCalled()
-  })
-})

web/src/pwa/UpdatePrompt.tsx

@@ -1,101 +0,0 @@
-import { useEffect, useRef, useState } from 'react'
-import { X } from 'lucide-react'
-import { Button } from '../ui/Button.tsx'
-import { Card } from '../ui/Card.tsx'
-import { Icon } from '../ui/Icon.tsx'
-import { IconButton } from '../ui/IconButton.tsx'
-import styles from './UpdatePrompt.module.css'
-
-// UpdateContainer is the part of navigator.serviceWorker the prompt uses.
-export type UpdateContainer = Pick<ServiceWorkerContainer, 'ready' | 'controller' | 'addEventListener' | 'removeEventListener'>
-
-export type UpdatePromptProps = {
-  // navigator.serviceWorker, or undefined where the browser has none.
-  container: UpdateContainer | undefined
-  // Reloads the page once the new worker controls it.
-  reload: () => void
-}
-
-// SKIP_WAITING is the message src/sw.ts answers by activating the waiting
-// worker.
-export const SKIP_WAITING = { type: 'SKIP_WAITING' } as const
-
-// UpdatePrompt offers to reload when a new service worker is installed and
-// waiting to replace the one controlling the page. Reload asks the waiting
-// worker to activate and reloads once it controls the page; dismissing hides
-// the prompt until a different worker is waiting.
-export function UpdatePrompt({ container, reload }: UpdatePromptProps) {
-  const [waiting, setWaiting] = useState<ServiceWorker | null>(null)
-  const [dismissed, setDismissed] = useState<ServiceWorker | null>(null)
-  const [accepted, setAccepted] = useState<ServiceWorker | null>(null)
-  const reloadListener = useRef<(() => void) | null>(null)
-
-  useEffect(() => {
-    if (container === undefined) return
-    const sw = container
-    let registration: ServiceWorkerRegistration | null = null
-    let unmounted = false
-    const watched = new Set<ServiceWorker>()
-
-    // A waiting worker only replaces something when the page has a
-    // controller; without one there is no controllerchange to reload on.
-    function check() {
-      if (registration === null) return
-      setWaiting(sw.controller === null ? null : registration.waiting)
-    }
-    function watch(worker: ServiceWorker | null) {
-      if (worker === null || watched.has(worker)) return
-      watched.add(worker)
-      worker.addEventListener('statechange', check)
-    }
-    function updateFound() {
-      watch(registration?.installing ?? null)
-    }
-
-    void sw.ready.then((ready) => {
-      if (unmounted) return
-      registration = ready
-      ready.addEventListener('updatefound', updateFound)
-      watch(ready.installing)
-      watch(ready.waiting)
-      check()
-    })
-    return () => {
-      unmounted = true
-      registration?.removeEventListener('updatefound', updateFound)
-      watched.forEach((worker) => worker.removeEventListener('statechange', check))
-      if (reloadListener.current !== null) {
-        sw.removeEventListener('controllerchange', reloadListener.current)
-        reloadListener.current = null
-      }
-    }
-  }, [container])
-
-  if (container === undefined || waiting === null || waiting === dismissed || waiting === accepted) return null
-
-  function update() {
-    if (container === undefined || waiting === null || reloadListener.current !== null) return
-    const listener = () => {
-      reloadListener.current = null
-      reload()
-    }
-    reloadListener.current = listener
-    container.addEventListener('controllerchange', listener, { once: true })
-    setAccepted(waiting)
-    waiting.postMessage(SKIP_WAITING)
-  }
-
-  return (
-    <Card role="status" className={styles.toast}>
-      <p className={styles.message}>
-        New version ready <span aria-hidden="true">·</span>
-      </p>
-      {/* The space keeps the copy "New version ready · Reload" in the text;
-          a flex container does not render it. */}{' '}
-      <Button onClick={update}>Reload</Button>
-      <IconButton label="Dismiss" onClick={() => setDismissed(waiting)}>
-        <Icon icon={X} />
-      </IconButton>
-    </Card>
-  )
-}

web/src/pwa/networkStatus.ts

@@ -1,51 +0,0 @@
-// NetworkWindow is the part of window the network status reads: the browser's
-// online flag and its online/offline events.
-export type NetworkWindow = Pick<Window, 'navigator' | 'addEventListener' | 'removeEventListener'>
-
-export type NetworkStatus = {
-  // offline reports whether the browser says it is offline or the last API
-  // request failed with a network error or was answered from the cache.
-  offline(): boolean
-  // subscribe is notified when offline may have changed. It listens for the
-  // window's online/offline events until the returned function is called.
-  subscribe(listener: () => void): () => void
-  // requestFailed records a fetch that rejected with a network error or that
-  // the service worker answered from its cache.
-  requestFailed(): void
-  // requestSucceeded records a fetch the server answered.
-  requestSucceeded(): void
-}
-
-// createNetworkStatus tracks whether MealQuest can reach the server. A failed
-// request counts as offline until a later request gets a response or the
-// browser reports that it is back online.
-export function createNetworkStatus(win: NetworkWindow): NetworkStatus {
-  let failed = false
-  const listeners = new Set<() => void>()
-
-  function setFailed(value: boolean) {
-    if (failed === value) return
-    failed = value
-    listeners.forEach((listener) => listener())
-  }
-
-  return {
-    offline: () => !win.navigator.onLine || failed,
-    subscribe(listener) {
-      const online = () => {
-        failed = false
-        listener()
-      }
-      listeners.add(listener)
-      win.addEventListener('online', online)
-      win.addEventListener('offline', listener)
-      return () => {
-        listeners.delete(listener)
-        win.removeEventListener('online', online)
-        win.removeEventListener('offline', listener)
-      }
-    },
-    requestFailed: () => setFailed(true),
-    requestSucceeded: () => setFailed(false),
-  }
-}

web/src/sw.ts

@@ -1,115 +0,0 @@
-// MealQuest service worker. vite-plugin-pwa replaces self.__WB_MANIFEST with
-// the build's precache list (shell, JS, CSS and fonts, each with a revision).
-// Every other request goes through the route src/sw/routes.ts decides.
-// A network-only request is left to the browser: the worker never answers it,
-// so it reaches the network exactly as the page sent it. That matters for
-// POST /auth/logout, whose Clear-Site-Data header wipes the worker and its
-// caches — Chrome stalls that navigation when the worker answers it.
-// Fonts are precached too, but their route is registered ahead of the
-// precache route, so a font fetch goes through the expiring CacheFirst
-// strategy and falls back to the precached copy when the network fails.
-
-import { cacheNames as workboxCacheNames, setCacheNameDetails } from 'workbox-core'
-import type { RouteHandlerCallbackOptions } from 'workbox-core/types'
-import { ExpirationPlugin } from 'workbox-expiration'
-import { PrecacheFallbackPlugin, matchPrecache, precacheAndRoute } from 'workbox-precaching'
-import { registerRoute } from 'workbox-routing'
-import { CacheFirst, NetworkOnly, type Strategy } from 'workbox-strategies'
-import { createApiStrategy } from './sw/apiStrategy'
-import {
-  cacheNames,
-  cacheVersion,
-  routeFor,
-  staleCaches,
-  type Route,
-} from './sw/routes'
-
-declare const self: ServiceWorkerGlobalScope & {
-  __WB_MANIFEST: Array<{ url: string; revision: string | null }>
-}
-
-// The precache becomes mealquest-precache-v1.
-setCacheNameDetails({ prefix: 'mealquest', precache: 'precache', suffix: cacheVersion })
-
-const day = 24 * 60 * 60
-
-const strategies = {
-  [cacheNames.api]: createApiStrategy(),
-  [cacheNames.media]: new CacheFirst({
-    cacheName: cacheNames.media,
-    plugins: [
-      new ExpirationPlugin({ maxEntries: 200, maxAgeSeconds: 30 * day, purgeOnQuotaError: true }),
-    ],
-  }),
-  [cacheNames.fonts]: new CacheFirst({
-    cacheName: cacheNames.fonts,
-    plugins: [
-      new ExpirationPlugin({ maxEntries: 20, maxAgeSeconds: 365 * day, purgeOnQuotaError: true }),
-      // Offline with no runtime copy yet: the font from the precache.
-      { handlerDidError: async ({ request }) => matchPrecache(request.url) },
-    ],
-  }),
-}
-const navigation = new NetworkOnly({
-  plugins: [new PrecacheFallbackPlugin({ fallbackURL: 'index.html' })],
-})
-
-type AnsweredRoute = Exclude<Route, { strategy: 'network-only' }>
-
-function strategyFor(route: AnsweredRoute): Strategy {
-  switch (route.strategy) {
-    case 'network-first':
-    case 'cache-first':
-      return strategies[route.cacheName]
-    case 'navigation-fallback':
-      return navigation
-  }
-}
-
-function routeOf({ request, url }: { request: Request; url: URL }): Route {
-  return routeFor({ method: request.method, url, mode: request.mode }, self.location.origin)
-}
-
-// answered matches every request the worker answers: all but network-only.
-function answered(options: { request: Request; url: URL }): boolean {
-  return routeOf(options).strategy !== 'network-only'
-}
-
-function handle({ request, url, event }: RouteHandlerCallbackOptions): Promise<Response> {
-  const route = routeOf({ request, url })
-  if (route.strategy === 'network-only') {
-    throw new Error(`the worker never answers network-only ${request.method} ${url.href}`)
-  }
-  return strategyFor(route).handle({ request, event })
-}
-
-function isFont(options: { request: Request; url: URL }): boolean {
-  const route = routeOf(options)
-  return route.strategy === 'cache-first' && route.cacheName === cacheNames.fonts
-}
-
-// Workbox uses the first route that matches, so the font route comes before
-// the precache route, which would otherwise answer every precached font.
-registerRoute(isFont, handle, 'GET')
-precacheAndRoute(self.__WB_MANIFEST)
-
-// Workbox routes are per method; every method goes through routeFor, which
-// sends every non-GET to the network only, so only GETs are ever answered.
-for (const method of ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE'] as const) {
-  registerRoute(answered, handle, method)
-}
-
-self.addEventListener('activate', (event) => {
-  const current = [workboxCacheNames.precache, ...Object.values(cacheNames)]
-  event.waitUntil(
-    caches
-      .keys()
-      .then((names) => Promise.all(staleCaches(names, current).map((name) => caches.delete(name)))),
-  )
-})
-
-// The update prompt (src/pwa/UpdatePrompt.tsx) asks a waiting worker to take
-// over when the household chooses Reload.
-self.addEventListener('message', (event) => {
-  if (event.data?.type === 'SKIP_WAITING') void self.skipWaiting()
-})

web/src/sw/apiStrategy.test.ts

@@ -1,165 +0,0 @@
-// Runs the real Workbox network-first strategy against an in-memory cache
-// storage: jsdom has none, and the worker itself needs service worker globals.
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type { RouteHandlerCallbackOptions } from 'workbox-core/types'
-import { createApiClient, createVerifiedSession } from '../api/index.ts'
-import { createNetworkStatus } from '../pwa/networkStatus.ts'
-import { fakeLocation, jsonResponse } from '../test/fetchStub.ts'
-import { createApiStrategy } from './apiStrategy'
-import { cacheFallbackHeader, cacheNames, routeFor } from './routes'
-
-const origin = 'https://mealquest.test'
-
-// FakeCache keys entries by URL, which is all the API cache needs.
-class FakeCache {
-  readonly entries = new Map<string, Response>()
-  async match(request: RequestInfo | URL): Promise<Response | undefined> {
-    return this.entries.get(new Request(request).url)?.clone()
-  }
-  async put(request: RequestInfo | URL, response: Response): Promise<void> {
-    this.entries.set(new Request(request).url, response)
-  }
-}
-
-// FakeExtendableEvent stands in for the worker-only ExtendableEvent,
-// collecting the promises the strategy waits on.
-class FakeExtendableEvent extends Event {
-  readonly pending: Promise<unknown>[] = []
-  waitUntil(promise: Promise<unknown>) {
-    this.pending.push(promise)
-  }
-}
-
-let cache: FakeCache
-
-beforeEach(() => {
-  cache = new FakeCache()
-  // Workbox checks its arguments against these worker-only globals.
-  vi.stubGlobal('FetchEvent', class FetchEvent {})
-  vi.stubGlobal('ExtendableEvent', FakeExtendableEvent)
-  const only = (name: string | undefined) => {
-    if (name !== cacheNames.api) throw new Error(`unexpected cache ${name}`)
-    return cache
-  }
-  vi.stubGlobal('caches', {
-    open: async (name: string) => only(name),
-    match: async (request: RequestInfo | URL, options?: MultiCacheQueryOptions) =>
-      only(options?.cacheName).match(request),
-  })
-})
-
-afterEach(() => {
-  vi.unstubAllGlobals()
-})
-
-// handle sends a GET through the API strategy, as src/sw.ts does for a
-// network-first route.
-async function handle(path: string): Promise<Response> {
-  return answer(new Request(new URL(path, origin)))
-}
-
-async function answer(request: Request): Promise<Response> {
-  expect(routeFor({ method: request.method, url: new URL(request.url), mode: 'cors' }, origin)).toEqual({
-    strategy: 'network-first',
-    cacheName: cacheNames.api,
-  })
-  const event = new FakeExtendableEvent('fetch')
-  const response = await createApiStrategy().handle({ request, event: event as unknown as RouteHandlerCallbackOptions['event'] })
-  await Promise.all(event.pending)
-  return response
-}
-
-function recipe(): Response {
-  return new Response(JSON.stringify({ id: '01J9ZR', name: 'Chicken tikka masala' }), {
-    status: 200,
-    headers: { 'Content-Type': 'application/json' },
-  })
-}
-
-describe('API strategy', () => {
-  it('answers from the network while the server is reachable, unmarked', async () => {
-    vi.stubGlobal('fetch', vi.fn<typeof fetch>().mockResolvedValue(recipe()))
-    const response = await handle('/api/v1/recipes/01J9ZR')
-    expect(response.headers.has(cacheFallbackHeader)).toBe(false)
-    expect(await response.json()).toMatchObject({ id: '01J9ZR' })
-    expect(cache.entries.has(`${origin}/api/v1/recipes/01J9ZR`)).toBe(true)
-  })
-
-  it('opens a previously viewed recipe offline, marked as a cache fallback', async () => {
-    vi.stubGlobal('fetch', vi.fn<typeof fetch>().mockResolvedValue(recipe()))
-    await handle('/api/v1/recipes/01J9ZR')
-
-    vi.stubGlobal('fetch', vi.fn<typeof fetch>().mockRejectedValue(new TypeError('Failed to fetch')))
-    const response = await handle('/api/v1/recipes/01J9ZR')
-    expect(response.headers.get(cacheFallbackHeader)).toBe('1')
-    expect(await response.json()).toEqual({ id: '01J9ZR', name: 'Chicken tikka masala' })
-  })
-
-  it('fails offline for a recipe never viewed', async () => {
-    vi.stubGlobal('fetch', vi.fn<typeof fetch>().mockRejectedValue(new TypeError('Failed to fetch')))
-    await expect(handle('/api/v1/recipes/01J9ZS')).rejects.toThrow()
-  })
-})
-
-describe('previously viewed plan and recipe reads', () => {
-  const plan = { week: '2026-W40', days: [{ date: '2026-10-05', dinner: 'Chicken tikka masala' }] }
-  const recipe = { id: '01J9ZR', name: 'Chicken tikka masala', steps: ['Marinate', 'Simmer'] }
-  const server: Record<string, unknown> = { '/api/v1/plans/2026-W40': plan, '/api/v1/recipes/01J9ZR': recipe }
-  let reachable: boolean
-
-  // The page's fetch goes through the worker's API strategy; the strategy's
-  // own fetch (always a Request) is the network. The API client fetches a
-  // path string, so the two are told apart by the argument's type. As in a
-  // browser, a worker that cannot answer is a network error to the page.
-  beforeEach(() => {
-    reachable = true
-    vi.spyOn(navigator, 'onLine', 'get').mockImplementation(() => reachable)
-    vi.stubGlobal('fetch', async (input: RequestInfo | URL, init?: RequestInit) => {
-      if (!(input instanceof Request)) {
-        return answer(new Request(new URL(String(input), origin), init)).catch((error: unknown) => {
-          throw new TypeError('Failed to fetch', { cause: error })
-        })
-      }
-      if (!reachable) throw new TypeError('Failed to fetch')
-      const body = server[new URL(input.url).pathname]
-      if (body === undefined) throw new Error(`unexpected network fetch: ${input.url}`)
-      return jsonResponse(200, body)
-    })
-  })
-
-  afterEach(() => {
-    vi.restoreAllMocks()
-  })
-
-  function client() {
-    return createApiClient(fakeLocation('/plan'), createNetworkStatus(window), createVerifiedSession(localStorage))
-  }
-
-  it('serves the plan and recipe fetched online once the network is gone', async () => {
-    const online = client()
-    expect(await online.apiFetch('/api/v1/plans/2026-W40')).toEqual(plan)
-    expect(await online.apiFetch('/api/v1/recipes/01J9ZR')).toEqual(recipe)
-    expect(online.network.offline()).toBe(false)
-
-    reachable = false
-    const offline = client()
-    expect(await offline.apiFetch('/api/v1/plans/2026-W40')).toEqual(plan)
-    expect(await offline.apiFetch('/api/v1/recipes/01J9ZR')).toEqual(recipe)
-    expect(offline.network.offline()).toBe(true)
-  })
-
-  it('shows the offline indicator when the cached copy answers while the browser reports online', async () => {
-    await client().apiFetch('/api/v1/plans/2026-W40')
-
-    vi.spyOn(navigator, 'onLine', 'get').mockReturnValue(true)
-    reachable = false
-    const api = client()
-    expect(await api.apiFetch('/api/v1/plans/2026-W40')).toEqual(plan)
-    expect(api.network.offline()).toBe(true)
-  })
-
-  it('fails offline for a plan never fetched', async () => {
-    reachable = false
-    await expect(client().apiFetch('/api/v1/plans/2026-W41')).rejects.toThrow(TypeError)
-  })
-})

web/src/sw/apiStrategy.ts

@@ -1,16 +0,0 @@
-// The network-first strategy for API reads, kept apart from src/sw.ts so the
-// tests can run it without a service worker.
-import type { WorkboxPlugin } from 'workbox-core/types'
-import { NetworkFirst } from 'workbox-strategies'
-import { cacheNames, markCacheFallback, networkTimeoutSeconds } from './routes'
-
-// NetworkFirst reads its cache only when the network fails or times out, so
-// every cached response it uses is a fallback.
-const markFallback: WorkboxPlugin = {
-  cachedResponseWillBeUsed: async ({ cachedResponse }) =>
-    cachedResponse === undefined ? undefined : markCacheFallback(cachedResponse),
-}
-
-export function createApiStrategy(): NetworkFirst {
-  return new NetworkFirst({ cacheName: cacheNames.api, networkTimeoutSeconds, plugins: [markFallback] })
-}

web/src/sw/routes.test.ts

@@ -1,180 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { cacheFallbackHeader, cacheNames, markCacheFallback, routeFor, staleCaches, type Route } from './routes'
-
-const origin = 'https://mealquest.test'
-
-function route(path: string, method = 'GET', mode: RequestMode = 'cors'): Route {
-  return routeFor({ method, url: new URL(path, origin), mode }, origin)
-}
-
-const apiCache: Route = { strategy: 'network-first', cacheName: cacheNames.api }
-const networkOnly: Route = { strategy: 'network-only' }
-
-describe('routeFor', () => {
-  it.each([
-    '/api/v1/plans',
-    '/api/v1/plans/2026-W40',
-    '/api/v1/shopping/current',
-    '/api/v1/dinners',
-    '/api/v1/dinners/01J9ZK?include=recipe',
-    '/api/v1/recipes',
-    '/api/v1/recipes/01J9ZR',
-    '/api/v1/home',
-  ])('GET %s is network-first in the API cache', (path) => {
-    expect(route(path)).toEqual(apiCache)
-  })
-
-  it.each(['/media/photos/abc.jpg', '/media/thumbs/abc.webp'])(
-    'GET %s is cache-first in the media cache',
-    (path) => {
-      expect(route(path)).toEqual({ strategy: 'cache-first', cacheName: cacheNames.media })
-    },
-  )
-
-  it('GET of a font file is cache-first in the fonts cache', () => {
-    expect(route('/assets/Figtree-Bold-a1b2c3.woff2')).toEqual({
-      strategy: 'cache-first',
-      cacheName: cacheNames.fonts,
-    })
-  })
-
-  it.each([
-    '/auth/login',
-    '/auth/callback?code=x&state=y',
-    '/auth/logout',
-    '/auth/me',
-    '/api/v1/settings',
-    '/api/v1/settings/ai',
-    '/api/v1/jobs',
-    '/api/v1/jobs/01J9ZK',
-  ])('GET %s is network-only', (path) => {
-    expect(route(path)).toEqual(networkOnly)
-  })
-
-  it.each(['/auth/login', '/auth/callback?code=x&state=y', '/api/v1/settings/ai'])(
-    'a navigation to %s is network-only with no offline fallback',
-    (path) => {
-      expect(route(path, 'GET', 'navigate')).toEqual(networkOnly)
-    },
-  )
-
-  it.each([
-    '/%61uth/login',
-    '/auth%2Fcallback?code=x&state=y',
-    '/%61pi/v1/settings/household',
-    '/api/v1/%73ettings/ai',
-    '/api/v1/settings%2Fai',
-    '/%61pi/v1/jobs/01J9ZK',
-    '/api/v1/j%6Fbs',
-    '/api/v1/plans%2F..%2Fsettings',
-    '/api/v1/recipes%2F..%2Fsettings%2Fai',
-    '/api/v1/recipes/..%2F..%2F..%2Fauth%2Flogin',
-    '/plan%2F..%2Fauth%2Flogin',
-  ])('an encoded reserved path %s is network-only, navigated or not', (path) => {
-    expect(route(path)).toEqual(networkOnly)
-    expect(route(path, 'GET', 'navigate')).toEqual(networkOnly)
-  })
-
-  it.each(['/%E0%A4%A', '/auth%', '/plan/%zz', '/api/v1/plans/%C3'])(
-    'a malformed encoding in %s is network-only, navigated or not',
-    (path) => {
-      expect(route(path)).toEqual(networkOnly)
-      expect(route(path, 'GET', 'navigate')).toEqual(networkOnly)
-    },
-  )
-
-  it('classifies other API paths by their decoded form', () => {
-    expect(route('/%61pi/v1/plans/2026-W40')).toEqual(apiCache)
-    expect(route('/%61pi/v1/recipes/01J9ZR')).toEqual(apiCache)
-    expect(route('/%61pi/v1/ideas', 'GET', 'navigate')).toEqual(networkOnly)
-  })
-
-  it.each(['POST', 'PUT', 'PATCH', 'DELETE', 'HEAD'])(
-    '%s is network-only on every URL class',
-    (method) => {
-      for (const path of [
-        '/api/v1/plans/2026-W40',
-        '/api/v1/shopping/current',
-        '/api/v1/dinners/01J9ZK',
-        '/api/v1/recipes/01J9ZR',
-        '/api/v1/home',
-        '/media/photos/abc.jpg',
-        '/assets/Figtree-Bold-a1b2c3.woff2',
-        '/auth/logout',
-        '/plan',
-      ]) {
-        expect(route(path, method), `${method} ${path}`).toEqual(networkOnly)
-        expect(route(path, method, 'navigate'), `${method} ${path}`).toEqual(networkOnly)
-      }
-    },
-  )
-
-  it('matches whole path segments only', () => {
-    expect(route('/api/v1/plansx')).toEqual(networkOnly)
-    expect(route('/api/v1/homepage')).toEqual(networkOnly)
-    expect(route('/api/v1/recipesx')).toEqual(networkOnly)
-    expect(route('/mediax/a.jpg')).toEqual(networkOnly)
-    expect(route('/authors')).toEqual(networkOnly)
-    expect(route('/api/v1/settingsx')).toEqual(networkOnly)
-  })
-
-  it('leaves other API calls network-only', () => {
-    expect(route('/api/v1/me')).toEqual(networkOnly)
-    expect(route('/api/v1/ideas', 'GET', 'navigate')).toEqual(networkOnly)
-  })
-
-  it('leaves cross-origin requests network-only', () => {
-    for (const path of ['/api/v1/plans', '/media/a.jpg', '/assets/a.woff2']) {
-      const url = new URL(path, 'https://cdn.example')
-      expect(routeFor({ method: 'GET', url, mode: 'no-cors' }, origin)).toEqual(networkOnly)
-    }
-  })
-
-  it.each(['/', '/plan', '/supply-run', '/dinners/01J9ZK'])(
-    'a navigation to the app at %s falls back to the precached index.html',
-    (path) => {
-      expect(route(path, 'GET', 'navigate')).toEqual({ strategy: 'navigation-fallback' })
-    },
-  )
-
-  it('leaves other same-origin GETs network-only', () => {
-    expect(route('/health')).toEqual(networkOnly)
-  })
-})
-
-describe('cache names', () => {
-  it('all start with mealquest-', () => {
-    for (const name of Object.values(cacheNames)) expect(name).toMatch(/^mealquest-/)
-  })
-})
-
-describe('staleCaches', () => {
-  it('deletes only MealQuest caches that are not current', () => {
-    const current = ['mealquest-precache-v1', ...Object.values(cacheNames)]
-    const names = [
-      ...current,
-      'mealquest-precache',
-      'mealquest-api-v0',
-      'workbox-precache-v2-https://mealquest.test/',
-      'other-app-cache',
-      'my-mealquest-cache',
-    ]
-    expect(staleCaches(names, current)).toEqual(['mealquest-precache', 'mealquest-api-v0'])
-  })
-})
-
-describe('markCacheFallback', () => {
-  it('copies the cached response with the cache fallback header set', async () => {
-    const cached = new Response('{"id":"01J9ZR"}', {
-      status: 200,
-      statusText: 'OK',
-      headers: { 'Content-Type': 'application/json' },
-    })
-    const marked = markCacheFallback(cached)
-    expect(marked.status).toBe(200)
-    expect(marked.statusText).toBe('OK')
-    expect(marked.headers.get('Content-Type')).toBe('application/json')
-    expect(marked.headers.get(cacheFallbackHeader)).toBe('1')
-    expect(await marked.json()).toEqual({ id: '01J9ZR' })
-  })
-})

web/src/sw/routes.ts

@@ -1,108 +0,0 @@
-// Decides how the service worker handles each request. This module is pure —
-// no Workbox, no service worker globals — so the tests can assert every URL
-// class without a worker; src/sw.ts maps each route to a Workbox strategy.
-//
-// Security rule: /auth/*, /api/v1/settings/*, /api/v1/jobs/* and every
-// non-GET request are network-only and never reach a cache. Paths are matched
-// as the server sees them — percent-decoded, before and after dot segments are
-// resolved — so /%61uth/login is /auth/login; a malformed encoding is
-// network-only.
-
-export type Route =
-  // Network with a 3 s timeout, then the last cached response.
-  | { strategy: 'network-first'; cacheName: typeof cacheNames.api }
-  // Cached response when there is one, else the network; entries expire.
-  | { strategy: 'cache-first'; cacheName: typeof cacheNames.media | typeof cacheNames.fonts }
-  // Network only, nothing cached: the worker leaves the request to the browser.
-  | { strategy: 'network-only' }
-  // Network only, nothing cached; offline, the precached index.html.
-  | { strategy: 'navigation-fallback' }
-
-export interface RouteRequest {
-  method: string
-  url: URL
-  mode: RequestMode
-}
-
-// Bumping the version renames every cache; activate then deletes the old ones.
-export const cacheVersion = 'v1'
-export const cachePrefix = 'mealquest-'
-
-export const cacheNames = {
-  api: `${cachePrefix}api-${cacheVersion}`,
-  media: `${cachePrefix}media-${cacheVersion}`,
-  fonts: `${cachePrefix}fonts-${cacheVersion}`,
-} as const
-
-export const networkTimeoutSeconds = 3
-
-// cacheFallbackHeader marks a network-first response answered from the cache
-// because the server could not be reached in time, so the app can show the
-// offline indicator even while the browser reports that it is online.
-export const cacheFallbackHeader = 'X-MealQuest-Cache-Fallback'
-
-// markCacheFallback copies a cached response with cacheFallbackHeader set.
-export function markCacheFallback(cached: Response): Response {
-  const headers = new Headers(cached.headers)
-  headers.set(cacheFallbackHeader, '1')
-  return new Response(cached.body, { status: cached.status, statusText: cached.statusText, headers })
-}
-
-const neverCached = ['/auth', '/api/v1/settings', '/api/v1/jobs']
-const networkFirst = ['/api/v1/plans', '/api/v1/shopping', '/api/v1/dinners', '/api/v1/recipes', '/api/v1/home']
-
-// True when path is prefix itself or a path below it: /api/v1/plans matches
-// /api/v1/plans and /api/v1/plans/2026-W40, never /api/v1/plansx.
-function under(path: string, prefix: string): boolean {
-  return path === prefix || path.startsWith(`${prefix}/`)
-}
-
-// The pathname percent-decoded, as the server's router sees it, or undefined
-// when the encoding is malformed.
-function decodePath(pathname: string): string | undefined {
-  try {
-    return decodeURIComponent(pathname)
-  } catch {
-    return undefined
-  }
-}
-
-// Resolves "." and ".." segments the way the server's path.Clean does, so a
-// decoded %2F cannot carry a request out of a reserved prefix:
-// /api/v1/plans/../settings cleans to /api/v1/settings.
-function cleanPath(path: string): string {
-  const segments: string[] = []
-  for (const segment of path.split('/')) {
-    if (segment === '' || segment === '.') continue
-    if (segment === '..') segments.pop()
-    else segments.push(segment)
-  }
-  return `/${segments.join('/')}`
-}
-
-const networkOnly: Route = { strategy: 'network-only' }
-
-export function routeFor(request: RouteRequest, origin: string): Route {
-  const { method, url, mode } = request
-  if (method !== 'GET') return networkOnly
-  if (url.origin !== origin) return networkOnly
-  const path = decodePath(url.pathname)
-  if (path === undefined) return networkOnly
-  const cleaned = cleanPath(path)
-  const reserved = (prefix: string) => under(path, prefix) || under(cleaned, prefix)
-  if (neverCached.some(reserved)) return networkOnly
-  if (networkFirst.some((prefix) => under(path, prefix))) {
-    return { strategy: 'network-first', cacheName: cacheNames.api }
-  }
-  if (under(path, '/media')) return { strategy: 'cache-first', cacheName: cacheNames.media }
-  if (path.endsWith('.woff2')) return { strategy: 'cache-first', cacheName: cacheNames.fonts }
-  if (reserved('/api')) return networkOnly
-  if (mode === 'navigate') return { strategy: 'navigation-fallback' }
-  return networkOnly
-}
-
-// The caches activate deletes: MealQuest caches that are no longer current.
-// Caches without the mealquest- prefix belong to someone else and are kept.
-export function staleCaches(names: readonly string[], current: readonly string[]): string[] {
-  return names.filter((name) => name.startsWith(cachePrefix) && !current.includes(name))
-}

web/src/sw/worker.test.ts

@@ -1,45 +0,0 @@
-// The service worker itself needs worker globals, so these tests read its
-// source: they pin the parts routes.ts cannot express — the API cache's
-// strategy, the font strategy's expiration, the font route's place ahead of
-// the precache route and network-only requests left to the browser.
-import { describe, expect, it } from 'vitest'
-import source from '../sw.ts?raw'
-
-describe('service worker source', () => {
-  it('serves the API cache with the strategy that marks cache fallbacks', () => {
-    expect(source).toContain('[cacheNames.api]: createApiStrategy(),')
-  })
-
-  it('gives the fonts cache a CacheFirst strategy with an expiration plugin', () => {
-    expect(source).toMatch(
-      /\[cacheNames\.fonts\]: new CacheFirst\(\{\s*cacheName: cacheNames\.fonts,\s*plugins: \[\s*new ExpirationPlugin\(\{ maxEntries: \d+, maxAgeSeconds: [^}]+\}\)/,
-    )
-  })
-
-  it('falls back to the precached font when the network fails', () => {
-    expect(source).toContain('handlerDidError: async ({ request }) => matchPrecache(request.url)')
-  })
-
-  it('registers the font route before the precache route', () => {
-    const fontRoute = source.indexOf("registerRoute(isFont, handle, 'GET')")
-    const precache = source.indexOf('precacheAndRoute(self.__WB_MANIFEST)')
-    expect(fontRoute).toBeGreaterThanOrEqual(0)
-    expect(precache).toBeGreaterThan(fontRoute)
-  })
-
-  it('leaves network-only requests to the browser instead of answering them', () => {
-    // Chrome stalls a navigation whose Clear-Site-Data response (POST
-    // /auth/logout) the worker answered, so the worker must not match it.
-    expect(source).toMatch(
-      /function answered\(options: \{ request: Request; url: URL \}\): boolean \{\s*return routeOf\(options\)\.strategy !== 'network-only'/,
-    )
-    expect(source).toContain('registerRoute(answered, handle, method)')
-    expect(source).not.toContain('registerRoute(() => true')
-  })
-
-  it('activates a waiting worker when the update prompt sends SKIP_WAITING', () => {
-    expect(source).toMatch(
-      /self\.addEventListener\('message', \(event\) => \{\s*if \(event\.data\?\.type === 'SKIP_WAITING'\) void self\.skipWaiting\(\)/,
-    )
-  })
-})

web/src/test/setup.ts

@@ -4,7 +4,4 @@ import { afterEach } from 'vitest'
 
 afterEach(() => {
   cleanup()
-  // The verified-session marker and other device state must not leak between
-  // tests. Tests in the node environment (src/pwa.test.ts) have no storage.
-  if (typeof localStorage !== 'undefined') localStorage.clear()
 })

web/tsconfig.json

@@ -13,11 +13,9 @@
     "noUncheckedIndexedAccess": true,
     "verbatimModuleSyntax": true,
     "isolatedModules": true,
-    "resolveJsonModule": true,
     "allowImportingTsExtensions": true,
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["src", "vite.config.ts", "manifest.json"],
-  "exclude": ["src/sw.ts"]
+  "include": ["src", "vite.config.ts"]
 }

web/tsconfig.sw.json

@@ -1,9 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "lib": ["ES2022", "WebWorker"],
-    "types": []
-  },
-  "include": ["src/sw.ts"],
-  "exclude": []
-}

web/vite.config.ts

@@ -1,30 +1,10 @@
 import { defineConfig } from 'vitest/config'
 import react from '@vitejs/plugin-react'
-import { VitePWA, type ManifestOptions } from 'vite-plugin-pwa'
-import manifest from './manifest.json' with { type: 'json' }
 
 const backend = 'http://localhost:8080'
 
 export default defineConfig({
-  plugins: [
-    react(),
-    // The plugin writes manifest.webmanifest and sw.js, links the manifest
-    // from index.html and adds the registerSW.js script. It does both only
-    // in production builds: dev options stay off, so neither `vite` nor
-    // Vitest registers a service worker.
-    VitePWA({
-      strategies: 'injectManifest',
-      srcDir: 'src',
-      filename: 'sw.ts',
-      injectRegister: 'script',
-      // Precache the shell, JS, CSS and the self-hosted fonts.
-      injectManifest: { globPatterns: ['**/*.{html,js,css,woff2}'] },
-      // The web manifest lives in manifest.json: its theme and background
-      // colours are --color-accent and --color-bg from src/styles/tokens.css,
-      // and hex colours may not be written in TypeScript.
-      manifest: manifest as Partial<ManifestOptions>,
-    }),
-  ],
+  plugins: [react()],
   server: {
     proxy: {
       '/api': backend,