- POST /auth/logout answers with Clear-Site-Data: "storage", "cache", which removes the verified-session marker, the service worker and its caches, so an offline visit after logout cannot reopen household data. The 401/403 clearing path is unchanged. - The service worker no longer answers network-only requests; it leaves them to the browser. Chrome stalls a Clear-Site-Data navigation that the worker answered, so the logout POST must bypass it. - New tests send plan and recipe reads through the real API client and the real network-first strategy online, then serve them from the cache offline. - The icon generator is now Go on golang.org/x/image (approved) instead of Python on Pillow; the icons are regenerated with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>