Refresh repo docs to match what was built (Maestro 3b22e48b)

ARCHITECTURE.md: drop the Feature 01 "planned application" framing; add the missing packages (forwarded, secureurl, home, ai/aisettings) to the layout; add photo backfill (text as on dev), a job-kinds table and a Deployment section (compose stack, systemd units, release flow, automated deploy of main); correct the onboarding notifications step, which now subscribes to Web Push. AGENTS.md: the internal/* list is no longer "planned" and names every package; migrations/ and deploy/ describe what exists; cmd/vapidgen and the sqlc targets are listed; the release flow notes the auto-deploy of main. README.md: replace the scaffold status with the production URL, the stack, sqlc-check, and where the deploy runbook lives (deploy/RUNBOOK.md + CTXD). Maestro task: 3b22e48b-83a0-4e76-a604-20474419b47a Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Serve the MealQuest favicon instead of the browser default (Maestro 7c778111) (#213 )
2026-10-12 10:34:07 -04:00 · 2026-10-12 09:34:26 -04:00 · 2026-10-12 09:00:24 -04:00 · 2026-10-11 20:39:35 -04:00 · 2026-10-11 18:25:55 -04:00 · 2026-10-11 17:29:09 -04:00
31 changed files with 45667 additions and 105 deletions
@@ -78,17 +78,18 @@ behaviour, exercise it (hit the endpoint, render the page).
 | Path | Purpose |
 | --- | --- |
 | `cmd/server` | Entry point. Wiring only — no business logic. |
+| `cmd/vapidgen` | Prints a new VAPID key pair for Web Push. |
 | `internal/config` | `MEALQUEST_*` environment config; secrets from `*_FILE`. |
 | `internal/server` | HTTP server, routes, `/health`. |
 | `internal/frontend` | `go:embed` of the built PWA with SPA fallback. |
-| `internal/*` (planned) | `auth`, `db`, `store`, `secretbox`, `household`, `dinners`, `recipes`, `ai/llm`, `ai/harness`, `ai/skills`, `suggest`, `plan`, `shopping`, `ideas`, `gcal`, `notify`, `push`, `chat`, `jobs`, `scheduler`. |
-| `migrations/` | SQL migrations (planned). |
+| `internal/*` | `auth`, `forwarded`, `secureurl`, `db`, `store`, `secretbox`, `household`, `dinners`, `recipes`, `ai/llm`, `ai/harness`, `ai/skills`, `ai/aisettings`, `suggest`, `plan`, `shopping`, `ideas`, `home`, `gcal`, `notify`, `push`, `chat`, `vapid`, `jobs`, `scheduler` — one line each in [ARCHITECTURE.md](docs/ARCHITECTURE.md#repository-layout). |
+| `migrations/` | SQL migrations, embedded and applied at boot by `internal/store`; sqlc queries in `migrations/queries/`. |
 | `web/` | React PWA source. |
-| `deploy/` | Deployment files (planned). |
-| `docs/` | Project documentation, including [ARCHITECTURE.md](docs/ARCHITECTURE.md). |
+| `deploy/` | Deployment files: compose stack, systemd units, [deploy runbook](deploy/RUNBOOK.md) and the automated deploy (`auto-deploy.sh` with `systemd/mealquest-auto-deploy.*`). |
+| `docs/` | Project documentation, including [ARCHITECTURE.md](docs/ARCHITECTURE.md), launch evidence in [LAUNCH.md](docs/LAUNCH.md), and Lighthouse reports in `docs/lighthouse/`. |
 | `design/` | Requirements and UI handoff. **Read-only reference** — do not edit. |
 | `Dockerfile` | Multi-stage image build, at the repository root. |
-| `Makefile` | `dev`, `test`, `build`, `docker`. |
+| `Makefile` | `dev`, `test`, `build`, `docker`; `sqlc` and `sqlc-check` regenerate and check `internal/db`. |
 | `.gitea/workflows/ci.yml` | CI quality floor. |

 Design references:
@@ -104,7 +105,10 @@ Design references:
 - **Task branches:** `task/<slug>_<task-uuid>`, branched from the feature branch.
 - Task pull requests **squash-merge into the feature branch**.
 - The feature pull request merges into `dev`.
- **Only `overseer` merges `dev` → `main`** (a release).
+- **Only `overseer` merges `dev` → `main`** (a release). On the production
+  host, `mealquest-auto-deploy.timer` then deploys the new `main` once its
+  CI passes ([deploy/RUNBOOK.md](deploy/RUNBOOK.md) "Automated deploys");
+  nothing deploys `dev` or a feature branch.
 - Never push directly to `dev` or `main`.
 - Authors never review, approve, merge or close their own work.
 - Never store credentials in the repository; environment or ignored files only.
@@ -7,9 +7,28 @@ builds a weekly plan, pushes it to Google Calendar, and generates a shopping
 list grouped by dinner, kept as a browsable weekly history. It ships as a
 single Go service with the React PWA embedded in the binary.

-> Status: this repository is the Feature 01 scaffold (Go service with
-> `/health`, embedded PWA skeleton, Makefile, Dockerfile, CI). The planned
-> application is described in [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
+Production runs at <https://mealquest.cubecraftlabs.com> for one household,
+signed in through Authentik. Launch evidence (production smoke, Lighthouse)
+is in [docs/LAUNCH.md](docs/LAUNCH.md).
+
+## Stack
+
+- **Backend:** Go 1.25 (`CGO_ENABLED=0`, one static binary), chi router,
+  SQLite through `modernc.org/sqlite` with sqlc queries and embedded
+  migrations, Authentik OIDC, `log/slog`. AI calls go to an
+  OpenAI-compatible, Anthropic or Ollama endpoint over plain HTTP; recipes
+  come from SearXNG or Brave search and the recipe page's schema.org data.
+  Google Calendar, Google Chat and Web Push are the integrations.
+- **Frontend:** React 19, TypeScript, Vite, React Router 7, TanStack Query 5,
+  `vite-plugin-pwa`, CSS Modules over the design tokens; tests with Vitest,
+  Testing Library and jsdom.
+- **Deployment:** a Docker Compose stack (the service, Litestream
+  replication to the NAS, a SearXNG sidecar) behind Traefik, with systemd
+  units for the firewall, nightly media backup and the automated deploy of
+  `main`.
+
+The approved dependency list is in [AGENTS.md](AGENTS.md); nothing else is
+added without the owner's approval.

 ## Running it locally

@@ -28,6 +47,15 @@ invalid variable.
 | `make test`    | `gofmt` check, `go vet`, `go test -race`, web typecheck and tests. |
 | `make build`   | Build the PWA, embed it, build the static binary `bin/mealquest`. |
 | `make docker`  | Build the container image from the root `Dockerfile`.           |
+| `make sqlc-check` | Regenerate `internal/db` with sqlc and fail if it drifted.   |
+
+## Deploying and operating
+
+[deploy/RUNBOOK.md](deploy/RUNBOOK.md) is the deploy runbook: build, ship and
+restart, verifying the deployed version, rollback and the automated deploy.
+Database restore, the boot configuration and other host procedures are in
+CTXD: project `mealquest`, file `RUNBOOKS.MD`. Only `overseer` releases, by
+merging `dev` into `main`.

 ## Where to read next

@@ -0,0 +1,255 @@
+# MealQuest deploy runbook
+
+The one way to deploy MealQuest to production: the docker compose project
+`mealquest` on office-srvr `10.60.1.14` (see
+[ARCHITECTURE.md](../docs/ARCHITECTURE.md#topology)). Production runs `main`
+or a release tag; only `overseer` merges `dev` → `main`. Every deploy builds
+on the host, from the checked-out commit, with `make docker`.
+
+Host setup (clone, firewall, the systemd unit, Traefik, DNS, Litestream) and
+the database restore are in CTXD project `mealquest`, `RUNBOOKS.MD`. This
+file is the build, restart, verification and rollback procedure; where it
+uses a CTXD section, it names it.
+
+All commands run on `10.60.1.14` as `overseer`, in bash, from the checkout
+`/home/overseer/mealquest`. A block that ends with `FAILED` or a non-zero
+`$?` stops the deploy: do not go on to the next step.
+
+## How the image carries its version
+
+`make docker` runs `docker build --build-arg VERSION=<version>` and tags the
+image `mealquest:<version>`, where `<version>` is
+`git describe --tags --always` of the checkout (a release tag such as
+`v1.0.0`, otherwise the short SHA), with `-dirty` added when a tracked file
+is modified. The [Dockerfile](../Dockerfile) links it into the binary, and
+`/health` reports it:
+
+```json
+{"status":"ok","version":"v1.0.0"}
+```
+
+Never pass `--build-arg VERSION` by hand, and never build with
+`docker compose build` or `docker compose up --build`: compose passes no
+version, so that image reports `dev`.
+
+The compose service `mealquest` runs the image named `mealquest-mealquest`
+(compose's name for the image it would build; check with
+`docker compose -f deploy/compose.yaml config --images mealquest`). It
+already exists, so `docker compose up` uses it and never builds. A deploy
+points that name at the `make docker` image with `docker tag`. Every
+`mealquest:<version>` image is kept for rollback; do not prune them.
+
+## Prerequisites
+
+- `make`, `git`, `curl`, `python3` and Docker Engine with Compose on the
+  host (`make` is not in the base install: `sudo apt-get install make`).
+- `deploy/.env` (git-ignored, owner `overseer`, mode 0600) sets every
+  variable [`deploy/.env.example`](.env.example) sets, with
+  `MEALQUEST_BIND_ADDRESS=10.60.1.14`. It must not set the variables
+  `deploy/compose.yaml` fixes (`MEALQUEST_HTTP_ADDR`, `MEALQUEST_DATA_DIR`,
+  `MEALQUEST_SEARXNG_URL` and the `*_FILE` variables). Creating it: CTXD
+  `RUNBOOKS.MD` "Stack and first deploy" > "3. Environment file".
+- `deploy/secrets/` (git-ignored, mode 0700) holds `secret_key`,
+  `oidc_client_secret`, `google_client_secret`, `vapid_private_key` and
+  `litestream_key`, each owned by `10001:10001` with mode 0600, and
+  `searxng.env`, owned by `overseer` with mode 0600. Creating them: CTXD
+  `RUNBOOKS.MD` "Stack and first deploy" > "4. Secrets".
+- The compose file is the checkout's [`deploy/compose.yaml`](compose.yaml);
+  the systemd unit [`mealquest.service`](systemd/mealquest.service) starts
+  and stops it and is the only way the stack starts.
+- DNS and Traefik already route `https://mealquest.cubecraftlabs.com` to
+  `10.60.1.14:8090` (CTXD `RUNBOOKS.MD` "Reverse proxy (Traefik)", "DNS").
+
+Check `deploy/.env` and the secrets before every deploy (a new release may
+add a variable; the service refuses to boot without it). Both commands must
+print nothing:
+
+```sh
+cd /home/overseer/mealquest
+comm -23 <(grep -oE '^MEALQUEST_[A-Z_]+' deploy/.env.example | sort -u) \
+         <(grep -oE '^MEALQUEST_[A-Z_]+' deploy/.env | sort -u)   # variables missing from deploy/.env
+sudo find deploy/secrets -type f ! -perm 600                       # secrets not mode 0600
+```
+
+## Deploy
+
+### 1. Build
+
+Record the release production is running now, check out the new release
+and build its image. Nothing restarts.
+
+The rollback target is the version the running service reports on
+`/health`, read before the checkout changes, never the checkout's `HEAD`:
+after a failed or deferred deploy the checkout can be ahead of production.
+The block resolves that version to a commit and prints it as the rollback
+SHA. A running version of `dev` or `*-dirty` names no commit: the block
+fails, and the rollback target must be established by hand before going on.
+
+The checkout must be clean (the same test as the Makefile's `GIT_DIRTY`:
+no modified tracked file outside the generated `internal/frontend/dist`).
+The block computes the image tag exactly as `make docker` does, `-dirty`
+included, and checks that image exists after the build.
+
+```sh
+cd /home/overseer/mealquest && (
+set -euo pipefail
+fail() { echo "$*" >&2; exit 1; }
+built=
+trap 'st=$?
+if [ "$st" -eq 0 ] && [ -n "$built" ]; then echo "built: $built"
+else [ "$st" -ne 0 ] || st=1; echo "build FAILED (status $st)" >&2; fi
+exit "$st"' EXIT
+bind=$(grep -E '^MEALQUEST_BIND_ADDRESS=' deploy/.env | cut -d = -f 2-)
+[ -n "$bind" ] || fail "deploy/.env sets no MEALQUEST_BIND_ADDRESS"
+running=$(curl -fsS "http://$bind:8090/health" | python3 -c 'import json, sys; print(json.load(sys.stdin)["version"])') \
+  || fail "http://$bind:8090/health did not return a version: no running release to roll back to"
+case "$running" in
+  dev|*-dirty) fail "the running release reports $running, which names no commit" ;;
+esac
+git fetch --tags origin
+rollback=$(git rev-parse --verify --quiet "$running^{commit}") \
+  || fail "running version $running is not a commit in this repository"
+echo "rollback SHA: $rollback (running version $running)"   # RECORD it for rollback
+git checkout --detach origin/main            # or the release tag, e.g. v1.0.0
+dirty=$(git status --porcelain --untracked-files=no -- . ':(exclude)internal/frontend/dist')
+[ -z "$dirty" ] || fail "the checkout has modified tracked files; clean it first:
+$dirty"
+v=$(git describe --tags --always)${dirty:+-dirty}   # the Makefile's VERSION
+make docker
+docker image inspect "mealquest:$v" > /dev/null 2>&1 || fail "no image mealquest:$v: the build failed"
+built="mealquest:$v"
+)
+```
+
+### 2. Ship and restart
+
+1. **Pre-restart gates.** Run CTXD `RUNBOOKS.MD` "Routine deploy and
+   rollback" > "Deploy" step 2 (a verified pre-deploy restore point; record
+   it with the rollback SHA) and step 3 (boot-required configuration). The
+   restart applies migrations the previous release refuses, so without that
+   restore point there is no rollback. If either fails, do not restart:
+   production stays on the previous release.
+2. **Point the stack at the new image and restart.** `docker compose pull`
+   fetches the pinned `litestream` and `searxng` images before anything
+   stops; `mealquest` is never pulled. The restart applies the firewall,
+   then runs `down` and `up -d`, and returns once `mealquest` passes its
+   healthcheck (`/health` inside the container).
+
+```sh
+cd /home/overseer/mealquest && (
+set -euo pipefail
+fail() { echo "$*" >&2; exit 1; }
+up=
+trap 'st=$?
+if [ "$st" -eq 0 ] && [ -n "$up" ]; then echo "restarted on: $up"
+else [ "$st" -ne 0 ] || st=1; echo "restart FAILED (status $st)" >&2; fi
+exit "$st"' EXIT
+v=$(git describe --tags --always)
+docker compose -f deploy/compose.yaml pull litestream searxng
+docker tag "mealquest:$v" mealquest-mealquest
+sudo systemctl restart mealquest
+for s in mealquest litestream searxng; do
+  id=$(docker compose -f deploy/compose.yaml ps --status running --quiet "$s")
+  [ -n "$id" ] || fail "$s is not running"
+done
+id=$(docker compose -f deploy/compose.yaml ps --quiet mealquest)
+health=$(docker inspect -f '{{.State.Health.Status}}' "$id")
+[ "$health" = healthy ] || fail "mealquest is $health, not healthy"
+up="mealquest:$v"
+)
+```
+
+On failure read `journalctl -u mealquest` and
+`docker compose -f deploy/compose.yaml logs mealquest`: a configuration
+error names the variable. Fix it or roll back.
+
+### 3. Verify the deployed version and a real screen
+
+A `/health` 200 alone proves only that some build is up. This step checks,
+on the LAN address and through Traefik, that:
+
+- `/health` reports exactly the checkout's `git describe --tags --always`;
+- `/` and the Plan screen's route `/plan` serve the built PWA shell (the
+  React root and a hashed `/assets/` script, not the placeholder page an
+  unbuilt embed serves);
+- that script is served as JavaScript.
+
+```sh
+cd /home/overseer/mealquest && (
+set -euo pipefail
+fail() { echo "$*" >&2; exit 1; }
+want=
+trap 'st=$?
+if [ "$st" -eq 0 ] && [ -n "$want" ]; then echo "deployed and verified: $want ($(git rev-parse HEAD))"
+else [ "$st" -ne 0 ] || st=1; echo "verification FAILED (status $st): the deploy is not verified" >&2; fi
+exit "$st"' EXIT
+v=$(git describe --tags --always)
+for base in http://10.60.1.14:8090 https://mealquest.cubecraftlabs.com; do
+  got=$(curl -fsS "$base/health" | python3 -c 'import json, sys; print(json.load(sys.stdin)["version"])') \
+    || fail "$base/health did not return a version"
+  [ "$got" = "$v" ] || fail "$base/health reports version $got, the checkout is $v"
+  for path in / /plan; do
+    page=$(curl -fsS "$base$path") || fail "$base$path did not return 200"
+    grep -q '<div id="root"></div>' <<< "$page" || fail "$base$path is not the PWA shell"
+    js=$(grep -oE 'src="/assets/[^"]+\.js"' <<< "$page" | head -n 1 | cut -d '"' -f 2) || true
+    [ -n "$js" ] || fail "$base$path references no built /assets/ script"
+    type=$(curl -fsS -o /dev/null -w '%{content_type}' "$base$js") || fail "$base$js did not return 200"
+    case "$type" in
+      text/javascript*) ;;
+      *) fail "$base$js is $type, not JavaScript" ;;
+    esac
+  done
+  echo "$base: version $got, PWA shell and $js served"
+done
+want=$v
+)
+```
+
+- `deployed and verified: <version> (<SHA>)` and `$?` = `0` → open
+  `https://mealquest.cubecraftlabs.com` in a browser: sign in and the Home
+  screen renders with the household's data. Then record the deployed
+  version and SHA, the rollback SHA, the pre-deploy restore point and the
+  date in the release's Maestro task.
+- `verification FAILED`, any error or a non-zero `$?` → the deploy is not
+  done. A version mismatch means the stack runs a different image than the
+  checkout: repeat step 2, or roll back.
+
+## Rollback to a previous release
+
+Rolling back points `mealquest-mealquest` at the previous release's
+`mealquest:<version>` image again; that release's checkout keeps the
+compose file and the version check consistent with it.
+
+1. **Check whether the rollback crosses a migration** with CTXD
+   `RUNBOOKS.MD` "Routine deploy and rollback" > "Rollback to a previous
+   SHA" (its first block), run against the rollback SHA that deploy step 1
+   recorded. If it prints versions unknown to the rollback SHA, restore the
+   database to the pre-deploy restore point first (CTXD `RUNBOOKS.MD`
+   "Restore the database", with `-timestamp <restore point>`); changes
+   since then are lost, so tell the household.
+2. **Check out the rollback SHA and retag its image.** An image built before
+   this runbook was not tagged `mealquest:<version>`; `make docker` builds
+   it from the same commit.
+
+```sh
+cd /home/overseer/mealquest && (
+set -euo pipefail
+fail() { echo "$*" >&2; exit 1; }
+P=<rollback SHA>   # recorded by step 1, from the running release's /health
+back=
+trap 'st=$?
+if [ "$st" -eq 0 ] && [ -n "$back" ]; then echo "rolled back to: $back"
+else [ "$st" -ne 0 ] || st=1; echo "rollback FAILED (status $st)" >&2; fi
+exit "$st"' EXIT
+git checkout --detach "$P"
+v=$(git describe --tags --always)
+docker image inspect "mealquest:$v" > /dev/null 2>&1 || make docker
+docker image inspect "mealquest:$v" > /dev/null 2>&1 || fail "no image mealquest:$v"
+docker tag "mealquest:$v" mealquest-mealquest
+sudo systemctl restart mealquest
+back="mealquest:$v"
+)
+```
+
+3. **Run step 3 above** unchanged. The rollback is done only when it prints
+   `deployed and verified:` with the previous release's version.
@@ -2,10 +2,9 @@

 This mirrors the architecture section of `CONTEXT.MD` in the CTXD project
 `mealquest`, which is the source of record; if the two disagree, CTXD wins and
-this file should be updated. It describes the **planned** application. The
-repository today is the Feature 01 scaffold: `cmd/server`, `internal/config`,
-`internal/server` (`/health`), `internal/frontend` (embedded PWA with SPA
-fallback), the `web/` skeleton, `Makefile`, `Dockerfile` and CI.
+this file should be updated. It describes the application as built and
+released on `main`; nothing it names is still only planned. Launch evidence
+(production smoke, Lighthouse) is in [LAUNCH.md](LAUNCH.md).

 Decision numbers (D-NNN) refer to `DECISIONS.MD` in CTXD.

@@ -46,20 +45,22 @@ headers, so sign-in works whichever peer the request arrives from.
 | `cmd/vapidgen` | Prints a new VAPID key pair for Web Push. |
 | `internal/config` | Env-only `MEALQUEST_*` config; secrets from `*_FILE`. |
 | `internal/server` | HTTP server, router, middleware. |
+| `internal/forwarded` | Client IP and scheme from `X-Forwarded-*`, trusted only from `MEALQUEST_TRUSTED_PROXY`. |
+| `internal/secureurl` | The transport rule for URLs that carry credentials (`secureurl.Check`). |
 | `internal/frontend` | Embedded PWA, SPA fallback. |
 | `internal/auth` | Authentik OIDC, sessions, CSRF. |
-| `internal/db`, `internal/store` | SQLite connections, sqlc queries. |
+| `internal/db`, `internal/store` | sqlc-generated queries; SQLite connections, migrations at boot, transactions. |
 | `internal/secretbox` | AES-256-GCM encryption for `_ct` columns. |
-| `internal/household`, `internal/dinners`, `internal/recipes` | Domain. |
-| `internal/ai/llm`, `internal/ai/harness`, `internal/ai/skills` | AI provider adapters, skill harness, skills. |
-| `internal/suggest`, `internal/plan`, `internal/shopping`, `internal/ideas` | Feature services. |
+| `internal/household`, `internal/dinners`, `internal/recipes` | Domain: household settings and local time, dinners (grounding, photo backfill), recipe search, fetch and grounding. |
+| `internal/ai/llm`, `internal/ai/harness`, `internal/ai/skills`, `internal/ai/aisettings` | AI provider adapters, skill harness, skills, AI settings. |
+| `internal/suggest`, `internal/plan`, `internal/shopping`, `internal/ideas`, `internal/home` | Feature services. |
 | `internal/gcal`, `internal/notify`, `internal/push`, `internal/chat` | Integrations. |
 | `internal/vapid` | VAPID key generation and validation. |
 | `internal/jobs`, `internal/scheduler` | Background jobs and schedules. |
-| `migrations/` | SQL migrations (no goose or golang-migrate). |
+| `migrations/` | SQL migrations, embedded and applied at boot by `internal/store` (no goose or golang-migrate); sqlc queries in `migrations/queries/`. |
 | `web/` | React PWA. |
-| `deploy/` | Deployment files. |
-| `docs/` | Documentation. |
+| `deploy/` | Production compose stack, systemd units, the [deploy runbook](../deploy/RUNBOOK.md) and the automated deploy (see Deployment). |
+| `docs/` | Documentation: this file, [LAUNCH.md](LAUNCH.md), `A11Y.md`, `STATES.md`, Lighthouse reports. |
 | `design/` | Requirements and UI handoff (read-only reference). |

 ## Backend stack and conventions
@@ -269,6 +270,29 @@ automatic** (D-021).
  unarchived dinner still `pending` with no `ground_dinner` job for its revision
  queued or running is set `failed` with `interrupted`, so no dinner stays
  pending with nothing left to ground it.
+  Photo backfill. `POST /api/v1/settings/photo-backfill` (CSRF-checked)
+  enqueues a `backfill_dinner_photos` job and answers 202 `{id}` without
+  waiting for it; while one is queued or running it enqueues nothing and
+  answers with that job's id, so two passes never overlap, across restarts
+  too. The kind is refused by `POST /api/v1/jobs`. The job
+  grounds, one at a time with `Ground` on its name, every unarchived dinner
+  that is `failed` with no photo and no pasted `recipe_url` — grounded,
+  `manual` and `pending` dinners are never listed, and a pasted link is
+  never replaced by a search. Success sets grounding_status `grounded` as
+  the `ground_dinner` job does (the recipe keeps its source URL and site);
+  failure leaves the dinner `failed` with the new `grounding_error`, for
+  the fix-recipe flow. One dinner's failure never stops the others; a
+  dinner renamed, archived or grounded by hand meanwhile is left as it is.
+  Its result is `{dinners: [{dinner_id, outcome, reason}]}`, outcome
+  `grounded`, `failed` (with its reason) or `skipped`. A dinner whose write
+  fails is `failed` with `grounding_error` and left as it was; the others
+  still run, then the job fails with `internal_error`, keeping that result.
+  The responses returning a `dinners.Dinner` representation (the list; the
+  create, update, archive, favorite and grounding responses; the idea
+  responses) carry `photo_backfill_eligible`, and
+  `GET /api/v1/dinners/{id}` does not; it says whether the backfill grounds
+  that dinner, computed by the same condition it lists dinners by, so a
+  client offers a search only where one runs.
  `GET /api/v1/dinners/{id}/recipe-candidates`
  searches for the dinner's name and returns `{candidates: [{candidate_id,
  title, site_name, photo_url, minutes}]}`, at most 3, ranked as `Ground`
@@ -809,6 +833,20 @@ purge are fixed and not configurable.

 Runs are recorded in `schedule_runs` and executed through `jobs`.

+Job kinds (`internal/jobs`; each registered when `cmd/server` builds the
+service named, before the runner starts). `POST /api/v1/jobs` refuses a
+service-only kind; `GET /api/v1/jobs/{id}` reports any job.
+
+| Kind | Registered by | Enqueued by | Service-only |
+| --- | --- | --- | --- |
+| `noop` | `jobs.RegisterBuiltins` | `POST /api/v1/jobs` (does nothing; proves the runner works) | no |
+| `ground_dinner` | `dinners.Service` | Adding or renaming a `pending` dinner | no |
+| `backfill_dinner_photos` | `dinners.Service` | `POST /api/v1/settings/photo-backfill` | yes |
+| `suggestion_batch` | `suggest.Service` | `POST /api/v1/suggestions/batches`, a deck decision (replenish), `suggestions_weekly` | no |
+| `draft_week` | `plan.Service` | `POST /api/v1/plans/{weekStart}/draft`, `plan_draft` | yes |
+| `title_supply_run` | `shopping.Service` | Generating an untitled Supply run | yes |
+| `ideas_from_ingredients`, `quick_ideas` | `ideas.Service` | `POST /api/v1/ideas/from-ingredients`, `POST /api/v1/ideas/quick` | yes |
+
 `internal/scheduler` runs them. A schedule registers a name, a rule read
 from the settings (`scheduler.Daily`, `Weekly` or `WeeklyForNextWeek`, or `DailyAt` for a time read from data) and a
 run function; settings changes reach it through `SettingsService.Subscribe`
@@ -1325,10 +1363,12 @@ fewer the server answers 400 `invalid_settings` naming
 `onboarding_completed` and changes nothing. Step 3 can be reached with
 fewer — by its URL, or after another member removes a Regular — so it then
 shows the server's reason with an "Add Regulars" button back to step 2.
-Notification permission is never asked for on page load; until Feature 19
-wires Web Push, "Turn on notifications" asks for nothing and says plainly
-that notifications are not on yet, offering "Finish setting up" (which
-completes onboarding as above) instead of a silent success. Offline on the
+Notification permission is never asked for on page load. "Turn on
+notifications" subscribes this device to Web Push from the tap and says
+how it ended — on, blocked by the browser, or unsupported (on iPhone and
+iPad, until MealQuest is on the Home Screen) — then offers only "Finish
+setting up" (which completes onboarding as above); a dismissed permission
+prompt can be asked again. Offline on the
 saved pages the settings cannot be read (the service worker never caches `/api/v1/settings`),
 so the saved pages open as they are.

@@ -1345,6 +1385,41 @@ are undone if the server refuses them. While any Regular is `pending`, the
 list is read again every 3 seconds (not while a change is in flight), and
 polling stops once none is.

+## Deployment
+
+Production is the compose project `mealquest` on 10.60.1.14
+([`deploy/compose.yaml`](../deploy/compose.yaml)): the `mealquest` image built
+from the root `Dockerfile`, `litestream` replicating the database to the
+NAS over SFTP, and `searxng` on the internal network only. Configuration is
+`deploy/.env` and file secrets in `deploy/secrets/`, neither committed. The
+services never restart themselves; systemd units in `deploy/systemd/` own
+the host:
+
+| Unit | Does |
+| --- | --- |
+| `mealquest-firewall.service` | Restricts port 8090 to Traefik in `DOCKER-USER`; required before the stack starts. |
+| `mealquest.service` | Starts and stops the compose stack. |
+| `mealquest-media-backup.timer` / `.service` | Backs up cached photos to the NAS nightly at 03:30. |
+| `mealquest-auto-deploy.timer` / `.service` | Automated deploy of `main` (below). |
+
+Releases: only `overseer` merges `dev` into `main`. The image carries its
+version (`git describe`: a release tag, else the short SHA), which
+`/health` reports. A deploy follows
+[`deploy/RUNBOOK.md`](../deploy/RUNBOOK.md) — build, pre-deploy restore
+point, boot-config check, ship and restart, verify the deployed SHA and a
+real screen — with rollback to the previous release. The automated deploy
+([`deploy/auto-deploy.sh`](../deploy/auto-deploy.sh), installed as
+`/usr/local/sbin/mealquest-auto-deploy`) runs those same steps unattended:
+its timer checks every quarter hour (plus up to 5 minutes' random delay),
+and deploys `refs/remotes/origin/main` only when it differs from the last
+SHA in the deploy record `/home/overseer/mealquest-auto-deploy.log`, its
+Gitea CI status is `success`, its last attempt did not fail, and
+`mealquest.service` is active. It stops at the first failure and never
+retries a failed SHA; `--ref <ref>` is the manual override. Installing,
+seeding the record and enabling the timer are host steps in the runbook's
+"Automated deploys". Database restore and the boot configuration are in
+CTXD `RUNBOOKS.MD`.
+
 ## Boundaries and gotchas

 - **Secrets never reach the client** — API keys, OAuth tokens and the Chat
@@ -0,0 +1,96 @@
+# Launch evidence
+
+Evidence that the production PWA meets the launch gates. The raw reports and
+the check script are committed under [lighthouse/](lighthouse/).
+
+## Run conditions
+
+| | |
+| --- | --- |
+| Target | Production, <https://mealquest.cubecraftlabs.com> |
+| Build | `mealquest:743a155` |
+| Session | Signed in (household session cookie, supplied at run time) |
+| Date | 2026-10-11 |
+| Tool | Lighthouse 13.5.0, mobile form factor |
+
+The session cookie value is redacted from the committed reports
+(`configSettings.extraHeaders`); nothing else in them is changed.
+
+## Lighthouse
+
+Reports: [lighthouse/2026-10-11/](lighthouse/2026-10-11/) — one
+`.report.json` and one `.report.html` per page.
+
+| Page | Route | Performance | Accessibility | Best practices |
+| --- | --- | --- | --- | --- |
+| Home | `/` | 71 | 100 | 100 |
+| Plan | `/plan` | 72 | 100 | 100 |
+| Discover | `/discover` | 66 | 100 | 100 |
+| Dinner detail | `/dinner/<id>` | 70 | 100 | 100 |
+
+**Gate: accessibility ≥ 95 on every page — met** (100 on all four).
+Performance is recorded for reference but is not gated.
+
+## Installability
+
+Lighthouse 10 and later removed the PWA category, so installability was checked
+directly with a Playwright probe:
+[installability-check.mjs](lighthouse/2026-10-11/installability-check.mjs).
+It loads each of the four pages above in a signed-in Chrome session with
+Playwright's Pixel 5 mobile emulation (viewport, touch, `isMobile` and mobile
+user agent; the cookie comes from the `CK` environment variable, never the
+file) and gates every page on all of:
+
+- **Manifest** — the linked manifest is fetched with HTTP 200 and has
+  `name` "MealQuest", `display` "standalone", a `start_url`, and icons at
+  192x192, 512x512 and one with `maskable` purpose.
+- **Service worker** — `navigator.serviceWorker.ready` resolves within 10
+  seconds (expiry is a failure), and a registration exists whose active worker
+  is `activated`.
+
+It prints a PASS or FAIL line per condition per page and exits 1 if any
+condition fails on any page.
+
+**Result: PASS on all four pages.**
+
+## Production smoke — 2026-10-11/12
+
+An end-to-end smoke of the launch flows against production, run in the
+household's owner session.
+
+| | |
+| --- | --- |
+| Target | Production, <https://mealquest.cubecraftlabs.com> |
+| Build | `mealquest:743a155`, then `mealquest:561f249` mid-smoke |
+| Session | Owner session (signed in) |
+| Google Chat | Test space "MealQuest - Test" (not the family space) |
+| Google Calendar | Test calendar "MealQuest - Test" (not the family calendar) |
+| Dates | 2026-10-11 to 2026-10-12 |
+
+The smoke spanned two deploys: Feature 24 shipped mid-smoke through the new
+auto-deploy path, moving production from `743a155` to `561f249`.
+
+| Step | Result |
+| --- | --- |
+| Sign-in session and CSRF | ✓ |
+| `/home` shows the Regulars | ✓ |
+| Suggestion batch through the real LLM | ✓ 10 grounded cards, each "Why this?" citing the Regulars |
+| Try it | ✓ dinner created with a grounded photo, added to the Quest log |
+| Pass | ✓ declined dinner never re-suggested; deck 10 → 8 |
+| AI draft, Week 42 (Oct 12–18) | ✓ 7 days, no duplicates, Quest-log pick marked `is_new`, `ai_note` cites the Regulars |
+| Day swap | ✓ Monday → Slow Cooker French Dip Sandwiches (crock pot) |
+| Push to Calendar | ✓ synced; owner confirmed 7 events; a second push made no duplicates |
+| Supply run | ✓ 27 items, AI title "A Beefy Week with Pizza Night" |
+| Have-it toggle | ✓ needed items 27 → 26 |
+| Send to Google Chat | ✓ `sent_to_chat_at` stamped; owner confirmed receipt in the test space |
+| Test push notification | ✓ HTTP 202, `event_key` `plan_ready:test-…`, 3 subscriptions; owner confirmed receipt on their iPhone |
+| Quick dinner ideas | ✓ 6 ideas |
+| Cook from what I have | ✓ 4 ideas, with uses and missing ingredients computed |
+
+**Result: PASS on every step.**
+
+Evidence form: server-side API responses and timestamps, plus the owner's
+explicit confirmations for the steps that land outside the app (calendar
+events, Google Chat message, push notification on the phone). The owner's
+confirmation quotes are recorded on Maestro task
+`0544e318-9b5f-4264-9884-1ec8cb63fd49`. Phone screenshots were not captured.
@@ -0,0 +1,53 @@
+import { chromium, devices } from 'playwright';
+const ck = process.env.CK;
+if (!ck) { console.error('CK (session cookie) is not set'); process.exit(2); }
+const origin = 'https://mealquest.cubecraftlabs.com';
+const pages = [['home','/'],['plan','/plan'],['discover','/discover'],['dinner','/dinner/01M4PKT9QYA6C4JCF67XE7RA6R']];
+const SW_READY_TIMEOUT_MS = 10000;
+const browser = await chromium.launch({ executablePath: '/usr/bin/google-chrome', args: ['--no-sandbox'] });
+// Mobile emulation: Pixel 5 viewport, device scale, touch, isMobile and user agent.
+const ctx = await browser.newContext({ ...devices['Pixel 5'] });
+await ctx.addCookies([{ name: '__Host-mealquest_session', value: ck, url: origin + '/' }]);
+let fail = 0;
+for (const [name, path] of pages) {
+  const page = await ctx.newPage();
+  page.on('console', m => { if (/sw|service|error/i.test(m.text())) console.log('  [console]', m.text().slice(0,120)); });
+  page.on('pageerror', e => console.log('  [pageerror]', String(e).slice(0,120)));
+  await page.goto(origin + path, { waitUntil: 'networkidle', timeout: 30000 });
+  const href = await page.evaluate(() => document.querySelector('link[rel="manifest"]')?.href || null);
+  const sw = await page.evaluate(async (ms) => {
+    const ready = await Promise.race([
+      navigator.serviceWorker.ready.then(() => 'ready', e => 'error: ' + String(e)),
+      new Promise(r => setTimeout(() => r('timeout after ' + ms + ' ms'), ms)),
+    ]);
+    const regs = await navigator.serviceWorker.getRegistrations();
+    return { ready, registrations: regs.length, state: regs[0]?.active?.state || null };
+  }, SW_READY_TIMEOUT_MS);
+  const manifest = href
+    ? await page.evaluate(async (h) => { const r = await fetch(h); return { status: r.status, body: r.ok ? await r.json() : {} }; }, href)
+    : { status: 'no manifest link', body: {} };
+  const m = manifest.body;
+  const icons = m.icons || [];
+  const hasSize = (s) => icons.some(i => (i.sizes || '').split(/\s+/).includes(s));
+  const checks = [
+    ['manifest HTTP 200', manifest.status === 200, manifest.status],
+    ['manifest name "MealQuest"', m.name === 'MealQuest', m.name],
+    ['manifest display "standalone"', m.display === 'standalone', m.display],
+    ['manifest start_url present', !!m.start_url, m.start_url],
+    ['icon 192x192', hasSize('192x192'), icons.map(i => i.sizes).join(',')],
+    ['icon 512x512', hasSize('512x512'), icons.map(i => i.sizes).join(',')],
+    ['icon purpose maskable', icons.some(i => (i.purpose || '').split(/\s+/).includes('maskable')), icons.map(i => i.purpose || 'any').join(',')],
+    ['service worker ready', sw.ready === 'ready', sw.ready],
+    ['service worker registered', sw.registrations > 0, sw.registrations],
+    ['service worker activated', sw.state === 'activated', sw.state],
+  ];
+  console.log(`${name} (${path}) url=${page.url().replace(origin, '')}:`);
+  for (const [label, ok, actual] of checks) console.log(`  ${ok ? 'PASS' : 'FAIL'} ${label} (got ${JSON.stringify(actual ?? null)})`);
+  const pass = checks.every(([, ok]) => ok);
+  if (!pass) fail++;
+  console.log(`  => ${pass ? 'INSTALLABLE' : 'NOT INSTALLABLE'}`);
+  await page.close();
+}
+await browser.close();
+console.log(fail ? `FAILED on ${fail} of ${pages.length} pages` : `PASS on all ${pages.length} pages`);
+process.exit(fail ? 1 : 0);
@@ -222,8 +222,9 @@ type archivePeriod struct {
 }

 // archivePost is one week's Supply run in the Supply archive. label is
-// the week label, which stands in for title while it is null, and
-// onHandCount counts the items marked "have it".
+// the week label, which stands in for title while it is null,
+// onHandCount counts the items marked "have it", and frozen is false
+// while the list can still be changed from the Supply run.
 type archivePost struct {
 	WeekStart   string   `json:"weekStart"`
 	Label       string   `json:"label"`
@@ -233,6 +234,7 @@ type archivePost struct {
 	OnHandCount int      `json:"onHandCount"`
 	Dinners     []string `json:"dinners"`
 	Current     bool     `json:"current"`
+	Frozen      bool     `json:"frozen"`
 }

 // getSupplyArchive answers GET /shopping/archive?by=week|month|year with
@@ -262,6 +264,7 @@ func getSupplyArchive(logger *slog.Logger, svc *shopping.Service) http.HandlerFu
 					OnHandCount: post.OnHand,
 					Dinners:     post.Dinners,
 					Current:     post.Current,
+					Frozen:      post.Frozen,
 				}
 			}
 			out.Periods[i] = archivePeriod{Key: p.Key, Heading: p.Heading, Posts: posts}
@@ -720,6 +720,7 @@ type archiveJSON struct {
 			OnHandCount int      `json:"onHandCount"`
 			Dinners     []string `json:"dinners"`
 			Current     bool     `json:"current"`
+			Frozen      bool     `json:"frozen"`
 		} `json:"posts"`
 	} `json:"periods"`
 }
@@ -798,7 +799,7 @@ func TestSupplyArchive(t *testing.T) {
 	if k := keys(period); !reflect.DeepEqual(k, []string{"heading", "key", "posts"}) {
 		t.Errorf("period fields = %v", k)
 	}
-	wantPost := []string{"current", "dinnerCount", "dinners", "itemCount", "label", "onHandCount", "title", "weekStart"}
+	wantPost := []string{"current", "dinnerCount", "dinners", "frozen", "itemCount", "label", "onHandCount", "title", "weekStart"}
 	if k := keys(period["posts"].([]any)[0].(map[string]any)); !reflect.DeepEqual(k, wantPost) {
 		t.Errorf("post fields = %v, want %v", k, wantPost)
 	}
@@ -815,13 +816,13 @@ func TestSupplyArchive(t *testing.T) {
 			if post.Label != label || post.Title != nil {
 				t.Errorf("post %s: label %q title %v, want %q and null", post.WeekStart, post.Label, post.Title, label)
 			}
-			posts = append(posts, fmt.Sprintf("%s %d dinners %d items %d on hand %v current=%t",
-				post.WeekStart, post.DinnerCount, post.ItemCount, post.OnHandCount, post.Dinners, post.Current))
+			posts = append(posts, fmt.Sprintf("%s %d dinners %d items %d on hand %v current=%t frozen=%t",
+				post.WeekStart, post.DinnerCount, post.ItemCount, post.OnHandCount, post.Dinners, post.Current, post.Frozen))
 		}
 	}
 	want := []string{
-		thisWeek.String() + " 1 dinners 2 items 0 on hand [Lemon Chicken] current=true",
-		lastWeek.String() + " 1 dinners 3 items 1 on hand [Beef Stew] current=false",
+		thisWeek.String() + " 1 dinners 2 items 0 on hand [Lemon Chicken] current=true frozen=false",
+		lastWeek.String() + " 1 dinners 3 items 1 on hand [Beef Stew] current=false frozen=true",
 	}
 	if got.By != "week" || !reflect.DeepEqual(posts, want) {
 		t.Errorf("archive by %s =\n  %s\nwant\n  %s", got.By, strings.Join(posts, "\n  "), strings.Join(want, "\n  "))
@@ -852,6 +853,70 @@ func TestSupplyArchive(t *testing.T) {
 	}
 }

+// TestSupplyArchiveUnfrozenPastWeek: a past week's Supply run that
+// week_rollover has not frozen is in the Supply archive as not frozen for
+// as long as the Supply run route can still change it, and as frozen once
+// it cannot.
+func TestSupplyArchiveUnfrozenPastWeek(t *testing.T) {
+	t.Parallel()
+	e := newPlansRouter(t)
+	if _, err := e.st.Writer.ExecContext(t.Context(), `DELETE FROM plan_days; DELETE FROM week_plans`); err != nil {
+		t.Fatal(err)
+	}
+	zone, err := household.LoadZone("America/New_York") // the env's household zone
+	if err != nil {
+		t.Fatal(err)
+	}
+	thisWeek := household.WeekStart(household.Today(time.Now(), zone))
+	y, m, d := thisWeek.Date()
+	lastWeek := store.LocalDateOf(time.Date(y, m, d-7, 0, 0, 0, 0, time.UTC))
+	last := e.weekSupplyRun(t, lastWeek, "Beef Stew", shopIng{"stewing beef", "2", "lb"}, shopIng{"carrots", "4", ""})
+
+	// post is last week's post in the Supply archive.
+	post := func() (frozen bool) {
+		t.Helper()
+		var got archiveJSON
+		if status, raw := callShopping(t, e, http.MethodGet, shoppingPath+"archive?by=week", "", &got); status != http.StatusOK {
+			t.Fatalf("GET archive = %d %v", status, raw)
+		}
+		for _, p := range got.Periods {
+			for _, post := range p.Posts {
+				if post.WeekStart == lastWeek.String() {
+					if post.Current {
+						t.Errorf("last week's post is current")
+					}
+					return post.Frozen
+				}
+			}
+		}
+		t.Fatalf("archive %+v has no post for %s", got, lastWeek)
+		return false
+	}
+	// change marks carrots and reports whether the Supply run route took it.
+	change := func(needed bool) bool {
+		t.Helper()
+		status, body := callShopping(t, e, http.MethodPatch, shoppingPath+"items/"+last.itemID(t, "carrots"), fmt.Sprintf(`{"needed":%t}`, needed), nil)
+		switch {
+		case status == http.StatusOK:
+			return true
+		case status == http.StatusConflict && errorCode(body) == "archived":
+			return false
+		}
+		t.Fatalf("PATCH = %d %v, want 200 or 409 archived", status, body)
+		return false
+	}
+
+	if frozen, changed := post(), change(false); frozen || !changed {
+		t.Errorf("unfrozen past week: post frozen=%t, PATCH changed=%t; want a post not frozen for a list that changes", frozen, changed)
+	}
+	if err := e.shop.Freeze(t.Context(), lastWeek); err != nil {
+		t.Fatal(err)
+	}
+	if frozen, changed := post(), change(true); !frozen || changed {
+		t.Errorf("frozen past week: post frozen=%t, PATCH changed=%t; want a frozen post for a list that cannot change", frozen, changed)
+	}
+}
+
 // TestSupplyArchiveKeepsFrozenNames freezes last week's Supply run, then
 // renames its dinner and this week's through the dinners API: the frozen
 // post and list keep the name the dinner had when frozen, while this
@@ -166,6 +166,11 @@ type Post struct {
 	Items, OnHand int
 	// Current is true for the household's current week.
 	Current bool
+	// Frozen is true once the list is frozen into the Supply archive and
+	// can no longer change. A list not yet frozen — the current week's, or
+	// a past week's that week_rollover has not frozen — can still be
+	// changed from the Supply run.
+	Frozen bool
 }

 // Archive returns the Supply archive: the Supply run of every week up to
@@ -222,7 +227,7 @@ func (s *Service) Archive(ctx context.Context, by string) (out []Period, err err
 		if err != nil {
 			return nil, err
 		}
-		p, err := postOf(monday, l, monday == thisWeek)
+		p, err := postOf(monday, l, monday == thisWeek, frozen(row))
 		if err != nil {
 			return nil, err
 		}
@@ -237,7 +242,7 @@ func (s *Service) Archive(ctx context.Context, by string) (out []Period, err err

 // postOf is l, the Supply run of the week starting monday, as a post in
 // the Supply archive.
-func postOf(monday store.LocalDate, l List, current bool) (Post, error) {
+func postOf(monday store.LocalDate, l List, current, isFrozen bool) (Post, error) {
 	label, err := household.WeekLabel(monday)
 	if err != nil {
 		return Post{}, fmt.Errorf("shopping: Supply run %s: %w", l.ID, err)
@@ -255,5 +260,6 @@ func postOf(monday store.LocalDate, l List, current bool) (Post, error) {
 		Items:     c.Total,
 		OnHand:    c.Total - c.Needed,
 		Current:   current,
+		Frozen:    isFrozen,
 	}, nil
 }
@@ -381,6 +381,9 @@ func postLine(p shopping.Post) string {
 	if p.Current {
 		cur = " | current"
 	}
+	if !p.Frozen {
+		cur += " | open"
+	}
 	return p.WeekStart + " " + p.Label + " | " + title + " | " + strings.Join(p.Dinners, ", ") + " | " +
 		strconv.Itoa(p.Items) + " items, " + strconv.Itoa(p.OnHand) + " on hand" + cur
 }
@@ -427,7 +430,7 @@ func TestArchiveGroups(t *testing.T) {
 	}

 	posts := map[string]string{
-		"jan": "2027-01-04 Week 1 · Jan 4 – 10 | - | Pad Thai, Beef Chili | 5 items, 1 on hand | current",
+		"jan": "2027-01-04 Week 1 · Jan 4 – 10 | - | Pad Thai, Beef Chili | 5 items, 1 on hand | current | open",
 		"dec": "2026-12-28 Week 53 · Dec 28 – Jan 3 | Chili, Noodles & Co | Beef Chili, Pad Thai | 5 items, 2 on hand",
 		"d07": "2026-12-07 Week 50 · Dec 7 – 13 | - | Pad Thai | 2 items, 0 on hand",
 		"nov": "2026-11-30 Week 49 · Nov 30 – Dec 6 | - | Pot Roast | 1 items, 1 on hand",
@@ -4,6 +4,9 @@
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <meta name="theme-color" content="#5a358c" />
+    <link rel="icon" href="/favicon.ico" sizes="16x16 32x32 48x48" />
+    <link rel="icon" type="image/png" sizes="32x32" href="/icons/favicon-32.png" />
+    <link rel="icon" type="image/png" sizes="16x16" href="/icons/favicon-16.png" />
    <link rel="apple-touch-icon" href="/apple-touch-icon.png" />
    <title>MealQuest</title>
  </head>
@@ -1,5 +1,5 @@
-// Command generate-icons writes the PWA icons in web/public from the
-// MealQuest logo. Run it from the repository root:
+// Command generate-icons writes the PWA icons and favicons in web/public from
+// the MealQuest logo. Run it from the repository root:
 //
 //	go run ./web/scripts/generate-icons
 //
@@ -9,10 +9,13 @@
 package main

 import (
+	"bytes"
+	"encoding/binary"
 	"fmt"
 	"image"
 	"image/color"
 	"image/png"
+	"io"
 	"math"
 	"os"
 	"path/filepath"
@@ -27,6 +30,9 @@ const (
 	maskableScale = 0.66
 )

+// faviconSizes are the images packed into favicon.ico.
+var faviconSizes = []int{16, 32, 48}
+
 func main() {
 	if err := run(); err != nil {
 		fmt.Fprintln(os.Stderr, "generate-icons:", err)
@@ -49,6 +55,8 @@ func run() error {
 		{"icons/icon-192.png", resized(logo, 192)},
 		{"icons/icon-512.png", resized(logo, 512)},
 		{"icons/icon-maskable-512.png", maskable(logo, 512)},
+		{"icons/favicon-16.png", resized(logo, 16)},
+		{"icons/favicon-32.png", resized(logo, 32)},
 		{"apple-touch-icon.png", resized(logo, 180)},
 	}
 	for _, out := range outputs {
@@ -58,9 +66,53 @@ func run() error {
 		}
 		fmt.Printf("wrote %s (%dx%d)\n", path, out.image.Rect.Dx(), out.image.Rect.Dy())
 	}
+	ico, err := favicon(logo)
+	if err != nil {
+		return err
+	}
+	path := filepath.Join(public, "favicon.ico")
+	if err := os.WriteFile(path, ico, 0o644); err != nil {
+		return err
+	}
+	fmt.Printf("wrote %s (%v)\n", path, faviconSizes)
 	return nil
 }

+// favicon is an ICO file holding the logo at each of faviconSizes as an
+// embedded PNG: a 6-byte header, a 16-byte directory entry per image, then
+// the images.
+func favicon(logo image.Image) ([]byte, error) {
+	var images [][]byte
+	for _, size := range faviconSizes {
+		var buf bytes.Buffer
+		if err := encode(&buf, resized(logo, size)); err != nil {
+			return nil, fmt.Errorf("encode favicon %dx%d: %w", size, size, err)
+		}
+		images = append(images, buf.Bytes())
+	}
+	var out bytes.Buffer
+	le := binary.LittleEndian
+	out.Write(le.AppendUint16(nil, 0))                   // reserved
+	out.Write(le.AppendUint16(nil, 1))                   // type: icon
+	out.Write(le.AppendUint16(nil, uint16(len(images)))) // image count
+	offset := 6 + 16*len(images)
+	for i, size := range faviconSizes {
+		out.WriteByte(byte(size))           // width
+		out.WriteByte(byte(size))           // height
+		out.WriteByte(0)                    // palette size: none
+		out.WriteByte(0)                    // reserved
+		out.Write(le.AppendUint16(nil, 1))  // colour planes
+		out.Write(le.AppendUint16(nil, 32)) // bits per pixel
+		out.Write(le.AppendUint32(nil, uint32(len(images[i]))))
+		out.Write(le.AppendUint32(nil, uint32(offset)))
+		offset += len(images[i])
+	}
+	for _, img := range images {
+		out.Write(img)
+	}
+	return out.Bytes(), nil
+}
+
 // load decodes the logo. The file is a PNG despite its .jpg name, so the
 // format is sniffed rather than taken from the extension.
 func load(path string) (image.Image, error) {
@@ -84,14 +136,18 @@ func save(path string, img image.Image) error {
 	if err != nil {
 		return err
 	}
-	enc := png.Encoder{CompressionLevel: png.BestCompression}
-	if err := enc.Encode(f, img); err != nil {
+	if err := encode(f, img); err != nil {
 		f.Close()
 		return fmt.Errorf("encode %s: %w", path, err)
 	}
 	return f.Close()
 }

+func encode(w io.Writer, img image.Image) error {
+	enc := png.Encoder{CompressionLevel: png.BestCompression}
+	return enc.Encode(w, img)
+}
+
 func resized(logo image.Image, size int) *image.RGBA {
 	dst := image.NewRGBA(image.Rect(0, 0, size, size))
 	draw.CatmullRom.Scale(dst, dst.Rect, logo, logo.Bounds(), draw.Src, nil)
@@ -237,6 +237,21 @@ function supplyRun(needed: number) {
  }
 }

+// makesSupplyRun answers POST /api/v1/shopping/2026-10-05/generate with
+// generate and, as the server does, GET of the week's Supply run with the
+// one made once generate has made it: until then the week has none.
+function makesSupplyRun(generate: () => Response): Record<string, Responder> {
+  let made = false
+  return {
+    'GET /api/v1/shopping/2026-10-05': () => (made ? jsonResponse(200, supplyRun(28)) : errorResponse(404, 'not_found')),
+    'POST /api/v1/shopping/2026-10-05/generate': () => {
+      const response = generate()
+      made ||= response.ok
+      return response
+    },
+  }
+}
+
 // Wednesday Oct 7, noon in New York: before Friday's 09:00 plan_draft, so
 // the page opens on this week.
 beforeEach(() => {
@@ -553,7 +568,7 @@ describe('PlanPage', () => {
    const fetchMock = stubServer({
      [`GET ${THIS_WEEK}`]: () => jsonResponse(200, planBody('draft')),
      [`POST ${PUSH}`]: () => jsonResponse(200, syncedNow(SUPPLY_RUN_FAILED)),
-      'POST /api/v1/shopping/2026-10-05/generate': () => generate(),
+      ...makesSupplyRun(() => generate()),
    })
    await renderPage()

@@ -585,7 +600,7 @@ describe('PlanPage', () => {
    stubServer({
      [`GET ${THIS_WEEK}`]: () => jsonResponse(200, planBody('draft')),
      [`POST ${PUSH}`]: () => jsonResponse(200, syncedNow(SUPPLY_RUN_FAILED)),
-      'POST /api/v1/shopping/2026-10-05/generate': () => jsonResponse(200, { ...supplyRun(28), skipped: [] }),
+      ...makesSupplyRun(() => jsonResponse(200, { ...supplyRun(28), skipped: [] })),
    })
    await renderPage()

@@ -670,7 +685,7 @@ describe('PlanPage', () => {
    stubServer({
      [`GET ${THIS_WEEK}`]: () => jsonResponse(200, planBody('draft')),
      [`POST ${PUSH}`]: () => jsonResponse(200, syncedNow(SUPPLY_RUN_FAILED)),
-      'POST /api/v1/shopping/2026-10-05/generate': () => jsonResponse(200, { ...supplyRun(28), skipped: [] }),
+      ...makesSupplyRun(() => jsonResponse(200, { ...supplyRun(28), skipped: [] })),
    })
    const queryClient = createQueryClient()
    await renderPage(queryClient, <SupplyRunScreen />)
@@ -1,7 +1,8 @@
 // @vitest-environment node
 // Builds the app with the production config and serves the result, so the
 // assertions cover what ships in dist: the web manifest, the service worker,
-// every icon, and the service worker registration that only builds include.
+// every icon and favicon, and the service worker registration that only builds
+// include.
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 import { build, createServer, preview, type PreviewServer, type ViteDevServer } from 'vite'
 import tokens from './styles/tokens.css?raw'
@@ -12,9 +13,13 @@ const icons = [
  { path: '/icons/icon-192.png', size: 192 },
  { path: '/icons/icon-512.png', size: 512 },
  { path: '/icons/icon-maskable-512.png', size: 512 },
+  { path: '/icons/favicon-16.png', size: 16 },
+  { path: '/icons/favicon-32.png', size: 32 },
  { path: '/apple-touch-icon.png', size: 180 },
 ]

+const faviconSizes = [16, 32, 48]
+
 function token(name: string): string {
  const value = tokens.match(new RegExp(`^\\s*${name}:\\s*([^;\\s]+);`, 'm'))?.[1]
  if (!value) throw new Error(`${name} is not defined in tokens.css`)
@@ -38,6 +43,18 @@ function pngSize(bytes: Uint8Array): { width: number; height: number } {
  return { width: view.getUint32(16), height: view.getUint32(20) }
 }

+// The images in an ICO file: a 6-byte header (reserved, type 1, count), then
+// a 16-byte directory entry per image giving its byte length and offset.
+function icoImages(bytes: Uint8Array): Uint8Array[] {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+  expect([view.getUint16(0, true), view.getUint16(2, true)]).toEqual([0, 1])
+  return Array.from({ length: view.getUint16(4, true) }, (_, i) => {
+    const entry = 6 + 16 * i
+    const offset = view.getUint32(entry + 12, true)
+    return bytes.subarray(offset, offset + view.getUint32(entry + 8, true))
+  })
+}
+
 describe('production build', () => {
  let server: PreviewServer
  let origin: string
@@ -94,13 +111,25 @@ describe('production build', () => {
    expect(pngSize(bytes)).toEqual({ width: size, height: size })
  })

+  it('ships /favicon.ico holding the logo as PNGs at every favicon size', async () => {
+    const bytes = new Uint8Array(await (await get('/favicon.ico')).arrayBuffer())
+    expect(icoImages(bytes).map((png) => pngSize(png))).toEqual(
+      faviconSizes.map((size) => ({ width: size, height: size })),
+    )
+  })
+
  it('emits sw.js with the precache list injected', async () => {
    const sw = await (await get('/sw.js')).text()
    expect(sw).not.toContain('self.__WB_MANIFEST')
    expect(sw).toContain('"url":"index.html"')
-    for (const { path } of icons.slice(0, 3)) {
-      expect(sw).toContain(`"url":"${path.slice(1)}"`)
+  })
+
+  it('precaches every icon and favicon so the offline shell keeps them', async () => {
+    const urls = precacheEntries(await (await get('/sw.js')).text()).map((entry) => entry.url)
+    for (const path of [...icons.map((icon) => icon.path), '/favicon.ico']) {
+      expect(urls).toContain(path.slice(1))
    }
+    expect(new Set(urls).size, 'precache URLs are unique').toBe(urls.length)
  })

  it('precaches the shell, JS, CSS and every self-hosted font', async () => {
@@ -129,6 +158,17 @@ describe('production build', () => {
    expect(html).toContain('<link rel="apple-touch-icon" href="/apple-touch-icon.png" />')
  })

+  it('links the favicons from index.html', async () => {
+    const html = await (await get('/')).text()
+    expect(html).toContain('<link rel="icon" href="/favicon.ico" sizes="16x16 32x32 48x48" />')
+    expect(html).toContain(
+      '<link rel="icon" type="image/png" sizes="32x32" href="/icons/favicon-32.png" />',
+    )
+    expect(html).toContain(
+      '<link rel="icon" type="image/png" sizes="16x16" href="/icons/favicon-16.png" />',
+    )
+  })
+
  it('registers /sw.js at scope / from index.html', async () => {
    const html = await (await get('/')).text()
    expect(html).toContain('<script id="vite-plugin-pwa:register-sw" src="/registerSW.js"></script>')
@@ -10,6 +10,7 @@ import { mockViewport } from '../test/matchMedia.ts'
 import type { ArchivePost } from './api.ts'
 import { PAGE, SupplyArchivePage } from './SupplyArchivePage.tsx'
 import styles from './SupplyArchivePage.module.css'
+import { SupplyRunPage } from './SupplyRunPage.tsx'

 const ARCHIVE = (by: string) => `/api/v1/shopping/archive?by=${by}`

@@ -24,13 +25,14 @@ function post(weekStart: string, label: string, overrides: Partial<ArchivePost>
    onHandCount: 4,
    dinners: ['Beef tacos', 'Tikka masala', 'Pizza', 'Pot roast', 'Orzo', 'Chili', 'Salmon'],
    current: false,
+    frozen: true,
    ...overrides,
  }
 }

 // The posts of mock 1m: this week's titled post, then the weeks across the
 // September–October boundary and the 2025–2026 one, the last untitled.
-const WEEK_41 = post('2026-10-05', 'Week 41 · Oct 5 – 11', { title: 'Tacos, tikka & a salmon finale', current: true })
+const WEEK_41 = post('2026-10-05', 'Week 41 · Oct 5 – 11', { title: 'Tacos, tikka & a salmon finale', current: true, frozen: false })
 const WEEK_40 = post('2026-09-28', 'Week 40 · Sep 28 – Oct 4', { title: 'Pizza, pot roast & the great orzo trial', itemCount: 26 })
 const WEEK_39 = post('2026-09-21', 'Week 39 · Sep 21 – 27', { title: 'Chili season opens', dinnerCount: 1, itemCount: 1, onHandCount: 0, dinners: ['Chili'] })
 const WEEK_1 = post('2025-12-29', 'Week 1 · Dec 29 – Jan 4')
@@ -83,8 +85,9 @@ function stubServer(responders: Record<string, Responder>) {
 }

 // renderPage loads /me (for the CSRF token any write would need, so a
-// missing PATCH is not for want of it) and renders the Supply archive at path.
-async function renderPage(path = '/plan/shopping/archive') {
+// missing PATCH is not for want of it) and renders the Supply archive at path,
+// with supplyRun at the Supply run's route.
+async function renderPage(path = '/plan/shopping/archive', supplyRun = <p>Supply run screen</p>) {
  const api = createApiClient(fakeLocation(path), createNetworkStatus(window), createVerifiedSession(localStorage))
  await api.loadMe()
  return render(
@@ -93,7 +96,7 @@ async function renderPage(path = '/plan/shopping/archive') {
        <MemoryRouter initialEntries={[path]}>
          <Routes>
            <Route path="/plan/shopping/archive" element={<SupplyArchivePage />} />
-            <Route path="/plan/shopping" element={<p>Supply run screen</p>} />
+            <Route path="/plan/shopping" element={supplyRun} />
          </Routes>
        </MemoryRouter>
      </QueryClientProvider>
@@ -137,7 +140,7 @@ describe('SupplyArchivePage', () => {
    expect(within(postCard('Chili season opens')).queryByText(/^\+/)).not.toBeInTheDocument()

    expect(screen.getAllByRole('link').map((link) => link.getAttribute('href'))).toEqual([
-      '/plan/shopping/archive?week=2026-10-05',
+      '/plan/shopping?week=2026-10-05',
      '/plan/shopping/archive?week=2026-09-28',
      '/plan/shopping/archive?week=2026-09-21',
      '/plan/shopping/archive?week=2025-12-29',
@@ -154,7 +157,7 @@ describe('SupplyArchivePage', () => {
    for (const period of BY.week) {
      const section = screen.getByRole('region', { name: period.heading })
      expect(within(section).getAllByRole('link').map((link) => link.getAttribute('href'))).toEqual(
-        period.posts.map((p) => `/plan/shopping/archive?week=${p.weekStart}`),
+        period.posts.map((p) => (p.frozen ? `/plan/shopping/archive?week=${p.weekStart}` : `/plan/shopping?week=${p.weekStart}`)),
      )
    }
  })
@@ -182,7 +185,7 @@ describe('SupplyArchivePage', () => {
    for (const period of BY[by]) {
      const section = screen.getByRole('region', { name: period.heading })
      expect(within(section).getAllByRole('link').map((link) => link.getAttribute('href'))).toEqual(
-        period.posts.map((p) => `/plan/shopping/archive?week=${p.weekStart}`),
+        period.posts.map((p) => (p.frozen ? `/plan/shopping/archive?week=${p.weekStart}` : `/plan/shopping?week=${p.weekStart}`)),
      )
    }
  })
@@ -366,38 +369,66 @@ describe('SupplyArchivePage frozen post', () => {
    expect(await screen.findByRole('heading', { level: 1, name: 'Supply archive' })).toBeInTheDocument()
  })

-  it('opens the current week’s post read-only too, tagged Archived, with no checkbox, nothing to send and no PATCH', async () => {
-    const fetchMock = stubServer({
+  it('opens the current week’s post, not yet frozen, in the Supply run, where it can still change', async () => {
+    stubServer({
      [`GET ${ARCHIVE('week')}`]: archive('week'),
      'GET /api/v1/shopping/2026-10-05': () => jsonResponse(200, CURRENT),
    })
-    await renderPage()
+    await renderPage('/plan/shopping/archive', <SupplyRunPage />)

    fireEvent.click(await screen.findByText('Tacos, tikka & a salmon finale'))

-    expect(await screen.findByText('Archived')).toBeInTheDocument()
-    expect(screen.getByText("This week's list as it stands, read-only in the Supply archive.")).toBeInTheDocument()
-    expect(screen.getByText('Corn tortillas')).toBeInTheDocument()
-    expect(screen.queryAllByRole('checkbox')).toEqual([])
-    fireEvent.click(screen.getByText('Corn tortillas'))
-    fireEvent.click(screen.getByText('Limes'))
-    expect(fetchMock.mock.calls.filter(([, init]) => init?.method !== undefined && init.method !== 'GET')).toEqual([])
+    expect(await screen.findByRole('checkbox', { name: 'Corn tortillas' })).toBeEnabled()
+    expect(screen.queryByText('Archived')).not.toBeInTheDocument()
  })

-  it('on desktop opens the current week’s post read-only, and with no post open shows this week’s Supply run to change', async () => {
+  it('marks a past week’s post not yet frozen Still open and opens it in the Supply run, where it can still change', async () => {
+    const open = { ...WEEK_40, frozen: false }
+    stubServer({
+      [`GET ${ARCHIVE('week')}`]: () => jsonResponse(200, { by: 'week', periods: [{ key: '2026-W40', heading: open.label, posts: [open] }] }),
+      'GET /api/v1/shopping/2026-09-28': () => jsonResponse(200, { ...FROZEN, status: 'current' }),
+    })
+    await renderPage('/plan/shopping/archive', <SupplyRunPage />)
+
+    await screen.findByText('Pizza, pot roast & the great orzo trial')
+    const card = postCard('Pizza, pot roast & the great orzo trial')
+    expect(within(card).getByText('Week 40 · Sep 28 – Oct 4 · Still open')).toHaveClass(styles.kicker!)
+    expect(card).not.toHaveClass(styles.current!)
+    expect(card).toHaveAttribute('href', '/plan/shopping?week=2026-09-28')
+
+    fireEvent.click(card)
+
+    expect(await screen.findByRole('checkbox', { name: 'Pizza dough' })).toBeEnabled()
+    expect(screen.queryByText('Archived')).not.toBeInTheDocument()
+  })
+
+  it('marks no frozen post Still open', async () => {
+    stubServer({ [`GET ${ARCHIVE('week')}`]: archive('week') })
+    await renderPage()
+    await screen.findByText('Chili season opens')
+    expect(screen.queryByText(/Still open/)).not.toBeInTheDocument()
+  })
+
+  it('opens a saved link to a past week’s list not yet frozen in the editable Supply run, not read-only', async () => {
+    stubServer({ 'GET /api/v1/shopping/2026-09-28': () => jsonResponse(200, { ...FROZEN, status: 'current' }) })
+    await renderPage('/plan/shopping/archive?week=2026-09-28', <SupplyRunPage />)
+
+    expect(await screen.findByRole('checkbox', { name: 'Pizza dough' })).toBeEnabled()
+    expect(screen.queryByText('Archived')).not.toBeInTheDocument()
+    expect(screen.getByText("Uncheck anything you already have — it won't be counted.")).toBeInTheDocument()
+  })
+
+  it('on desktop opens a saved link to the current week’s list, not yet frozen, in the editable Supply run, as with no post open', async () => {
    mockViewport(1440)
-    const fetchMock = stubServer({
+    stubServer({
      [`GET ${ARCHIVE('week')}`]: archive('week'),
      'GET /api/v1/shopping/2026-10-05': () => jsonResponse(200, CURRENT),
    })
-    const view = await renderPage('/plan/shopping/archive?week=2026-10-05')
+    const view = await renderPage('/plan/shopping/archive?week=2026-10-05', <SupplyRunPage />)

-    expect(await screen.findByText('Archived')).toBeInTheDocument()
-    expect(screen.getByText('Corn tortillas')).toBeInTheDocument()
-    expect(screen.queryAllByRole('checkbox')).toEqual([])
-    expect(screen.queryByText('Send to Google Chat')).not.toBeInTheDocument()
-    fireEvent.click(screen.getByText('Corn tortillas'))
-    expect(fetchMock.mock.calls.filter(([, init]) => init?.method !== undefined && init.method !== 'GET')).toEqual([])
+    expect(await screen.findByRole('checkbox', { name: 'Corn tortillas' })).toBeEnabled()
+    expect(screen.queryByText('Archived')).not.toBeInTheDocument()
+    expect(screen.queryByRole('complementary', { name: 'Supply archive' })).not.toBeInTheDocument()
    view.unmount()

    await renderPage()
@@ -9,9 +9,9 @@ import { Icon } from '../ui/Icon.tsx'
 import { IconButton } from '../ui/IconButton.tsx'
 import { Segmented } from '../ui/Segmented.tsx'
 import { Skeleton } from '../ui/Skeleton.tsx'
-import { useSupplyArchive, WEEK_PARAM, type ArchiveGroup, type ArchivePeriod, type ArchivePost } from './api.ts'
+import { supplyRunScreen, useSupplyArchive, WEEK_PARAM, type ArchiveGroup, type ArchivePeriod, type ArchivePost } from './api.ts'
 import styles from './SupplyArchivePage.module.css'
-import { SUPPLY_ARCHIVE, SupplyRunPage } from './SupplyRunPage.tsx'
+import { SUPPLY_ARCHIVE, SUPPLY_RUN, SupplyRunPage } from './SupplyRunPage.tsx'

 // PAGE is how many posts the Supply archive shows at first, and how many
 // more each "Load older" shows.
@@ -38,15 +38,20 @@ function plural(n: number, one: string, many: string): string {

 // PostCard is one week's Supply run (mock 1m): the week label as its kicker,
 // the AI's title — the week label while it has none — the counts and its
-// first dinners as chips. The current week's post is ringed in grape. It
-// opens the week's list, read-only.
+// first dinners as chips. The current week's post is ringed in grape. A
+// frozen post opens the week's list here, read-only; a post not yet frozen —
+// this week's, or a past week's the week rollover has not frozen — is marked
+// Current or Still open and opens the Supply run, where it can still change.
 function PostCard({ post }: { post: ArchivePost }) {
  const rest = post.dinners.length - CHIPS
  return (
-    <Link to={archivePost(post.weekStart)} className={[styles.post, post.current && styles.current].filter(Boolean).join(' ')}>
+    <Link
+      to={post.frozen ? archivePost(post.weekStart) : supplyRunScreen(post.weekStart)}
+      className={[styles.post, post.current && styles.current].filter(Boolean).join(' ')}
+    >
      <span className={styles.kicker}>
        {post.label}
-        {post.current && ' · Current'}
+        {post.current ? ' · Current' : !post.frozen && ' · Still open'}
      </span>
      <span className={styles.postTitle}>{post.title ?? post.label}</span>
      <span className={styles.meta}>
@@ -145,7 +150,7 @@ function SupplyArchive({ panel }: { panel: boolean }) {
    <div className={styles.archive}>
      <header className={styles.header}>
        {!panel && (
-          <IconButton label="Back to the Supply run" onClick={() => void navigate('/plan/shopping')}>
+          <IconButton label="Back to the Supply run" onClick={() => void navigate(SUPPLY_RUN)}>
            <Icon icon={ChevronLeft} size="nav" />
          </IconButton>
        )}
@@ -157,10 +162,10 @@ function SupplyArchive({ panel }: { panel: boolean }) {
  )
 }

-// SupplyArchivePage is /plan/shopping/archive. A post opens it on its week
-// (?week=), whose list the Supply run screen shows read-only and tagged
-// Archived, whatever its status: even the current week's post is only
-// viewed here, never changed. On desktop (mock 2f) the archive is a panel at
+// SupplyArchivePage is /plan/shopping/archive. A frozen post opens it on its
+// week (?week=), whose list the Supply run screen shows read-only and tagged
+// Archived; a post not yet frozen opens the Supply run instead, as does a
+// ?week= visit to a list not yet frozen. On desktop (mock 2f) the archive is a panel at
 // the right of that list, this week's editable Supply run when no post is
 // open; on mobile and tablet it is the archive or, with a post open, the
 // post's list.
@@ -99,12 +99,12 @@ function writes(fetchMock: Mock<typeof fetch>) {

 // renderPage loads /me (for the CSRF token every write needs) and renders
 // the Supply run at path.
-async function renderPage(path = '/plan/shopping') {
+async function renderPage(path = '/plan/shopping', queryClient = createQueryClient()) {
  const api = createApiClient(fakeLocation('/plan/shopping'), createNetworkStatus(window), createVerifiedSession(localStorage))
  await api.loadMe()
  return render(
    <ApiProvider client={api}>
-      <QueryClientProvider client={createQueryClient()}>
+      <QueryClientProvider client={queryClient}>
        <MemoryRouter initialEntries={[path]}>
          <SupplyRunPage />
        </MemoryRouter>
@@ -563,9 +563,13 @@ describe('SupplyRunPage', () => {
  })

  it('offers to make the list when the week has none, and shows the list made', async () => {
+    let made = false
    const fetchMock = stubServer({
-      [`GET ${THIS_WEEK}`]: () => errorResponse(404, 'not_found'),
-      [`POST ${GENERATE}`]: () => jsonResponse(200, { ...supplyRun(), skipped: [] }),
+      [`GET ${THIS_WEEK}`]: () => (made ? jsonResponse(200, supplyRun()) : errorResponse(404, 'not_found')),
+      [`POST ${GENERATE}`]: () => {
+        made = true
+        return jsonResponse(200, { ...supplyRun(), skipped: [] })
+      },
    })
    await renderPage()

@@ -575,6 +579,50 @@ describe('SupplyRunPage', () => {
    expect(writes(fetchMock)).toEqual([`POST ${GENERATE} undefined`])
  })

+  it('keeps the list made when a read sent before it was made answers after it', async () => {
+    const queryClient = createQueryClient()
+    const made = deferred()
+    const late = deferred()
+    const again = deferred()
+    let reads = 0
+    const fetchMock = stubServer({
+      [`GET ${THIS_WEEK}`]: () => {
+        reads++
+        if (reads === 1) return errorResponse(404, 'not_found')
+        return reads === 2 ? late.response : again.response
+      },
+      [`POST ${GENERATE}`]: () => made.response,
+    })
+    await renderPage('/plan/shopping', queryClient)
+
+    fireEvent.click(await screen.findByRole('button', { name: 'Make the shopping list' }))
+    // A read of the week sent while the list is being made, so from before it.
+    void queryClient.invalidateQueries({ queryKey: ['shopping', '2026-10-05'] })
+    await waitFor(() => expect(reads).toBe(2))
+    made.send(jsonResponse(200, { ...supplyRun(), skipped: [] }))
+    expect(await screen.findByText('4 / 6')).toBeInTheDocument()
+    // The list made is written, and the week read again from the server.
+    await waitFor(() => expect(reads).toBe(3))
+
+    // The read from before the list was made answers only now.
+    late.send(errorResponse(404, 'not_found'))
+    await late.response
+    await new Promise((resolve) => setTimeout(resolve, 0))
+    expect(screen.getByText('4 / 6')).toBeInTheDocument()
+    expect(screen.queryByRole('heading', { name: 'No shopping list yet' })).not.toBeInTheDocument()
+
+    // The read sent after it was made is the one shown: by then the
+    // household has the ground beef.
+    const groups = GROUPS.map((group, g) => ({
+      ...group,
+      items: group.items.map((item, i) => (g === 0 && i === 0 ? { ...item, needed: false } : item)),
+    }))
+    again.send(jsonResponse(200, supplyRun({ needed_count: 3, groups })))
+    expect(await screen.findByText('3 / 6')).toBeInTheDocument()
+    expect(reads).toBe(3)
+    expect(writes(fetchMock)).toEqual([`POST ${GENERATE} undefined`])
+  })
+
  it('says why the list could not be made', async () => {
    stubServer({
      [`GET ${THIS_WEEK}`]: () => errorResponse(404, 'not_found'),
@@ -1,6 +1,6 @@
 import { Archive, Check, CloudUpload, MessageSquare } from 'lucide-react'
 import { useState } from 'react'
-import { Link, useSearchParams } from 'react-router'
+import { Link, Navigate, useSearchParams } from 'react-router'
 import { defaultWeek, isMonday, localNow, weekdayKicker, weekLabel } from '../plan/week.ts'
 import { ApiError } from '../api/errors.ts'
 import { formatClockTime, useHouseholdSettings } from '../settings/api.ts'
@@ -15,6 +15,7 @@ import { Skeleton } from '../ui/Skeleton.tsx'
 import { Tag } from '../ui/Tag.tsx'
 import {
  useGenerateSupplyRun,
+  supplyRunScreen,
  useSendToChat,
  useSupplyRun,
  useToggles,
@@ -26,6 +27,9 @@ import {
 import { keep, savedSchedule, useSavedProblem } from './offline.ts'
 import styles from './SupplyRunPage.module.css'

+// SUPPLY_RUN is the Supply run screen.
+export const SUPPLY_RUN = '/plan/shopping'
+
 // SUPPLY_ARCHIVE is the Supply archive screen.
 export const SUPPLY_ARCHIVE = '/plan/shopping/archive'

@@ -143,10 +147,10 @@ function ArchiveLink({ layout }: { layout: Breakpoint }) {
 // tablet up, where Archive and Send to Google Chat are actions in the
 // header; a send that fails says why, and one whose outcome is not known
 // offers no retry and leaves the status line saying so. On a current Supply run each item toggles at once (useToggles); a
-// toggle refused puts the item back and says why. An archived one, or any
-// opened from the Supply archive (readOnly), is read-only and tagged
-// Archived, and a toggle it refused is not offered again.
-function SupplyRunList({ weekStart, timezone, layout, readOnly }: WeekProps) {
+// toggle refused puts the item back and says why. An archived one is
+// read-only and tagged Archived, and a toggle it refused is not offered
+// again.
+function SupplyRunList({ weekStart, timezone, layout }: Omit<WeekProps, 'readOnly'>) {
  const toggles = useToggles(weekStart)
  const send = useSendToChat(weekStart)
  const run = toggles.shown
@@ -157,7 +161,7 @@ function SupplyRunList({ weekStart, timezone, layout, readOnly }: WeekProps) {
    <UnconfirmedStatus at={run.chat_send_unconfirmed_at} timezone={timezone} />
  )
  const sendUnconfirmed = send.error instanceof ApiError && send.error.code === 'chat_unconfirmed'
-  const viewOnly = readOnly || run.status === 'archived'
+  const viewOnly = run.status === 'archived'
  const wide = layout !== 'mobile'
  const failed = toggles.failed
  const failedItem = failed && run.groups.flatMap((group) => group.items).find((item) => item.id === failed.toggle.id)
@@ -175,11 +179,9 @@ function SupplyRunList({ weekStart, timezone, layout, readOnly }: WeekProps) {
            </p>
          </div>
          <p className={styles.helper}>
-            {run.status === 'archived'
+            {viewOnly
              ? 'This list is in the Supply archive, as it was when the week ended.'
-              : viewOnly
-                ? "This week's list as it stands, read-only in the Supply archive."
-                : "Uncheck anything you already have — it won't be counted."}
+              : "Uncheck anything you already have — it won't be counted."}
          </p>
        </div>
        {wide && (
@@ -240,7 +242,8 @@ type WeekProps = { weekStart: string; timezone: string; layout: Breakpoint; read

 // WeekSupplyRun is the Supply run of the week starting on weekStart, or,
 // when the week has none yet, the offer to make it from the week's plan —
-// not offered read-only.
+// not offered read-only. Read-only, a Supply run not yet frozen opens the
+// editable Supply run screen instead, where it can still change.
 function WeekSupplyRun({ weekStart, timezone, layout, readOnly }: WeekProps) {
  const run = useSupplyRun(weekStart)
  const generate = useGenerateSupplyRun(weekStart)
@@ -267,14 +270,16 @@ function WeekSupplyRun({ weekStart, timezone, layout, readOnly }: WeekProps) {
      </div>
    )
  }
-  return <SupplyRunList weekStart={weekStart} timezone={timezone} layout={layout} readOnly={readOnly} />
+  if (readOnly && run.data.status !== 'archived') return <Navigate to={supplyRunScreen(weekStart)} replace />
+  return <SupplyRunList weekStart={weekStart} timezone={timezone} layout={layout} />
 }

 // SupplyRunPage is the Supply run (mock 1l on mobile, 2b on tablet, 2f on
 // desktop) of the week the Plan opens on — next week once this week's
 // plan_draft time has come, otherwise this week — or of the week chosen by
-// ?week=. Opened from the Supply archive it is readOnly: tagged Archived,
-// with no checkbox and nothing to make or send, whatever the week. Offline,
+// ?week=. Opened from the Supply archive it is readOnly: a frozen Supply run
+// is tagged Archived, with no checkbox and nothing to make or send; one not
+// yet frozen opens the editable Supply run screen instead. Offline,
 // where the settings cannot be read, it chooses the week by the schedule
 // saved on this device.
 export function SupplyRunPage({ readOnly = false }: { readOnly?: boolean }) {
@@ -194,18 +194,26 @@ export function useSupplyRun(weekStart: string) {
 // /api/v1/shopping/{weekStart}/generate); the Supply run it answers with is
 // the one shown. Once made, from whichever screen, a push of the week whose
 // Supply run was not made is settled (settleUnmadePushes).
+//
+// A read of the week's Supply run still in flight as the answer arrives may
+// have been sent before the Supply run was made: it is cancelled before the
+// answer is written, so it cannot land over it, and the week is then read
+// again from the server.
 export function useGenerateSupplyRun(weekStart: string) {
  const { apiFetch } = useApi()
  const queryClient = useQueryClient()
+  const key = supplyRunKey(weekStart)
  return useMutation({
    onMutate: () => settleUnmadePushes(queryClient, weekStart),
    mutationFn: async (): Promise<SupplyRun> => {
      const path = `${supplyRunPath(weekStart)}/generate`
      return parseSupplyRun(`POST ${path}`, weekStart, await apiFetch<unknown>(path, { method: 'POST' }))
    },
-    onSuccess: (run, _, settle) => {
-      queryClient.setQueryData<SupplyRun | null>(supplyRunKey(weekStart), run)
+    onSuccess: async (run, _, settle) => {
+      await queryClient.cancelQueries({ queryKey: key })
+      queryClient.setQueryData<SupplyRun | null>(key, run)
      settle()
+      void queryClient.invalidateQueries({ queryKey: key })
    },
  })
 }
@@ -537,7 +545,9 @@ export type ArchivePeriod = (typeof ARCHIVE_PERIODS)[number]
 // ArchivePost is one week's Supply run in the Supply archive: label is the
 // week label, "Week 41 · Oct 5 – 11", which stands in for title while it is
 // null; onHandCount counts the items marked "have it", and dinners names the
-// dinners in day order. current is true for the household's current week.
+// dinners in day order. current is true for the household's current week,
+// and frozen once the list is frozen into the Supply archive: until then it
+// can still be changed from the Supply run.
 export type ArchivePost = {
  weekStart: string
  label: string
@@ -547,6 +557,7 @@ export type ArchivePost = {
  onHandCount: number
  dinners: string[]
  current: boolean
+  frozen: boolean
 }

 // ArchiveGroup is one period of the Supply archive — a week, a month
@@ -561,7 +572,8 @@ function parsePost(where: string, body: unknown): ArchivePost {
    (body.title !== null && typeof body.title !== 'string') ||
    !Array.isArray(body.dinners) ||
    !body.dinners.every((name) => typeof name === 'string') ||
-    typeof body.current !== 'boolean'
+    typeof body.current !== 'boolean' ||
+    typeof body.frozen !== 'boolean'
  ) {
    throw new Error(`${where}: response has a post that is not a Supply archive post`)
  }
@@ -574,6 +586,7 @@ function parsePost(where: string, body: unknown): ArchivePost {
    onHandCount: count(where, 'onHandCount', body.onHandCount),
    dinners: body.dinners as string[],
    current: body.current,
+    frozen: body.frozen,
  }
 }

@@ -17,8 +17,11 @@ export default defineConfig({
      srcDir: 'src',
      filename: 'sw.ts',
      injectRegister: 'script',
-      // Precache the shell, JS, CSS and the self-hosted fonts.
-      injectManifest: { globPatterns: ['**/*.{html,js,css,woff2}'] },
+      // Precache the shell, JS, CSS, the self-hosted fonts and every icon
+      // and favicon. The glob already covers the manifest icons, so the
+      // plugin does not add them a second time.
+      injectManifest: { globPatterns: ['**/*.{html,js,css,woff2,png,ico}'] },
+      includeManifestIcons: false,
      // The web manifest lives in manifest.json: its theme and background
      // colours are --color-accent and --color-bg from src/styles/tokens.css,
      // and hex colours may not be written in TypeScript.
Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	6903b3bb47	Refresh repo docs to match what was built (Maestro 3b22e48b) CI / ci (push) Successful in 10m42s Details CI / ci (pull_request) Successful in 10m45s Details ARCHITECTURE.md: drop the Feature 01 "planned application" framing; add the missing packages (forwarded, secureurl, home, ai/aisettings) to the layout; add photo backfill (text as on dev), a job-kinds table and a Deployment section (compose stack, systemd units, release flow, automated deploy of main); correct the onboarding notifications step, which now subscribes to Web Push. AGENTS.md: the internal/* list is no longer "planned" and names every package; migrations/ and deploy/ describe what exists; cmd/vapidgen and the sqlc targets are listed; the release flow notes the auto-deploy of main. README.md: replace the scaffold status with the production URL, the stack, sqlc-check, and where the deploy runbook lives (deploy/RUNBOOK.md + CTXD). Maestro task: 3b22e48b-83a0-4e76-a604-20474419b47a Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-12 10:34:07 -04:00
orchestrator-agent	48c4c0e6f1	Serve the MealQuest favicon instead of the browser default (Maestro 7c778111) (#213 ) CI / ci (push) Successful in 10m15s Details Co-authored-by: orchestrator-agent <20+orchestrator-agent@code.cubecraftcreations.com>	2026-10-12 09:34:26 -04:00
orchestrator-agent	28164e762d	Production smoke evidence in the launch summary (Maestro 0544e318) (#212 ) CI / ci (push) Successful in 10m5s Details Co-authored-by: orchestrator-agent <20+orchestrator-agent@code.cubecraftcreations.com>	2026-10-12 09:00:24 -04:00
orchestrator-agent	90c2d79354	Lighthouse production results and launch summary (Maestro 2c8f8887) (#204 ) CI / ci (push) Successful in 11m9s Details Co-authored-by: orchestrator-agent <20+orchestrator-agent@code.cubecraftcreations.com>	2026-10-11 20:39:35 -04:00
orchestrator-agent	8b0e2f25a9	Document the deploy: SHA-embedded build and step-3 verification (Maestro 8611c4b6) (#203 ) CI / ci (push) Successful in 11m55s Details Co-authored-by: orchestrator-agent <20+orchestrator-agent@code.cubecraftcreations.com>	2026-10-11 18:25:55 -04:00
orchestrator-agent	cfc229049f	Supply archive: mark an unfrozen past run as still open (Maestro 29b629aa) (#200 ) CI / ci (push) Successful in 8m36s Details Co-authored-by: orchestrator-agent <20+orchestrator-agent@code.cubecraftcreations.com>	2026-10-11 17:29:09 -04:00
orchestrator-agent	01cd9a8741	Supply run: a late in-flight read must not overwrite a just-made list (Maestro 4d299127) (#199 ) CI / ci (push) Successful in 8m30s Details Co-authored-by: orchestrator-agent <20+orchestrator-agent@code.cubecraftcreations.com>	2026-10-11 16:34:35 -04:00
orchestrator-agent	f7ebc85862	Supply archive fidelity: frozen posts keep dinner names as frozen (Maestro 22f80eb6) (#201 ) CI / ci (push) Successful in 10m7s Details Co-authored-by: orchestrator-agent <20+orchestrator-agent@code.cubecraftcreations.com>	2026-10-11 15:57:29 -04:00