Session store: implement create with id-collision retry

Silences tower-sessions' warning about the default create and never overwrites an existing row on a session id collision. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM
Web dashboard step 7: docs, users page, polish
2026-09-03 18:22:41 +00:00 · 2026-09-03 18:19:08 +00:00 · 2026-09-03 18:03:50 +00:00 · 2026-09-03 18:01:36 +00:00 · 2026-09-03 18:01:21 +00:00 · 2026-09-03 17:53:47 +00:00
90 changed files with 18810 additions and 185 deletions
@@ -138,6 +138,18 @@ dependencies = [
 "syn 2.0.119",
 ]
 [[package]]
 name = "argon2"
 version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
 dependencies = [
 "base64ct",
 "blake2",
 "cpufeatures 0.2.17",
 "password-hash",
 ]
 [[package]]
 name = "arrayref"
 version = "0.3.9"
@@ -224,6 +236,17 @@ dependencies = [
 "tokio",
 ]
 [[package]]
 name = "async-trait"
 version = "0.1.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn 3.0.3",
 ]
 [[package]]
 name = "atoi"
 version = "2.0.0"
@@ -269,7 +292,7 @@ dependencies = [
 "num-traits",
 "pastey",
 "rayon",
- "thiserror",
+ "thiserror 2.0.20",
 "v_frame",
 "y4m",
 ]
@@ -372,6 +395,26 @@ dependencies = [
 "tracing",
 ]
 [[package]]
 name = "axum-login"
 version = "0.18.0"
 source = "git+https://github.com/maxcountryman/axum-login.git?rev=151c72d7a1b4646830f86b4332e6bd6e34d719a7#151c72d7a1b4646830f86b4332e6bd6e34d719a7"
 dependencies = [
 "axum",
 "form_urlencoded",
 "pin-project",
 "serde",
 "subtle",
 "thiserror 2.0.20",
 "tokio",
 "tower-cookies",
 "tower-layer",
 "tower-service",
 "tower-sessions",
 "tracing",
 "urlencoding",
 ]
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -384,6 +427,12 @@ version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
 [[package]]
 name = "base64ct"
 version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 [[package]]
 name = "basic-toml"
 version = "0.1.10"
@@ -438,6 +487,15 @@ dependencies = [
 "no_std_io2",
 ]
 [[package]]
 name = "blake2"
 version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
 dependencies = [
 "digest 0.10.7",
 ]
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -654,6 +712,17 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
 [[package]]
 name = "cookie"
 version = "0.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
 dependencies = [
 "percent-encoding",
 "time",
 "version_check",
 ]
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -820,7 +889,9 @@ dependencies = [
 "ammonia",
 "anyhow",
 "askama",
 "async-trait",
 "axum",
 "axum-login",
 "base64 0.23.1",
 "clap",
 "dom_smoothie",
@@ -832,26 +903,48 @@ dependencies = [
 "image",
 "jiff",
 "libc",
 "password-auth",
 "rand 0.10.2",
 "reqwest",
 "resvg",
 "roxmltree 0.21.1",
 "rpassword",
 "scraper",
 "serde",
 "serde_json",
 "sha2 0.11.0",
 "sqlx",
 "tempfile",
- "thiserror",
+ "thiserror 2.0.20",
 "time",
 "tiny-skia",
 "tokio",
 "tokio-util",
 "toml 1.1.4+spec-1.1.0",
 "toml_edit 0.25.13+spec-1.1.0",
 "tower",
 "tower-http 0.7.0",
 "tower_governor",
 "tracing",
 "tracing-subscriber",
 "url",
 "zip",
 ]
 [[package]]
 name = "dashmap"
 version = "6.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
 dependencies = [
 "cfg-if",
 "crossbeam-utils",
 "hashbrown 0.14.5",
 "lock_api",
 "once_cell",
 "parking_lot_core",
 ]
 [[package]]
 name = "data-url"
 version = "0.3.2"
@@ -886,7 +979,7 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
 dependencies = [
- "thiserror",
+ "thiserror 2.0.20",
 ]
 [[package]]
@@ -894,6 +987,9 @@ name = "deranged"
 version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
 "serde_core",
 ]
 [[package]]
 name = "derive_arbitrary"
@@ -935,6 +1031,7 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
 "block-buffer 0.10.4",
 "crypto-common 0.1.7",
 "subtle",
 ]
 [[package]]
@@ -990,7 +1087,7 @@ dependencies = [
 "once_cell",
 "phf",
 "tendril",
- "thiserror",
+ "thiserror 2.0.20",
 "unicode-segmentation",
 ]
@@ -1056,7 +1153,7 @@ dependencies = [
 "log",
 "once_cell",
 "tempfile",
- "thiserror",
+ "thiserror 2.0.20",
 "upon",
 "uuid",
 "zip",
@@ -1176,7 +1273,7 @@ dependencies = [
 "pear",
 "serde",
 "tempfile",
- "toml",
+ "toml 0.8.23",
 "uncased",
 "version_check",
 ]
@@ -1273,6 +1370,16 @@ dependencies = [
 "percent-encoding",
 ]
 [[package]]
 name = "forwarded-header-value"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8835f84f38484cc86f110a805655697908257fb9a7af005234060891557198e9"
 dependencies = [
 "nonempty",
 "thiserror 1.0.69",
 ]
 [[package]]
 name = "fs_extra"
 version = "1.3.0"
@@ -1361,6 +1468,12 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
 [[package]]
 name = "futures-timer"
 version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
 [[package]]
 name = "futures-util"
 version = "0.3.34"
@@ -1417,9 +1530,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
 "cfg-if",
 "js-sys",
 "libc",
 "r-efi 5.3.0",
 "wasip2",
 "wasm-bindgen",
 ]
 [[package]]
@@ -1458,6 +1573,29 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 [[package]]
 name = "governor"
 version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9efcab3c1958580ff1f25a2a41be1668f7603d849bb63af523b208a3cc1223b8"
 dependencies = [
 "cfg-if",
 "dashmap",
 "futures-sink",
 "futures-timer",
 "futures-util",
 "getrandom 0.3.4",
 "hashbrown 0.16.1",
 "nonzero_ext",
 "parking_lot",
 "portable-atomic",
 "quanta",
 "rand 0.9.5",
 "smallvec",
 "spinning_top",
 "web-time",
 ]
 [[package]]
 name = "h2"
 version = "0.4.15"
@@ -1500,6 +1638,12 @@ dependencies = [
 "smallvec",
 ]
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -1669,6 +1813,19 @@ dependencies = [
 "tower-service",
 ]
 [[package]]
 name = "hyper-timeout"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
 "hyper",
 "hyper-util",
 "pin-project-lite",
 "tokio",
 "tower-service",
 ]
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
@@ -1987,7 +2144,7 @@ dependencies = [
 "jni-sys",
 "log",
 "simd_cesu8",
- "thiserror",
+ "thiserror 2.0.20",
 "walkdir",
 "windows-link",
 ]
@@ -2282,6 +2439,18 @@ dependencies = [
 "memchr",
 ]
 [[package]]
 name = "nonempty"
 version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e9e591e719385e6ebaeb5ce5d3887f7d5676fceca6411d1925ccc95745f3d6f7"
 [[package]]
 name = "nonzero_ext"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
 [[package]]
 name = "noop_proc_macro"
 version = "0.3.0"
@@ -2410,6 +2579,29 @@ dependencies = [
 "windows-link",
 ]
 [[package]]
 name = "password-auth"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a2a4764cc1f8d961d802af27193c6f4f0124bd0e76e8393cf818e18880f0524"
 dependencies = [
 "argon2",
 "getrandom 0.2.17",
 "password-hash",
 "rand_core 0.6.4",
 ]
 [[package]]
 name = "password-hash"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
 dependencies = [
 "base64ct",
 "rand_core 0.6.4",
 "subtle",
 ]
 [[package]]
 name = "paste"
 version = "1.0.15"
@@ -2510,6 +2702,26 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5be167a7af36ee22fe3115051bc51f6e6c7054c9348e28deb4f49bd6f705a315"
 [[package]]
 name = "pin-project"
 version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
 dependencies = [
 "pin-project-internal",
 ]
 [[package]]
 name = "pin-project-internal"
 version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn 2.0.119",
 ]
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
@@ -2668,6 +2880,21 @@ dependencies = [
 "bytemuck",
 ]
 [[package]]
 name = "quanta"
 version = "0.12.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
 dependencies = [
 "crossbeam-utils",
 "libc",
 "once_cell",
 "raw-cpuid",
 "wasi",
 "web-sys",
 "winapi",
 ]
 [[package]]
 name = "quick-error"
 version = "2.0.1"
@@ -2688,7 +2915,7 @@ dependencies = [
 "rustc-hash",
 "rustls",
 "socket2",
- "thiserror",
+ "thiserror 2.0.20",
 "tokio",
 "tracing",
 "web-time",
@@ -2711,7 +2938,7 @@ dependencies = [
 "rustls",
 "rustls-pki-types",
 "slab",
- "thiserror",
+ "thiserror 2.0.20",
 "tinyvec",
 "tracing",
 "web-time",
@@ -2783,6 +3010,15 @@ dependencies = [
 "rand_core 0.9.5",
 ]
 [[package]]
 name = "rand_core"
 version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
 "getrandom 0.2.17",
 ]
 [[package]]
 name = "rand_core"
 version = "0.9.5"
@@ -2837,7 +3073,7 @@ dependencies = [
 "rand 0.9.5",
 "rand_chacha",
 "simd_helpers",
- "thiserror",
+ "thiserror 2.0.20",
 "v_frame",
 "wasm-bindgen",
 ]
@@ -3026,6 +3262,27 @@ dependencies = [
 "memchr",
 ]
 [[package]]
 name = "rpassword"
 version = "7.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2da316a15f47e3d053de9cb2c439650bd8fa4aaeb9365f2e5f27f492ff73c196"
 dependencies = [
 "libc",
 "rtoolbox",
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "rtoolbox"
 version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a1efe12a1469752d0e6ff5ebec0b6ef4924cc5c4c71046b0ec730040535819d"
 dependencies = [
 "libc",
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "rustc-hash"
 version = "2.1.3"
@@ -3292,6 +3549,15 @@ dependencies = [
 "serde",
 ]
 [[package]]
 name = "serde_spanned"
 version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
 dependencies = [
 "serde_core",
 ]
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -3470,6 +3736,15 @@ dependencies = [
 "lock_api",
 ]
 [[package]]
 name = "spinning_top"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
 dependencies = [
 "lock_api",
 ]
 [[package]]
 name = "sqlx"
 version = "0.9.0"
@@ -3511,7 +3786,7 @@ dependencies = [
 "serde_json",
 "sha2 0.10.9",
 "smallvec",
- "thiserror",
+ "thiserror 2.0.20",
 "tokio",
 "tokio-stream",
 "tracing",
@@ -3553,7 +3828,7 @@ dependencies = [
 "sqlx-postgres",
 "sqlx-sqlite",
 "syn 2.0.119",
- "thiserror",
+ "thiserror 2.0.20",
 "tokio",
 "url",
 ]
@@ -3580,7 +3855,7 @@ dependencies = [
 "sha1",
 "sha2 0.11.0",
 "sqlx-core",
- "thiserror",
+ "thiserror 2.0.20",
 "tracing",
 ]
@@ -3614,7 +3889,7 @@ dependencies = [
 "smallvec",
 "sqlx-core",
 "stringprep",
- "thiserror",
+ "thiserror 2.0.20",
 "tracing",
 "whoami",
 ]
@@ -3638,7 +3913,7 @@ dependencies = [
 "percent-encoding",
 "serde",
 "sqlx-core",
- "thiserror",
+ "thiserror 2.0.20",
 "tracing",
 "url",
 ]
@@ -3800,13 +4075,33 @@ dependencies = [
 "new_debug_unreachable",
 ]
 [[package]]
 name = "thiserror"
 version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
 "thiserror-impl 1.0.69",
 ]
 [[package]]
 name = "thiserror"
 version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 2.0.20",
 ]
 [[package]]
 name = "thiserror-impl"
 version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn 2.0.119",
 ]
 [[package]]
@@ -3854,6 +4149,7 @@ dependencies = [
 "powerfmt",
 "serde_core",
 "time-core",
 "time-macros",
 ]
 [[package]]
@@ -3862,6 +4158,16 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 [[package]]
 name = "time-macros"
 version = "0.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
 dependencies = [
 "num-conv",
 "time-core",
 ]
 [[package]]
 name = "tiny-skia"
 version = "0.12.0"
@@ -3983,9 +4289,24 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
 dependencies = [
 "serde",
- "serde_spanned",
+ "serde_spanned 0.6.9",
- "toml_datetime",
+ "toml_datetime 0.6.11",
- "toml_edit",
+ "toml_edit 0.22.27",
 ]
 [[package]]
 name = "toml"
 version = "1.1.4+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3aace63f4bbcdfc2c965b059de67119c89c4017a70d633be6c104910f67056f5"
 dependencies = [
 "indexmap",
 "serde_core",
 "serde_spanned 1.1.1",
 "toml_datetime 1.1.1+spec-1.1.0",
 "toml_parser",
 "toml_writer",
 "winnow 1.0.4",
 ]
 [[package]]
@@ -3997,6 +4318,15 @@ dependencies = [
 "serde",
 ]
 [[package]]
 name = "toml_datetime"
 version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
 "serde_core",
 ]
 [[package]]
 name = "toml_edit"
 version = "0.22.27"
@@ -4005,18 +4335,75 @@ checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
 "indexmap",
 "serde",
- "serde_spanned",
+ "serde_spanned 0.6.9",
- "toml_datetime",
+ "toml_datetime 0.6.11",
 "toml_write",
 "winnow 0.7.15",
 ]
 [[package]]
 name = "toml_edit"
 version = "0.25.13+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
 dependencies = [
 "indexmap",
 "toml_datetime 1.1.1+spec-1.1.0",
 "toml_parser",
 "toml_writer",
 "winnow 1.0.4",
 ]
 [[package]]
 name = "toml_parser"
 version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
 "winnow 1.0.4",
 ]
 [[package]]
 name = "toml_write"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 [[package]]
 name = "toml_writer"
 version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
 [[package]]
 name = "tonic"
 version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
 dependencies = [
 "async-trait",
 "axum",
 "base64 0.22.1",
 "bytes",
 "h2",
 "http",
 "http-body",
 "http-body-util",
 "hyper",
 "hyper-timeout",
 "hyper-util",
 "percent-encoding",
 "pin-project",
 "socket2",
 "sync_wrapper",
 "tokio",
 "tokio-stream",
 "tower",
 "tower-layer",
 "tower-service",
 "tracing",
 ]
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -4025,14 +4412,33 @@ checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
 "futures-core",
 "futures-util",
 "indexmap",
 "pin-project-lite",
 "slab",
 "sync_wrapper",
 "tokio",
 "tokio-util",
 "tower-layer",
 "tower-service",
 "tracing",
 ]
 [[package]]
 name = "tower-cookies"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "151b5a3e3c45df17466454bb74e9ecedecc955269bdedbf4d150dfa393b55a36"
 dependencies = [
 "axum-core",
 "cookie",
 "futures-util",
 "http",
 "parking_lot",
 "pin-project-lite",
 "tower-layer",
 "tower-service",
 ]
 [[package]]
 name = "tower-http"
 version = "0.6.11"
@@ -4080,6 +4486,7 @@ dependencies = [
 "tower-layer",
 "tower-service",
 "tracing",
 "uuid",
 ]
 [[package]]
@@ -4094,6 +4501,60 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 [[package]]
 name = "tower-sessions"
 version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "518dca34b74a17cadfcee06e616a09d2bd0c3984eff1769e1e76d58df978fc78"
 dependencies = [
 "async-trait",
 "http",
 "time",
 "tokio",
 "tower-cookies",
 "tower-layer",
 "tower-service",
 "tower-sessions-core",
 "tracing",
 ]
 [[package]]
 name = "tower-sessions-core"
 version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "568531ec3dfcf3ffe493de1958ae5662a0284ac5d767476ecdb6a34ff8c6b06c"
 dependencies = [
 "async-trait",
 "base64 0.22.1",
 "futures",
 "http",
 "parking_lot",
 "rand 0.9.5",
 "serde",
 "serde_json",
 "thiserror 2.0.20",
 "time",
 "tokio",
 "tracing",
 ]
 [[package]]
 name = "tower_governor"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44de9b94d849d3c46e06a883d72d408c2de6403367b39df2b1c9d9e7b6736fe6"
 dependencies = [
 "axum",
 "forwarded-header-value",
 "governor",
 "http",
 "pin-project",
 "thiserror 2.0.20",
 "tonic",
 "tower",
 "tracing",
 ]
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -4264,6 +4725,12 @@ dependencies = [
 "serde_derive",
 ]
 [[package]]
 name = "urlencoding"
 version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 [[package]]
 name = "usvg"
 version = "0.48.1"
@@ -4495,6 +4962,22 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "626c4bac6755d76ffc12cb01b2eac751db1996b9e0041de9aa02c8c211ddc82c"
 [[package]]
 name = "winapi"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
 dependencies = [
 "winapi-i686-pc-windows-gnu",
 "winapi-x86_64-pc-windows-gnu",
 ]
 [[package]]
 name = "winapi-i686-pc-windows-gnu"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -4504,6 +4987,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 [[package]]
 name = "windows-core"
 version = "0.62.2"
@@ -7,7 +7,9 @@ edition = "2024"
 ammonia = "4.1.4"
 anyhow = "1.0.104"
 askama = "0.16.0"
 async-trait = "0.1.92"
 axum = "0.8.9"
 axum-login = { git = "https://github.com/maxcountryman/axum-login.git", rev = "151c72d7a1b4646830f86b4332e6bd6e34d719a7", version = "0.18.0" }
 base64 = "0.23.1"
 clap = { version = "4.6.6", features = ["derive"] }
 dom_smoothie = "0.18.0"
@@ -19,6 +21,7 @@ hmac = "0.13.0"
 image = "0.25.10"
 jiff = { version = "0.2.35", features = ["serde"] }
 libc = "0.2.189"
 password-auth = "1.0.0"
 rand = "0.10.2"
 reqwest = { version = "0.13.4", default-features = false, features = [
    "rustls",
@@ -30,6 +33,7 @@ reqwest = { version = "0.13.4", default-features = false, features = [
    "system-proxy",
 ] }
 resvg = "0.48.1"
 rpassword = "7.5.4"
 scraper = "0.27.0"
 serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
@@ -44,15 +48,21 @@ sqlx = { version = "0.9.0", default-features = false, features = [
    "tls-rustls-ring",
 ] }
 thiserror = "2.0.20"
 time = "0.3.55"
 tiny-skia = "0.12.0"
 tokio = { version = "1.53.1", features = ["full"] }
 tokio-util = { version = "0.7.19", features = ["io"] }
-tower-http = { version = "0.7.0", features = ["trace", "fs"] }
+toml = "1.1.4"
 toml_edit = "0.25"
 tower-http = { version = "0.7.0", features = ["trace", "fs", "request-id"] }
 tower_governor = { version = "0.8.0", features = ["axum"] }
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 url = { version = "2.5.8", features = ["serde"] }
 [dev-dependencies]
 figment = { version = "0.10.19", features = ["test", "toml", "env"] }
 roxmltree = "0.21.1"
 tempfile = "3.27.0"
 tower = { version = "0.5.3", features = ["util"] }
 zip = { version = "6", default-features = false, features = ["deflate"] }
@@ -30,6 +30,7 @@ Gemini (or anything OpenAI-compatible) is a config line plus an API key.
 - Full design: [`docs/plans/2026-08-15-the-daily-epub.md`](docs/plans/2026-08-15-the-daily-epub.md)
 - Implementation decisions: [`docs/plans/2026-08-15-implementation-notes.md`](docs/plans/2026-08-15-implementation-notes.md)
 - Web dashboard rollout: [`docs/runbooks/web-dashboard-rollout.md`](docs/runbooks/web-dashboard-rollout.md)
 ---
@@ -114,7 +115,7 @@ sudo install -m0755 target/release/daily-epub /usr/local/bin/
 ```
 daily-epub generate [--date YYYY-MM-DD] [--dry-run] [--out DIR] [--max-articles N] [--skip-llm] [--skip-embeddings] [--rescore]
-daily-epub serve                # rating endpoints + OPDS catalog + downloads
+daily-epub serve                # public site, private dashboard, OPDS, ratings, downloads
 daily-epub profile rebuild      # regenerate learned profile adjustments
 daily-epub ratings list [--days 90] [--label loved|good|down|cleared]
 daily-epub ratings set --article 42 --label loved --note "excellent"
@@ -127,6 +128,14 @@ daily-epub features prune       # stale embeddings, old telemetry and assessment
 daily-epub backfill-social [--days 7]   # re-poll social scores for recent articles
 daily-epub db migrate           # run migrations (also automatic on every start)
 daily-epub config check         # validate the config, print the resolved roles, keys and paths
 daily-epub users add USER [--admin] [--password-stdin]
 daily-epub users passwd USER [--password-stdin]
 daily-epub users role USER user|admin
 daily-epub users disable USER
 daily-epub users enable USER
 daily-epub users list
 daily-epub users logout USER    # revoke all of USER's sessions
 daily-epub job run NAME         # systemd job-unit entry point; normally not run by hand
 ```
 `--dry-run` does everything except deliver: it still ingests, persists entries and
@@ -177,6 +186,59 @@ start with `!`. It exits non-zero only on a validation error — a missing key o
 file is a warning, since the run degrades rather than fails — and never opens
 the database or takes the lock, so it is safe to run next to a live `generate`.
 ## Web site and dashboard
 The server is both the public newspaper index and the private operator UI. An
 anonymous visitor sees only titles, authors, sources, metadata and outbound
 comment links; generated and scraped text stays private. A signed-in `user`
 sees complete issues and article chapters and can download artifacts. An
 `admin` can additionally rate articles and use every `/dashboard/*` page,
 including settings and jobs. Personalization is shared across accounts for now.
 Accounts are deliberately managed on the host, not in the browser. Usernames
 are case-insensitive and passwords must be 12–1024 characters. Bootstrap with
 `daily-epub users add <username> --admin`; use `users passwd`, `role`,
 `disable`/`enable`, `list`, and `logout` for later administration. Password
 changes and disabling a user revoke that user's sessions. `/dashboard/users`
 is a read-only view of roles, status, login times, and open sessions.
 The Jobs page starts only the fixed job catalogue as
 `daily-epub-job@<name>.service`; the web server never runs the pipeline inside
 its own process. Install `systemd/daily-epub-job@.service` and the narrowly
 scoped `systemd/50-daily-epub.rules` polkit rule, and put the server user in
 `systemd-journal` so the page can show status and its configured journal tail.
 Set `server.jobs_enabled = false` to make starts unavailable.
 The Settings page derives its fields from `Config`, rewrites `config.toml` in
 place with `toml_edit`, preserves comments/order and file permissions, validates
 before an atomic rename, and records attributed history. It re-reads hand edits
 on the next view. `DAILY_EPUB_*` overrides appear locked, and secrets are shown
 only as present or absent. Shipped providers (`deepseek`, `anthropic`,
 `gemini`) cannot be removed because defaults would restore them; leave one
 unreferenced or edit it. Custom providers can be removed after no `[llm]` role
 references them. The service needs `/etc/daily-epub` in `ReadWritePaths` for
 these writes.
 ### Web routes
 | Route | Access | Purpose |
 |---|---|---|
 | `GET /`, `/issues`, `/issues/{date}`, `/feed.xml` | Public | Latest issue, archive, stripped issue index, and equivalent Atom feed. Signed-in issue views expand to the complete issue. |
 | `GET /issues/{date}/articles/{id}`, `/world`, `/behind` | User or admin | Private article, World Briefing, and Behind the paper chapters. |
 | `GET /robots.txt`, `/static/{file}` | Public | Crawler policy and embedded CSS, JavaScript, and favicon. |
 | `GET/POST /login`, `POST /logout` | Public/session | Sign in and out; login attempts are throttled per client IP. |
 | `GET /account`, `POST /account/password`, `/account/logout-all` | User or admin | Change the current password or revoke sessions. |
 | `POST /rate` | Admin | Append an attributed dashboard rating event. |
 | `GET /dashboard` | Admin | Run, budget, rating, job, and config overview. |
 | `GET /dashboard/runs[/{id}]`, `/articles[/{id}]`, `/ratings`, `/stats` | Admin | Pipeline history, article explanations, rating contributions/history, and evaluation stats. |
 | `GET/POST /dashboard/profile`, `POST /dashboard/profile/restore` | Admin | Edit `profile.md`, inspect prompts/adjustments, and restore a version. |
 | `GET/POST /dashboard/settings`, `POST /dashboard/settings/providers`, `GET /dashboard/settings/history` | Admin | Edit validated configuration and inspect its audit log. |
 | `GET /dashboard/jobs`, `GET /dashboard/jobs/{id}`, `POST /dashboard/jobs/{name}` | Admin | Start fixed systemd jobs and inspect status and logs. |
 | `GET /dashboard/users` | Admin | Read-only users and open-session list; edits use the CLI. |
 | `GET /files/epub/{name}`, `/files/xtc/{name}` | Public if Basic auth is unset; otherwise session or Basic auth | Published downloads. Keeping them public when Basic auth is absent preserves existing OPDS acquisition links. |
 | `GET /opds`, `/opds/`, `/opds/daily.xml` | Existing optional Basic auth | OPDS acquisition feed. |
 | `GET /r/...`, `/healthz`, `/issues.json` | Existing policy | HMAC rating links, health, and issue reports. |
 ---
 ## Configuration
@@ -293,7 +355,12 @@ prints what resolved.
 | `server.bind` | `127.0.0.1:3499` | Listen address. |
 | `server.public_url` | `https://daily.hallada.net` | Base URL the rating links inside the EPUB are built from. |
 | `server.hmac_secret` | — | **`DAILY_EPUB_SERVER__HMAC_SECRET`** (or `DAILY_EPUB_SECRET`). Without it, generated links are rejected with 403. |
-| `server.basic_auth_user` / `_pass` | unset | Optional Basic auth for `/opds/*` and `/files/*`. |
+| `server.basic_auth_user` / `_pass` | unset | Optional Basic auth for `/opds/*` and `/files/*`; signed-in web users may download from `/files/*` without Basic auth. |
 | `server.session_days` | `30` | Sliding lifetime for dashboard login sessions. |
 | `server.login_attempts` | `10` | Login attempts allowed per IP in one throttle window. |
 | `server.login_window_minutes` | `15` | Length of the login throttle window. |
 | `server.jobs_enabled` | `true` | Allow the dashboard to start the fixed systemd job catalogue. |
 | `server.journal_lines` | `300` | Journal lines shown on a dashboard job page (10–5000). |
 `[curation.ranking]` holds the ranker's tunables. The learned signals are
 gated: `knn` (rated-neighbour preference) ramps from `knn_floor` (8) to
@@ -361,15 +428,21 @@ sudo setfacl -m u:daily-epub:rwx /srv/bookorbit/libraries/daily-epub   # or chow
 # units
 sudo install -m0644 systemd/daily-epub.service systemd/daily-epub-generate.service \
-                    systemd/daily-epub-generate.timer /etc/systemd/system/
+                    systemd/daily-epub-generate.timer systemd/daily-epub-job@.service \
                    /etc/systemd/system/
 sudo install -m0644 systemd/50-daily-epub.rules /etc/polkit-1/rules.d/
 sudo systemctl daemon-reload
 sudo systemctl enable --now daily-epub.service daily-epub-generate.timer
 ```
-> **Keep `ReadWritePaths` in sync.** Both units run under `ProtectSystem=strict`
+> **Keep `ReadWritePaths` in sync.** The units run under `ProtectSystem=strict`
-> and list the publish directories explicitly:
+> and list the publish directories explicitly; the server additionally lists
 > `/etc/daily-epub` so Settings can replace `config.toml`:
 > ```
 > # generate and job units
 > ReadWritePaths=/home/thallada/bookorbit/books/daily-epub /var/lib/daily-epub/xtc
 > # server unit
 > ReadWritePaths=/home/thallada/bookorbit/books/daily-epub /var/lib/daily-epub/xtc /etc/daily-epub
 > ```
 > If you change `publish.epub_dir` or `publish.xtc_dir` in the config, change
 > these lines too and `systemctl daemon-reload`, or publishing fails with
@@ -383,6 +456,9 @@ Node for the XTC converter, whose JIT needs W+X pages.
 The rating links baked into every article chapter point at
 `server.public_url`, so `daily.hallada.net` must resolve and serve TLS from the
 internet (e-readers tap these links). The OPDS catalog rides on the same host.
 The login throttle's `SmartIpKeyExtractor` trusts `X-Forwarded-For`; this is
 safe only because the configured bind address is loopback and nginx is the
 only process that can reach it.
 With an existing certificate, a minimal nginx site is:
 ```nginx
@@ -698,5 +774,6 @@ From spec §7, plus what implementation turned up:
  `triage:` / `assess:` log lines (`… 3 rejected (2 recovered on gemini)`), the
  ` · N rejected` suffix on the `curation:` line, or
  `sqlite3 /var/lib/daily-epub/daily-epub.db "select stage, count(*) from article_assessments where kind = 'provider_rejected' group by stage"`.
- **One reader, one issue per day.** There is no multi-user support and no
+- **One shared reader profile, one issue per day.** Multiple login accounts and
-  weekly/retrospective edition (spec §6).
+  `user`/`admin` roles are supported, but they share one personalization model;
  there is no per-user issue or weekly/retrospective edition (spec §6).
@@ -1,4 +1,4 @@
 [general]
 # EPUB chapter templates live next to the builder that renders them
 # (implementation notes §11).
-dirs = ["src/epub/templates"]
+dirs = ["src/epub/templates", "src/web/templates"]
@@ -208,9 +208,15 @@ format = "xtch"                      # xtc (1-bit) | xtch (grayscale)
 settings = "/etc/daily-epub/xtc-settings.json"
 [server]
-bind = "127.0.0.1:3499"
+bind = "127.0.0.1:3499"              # listen address; keep loopback when trusting proxy IP headers
-public_url = "https://daily.hallada.net"
+public_url = "https://daily.hallada.net" # base URL for EPUB rating links and same-origin checks
 session_days = 30                    # sliding lifetime for web login sessions
 login_attempts = 10                  # login POSTs allowed per client IP in one throttle window
 login_window_minutes = 15            # length of the login throttle window
 jobs_enabled = true                  # let the dashboard start daily-epub-job@<name>.service
 journal_lines = 300                  # job-page journal tail; valid range 10..=5000
 # hmac_secret via DAILY_EPUB_SERVER__HMAC_SECRET env (32+ random bytes)
-# Optional Basic auth for the XTC OPDS feed and file downloads:
+# Optional Basic auth for /opds/* and /files/*; without it those existing
 # routes remain public. A signed-in web user can download without Basic auth.
 # basic_auth_user = "daily"
 # basic_auth_pass = "..."
@@ -221,3 +221,59 @@ implementer needs that are easy to get wrong:
  `assessment_reuse_days`, `--rescore` ignores it, and `admit::hygiene` never treats it as a low
  score. Because a recovered article's row carries the editor's model, reuse accepts rows whose
  `model` is either configured model (`triage::reusable_models`).
 ## Web dashboard (2026-09-03)
 Verified on the production host and against the implemented dependency graph on 2026-09-03:
 - **Host authorization and units:** polkit 124 supports JavaScript rules. The installed rule must
  grant user `daily-epub` only `org.freedesktop.systemd1.manage-units`, verb `start`, for units
  matching `^daily-epub-job@[a-z0-9-]+\.service$`. `daily-epub.service` now needs
  `SupplementaryGroups=systemd-journal` to read job logs and `/etc/daily-epub` in
  `ReadWritePaths` to atomically replace `config.toml`. The job template deliberately omits
  `MemoryDenyWriteExecute` because generate jobs can launch Node's JIT; the server retains it.
 - **Settings writes:** direct `toml_edit 0.25` performs typed, comment/order-preserving updates.
  A candidate file is loaded through `Config::load` before its permissions are copied and it is
  renamed over the original. The process therefore needs write access to the containing
  directory, not only the file. Every changed dotted key is written to `config_changes`.
 - **Authentication stack:** `axum-login` is pinned to git revision
  `151c72d7a1b4646830f86b4332e6bd6e34d719a7`, whose graph contains `tower-sessions 0.15`.
  The local `SqliteSessionStore` uses this crate's existing sqlx 0.9 pool because the published
  tower SQLx store is incompatible. `password-auth 1.0` supplies Argon2id PHC hashes;
  `tower_governor 0.8` throttles login POSTs. Its smart IP extractor trusts forwarded headers,
  so production must bind to loopback and accept traffic only from the configured reverse proxy.
 - **Test environment:** router tests use `tower::ServiceExt::oneshot`, temp SQLite databases and
  `MockRunner`; they do not bind or invoke systemd. This sandbox forbids loopback listeners, so
  the four `curate::llm::tests::anthropic_*` tests, the three OpenAI tests using the same fake
  listener, `extract::tests::relative_urls_resolve_against_the_url_we_landed_on`, the five
  listener-based `server::tests::*`, and `tests/m7_server.rs` are filtered only for sandbox runs.
  The complete suite is expected to run outside the sandbox.
 Implementation-time decisions recorded while landing dashboard steps 1–7:
 - `/files/*` remains public when Basic auth is not configured, preserving existing OPDS
  acquisition behavior. With Basic auth configured, either valid Basic credentials or any valid
  web session authorizes a download. This intentionally resolves the plan's conflicting request
  to redirect unauthenticated downloads in favor of its compatibility acceptance criterion.
 - Final reports are attached to an issue after `finish_run`, when publish timing and status are
  complete. Issue snapshots omit article bodies and rehydrate them from `articles`; old rows use
  the reduced fallback renderer. The CLI password prompt uses `rpassword` after it became
  available to the orchestrator.
 - Flash handlers extract the exact tower session installed by the auth layer through
  `Extension<Session>`. Dashboard `down` forms persist the established `not_for_me` label.
  Ratings-page feed credit includes rating decay because that is what `signals::feed_rates`
  actually uses; the stored prompt verdict count is inferred from the prompt text because
  `TasteProfile.verdicts` is not persisted.
 - Dynamic list SQL is assembled only from fixed fragments and allow-listed sort/filter names,
  wrapped in sqlx 0.9's `AssertSqlSafe`; all user values remain bound parameters. Funnel bars
  count rows that reached each stage because a row stores the stage where it stopped. SVG/meter
  attributes replace inline styles under the CSP. Article pages omit the nominal extract method
  because database reconstruction currently hard-codes it and would display misleading data.
 - Shipped providers cannot be removed: deleting one would cause `Config::default()` to restore
  it. They remain editable and may be unreferenced; custom providers are removable. An absent
  setting already equal to its submitted default stays absent. Settings that are captured while
  building the server, session, or throttle layers carry restart notices.
 - A job start reloads a hand-edited config before inserting and starting the unit, retaining the
  last-good config if reload fails. The offline lifecycle test uses `features-prune`; generate
  run-id linkage is covered separately. CLI duration statistics retain finished dry runs for
  byte-identical output, while dashboard run series and overview sparklines exclude them.
@@ -0,0 +1,811 @@
 # Web site and operator dashboard
 **Date:** 2026-09-03
 **Repository:** `thallada/the-daily-epub`
 **Status:** implementation plan, ready to execute
 **Builds on:** `docs/plans/2026-09-02-personalized-curation-v2.md` (the ranker this dashboard inspects; its §23 deferred a "web dashboard for ratings and knobs" — this is that plan)
 This plan is written so that a fresh implementation agent can execute it end to end. It records the decisions made in the 2026-09-03 brainstorming session with the operator, the verified facts about the current code and the production host, the target design in enough detail to code from, and the order in which to land it.
 ---
 ## 0. Decisions recorded from the brainstorm (2026-09-03)
 These are settled. Do not reopen them during implementation.
 | Topic | Decision |
 |---|---|
 | Purpose | Publicly, `https://daily.hallada.net` is an aggregator: every issue as a stripped HTML page of titles linking out, authors, sources and comment links. Privately, after login, it is the operator's dashboard: every article ever considered and why it was or was not in the paper, the full rating history with edits, every issue in full HTML with downloads, all config knobs, and pipeline actions. |
 | Frontend | Server-rendered **askama** templates plus one hand-written CSS file and a few hundred lines of plain JavaScript. No node build, no SPA, no framework; assets are embedded in the binary with `include_str!`. |
 | Auth | Username + password, sessions in a SQLite table, one `HttpOnly; Secure; SameSite=Lax` cookie. Users are created from the CLI (`daily-epub users add`). No third-party identity, no passkeys. **Use the ecosystem, not hand-rolled code**: `axum-login` over `tower-sessions` for login/logout/session lifecycle and route guards, `password-auth` for argon2 hashing, `tower_governor` for the login throttle. axum-login is taken from **git at the pinned rev `151c72d7a1b4646830f86b4332e6bd6e34d719a7`** (`main`, 2026-05-07: tower-sessions 0.15 and the finalized `Require` API), not from the 0.18.0 crates.io release; §2 records why and what was verified. The only auth code we write is a ~60-line `SessionStore` over our own sqlx pool (the official store pins sqlx 0.8; we are on 0.9) and the `AuthnBackend` glue (§6). |
 | Roles | `user` and `admin`. **Signed-in users of either role** see every issue in full HTML (Brief, summaries, article bodies, discussions, World Briefing, Behind the paper) and can download the EPUB/XTC files. **Admins** additionally rate, browse the dashboard, edit settings and the profile, and start jobs. |
 | Copyright boundary | Anonymous visitors never see generated or scraped text: no Brief, no summaries, no `why` lines, no article bodies, no comments, no World Briefing. Sections, reading time and word count are fine. The public renderer takes a dedicated `PublicIssue` type that cannot carry the private fields. |
 | Personalization | One shared algorithm for now. `rating_events` gains a nullable `user_id` so a per-user algorithm is possible later; nothing else is per user. HMAC links from the EPUB stay unattributed (`user_id NULL`, `source = 'epub'`). |
 | Settings | Every key of `config.toml`, grouped by table, editable from the UI and written back **in place with comments preserved** (`toml_edit`). A key overridden by a `DAILY_EPUB_*` environment variable is shown locked. API keys and the HMAC secret are shown as present/absent only. The page re-reads the file on every view, so hand edits show up. `data/profile.md` gets an editor with version history. |
 | Actions | A Jobs page starts pipeline work through **systemd**: `systemctl start daily-epub-job@<name>.service`, permitted by a polkit rule for the `daily-epub` user. The server never runs the pipeline in-process (its unit has `MemoryDenyWriteExecute=yes`, which the XTC converter's Node JIT cannot live with). |
 | Feed | A public Atom feed at `/feed.xml` with one entry per issue, carrying the same stripped list as the public page. |
 | Existing routes | `/r/…`, `/opds…`, `/files/…`, `/healthz`, `/issues.json` keep working unchanged. `/files/*` additionally accepts a session cookie. |
 | Retention | HTML issue pages are built from the database, so they outlive the EPUB files (`retention_days`); download links appear only while the file exists. The operator should raise `curation.ranking.telemetry_retention_days` if they want candidate history beyond 180 days; this plan does not change the default. |
 | Design | Newspaper masthead in a serif, dashboard tables in the system sans stack, no external fonts or CDNs, light and dark via `prefers-color-scheme`, every wide table scrolls inside its own container. |
 ---
 ## 1. Read these first
 - `docs/plans/2026-08-15-implementation-notes.md` — conventions (runtime sqlx queries, `jiff`, error style, askama, no network in tests). All of it applies here.
 - `docs/plans/2026-09-02-personalized-curation-v2.md` §6 (feedback), §7 (tables), §9–§13 (signals, admission, utility, editor — the numbers the dashboard explains), §15 (explain/stats), §19 (config).
 - `src/server.rs` — the existing axum router, `AppState`, `handle_rating`, Basic auth, `safe_join`, the tiny e-ink pages. This plan extends this file's router and moves nothing.
 - `src/auth.rs` — HMAC rating links (unchanged).
 - `src/config.rs` — `Config`, `Config::load`, `Config::resolve_path`, `validate`, `check_report`, `providers_redacted`, `stale_toml_error`, `ENV_PREFIX`/`ENV_SPLIT`.
 - `src/db.rs` — `Db`, `current_ratings`, `append_rating_event`, `upsert_issue`, `replace_issue_articles`, `start_run`/`finish_run`, `provider_spend_for_utc_day`, `get_article`.
 - `src/curate/telemetry.rs` — `ExplainRow`, `resolve_run`, `explain_row`, `near_misses`, `render_explain`, `stats`, `SignalsJson`. The dashboard renders the same data as HTML.
 - `src/curate/signals.rs` — `decay`, `gate`, `direct_feeds`, `PreferenceState::load/summary`, used by the ratings page.
 - `src/curate/profile/mod.rs` — `parse_profile_str`, `load_profile`, `load_or_build`, `rebuild`, `KV_LEARNED_ADJUSTMENTS`.
 - `src/epub/chapters.rs`, `src/epub/templates/` — what an issue contains and how it is rendered; `prepare_body`, `social_line`, `behind_*_line`, `render_in_this_issue`.
 - `src/epub/fixtures.rs` — `fixtures::issue()` builds a full `Issue` for tests; the web tests use it.
 - `src/main.rs` — CLI layout (`clap` derive), `lock_holder`, `cmd_*` helpers.
 - `systemd/`, `README.md` §"Reverse proxy", `docs/runbooks/curation-v2-migration.md` — how the host is set up.
 ---
 ## 2. Verified facts (2026-09-03)
 Host and deployment (checked on the production box, which is also the dev checkout):
 - nginx site `daily` proxies `/` → `http://127.0.0.1:3499` with `Host`, `X-Forwarded-For` and `X-Forwarded-Proto` set, TLS from Let's Encrypt, HTTP→HTTPS redirect. `snippets/security-headers.conf` adds `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: strict-origin-when-cross-origin`, a `Permissions-Policy`, and HSTS. **No Content-Security-Policy**, so inline `<script>`/`<style>` would work, but this plan serves CSS/JS from `/static/` anyway and adds its own CSP header from the app (§16).
 - `daily-epub.service` and `daily-epub-generate.timer` are active. Both units run as `daily-epub` (uid 995, no supplementary groups) with `ProtectSystem=strict`, `ProtectHome=read-only`, `ReadWritePaths=/home/thallada/bookorbit/books/daily-epub /var/lib/daily-epub/xtc`, `StateDirectory=daily-epub`. **`/etc/daily-epub` is therefore read-only inside the server** — the settings writer needs `ReadWritePaths=/etc/daily-epub` (§18). The server unit alone has `MemoryDenyWriteExecute=yes`.
 - `/etc/daily-epub/config.toml` is `0640 daily-epub:daily-epub` (per the unit header and runbook); `/etc/daily-epub/env` holds the API keys and `DAILY_EPUB_SERVER__HMAC_SECRET`.
 - polkit is version 124 (JavaScript rules in `/etc/polkit-1/rules.d/` are supported). `journalctl -u <unit>` as `daily-epub` requires membership in `systemd-journal` (gid 999).
 - `systemctl show -p ActiveState,SubState,Result,ExecMainStatus,ExecMainStartTimestamp,ExecMainExitTimestamp <unit>` works unprivileged and is the status source for jobs.
 Code:
 - `issues.report_json` is **never written**: `pipeline::record_issue` passes `None` to `upsert_issue`, and nothing else sets it, so `GET /issues.json` returns `"report": null` for every issue. `runs` keeps only counters. This plan fixes both (§5.3).
 - The World Briefing and the discussion chapters are built at run time and never persisted; `Issue` (with `Lineup`, `Editorial`, `WorldBriefing`, `Colophon`, `BehindThePaper`, `Pick.discussion`) derives `Serialize`/`Deserialize`. Article bodies live in `articles.content_html` for every article ever ingested; nothing prunes `articles`.
 - `Config::load(explicit)` reads `--config` or `./config.toml`, then `DAILY_EPUB_*` env (`ENV_PREFIX = "DAILY_EPUB_"`, `ENV_SPLIT = "__"`), accepts `DAILY_EPUB_SECRET` as an alias for `server.hmac_secret`, then `validate()`. `Config::resolve_path` returns the path `load` used. `Config` and every sub-struct derive `Serialize`/`Deserialize` with `deny_unknown_fields`; `Config::default()` is the shipped example key for key (a test enforces it).
 - `main::serve` receives `(config, db)` only; the config path is not passed through. `AppState { db, config }` is cloned per request.
 - Crates already present: `axum 0.8`, `askama 0.16`, `tower-http 0.7` (`trace`, `fs`), `sqlx 0.9` (sqlite, runtime queries), `jiff`, `serde_json`, `sha2`, `hex`, `hmac`, `base64`, `rand 0.10`, `ammonia`, `figment`, `libc`. `toml_edit` and `toml` are in `Cargo.lock` transitively (via figment) but not direct dependencies; `tower` is transitive only.
 - Current crates.io versions (checked with `cargo search` on 2026-09-03): `toml_edit 0.25.13`, `tower 0.5.3`, `askama 0.16.0`. Add with `cargo add` and let Cargo resolve; do not hand-pin older versions.
 Auth ecosystem (crates.io dependency metadata and docs.rs, checked 2026-09-03):
 - **`axum-login` 0.18.0** (crates.io, released 2025-07-20, ~1M downloads): `axum ^0.8.1`, `tower-sessions ^0.14` (re-exported as `axum_login::tower_sessions`), `tower-cookies ^0.11`. Exports `AuthUser` (`id()`, `session_auth_hash()`), `AuthnBackend` (`authenticate`, `get_user`), `AuthzBackend` (`get_user_permissions`), the `AuthSession` extractor, `AuthManagerLayerBuilder::new(backend, session_layer).build()`, and the `login_required!`, `permission_required!`, `predicate_required!` route-layer macros. Login cycles the session id (fixation defence) and stores the user's `session_auth_hash`, so changing a password invalidates every session of that user.
 - **`axum-login` `main` at `151c72d7a1b4646830f86b4332e6bd6e34d719a7`** (2026-05-07, "Upgrade tower-sessions to 0.15.0 (#315)"; 13 commits past `v0.18.0`, none since; the default branch is `main`, there is no `master`). What changed since 0.18.0 (CHANGELOG "Unreleased" + diff): `tower-sessions ^0.15`; the new builder-based `require` module (`Require::<Backend>::builder().decision(PermissionsPredicate).unauthenticated(RedirectHandler::new().login_url(..).redirect_field(..)).build()`) with the macros rewritten as thin wrappers over it; `permission_required!` answers 401 when unauthenticated (302 to `login_url` when one is given) and 403 only when authenticated without the permission; `AuthSession` is now `Clone` over an `Arc<Mutex<_>>` with `login(&self, &user)`, `logout(&self)`, `authenticate(&self, creds)`, **`user().await -> Option<User>` (a method, no longer a public field)** and `backend()`; the `session` field is no longer public (use tower-sessions' own `Session` extractor for flashes); the `async-trait` dependency is gone (native async fn in traits). The user id is stored in the session under the key `"axum-login.data"` (configurable with `AuthManagerLayerBuilder::with_data_key`).
  **Verified locally on 2026-09-03** (nightly 1.100, 2026-09-01) at that rev: `cargo clippy --lib --all-features` clean; `cargo test --doc` 15/15; `cargo test --lib` 79/79 once the unit-test modules use `MemoryStore` instead of `tower_sessions_sqlx_store::SqliteStore`; `tests/feature_gates.rs` passes. A scratch consumer crate depending on the git rev together with `tower-sessions 0.15`, `sqlx 0.9` (sqlite, single copy, single `libsqlite3-sys 0.37`), `axum 0.8.9`, `tower_governor 0.8`, `password-auth 1.0` and the §6.2 store implementation compiles (`cargo check`, `cargo tree -d` shows no second sqlx or sqlite).
  **Why the repository's CI is red** (the push run for that commit fails at the `check` job's clippy step and skips the tests): the crate's dev-dependency and its examples use `tower-sessions-sqlx-store 0.15.0`, which depends on `tower-sessions-core 0.14`; against `tower-sessions 0.15` that store no longer implements the (0.15) `SessionStore` trait, so the test targets and the examples fail to compile and the integration tests (which spawn the example binaries) fail. That is a harness/examples problem in the stores repository lagging behind, not a library defect; our own store is written against whatever `tower-sessions` axum-login re-exports, so it is unaffected either way.
  **Maintenance status** (discussion #330, opened 2026-07-12 by the author): "I don't have the time I would like to maintain axum-login"; three volunteers (one collaborator offering co-maintenance, one asking about updating the stores for 0.15 on 2026-08-06) and no release or new commit since 2026-06. Expect a 0.19 eventually; pinning the rev means the plan's API is the one 0.19 will ship, and a later switch to the crates.io release is a one-line `Cargo.toml` change.
  **Fallback** if the git dependency is ever unwanted: `axum-login = "0.18"` from crates.io with `tower-sessions 0.14`; the only source differences are `auth.user` (field) instead of `auth.user().await`, `&mut auth` for `login`/`logout`, and `pub session` on `AuthSession`.
 - **`tower-sessions` 0.15.0** (`SessionManagerLayer::new(store).with_secure(..).with_same_site(..).with_name(..).with_expiry(Expiry::OnInactivity(time::Duration))`): lazy — no cookie is set unless a handler touches the session, so anonymous pages stay cookie-free. `SessionStore` is a trait with `save`, `load`, `delete` (and a provided `create`) over `Record { id: Id, data: HashMap<String, serde_json::Value>, expiry_date: time::OffsetDateTime }`; the trait is unchanged from 0.14. 0.15 over 0.14 is only the `rand 0.9` bump and a memory-ordering fix in the session's modified-flag handling (#254), which is the other reason to take the git rev of axum-login rather than 0.18.0.
 - **`tower-sessions-sqlx-store` 0.15.0** pins **`sqlx ^0.8`** (and `tower-sessions-core 0.14`). This crate is on `sqlx 0.9`; two sqlx versions would each bundle SQLite and collide on the `links = "sqlite3"` native key, so the official store **cannot** be used. A store over our own pool is ~60 lines (§6.2).
 - **`password-auth` 1.0.0** (`generate_hash(password) -> String` PHC/argon2id, `verify_password(password, hash) -> Result<(), VerifyError>`; `argon2 ^0.5` inside). The crate axum-login's own SQLite example uses.
 - **`tower_governor` 0.8.0** (`governor 0.10`, `axum` feature for `axum ^0.8`): `GovernorConfigBuilder::default().per_second(n).burst_size(n).key_extractor(SmartIpKeyExtractor)`, `GovernorLayer::new(config)`, a periodic `limiter.retain_recent()` cleanup, and `into_make_service_with_connect_info::<SocketAddr>()` on the server. `SmartIpKeyExtractor` reads `x-forwarded-for`, `x-real-ip`, `forwarded`, then the peer address.
 - **`axum_csrf` 0.11.0** (`axum-core ^0.5`, `cookie 0.18`): a signed-cookie token with a `CsrfToken` extractor (`authenticity_token()`, `verify()`). Compatible, but it is a second cookie plus per-form plumbing that `SameSite=Lax` and a fetch-metadata origin check already cover; kept as the fallback option (§6.4).
 - **`axum_session` 0.21 / `axum_session_sqlx` 0.11 / `axum_session_auth` 0.21** (released 2026-08-10): match `sqlx ^0.9` and `axum ^0.8.9` exactly and would need no custom store, but they add `chrono`, `dashmap` and `async-recursion`, create their own table outside our migrations, cache users in memory (`cache_clear_user` after a role change), and set a cookie for every visitor unless the session mode is changed. Rejected in favour of the larger and lazier `axum-login`/`tower-sessions` pair; recorded here so the choice is not re-litigated.
 - `askama.toml` has `dirs = ["src/epub/templates"]`; the EPUB templates are `.xhtml` with `escape = "html"` declared per template. `.html` templates are HTML-escaped by default.
 - `telemetry::resolve_run` treats the latest run with `status != 'dry_run'` as the run of a date; `RunStatus` is `running | ok | degraded | failed | dry_run`.
 - `db::current_ratings_including_cleared(lookback_days)` returns the latest explicit event per article joined with title, feed, latest summary and deep facets. `profile::MAX_RATINGS_IN_REBUILD` (200) and `RATINGS_LOOKBACK_DAYS` (36,500) are private constants; make the first `pub`.
 - `signals::decay(age_days, half_life)`, `signals::gate(n, floor, full)`, `signals::direct_feeds(&article)` and `PreferenceState::load(..)` + `summary()` exist and are `pub`.
 - Rating attribution today: `RatingEvent { source: "epub" | "cli" | "migration", .. }`; `"dashboard"` is already reserved in the plan's `source` comment.
 - `publish::issue_filename(date, edition, "epub")` gives the EPUB names the OPDS feed and `/files/epub/{name}` use; `issues.epub_path/x4_path/xtc_path` hold full paths.
 - `server.rs` unit tests call handlers and helpers directly (12 tests); `tests/m7_server.rs` drives the real binary over TCP with a hand-rolled HTTP client and an env-only configuration. Both patterns continue.
 ---
 ## 3. Site map and access levels
 | Route | Anonymous | Signed in (user) | Admin |
 |---|---|---|---|
 | `GET /` | latest issue, public rendering | latest issue, full rendering | same + rating buttons |
 | `GET /issues` | archive by month | same | same |
 | `GET /issues/{date}` | public issue page | full issue page + downloads | same + rating buttons |
 | `GET /issues/{date}/articles/{article_id}` | 302 → `/login?next=` | article chapter (body, discussion) | same + rating buttons |
 | `GET /issues/{date}/world`, `/behind` | 302 → login | the chapter | same |
 | `GET /feed.xml` | Atom, public content | same | same |
 | `GET /robots.txt` | allow `/`, `/issues`; disallow `/dashboard`, `/login`, `/files`, `/r`, `/opds` | | |
 | `GET /static/{file}` | `app.css`, `app.js`, `favicon.svg` | | |
 | `GET /login`, `POST /login`, `POST /logout` | login form | | |
 | `GET /account`, `POST /account/password` | 302 → login | change own password, sign out everywhere | same |
 | `GET /files/epub/{name}`, `/files/xtc/{name}` | Basic auth (existing) | session cookie **or** Basic auth | same |
 | `POST /rate` | 403 | 403 | append a rating event |
 | `GET /dashboard` | 302 → login | 403 page | overview |
 | `GET /dashboard/runs`, `/dashboard/runs/{id}` | | 403 | runs list, run detail with candidate table |
 | `GET /dashboard/articles`, `/dashboard/articles/{id}` | | 403 | every article, article detail |
 | `GET /dashboard/ratings`, `POST /rate` | | 403 | rating history, contributions, edit |
 | `GET /dashboard/profile`, `POST /dashboard/profile`, `POST /dashboard/profile/restore` | | 403 | `profile.md` editor, prompt, history |
 | `GET /dashboard/stats` | | 403 | the `stats` numbers as tables + sparklines |
 | `GET /dashboard/settings`, `POST /dashboard/settings`, `POST /dashboard/settings/providers`, `GET /dashboard/settings/history` | | 403 | every config key |
 | `GET /dashboard/jobs`, `POST /dashboard/jobs/{name}`, `GET /dashboard/jobs/{id}` | | 403 | start and watch jobs |
 | `GET /dashboard/users` | | 403 | list users and sessions (read-only; CLI edits) |
 | `GET /r/{date}/{article_id}/{vote}?t=` | HMAC (existing) | | |
 | `GET /opds…`, `/healthz`, `/issues.json` | existing behaviour | | |
 Every `/dashboard/*` page is `Cache-Control: no-store`. Every HTML response carries `Vary: Cookie`.
 Dates in paths are `YYYY-MM-DD` issue dates; ids are database ids. An unknown date or id is a 404 page in the site layout, not a bare string.
 ---
 ## 4. Architecture
 ### 4.1 Module layout
 ```text
 src/server.rs                  existing router + handlers; `router()` now merges `web::router()`
 src/web/
 ├── mod.rs                     WebState, `Html<T>` response helper, WebError, layout context, pagination, time formatting
 ├── session.rs                 `SqliteSessionStore` (tower-sessions `SessionStore` over our pool), `Backend` (axum-login `AuthnBackend` + `AuthzBackend`), `Viewer` helper, origin check middleware
 ├── users.rs                   User/Role types, password-auth hash/verify wrappers, `daily-epub users …` implementation
 ├── public.rs                  `/`, `/issues`, `/issues/{date}` (public branch), `/feed.xml`, `/robots.txt`, `PublicIssue`
 ├── issue.rs                   IssueView loader (issue_json → fallback), full issue page, article/world/behind pages, downloads gate
 ├── rate.rs                    `POST /rate` (form + JSON), rating widget data
 ├── dashboard/
 │   ├── mod.rs                 overview
 │   ├── runs.rs                runs list, run detail, candidate table, config diff
 │   ├── articles.rs            articles list, article detail
 │   ├── ratings.rs             ratings page, contributions
 │   ├── profile.rs             profile editor, history, prompt view
 │   ├── stats.rs               stats page (renders `telemetry::StatsData`)
 │   ├── settings.rs            settings schema, form, toml_edit writer, providers, history
 │   ├── jobs.rs                jobs page, JobRunner trait, systemctl/journalctl runner
 │   └── users.rs               users list page
 ├── static/
 │   ├── app.css
 │   ├── app.js
 │   └── favicon.svg
 └── templates/                 askama `.html` templates (§4.3)
 src/jobs.rs                    job catalogue (name → CLI equivalent), `daily-epub job run`, jobs table lifecycle
 migrations/0004_web.sql
 systemd/daily-epub-job@.service
 systemd/50-daily-epub.rules    polkit rule
 docs/runbooks/web-dashboard-rollout.md
 ```
 `askama.toml` becomes `dirs = ["src/epub/templates", "src/web/templates"]`. Web templates end in `.html`; there is no name collision with the `.xhtml` EPUB templates.
 ### 4.2 State
 ```rust
 pub struct AppState {
    pub db: Db,
    pub config: Arc<RwLock<Arc<Config>>>,     // swapped after a settings save or when the file's mtime changes
    pub config_path: Option<PathBuf>,        // Config::resolve_path(cli.config); None ⇒ settings read-only
    pub web: Arc<WebState>,
 }
 pub struct WebState {
    pub jobs: Arc<dyn JobRunner>,            // SystemdRunner in production, MockRunner in tests
    pub started_at: Timestamp,
    pub config_mtime: Mutex<Option<SystemTime>>,
 }
 impl AppState { pub fn config(&self) -> Arc<Config> }   // read-lock + clone the Arc
 ```
 `main::serve` gains the config path: `server::serve(config, config_path, db)`. Handlers that today read `state.config.server.*` call `state.config()` instead (mechanical change; keep the tests).
 **Config reload.** `WebState::reload_if_changed(&AppState)` compares the file's mtime with the cached one on every `/dashboard/settings` GET and every job start, re-runs `Config::load(config_path)` and swaps the Arc when it changed and validates. A file that fails validation is reported on the settings page (`! config.toml on disk does not load: <error>`) and the previous config stays live.
 ### 4.3 Templates and rendering
 - `layout.html`: `<head>` (charset, viewport, `<title>`, `/static/app.css?v={VERSION}`, Atom `<link rel="alternate">`, favicon), masthead ("The Daily EPUB", serif), primary nav (Latest · Archive · Feed · Sign in / account name), admin nav bar when the viewer is an admin (Overview · Runs · Articles · Ratings · Profile · Stats · Jobs · Settings · Users), `<main>`, footer (`daily-epub {VERSION}`), `/static/app.js` at the end.
 - Every page template `{% extends "layout.html" %}` and receives a `Page` context: `title`, `viewer: Option<Viewer { username, role }>`, `flash: Option<Flash>`, `active_nav`.
 - `Html<T: Template>` implements `IntoResponse`: renders, sets `text/html; charset=utf-8`, and on a render error logs and returns the 500 page.
 - `WebError { NotFound, Forbidden, Unauthenticated { next }, BadRequest(String), Csrf, Db(sqlx::Error), Internal(anyhow::Error) }` → `IntoResponse`. `Unauthenticated` redirects HTML requests to `/login?next=<path>` and returns 401 JSON to `Accept: application/json`.
 - Flash messages live in the tower-sessions session (`session.insert("flash", Flash { kind, text })`, removed when the next page reads it), so POST-redirect-GET can confirm "Saved 3 settings" or "Rated: Loved it". Only signed-in flows set flashes, so anonymous visitors never get a session cookie from this.
 - Templates (all under `src/web/templates/`): `layout.html`, `error.html`, `login.html`, `account.html`, `issue_public.html`, `issue_full.html`, `issue_list.html`, `article.html`, `world.html`, `behind.html`, `dashboard/overview.html`, `dashboard/runs.html`, `dashboard/run.html`, `dashboard/articles.html`, `dashboard/article.html`, `dashboard/ratings.html`, `dashboard/profile.html`, `dashboard/stats.html`, `dashboard/settings.html`, `dashboard/settings_history.html`, `dashboard/jobs.html`, `dashboard/job.html`, `dashboard/users.html`, plus partials `_rating_widget.html`, `_pagination.html`, `_signals_table.html`, `_candidate_row.html`, `_sparkline.html`.
 - Static assets: `include_str!` the three files; `GET /static/{file}` sets `Content-Type`, `Cache-Control: public, max-age=86400`, and an `ETag` of the sha256 (respond 304 to `If-None-Match`). The `?v={VERSION}` query busts caches across releases.
 ### 4.4 Design system (the one CSS file)
 - Tokens: `--bg`, `--fg`, `--muted`, `--rule`, `--accent`, `--loved`, `--good`, `--down`, redefined under `@media (prefers-color-scheme: dark)`.
 - Masthead and issue pages: Georgia/serif headings, `max-width: 72ch` reading column, hairline rules like the EPUB front page.
 - Dashboard: system sans, `max-width: 1200px`, dense tables (`font-size: .9rem`, sticky `<thead>`), every `<table>` wrapped in `.scroll-x { overflow-x: auto }`.
 - Components: `.badge` per stage/reason/label (`selected`, `shortlisted`, `assessed`, `admitted`, `triaged`, `eligible`, `excluded`, `loved`, `good`, `down`, `cleared`), `.kv` definition lists, `.funnel` (a horizontal bar per stage, widths proportional to counts), `.spark` (inline SVG polyline, server-rendered), `.rating` button group with the active verdict filled.
 - No layout JavaScript. `app.js` does exactly: intercept `.rating` forms and `POST` with `fetch` + `Accept: application/json`, then update the button state; confirm dialogs on `data-confirm` forms (jobs, provider removal, clear rating); auto-refresh `dashboard/job.html` every 5 s while the status is `requested`/`running`; a "filter as you type" on tables with `data-filter` (client-side, current page only); collapse/expand for `<details>` state kept in `localStorage` (guard with try/catch).
 ---
 ## 5. Data model — migration `0004_web.sql`
 Do not edit earlier migrations. Plain SQL, no Rust bootstrap.
 ### 5.1 Tables
 ```sql
 CREATE TABLE users (
    id            INTEGER PRIMARY KEY AUTOINCREMENT,
    username      TEXT NOT NULL UNIQUE COLLATE NOCASE,
    password_hash TEXT NOT NULL,                 -- PHC string from argon2
    role          TEXT NOT NULL CHECK (role IN ('user', 'admin')),
    disabled      INTEGER NOT NULL DEFAULT 0,
    created_at    TEXT NOT NULL,
    last_login_at TEXT
 );
 -- tower-sessions records (§6.2). `id` is the session Id's string form (a random
 -- 128-bit value the cookie carries), `data` the JSON-encoded record map.
 -- `expiry` is unix seconds because tower-sessions hands us a `time::OffsetDateTime`
 -- and the store compares it in SQL; `user_id` is denormalized from the
 -- axum-login entry in `data` so the Users page and `users logout` can find a
 -- user's sessions without decoding every row.
 CREATE TABLE sessions (
    id         TEXT PRIMARY KEY,
    data       TEXT NOT NULL,
    expiry     INTEGER NOT NULL,
    user_id    INTEGER REFERENCES users(id) ON DELETE CASCADE,
    created_at TEXT NOT NULL,
    updated_at TEXT NOT NULL
 );
 CREATE INDEX idx_sessions_user ON sessions(user_id);
 CREATE INDEX idx_sessions_expiry ON sessions(expiry);
 ALTER TABLE rating_events ADD COLUMN user_id INTEGER REFERENCES users(id) ON DELETE SET NULL;
 CREATE TABLE config_changes (
    id         INTEGER PRIMARY KEY AUTOINCREMENT,
    user_id    INTEGER REFERENCES users(id) ON DELETE SET NULL,
    key        TEXT NOT NULL,                     -- dotted path, e.g. curation.ranking.deep_keep
    old_value  TEXT,                              -- TOML literal as it was in the file (NULL = absent)
    new_value  TEXT,                              -- NULL = removed
    changed_at TEXT NOT NULL
 );
 CREATE INDEX idx_config_changes_at ON config_changes(changed_at);
 CREATE TABLE profile_versions (
    id       INTEGER PRIMARY KEY AUTOINCREMENT,
    content  TEXT NOT NULL,                       -- the profile.md text *before* the save (and one row for the first save's original)
    saved_by INTEGER REFERENCES users(id) ON DELETE SET NULL,
    saved_at TEXT NOT NULL
 );
 CREATE TABLE jobs (
    id           INTEGER PRIMARY KEY AUTOINCREMENT,
    name         TEXT NOT NULL,                   -- catalogue name, e.g. generate, dry-run, generate-2026-09-01
    unit         TEXT NOT NULL,                   -- daily-epub-job@<name>.service
    requested_by INTEGER REFERENCES users(id) ON DELETE SET NULL,
    requested_at TEXT NOT NULL,
    started_at   TEXT,
    finished_at  TEXT,
    status       TEXT NOT NULL CHECK (status IN ('requested', 'running', 'ok', 'failed')),
    message      TEXT,                            -- error text or one-line summary
    run_id       INTEGER REFERENCES runs(id) ON DELETE SET NULL
 );
 CREATE INDEX idx_jobs_requested_at ON jobs(requested_at);
 ALTER TABLE runs ADD COLUMN report_json TEXT;
 ALTER TABLE issues ADD COLUMN issue_json TEXT;
 ```
 ### 5.2 `issues.issue_json`
 The full `Issue` the pipeline assembled, serialized with `serde_json`, **with every `pick.article.content_html` replaced by an empty string** (bodies are already in `articles.content_html`; the discussion threads and the World Briefing are the parts that exist nowhere else). Written by `pipeline::record_issue` alongside the lineup. A regenerated date overwrites it. Expected size: 100–300 KB per issue.
 The web loader (`web::issue::load`) rehydrates each pick's body from `articles` by id. Issues published before this change have `issue_json IS NULL`; the loader then builds a reduced `Issue` from `issues` (`front_page_html` as the Brief, `issue_number`, `generated_at`), `issue_articles` (section, position, `is_lead`, `summary`, `why`) and `articles` — with `world_briefing = None`, `discussion = None`, `behind = Default`. Section order for the fallback is `config.curation.sections` order, then any unknown section names in first-seen order.
 ### 5.3 `runs.report_json` and `issues.report_json`
 `db::finish_run` writes `serde_json::to_string(report)` into `runs.report_json`. `pipeline::record_issue` passes the same string as `report_json` to `upsert_issue` (fixing the never-written column; `GET /issues.json` starts returning real reports). `RunReport` already serializes; nothing in it is secret (`config_json` is `providers_redacted()`).
 ### 5.4 Job attribution and rating attribution
 - `POST /rate` appends `RatingEvent { source: "dashboard", user_id: Some(viewer.id), .. }`. Extend `RatingEvent` with `pub user_id: Option<i64>` (default `None`; the `epub`/`cli` writers leave it `None`) and `db::append_rating_event` binds it. `db::current_ratings*` and `rated_article_from_row` gain the column so the ratings page can show who rated.
 - `jobs.run_id` is set by `daily-epub job run` for the `generate*` jobs from `GenerateOutcome` (add `pub run_id: i64` to `GenerateOutcome`; `pipeline::generate` already has it as `run_id`).
 ---
 ## 6. Authentication and sessions
 Sessions, login, logout and route guards come from **`axum-login` at the pinned git rev** (§2) over **`tower-sessions` 0.15** (the version it re-exports; use `axum_login::tower_sessions`, do not add `tower-sessions` separately). Passwords go through **`password-auth` 1.0**. The login throttle is **`tower_governor` 0.8**. What we write ourselves is limited to: the session store over our sqlx pool (§6.2), the `AuthnBackend`/`AuthzBackend` impl over the `users` table (§6.3), the origin check (§6.4), and the CLI.
 ### 6.1 Users and passwords (`src/web/users.rs`)
 ```rust
 pub enum Role { User, Admin }              // as_str: "user" | "admin"; parse; Display
 #[derive(Clone)]
 pub struct User { id: i64, username: String, password_hash: String, role: Role, disabled: bool, created_at, last_login_at }
 impl std::fmt::Debug for User { /* redact password_hash */ }
 pub fn hash_password(plain: &str) -> String            // password_auth::generate_hash (argon2id, random salt, PHC string)
 pub fn verify_password(hash: &str, plain: &str) -> bool // password_auth::verify_password(..).is_ok()
 ```
 Rules: usernames are 1–32 chars of `[A-Za-z0-9._-]`, compared case-insensitively (`COLLATE NOCASE`); passwords are at least 12 characters and at most 1,024. `password_auth::verify_password` is a blocking argon2 computation; call it inside `tokio::task::spawn_blocking` from the backend.
 CLI (`src/main.rs` + `web::users`), none of which take the run lock:
 ```text
 daily-epub users add <username> [--admin] [--password-stdin]   # hidden double prompt (rpassword), or one line from stdin
 daily-epub users passwd <username> [--password-stdin]          # also deletes the user's sessions (session_auth_hash changes anyway)
 daily-epub users role <username> user|admin
 daily-epub users disable <username> | enable <username>        # disable also deletes the user's sessions
 daily-epub users list                                           # username · role · created · last login · open sessions
 daily-epub users logout <username>                              # delete that user's sessions
 ```
 `users add` refuses a duplicate name; `--admin` on the very first user is the intended bootstrap (§18).
 ### 6.2 Session store (`src/web/session.rs`)
 ```rust
 #[derive(Clone, Debug)]
 pub struct SqliteSessionStore { pool: SqlitePool }
 #[async_trait]
 impl tower_sessions::SessionStore for SqliteSessionStore {
    async fn save(&self, record: &Record) -> session_store::Result<()>;          // INSERT … ON CONFLICT(id) DO UPDATE SET data, expiry, user_id, updated_at
    async fn load(&self, id: &Id) -> session_store::Result<Option<Record>>;      // SELECT data FROM sessions WHERE id = ? AND expiry > strftime('%s','now')
    async fn delete(&self, id: &Id) -> session_store::Result<()>;
 }
 impl SqliteSessionStore {
    pub async fn delete_expired(&self) -> Result<u64>;                            // on server start and once an hour from a tokio task
    pub async fn delete_for_user(&self, user_id: i64) -> Result<u64>;             // users passwd/disable/logout, "sign out everywhere"
 }
 ```
 `data` is `serde_json::to_string(&record.data)`; `expiry` is `record.expiry_date.unix_timestamp()`. `user_id` is read best-effort from `record.data["axum-login.data"]["user_id"]` (the key axum-login uses) and stored alongside, so the Users page and the CLI can list and delete a user's sessions without decoding every row; a record without that key (an anonymous session that set flash data) stores `NULL`. Map every sqlx error to `session_store::Error::Backend(e.to_string())`. This is the whole store: ~60 lines plus tests. It mirrors what `tower-sessions-sqlx-store` does, which we cannot link because it pins sqlx 0.8 (§2).
 Layer, built in `server::router`:
 ```rust
 let session_layer = SessionManagerLayer::new(SqliteSessionStore::new(db.pool().clone()))
    .with_name("daily_session")
    .with_http_only(true)
    .with_same_site(SameSite::Lax)
    .with_secure(config.server.public_url.starts_with("https://"))
    .with_expiry(Expiry::OnInactivity(time::Duration::days(config.server.session_days as i64)));
 let auth_layer = AuthManagerLayerBuilder::new(Backend::new(db.clone()), session_layer).build();
 ```
 `Expiry::OnInactivity` is the sliding lifetime. tower-sessions only writes a cookie when a handler touches the session, so anonymous page views create no rows and no cookie. Flash messages (§4.3) use tower-sessions' own `Session` extractor (`session.insert("flash", ..).await` / `session.remove(..).await`), since `AuthSession` no longer exposes its inner session.
 ### 6.3 Backend (`src/web/session.rs`)
 ```rust
 #[derive(Clone)] pub struct Backend { db: Db }
 pub struct Credentials { username: String, password: String, next: Option<String> }
 impl AuthUser for User {
    type Id = i64;
    fn id(&self) -> i64 { self.id }
    fn session_auth_hash(&self) -> &[u8] { self.password_hash.as_bytes() }   // password change ⇒ every session of the user is invalid
 }
 impl AuthnBackend for Backend {   // native async fn; no async-trait at this rev
    type User = User; type Credentials = Credentials; type Error = BackendError;
    async fn authenticate(&self, creds) -> Result<Option<User>> {
        // SELECT by username COLLATE NOCASE; verify against the row's hash, or against
        // a fixed dummy hash when the row is missing (equal timing); None when disabled.
    }
    async fn get_user(&self, id: &i64) -> Result<Option<User>> { /* None when disabled */ }
 }
 impl AuthzBackend for Backend {
    type Permission = Role;   // Hash + Eq + Clone
    async fn get_user_permissions(&self, user: &User) -> Result<HashSet<Role>> {
        Ok(match user.role { Role::Admin => [Role::User, Role::Admin].into(), Role::User => [Role::User].into() })
    }
 }
 pub type AuthSession = axum_login::AuthSession<Backend>;
 ```
 Guards, applied as `route_layer` on the sub-routers (§3):
 ```rust
 // any signed-in user: full issues, article/world/behind pages, /account
 .route_layer(login_required!(Backend, login_url = "/login", redirect_field = "next"))
 // admins: everything under /dashboard and POST /rate
 .route_layer(permission_required!(Backend, login_url = "/login", redirect_field = "next", Role::Admin))
 ```
 `permission_required!` redirects anonymous requests to `/login?next=…` and answers 403 to a signed-in user without the permission; the 403 is turned into the site's error page by a small `map_response` on the dashboard router. Pages that render differently for anonymous and signed-in viewers (`/`, `/issues/{date}`) take `AuthSession` and branch on `auth.user().await`. `/files/*` (§8) checks `auth.user().await.is_some()` before falling back to Basic auth.
 `Viewer { user: User }` is derived from `auth.user().await` for templates; the layout shows the username and role from it.
 Login: `GET /login?next=` renders the form. `POST /login` calls `auth.authenticate(creds)`; `Ok(Some(user))` → `auth.login(&user).await` (axum-login cycles the session id), `UPDATE users SET last_login_at`, redirect to `next` when it is a same-site absolute path (starts with `/`, not `//`), else `/`; `Ok(None)` → the form again with "invalid username or password" (status 401); `Err` → 500 page. `POST /logout` → `auth.logout().await`, redirect `/`. `/account` shows the viewer and offers "change password" (verify current, `hash_password`, update the row; the new `session_auth_hash` logs out every other session automatically) and "sign out everywhere" (`delete_for_user`).
 ### 6.4 CSRF: SameSite + origin check
 The session cookie is `SameSite=Lax`, so browsers do not attach it to cross-site `POST`s at all. On top of that, one middleware (`web::session::require_same_origin`, applied to every `POST` route except `/r/*` which has no session) rejects with 403 when: `Sec-Fetch-Site` is present and is neither `same-origin` nor `none`; or, when it is absent, the `Origin` header (or the origin of `Referer`) does not equal the origin of `server.public_url` or of the request `Host`. That is the OWASP "fetch metadata + origin verification" defence and is enough for cookie-authenticated forms; there is no per-form token to render or check. `app.js` `fetch` calls send `credentials: "same-origin"` and get `Sec-Fetch-Site: same-origin` from the browser automatically.
 If a per-form token is ever wanted (e.g. for a very old browser without fetch metadata), add `axum_csrf` 0.11 as a second layer; nothing in this plan precludes it.
 ### 6.5 Login throttle
 `tower_governor` on the `POST /login` route only:
 ```rust
 let governor = Arc::new(GovernorConfigBuilder::default()
    .per_second(config.server.login_window_minutes * 60 / config.server.login_attempts)   // e.g. 90 s per token
    .burst_size(config.server.login_attempts)                                            // e.g. 10
    .key_extractor(SmartIpKeyExtractor)
    .finish().expect("governor config"));
 // route_layer(GovernorLayer::new(governor.clone())) on POST /login; a tokio task calls
 // governor.limiter().retain_recent() every 60 s.
 ```
 `SmartIpKeyExtractor` trusts `X-Forwarded-For`; that is acceptable because `server.bind` is loopback and nginx is the only peer (README §"Reverse proxy" says so; add a sentence). `server::serve` binds with `into_make_service_with_connect_info::<SocketAddr>()` so the peer address is available as the fallback key. Over the limit the layer answers 429; the login page template is not involved. Note the limiter counts attempts, not failures — ten login POSTs per fifteen minutes per IP is plenty for one operator.
 ## 7. Public site
 ### 7.1 `PublicIssue` — the only thing the public templates receive
 ```rust
 pub struct PublicIssue {
    pub date: Date, pub issue_number: i64, pub display_date: String,
    pub article_count: i64, pub reading_minutes: i64,
    pub sections: Vec<PublicSection>,
    pub generated_at: Timestamp,
 }
 pub struct PublicSection { pub name: String, pub entries: Vec<PublicEntry> }
 pub struct PublicEntry {
    pub title: String, pub url: String,           // canonical_url; the link target
    pub author: Option<String>,
    pub source: String,                            // feed_title
    pub domain: String,                            // host of `url`, "www." stripped
    pub reading_minutes: i64, pub word_count: i64,
    pub comment_links: Vec<CommentLink>,           // {label, url, meta}
    pub is_lead: bool,
 }
 ```
 `PublicIssue::from(&Issue)` is the only constructor, and it copies exactly these fields. There is deliberately no `summary`, `why`, `body`, `brief`, or `world` field, so the template cannot render them. Test `public_issue_carries_no_generated_text` (§17) renders the fixture issue publicly and asserts that the Brief, every summary, every `why`, every article body sentence and every comment string are absent from the HTML.
 `comment_links`: one per `SocialRef` with an `item_url` — label `Hacker News` / `Lobsters` / `Reddit`, meta `"342 points · 210 comments"` — plus `Comments` for `entries.comments_url` when it is set and differs from the article URL. Links carry `rel="noopener"` and `target="_blank"`; article title links are plain `<a href>` (the aggregator's purpose is to send readers to the source, so no `nofollow`).
 ### 7.2 Pages
 - `GET /` — the latest issue by date, rendered as `issue_public.html` (or `issue_full.html` when signed in, §8), with a strap line ("A personal morning paper, assembled daily from N feeds; the selection is the reader's, the words are the authors'") and a link to the archive. When no issue exists: an empty-state page.
 - `GET /issues` — every issue date, newest first, grouped by month: date, weekday, `issue_number`, article count. Anonymous and signed-in alike.
 - `GET /issues/{date}` — `issue_public.html`: masthead, dateline `Friday, September 3, 2026 · No. 20`, `stats_line` (articles · read time · sections), then sections in `Lineup.section_order` with entries: title → source link, `author · source (domain) · 8 min`, comment links. The World Briefing is **not** listed publicly (its entries are Wikipedia text). The lead story is marked with `.lead`.
 - `GET /feed.xml` — Atom 1.0, last 30 issues: `<id>tag:daily.hallada.net,2026:issue/{date}</id>` (host from `server.public_url`), `<title>The Daily EPUB — {date}</title>`, `<updated>` = `generated_at`, `<link rel="alternate" href="{public_url}/issues/{date}">`, `<content type="html">` = the public section list as escaped HTML (the same `PublicIssue`, rendered by `feed_entry.html`). `Content-Type: application/atom+xml; charset=utf-8`, `Cache-Control: public, max-age=300`.
 - `GET /robots.txt` — as in §3.
 Public pages send `Cache-Control: public, max-age=300` only when no session cookie is present; with a cookie they are `private, no-store`.
 ---
 ## 8. Full issue views for signed-in users
 `web::issue::load(state, date) -> Result<Option<IssueView>>` (§5.2). `IssueView { issue: Issue, downloads: Vec<Download>, from_json: bool }` where `Download { label, href, size_bytes }` lists the standard EPUB, the X4 EPUB and the XTC file **only when the file at `issues.*_path` (or `publish::issue_filename` in `epub_dir`) exists**; `href` is the existing `/files/epub/{name}` or `/files/xtc/{name}`.
 - `GET /issues/{date}` (signed in) — `issue_full.html`: masthead and dateline; **The Brief** (`editorial.front_page_html`, already sanitized XHTML, rendered `|safe`); download buttons; the index exactly like the EPUB's In-this-issue page: per section, title (→ `/issues/{date}/articles/{id}`), `source · N min read`, summary, `Why it's here`, the rating widget for admins; then links to World Briefing and Behind the paper; the colophon facts (models, cost, counts) in a footer block.
 - `GET /issues/{date}/articles/{article_id}` — `article.html`: `article-header` (title linking to the source, byline, meta line `feed · 1,850 words · ~8 min`, `Why it's here`, social line via `chapters::social_line`, summary), the body (`ammonia::clean(articles.content_html)` — reuse the same ammonia configuration the EPUB uses; do **not** run `to_xhtml`; `<img>` tags keep their remote `src` and get `loading="lazy" referrerpolicy="no-referrer"`), the discussion (`comments::render_xhtml(discussion, title)` when `pick.discussion` is present; it is XHTML and renders fine as HTML), prev/next links in issue order, "Read online ↗", and the rating widget for admins. 404 when the article is not in that issue.
 - `GET /issues/{date}/world` — `world::render_xhtml` in the layout; 404 when the issue has no briefing (fallback issues).
 - `GET /issues/{date}/behind` — the same lines as the EPUB chapter (`chapters::behind_*_line`, near misses linking to `/dashboard/articles/{id}` for admins).
 `/files/epub/{name}` and `/files/xtc/{name}`: `serve_file` accepts either a valid session (any role) **or** the existing Basic auth; when neither is present and Basic auth is configured, it challenges as today; when Basic auth is not configured it redirects HTML clients to `/login?next=` and returns 401 to others. OPDS clients are unaffected.
 The HMAC confirmation page (`server::confirmation_page`) gains one line: `<a href="{public_url}/issues/{date}">Open this issue on the site</a>`.
 ### 8.1 Rating widget (`_rating_widget.html`, `web::rate`)
 A `<form class="rating" method="post" action="/rate">` with hidden `article_id`, `issue_date`, `next`, and four buttons `label=loved|good|down|cleared` (the last styled as a link "clear"); the current verdict button is filled. An optional `note` text field appears on the dashboard variants (`/dashboard/articles/{id}`, `/dashboard/ratings`), not on issue pages. `POST /rate`:
 1. Admin route layer (§6.3) and the origin check (§6.4) have already passed; read the viewer from `AuthSession`.
 2. Validate `article_id` exists; `issue_date` optional (issue pages pass it; the dashboard passes the latest `issue_articles` date for the article, if any, like the CLI does).
 3. Append `RatingEvent { kind: "explicit", source: "dashboard", label, value: vote.value(&cfg.curation.feedback) (0.0 for cleared), note, user_id, event_at: now }`.
 4. `Accept: application/json` → `200 {"article_id", "label", "event_id"}`; otherwise set a flash and `303 See Other` to `next` (validated same-site path).
 ---
 ## 9. Dashboard: overview, runs, articles
 All dashboard queries live in `src/web/dashboard/*.rs` as runtime `sqlx` queries with manual row mapping. Page size 50 (articles) / 100 (candidates), `?page=N`, `_pagination.html`. Sort and filter parameters are query-string, validated against allow-lists (never interpolated into SQL).
 ### 9.1 Overview (`/dashboard`)
 - **Last run** card: date, status badge, started/duration, the four-line block (`curation:`, `admission:`, `preference:`, `providers:`) built from `runs.report_json` (fall back to the counters when NULL), warnings count with a link to the run.
 - **Budget today** card: per provider (from `config.referenced_providers()` + voyage): spent today (`db::provider_spend_for_utc_day(now)` + the last run if it is today) vs `max_daily_usd`, as a bar.
 - **Sparklines** (server-rendered SVG, last 30 non-dry runs): cost per run, selected per run, generation seconds.
 - **Ratings this week**: counts by label, and **"Unrated picks"** — the last three issues' picks with no explicit event, title + feed + inline rating widget. (The operator forgets to rate; this is the nudge.)
 - **Jobs**: any `requested`/`running` job, and the last five finished.
 - **Config on disk**: the `Config::check_report` lines that start with `! ` (missing keys/files), if any.
 ### 9.2 Runs (`/dashboard/runs`, `/dashboard/runs/{id}`)
 List: one row per `runs` row, newest first, 50 per page: id, date (→ issue page), status badge, started (config tz), duration, `considered → eligible → triaged → assessed → shortlisted → selected` from `report_json.counts` (or `candidates`/`selected` when NULL), cost per provider, total, dry-run marker, warnings count. Filter `?status=`.
 Detail:
 1. Header: date, status, started/finished/duration, link to the issue, link to the previous and next run of that date.
 2. **Funnel**: `SELECT stage, excluded_reason, COUNT(*) FROM candidate_runs WHERE run_id = ? GROUP BY 1, 2` rendered as bars in pipeline order (`excluded` → `eligible` → `triaged` → `admitted` → `assessed` → `shortlisted` → `selected`) with the reason breakdown under each.
 3. **Admission mix** (`report_json.counts.admitted_by`), **preference state** (`rated_with_embeddings`, `knn_gate`, `feed_gate`, `verdicts_in_prompt`), **timings** table (`report_json.timings`), **provider usage** (tokens in/cached/write/out, cost), **warnings** list, **per-feed counts** top 20.
 4. **Config diff**: flatten `runs.config_json` of this run and of the previous non-dry run into dotted keys; show keys whose values differ (`key · before → after`). This is how a tuning change is tied to its first paper.
 5. **Near misses**: `telemetry::near_misses(db, run_id, 10)`.
 6. **Candidates** table: every `candidate_runs` row joined to `articles`/`entries`/`article_assessments`: title (→ article detail), feed, words, stage badge, reason, `admitted_by`, utility, rank, cluster (`id · rank`), triage `interest`, deep `quality`/`fit`, exploration/auto-include flags, `editor_why`. Filters: `stage`, `reason`, `admitted_by` (prefix match on the JSON array's first element via `json_extract(admitted_by, '$[0]')`), `q` (title LIKE), `flag=exploration|auto`. Sort: utility desc (default), rank, triage, quality, fit, title. A `<details>` per row expands `_signals_table.html` (raw · norm · weight · present for each signal, top interests, neighbours, notes) from `signals_json`.
 ### 9.3 Articles (`/dashboard/articles`, `/dashboard/articles/{id}`)
 List: `articles` LEFT JOIN `entries` (best entry) LEFT JOIN the article's **latest** `candidate_runs` row (`MAX(run_id)` subquery) LEFT JOIN triage/deep `article_assessments` LEFT JOIN the current rating (latest explicit event) LEFT JOIN the latest `issue_articles` row. Columns: first seen, title, feed, words, last stage/reason (with run date), utility, triage, quality/fit, rating badge, published date. Filters: `q` (title or canonical_url LIKE), `feed` (feed_id), `stage`, `reason`, `rated=any|loved|good|down|cleared|none`, `published=yes|no`, `from`/`to` (first_seen dates), `kind` (triage kind). Sort: first_seen desc (default), utility, quality, fit, triage, words, title. Add index `CREATE INDEX idx_candidate_runs_article_run ON candidate_runs(article_id, run_id DESC)` in the migration so the latest-row join stays fast.
 Detail — everything the system knows, in this order:
 1. **Article**: title → source, canonical URL, feed (+ category), author, published, first seen, words, excerpt-only, image count, extract method (from `sources_json`? no — from the best entry; show what `Article` carries), sources list (`SourceRef` kind + feed), social refs with links and scores, "in issues" (date · section · position · lead), current rating badge, the rating widget with note field, "Explain (text)" `<details>` containing `telemetry::render_explain` for the latest run row, verbatim in `<pre>`.
 2. **Assessments**: triage (interest, kind, why, model, prompt version, assessed_at) and deep (quality, fit, category, rationale, paywalled guess, facets as a table, model, assessed_at); a `provider_rejected` row is shown as such.
 3. **Run history**: every `candidate_runs` row for the article, newest first: run (→ run detail), date, stage, reason, admitted_by, utility, rank, cluster, editor why. Clicking a row expands its `_signals_table.html`.
 4. **Neighbours and interests** from the latest row's `signals_json`: top interests (z, cos) and nearest rated neighbours (label, cos, → their article page).
 5. **Embedding**: model, dimension, created_at, input hash — never the vector.
 6. **Rating events**: all events for this article (including superseded ones), with source, user, note, value.
 ---
 ## 10. Ratings page (`/dashboard/ratings`)
 Two tabs (query `?tab=current|events`).
 **Header** (from `PreferenceState::load(db, &config.curation.ranking, now).summary()` — reuse whatever the pipeline calls): `N rated articles with embeddings → neighbour signal at {knn_gate:.0%} (floor {knn_floor}, full {knn_full}) · {attributable_feed_ratings} attributable feed ratings → feed affinity at {feed_gate:.0%} · {verdicts_in_prompt} verdicts in the prompt · {n} in the weekly rebuild set`. When a rated article has no embedding, a notice: "M rated articles have no embedding and cannot act as neighbours — run the `features backfill --rated-only` job."
 **Current** tab: `db::current_ratings_including_cleared(36_500)`, one row per article, newest first, filter by label/source/feed/q. Columns:
 | Column | Definition |
 |---|---|
 | Verdict | badge; the rating widget inline (with note) to change it |
 | Article | title → article detail, feed, issue date if any |
 | When · by | `event_at` (config tz), `source`, username |
 | Note | `note` |
 | Age → decay | `age_days` and `decay = 0.5^(age/half_life)` (`signals::decay`) |
 | Neighbour weight | `value × decay` when the article has an embedding; "no embedding" otherwise. This is exactly the `w_i` of plan §9.2 |
 | Feed credit | each direct feed (`signals::direct_feeds`, else the best entry's feed) and `value / n` credited to it (plan §9.3) |
 | In prompt | ✓ when its rank among current non-cleared verdicts (newest first) is `< curation.feedback.verdicts_in_prompt` |
 | In rebuild | ✓ when that rank is `< profile::MAX_RATINGS_IN_REBUILD` |
 | Used last run | from the latest non-dry run: the number of candidates whose `signals_json.neighbours` include this article id (`WHERE signals_json LIKE '%"article_id":<id>,%'` then parsed to confirm), and how many of those were selected |
 A "How ratings enter the algorithm" `<details>` block at the top explains the four paths in prose (prompt verdict block, weekly learned adjustments, neighbour signal with decay and gate, feed affinity with gate) with the current config values inlined, and links to the settings groups that tune them.
 **Events** tab: every `rating_events` row, newest first, 100 per page, with `superseded` marked when a later explicit event exists for the same article; filters by label, source, user, date range. Nothing here is editable — history is append-only, and the "clear" verdict is the way to retract.
 ---
 ## 11. Profile page (`/dashboard/profile`)
 - **profile.md editor**: a monospace `<textarea>` with the current file (`config.profile_path`), a Save button (an origin-checked POST, §6.4), and a live preview of what the loader parses: the sections that pass through verbatim and the `## Interests` lines it extracted (`profile::parse_profile_str`). Saving: validate the text parses (it always does; reject only empty or > 64 KB), insert the **previous** content into `profile_versions`, write atomically (`<path>.tmp` + rename, preserve mode), flash "Saved; the next run rebuilds the system prompt". The server unit needs the profile's directory writable (it is under `/var/lib/daily-epub`, the `StateDirectory`; §18 confirms).
 - **History**: `profile_versions` newest first with a diff-less preview (first 200 chars) and a "Restore" button (writes that content back, recording the current one as a new version).
 - **Standing interests**: the OPML interests (`profile::parse_interests`) grouped by `themes::group_into_themes` — read-only, with the file path and count; a note that the union with `## Interests` is what the prompt uses.
 - **System prompt**: `kv.taste_profile` (`TasteProfile { text, version, built_at, verdicts }`) in a collapsed `<pre>`, the learned adjustments block (`kv.taste_profile_learned`) shown separately with its age and whether a weekly rebuild is due (`profile::is_stale`), and a "Rebuild profile now" button that starts the `profile-rebuild` job (§14).
 ---
 ## 12. Stats page (`/dashboard/stats`)
 Refactor `telemetry::stats(db, days, now) -> String` into `telemetry::stats_data(db, days, now) -> StatsData` plus `telemetry::render_stats_text(&StatsData) -> String`; the CLI output is byte-identical (a test pins it against the current fixture). `StatsData` carries: issues, articles published, ratings by label, ratings per issue, per-retriever up/down, exploration yield, mean issue size, cost per day per provider (as a date → provider → usd map), mean generation time, and the per-run series used by the sparklines.
 The page: `?days=14|30|90`, the same figures as tables, three sparklines (cost per day stacked per provider as bars, selected per issue, ratings per week by label), and the retriever yield as a small table with the up/down ratio.
 ---
 ## 13. Settings (`/dashboard/settings`)
 ### 13.1 The schema is derived, not hand-listed
 `settings::schema(config: &Config, file: Option<&toml_edit::DocumentMut>) -> Vec<SettingGroup>`:
 1. `let defaults = toml::Value::try_from(Config::default())` and `let current = toml::Value::try_from(config)`; walk both in parallel, depth-first, producing one `SettingField` per leaf:
 ```rust
 pub struct SettingField {
    pub path: String,                  // "curation.ranking.deep_keep"
    pub group: String,                 // "curation.ranking" (the enclosing table)
    pub kind: FieldKind,               // Bool | Integer | Float | Text | TextList | Enum(&'static [&'static str]) | Secret | Path
    pub current: String,               // rendered value (TextList: one per line)
    pub default: String,
    pub source: Source,                // Default | File | Env(String /* the var name */)
    pub help: Option<&'static str>,
    pub restart_required: bool,        // server.bind, database_path
 }
 ```
 2. `source`: `Env` when `std::env::var_os(env_name(path))` is set, where `env_name` = `ENV_PREFIX + path.to_uppercase().replace('.', ENV_SPLIT)` (`DAILY_EPUB_SECRET` also counts for `server.hmac_secret`); else `File` when the key exists in the parsed document; else `Default`.
 3. `kind`: from the default's TOML type; `TextList` for arrays of strings; `Enum` from a static table keyed by path suffix — `providers.*.kind` → `openai|anthropic`, `providers.*.effort` → `low|medium|high|xhigh|max` (anthropic) or free text (openai), `editorial.summary_model` → `editor|bulk`, `xtc.format` → `xtc|xtch`, `llm.bulk`/`llm.editor` → the provider names (plus `""` for editor); `Secret` for paths ending in `api_key`, `hmac_secret`, `basic_auth_pass`; `Path` for `database_path`, `out_dir`, `profile_path`, `interests_opml`, `publish.*_dir`, `xtc.settings`.
 4. `help`: a static `SETTINGS_HELP: &[(&str, &str)]` seeded from the README's configuration table and the comments in `config.example.toml`. Every key in the shipped example must have an entry (test).
 5. Groups render in this order: top level, `llm`, `providers.<name>` (one card each), `voyage`, `curation`, `curation.feedback`, `curation.ranking`, `curation.ranking.quotas`, `curation.ranking.weights.preliminary`, `curation.ranking.weights.utility`, `curation.ranking.diversity`, `editorial`, `publish`, `xtc`, `server`, `miniflux`.
 `Secret` fields render as "set (from `DAILY_EPUB_…`)" / "not set" with no input. `Env` fields render disabled with "locked by `DAILY_EPUB_…` in the env file". Everything else is an input of its kind, showing the default beside it and a "reset to default" affordance. Weights render with a note that they are renormalized.
 ### 13.2 Saving
 `POST /dashboard/settings` (admin, origin-checked) carries every editable field. The handler:
 1. `reload_if_changed`; load `config_path` into `toml_edit::DocumentMut` (a missing file starts from an empty document; `config_path == None` → 400 "no config file is configured; start the server with --config").
 2. For each posted field whose parsed value differs from the current **file** value (compare TOML values; a field equal to the default but absent from the file is still written when the user submitted a change to it — "explicit beats implicit"; a field unchanged from what the file holds is skipped): set it in the document at its path, creating intermediate tables as implicit tables; typed by `FieldKind` (integers → `i64`, floats → `f64` formatted with at most 6 decimals, bools, strings, `TextList` → a multi-line array with one item per line, trailing comma). Parsing failures (letters in a number, unknown enum value) collect into a field-error list and abort before writing.
 3. Render the document to a string, write to `<path>.tmp.<pid>`, and validate by `Config::load(Some(&tmp))` (the same loader the CLI uses, env included). On error: remove the temp file, re-render the form with the message. On success: copy the original file's permissions onto the temp file, `rename` it over the original, and swap `state.config`.
 4. Insert one `config_changes` row per changed key with the TOML literal before/after (`NULL` when absent/removed) and the viewer's id; flash "Saved N settings — they apply to the next run" (plus "restart the server for: …" when a `restart_required` key changed).
 Because `generate` runs as its own process and reads `config.toml` at start, a saved setting reaches the next paper with no further plumbing. `runs.config_json` continues to snapshot what each run actually used, and the run page's config diff (§9.2) shows it.
 ### 13.3 Providers
 The `providers.*` cards each have a "Remove" button (`POST /dashboard/settings/providers` with `action=remove&name=`; refused when an `[llm]` role names it) and the page has an "Add provider" form (`action=add&name=&kind=`; name validated as `[a-z0-9_]+`, must not exist). Adding inserts a `[providers.<name>]` table whose keys are `ProviderConfig::default()` with the chosen `kind` and a `base_url`/`model` placeholder, via `toml::to_string` → parsed into `toml_edit::Item`. Both go through the same validate-and-rename path and log `config_changes` rows (`providers.<name>` with the whole table as the literal).
 ### 13.4 History
 `GET /dashboard/settings/history`: `config_changes` newest first, 100 per page — when, who, key, before → after. Linked from the settings page and from the run page's config diff.
 ---
 ## 14. Jobs
 ### 14.1 Catalogue (`src/jobs.rs`)
 ```rust
 pub enum Job {
    Generate { date: Option<Date> },   // "generate" | "generate-YYYY-MM-DD"
    DryRun,                            // "dry-run"           → generate --dry-run
    ProfileRebuild,                    // "profile-rebuild"   → profile rebuild
    FeaturesBackfill,                  // "features-backfill" → features backfill --days 30 --yes
    BackfillSocial,                    // "backfill-social"   → backfill-social --days 7
    FeaturesPrune,                     // "features-prune"    → features prune
 }
 impl Job {
    pub fn parse(name: &str) -> Option<Job>;      // names match ^[a-z0-9-]+$ and the forms above
    pub fn name(&self) -> String;
    pub fn unit(&self) -> String;                  // format!("daily-epub-job@{}.service", name)
    pub fn description(&self) -> &'static str;    // shown on the Jobs page
    pub fn takes_lock(&self) -> Option<&'static str>; // same names lock_holder uses
    pub fn dangerous(&self) -> bool;               // Generate (republishes an issue) → confirm dialog
 }
 ```
 ### 14.2 `daily-epub job run <name>`
 A new subcommand in `main.rs`. It:
 1. Parses the name (unknown → exit 2 with the catalogue).
 2. Takes the run lock when `takes_lock()` says so (via `lock_holder`, so "generate is already running" behaves as today).
 3. Finds the newest `jobs` row with this `name` and `status = 'requested'`; if none, inserts one (`requested_by NULL` — the operator started the unit by hand). Sets `running` + `started_at`.
 4. Runs the mapped command **in-process** by calling the same functions `main` uses (`pipeline::generate`, `cmd_profile_rebuild`, `cmd_features`, `cmd_backfill_social`, `telemetry::prune`), with the same logging.
 5. On success sets `ok`, `finished_at`, `run_id` (for generate) and a one-line `message` (the `curation:` line for generate; counts otherwise). On error sets `failed` and `message = error`, exits non-zero so systemd records `Result=exit-code`.
 ### 14.3 Unit, polkit, groups
 `systemd/daily-epub-job@.service` — a copy of `daily-epub-generate.service` with `Description=The Daily EPUB job %i` and `ExecStart=/usr/local/bin/daily-epub --config /etc/daily-epub/config.toml job run %i`. Same hardening, same `ReadWritePaths`, `TimeoutStartSec=45min`. The timer keeps driving `daily-epub-generate.service` unchanged.
 `systemd/50-daily-epub.rules` (installed to `/etc/polkit-1/rules.d/`):
 ```js
 polkit.addRule(function (action, subject) {
  if (action.id == "org.freedesktop.systemd1.manage-units" &&
      subject.user == "daily-epub" &&
      action.lookup("verb") == "start" &&
      /^daily-epub-job@[a-z0-9-]+\.service$/.test(action.lookup("unit"))) {
    return polkit.Result.YES;
  }
 });
 ```
 `systemd/daily-epub.service` gains `SupplementaryGroups=systemd-journal` (journal reads) and `ReadWritePaths=/etc/daily-epub` (settings writes). Nothing else in the hardening changes; `systemctl` talks to systemd over the system bus (`AF_UNIX`, already allowed).
 ### 14.4 Runner and page
 ```rust
 #[async_trait] pub trait JobRunner: Send + Sync {
    async fn start(&self, unit: &str) -> Result<(), String>;                 // systemctl start --no-block <unit>
    async fn status(&self, unit: &str) -> Result<UnitStatus, String>;        // systemctl show -p ActiveState,SubState,Result,ExecMainStatus,ExecMainStartTimestamp,ExecMainExitTimestamp
    async fn log(&self, unit: &str, lines: usize) -> Result<String, String>; // journalctl -u <unit> -n <lines> --no-pager -o short-iso
 }
 ```
 `SystemdRunner` spawns the commands with `tokio::process::Command` (10 s timeout, stderr captured into the error). `MockRunner` records calls and returns scripted statuses for tests. `server.jobs_enabled = false` swaps in a `DisabledRunner` whose page says so.
 `GET /dashboard/jobs`: the catalogue as cards (name, description, Start button with `data-confirm` for `dangerous()`; the `generate-<date>` card has a date input), then the jobs table newest first (name, requested by/at, started, finished, duration, status badge, message, run → run detail).
 `POST /dashboard/jobs/{name}` (admin, origin-checked): parse; refuse when a job with the same unit is `requested`/`running` (409 with a flash); insert `requested`; `runner.start(unit)`; on error mark the row `failed` with the message; redirect to `/dashboard/jobs/{id}`.
 `GET /dashboard/jobs/{id}`: the row, the live `UnitStatus`, and the journal tail (`server.journal_lines`, 300) in a `<pre>`. If the row is still `requested` but the unit is `inactive` with `Result=exit-code`/`failed` 30 s after `requested_at`, mark it `failed` ("unit exited before the job started; see the log"). `app.js` refreshes while `requested`/`running`.
 ---
 ## 15. Configuration additions
 ```toml
 [server]
 bind = "127.0.0.1:3499"
 public_url = "https://daily.hallada.net"
 session_days = 30                    # web login lifetime, sliding
 login_attempts = 10                  # failed logins per IP per window before a 429
 login_window_minutes = 15
 jobs_enabled = true                  # the Jobs page starts daily-epub-job@<name>.service via systemctl
 journal_lines = 300                  # log tail shown on a job page
 # hmac_secret / basic_auth_* unchanged
 ```
 Validation: `session_days ≥ 1`, `login_attempts ≥ 1`, `login_window_minutes ≥ 1`, `journal_lines ∈ 10..=5000`. Update `config.example.toml`, `Config::default()` (the key-for-key test enforces both), the README table, and `SETTINGS_HELP`. These keys appear on the settings page automatically.
 New dependencies: `axum-login = { git = "https://github.com/maxcountryman/axum-login.git", rev = "151c72d7a1b4646830f86b4332e6bd6e34d719a7" }` (brings `tower-sessions` 0.15 and `tower-cookies`; use the re-exports, do not add `tower-sessions` separately — a second copy would be a different version; the server builds from source with GitHub access, as it does today), `password-auth`, `tower_governor` with the `axum` feature, `time` (the type tower-sessions' `Expiry` and `Record` use; no `formatting` feature needed since the store keeps unix seconds), `async-trait` (only for our `SessionStore` impl — tower-sessions' trait still uses it; axum-login's own traits no longer do), `rpassword`, `toml_edit`, `toml` (already transitive; promote to direct for `toml::Value`), dev: `tower` with `util` (router `oneshot` tests). Do **not** add `argon2` or `tower-sessions-sqlx-store` (§2). Confirm the sqlx SQLite build has `json_extract` (it does; bundled SQLite ships JSON1).
 ---
 ## 16. Security checklist
 - Password hashes: `password-auth` argon2id PHC strings; `User`'s `Debug` redacts the hash; never logged. Session ids are tower-sessions' random ids stored server-side; the cookie is `HttpOnly`, `Secure` on https, `SameSite=Lax`; login cycles the id; a password change or `disable` invalidates the user's sessions (`session_auth_hash` + `delete_for_user`).
 - CSRF: `SameSite=Lax` plus the fetch-metadata/origin middleware on every POST (§6.4). Redirect targets validated to same-site paths.
 - Login: `tower_governor` per-IP limit on `POST /login` (§6.5); equal-timing dummy verification for unknown users; no username enumeration in messages ("invalid username or password").
 - Authorization: `login_required!`/`permission_required!` route layers on whole sub-routers (§6.3), so a forgotten check in one handler still redirects or 403s; `POST /rate` sits under the admin layer.
 - Headers on every app response (via a `tower-http` `SetResponseHeader` layer or a small middleware): `Content-Security-Policy: default-src 'self'; img-src * data:; style-src 'self'; script-src 'self'; frame-ancestors 'none'; form-action 'self'`, `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin`. (`img-src *` because article pages show remote images for signed-in users.) nginx keeps adding its own.
 - All user text is escaped by askama; the only `|safe` inputs are `front_page_html` (already sanitized by the pipeline), `ammonia::clean` output, `comments::render_xhtml` and `world::render_xhtml` (built from sanitized comment/portal HTML), and the server-rendered SVG sparklines.
 - Settings: secrets never rendered, never written; validation through `Config::load` before rename; permissions preserved; every change attributed. `Path` fields are written as given — the operator is the admin, and the config validates paths on load.
 - Jobs: unit names come only from the fixed catalogue regex; the polkit rule allows `start` only, on that regex only, for that user only.
 - Files: `safe_join` unchanged. `robots.txt` disallows private paths. Public caching only without a cookie.
 - Logs: never log passwords, tokens, cookies, or `Authorization`. The `TraceLayer` stays; add a request-id.
 ---
 ## 17. Tests
 No test touches the network or systemd. Router-level tests use `tower::ServiceExt::oneshot` against `server::router(state)` with a temp database (`Db::open_and_migrate` on a `tempfile` path), a `MockRunner`, and `fixtures::issue()` written through `record_issue`'s helpers.
 - **Migration**: temp DB through `0001`…`0004`; the new tables exist; `rating_events.user_id` present; old rows keep `user_id NULL`.
 - **Users/passwords**: hash round-trips through `password-auth`; wrong password fails; malformed hash fails safely; `users add` rejects short passwords and duplicate names (case-insensitive); `role`, `disable`, `logout`, `passwd` behave and the last three delete sessions.
 - **Session store**: `save`/`load`/`delete` round-trip a `Record`; `load` returns `None` past `expiry`; `user_id` is denormalized from the axum-login key and `NULL` otherwise; `delete_expired` and `delete_for_user` count correctly; a store error surfaces as `session_store::Error::Backend`.
 - **Login flow (router oneshot)**: `POST /login` sets `daily_session` with `HttpOnly`, `SameSite=Lax`, and `Secure` iff the public URL is https; the cookie then reaches `/account`; a disabled user's cookie does not; a password change logs the other session out; logout clears; anonymous `GET /` sets no cookie at all; `next` is honoured only for same-site paths.
 - **Guards**: anonymous `/dashboard` → 302 `/login?next=/dashboard`; signed-in `user` role → 403 site page; admin → 200; `POST /rate` follows the same three outcomes.
 - **Origin check**: POST with `Sec-Fetch-Site: cross-site` → 403; absent fetch metadata and a foreign `Origin` → 403; same-origin passes; the HMAC rating route (GET) is untouched.
 - **Throttle**: with a test governor config of burst 3, the fourth `POST /login` from one address → 429; another address still passes.
 - **Public rendering**: `public_issue_carries_no_generated_text` (§7.1); comment links built from social refs and `comments_url`; the World Briefing is absent publicly; the feed validates as XML, has one entry per issue, and its content is the public list; `robots.txt` content; `Cache-Control` public without a cookie, `no-store` with one.
 - **Full rendering**: signed-in `/issues/{date}` contains the Brief, summaries and `why`; article page contains the body and the discussion; the fallback loader (no `issue_json`) renders an issue from rows with no world/discussion links; downloads listed only for files that exist; `/files/epub` accepts a session, still challenges Basic auth when configured and no session.
 - **issue_json**: `record_issue` writes it with empty bodies; the loader rehydrates bodies; `runs.report_json` and `issues.report_json` written; `/issues.json` returns real reports.
 - **Rating**: `POST /rate` as admin appends a `dashboard` event with `user_id`; as user → 403; anonymous → redirect/401; `cleared` writes value 0; JSON and form variants; `next` validated.
 - **Dashboard queries**: funnel counts match a seeded `candidate_runs` set; candidate filters and sorts are allow-listed (an unknown sort falls back, never errors); config diff finds changed dotted keys and ignores unchanged; articles list filters; article detail shows assessments, run history and rating events.
 - **Ratings contributions**: decay/weight/feed-credit/in-prompt/in-rebuild computed against hand-checked values; "used last run" counts neighbours in `signals_json`.
 - **Profile**: save writes the file and a `profile_versions` row; restore swaps; oversized rejected; the parsed preview matches `parse_profile_str`.
 - **Settings schema**: every leaf of `Config::default()` appears exactly once; every shipped key has help text; secrets are `Secret` and never carry a value; env detection uses the derived name; enum options match `validate()`'s accepted values (a round-trip test over each option).
 - **Settings writer**: starting from `config.example.toml`, changing three keys preserves every comment and the original key order (string compare of untouched lines); a new key in an absent table creates the table; `TextList` writes a multi-line array; an invalid value (e.g. `deep_keep < shortlist_keep`) is rejected by `Config::load` and the file is untouched; permissions preserved; `config_changes` rows written; provider add/remove; removing a referenced provider refused.
 - **Stats refactor**: `render_stats_text(stats_data(..))` equals the previous `stats(..)` output for a seeded DB.
 - **Jobs**: `Job::parse` accepts the catalogue and dated form, rejects `../x`, uppercase, and unknown names; `POST /dashboard/jobs/{name}` inserts a row and calls `MockRunner::start` with the right unit; a running duplicate is refused; a failed start marks the row; `job run` (in-process, `--skip-llm`-style config, mocked providers) flips `requested → running → ok` and sets `run_id`; the polkit rule file is present in the repo and matches the unit regex (string test).
 - **Binary** (`tests/m7_server.rs` style): the shipped binary serves `/`, `/issues`, `/feed.xml`, `/login` from env-only config; `/dashboard` redirects to `/login`; `users add` then a real login over TCP works.
 ---
 ## 18. Deployment — `docs/runbooks/web-dashboard-rollout.md`
 Write this runbook as part of step 7; its content:
 1. Build and install the binary; `daily-epub --help` shows `users`, `job`.
 2. `sudo install -m0644 systemd/daily-epub-job@.service /etc/systemd/system/`; `sudo install -m0644 systemd/50-daily-epub.rules /etc/polkit-1/rules.d/`; update `/etc/systemd/system/daily-epub.service` with `SupplementaryGroups=systemd-journal` and `ReadWritePaths=… /etc/daily-epub`; `daemon-reload`.
 3. Confirm `/etc/daily-epub` and `config.toml` are owned by `daily-epub` (settings writes rename into that directory) and that `profile.md` lives under `/var/lib/daily-epub` (writable `StateDirectory`).
 4. Add the new `[server]` keys to `config.toml` if overriding defaults (optional).
 5. Restart `daily-epub.service`; the migration `0004` applies on start. Verify `curl -s https://daily.hallada.net/` shows the latest issue and `/feed.xml` parses.
 6. `sudo -u daily-epub daily-epub --config /etc/daily-epub/config.toml users add tyler --admin` (hidden prompt). Log in, open `/dashboard`.
 7. Smoke test jobs: start `features-prune` from the Jobs page; watch the log tail; `systemctl status daily-epub-job@features-prune.service`. If polkit refuses, `journalctl -u polkit` shows the denied action.
 8. Smoke test settings: change `curation.ranking.utility_protected` by one, confirm `config.toml` kept its comments, read `/dashboard/settings/history`, change it back.
 9. Optional: raise `curation.ranking.telemetry_retention_days` for longer article history.
 ---
 ## 19. Implementation sequence
 Each step is a shippable commit or small series; `cargo fmt --check`, `cargo clippy --all-targets`, `cargo test` green at each. Do not combine steps.
 1. **Foundation.** Migration `0004`, `RatingEvent.user_id`, `runs.report_json` + `issues.report_json` writes, `issues.issue_json` write and loader, `GenerateOutcome.run_id`. `web/` skeleton: `WebState`, `AppState.config()` refactor (config path passed into `serve`), layout, error pages, static assets with ETag, security headers layer. `SqliteSessionStore`, `Backend`, the axum-login/tower-sessions/tower_governor layers, CLI `users …`, `/login`, `/logout`, `/account`, the origin-check middleware. Public site: `/`, `/issues`, `/issues/{date}` (public branch), `/feed.xml`, `/robots.txt`, `PublicIssue` with its no-leak test. `/files/*` accepts sessions. README route table updated.
 2. **Full issues.** `issue_full.html`, article/world/behind pages, downloads, prev/next, the rating widget and `POST /rate`, the HMAC confirmation link. `app.js` rating enhancement.
 3. **Dashboard reads.** Overview, runs list/detail (funnel, admission, timings, providers, warnings, config diff, near misses, candidate table with filters and the signals partial), articles list/detail (with the run history and the text explain). Index `idx_candidate_runs_article_run`.
 4. **Ratings and profile.** Ratings page with contributions and the events tab; profile editor, versions, prompt view. `MAX_RATINGS_IN_REBUILD` made `pub`.
 5. **Settings.** Schema derivation, help table, form rendering, `toml_edit` writer with validate-and-rename, env locks, providers add/remove, history, config reload-on-mtime. Unit file `ReadWritePaths` change in `systemd/`.
 6. **Jobs and stats.** `jobs.rs` catalogue, `job run` subcommand, `JobRunner` + `SystemdRunner`/`MockRunner`, unit template, polkit rule, `SupplementaryGroups`, the Jobs pages; the `stats_data` refactor and the stats page; overview sparklines.
 7. **Docs and polish.** README (site, roles, users CLI, jobs, settings), `config.example.toml`, `docs/plans/2026-08-15-implementation-notes.md` (new verified facts with dates: polkit, unit changes, toml_edit, axum-login/tower-sessions, password-auth, tower_governor), the rollout runbook (§18), users page, `robots.txt`/feed links in the layout, a final pass over dark mode and narrow screens.
 ---
 ## 20. Acceptance criteria
 1. Anonymous `GET /issues/{date}` shows every pick's title (linking to the source), author, source, comment links, section and reading time — and contains **no** Brief, summary, `why`, body, comment text or World Briefing; a test enforces it. `/feed.xml` is a valid Atom feed with the same content.
 2. A signed-in user sees the complete issue in HTML — Brief, summaries, `why` lines, article bodies, discussions, World Briefing, Behind the paper — and can download the EPUB, X4 and XTC files while they exist. Issues from before `issue_json` still render (without world/discussion).
 3. Only admins can rate; a dashboard rating appends a `rating_events` row with `source = 'dashboard'` and the admin's `user_id`; the EPUB's HMAC links keep working unchanged.
 4. Every article the pipeline ever recorded in `candidate_runs` is reachable from `/dashboard/articles` with its stage, reason, signals, assessments, facets, utility, cluster, admission path, editor `why`, rating history and issue appearances — the same facts `explain` prints, plus history across runs.
 5. Every run is listed with its funnel, admission mix, timings, provider costs, warnings, near misses, and the config keys that changed since the previous run.
 6. The ratings page shows every current verdict with its decayed neighbour weight, feed credit, prompt/rebuild membership and last-run neighbour usage, and lets the admin change, clear or annotate it.
 7. The settings page lists every key in `config.toml` (derived from `Config`, so a new key appears without UI work); saving writes the file with comments preserved, validates through `Config::load`, records the change, and a hand edit on disk shows up on the next page view. Secrets are never displayed; env-overridden keys are locked.
 8. `profile.md` is editable with version history; the prompt and learned adjustments are viewable.
 9. The Jobs page starts `daily-epub-job@<name>.service` through systemd + polkit, shows status and the journal tail, and links a generate job to its run; the server never runs the pipeline in-process.
 10. Sessions come from axum-login/tower-sessions with password-auth hashes, `SameSite=Lax` cookies plus an origin check on every POST, a tower_governor login throttle, and a CSP; no password, token or API key is ever logged, rendered or stored in plain form.
 11. Existing routes (`/r`, `/opds`, `/files`, `/healthz`, `/issues.json`) behave as before, and `/issues.json` now carries real reports.
 12. `cargo test` covers all of §17 without network or systemd.
 ---
 ## 21. Deferred, with triggers
 | Item | Trigger |
 |---|---|
 | Per-user personalization (per-user `rating_events`, profiles, issues) | A second real reader. `user_id` on `rating_events` is the hook; nothing else is prepared on purpose. |
 | Editing `data/scour-interests.opml` from the UI | The operator asks; `## Interests` in `profile.md` already covers additions. |
 | Search over article bodies (FTS5) | Title/URL `LIKE` feels slow or insufficient. |
 | Live log streaming (SSE) on the job page | The 5-second refresh feels slow. |
 | Passkeys / WebAuthn | A second admin or a phishing concern. |
 | Public per-article "why" lines | The operator decides the second-person tone reads fine publicly (one field added to `PublicEntry`, one template line, one test change). |
 | Backfilling `issue_json` for old issues from the EPUB files on disk | Only the last `retention_days` of EPUBs exist; the fallback renderer covers the rest. |
 | Charts beyond sparklines | `stats` grows a question the tables cannot answer. |
@@ -0,0 +1,66 @@
 # Shared brief — web dashboard implementation agents
 You are implementing one step of `docs/plans/2026-09-03-web-dashboard.md` in the
 `daily-epub` Rust crate. Read that plan **in full** before writing code — every
 decision in it is settled (§0), and §2 records verified facts about the crates and
 the host. Also read `docs/plans/2026-08-15-implementation-notes.md` (conventions:
 runtime sqlx queries with manual row mapping, `jiff` for time with RFC3339 UTC
 strings in SQLite, `thiserror`/`anyhow` errors, askama templates, no network in
 tests, rustfmt defaults, no `unwrap()` outside tests, tracing spans).
 ## Ground rules
 - Work on the current branch (`web-dashboard`) in place. Do **not** commit; the
  orchestrator reviews and commits. Do not create branches or stash.
 - Do not edit earlier migrations (`0001`–`0003`). Step 1 creates
  `migrations/0004_web.sql`; later steps may append a new migration file only if
  the plan says so.
 - Templates for the web live in `src/web/templates/` (`.html`, HTML-escaped by
  default); `askama.toml` lists both template dirs. EPUB templates in
  `src/epub/templates/` are untouched.
 - Every `|safe` in a template must be one of the sanitized inputs listed in plan
  §16; user text is never `|safe`.
 - The existing routes (`/r/…`, `/opds…`, `/files/…`, `/healthz`, `/issues.json`)
  and their tests keep working unchanged.
 - Tests: unit tests inline per module; router tests with
  `tower::ServiceExt::oneshot` against `server::router(...)` over a temp DB
  (`tempfile`), never the network, never systemd. Add the tests the plan's §17
  lists for your step.
 - Keep `cargo fmt`, `cargo clippy --all-targets -- -D warnings` and `cargo test`
  green. Finish with those three commands and report their output.
 - **Sandbox note:** inside your sandbox `bind()` on 127.0.0.1 is forbidden, so
  exactly these pre-existing tests fail there and must be ignored:
  `curate::llm::tests::anthropic_*` (4), `extract::tests::relative_urls_resolve_against_the_url_we_landed_on`,
  `server::tests::*` (5 that bind a listener), and any test in `tests/m7_server.rs`.
  Do not "fix" them. Any **new** router test must use `oneshot` and not bind.
  The orchestrator runs the full suite outside the sandbox.
 - Don't gold-plate: implement what the plan says for your step and nothing from
  later steps beyond stubs the plan explicitly asks for. Where the plan's
  sketch and the real crate API disagree, follow the real API (read the crate
  source in `~/.cargo/registry` or `~/.cargo/git`) and note the deviation.
 - When you finish, write a short handoff at
  `docs/plans/briefs/web-dashboard/handoff-step<N>.md`: what landed, deviations
  from the plan and why, anything left for the next step, test counts.
 ## Parallel steps (added after step 2)
 From step 3 on, steps may run **in parallel in separate git worktrees**, so
 file ownership matters:
 - `src/web/dashboard/mod.rs` already declares one submodule per page group
  (`runs`, `articles`, `ratings`, `profile`, `settings`, `jobs`, `stats`,
  `users`), each exposing `routes() -> Router<AppState>` that the dashboard
  router merges under the admin layer. Put your routes in **your** submodule's
  `routes()`; do not touch `web::router` in `src/web/mod.rs` for dashboard
  routes. Only step 3 edits the `overview` handler in `dashboard/mod.rs`.
 - You own: your `src/web/dashboard/<group>.rs` files, your templates under
  `src/web/templates/dashboard/`, partials you introduce, your tests.
 - Shared files you may touch **additively only** (no reformatting, reordering
  or renaming of existing code): `src/web/mod.rs` (helpers), `src/db.rs` (new
  query helpers appended inside `impl Db`), `src/main.rs`, `src/lib.rs`,
  `Cargo.toml`, `src/web/static/app.css` and `app.js` (append a block at the
  end under a `/* step N: … */` comment), `src/web/templates/layout.html`.
  Keep such edits small so merges stay trivial.
 - If your worktree is on its own branch, finish by committing **one** commit
  on that branch (message `Web dashboard step N: …`); the orchestrator merges.
  If you are on `web-dashboard` itself, do not commit.
@@ -0,0 +1,113 @@
 # Step 1 — Foundation
 Read `docs/plans/briefs/web-dashboard/00-shared.md` first, then the plan
 `docs/plans/2026-09-03-web-dashboard.md`. This step is plan §19 item 1. Sections
 that govern it: §2 (verified crate facts — read carefully, especially the
 axum-login git rev API), §3 (routes and access levels), §4 (architecture, state,
 templates, design system), §5 (migration and data model), §6 (auth, sessions,
 CSRF, throttle), §7 (public site), §15 (config keys and dependencies), §16
 (security checklist), §17 (tests for the parts you build).
 ## Deliverables
 1. **Dependencies** (§15): `axum-login` from git at rev
   `151c72d7a1b4646830f86b4332e6bd6e34d719a7`, `password-auth`, `tower_governor`
   (feature `axum`), `time`, `async-trait`, `rpassword`, `toml_edit`, `toml`
   (promote to direct), dev `tower` with `util`. Use `cargo add`; do not hand-pin
   old versions; do not add `tower-sessions` or `argon2` separately. Confirm
   `cargo tree -d` shows a single sqlx and a single `libsqlite3-sys`.
 2. **Migration `migrations/0004_web.sql`** exactly as §5.1 (users, sessions +
   indexes, `rating_events.user_id`, `config_changes`, `profile_versions`,
   `jobs`, `runs.report_json`, `issues.issue_json`), plus the index
   `idx_candidate_runs_article_run ON candidate_runs(article_id, run_id DESC)`
   from §9.3 (put it in this migration so step 3 needs no new file).
 3. **Data model changes** (§5.2–§5.4): `RatingEvent.user_id: Option<i64>`
   (bound by `append_rating_event`, read back by `current_ratings*` /
   `rated_article_from_row`); `db::finish_run` writes `runs.report_json`;
   `pipeline::record_issue` writes `issues.report_json` (fixing the never-written
   column) and `issues.issue_json` (the `Issue` with every
   `pick.article.content_html` emptied); `GenerateOutcome.run_id: i64`. Add the
   `db` accessors the loader needs (`issue_by_date`, `issue_dates`/listing for
   the archive, `latest_issue_date`).
 4. **`src/web/` skeleton** (§4): `mod.rs` (`WebState`, `Html<T>`, `WebError`,
   `Page` layout context, pagination + time helpers), `session.rs`
   (`SqliteSessionStore`, `Backend`, `Credentials`, `AuthSession` alias, `Viewer`,
   `require_same_origin` middleware), `users.rs` (Role, User with redacting
   Debug, hash/verify wrappers, username/password rules, the CLI operations),
   `public.rs` (`PublicIssue` + `/`, `/issues`, `/issues/{date}` public branch,
   `/feed.xml`, `/robots.txt`), `issue.rs` (the `IssueView` loader with
   `issue_json` → row fallback per §5.2; the *full* page template is step 2 —
   for now a signed-in viewer on `/` and `/issues/{date}` may see the public
   rendering plus the downloads list, and the loader must be complete and
   tested), `static/{app.css,app.js,favicon.svg}` served from `/static/{file}`
   with sha256 ETag / 304 and `Cache-Control: public, max-age=86400`, and the
   templates `layout.html`, `error.html`, `login.html`, `account.html`,
   `issue_public.html`, `issue_list.html`, `feed_entry.html`, `_pagination.html`.
   `app.css` implements the §4.4 design tokens, masthead, reading column, the
   dashboard table/badge/kv/funnel/spark/rating classes (so later steps only add
   to it), light and dark. `app.js` can be minimal now (the `data-confirm` and
   `<details>` persistence bits); the rating fetch enhancement is step 2.
 5. **`AppState` refactor** (§4.2): `config: Arc<RwLock<Arc<Config>>>`,
   `config_path: Option<PathBuf>`, `web: Arc<WebState>`, `AppState::config()`;
   `server::serve(config, config_path, db)`; `main::serve` passes
   `Config::resolve_path(cli.config)`. Existing handlers call `state.config()`.
   `WebState { jobs: Arc<dyn JobRunner>, started_at, config_mtime }` — define a
   minimal `JobRunner` trait + `DisabledRunner`/`MockRunner` in `src/web/mod.rs`
   or a small `src/web/dashboard/jobs.rs` stub now so the state shape is final
   (step 6 fills in `SystemdRunner` and the pages).
 6. **Auth** (§6): session layer, auth layer, governor on `POST /login`
   (`into_make_service_with_connect_info::<SocketAddr>` in `serve`; a periodic
   `retain_recent` task; a periodic `delete_expired` task), `/login` GET/POST,
   `/logout`, `/account` (change password, sign out everywhere), the origin-check
   middleware on every POST except `/r/*`, `login_required!` /
   `permission_required!` route layers on the sub-routers (a `/dashboard` stub
   router with an admin-only placeholder overview page is fine so the guard
   tests in §17 can run now), and the 403 → site error page `map_response`.
   `/files/*` accepts a session or Basic auth per §8's last paragraph.
 7. **Security headers** (§16) on every app response: CSP, nosniff, referrer
   policy; `Cache-Control: no-store` on `/dashboard/*`; `Vary: Cookie` on HTML;
   public pages `public, max-age=300` only without a session cookie.
 8. **CLI** `daily-epub users add|passwd|role|disable|enable|list|logout` (§6.1),
   none of which take the run lock; `users add --admin` bootstraps.
 9. **Config** (§15): the new `[server]` keys with validation, `Config::default()`,
   `config.example.toml`, README table (the key-for-key test must pass).
 10. **README**: the route table gains the new public routes and the
    session-or-Basic note on `/files/*`; a sentence that `SmartIpKeyExtractor`
    trusts `X-Forwarded-For` because only nginx reaches the bind address.
 11. **Tests** from §17: migration, users/passwords, session store, login flow
    (cookie flags, disabled user, password change logs out other sessions,
    logout, anonymous `/` sets no cookie, `next` validation), guards, origin
    check, throttle (burst 3 test config), public rendering
    (`public_issue_carries_no_generated_text`, comment links, no World Briefing,
    feed is valid XML with one entry per issue, robots.txt, cache headers),
    issue_json round trip + fallback loader + `runs.report_json` /
    `issues.report_json` written and `/issues.json` returning real reports, and
    the `/files/epub` session-or-Basic behaviour. The binary-level test in
    `tests/m7_server.rs` (serves `/`, `/issues`, `/feed.xml`, `/login`;
    `/dashboard` redirects; `users add` then a real login over TCP) — add it, but
    remember it cannot run inside your sandbox.
 ## Notes and traps
 - Read the axum-login source at the pinned rev under `~/.cargo/git/checkouts`
  after `cargo add` to confirm the `Require` builder, `AuthSession::user().await`,
  `login(&self, &user)`, the macros' signatures, and the session data key
  `"axum-login.data"`. §2 describes what was verified; trust the source over the
  plan's sketch if they differ, and record the difference in your handoff.
 - `tower-sessions` 0.15 `SessionStore` still uses `async_trait`; axum-login's
  own traits do not.
 - `password_auth::verify_password` blocks — run it in `spawn_blocking`, and use
  a fixed dummy hash for unknown usernames so timing does not reveal existence.
 - The governor's `per_second` takes seconds per token: `login_window_minutes *
  60 / login_attempts`.
 - The `sessions.user_id` column is denormalized best-effort from
  `record.data["axum-login.data"]["user_id"]` — verify the actual shape axum-login
  stores (it may be a struct with `user_id` and `auth_hash`).
 - `PublicIssue::from(&Issue)` is the only constructor and carries no generated
  text; the no-leak test renders `fixtures::issue()` publicly and asserts the
  Brief, every summary, every `why`, article body sentences and comment strings
  are absent.
 - The `serve_file` Basic-auth fallback must keep the existing OPDS client
  behaviour byte for byte when no session cookie is present.
 - Keep `server.rs` as the router root: `router()` merges `web::router()`
  sub-routers; do not move the existing handlers.
@@ -0,0 +1,47 @@
 # Step 2 — Full issue views, rating widget, POST /rate
 Read `00-shared.md`, then the plan `docs/plans/2026-09-03-web-dashboard.md`
 (§3, §4.3–§4.4, §5.4, §6.3–§6.4, §8 including §8.1, §16, §17), then
 `handoff-step1.md` for what the foundation actually shipped. This is plan §19
 item 2. Build on the step 1 code as it exists; do not restructure it.
 ## Deliverables
 1. `issue_full.html` (§8): masthead + dateline, The Brief (`front_page_html`
   `|safe`), download buttons (from `IssueView.downloads`), the per-section
   index like the EPUB's In-this-issue page (title → article page,
   `source · N min read`, summary, Why it's here), the rating widget for admins,
   links to World Briefing / Behind the paper (only when present), colophon
   facts footer. `/` and `/issues/{date}` render this for any signed-in viewer.
 2. `article.html` at `/issues/{date}/articles/{article_id}` (§8): header
   (title → source, byline, meta line, Why, social line via
   `chapters::social_line`, summary), body from `ammonia::clean` with the same
   configuration the EPUB uses (find it in `src/html.rs`/`src/epub`; do not run
   `to_xhtml`), `<img>` keep remote `src` and get `loading="lazy"
   referrerpolicy="no-referrer"`, the discussion via `comments::render_xhtml`
   when present, prev/next in issue order, "Read online ↗", rating widget for
   admins. 404 (site error page) when the article is not in that issue.
 3. `world.html` (`/issues/{date}/world`, `world::render_xhtml`, 404 when
   absent) and `behind.html` (`/issues/{date}/behind`, the same lines as the
   EPUB chapter via `chapters::behind_*_line`; near misses link to
   `/dashboard/articles/{id}` for admins).
 4. These three routes sit under the `login_required!` layer (§3).
 5. The HMAC confirmation page (`server::confirmation_page`) gains the
   "Open this issue on the site" link (§8).
 6. Rating widget partial `_rating_widget.html` + `src/web/rate.rs` (§8.1):
   `POST /rate` under the admin layer and the origin check; form and JSON
   variants; `RatingEvent { source: "dashboard", user_id: Some(viewer.id) }`;
   `cleared` writes value 0.0 with label `cleared`; `issue_date` optional with
   the dashboard fallback (`db::latest_issue_date_for_article`); JSON →
   `200 {"article_id","label","event_id"}`, form → flash + 303 to a validated
   same-site `next`. Check how the CLI (`main.rs` `cmd_ratings`) writes the
   `cleared` event and match it exactly.
 7. `app.js`: intercept `.rating` forms, `fetch` with
   `credentials: "same-origin"` and `Accept: application/json`, update the
   active button; keep the no-JS form path working.
 8. Tests (§17 "Full rendering", "Rating"): signed-in `/issues/{date}` contains
   Brief, summaries and why; article page contains body and discussion; the
   fallback loader (no `issue_json`) renders without world/discussion links;
   downloads listed only for files that exist; `POST /rate` as admin appends a
   `dashboard` event with `user_id`, as user → 403, anonymous → redirect/401,
   JSON and form variants, `next` validated, `cleared` value 0.
@@ -0,0 +1,53 @@
 # Step 3 — Dashboard reads: overview, runs, articles
 Read `00-shared.md`, the plan (§3, §4, §9 in full, §16, §17 "Dashboard
 queries"), the curation v2 plan sections it cites
 (`docs/plans/2026-09-02-personalized-curation-v2.md` §7 tables, §9–§13
 signals/admission/utility/editor, §15 explain/stats) and the handoffs for
 steps 1–2. This is plan §19 item 3. Study `src/curate/telemetry.rs`
 (`ExplainRow`, `resolve_run`, `explain_row`, `near_misses`, `render_explain`,
 `SignalsJson`) — the dashboard renders the same data as HTML and must reuse
 those loaders/types where they fit rather than re-deriving them.
 ## Deliverables
 1. `src/web/dashboard/mod.rs` — the overview (§9.1): last-run card from
   `runs.report_json` (counters fallback), budget-today card per provider
   (`config.referenced_providers()` + voyage, `db::provider_spend_for_utc_day`),
   ratings this week by label, "Unrated picks" (last three issues' picks with
   no explicit event, with the inline rating widget from step 2), jobs summary
   (the `jobs` table; the pages come in step 6), config-on-disk `! ` lines from
   `Config::check_report`. Sparklines are step 6 — leave a clearly marked
   placeholder section or omit.
 2. `src/web/dashboard/runs.rs` (§9.2): the list with `?status=` filter and
   pagination; the detail with header + prev/next run, the funnel (from
   `candidate_runs` grouped by stage/reason, in pipeline order, bars via the
   `.funnel` CSS), admission mix, preference state, timings, provider usage,
   warnings, per-feed top 20, the **config diff** against the previous non-dry
   run (flatten both `config_json` documents to dotted keys), near misses via
   `telemetry::near_misses`, and the candidates table with the allow-listed
   filters (`stage`, `reason`, `admitted_by` via
   `json_extract(admitted_by,'$[0]')`, `q`, `flag`) and sorts (utility default,
   rank, triage, quality, fit, title), 100 per page, a `<details>` per row with
   `_signals_table.html` built from `signals_json`.
 3. `src/web/dashboard/articles.rs` (§9.3): the list with the latest
   `candidate_runs` row join (the index `idx_candidate_runs_article_run` exists
   from migration 0004 — confirm), all listed filters and sorts allow-listed,
   50 per page; the detail with the six blocks in the plan's order (article
   facts, assessments incl. `provider_rejected`, run history with expandable
   signals, neighbours/interests, embedding metadata never the vector, rating
   events). The "Explain (text)" `<details>` wraps `telemetry::render_explain`
   output in `<pre>`. The rating widget here carries the note field.
 4. Templates: `dashboard/overview.html`, `dashboard/runs.html`,
   `dashboard/run.html`, `dashboard/articles.html`, `dashboard/article.html`,
   partials `_signals_table.html`, `_candidate_row.html`. Every table inside
   `.scroll-x`; badges per stage/reason/label; sticky thead; the `data-filter`
   client-side filter from §4.4 in `app.js`.
 5. Sort/filter parameters are validated against allow-lists and never
   interpolated into SQL; an unknown sort falls back to the default, never
   errors.
 6. Tests (§17 "Dashboard queries"): funnel counts against a seeded
   `candidate_runs` set; candidate filters/sorts allow-listed; config diff finds
   changed dotted keys and ignores unchanged; articles list filters; article
   detail shows assessments, run history and rating events. Router-level tests
   for the admin guard on each new route.
@@ -0,0 +1,42 @@
 # Step 4 — Ratings page and profile page
 Read `00-shared.md`, the plan (§3, §10, §11, §14.1 for the job names the
 profile page references, §16, §17 "Ratings contributions" and "Profile"), the
 curation v2 plan §6, §9.2–§9.3, §11 (profile/learned adjustments), and the
 handoffs for steps 1–3. This is plan §19 item 4. Reuse `signals::decay`,
 `signals::gate`, `signals::direct_feeds`, `PreferenceState::load/summary`,
 `profile::parse_profile_str`, `profile::parse_interests`,
 `themes::group_into_themes`, `profile::is_stale`; make
 `profile::MAX_RATINGS_IN_REBUILD` `pub`.
 ## Deliverables
 1. `src/web/dashboard/ratings.rs` + `dashboard/ratings.html` (§10): header from
   `PreferenceState::summary()` with the "no embedding" notice; the "How
   ratings enter the algorithm" `<details>` with current config values inlined
   and links to the settings groups (the settings page is step 5; link to
   `/dashboard/settings#curation.feedback` etc. — anchors the settings page will
   provide); the **Current** tab with every column in the plan's table (verdict
   + inline widget with note, article, when·by with username, note, age→decay,
   neighbour weight or "no embedding", feed credit, in prompt, in rebuild, used
   last run from `signals_json.neighbours` of the latest non-dry run), filters
   by label/source/feed/q; the **Events** tab (100 per page, `superseded`
   marking, filters by label/source/user/date range).
 2. `src/web/dashboard/profile.rs` + `dashboard/profile.html` (§11): the
   `profile.md` editor (textarea, Save = origin-checked POST; reject empty or
   > 64 KB; insert the previous content into `profile_versions`; write
   atomically via `<path>.tmp` + rename preserving mode; flash), the live parsed
   preview (server-rendered on GET is fine: the passthrough sections and the
   extracted `## Interests` lines), history with 200-char previews and Restore
   (`POST /dashboard/profile/restore`), standing OPML interests grouped by
   theme (read-only, with path and count), the system prompt
   (`kv.taste_profile` in a collapsed `<pre>`), the learned adjustments block
   with its age and whether a rebuild is due, and a "Rebuild profile now"
   button that POSTs to `/dashboard/jobs/profile-rebuild` (step 6 implements
   the route; render the form now, disabled with a note if `jobs_enabled` is
   false).
 3. Tests (§17): decay/weight/feed-credit/in-prompt/in-rebuild against
   hand-checked values; "used last run" counts neighbours in `signals_json`;
   profile save writes the file and a `profile_versions` row; restore swaps;
   oversized rejected; the parsed preview matches `parse_profile_str`; admin
   guard on every new route.
@@ -0,0 +1,49 @@
 # Step 5 — Settings
 Read `00-shared.md`, the plan (§3, §4.2 "Config reload", §13 in full, §15,
 §16, §17 "Settings schema" and "Settings writer"), `src/config.rs` in full
 (every struct, `validate`, `load`, `resolve_path`, `check_report`, `ENV_PREFIX`,
 `ENV_SPLIT`, the `DAILY_EPUB_SECRET` alias, the stale-key checks), the README
 configuration table and `config.example.toml`, and the handoffs for steps 1–4.
 This is plan §19 item 5.
 ## Deliverables
 1. `src/web/dashboard/settings.rs`: `schema(config, file) -> Vec<SettingGroup>`
   derived by walking `toml::Value::try_from(Config::default())` and the
   current config in parallel (§13.1) — one `SettingField` per leaf with
   `path`, `group`, `kind`, `current`, `default`, `source`
   (Default/File/Env(name)), `help`, `restart_required`. Kinds and the static
   enum table exactly as §13.1 item 3; `SETTINGS_HELP` seeded from the README
   table and `config.example.toml` comments, one entry per shipped key (test).
   Groups render in the §13.1 item 5 order; each group gets an `id` anchor equal
   to its dotted path (step 4 links to these).
 2. `GET /dashboard/settings` (§4.2 reload-on-mtime first; report a file that
   fails to load with the `!` banner and keep the previous config live),
   `dashboard/settings.html`: `Secret` fields as set/not set, `Env` fields
   disabled with the lock note, everything else as an input with the default
   beside it and a reset affordance; weights note. `POST /dashboard/settings`
   implements §13.2 exactly: `toml_edit::DocumentMut`, only changed fields
   written ("explicit beats implicit"), typed by kind, `TextList` as a
   multi-line array with trailing comma, field errors collected before any
   write, render → `<path>.tmp.<pid>` → validate with `Config::load(Some(tmp))`
   → copy permissions → rename → swap `state.config`; one `config_changes` row
   per changed key; flash with the restart note for `restart_required` keys;
   `config_path == None` → 400.
 3. Providers (§13.3): remove (refused when an `[llm]` role names it) and add
   (`[a-z0-9_]+`, must not exist, `ProviderConfig::default()` with the chosen
   kind and placeholders) through the same validate-and-rename path, with
   `config_changes` rows.
 4. `GET /dashboard/settings/history` (§13.4), `dashboard/settings_history.html`.
 5. `systemd/daily-epub.service`: add `/etc/daily-epub` to `ReadWritePaths`
   (the `SupplementaryGroups` line is step 6).
 6. Tests (§17): every leaf of `Config::default()` appears exactly once; every
   shipped key has help; secrets are `Secret` with no value; env detection uses
   the derived name (set the env var inside the test with a unique key and
   restore it); enum options round-trip through `validate()`; starting from
   `config.example.toml` changing three keys preserves every comment and the
   order of untouched lines; a new key in an absent table creates the table;
   `TextList` multi-line; an invalid value (e.g. `deep_keep < shortlist_keep`)
   is rejected and the file untouched; permissions preserved; `config_changes`
   rows; provider add/remove; removing a referenced provider refused; reload
   on mtime swaps the config.
@@ -0,0 +1,51 @@
 # Step 6 — Jobs and stats
 Read `00-shared.md`, the plan (§2 host facts, §3, §4.2, §9.1 sparklines, §12,
 §14 in full, §15 `jobs_enabled`/`journal_lines`, §16, §17 "Stats refactor" and
 "Jobs"), `src/main.rs` (`lock_holder`, `cmd_*` helpers, `GenerateOptions`),
 `src/curate/telemetry.rs` (`stats`), `systemd/`, and the handoffs for steps
 1–5. This is plan §19 item 6.
 ## Deliverables
 1. `src/jobs.rs` (§14.1): the `Job` enum, `parse` (regex `^[a-z0-9-]+$` and
   the listed forms only), `name`, `unit`, `description`, `takes_lock`,
   `dangerous`. Register in `lib.rs`.
 2. `daily-epub job run <name>` (§14.2) in `main.rs`: parse (unknown → exit 2
   with the catalogue), take the lock via `lock_holder` when `takes_lock()`,
   find-or-insert the `requested` jobs row → `running`, run the mapped command
   in-process with the same functions `main` uses, set `ok`/`failed`,
   `finished_at`, `run_id` (generate, from `GenerateOutcome.run_id`), a one-line
   `message`; non-zero exit on failure. The job lifecycle helpers live in
   `src/jobs.rs` as db functions or on `Db`.
 3. `systemd/daily-epub-job@.service` (copy of the generate unit with the `%i`
   description and `job run %i`), `systemd/50-daily-epub.rules` exactly as
   §14.3, `SupplementaryGroups=systemd-journal` on `daily-epub.service`.
 4. `JobRunner` (§14.4): finalize the trait from step 1's stub; `SystemdRunner`
   with `tokio::process::Command`, 10 s timeout, stderr in the error;
   `MockRunner` with recorded calls and scripted statuses; `DisabledRunner`
   when `jobs_enabled = false`. `serve` picks the runner from config.
 5. `src/web/dashboard/jobs.rs` + `dashboard/jobs.html` + `dashboard/job.html`:
   the catalogue cards (Start with `data-confirm` for `dangerous()`, a date
   input on the `generate-<date>` card), the jobs table, `POST
   /dashboard/jobs/{name}` (409 + flash for a duplicate `requested`/`running`
   unit; insert; `runner.start`; failed start marks the row), `GET
   /dashboard/jobs/{id}` (row, live `UnitStatus`, journal tail of
   `server.journal_lines` in `<pre>`, the 30-second "unit exited before the job
   started" rule). `reload_if_changed` on every job start (§4.2). `app.js`
   refreshes the job page every 5 s while `requested`/`running`.
 6. Stats (§12): refactor `telemetry::stats` into `stats_data -> StatsData` +
   `render_stats_text(&StatsData) -> String` with byte-identical CLI output (a
   test pins it against a seeded DB before and after); `GET /dashboard/stats`
   with `?days=14|30|90`, the tables, three server-rendered SVG sparklines via
   `_sparkline.html`, the retriever yield table.
 7. Overview sparklines (§9.1): cost per run, selected per run, generation
   seconds over the last 30 non-dry runs, using the same partial.
 8. Tests (§17 "Stats refactor", "Jobs"): `Job::parse` accepts the catalogue and
   the dated form, rejects `../x`, uppercase and unknown names; `POST
   /dashboard/jobs/{name}` inserts a row and calls `MockRunner::start` with the
   right unit; a running duplicate is refused; a failed start marks the row;
   `job run` in-process (a `--skip-llm`-style config with mocked providers, e.g.
   `features-prune` or `profile-rebuild` against a temp DB) flips
   `requested → running → ok`; the polkit rule file is present and its regex
   matches the unit name format (string test); stats text unchanged.
@@ -0,0 +1,48 @@
 # Step 7 — Docs, users page, polish
 Read `00-shared.md`, the plan (§3, §6.1, §7.2, §18, §19 item 7, §20
 acceptance criteria), the README, `config.example.toml`,
 `docs/plans/2026-08-15-implementation-notes.md`, `docs/runbooks/`, and every
 `handoff-step*.md`. This is plan §19 item 7.
 ## Deliverables
 1. `src/web/dashboard/users.rs` + `dashboard/users.html`: read-only list of
   users (username, role, disabled, created, last login, open session count)
   and a note that edits happen through the `users` CLI.
 2. README: the site (public vs signed-in vs admin), roles, the `users` CLI,
   jobs (unit + polkit), settings (in-place writes, env locks), the updated
   route table, the reverse-proxy note about `X-Forwarded-For`.
 3. `config.example.toml`: confirm the new `[server]` keys are documented with
   comments matching the README table.
 4. `docs/plans/2026-08-15-implementation-notes.md`: a "Web dashboard
   (2026-09-03)" section recording the verified facts with dates (polkit 124
   and the rule, unit changes, toml_edit in-place writes, axum-login git rev +
   tower-sessions 0.15 + our store, password-auth, tower_governor, the
   sandbox/test caveats) and the implementation-time decisions the handoffs
   recorded.
 5. `docs/runbooks/web-dashboard-rollout.md` with the nine steps of plan §18,
   written for the production host.
 6. Layout polish: Atom `<link rel="alternate">` and favicon in `<head>`, the
   Users link in the admin nav, a pass over dark mode and narrow screens in
   `app.css` (every wide table scrolls in `.scroll-x`; the masthead wraps; nav
   collapses to wrapping links), and the 404/500 pages in the site layout.
 7. Walk plan §20's acceptance criteria one by one and fix any gap you can
   close inside this step; list the rest in your handoff.
 8. Tests: the users page under the admin guard; a smoke test that every
   template referenced by a route renders with the fixture data (extend the
   existing router tests rather than duplicating setup).
 ## Follow-ups collected during the orchestrator's reviews of steps 1–6
 - Download buttons on the full issue page show raw byte counts; render them
  human-readable (KB/MB).
 - The `/files/*` deviation: with no Basic auth configured the files stay
  public (see handoff-step1 review notes); document that in the README's route
  table and the rollout runbook.
 - The settings page cannot remove a shipped provider (handoff-step5); mention
  it in the README settings section.
 - Every step left a handoff in this directory; fold their "left for later"
  items into the acceptance walk-through and list anything still open.
 - Two Codex review documents exist under `docs/reviews/` for this plan; leave
  them as they are.
@@ -0,0 +1,72 @@
 # Step 1 handoff — foundation
 ## Landed
 - Added migration `0004_web.sql`: users, SQLite-backed sessions and indexes,
  rating attribution, config/profile/job history, report/issue snapshots, and
  the candidate article/run index. `RatingEvent`/`RatedArticle` now carry a
  nullable user id.
 - Persisted full `runs.report_json`, final `issues.report_json`, and a compact
  `issues.issue_json` with article bodies removed. The issue loader rehydrates
  bodies from `articles` and has a reduced-row fallback for pre-migration
  issues. `GenerateOutcome` exposes `run_id`.
 - Added the `web` skeleton, final shared-state shape, Askama layout/error/public
  templates, embedded CSS/JS/favicon with SHA-256 ETags, security/cache/request
  headers, and `DisabledRunner`/`MockRunner` stubs.
 - Added `axum-login` at the required git revision, the local sqlx 0.9 session
  store, password-auth users/backend, session/auth route layers, role guards,
  same-origin POST middleware, login governor and cleanup tasks, login/logout,
  account/password/session revocation, and session-or-Basic file downloads.
 - Added public latest/archive/issue pages, the stripped `PublicIssue` boundary,
  Atom feed, and robots policy. Anonymous page loads remain session-cookie-free.
 - Added all `daily-epub users` commands without the pipeline lock, new server
  configuration/defaults/validation, example config, and README command/route/
  reverse-proxy documentation.
 - Expanded `tests/m7_server.rs` to cover env-only public routes, dashboard
  redirect, CLI admin bootstrap, and a real TCP login/account request.
 ## Deviations and follow-up
 - `rpassword` could not be added: it is absent from the local Cargo cache and
  this sandbox cannot resolve `index.crates.io` (three retries failed). The CLI
  currently uses an equivalent Unix `/dev/tty` no-echo double prompt and keeps
  `--password-stdin`. Replace that helper with `rpassword::prompt_password`
  after adding the dependency in a network-enabled environment.
 - Cargo resolved direct `toml_edit` to 0.22.27 rather than the plan's observed
  0.25.x release; it was selected by `cargo add` for the available toolchain and
  lock graph, not hand-pinned.
 - The finished issue report is attached immediately after `finish_run`, rather
  than during the earlier issue snapshot write, because publish timing and the
  final run status are not complete at snapshot time. The stored observable
  value is the same final serialized report.
 - The pinned axum-login source confirms `AuthSession::user().await`, immutable
  `login`/`logout`, the macro route layers, and session key
  `"axum-login.data"`; the implementation follows those real APIs.
 - Full signed-in issue/article rendering and the real `POST /rate` handler are
  step 2. Step 1 supplies the protected dashboard overview and admin-only 501
  rate stub so route-guard tests exercise the final boundary.
 ## Verification
 - `cargo fmt --check`: pass.
 - `cargo clippy --all-targets -- -D warnings`: pass.
 - `cargo test` with sandbox-bound tests skipped: **389 passed, 0 failed**.
  Excluded were the four named Anthropic listener tests, the relative-URL
  listener test, five `server::tests` listener tests, both `m7_server` TCP
  tests, and three existing OpenAI fake-server tests that also bind loopback.
 - Focused `cargo test web:: -- --nocapture`: **16 passed, 0 failed**.
 - `cargo tree -i` shows one `sqlx` version (0.9.0) and one
  `libsqlite3-sys` version (0.37.0).
 ## Orchestrator review (2026-09-03)
 - `rpassword` added (the sandbox had no network); `read_password_hidden` is
  now `rpassword::prompt_password`. `toml_edit` moved to 0.25 as the plan says.
 - **Deviation from plan §8 kept on purpose:** `/files/*` with *no* Basic auth
  configured stays public, exactly as before. The plan wanted a redirect to
  `/login` there, but the public OPDS feed's acquisition links point at those
  files and an e-reader cannot log in; acceptance criterion 11 ("`/files`
  behave as before") and "OPDS clients are unaffected" win. With Basic auth
  configured, a session cookie of any role bypasses it.
 - A short new password on `/account/password` is a 400 form error, not a 500.
 - Full suite outside the sandbox: 370 lib + all integration tests green.
@@ -0,0 +1,56 @@
 # Step 2 handoff — full issues and ratings
 ## Landed
 - Signed-in `/` and `/issues/{date}` now render the full issue: Brief, download
  links for artifacts that still exist, the section/article index with summaries
  and `why`, admin rating widgets, World/Behind links when their snapshot data is
  present, and colophon facts.
 - Added login-protected article, World Briefing, and Behind the paper pages.
  Article pages use the EPUB's ammonia cleaning path without XHTML conversion,
  retain remote images with lazy/no-referrer attributes, include rendered
  discussions, previous/next navigation, source links, and admin ratings.
 - Replaced the Step 1 `/rate` stub with the admin-only form/JSON handler. Events
  are append-only `dashboard` events attributed to the viewer; missing issue
  dates use `latest_issue_date_for_article`; clear events use the CLI's exact
  `cleared`/`0.0` representation; form redirects validate `next` and carry a
  flash, while JSON returns the event id.
 - Added the no-JS rating partial and JavaScript enhancement, active-state
  updates, issue/article styling, and the signed-in private cache policy.
 - The e-ink HMAC confirmation page now links to the corresponding site issue.
 - Added router tests for full/fallback rendering, article discussions and image
  handling, World/Behind pages, 404s and login protection, artifact gating,
  both rating representations, role guards, attribution, fallback dates,
  validated redirects, clear values, admin widget state, and near-miss links.
 ## Deviations and notes
 - The pinned `axum-login` dependency disables tower-sessions' `axum-core`
  feature, so its re-exported `Session` does not implement an Axum extractor in
  this dependency graph. Handlers use `Extension<Session>` to read the exact
  session already installed by the auth layer; no second tower-sessions
  dependency was added.
 - The web form and JSON response use `down`, as specified for the widget, while
  the persisted event label is `not_for_me`, matching `cmd_ratings` and the
  existing learned-rating queries exactly.
 - No migration was needed. Step 3 can construct `RatingWidget` with
  `show_note = true` for dashboard article variants.
 ## Verification
 - `cargo fmt`: pass.
 - `cargo clippy --all-targets -- -D warnings`: pass.
 - Focused `cargo test web:: -- --nocapture`: **22 passed, 0 failed**.
 - `cargo test` with the documented sandbox listener tests skipped:
  **395 passed, 0 failed, 15 filtered out**. The filtered tests were the four
  Anthropic listener tests, three OpenAI fake-server listener tests noted in the
  Step 1 handoff review, the relative-URL listener test, five `server::tests`
  listener tests, and both `tests/m7_server.rs` tests.
 ## Orchestrator review (2026-09-03)
 - Accepted as is. `Extension<Session>` for flashes is fine (the auth layer's
  session manager inserts it); no second tower-sessions dependency.
 - Cosmetic follow-up for step 7: download buttons show raw byte counts;
  render them human-readable (KB/MB).
 - Full suite outside the sandbox: 376 lib + all integration tests green.
@@ -0,0 +1,100 @@
 # Step 3 handoff — dashboard reads: overview, runs, articles
 ## Landed
 - `src/web/dashboard/mod.rs`: the overview (§9.1) — last-run card built from
  `runs.report_json` via `RunReport::info_block()` (legacy-counter fallback
  when the report is missing or unparseable), budget-today `<meter>` per
  referenced provider plus voyage from `db::provider_spend_for_utc_day(now)`,
  ratings this week by label, "Unrated picks" (last three issues' picks with
  no explicit event, each with the step 2 rating widget posting back to
  `/dashboard`), a jobs summary read straight from the `jobs` table (active
  rows plus the last five finished; the pages themselves are step 6), and the
  `! ` lines of `Config::check_report`. Sparklines are a marked HTML comment
  for step 6. The module also carries the helpers the read pages share:
  `Pager`, `SignalsView` (the parsed `signals_json` behind
  `_signals_table.html`), `allow_listed`, `like_pattern`, `Bind`/`bind_all`/
  `dynamic_query`, formatting helpers, and the `STAGES`/`REASONS`/
  `RETRIEVERS` allow-lists.
 - `src/web/dashboard/runs.rs` (§9.2): `/dashboard/runs` with `?status=` and
  pagination (50), and `/dashboard/runs/{id}` with header (issue link when the
  issue exists, previous/next run by id), the funnel from `candidate_runs`
  grouped by stage and reason, admission mix, preference state, timings,
  provider usage, warnings (`#warnings` anchor used by the overview and the
  list), top-20 feeds, the config diff (`flatten_json` + `config_diff`)
  against the previous non-dry run that recorded a config, ten near misses via
  `telemetry::near_misses`, and the candidates table (100 per page) with the
  `stage`/`reason`/`admitted_by`/`q`/`flag` filters and `utility` (default)/
  `rank`/`triage`/`quality`/`fit`/`title` sorts. Each row's title is a
  `<details>` that expands `_signals_table.html`.
 - `src/web/dashboard/articles.rs` (§9.3): `/dashboard/articles` (50 per page)
  joining the best entry, the latest `candidate_runs` row through the
  `MAX(run_id)` subquery (the index `idx_candidate_runs_article_run` is in
  migration 0004 — confirmed), both assessments, the current explicit rating
  and the latest publication; every listed filter and sort;
  `/dashboard/articles/{id}` with the six blocks in the plan's order,
  `provider_rejected` rows called out as such, run history rows expanding
  their signals, neighbours/interests from the latest row, embedding metadata
  only (never the vector), all rating events with source/user/note/value, the
  rating widget with `show_note = true`, and "Explain (text)" wrapping
  `telemetry::render_explain` verbatim in `<pre>`.
 - Templates: `dashboard/overview.html`, `runs.html`, `run.html`,
  `articles.html`, `article.html`, partials `_signals_table.html`,
  `_candidate_row.html` and `dashboard/_pager.html`. Every table sits in
  `.scroll-x`; badges per stage/reason/label/status; tables carry
  `data-filter`.
 - `app.css` / `app.js`: one appended block each (`/* step 3 … */`): cards,
  filters, funnel bar, pager, signals details, diff colours, and the
  filter-as-you-type behaviour for `table[data-filter]` (inserts a search
  input before the table's `.scroll-x` wrapper, hides non-matching rows on
  the current page only).
 ## Deviations and notes
 - **sqlx 0.9 dynamic SQL.** `sqlx::query` only accepts `&'static str` or
  `AssertSqlSafe`, so the list queries go through `dashboard::dynamic_query`,
  which wraps the assembled string in `AssertSqlSafe`. The audit holds
  because the string is built only from constants and allow-listed fragments
  (`CANDIDATE_SORTS`/`ARTICLE_SORTS` map names to fixed `ORDER BY` text);
  every user value is bound through `bind_all`. An unknown sort or filter
  value falls back to the default / is dropped, never an error.
 - **Funnel semantics.** `stage` records where a row stopped, so the bars
  show the cumulative "reached" count (rows at this stage or a later one, so
  the first bar is everything considered) with "stopped here" and the reason
  breakdown beside it. Widths are `<svg width="N%">` children of `.funnel`
  because the CSP (`style-src 'self'`) forbids inline `style` attributes;
  the budget card uses `<meter>` for the same reason.
 - **Prev/next run** links go to the neighbouring run ids overall (the
  header already links the date's issue); a rerun of the same date is
  therefore the immediate neighbour.
 - **Extract method** is not shown on the article page: `db::article_from_row`
  hard-codes `ExtractMethod::Miniflux` for every loaded article, so the value
  would be meaningless. `excerpt_only` is shown instead. Source `kind`s render
  via their `Debug` names (`Feed`, `Scour`, …).
 - **`admitted_by` filter** is allow-listed against the six retriever names
  and still applied as the plan's prefix `LIKE` on
  `json_extract(admitted_by, '$[0]')`.
 - The `_pagination.html` partial from step 1 (text only) was left alone; the
  dashboard uses its own `dashboard/_pager.html` with prev/next links that
  preserve the other query parameters.
 - Only additive edits outside my files: two appended blocks in `app.css` and
  `app.js`. No changes to `web/mod.rs`, `db.rs`, `rate.rs` or `telemetry.rs`
  (a private `first_retriever` in telemetry was reimplemented as
  `admitted_by_parts` rather than made `pub`).
 ## Left for later steps
 - Step 6: overview sparklines (placeholder comment in `overview.html`), and
  the `/dashboard/jobs` pages the overview's job links point at.
 - Step 4: `/dashboard/ratings`, linked from the overview's ratings card.
 - The overview's ratings-this-week card counts all explicit events in the
  last seven days by label (a `cleared` is listed but not counted in the
  total).
 ## Verification (outside the sandbox)
 - `cargo fmt`: pass.
 - `cargo clippy --all-targets -- -D warnings`: pass.
 - `cargo test web::dashboard`: **11 passed, 0 failed**.
 - `cargo test` (full suite): **387 lib tests passed, 0 failed**, plus every
  integration test binary green (7, 2, 3, 4, 7, 9, 2), nothing skipped.
@@ -0,0 +1,79 @@
 # Step 4 handoff — ratings page and profile page
 ## Landed
 - `src/web/dashboard/ratings.rs` + `dashboard/ratings.html` (`GET /dashboard/ratings`,
  plan §10). Header from `PreferenceState::load(..).summary()` (the same loader
  the pipeline uses) plus the "N rated articles have no embedding" notice; the
  "How ratings enter the algorithm" `<details>` with the live config values
  inlined and links to `/dashboard/settings#curation.feedback`,
  `#curation.ranking` and `#curation.ranking.weights.preliminary`.
  **Current** tab: one row per article from
  `current_ratings_including_cleared(36_500)` with the verdict badge and the
  inline rating widget (`show_note = true`), article → `/dashboard/articles/{id}`
  with feed and issue date, when · source · username, note, age → decay,
  neighbour weight (`value × decay`, or "no embedding"; a "(beyond lookback)"
  marker when older than `rating_lookback_days`), feed credit per direct feed,
  in-prompt / in-rebuild ticks from the rank among non-cleared verdicts, and
  "used last run" from `signals_json.neighbours` of the latest non-dry run
  (count of candidates and how many were selected). Filters: label, source,
  feed, q. **Events** tab: every `rating_events` row, 100 per page,
  `superseded` marked via an `EXISTS` on a later explicit event; filters label,
  source, user, from/to date. Filter values are validated (allow-listed labels,
  `[a-z0-9_]` sources, parsed dates/ids) and only ever bound; the dynamic
  `WHERE` is assembled from fixed clause strings under `sqlx::AssertSqlSafe`.
 - `src/web/dashboard/profile.rs` + `dashboard/profile.html` (plan §11).
  `GET /dashboard/profile`: the `profile.md` textarea, the server-rendered
  parsed preview (passthrough body in a `<pre>`, extracted `## Interests`
  lines), history (50 newest `profile_versions` with 200-char previews and a
  Restore form), OPML standing interests grouped by `group_into_themes` with
  path and count, the learned adjustments with the prompt version, build time,
  age and whether `profile::is_stale` says a rebuild is due, the collapsed
  system prompt (`kv.taste_profile`), and the "Rebuild profile now" form
  posting to `/dashboard/jobs/profile-rebuild` (disabled with a note when
  `server.jobs_enabled` is false). `POST /dashboard/profile`: CRLF→LF
  normalization, reject empty or > 64 KB (400), record the previous file in
  `profile_versions` with `saved_by`, write `<path>.tmp` + rename preserving
  the existing mode, flash "Saved; the next run rebuilds the system prompt."
  Identical content is a no-op flash with no version row.
  `POST /dashboard/profile/restore` (`version_id`): records the current file
  as a new version and writes the chosen one back; unknown id → 404.
 - `src/curate/profile/mod.rs`: `MAX_RATINGS_IN_REBUILD` and `stored_version`
  are now `pub` (the profile page shows the prompt version and build time).
 - `src/web/static/app.css`: a `/* step 4 */` block (tabs, filters, contribution
  table, profile grid, previews).
 ## Deviations and notes
 - Feed credit is shown as `value × decay / n`, not the plan §10 table's
  `value / n`: `signals::feed_rates` credits the **decayed** weight ("decayed as
  in §9.2", curation plan §9.3), and the page shows what the ranker computes.
 - "Used last run" scans the run's `candidate_runs` rows once
  (`signals_json LIKE '%"neighbours":[{%'`) and parses each `SignalsJson`,
  instead of one `LIKE '%"article_id":<id>,%'` query per rated article; same
  result, one query.
 - The verdict block and rebuild set are count-bounded, so the neighbour weight
  is still shown for ratings older than `rating_lookback_days`, with a
  "(beyond lookback)" marker, since `PreferenceState::load` would not load them.
 - `RatedArticle` does not carry the event `source`; the Current tab reads it
  with one small query per row (ratings are sparse — hundreds at most).
 - `TasteProfile.verdicts` is not persisted, so the prompt's verdict count is
  derived by counting lines after `## Recent verdicts` in the stored text.
 - No new migration, no changes to `db.rs`, `web/mod.rs`, `layout.html` or
  `app.js`.
 ## Left for later steps
 - Step 5 must provide the settings anchors linked from the ratings page:
  `curation.feedback`, `curation.ranking`, `curation.ranking.weights.preliminary`.
 - Step 6 implements `POST /dashboard/jobs/profile-rebuild`; the profile page
  already renders the form (with `data-confirm`).
 - Step 3's article detail pages are linked as `/dashboard/articles/{id}`.
 ## Verification
 - `cargo fmt --check`: pass.
 - `cargo clippy --all-targets -- -D warnings`: pass.
 - `cargo test` (outside the sandbox, nothing skipped): **390 lib tests passed,
  0 failed** (14 new in `web::dashboard::{ratings,profile}`), plus every
  integration suite green (7, 2, 3, 4, 7, 9, 2 tests).
@@ -0,0 +1,62 @@
 # Step 5 handoff — settings
 ## Landed
 - `src/web/dashboard/settings.rs`: a schema derived by walking serialized
  default and live `Config` values, including optional/env-only fields, exact
  field kinds and enum choices, derived environment names, source tracking,
  README/example-backed help text, stable group order, and dotted-path anchors.
 - `/dashboard/settings`: reload-on-mtime with a visible load-error banner and
  last-good config retention; secret presence-only rendering, environment
  locks, typed inputs, defaults/reset controls, and weight normalization notes.
 - Typed `toml_edit` saves that preserve comments/order, collect field errors,
  write multiline string arrays, create missing tables, validate through
  `Config::load` in `<path>.tmp.<pid>`, preserve permissions, rename atomically,
  swap the live config, and record one attributed `config_changes` row per key.
 - Provider add/remove flows through the same validated writer, including name
  and kind validation, role-reference refusal, placeholder defaults, audit
  history, and redaction of a hand-written provider `api_key` from history.
 - `/dashboard/settings/history`, newest first at 100 rows per page.
 - A step 5 CSS block and reset helper in `app.js`; `/etc/daily-epub` added to
  the server unit's `ReadWritePaths`.
 - Sixteen settings tests covering every schema and writer case listed in §17,
  including router-level rendering and POST behavior through `oneshot`.
 ## Deviations and notes
 - Shipped providers cannot be removed, even when unreferenced. They are members
  of `Config::default()`, so deleting their TOML table would immediately restore
  the built-in entry and falsely report success. They can be edited or left
  unreferenced; custom providers can be removed normally.
 - `FieldKind::Enum` owns `Vec<String>` rather than the plan sketch's static
  slice because `llm.bulk` and `llm.editor` must include provider names derived
  at runtime. The rendered behavior and validation table are unchanged.
 - Restart notices also cover `server.public_url`, `server.session_days`,
  `server.login_attempts`, and `server.login_window_minutes`, in addition to
  the plan sketch's `database_path` and `server.bind`, because those values are
  captured when the server/session/throttle layers are built.
 - An absent key whose effective value is already the submitted default remains
  absent. This reconciles “only changed fields” with the no-JavaScript form
  posting every editable field; resetting an explicit non-default file value
  still writes the default explicitly.
 - Step 6 should call `WebState::reload_if_changed` before starting each job, as
  §4.2 requires. Step 5 supplies the shared helper; this branch's jobs module is
  intentionally still the parallel-step stub.
 - The shared brief's sandbox list omits three pre-existing OpenAI fake-server
  tests that bind through the same `curate::llm::tests::serve` helper as its four
  named Anthropic tests. The step 1 handoff records those three additional
  sandbox failures; they are not settings regressions.
 ## Verification
 - `cargo fmt`: pass.
 - `cargo clippy --all-targets -- -D warnings`: pass.
 - Focused `cargo test web::dashboard::settings -- --nocapture`: **16 passed,
  0 failed**.
 - Unfiltered `cargo test`: **379 library tests passed** before the harness
  reported the expected loopback-bind failures (the 10 named library tests plus
  the three OpenAI tests noted above); no settings test failed.
 - `cargo test` with all pre-existing loopback listener tests excluded:
  **411 passed, 0 failed, 15 filtered out** (379 library, 7 binary-unit, and 25
  integration tests passed; 13 library listener tests and both `m7_server`
  tests were filtered).
@@ -0,0 +1,73 @@
 # Step 6 handoff — jobs and stats
 ## Landed
 - Added `src/jobs.rs`: the fixed, regex-constrained job catalogue; jobs-table
  query/lifecycle helpers; single-line terminal messages; `SystemdRunner` with
  ten-second command timeouts, captured stderr and systemd status parsing.
 - Added `daily-epub job run <name>`. It uses the existing command lock policy,
  claims or creates the requested row, calls the same in-process helpers as the
  ordinary CLI commands, records `ok`/`failed`, stores the generated run id,
  and propagates failures to a non-zero process exit. Existing profile,
  features and social CLI output retains its prior line content.
 - Finalized `JobRunner`: production `serve` installs `SystemdRunner` when
  `server.jobs_enabled` is true; disabled servers use `DisabledRunner`;
  `AppState::new` keeps its existing test behavior; `MockRunner` records calls
  and scripts starts, statuses and logs.
 - Added the admin Jobs list/start/detail routes and templates: catalogue cards,
  dated generation, job history, duplicate conflict handling, start-failure
  persistence, live unit fields, configured journal tail, 30-second
  pre-claim failure detection, disabled-state messaging and five-second active
  refresh.
 - Added the systemd job template, the §14.3 polkit rule verbatim, and
  `SupplementaryGroups=systemd-journal` on the server unit.
 - Split stats into `stats_data` plus `render_stats_text` while pinning the
  complete previous CLI output. Added the 14/30/90-day stats page, aggregate
  tables, retriever yield, per-run table, daily provider costs and the three
  requested SVG charts.
 - Replaced the overview placeholder with cost-per-run, selected-per-run and
  generation-time sparklines over the last 30 finished non-dry runs. SVGs use
  presentation attributes and CSS classes only; no inline styles or template
  `safe` filters were added.
 - Added/expanded tests for the catalogue, job lifecycle and run link, CLI lock
  mapping, in-process job success/failure, polkit/unit files, runner status
  parsing, every jobs route behavior, exact stats text/data, stats routes and
  both sparkline forms.
 ## Deviations and integration notes
 - Per the parallel-step constraint, job start contains exactly the requested
  `// TODO(step 5 merge): reload_if_changed` marker and does not duplicate step
  5's helper. The step-5 merge must replace that marker with its helper call.
 - The offline in-process job test uses `features-prune`; generate's `run_id`
  persistence is tested separately through the same lifecycle helper because a
  full generate would require Miniflux/network fixtures. Production generate
  and dry-run mappings both store `GenerateOutcome.run_id`.
 - The server unit intentionally does not add `/etc/daily-epub` to
  `ReadWritePaths` here; step 5 owns that additive unit change.
 - `StatsData.durations` retains finished dry runs because that is what the old
  CLI calculation included and the text must remain byte-identical. Dashboard
  per-run series and overview sparklines exclude dry runs as specified.
 ## Left for later
 - Step-5 merge: call its `reload_if_changed` implementation at the marked job
  start site and combine its `/etc/daily-epub` unit path change.
 - Step 7 owns user-facing documentation and deployment/runbook polish.
 ## Verification
 - `cargo fmt`: pass.
 - `cargo clippy --all-targets -- -D warnings`: pass.
 - Raw `cargo test`: **406 passed, 13 failed** in the library before Cargo
  stopped; every failure was a sandbox-denied loopback listener (four named
  Anthropic tests, three pre-existing OpenAI fake-server tests documented in
  the step-1 handoff, the named extractor test and five named server tests).
 - `cargo test` with those listener tests and both `tests/m7_server.rs` listener
  tests skipped: **440 passed, 0 failed, 15 filtered out** across all targets.
 - Focused `cargo test jobs::`, `cargo test job_run`, and `cargo test stats`:
  pass.
 - `node --check` on the polkit JavaScript (via stdin): pass.
 - `systemd-analyze verify systemd/daily-epub-job@.service`: no diagnostics for
  the job unit.
@@ -0,0 +1,96 @@
 # Step 7 handoff — docs, users page, and polish
 ## Landed
 - Added the admin-only, read-only `/dashboard/users` page with username, role, enabled/disabled
  status, created time, last login, and unexpired session count. The page directs edits to the
  existing `daily-epub users` CLI.
 - Expanded the README with the public/user/admin boundary, user lifecycle commands, complete
  route table, systemd+polkit Jobs setup, comment-preserving Settings behavior, environment
  locks, shipped-provider removal limitation, public `/files/*` behavior without Basic auth,
  and the `X-Forwarded-For`/loopback trust boundary. Updated `[server]` comments in
  `config.example.toml` to match.
 - Added the dated Web dashboard section to the implementation notes: polkit 124 and its narrow
  rule, service-unit changes, the `toml_edit` write path, the pinned auth/session/password/
  throttle stack, sandbox test caveats, and the implementation-time decisions from steps 1–6.
 - Added `docs/runbooks/web-dashboard-rollout.md`, with the plan's nine production rollout steps,
  commands, permissions, public-files compatibility note, and smoke checks.
 - Completed layout polish: Atom discovery and favicon remain in `<head>`, Users remains in the
  admin nav, both navs now wrap cleanly, narrow cards/forms/rating controls collapse, dark-mode
  form controls use the site colors, focus states are visible, and all wide tables (including
  the nested signals table and new users table) sit in `.scroll-x`.
 - Unknown routes and template-render failures now use the site-layout 404/500 pages. Issue
  download buttons show human-readable B/KB/MB/GB sizes.
 - Removed stale diff3 ancestor markers from the merged CSS/JavaScript and restored the missing
  table-filter closure; `node --check src/web/static/app.js` passes.
 - Added the users guard/content test, file-size tests, site-layout error test, and one
  fixture-backed router smoke test that renders every dashboard route template.
 ## Acceptance criteria walk-through
 1. **Public issue and Atom boundary — met.** `PublicIssue` cannot carry generated/body fields;
   existing fixture tests assert titles/authors/sources/comment links/metadata are present and
   private Brief/summary/why/body/comment/World text is absent. The feed parses as XML and uses
   the same public view.
 2. **Complete signed-in issue — met.** Existing router tests cover Brief, summaries, why lines,
   article bodies/discussion, World and Behind pages, reduced pre-snapshot fallback, and
   existence-gated downloads. All three artifact slots share the same loader; sizes are now
   human-readable.
 3. **Admin-only ratings — met.** Whole-router role guards and rating tests cover anonymous,
   user, and admin outcomes, attributed `source = 'dashboard'` events, clear events, and the
   unchanged HMAC path.
 4. **Article history/explainability — met.** The articles list/detail routes expose the latest
   stage plus full run history, reasons, signals, assessments/facets, utility/cluster/admission,
   editor why, issue appearances, neighbours, embedding metadata, ratings, and text explain;
   allow-listed query tests and fixture rendering pass.
 5. **Run history — met.** Run list/detail renders the cumulative funnel and reasons, admission,
   preference state, timings, provider costs, warnings, feeds, near misses, config diff, and
   candidate table; seeded counts, sorts, filters, links, and sparklines are tested.
 6. **Ratings contributions/history — met.** Current and events tabs cover decay, decayed feed
   credit, neighbour weight, prompt/rebuild membership, last-run use, append-only edits/clear,
   annotations, filters, and superseded history with hand-checked tests.
 7. **Settings — met.** The schema/default/help/env/secret tests cover every config leaf. Writer
   tests cover typed changes, comments/order/mode preservation, validation before rename,
   history, providers, and reload-on-mtime. The README records why shipped providers cannot be
   removed.
 8. **Profile — met.** Save/restore/version tests cover the atomic editor and parsed preview;
   the page shows OPML interests, prompt, learned adjustments/staleness, and the rebuild job.
 9. **Jobs — met.** Fixed-name parsing, polkit/unit files, MockRunner starts/status/logs, duplicate
   refusal, failure persistence, lifecycle/run linkage, journal tail, reload-before-start, and
   overview links are present and tested. Pipeline work remains in the separate job unit.
 10. **Session/security stack — met.** The pinned axum-login/tower-sessions store,
    password-auth hashes, cookie properties, session invalidation, origin checks, login throttle,
    CSP/security headers, safe redirect checks, and secret redaction have focused tests.
 11. **Existing routes — met.** HMAC, OPDS, files, health, and reports remain wired; issue reports
    are populated. The reviewed compatibility decision keeps files public only when Basic auth
    is absent, while configured Basic auth or a valid session still gates them.
 12. **Test coverage — met, with sandbox execution caveat.** All new router tests use `oneshot`;
    no new test binds or invokes systemd. The filtered full run passed every runnable target.
    The orchestrator should run the complete suite outside this listener-restricted sandbox.
 ## Prior handoff follow-ups
 - Step 1's `rpassword` and direct `toml_edit 0.25` follow-ups were already resolved by the
  orchestrator; its public-files deviation is now documented.
 - Step 2's raw download sizes are resolved here.
 - Step 3's Jobs/ratings targets and overview sparklines, Step 4's settings anchors and profile
  rebuild action, and Steps 5–6's config reload plus combined unit changes are all present after
  the merged steps and were included in the smoke/audit pass.
 - Nothing remains open against §20. Production deployment itself is intentionally left to the
  operator following the new runbook. Plan §21's product deferrals remain intentional: per-user
  personalization, OPML editing, body FTS, SSE logs, passkeys, public why lines, old snapshot
  backfill, and charts beyond the current sparklines.
 ## Verification
 - `cargo fmt`: pass.
 - `cargo clippy --all-targets -- -D warnings`: pass.
 - `node --check src/web/static/app.js`: pass.
 - Focused new router/size/error tests: pass.
 - Raw `cargo test`: **426 passed, 13 failed** before Cargo stopped at the library target; every
  failure was `PermissionDenied` while binding a loopback listener (the four documented
  Anthropic tests, three OpenAI tests using the same helper, the extractor test, and five server
  tests).
 - `cargo test` with those 13 listener tests plus the two `tests/m7_server.rs` TCP tests filtered:
  **460 passed, 0 failed, 15 filtered out** across library, binary, integration, and doc targets.
@@ -0,0 +1,64 @@
 # Web dashboard step 6 implementation review
 The finished step-6 implementation matches the jobs and stats brief. The fixed
 job catalogue, CLI lifecycle, systemd runner and files, dashboard routes,
 stats-data refactor, SVG sparklines, production runner wiring, and required
 tests are all present. The review found and corrected two faulty test
 assertions, restored the polkit file to the brief's verbatim rule, made job
 messages reliably one-line, and strengthened the duplicate-start test to use a
 genuinely running row. No outstanding correctness finding remains.
 ## Critical
 None.
 ## High
 None.
 ## Medium
 None.
 ## Low
 None.
 ## Nits
 None.
 ## Plan Coverage
 | Requirement | Status | Evidence |
 |---|---|---|
 | Fixed job catalogue and validated names | Implemented as planned | `src/jobs.rs`: `Job`, `parse`, `name`, `unit`, `description`, `takes_lock`, `dangerous` and traversal/uppercase/unknown-name tests. |
 | `daily-epub job run <name>` lifecycle | Implemented as planned | `src/main.rs`: CLI dispatch, existing lock path, in-process command mapping, requested-row claim, terminal update, failure propagation and tests. `src/jobs.rs` owns row lifecycle helpers. |
 | Unit template, polkit rule and journal group | Implemented as planned | `systemd/daily-epub-job@.service`, verbatim `systemd/50-daily-epub.rules`, and `SupplementaryGroups=systemd-journal` in `systemd/daily-epub.service`; repository-content tests cover their security-sensitive strings. |
 | Production/test/disabled runners | Implemented as planned | `src/jobs.rs::SystemdRunner` uses bounded `tokio::process::Command`; `src/web/mod.rs` contains scripted `MockRunner` and `DisabledRunner`; `src/server.rs::serve` selects the production runner only when jobs are enabled while `AppState::new` remains test-compatible. |
 | Jobs list/start/detail pages | Implemented as planned | `src/web/dashboard/jobs.rs` and the two jobs templates implement catalogue cards, date selection, history, duplicate refusal, failed-start persistence, live status, journal tail, the 30-second failure rule, authorization tests and five-second refresh. |
 | Config reload integration boundary | Partially implemented by design | The required `// TODO(step 5 merge): reload_if_changed` is at the start site. Step 5 owns the helper and merge-time call per the brief's parallel-work constraint. |
 | Stats data/text split | Implemented as planned | `src/curate/telemetry.rs` exposes `StatsData`, `stats_data`, and `render_stats_text`; seeded fixtures pin the complete legacy output byte-for-byte. |
 | Stats page | Implemented as planned | `src/web/dashboard/stats.rs` and `dashboard/stats.html` provide the three allowed windows, tables, retriever yield, per-run data and the three requested charts. |
 | Overview sparklines | Implemented as planned | `src/web/dashboard/mod.rs` loads the last 30 finished non-dry runs and renders cost, selected count and duration through `_sparkline.html`. |
 | CSP-safe rendering | Implemented as planned | SVG geometry uses presentation attributes and stylesheet classes; changed templates contain no inline `style` attributes and no `safe` filter. |
 ## Testing Assessment
 Meaningful tests cover every catalogue form and rejection case, job-row claim
 and completion (including run-id persistence), real router authorization and
 POST behavior with `MockRunner`, requested/running duplicate refusal, failed
 starts, the unit-exited grace rule, disabled jobs, systemd output parsing,
 polkit/unit contents, in-process job success and failure, exact
 legacy stats text, stats aggregation, SVG geometry, page output, and overview
 series.
 The tests deliberately do not execute systemd or the network. The mapped
 generate branch is therefore covered by its option construction and the
 separate job run-id lifecycle test rather than a live pipeline invocation;
 this follows the brief's offline-test rule. No additional step-6 test is needed.
 ## Open Questions
 - During the step-5 merge, replace the required job-start TODO with the single
  `reload_if_changed` call supplied by step 5; do not duplicate that helper.
@@ -0,0 +1,92 @@
 # Web dashboard step 5 implementation review
 The final step 5 working tree implements the settings schema, editor, provider
 operations, history page, reload-on-mtime behavior, and systemd write access
 described by the plan. The implementation is well covered by behavior-focused
 unit and router tests. The review found one security issue in the inherited
 work—removing a provider could have copied a hand-written `api_key` into
 `config_changes`—and fixed it with redaction plus a regression assertion.
 ## Critical
 None.
 ## High
 None. The provider-history secret exposure found during review is fixed in
 `provider_literal`: `api_key` is removed before a whole-provider literal is
 stored or rendered by the history page.
 ## Medium
 None.
 ## Low
 ### Shipped provider removal differs from the literal plan wording
 - Evidence: `ProviderCard::removable` and `remove_provider` refuse entries in
  `default_providers()`, even when no `[llm]` role references them.
 - Plan difference: §13.3 only explicitly requires refusal when an `[llm]` role
  names the provider.
 - Reason and recommendation: deleting a shipped provider's file table cannot
  remove it from the effective config because `Config::default()` supplies it
  again; pretending otherwise would reset it while reporting removal. Keep the
  explicit refusal unless config loading later gains a provider tombstone or
  replacement-map semantic.
 ### Absent defaults are not materialized by an otherwise unchanged form
 - Evidence: `plan_changes` compares an absent file value through its effective
  default before deciding whether to write.
 - Plan difference: §13.2's “explicit beats implicit” sentence can be read as
  requiring an absent default-valued key to be written whenever posted.
 - Reason and recommendation: the same section says the form carries every
  editable field and only changed fields are written. Materializing every
  absent default on any no-JavaScript save would violate that behavior. Keep
  the effective-value comparison; a reset from an explicit non-default value
  still writes the default explicitly. Clarify this sentence in a future plan
  revision if touched-vs-untouched browser state becomes a requirement.
 ## Nits
 None.
 ## Plan Coverage
 | Requirement | Status | Evidence |
 |---|---|---|
 | Derived schema, kinds, sources, help, group order and anchors | Implemented as planned | `schema`, `schema_with_env`, `walk`, `kind_for`, `SETTINGS_HELP` |
 | Secret redaction and environment locks | Implemented as planned | `source_for`, secret field rendering, provider-literal redaction |
 | Typed `toml_edit` save with collected errors | Implemented as planned | `plan_changes`, `apply_change` |
 | Temp-file validation, permission preservation, rename and live swap | Implemented as planned | `write_validated`, `install` |
 | One attributed history row per changed key | Implemented as planned | `record_changes`, `config_changes` |
 | Provider add/remove and referenced-provider refusal | Implemented with the shipped-provider qualification above | `add_provider`, `remove_provider` |
 | Reload on mtime with previous config retained after an error | Implemented as planned | `WebState::reload_if_changed`, settings GET banner |
 | Settings history page, newest first, 100 per page | Implemented as planned | `history`, `config_changes`, `settings_history.html` |
 | `/etc/daily-epub` writable in the server unit | Implemented as planned | `systemd/daily-epub.service` |
 ## Testing Assessment
 Existing tests are meaningful: they compare the schema with serialized
 `Config::default()`, compare shipped TOML leaves with the help table, exercise
 all enum options through deserialization and `validate()`, prove secrets carry
 no value, mutate and restore a real environment variable, compare untouched
 configuration lines byte-for-byte, verify multiline arrays and new tables,
 exercise validation failure and permission preservation, inspect persisted
 history rows, add/remove/refuse providers, and drive the settings routes through
 `Router::oneshot`. The provider test also proves a file-sourced API key does not
 reach the audit table.
 No weak or missing test from the step 5 list remains. The only environmental
 suite limitation is the repository's pre-existing listener tests, which cannot
 bind loopback in the sandbox.
 ## Open Questions
 - Should the plan eventually define a tombstone for removing shipped providers,
  or should the current “leave built-ins unreferenced” behavior become the
  documented contract?
 - The shared brief lists four Anthropic listener tests as sandbox-bound, while
  the step 1 handoff also identifies three OpenAI tests using the same loopback
  fake server. The latter fail with the identical sandbox permission error.
@@ -0,0 +1,137 @@
 # Runbook — web dashboard rollout
 **Written:** 2026-09-03 for the production host. Run these commands from the checked-out
 `web-dashboard` tree as an operator with `sudo`. The existing curation-v2 migration should
 already be complete.
 ## 1. Build and install
 ```sh
 cargo test
 cargo build --release
 sudo install -m0755 target/release/daily-epub /usr/local/bin/daily-epub
 daily-epub --help
 ```
 Confirm the help includes both `users` and `job`. Keep the previous binary available until the
 smoke tests below pass.
 ## 2. Install the job unit and polkit rule
 ```sh
 sudo install -m0644 systemd/daily-epub-job@.service /etc/systemd/system/
 sudo install -m0644 systemd/50-daily-epub.rules /etc/polkit-1/rules.d/
 sudo install -m0644 systemd/daily-epub.service /etc/systemd/system/
 sudo systemctl daemon-reload
 ```
 The server unit must contain both:
 ```ini
 SupplementaryGroups=systemd-journal
 ReadWritePaths=/home/thallada/bookorbit/books/daily-epub /var/lib/daily-epub/xtc /etc/daily-epub
 ```
 Keep the two publish paths aligned with `[publish]`. The polkit rule permits user `daily-epub`
 to start only `daily-epub-job@[a-z0-9-]+.service`; it does not grant stop, restart, or arbitrary
 unit management.
 ## 3. Verify writable paths and ownership
 Settings saves create a temporary file and rename it into `/etc/daily-epub`, so the directory
 and config file must both belong to the service account:
 ```sh
 sudo chown daily-epub:daily-epub /etc/daily-epub /etc/daily-epub/config.toml
 sudo chmod 0750 /etc/daily-epub
 sudo chmod 0640 /etc/daily-epub/config.toml
 sudo install -d -m0750 -o daily-epub -g daily-epub /var/lib/daily-epub/data
 sudo test -f /var/lib/daily-epub/data/profile.md
 sudo -u daily-epub test -w /var/lib/daily-epub/data/profile.md
 ```
 Set `profile_path = "/var/lib/daily-epub/data/profile.md"`; `StateDirectory=daily-epub` makes
 that location writable. Also re-check the configured publish directories as `daily-epub`.
 ## 4. Review the new server settings
 All keys have defaults, so additions are optional unless production needs overrides:
 ```toml
 [server]
 bind = "127.0.0.1:3499"
 public_url = "https://daily.hallada.net"
 session_days = 30
 login_attempts = 10
 login_window_minutes = 15
 jobs_enabled = true
 journal_lines = 300
 ```
 Keep the bind address on loopback: the login throttle trusts `X-Forwarded-For`, so only the
 reverse proxy should be able to reach the listener. Keep secrets in `/etc/daily-epub/env`, not
 TOML. If `server.basic_auth_user` and `server.basic_auth_pass` are omitted, the existing
 `/opds/*` and `/files/*` routes remain public; this is intentional so OPDS acquisition links
 continue to work. When Basic auth is configured, signed-in users can still download files with
 their session.
 ## 5. Restart, migrate, and verify public pages
 ```sh
 sudo systemctl restart daily-epub.service
 sudo systemctl --no-pager --full status daily-epub.service
 curl -fsS https://daily.hallada.net/ | grep -F 'The Daily EPUB'
 curl -fsS https://daily.hallada.net/feed.xml >/tmp/daily-epub-feed.xml
 python3 -c 'import xml.etree.ElementTree as E; E.parse("/tmp/daily-epub-feed.xml")'
 ```
 Migration `0004_web.sql` applies automatically at start. Anonymous issue pages and the Atom
 feed must show the source-link index without summaries, article bodies, comments, the Brief, or
 World Briefing text.
 ## 6. Bootstrap the administrator
 ```sh
 sudo -u daily-epub /usr/local/bin/daily-epub \
  --config /etc/daily-epub/config.toml users add tyler --admin
 sudo -u daily-epub /usr/local/bin/daily-epub \
  --config /etc/daily-epub/config.toml users list
 ```
 The first command prompts twice without echo. Log in at `https://daily.hallada.net/login`, open
 `/dashboard`, and confirm `/dashboard/users` shows the admin and an open session. A non-admin
 account should receive the site's 403 page for every dashboard route.
 ## 7. Smoke test a job
 Start `features-prune` from `/dashboard/jobs`, open its job detail, and watch the status and log
 tail. On the host, confirm the same unit:
 ```sh
 systemctl status daily-epub-job@features-prune.service
 journalctl -u daily-epub-job@features-prune.service -n 100 --no-pager
 ```
 If the page reports a permission failure, inspect `journalctl -u polkit` and verify the installed
 rule and exact unit name. Do not broaden the rule to arbitrary units.
 ## 8. Smoke test an in-place settings write
 In `/dashboard/settings`, change `curation.ranking.utility_protected` by one and save. Confirm
 the next view shows the new value, comments and ordering remain in the file, and the attributed
 change appears at `/dashboard/settings/history`:
 ```sh
 sudo -u daily-epub grep -n 'utility_protected' /etc/daily-epub/config.toml
 ```
 Change the value back through the page and confirm the second history row. Environment-overridden
 fields should be locked, and no API key, HMAC secret, or Basic-auth password should be displayed.
 ## 9. Choose the history window
 Candidate and assessment history is pruned after
 `curation.ranking.telemetry_retention_days` (180 by default). Raise it now if the dashboard
 should retain a longer article/run history, then reload `/dashboard/settings` and verify the
 effective value. This changes future pruning only; it cannot restore rows already deleted.
@@ -0,0 +1,58 @@
 CREATE TABLE users (
    id            INTEGER PRIMARY KEY AUTOINCREMENT,
    username      TEXT NOT NULL UNIQUE COLLATE NOCASE,
    password_hash TEXT NOT NULL,
    role          TEXT NOT NULL CHECK (role IN ('user', 'admin')),
    disabled      INTEGER NOT NULL DEFAULT 0,
    created_at    TEXT NOT NULL,
    last_login_at TEXT
 );
 CREATE TABLE sessions (
    id         TEXT PRIMARY KEY,
    data       TEXT NOT NULL,
    expiry     INTEGER NOT NULL,
    user_id    INTEGER REFERENCES users(id) ON DELETE CASCADE,
    created_at TEXT NOT NULL,
    updated_at TEXT NOT NULL
 );
 CREATE INDEX idx_sessions_user ON sessions(user_id);
 CREATE INDEX idx_sessions_expiry ON sessions(expiry);
 ALTER TABLE rating_events ADD COLUMN user_id INTEGER REFERENCES users(id) ON DELETE SET NULL;
 CREATE TABLE config_changes (
    id         INTEGER PRIMARY KEY AUTOINCREMENT,
    user_id    INTEGER REFERENCES users(id) ON DELETE SET NULL,
    key        TEXT NOT NULL,
    old_value  TEXT,
    new_value  TEXT,
    changed_at TEXT NOT NULL
 );
 CREATE INDEX idx_config_changes_at ON config_changes(changed_at);
 CREATE TABLE profile_versions (
    id       INTEGER PRIMARY KEY AUTOINCREMENT,
    content  TEXT NOT NULL,
    saved_by INTEGER REFERENCES users(id) ON DELETE SET NULL,
    saved_at TEXT NOT NULL
 );
 CREATE TABLE jobs (
    id           INTEGER PRIMARY KEY AUTOINCREMENT,
    name         TEXT NOT NULL,
    unit         TEXT NOT NULL,
    requested_by INTEGER REFERENCES users(id) ON DELETE SET NULL,
    requested_at TEXT NOT NULL,
    started_at   TEXT,
    finished_at  TEXT,
    status       TEXT NOT NULL CHECK (status IN ('requested', 'running', 'ok', 'failed')),
    message      TEXT,
    run_id       INTEGER REFERENCES runs(id) ON DELETE SET NULL
 );
 CREATE INDEX idx_jobs_requested_at ON jobs(requested_at);
 ALTER TABLE runs ADD COLUMN report_json TEXT;
 ALTER TABLE issues ADD COLUMN issue_json TEXT;
 CREATE INDEX idx_candidate_runs_article_run ON candidate_runs(article_id, run_id DESC);
@@ -700,6 +700,15 @@ pub struct ServerConfig {
    /// Optional Basic auth for `/opds/*` and `/files/*`.
    pub basic_auth_user: Option<String>,
    pub basic_auth_pass: Option<String>,
    /// Sliding web-session lifetime in days.
    pub session_days: u32,
    /// Login attempts allowed per IP during the configured window.
    pub login_attempts: u32,
    pub login_window_minutes: u32,
    /// Whether the operator dashboard may start systemd jobs.
    pub jobs_enabled: bool,
    /// Number of journal lines displayed for a job.
    pub journal_lines: u32,
 }
 impl Default for ServerConfig {
@@ -710,6 +719,11 @@ impl Default for ServerConfig {
            hmac_secret: None,
            basic_auth_user: None,
            basic_auth_pass: None,
            session_days: 30,
            login_attempts: 10,
            login_window_minutes: 15,
            jobs_enabled: true,
            journal_lines: 300,
        }
    }
 }
@@ -931,6 +945,26 @@ impl Config {
    /// Cheap sanity checks so misconfiguration fails at startup, not mid-run.
    pub fn validate(&self) -> Result<(), ConfigError> {
        if self.server.session_days == 0 {
            return Err(ConfigError::Invalid(
                "server.session_days must be >= 1".into(),
            ));
        }
        if self.server.login_attempts == 0 {
            return Err(ConfigError::Invalid(
                "server.login_attempts must be >= 1".into(),
            ));
        }
        if self.server.login_window_minutes == 0 {
            return Err(ConfigError::Invalid(
                "server.login_window_minutes must be >= 1".into(),
            ));
        }
        if !(10..=5000).contains(&self.server.journal_lines) {
            return Err(ConfigError::Invalid(
                "server.journal_lines must be between 10 and 5000".into(),
            ));
        }
        if self.lookback_hours == 0 {
            return Err(ConfigError::Invalid("lookback_hours must be > 0".into()));
        }
@@ -21,7 +21,7 @@ pub const REBUILD_INTERVAL_DAYS: i64 = 7;
 /// so their `current_ratings` lookback is effectively unbounded.
 const RATINGS_LOOKBACK_DAYS: i64 = 36_500;
 pub const KV_LEARNED_ADJUSTMENTS: &str = "taste_profile_learned";
-const MAX_RATINGS_IN_REBUILD: usize = 200;
+pub const MAX_RATINGS_IN_REBUILD: usize = 200;
 pub const NO_LEARNED_ADJUSTMENTS: &str = "No reader ratings have been collected yet. Judge purely on the stated preferences and interests above.";
@@ -239,7 +239,9 @@ struct ProfileVersion {
    built_at: String,
 }
-async fn stored_version(db: &Db) -> anyhow::Result<Option<(i64, Timestamp)>> {
+/// The stored `(version, built_at)` of the taste profile, `None` before the
 /// first build. The dashboard's profile page reads it (web plan §11).
 pub async fn stored_version(db: &Db) -> anyhow::Result<Option<(i64, Timestamp)>> {
    let Some(raw) = db.kv_get(KV_PROFILE_VERSION).await? else {
        return Ok(None);
    };
@@ -509,6 +511,7 @@ mod tests {
    fn prompt_sections_are_ordered_and_verdicts_have_required_labels() {
        let rating = RatedArticle {
            article_id: 1,
            user_id: None,
            issue_date: None,
            title: "A title".into(),
            feed_title: "A feed".into(),
@@ -551,6 +554,7 @@ mod tests {
    fn rebuild_prompt_carries_summary_facets_note_and_diversity_instruction() {
        let rating = RatedArticle {
            article_id: 1,
            user_id: None,
            issue_date: Some("2026-08-15".parse().unwrap()),
            title: "Postgres failover".into(),
            feed_title: "Engineering Notes".into(),
@@ -647,6 +651,7 @@ mod tests {
        .unwrap();
        db.append_rating_event(&RatingEvent {
            id: 0,
            user_id: None,
            article_id: 1,
            issue_date: None,
            kind: "explicit".into(),
@@ -624,16 +624,179 @@ fn first_retriever(admitted_by: Option<&str>) -> String {
        .unwrap_or_else(|| "unknown".to_string())
 }
-#[derive(Debug, Default, Clone, Copy)]
+/// Rated picks by admitting retriever: how many were rated, up, down.
-struct UpDown {
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
-    rated: i64,
+pub struct UpDown {
-    up: i64,
+    pub rated: i64,
-    down: i64,
+    pub up: i64,
    pub down: i64,
 }
 impl UpDown {
    /// `"NN% up"`, or `n/a` with nothing rated.
    pub fn ratio(&self) -> String {
        if self.rated > 0 {
            format!("{:.0}% up", 100.0 * self.up as f64 / self.rated as f64)
        } else {
            "n/a".to_string()
        }
    }
 }
 /// One finished, non-dry run as a point of the per-run series (dashboard
 /// plan §9.1, §12).
 #[derive(Debug, Clone, PartialEq)]
 pub struct RunPoint {
    pub run_id: i64,
    pub date: String,
    pub started_at: String,
    pub status: String,
    pub cost_usd: f64,
    pub selected: i64,
    pub duration_secs: Option<i64>,
 }
 /// Everything `daily-epub stats` prints, as data (dashboard plan §12): the
 /// CLI renders it with [`render_stats_text`], the stats page as tables and
 /// sparklines.
 #[derive(Debug, Clone, Default, PartialEq)]
 pub struct StatsData {
    pub days: i64,
    /// First UTC date of the window.
    pub since_date: String,
    /// UTC date of `now`.
    pub today: String,
    pub issues: i64,
    pub published: i64,
    /// Explicit ratings per label, label order; `cleared` included.
    pub ratings_by_label: Vec<(String, i64)>,
    /// Explicit ratings excluding `cleared`.
    pub total_ratings: i64,
    pub per_retriever: BTreeMap<String, UpDown>,
    pub exploration_admitted: i64,
    pub exploration_selected: i64,
    pub exploration_positive: i64,
    /// Provider → spend over the whole window.
    pub provider_totals: BTreeMap<String, f64>,
    /// UTC date → provider → spend.
    pub cost_by_day: BTreeMap<String, BTreeMap<String, f64>>,
    /// Seconds of every finished run in the window (dry runs included), for
    /// the mean generation time.
    pub durations: Vec<i64>,
    /// Finished non-dry runs in the window, oldest first.
    pub runs: Vec<RunPoint>,
    /// Issue date → picks, oldest first.
    pub selected_per_issue: Vec<(String, i64)>,
    /// Week (Monday, UTC) → label → explicit ratings.
    pub ratings_per_week: BTreeMap<String, BTreeMap<String, i64>>,
 }
 impl StatsData {
    /// `n` per issue with one decimal, or `n/a` without issues.
    pub fn per_issue(&self, n: i64) -> String {
        if self.issues > 0 {
            format!("{:.1}", n as f64 / self.issues as f64)
        } else {
            "n/a".to_string()
        }
    }
    pub fn mean_issue_size(&self) -> String {
        self.per_issue(self.published)
    }
    pub fn ratings_per_issue(&self) -> String {
        self.per_issue(self.total_ratings)
    }
    /// Spend per day over the window for one provider total.
    pub fn per_day(&self, total: f64) -> f64 {
        total / self.days as f64
    }
    /// Every provider's window spend added up, in provider order.
    pub fn grand_total(&self) -> f64 {
        let mut grand = 0.0;
        for total in self.provider_totals.values() {
            grand += total;
        }
        grand
    }
    /// Integer mean of the finished runs' seconds.
    pub fn mean_generation_secs(&self) -> Option<i64> {
        if self.durations.is_empty() {
            None
        } else {
            Some(self.durations.iter().sum::<i64>() / self.durations.len() as i64)
        }
    }
 }
 /// `daily-epub stats [--days N]` as text: the whole evaluation framework
 /// (§15.3). One fact per line, nothing wider than 80 columns.
 pub async fn stats(db: &Db, days: i64, now: Timestamp) -> anyhow::Result<String> {
    Ok(render_stats_text(&stats_data(db, days, now).await?))
 }
 /// Finished non-dry runs as sparkline points, oldest first: those started
 /// at or after `since` (RFC3339) and/or the newest `limit`.
 pub async fn run_series(
    db: &Db,
    since: Option<&str>,
    limit: Option<i64>,
 ) -> Result<Vec<RunPoint>, sqlx::Error> {
    let rows = sqlx::query(
        "SELECT id, date, started_at, finished_at, status, cost_usd, selected FROM runs
         WHERE status != 'dry_run' AND finished_at IS NOT NULL
           AND (? IS NULL OR started_at >= ?)
         ORDER BY id DESC LIMIT ?",
    )
    .bind(since)
    .bind(since)
    .bind(limit.unwrap_or(i64::MAX))
    .fetch_all(db.pool())
    .await?;
    let mut points: Vec<RunPoint> = rows
        .iter()
        .map(|row| {
            let started_at: String = row.get("started_at");
            let finished_at: Option<String> = row.get("finished_at");
            let duration_secs = match (
                started_at.parse::<Timestamp>(),
                finished_at.as_deref().map(str::parse::<Timestamp>),
            ) {
                (Ok(started), Some(Ok(finished))) => {
                    Some((finished.as_second() - started.as_second()).max(0))
                }
                _ => None,
            };
            RunPoint {
                run_id: row.get("id"),
                date: row.get("date"),
                started_at,
                status: row.get("status"),
                cost_usd: row.get("cost_usd"),
                selected: row.get("selected"),
                duration_secs,
            }
        })
        .collect();
    points.reverse();
    Ok(points)
 }
 /// The Monday (UTC) of the week containing `ts`, as `YYYY-MM-DD`.
 pub fn week_start(ts: Timestamp) -> String {
    let date = ts.to_zoned(jiff::tz::TimeZone::UTC).date();
    let offset = i64::from(date.weekday().to_monday_zero_offset());
    date.checked_sub(jiff::Span::new().days(offset))
        .unwrap_or(date)
        .to_string()
 }
 /// Gather every figure of [`StatsData`] for the last `days` days.
 pub async fn stats_data(db: &Db, days: i64, now: Timestamp) -> anyhow::Result<StatsData> {
    let days = days.max(1);
    let since_ts = now
        .checked_sub(jiff::Span::new().hours(days.saturating_mul(24)))
@@ -641,30 +804,35 @@ pub async fn stats(db: &Db, days: i64, now: Timestamp) -> anyhow::Result<String>
    let since = fmt_ts(since_ts);
    let utc = jiff::tz::TimeZone::UTC;
    let since_date = since_ts.to_zoned(utc.clone()).date().to_string();
-    let today = now.to_zoned(utc).date().to_string();
+    let today = now.to_zoned(utc.clone()).date().to_string();
-    let mut out = String::new();
+    let mut data = StatsData {
-    let _ = writeln!(out, "stats: last {days} days ({since_date} → {today})");
+        days,
        since_date: since_date.clone(),
        today,
        ..StatsData::default()
    };
    // --- issues and articles ---
-    let issues: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM issues WHERE date >= ?")
+    data.issues = sqlx::query_scalar("SELECT COUNT(*) FROM issues WHERE date >= ?")
        .bind(&since_date)
        .fetch_one(db.pool())
        .await?;
-    let published: i64 =
+    data.published =
        sqlx::query_scalar("SELECT COUNT(*) FROM issue_articles WHERE issue_date >= ?")
            .bind(&since_date)
            .fetch_one(db.pool())
            .await?;
-    let _ = writeln!(out, "issues: {issues}");
+    let per_issue_rows = sqlx::query(
-    let _ = writeln!(out, "articles published: {published}");
+        "SELECT issue_date, COUNT(*) AS n FROM issue_articles
-    let per_issue = |n: i64| {
+         WHERE issue_date >= ? GROUP BY issue_date ORDER BY issue_date",
-        if issues > 0 {
+    )
-            format!("{:.1}", n as f64 / issues as f64)
+    .bind(&since_date)
-        } else {
+    .fetch_all(db.pool())
-            "n/a".to_string()
+    .await?;
-        }
+    data.selected_per_issue = per_issue_rows
-    };
+        .iter()
-    let _ = writeln!(out, "mean issue size: {} articles", per_issue(published));
+        .map(|row| (row.get::<String, _>("issue_date"), row.get::<i64, _>("n")))
        .collect();
    // --- explicit ratings by label ---
    let labels = sqlx::query(
@@ -674,21 +842,32 @@ pub async fn stats(db: &Db, days: i64, now: Timestamp) -> anyhow::Result<String>
    .bind(&since)
    .fetch_all(db.pool())
    .await?;
    let mut total_ratings = 0i64;
    let mut by_label = Vec::new();
    for row in &labels {
        let label = row.get::<String, _>("label");
        let n = row.get::<i64, _>("n");
        if label != "cleared" {
-            total_ratings += n;
+            data.total_ratings += n;
        }
-        by_label.push((label, n));
+        data.ratings_by_label.push((label, n));
    }
-    let _ = writeln!(out, "explicit ratings: {total_ratings}");
+    let events = sqlx::query(
-    for (label, n) in &by_label {
+        "SELECT label, event_at FROM rating_events
-        let _ = writeln!(out, "explicit ratings ({label}): {n}");
+         WHERE kind = 'explicit' AND event_at >= ? ORDER BY event_at",
    )
    .bind(&since)
    .fetch_all(db.pool())
    .await?;
    for row in &events {
        let Ok(event_at) = row.get::<String, _>("event_at").parse::<Timestamp>() else {
            continue;
        };
        *data
            .ratings_per_week
            .entry(week_start(event_at))
            .or_default()
            .entry(row.get::<String, _>("label"))
            .or_insert(0) += 1;
    }
    let _ = writeln!(out, "ratings per issue: {}", per_issue(total_ratings));
    // --- up/down per admitting retriever, from rated picks ---
    let rated_picks = sqlx::query(
@@ -712,8 +891,6 @@ pub async fn stats(db: &Db, days: i64, now: Timestamp) -> anyhow::Result<String>
    .bind(&since)
    .fetch_all(db.pool())
    .await?;
    let mut per_retriever: BTreeMap<String, UpDown> = BTreeMap::new();
    let mut exploration_positive = 0i64;
    let mut seen: Option<ArticleId> = None;
    for row in &rated_picks {
        let article_id = row.get::<ArticleId, _>("article_id");
@@ -723,7 +900,7 @@ pub async fn stats(db: &Db, days: i64, now: Timestamp) -> anyhow::Result<String>
        seen = Some(article_id);
        let value = row.get::<f64, _>("value");
        let retriever = first_retriever(row.get::<Option<String>, _>("admitted_by").as_deref());
-        let entry = per_retriever.entry(retriever).or_default();
+        let entry = data.per_retriever.entry(retriever).or_default();
        entry.rated += 1;
        if value > 0.0 {
            entry.up += 1;
@@ -735,24 +912,9 @@ pub async fn stats(db: &Db, days: i64, now: Timestamp) -> anyhow::Result<String>
                .map(|signals| signals.exploration)
                .unwrap_or(false);
        if exploration && value > 0.0 {
-            exploration_positive += 1;
+            data.exploration_positive += 1;
        }
    }
    if per_retriever.is_empty() {
        let _ = writeln!(out, "rated picks by admitting retriever: none");
    }
    for (retriever, counts) in &per_retriever {
        let ratio = if counts.rated > 0 {
            format!("{:.0}% up", 100.0 * counts.up as f64 / counts.rated as f64)
        } else {
            "n/a".to_string()
        };
        let _ = writeln!(
            out,
            "admitted by {retriever}: {} rated · {} up · {} down · {ratio}",
            counts.rated, counts.up, counts.down
        );
    }
    // --- exploration yield ---
    let exploration_rows = sqlx::query(
@@ -764,31 +926,25 @@ pub async fn stats(db: &Db, days: i64, now: Timestamp) -> anyhow::Result<String>
    .bind(&since)
    .fetch_all(db.pool())
    .await?;
    let mut exploration_admitted = 0i64;
    let mut exploration_selected = 0i64;
    for row in &exploration_rows {
        match row.get::<String, _>("stage").as_str() {
            "selected" => {
-                exploration_admitted += 1;
+                data.exploration_admitted += 1;
-                exploration_selected += 1;
+                data.exploration_selected += 1;
            }
-            "admitted" | "assessed" | "shortlisted" => exploration_admitted += 1,
+            "admitted" | "assessed" | "shortlisted" => data.exploration_admitted += 1,
            _ => {}
        }
    }
    let _ = writeln!(out, "exploration admitted: {exploration_admitted}");
    let _ = writeln!(out, "exploration selected: {exploration_selected}");
    let _ = writeln!(out, "exploration rated positively: {exploration_positive}");
    // --- cost per day per provider (§7.6) ---
    let cost_rows = sqlx::query(
-        "SELECT provider_costs_json FROM runs
+        "SELECT started_at, provider_costs_json FROM runs
         WHERE started_at >= ? AND provider_costs_json IS NOT NULL",
    )
    .bind(&since)
    .fetch_all(db.pool())
    .await?;
    let mut totals: BTreeMap<String, f64> = BTreeMap::new();
    for row in &cost_rows {
        let raw = row.get::<String, _>("provider_costs_json");
        let Ok(providers) =
@@ -796,20 +952,21 @@ pub async fn stats(db: &Db, days: i64, now: Timestamp) -> anyhow::Result<String>
        else {
            continue;
        };
        let day = row
            .get::<String, _>("started_at")
            .parse::<Timestamp>()
            .map(|ts| ts.to_zoned(utc.clone()).date().to_string())
            .unwrap_or_else(|_| since_date.clone());
        for (provider, usage) in providers {
-            *totals.entry(provider).or_insert(0.0) += usage.cost_usd;
+            *data.provider_totals.entry(provider.clone()).or_insert(0.0) += usage.cost_usd;
            *data
                .cost_by_day
                .entry(day.clone())
                .or_default()
                .entry(provider)
                .or_insert(0.0) += usage.cost_usd;
        }
    }
    let mut grand = 0.0;
    for (provider, total) in &totals {
        grand += total;
        let _ = writeln!(
            out,
            "cost per day ({provider}): ${:.3}",
            total / days as f64
        );
    }
    let _ = writeln!(out, "cost per day (total): ${:.3}", grand / days as f64);
    // --- mean generation time ---
    let run_rows = sqlx::query(
@@ -819,26 +976,81 @@ pub async fn stats(db: &Db, days: i64, now: Timestamp) -> anyhow::Result<String>
    .bind(&since)
    .fetch_all(db.pool())
    .await?;
    let mut durations = Vec::new();
    for row in &run_rows {
        let started = row.get::<String, _>("started_at").parse::<Timestamp>();
        let finished = row.get::<String, _>("finished_at").parse::<Timestamp>();
        if let (Ok(started), Ok(finished)) = (started, finished) {
-            durations.push((finished.as_second() - started.as_second()).max(0));
+            data.durations
                .push((finished.as_second() - started.as_second()).max(0));
        }
    }
-    if durations.is_empty() {
+
-        let _ = writeln!(out, "mean generation time: n/a (0 runs)");
+    data.runs = run_series(db, Some(&since), None).await?;
-    } else {
+    Ok(data)
-        let mean = durations.iter().sum::<i64>() / durations.len() as i64;
+}
 /// The CLI text of [`StatsData`], one fact per line.
 pub fn render_stats_text(data: &StatsData) -> String {
    let mut out = String::new();
    let _ = writeln!(
        out,
        "stats: last {} days ({} → {})",
        data.days, data.since_date, data.today
    );
    let _ = writeln!(out, "issues: {}", data.issues);
    let _ = writeln!(out, "articles published: {}", data.published);
    let _ = writeln!(out, "mean issue size: {} articles", data.mean_issue_size());
    let _ = writeln!(out, "explicit ratings: {}", data.total_ratings);
    for (label, n) in &data.ratings_by_label {
        let _ = writeln!(out, "explicit ratings ({label}): {n}");
    }
    let _ = writeln!(out, "ratings per issue: {}", data.ratings_per_issue());
    if data.per_retriever.is_empty() {
        let _ = writeln!(out, "rated picks by admitting retriever: none");
    }
    for (retriever, counts) in &data.per_retriever {
        let _ = writeln!(
            out,
-            "mean generation time: {} ({} runs)",
+            "admitted by {retriever}: {} rated · {} up · {} down · {}",
-            RunReport::format_duration(mean),
+            counts.rated,
-            durations.len()
+            counts.up,
            counts.down,
            counts.ratio()
        );
    }
-    Ok(out)
+    let _ = writeln!(out, "exploration admitted: {}", data.exploration_admitted);
    let _ = writeln!(out, "exploration selected: {}", data.exploration_selected);
    let _ = writeln!(
        out,
        "exploration rated positively: {}",
        data.exploration_positive
    );
    for (provider, total) in &data.provider_totals {
        let _ = writeln!(
            out,
            "cost per day ({provider}): ${:.3}",
            data.per_day(*total)
        );
    }
    let _ = writeln!(
        out,
        "cost per day (total): ${:.3}",
        data.per_day(data.grand_total())
    );
    match data.mean_generation_secs() {
        None => {
            let _ = writeln!(out, "mean generation time: n/a (0 runs)");
        }
        Some(mean) => {
            let _ = writeln!(
                out,
                "mean generation time: {} ({} runs)",
                RunReport::format_duration(mean),
                data.durations.len()
            );
        }
    }
    out
 }
 // ---------------------------------------------------------------------------
@@ -1523,6 +1735,41 @@ mod tests {
            text.lines().all(|line| line.chars().count() <= 80),
            "no line wider than 80 columns"
        );
        // Dashboard plan §12: the CLI output is byte-identical before and
        // after the `stats_data` / `render_stats_text` split.
        assert_eq!(text, STATS_TEXT_BEFORE_REFACTOR);
        let data = stats_data(&db, 14, now).await.unwrap();
        assert_eq!(render_stats_text(&data), text);
        // The figures the stats page adds on top of the text.
        assert_eq!(data.issues, 2);
        assert_eq!(data.total_ratings, 4);
        assert_eq!(
            data.selected_per_issue,
            vec![("2026-08-30".to_string(), 2), ("2026-09-01".to_string(), 1)]
        );
        assert_eq!(
            data.cost_by_day["2026-08-30"]["deepseek"],
            0.10 + 0.04,
            "both 08-30 runs land on the same day"
        );
        assert_eq!(data.cost_by_day["2026-09-01"]["gemini"], 0.07);
        assert_eq!(data.ratings_per_week["2026-08-31"]["loved"], 2);
        assert_eq!(data.ratings_per_week["2026-08-31"]["not_for_me"], 1);
        assert_eq!(data.ratings_per_week["2026-08-17"]["cleared"], 1);
        assert_eq!(data.runs.len(), 3, "three finished non-dry runs");
        assert_eq!(data.runs[0].run_id, run_ids[0], "oldest first");
        assert_eq!(data.runs[0].duration_secs, Some(1200));
        assert_eq!(data.runs[2].date, "2026-09-01");
        assert_eq!(data.per_retriever["knn"].ratio(), "100% up");
        assert_eq!(data.mean_generation_secs(), Some(900));
        // The newest-N form the overview uses.
        let last_two = run_series(&db, None, Some(2)).await.unwrap();
        assert_eq!(
            last_two.iter().map(|p| p.run_id).collect::<Vec<_>>(),
            vec![run_ids[1], run_ids[2]]
        );
        // An empty database still prints every heading.
        let (_dir, empty) = db_with_articles(&[]).await;
@@ -1537,6 +1784,69 @@ mod tests {
        ] {
            assert!(text.contains(line), "missing {line:?} in:\n{text}");
        }
        assert_eq!(text, STATS_TEXT_EMPTY_BEFORE_REFACTOR);
    }
    /// `stats(db, 14, 2026-09-02T12:00:00Z)` over the seed above, captured
    /// from the pre-refactor implementation.
    const STATS_TEXT_BEFORE_REFACTOR: &str = "\
 stats: last 14 days (2026-08-19 → 2026-09-02)
 issues: 2
 articles published: 3
 mean issue size: 1.5 articles
 explicit ratings: 4
 explicit ratings (cleared): 1
 explicit ratings (good): 1
 explicit ratings (loved): 2
 explicit ratings (not_for_me): 1
 ratings per issue: 2.0
 admitted by blend: 1 rated · 0 up · 1 down · 0% up
 admitted by exploration: 1 rated · 1 up · 0 down · 100% up
 admitted by knn: 1 rated · 1 up · 0 down · 100% up
 exploration admitted: 2
 exploration selected: 1
 exploration rated positively: 1
 cost per day (anthropic): $0.043
 cost per day (deepseek): $0.020
 cost per day (gemini): $0.005
 cost per day (voyage): $0.001
 cost per day (total): $0.069
 mean generation time: 15m00s (3 runs)
 ";
    const STATS_TEXT_EMPTY_BEFORE_REFACTOR: &str = "\
 stats: last 7 days (2026-08-26 → 2026-09-02)
 issues: 0
 articles published: 0
 mean issue size: n/a articles
 explicit ratings: 0
 ratings per issue: n/a
 rated picks by admitting retriever: none
 exploration admitted: 0
 exploration selected: 0
 exploration rated positively: 0
 cost per day (total): $0.000
 mean generation time: n/a (0 runs)
 ";
    #[test]
    fn week_start_is_the_utc_monday() {
        assert_eq!(
            week_start("2026-09-02T12:00:00Z".parse().unwrap()),
            "2026-08-31"
        );
        assert_eq!(
            week_start("2026-08-31T00:00:00Z".parse().unwrap()),
            "2026-08-31"
        );
        assert_eq!(
            week_start("2026-09-06T23:59:59Z".parse().unwrap()),
            "2026-08-31"
        );
        assert_eq!(
            week_start("2026-09-07T00:00:00Z".parse().unwrap()),
            "2026-09-07"
        );
    }
    #[tokio::test]
@@ -60,6 +60,27 @@ pub struct Db {
    pool: SqlitePool,
 }
 #[derive(Debug, Clone)]
 pub struct IssueRow {
    pub date: Date,
    pub issue_number: i64,
    pub generated_at: Timestamp,
    pub epub_path: Option<String>,
    pub x4_path: Option<String>,
    pub xtc_path: Option<String>,
    pub front_page_html: Option<String>,
    pub report_json: Option<String>,
    pub issue_json: Option<String>,
 }
 #[derive(Debug, Clone)]
 pub struct IssueListRow {
    pub date: Date,
    pub issue_number: i64,
    pub generated_at: Timestamp,
    pub article_count: i64,
 }
 impl Db {
    /// Open (creating if needed) the database at `path` with WAL + foreign keys on,
    /// creating parent directories first. Does **not** run migrations.
@@ -442,11 +463,12 @@ impl Db {
        xtc_path: Option<&str>,
        front_page_html: Option<&str>,
        report_json: Option<&str>,
        issue_json: Option<&str>,
    ) -> Result<()> {
        sqlx::query(
            "INSERT INTO issues (date, issue_number, generated_at, epub_path, x4_path, xtc_path,
-                                 front_page_html, report_json)
+                                 front_page_html, report_json, issue_json)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
             ON CONFLICT(date) DO UPDATE SET
                 issue_number = excluded.issue_number,
                 generated_at = excluded.generated_at,
@@ -454,7 +476,8 @@ impl Db {
                 x4_path = COALESCE(excluded.x4_path, issues.x4_path),
                 xtc_path = COALESCE(excluded.xtc_path, issues.xtc_path),
                 front_page_html = COALESCE(excluded.front_page_html, issues.front_page_html),
-                 report_json = COALESCE(excluded.report_json, issues.report_json)",
+                 report_json = COALESCE(excluded.report_json, issues.report_json),
                 issue_json = COALESCE(excluded.issue_json, issues.issue_json)",
        )
        .bind(date.to_string())
        .bind(issue_number)
@@ -464,11 +487,49 @@ impl Db {
        .bind(xtc_path)
        .bind(front_page_html)
        .bind(report_json)
        .bind(issue_json)
        .execute(&self.pool)
        .await?;
        Ok(())
    }
    /// One stored issue, including its serialized full-issue snapshot.
    pub async fn issue_by_date(&self, date: Date) -> Result<Option<IssueRow>> {
        let row = sqlx::query(
            "SELECT date, issue_number, generated_at, epub_path, x4_path, xtc_path,
                    front_page_html, report_json, issue_json
             FROM issues WHERE date = ?",
        )
        .bind(date.to_string())
        .fetch_optional(&self.pool)
        .await?;
        row.as_ref().map(issue_from_row).transpose()
    }
    /// Issue archive rows, newest first. A non-positive limit means all rows.
    pub async fn issue_dates(&self, limit: Option<i64>) -> Result<Vec<IssueListRow>> {
        let rows = sqlx::query(
            "SELECT i.date, i.issue_number, i.generated_at, COUNT(ia.article_id) AS article_count
             FROM issues i LEFT JOIN issue_articles ia ON ia.issue_date = i.date
             GROUP BY i.date, i.issue_number, i.generated_at
             ORDER BY i.date DESC
             LIMIT CASE WHEN ? > 0 THEN ? ELSE -1 END",
        )
        .bind(limit.unwrap_or(-1))
        .bind(limit.unwrap_or(-1))
        .fetch_all(&self.pool)
        .await?;
        rows.iter().map(issue_list_from_row).collect()
    }
    pub async fn latest_issue_date(&self) -> Result<Option<Date>> {
        let raw: Option<String> = sqlx::query_scalar("SELECT MAX(date) FROM issues")
            .fetch_one(&self.pool)
            .await?;
        raw.map(|value| parse_date("issues.date", &value))
            .transpose()
    }
    /// Replace the lineup for a date (regeneration is idempotent, notes §12).
    pub async fn replace_issue_articles(&self, date: Date, picks: &[Pick]) -> Result<()> {
        let mut tx = self.pool.begin().await?;
@@ -541,8 +602,8 @@ impl Db {
    pub async fn append_rating_event(&self, event: &RatingEvent) -> Result<i64> {
        let row = sqlx::query(
            "INSERT INTO rating_events
-                 (article_id, issue_date, kind, source, label, value, note, event_at)
+                 (article_id, issue_date, kind, source, label, value, note, event_at, user_id)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
             RETURNING id",
        )
        .bind(event.article_id)
@@ -553,6 +614,7 @@ impl Db {
        .bind(event.value)
        .bind(event.note.as_deref())
        .bind(fmt_ts(event.event_at))
        .bind(event.user_id)
        .fetch_one(&self.pool)
        .await?;
        Ok(row.get("id"))
@@ -611,7 +673,7 @@ impl Db {
                 FROM rating_events re
                 WHERE re.kind = 'explicit' AND re.event_at >= ?
             )
-             SELECT r.article_id, r.issue_date, r.label, r.value, r.note, r.event_at,
+             SELECT r.article_id, r.user_id, r.issue_date, r.label, r.value, r.note, r.event_at,
                    COALESCE(a.title, '') AS title,
                    COALESCE(e.feed_title, '') AS feed_title,
                    (SELECT ia.summary FROM issue_articles ia
@@ -655,7 +717,8 @@ impl Db {
        sqlx::query(
            "UPDATE runs SET finished_at = ?, entries_fetched = ?, candidates = ?, selected = ?,
                             input_tokens = ?, cached_tokens = ?, output_tokens = ?, cost_usd = ?,
-                             status = ?, error = ?, provider_costs_json = ?, config_json = ?
+                             status = ?, error = ?, provider_costs_json = ?, config_json = ?,
                             report_json = ?
             WHERE id = ?",
        )
        .bind(report.finished_at.map(fmt_ts))
@@ -680,6 +743,7 @@ impl Db {
                source,
            })?,
        )
        .bind(report.to_json())
        .bind(id)
        .execute(&self.pool)
        .await?;
@@ -828,6 +892,7 @@ fn rated_article_from_row(row: &sqlx::sqlite::SqliteRow) -> Result<RatedArticle>
    });
    Ok(RatedArticle {
        article_id: row.get("article_id"),
        user_id: row.get("user_id"),
        issue_date,
        title: row.get("title"),
        feed_title: row.get("feed_title"),
@@ -840,6 +905,29 @@ fn rated_article_from_row(row: &sqlx::sqlite::SqliteRow) -> Result<RatedArticle>
    })
 }
 fn issue_from_row(row: &sqlx::sqlite::SqliteRow) -> Result<IssueRow> {
    Ok(IssueRow {
        date: parse_date("issues.date", &row.get::<String, _>("date"))?,
        issue_number: row.get("issue_number"),
        generated_at: parse_ts("issues.generated_at", &row.get::<String, _>("generated_at"))?,
        epub_path: row.get("epub_path"),
        x4_path: row.get("x4_path"),
        xtc_path: row.get("xtc_path"),
        front_page_html: row.get("front_page_html"),
        report_json: row.get("report_json"),
        issue_json: row.get("issue_json"),
    })
 }
 fn issue_list_from_row(row: &sqlx::sqlite::SqliteRow) -> Result<IssueListRow> {
    Ok(IssueListRow {
        date: parse_date("issues.date", &row.get::<String, _>("date"))?,
        issue_number: row.get("issue_number"),
        generated_at: parse_ts("issues.generated_at", &row.get::<String, _>("generated_at"))?,
        article_count: row.get("article_count"),
    })
 }
 fn social_from_row(row: &sqlx::sqlite::SqliteRow) -> Result<SocialRef> {
    let raw: String = row.get("source");
    let source = SocialSource::parse(&raw).ok_or(DbError::Decode {
@@ -908,6 +996,30 @@ mod tests {
            .await
            .unwrap();
        assert_eq!(row.get::<i64, _>(0), 1);
        for table in [
            "users",
            "sessions",
            "config_changes",
            "profile_versions",
            "jobs",
        ] {
            let exists: i64 = sqlx::query_scalar(
                "SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = ?",
            )
            .bind(table)
            .fetch_one(db.pool())
            .await
            .unwrap();
            assert_eq!(exists, 1, "missing {table}");
        }
        let columns: Vec<String> = sqlx::query("PRAGMA table_info(rating_events)")
            .fetch_all(db.pool())
            .await
            .unwrap()
            .iter()
            .map(|row| row.get("name"))
            .collect();
        assert!(columns.contains(&"user_id".to_string()));
    }
    #[tokio::test]
@@ -1024,6 +1136,13 @@ mod tests {
        report.counts.selected = 20;
        report.finish(ts("2026-08-15T05:36:00Z"));
        db.finish_run(run_id, &report).await.unwrap();
        let stored_report: Option<String> =
            sqlx::query_scalar("SELECT report_json FROM runs WHERE id = ?")
                .bind(run_id)
                .fetch_one(db.pool())
                .await
                .unwrap();
        assert_eq!(stored_report.as_deref(), Some(report.to_json().as_str()));
        db.upsert_issue(
            date,
@@ -1034,6 +1153,7 @@ mod tests {
            None,
            None,
            Some("{}"),
            None,
        )
        .await
        .unwrap();
@@ -1158,6 +1278,7 @@ mod tests {
                None,
                None,
                None,
                None,
            )
            .await
            .unwrap();
@@ -1185,6 +1306,7 @@ mod tests {
        .unwrap();
        let event = |label: &str, value: f64, at: &str| RatingEvent {
            id: 0,
            user_id: None,
            article_id,
            issue_date: Some("2026-08-15".parse().unwrap()),
            kind: "explicit".into(),
@@ -1268,9 +1390,13 @@ mod tests {
            .execute(&pool)
            .await
            .unwrap();
        sqlx::raw_sql(include_str!("../migrations/0004_web.sql"))
            .execute(&pool)
            .await
            .unwrap();
        let rows = sqlx::query(
-            "SELECT article_id, issue_date, kind, source, label, value, event_at
+            "SELECT article_id, issue_date, kind, source, label, value, event_at, user_id
             FROM rating_events ORDER BY article_id",
        )
        .fetch_all(&pool)
@@ -1285,6 +1411,7 @@ mod tests {
            assert_eq!(row.get::<String, _>("kind"), "explicit");
            assert_eq!(row.get::<String, _>("source"), "migration");
            assert_eq!(row.get::<String, _>("issue_date"), "2026-08-15");
            assert_eq!(row.get::<Option<i64>, _>("user_id"), None);
        }
        assert_eq!(rows[0].get::<String, _>("event_at"), "2026-08-15T12:00:00Z");
@@ -1302,6 +1429,11 @@ mod tests {
            "interest_embeddings",
            "article_assessments",
            "candidate_runs",
            "users",
            "sessions",
            "config_changes",
            "profile_versions",
            "jobs",
        ] {
            assert!(tables.iter().any(|table| table == expected), "{expected}");
        }
@@ -0,0 +1,606 @@
 //! Operator jobs (dashboard plan §14): the fixed catalogue the Jobs page can
 //! start, the `jobs` table lifecycle shared by the page and `daily-epub job
 //! run`, and the systemd-backed [`JobRunner`].
 //!
 //! A job is a `daily-epub-job@<name>.service` instance. The web server never
 //! runs the pipeline in-process: it inserts a `requested` row, asks systemd to
 //! start the unit (polkit allows `start` on exactly that unit pattern), and the
 //! unit's `job run <name>` claims the row, does the work and finishes it.
 use std::time::Duration;
 use async_trait::async_trait;
 use jiff::Timestamp;
 use jiff::civil::Date;
 use sqlx::Row as _;
 use crate::db::{Db, fmt_ts};
 use crate::web::{JobRunner, UnitStatus};
 /// Prefix of every job unit; the polkit rule matches the same pattern.
 pub const UNIT_PREFIX: &str = "daily-epub-job@";
 /// Marker written by the page's 30-second rule (§14.4).
 pub const EXITED_BEFORE_START: &str = "unit exited before the job started; see the log";
 // ---------------------------------------------------------------------------
 // Catalogue (§14.1)
 // ---------------------------------------------------------------------------
 /// The jobs an admin can start from the dashboard (§14.1).
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Job {
    /// `generate` (today) or `generate-YYYY-MM-DD`.
    Generate { date: Option<Date> },
    /// `dry-run` → `generate --dry-run`.
    DryRun,
    /// `profile-rebuild` → `profile rebuild`.
    ProfileRebuild,
    /// `features-backfill` → `features backfill --days 30 --yes`.
    FeaturesBackfill,
    /// `backfill-social` → `backfill-social --days 7`.
    BackfillSocial,
    /// `features-prune` → `features prune`.
    FeaturesPrune,
 }
 impl Job {
    /// The catalogue in the order the Jobs page lists it.
    pub const CATALOGUE: [Job; 6] = [
        Job::Generate { date: None },
        Job::DryRun,
        Job::ProfileRebuild,
        Job::FeaturesBackfill,
        Job::BackfillSocial,
        Job::FeaturesPrune,
    ];
    /// `^[a-z0-9-]+$`: the only characters a job (and so a unit instance) name
    /// may contain.
    pub fn valid_name(name: &str) -> bool {
        !name.is_empty()
            && name
                .bytes()
                .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')
    }
    /// Parse a catalogue name or the dated `generate-YYYY-MM-DD` form; anything
    /// else (including `../x`, uppercase, unknown names) is `None`.
    pub fn parse(name: &str) -> Option<Job> {
        if !Self::valid_name(name) {
            return None;
        }
        match name {
            "generate" => Some(Job::Generate { date: None }),
            "dry-run" => Some(Job::DryRun),
            "profile-rebuild" => Some(Job::ProfileRebuild),
            "features-backfill" => Some(Job::FeaturesBackfill),
            "backfill-social" => Some(Job::BackfillSocial),
            "features-prune" => Some(Job::FeaturesPrune),
            _ => {
                let date = name.strip_prefix("generate-")?;
                // Exactly `YYYY-MM-DD`; the round trip rejects `2026-9-3`.
                let parsed: Date = date.parse().ok()?;
                (parsed.to_string() == date).then_some(Job::Generate { date: Some(parsed) })
            }
        }
    }
    pub fn name(&self) -> String {
        match self {
            Job::Generate { date: None } => "generate".into(),
            Job::Generate { date: Some(date) } => format!("generate-{date}"),
            Job::DryRun => "dry-run".into(),
            Job::ProfileRebuild => "profile-rebuild".into(),
            Job::FeaturesBackfill => "features-backfill".into(),
            Job::BackfillSocial => "backfill-social".into(),
            Job::FeaturesPrune => "features-prune".into(),
        }
    }
    /// `daily-epub-job@<name>.service`.
    pub fn unit(&self) -> String {
        unit_for(&self.name())
    }
    pub fn description(&self) -> &'static str {
        match self {
            Job::Generate { date: None } => {
                "Build and publish today's issue, exactly as the morning timer does."
            }
            Job::Generate { date: Some(_) } => {
                "Build and publish the issue of a given date, republishing it if it exists."
            }
            Job::DryRun => "Run the whole pipeline but publish nothing and record no issue.",
            Job::ProfileRebuild => {
                "Regenerate the learned taste adjustments from ratings with the editor model."
            }
            Job::FeaturesBackfill => {
                "Embed rated and recently published articles (30 days) and interests into the cache."
            }
            Job::BackfillSocial => "Re-poll social scores for the last 7 days of entries.",
            Job::FeaturesPrune => {
                "Drop stale embeddings, old candidate telemetry and old assessments per the retention config."
            }
        }
    }
    /// The run-lock name `main::lock_holder` uses for the same command, when
    /// the job takes the lock at all.
    pub fn takes_lock(&self) -> Option<&'static str> {
        match self {
            Job::Generate { .. } | Job::DryRun => Some("generate"),
            Job::ProfileRebuild => Some("profile rebuild"),
            Job::FeaturesBackfill => Some("features backfill"),
            Job::BackfillSocial => Some("backfill-social"),
            Job::FeaturesPrune => None,
        }
    }
    /// Needs a confirmation dialog: `generate` republishes an issue.
    pub fn dangerous(&self) -> bool {
        matches!(self, Job::Generate { .. })
    }
 }
 /// `daily-epub-job@<name>.service` for a validated job name.
 pub fn unit_for(name: &str) -> String {
    format!("{UNIT_PREFIX}{name}.service")
 }
 // ---------------------------------------------------------------------------
 // `jobs` table lifecycle (§14.2, §14.4)
 // ---------------------------------------------------------------------------
 /// One `jobs` row.
 #[derive(Debug, Clone)]
 pub struct JobRow {
    pub id: i64,
    pub name: String,
    pub unit: String,
    pub requested_by: Option<i64>,
    /// The requester's username, when the user still exists.
    pub requested_by_name: Option<String>,
    pub requested_at: String,
    pub started_at: Option<String>,
    pub finished_at: Option<String>,
    pub status: String,
    pub message: Option<String>,
    pub run_id: Option<i64>,
 }
 impl JobRow {
    pub fn is_active(&self) -> bool {
        matches!(self.status.as_str(), "requested" | "running")
    }
 }
 const ROW_SELECT: &str =
    "SELECT j.id, j.name, j.unit, j.requested_by, u.username AS requested_by_name,
            j.requested_at, j.started_at, j.finished_at, j.status, j.message, j.run_id
     FROM jobs j LEFT JOIN users u ON u.id = j.requested_by";
 fn row_from(row: &sqlx::sqlite::SqliteRow) -> JobRow {
    JobRow {
        id: row.get("id"),
        name: row.get("name"),
        unit: row.get("unit"),
        requested_by: row.get("requested_by"),
        requested_by_name: row.get("requested_by_name"),
        requested_at: row.get("requested_at"),
        started_at: row.get("started_at"),
        finished_at: row.get("finished_at"),
        status: row.get("status"),
        message: row.get("message"),
        run_id: row.get("run_id"),
    }
 }
 /// One job by id.
 pub async fn get(db: &Db, id: i64) -> Result<Option<JobRow>, sqlx::Error> {
    let row = sqlx::query(sqlx::AssertSqlSafe(format!("{ROW_SELECT} WHERE j.id = ?")))
        .bind(id)
        .fetch_optional(db.pool())
        .await?;
    Ok(row.as_ref().map(row_from))
 }
 /// The newest `limit` jobs.
 pub async fn list(db: &Db, limit: i64) -> Result<Vec<JobRow>, sqlx::Error> {
    let rows = sqlx::query(sqlx::AssertSqlSafe(format!(
        "{ROW_SELECT} ORDER BY j.id DESC LIMIT ?"
    )))
    .bind(limit)
    .fetch_all(db.pool())
    .await?;
    Ok(rows.iter().map(row_from).collect())
 }
 /// The id of a `requested`/`running` job for this unit, if any (the page
 /// refuses a duplicate start, §14.4).
 pub async fn active_for_unit(db: &Db, unit: &str) -> Result<Option<i64>, sqlx::Error> {
    sqlx::query_scalar(
        "SELECT id FROM jobs WHERE unit = ? AND status IN ('requested', 'running')
         ORDER BY id DESC LIMIT 1",
    )
    .bind(unit)
    .fetch_optional(db.pool())
    .await
 }
 /// Insert a `requested` row (the dashboard, or `job run` when nobody asked).
 pub async fn insert_requested(
    db: &Db,
    job: &Job,
    requested_by: Option<i64>,
    now: Timestamp,
 ) -> Result<i64, sqlx::Error> {
    let row = sqlx::query(
        "INSERT INTO jobs (name, unit, requested_by, requested_at, status)
         VALUES (?, ?, ?, ?, 'requested') RETURNING id",
    )
    .bind(job.name())
    .bind(job.unit())
    .bind(requested_by)
    .bind(fmt_ts(now))
    .fetch_one(db.pool())
    .await?;
    Ok(row.get::<i64, _>("id"))
 }
 /// `job run`'s first step (§14.2): the newest `requested` row with this name,
 /// or a fresh one with `requested_by NULL`, flipped to `running`.
 pub async fn claim(db: &Db, job: &Job, now: Timestamp) -> Result<i64, sqlx::Error> {
    let existing: Option<i64> = sqlx::query_scalar(
        "SELECT id FROM jobs WHERE name = ? AND status = 'requested' ORDER BY id DESC LIMIT 1",
    )
    .bind(job.name())
    .fetch_optional(db.pool())
    .await?;
    let id = match existing {
        Some(id) => id,
        None => insert_requested(db, job, None, now).await?,
    };
    sqlx::query("UPDATE jobs SET status = 'running', started_at = ? WHERE id = ?")
        .bind(fmt_ts(now))
        .bind(id)
        .execute(db.pool())
        .await?;
    Ok(id)
 }
 /// Terminal state of a job.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Outcome {
    Ok,
    Failed,
 }
 impl Outcome {
    pub fn as_str(self) -> &'static str {
        match self {
            Outcome::Ok => "ok",
            Outcome::Failed => "failed",
        }
    }
 }
 /// Finish a job: status, `finished_at`, the one-line message and, for a
 /// generate job, the run it produced.
 pub async fn finish(
    db: &Db,
    id: i64,
    outcome: Outcome,
    message: &str,
    run_id: Option<i64>,
    now: Timestamp,
 ) -> Result<(), sqlx::Error> {
    let message = message.split_whitespace().collect::<Vec<_>>().join(" ");
    sqlx::query(
        "UPDATE jobs SET status = ?, finished_at = ?, message = ?, run_id = ? WHERE id = ?",
    )
    .bind(outcome.as_str())
    .bind(fmt_ts(now))
    .bind(message)
    .bind(run_id)
    .bind(id)
    .execute(db.pool())
    .await?;
    Ok(())
 }
 // ---------------------------------------------------------------------------
 // SystemdRunner (§14.4)
 // ---------------------------------------------------------------------------
 /// Talks to systemd with `systemctl`/`journalctl` (10 s timeout each, stderr
 /// in the error). Production runner when `server.jobs_enabled` is true.
 #[derive(Debug, Clone)]
 pub struct SystemdRunner {
    timeout: Duration,
 }
 impl Default for SystemdRunner {
    fn default() -> Self {
        Self {
            timeout: Duration::from_secs(10),
        }
    }
 }
 const SHOW_PROPERTIES: &str =
    "ActiveState,SubState,Result,ExecMainStatus,ExecMainStartTimestamp,ExecMainExitTimestamp";
 impl SystemdRunner {
    async fn run(&self, program: &str, args: &[&str]) -> Result<String, String> {
        let command = format!("{program} {}", args.join(" "));
        let output = tokio::time::timeout(
            self.timeout,
            tokio::process::Command::new(program)
                .args(args)
                .kill_on_drop(true)
                .output(),
        )
        .await
        .map_err(|_| format!("{command}: timed out after {:?}", self.timeout))?
        .map_err(|error| format!("{command}: {error}"))?;
        let stdout = String::from_utf8_lossy(&output.stdout).into_owned();
        if output.status.success() {
            Ok(stdout)
        } else {
            let stderr = String::from_utf8_lossy(&output.stderr);
            Err(format!(
                "{command}: exit {}: {}",
                output
                    .status
                    .code()
                    .map(|code| code.to_string())
                    .unwrap_or_else(|| "signal".into()),
                stderr.trim()
            ))
        }
    }
 }
 /// Parse `systemctl show -p …` output (`Key=Value` lines).
 pub fn parse_unit_status(text: &str) -> UnitStatus {
    let mut status = UnitStatus::default();
    for line in text.lines() {
        let Some((key, value)) = line.split_once('=') else {
            continue;
        };
        let value = value.trim();
        match key.trim() {
            "ActiveState" => status.active_state = value.to_string(),
            "SubState" => status.sub_state = value.to_string(),
            "Result" => status.result = value.to_string(),
            "ExecMainStatus" => status.exit_status = value.parse().ok(),
            "ExecMainStartTimestamp" => {
                status.started = (!value.is_empty()).then(|| value.to_string())
            }
            "ExecMainExitTimestamp" => {
                status.exited = (!value.is_empty()).then(|| value.to_string())
            }
            _ => {}
        }
    }
    status
 }
 #[async_trait]
 impl JobRunner for SystemdRunner {
    async fn start(&self, unit: &str) -> Result<(), String> {
        self.run("systemctl", &["start", "--no-block", unit])
            .await
            .map(|_| ())
    }
    async fn status(&self, unit: &str) -> Result<UnitStatus, String> {
        self.run("systemctl", &["show", "-p", SHOW_PROPERTIES, unit])
            .await
            .map(|text| parse_unit_status(&text))
    }
    async fn log(&self, unit: &str, lines: usize) -> Result<String, String> {
        let lines = lines.to_string();
        self.run(
            "journalctl",
            &["-u", unit, "-n", &lines, "--no-pager", "-o", "short-iso"],
        )
        .await
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    const POLKIT_RULES: &str = include_str!("../systemd/50-daily-epub.rules");
    const JOB_UNIT: &str = include_str!("../systemd/daily-epub-job@.service");
    const SERVER_UNIT: &str = include_str!("../systemd/daily-epub.service");
    const POLKIT_UNIT_REGEX: &str = r"/^daily-epub-job@[a-z0-9-]+\.service$/";
    /// The polkit rule's regex, by hand: `^daily-epub-job@[a-z0-9-]+\.service$`.
    fn polkit_regex_matches(unit: &str) -> bool {
        unit.strip_prefix(UNIT_PREFIX)
            .and_then(|rest| rest.strip_suffix(".service"))
            .is_some_and(Job::valid_name)
    }
    #[test]
    fn parse_accepts_the_catalogue_and_the_dated_form() {
        for job in Job::CATALOGUE {
            assert_eq!(Job::parse(&job.name()), Some(job), "{}", job.name());
        }
        assert_eq!(
            Job::parse("generate-2026-09-03"),
            Some(Job::Generate {
                date: Some("2026-09-03".parse().unwrap())
            })
        );
        assert_eq!(
            Job::parse("generate-2026-09-03").unwrap().unit(),
            "daily-epub-job@generate-2026-09-03.service"
        );
        assert_eq!(
            Job::parse("generate").unwrap().takes_lock(),
            Some("generate")
        );
        assert_eq!(Job::parse("features-prune").unwrap().takes_lock(), None);
        assert!(Job::parse("generate-2026-09-03").unwrap().dangerous());
        assert!(!Job::parse("dry-run").unwrap().dangerous());
    }
    #[test]
    fn parse_rejects_traversal_uppercase_and_unknown_names() {
        for name in [
            "../x",
            "Generate",
            "GENERATE",
            "generate ",
            "",
            "backup",
            "generate-2026-9-3",
            "generate-2026-13-01",
            "generate-",
            "generate-2026-09-03.service",
            "dry_run",
            "features-prune;rm",
        ] {
            assert_eq!(Job::parse(name), None, "{name:?}");
        }
    }
    #[test]
    fn polkit_rule_is_present_and_matches_the_unit_names() {
        assert!(
            POLKIT_RULES.contains(POLKIT_UNIT_REGEX),
            "the rule must carry the unit regex verbatim"
        );
        assert!(POLKIT_RULES.contains(r#"action.lookup("verb") == "start""#));
        assert!(POLKIT_RULES.contains(r#"subject.user == "daily-epub""#));
        assert!(POLKIT_RULES.contains("org.freedesktop.systemd1.manage-units"));
        for job in Job::CATALOGUE {
            assert!(polkit_regex_matches(&job.unit()), "{}", job.unit());
        }
        assert!(polkit_regex_matches(
            &Job::parse("generate-2026-09-03").unwrap().unit()
        ));
        for unit in [
            "daily-epub-job@../x.service",
            "daily-epub-job@.service",
            "daily-epub-job@Generate.service",
            "daily-epub.service",
            "daily-epub-generate.service",
            "daily-epub-job@generate.service.d",
        ] {
            assert!(!polkit_regex_matches(unit), "{unit}");
        }
    }
    #[test]
    fn unit_files_carry_the_job_template_and_journal_group() {
        assert!(JOB_UNIT.contains("Description=The Daily EPUB job %i"));
        assert!(JOB_UNIT.contains(
            "ExecStart=/usr/local/bin/daily-epub --config /etc/daily-epub/config.toml job run %i"
        ));
        assert!(JOB_UNIT.contains("TimeoutStartSec=45min"));
        assert!(JOB_UNIT.contains("ProtectSystem=strict"));
        assert!(SERVER_UNIT.contains("SupplementaryGroups=systemd-journal"));
    }
    #[test]
    fn unit_status_parses_systemctl_show_output() {
        let status = parse_unit_status(
            "ActiveState=inactive\nSubState=dead\nResult=exit-code\nExecMainStatus=1\n\
             ExecMainStartTimestamp=Thu 2026-09-03 05:30:01 EDT\nExecMainExitTimestamp=\n",
        );
        assert_eq!(status.active_state, "inactive");
        assert_eq!(status.sub_state, "dead");
        assert_eq!(status.result, "exit-code");
        assert_eq!(status.exit_status, Some(1));
        assert_eq!(
            status.started.as_deref(),
            Some("Thu 2026-09-03 05:30:01 EDT")
        );
        assert_eq!(status.exited, None);
        assert_eq!(parse_unit_status("garbage").active_state, "");
    }
    #[tokio::test]
    async fn claim_reuses_the_requested_row_and_finish_records_the_run() {
        let dir = tempfile::tempdir().unwrap();
        let db = Db::open_and_migrate(&dir.path().join("jobs.db"))
            .await
            .unwrap();
        let now: Timestamp = "2026-09-03T10:00:00Z".parse().unwrap();
        let job = Job::Generate {
            date: Some("2026-09-03".parse().unwrap()),
        };
        let requested = insert_requested(&db, &job, None, now).await.unwrap();
        assert_eq!(
            active_for_unit(&db, &job.unit()).await.unwrap(),
            Some(requested)
        );
        let claimed = claim(&db, &job, now).await.unwrap();
        assert_eq!(
            claimed, requested,
            "the requested row is claimed, not duplicated"
        );
        let row = get(&db, claimed).await.unwrap().unwrap();
        assert_eq!(row.status, "running");
        assert_eq!(row.started_at.as_deref(), Some("2026-09-03T10:00:00Z"));
        assert!(row.is_active());
        let run_id = db.start_run(job_date(&job), now).await.unwrap();
        finish(
            &db,
            claimed,
            Outcome::Ok,
            "curation: done",
            Some(run_id),
            now,
        )
        .await
        .unwrap();
        let row = get(&db, claimed).await.unwrap().unwrap();
        assert_eq!(row.status, "ok");
        assert_eq!(row.run_id, Some(run_id));
        assert_eq!(row.message.as_deref(), Some("curation: done"));
        assert_eq!(row.finished_at.as_deref(), Some("2026-09-03T10:00:00Z"));
        assert_eq!(active_for_unit(&db, &job.unit()).await.unwrap(), None);
        // Nothing requested: `claim` inserts a row with no requester.
        let fresh = claim(&db, &Job::FeaturesPrune, now).await.unwrap();
        let row = get(&db, fresh).await.unwrap().unwrap();
        assert_eq!(row.status, "running");
        assert_eq!(row.requested_by, None);
        assert_eq!(row.name, "features-prune");
        assert_eq!(list(&db, 10).await.unwrap().len(), 2);
        assert_eq!(list(&db, 10).await.unwrap()[0].id, fresh);
        finish(
            &db,
            fresh,
            Outcome::Failed,
            "provider failed\n  after retry",
            None,
            now,
        )
        .await
        .unwrap();
        assert_eq!(
            get(&db, fresh).await.unwrap().unwrap().message.as_deref(),
            Some("provider failed after retry"),
            "job messages are always one line"
        );
    }
    fn job_date(job: &Job) -> Date {
        match job {
            Job::Generate { date: Some(date) } => *date,
            _ => panic!("expected a dated generate"),
        }
    }
 }
@@ -23,6 +23,7 @@ pub mod extract;
 pub mod html;
 pub mod http;
 pub mod images;
 pub mod jobs;
 pub mod lock;
 pub mod miniflux;
 pub mod pipeline;
@@ -31,6 +32,7 @@ pub mod report;
 pub mod server;
 pub mod social;
 pub mod types;
 pub mod web;
 pub mod world;
 /// `CARGO_PKG_VERSION`, printed in the colophon and the OPDS generator tag.
@@ -17,7 +17,7 @@ use daily_epub::db::Db;
 use daily_epub::pipeline::{self, GenerateOptions, GenerateOutcome};
 use daily_epub::report::{RunReport, VOYAGE_PROVIDER};
 use daily_epub::types::{ArticleId, RatingEvent, Vote};
-use daily_epub::{curate, http, lock, server, social};
+use daily_epub::{curate, http, jobs, lock, server, social};
 /// A personalized daily newspaper, delivered as an EPUB.
 #[derive(Debug, Parser)]
@@ -58,6 +58,56 @@ enum Command {
    /// Inspect the resolved configuration.
    #[command(subcommand)]
    Config(ConfigCommand),
    /// Manage dashboard users without taking the pipeline run lock.
    #[command(subcommand)]
    Users(UsersCommand),
    /// Operator jobs (what `daily-epub-job@<name>.service` runs).
    #[command(subcommand)]
    Job(JobCommand),
 }
 #[derive(Debug, Subcommand)]
 enum JobCommand {
    /// Run one catalogue job in-process and record it in the `jobs` table.
    Run {
        /// `generate`, `generate-YYYY-MM-DD`, `dry-run`, `profile-rebuild`,
        /// `features-backfill`, `backfill-social` or `features-prune`.
        name: String,
    },
 }
 #[derive(Debug, Subcommand)]
 enum UsersCommand {
    /// Add a user.
    Add(UserAddArgs),
    /// Change a user's password and revoke existing sessions.
    Passwd(UserPasswordArgs),
    /// Change a user's role.
    Role { username: String, role: String },
    /// Disable a user and revoke existing sessions.
    Disable { username: String },
    /// Enable a user.
    Enable { username: String },
    /// List users and open-session counts.
    List,
    /// Revoke all sessions for a user.
    Logout { username: String },
 }
 #[derive(Debug, clap::Args)]
 struct UserAddArgs {
    username: String,
    #[arg(long)]
    admin: bool,
    #[arg(long)]
    password_stdin: bool,
 }
 #[derive(Debug, clap::Args)]
 struct UserPasswordArgs {
    username: String,
    #[arg(long)]
    password_stdin: bool,
 }
 #[derive(Debug, Subcommand)]
@@ -286,11 +336,12 @@ async fn main() -> Result<()> {
        }
        Command::Serve => {
            let db = Db::open_and_migrate(&config.database_path).await?;
-            server::serve(config, db).await?;
+            let config_path = Config::resolve_path(cli.config.as_deref());
            server::serve(config, config_path, db).await?;
        }
        Command::Profile(ProfileCommand::Rebuild) => {
            let db = Db::open_and_migrate(&config.database_path).await?;
-            cmd_profile_rebuild(&config, &db).await?;
+            println!("{}", cmd_profile_rebuild(&config, &db).await?);
        }
        Command::Ratings(command) => {
            let db = Db::open_and_migrate(&config.database_path).await?;
@@ -307,11 +358,11 @@ async fn main() -> Result<()> {
        }
        Command::Features(command) => {
            let db = Db::open_and_migrate(&config.database_path).await?;
-            cmd_features(&config, &db, command).await?;
+            println!("{}", cmd_features(&config, &db, command).await?);
        }
        Command::BackfillSocial(args) => {
            let db = Db::open_and_migrate(&config.database_path).await?;
-            cmd_backfill_social(&db, args.days).await?;
+            println!("{}", cmd_backfill_social(&db, args.days).await?);
        }
        Command::Db(DbCommand::Migrate) => {
            let db = Db::open(&config.database_path).await?;
@@ -326,29 +377,139 @@ async fn main() -> Result<()> {
                println!("{line}");
            }
        }
        Command::Users(command) => {
            let db = Db::open_and_migrate(&config.database_path).await?;
            cmd_users(&db, command).await?;
        }
        Command::Job(JobCommand::Run { name }) => {
            let Some(job) = jobs::Job::parse(&name) else {
                eprintln!("unknown job {name:?}; the catalogue is:");
                for job in jobs::Job::CATALOGUE {
                    eprintln!("  {:<20} {}", job.name(), job.description());
                }
                eprintln!(
                    "  {:<20} {}",
                    "generate-YYYY-MM-DD",
                    jobs::Job::Generate {
                        date: Some(jiff::civil::Date::default())
                    }
                    .description()
                );
                std::process::exit(2);
            };
            let db = Db::open_and_migrate(&config.database_path).await?;
            cmd_job_run(&config, &db, &job).await?;
        }
    }
    Ok(())
 }
 /// The commands that write the database and provider budgets and so hold the
 /// run lock (§5): `generate`, `profile rebuild`, `features backfill`,
-/// `backfill-social`. Everything else is read-only or its own writer.
+/// `backfill-social`, and a `job run` of any of them. Everything else is
 /// read-only or its own writer.
 fn lock_holder(command: &Command) -> Option<&'static str> {
    match command {
        Command::Generate(_) => Some("generate"),
        Command::Profile(ProfileCommand::Rebuild) => Some("profile rebuild"),
        Command::Features(FeaturesCommand::Backfill(_)) => Some("features backfill"),
        Command::BackfillSocial(_) => Some("backfill-social"),
        // An unknown name takes no lock; the dispatch exits 2 before opening
        // the database.
        Command::Job(JobCommand::Run { name }) => {
            jobs::Job::parse(name).and_then(|job| job.takes_lock())
        }
        Command::Serve
        | Command::Ratings(_)
        | Command::Explain(_)
        | Command::Stats(_)
        | Command::Features(FeaturesCommand::Prune)
        | Command::Db(_)
-        | Command::Config(_) => None,
+        | Command::Config(_)
        | Command::Users(_) => None,
    }
 }
 async fn cmd_users(db: &Db, command: UsersCommand) -> Result<()> {
    use daily_epub::web::users;
    match command {
        UsersCommand::Add(args) => {
            let password = read_new_password(args.password_stdin)?;
            let user = users::add(db, &args.username, &password, args.admin).await?;
            println!("added {} ({})", user.username, user.role);
        }
        UsersCommand::Passwd(args) => {
            let password = read_new_password(args.password_stdin)?;
            let sessions = users::passwd(db, &args.username, &password).await?;
            println!(
                "changed password for {} and revoked {sessions} session(s)",
                args.username
            );
        }
        UsersCommand::Role { username, role } => {
            let role = role.parse().map_err(anyhow::Error::msg)?;
            users::set_role(db, &username, role).await?;
            println!("set {username} role to {role}");
        }
        UsersCommand::Disable { username } => {
            let sessions = users::set_disabled(db, &username, true).await?;
            println!("disabled {username} and revoked {sessions} session(s)");
        }
        UsersCommand::Enable { username } => {
            users::set_disabled(db, &username, false).await?;
            println!("enabled {username}");
        }
        UsersCommand::List => {
            for row in users::list(db).await? {
                let last_login = row
                    .user
                    .last_login_at
                    .map(|timestamp| timestamp.to_string())
                    .unwrap_or_else(|| "never".into());
                println!(
                    "{} · {}{} · created {} · last login {} · {} open session(s)",
                    row.user.username,
                    row.user.role,
                    if row.user.disabled {
                        " · disabled"
                    } else {
                        ""
                    },
                    row.user.created_at,
                    last_login,
                    row.open_sessions
                );
            }
        }
        UsersCommand::Logout { username } => {
            let sessions = users::logout(db, &username).await?;
            println!("revoked {sessions} session(s) for {username}");
        }
    }
    Ok(())
 }
 fn read_new_password(from_stdin: bool) -> Result<String> {
    if from_stdin {
        let mut password = String::new();
        std::io::stdin().read_line(&mut password)?;
        while password.ends_with(['\n', '\r']) {
            password.pop();
        }
        return Ok(password);
    }
    let first = read_password_hidden("Password: ")?;
    let second = read_password_hidden("Confirm password: ")?;
    if first != second {
        anyhow::bail!("passwords do not match");
    }
    Ok(first)
 }
 fn read_password_hidden(prompt: &str) -> Result<String> {
    rpassword::prompt_password(prompt).context("reading the password from the terminal")
 }
 /// `RUST_LOG`-driven tracing, defaulting to `info` (crate table "logging").
 fn init_tracing() {
    let filter = EnvFilter::try_from_default_env()
@@ -480,7 +641,8 @@ fn print_lineup(issue: &daily_epub::types::Issue) {
 // ---------------------------------------------------------------------------
 /// `profile rebuild` runs on the editor when configured, else bulk (§14.3).
-async fn cmd_profile_rebuild(config: &Config, db: &Db) -> Result<()> {
+/// Returns the one-line summary the CLI prints and `job run` records.
 async fn cmd_profile_rebuild(config: &Config, db: &Db) -> Result<String> {
    use curate::llm::{Llms, provider_meters};
    let profile = curate::profile::load_or_build(
        db,
@@ -514,12 +676,11 @@ async fn cmd_profile_rebuild(config: &Config, db: &Db) -> Result<()> {
        config.curation.feedback.verdicts_in_prompt,
    )
    .await?;
-    println!(
+    Ok(format!(
        "taste profile rebuilt (version {}, {} chars)",
        rebuilt.version,
        rebuilt.text.len()
-    );
+    ))
    Ok(())
 }
 async fn resolve_rating_article(
@@ -562,6 +723,7 @@ async fn append_cli_event(
    };
    let event = RatingEvent {
        id: 0,
        user_id: None,
        article_id,
        issue_date: db.latest_issue_date_for_article(article_id).await?,
        kind: "explicit".into(),
@@ -641,7 +803,9 @@ async fn cmd_explain(db: &Db, args: ExplainArgs) -> Result<()> {
    Ok(())
 }
-async fn cmd_features(config: &Config, db: &Db, command: FeaturesCommand) -> Result<()> {
+/// `features backfill` / `features prune`; returns the final summary line
 /// (progress lines are printed as they happen).
 async fn cmd_features(config: &Config, db: &Db, command: FeaturesCommand) -> Result<String> {
    match command {
        FeaturesCommand::Backfill(args) => {
            if !config.voyage.enabled {
@@ -664,8 +828,7 @@ async fn cmd_features(config: &Config, db: &Db, command: FeaturesCommand) -> Res
                plan.cached
            );
            if plan.is_empty() {
-                println!("cache is warm; nothing to do");
+                return Ok("cache is warm; nothing to do".into());
                return Ok(());
            }
            println!(
                "estimate: ~{} tokens ≈ ${:.4} with {} at ${:.2}/M",
@@ -678,17 +841,16 @@ async fn cmd_features(config: &Config, db: &Db, command: FeaturesCommand) -> Res
                && !args.yes
                && !confirm("continue?")?
            {
-                println!("aborted");
+                return Ok("aborted".into());
                return Ok(());
            }
            let outcome = embedding::run_backfill(&service, &plan).await?;
-            println!(
+            Ok(format!(
                "embedded {} articles and {} interests · {} tokens · ${:.4}",
                outcome.articles_embedded,
                outcome.interests_embedded,
                outcome.tokens,
                outcome.cost_usd
-            );
+            ))
        }
        FeaturesCommand::Prune => {
            let ranking = &config.curation.ranking;
@@ -699,17 +861,16 @@ async fn cmd_features(config: &Config, db: &Db, command: FeaturesCommand) -> Res
                jiff::Timestamp::now(),
            )
            .await?;
-            println!(
+            Ok(format!(
                "pruned {} embeddings older than {} days, {} candidate rows and {} assessments older than {} days",
                pruned.embeddings,
                ranking.embedding_retention_days,
                pruned.telemetry,
                pruned.assessments,
                ranking.telemetry_retention_days
-            );
+            ))
        }
    }
    Ok(())
 }
 /// A y/N question on stdin; anything but a leading `y` is a no.
@@ -721,12 +882,94 @@ fn confirm(question: &str) -> Result<bool> {
    Ok(answer.trim().to_lowercase().starts_with('y'))
 }
-async fn cmd_backfill_social(db: &Db, days: u32) -> Result<()> {
+async fn cmd_backfill_social(db: &Db, days: u32) -> Result<String> {
    let http = http::build_client(http::DEFAULT_TIMEOUT)?;
    let enricher = social::SocialEnricher::new(http, db.clone());
    let updated = enricher.backfill(days).await?;
-    println!("refreshed social scores for {updated} articles");
+    Ok(format!("refreshed social scores for {updated} articles"))
-    Ok(())
+}
 // ---------------------------------------------------------------------------
 // `job run` (dashboard plan §14.2)
 // ---------------------------------------------------------------------------
 /// `job run <name>`: claim the newest `requested` row of this job (or insert
 /// one when the unit was started by hand), run the mapped command in-process
 /// with the same functions the plain subcommands use, and record `ok` /
 /// `failed` with a one-line message and, for generate, the run id. A failure
 /// propagates so the unit exits non-zero (`Result=exit-code`).
 async fn cmd_job_run(config: &Config, db: &Db, job: &jobs::Job) -> Result<()> {
    let id = jobs::claim(db, job, jiff::Timestamp::now())
        .await
        .context("claiming the jobs row")?;
    tracing::info!(job = %job.name(), job_id = id, "job started");
    let result = run_job(config, db, job).await;
    let now = jiff::Timestamp::now();
    match result {
        Ok((message, run_id)) => {
            jobs::finish(db, id, jobs::Outcome::Ok, &message, run_id, now)
                .await
                .context("recording the job outcome")?;
            tracing::info!(job = %job.name(), job_id = id, %message, "job finished");
            Ok(())
        }
        Err(error) => {
            let message = format!("{error:#}");
            jobs::finish(db, id, jobs::Outcome::Failed, &message, None, now)
                .await
                .context("recording the job failure")?;
            tracing::error!(job = %job.name(), job_id = id, %message, "job failed");
            Err(error)
        }
    }
 }
 /// The command each catalogue job maps to (§14.1), returning its one-line
 /// message and the run id it produced.
 async fn run_job(config: &Config, db: &Db, job: &jobs::Job) -> Result<(String, Option<i64>)> {
    match job {
        jobs::Job::Generate { date } => {
            generate_job(config, db, date.map(|date| date.to_string()), false).await
        }
        jobs::Job::DryRun => generate_job(config, db, None, true).await,
        jobs::Job::ProfileRebuild => Ok((cmd_profile_rebuild(config, db).await?, None)),
        jobs::Job::FeaturesBackfill => {
            let args = BackfillArgs {
                days: 30,
                rated_only: false,
                all: false,
                yes: true,
            };
            Ok((
                cmd_features(config, db, FeaturesCommand::Backfill(args)).await?,
                None,
            ))
        }
        jobs::Job::BackfillSocial => Ok((cmd_backfill_social(db, 7).await?, None)),
        jobs::Job::FeaturesPrune => Ok((
            cmd_features(config, db, FeaturesCommand::Prune).await?,
            None,
        )),
    }
 }
 /// `generate [--date D] [--dry-run]` as a job: the `curation:` line is the
 /// message, the run id links the job to its run.
 async fn generate_job(
    config: &Config,
    db: &Db,
    date: Option<String>,
    dry_run: bool,
 ) -> Result<(String, Option<i64>)> {
    let opts = GenerateOptions {
        date,
        dry_run,
        ..GenerateOptions::default()
    };
    let outcome = pipeline::generate(config, db, &opts).await?;
    print_outcome(&outcome);
    let [curation, ..] = outcome.report.info_block();
    Ok((curation, Some(outcome.run_id)))
 }
 #[cfg(test)]
@@ -858,9 +1101,110 @@ mod tests {
            vec!["db", "migrate"],
            vec!["features", "prune"],
            vec!["config", "check"],
            vec!["job", "run", "features-prune"],
            vec!["job", "run", "not-a-job"],
        ] {
            assert_eq!(lock_holder(&parse(&args)), None, "{args:?}");
        }
        // `job run` takes the same lock as the command it maps to.
        assert_eq!(
            lock_holder(&parse(&["job", "run", "generate"])),
            Some("generate")
        );
        assert_eq!(
            lock_holder(&parse(&["job", "run", "generate-2026-09-03"])),
            Some("generate")
        );
        assert_eq!(
            lock_holder(&parse(&["job", "run", "dry-run"])),
            Some("generate")
        );
        assert_eq!(
            lock_holder(&parse(&["job", "run", "profile-rebuild"])),
            Some("profile rebuild")
        );
        assert_eq!(
            lock_holder(&parse(&["job", "run", "features-backfill"])),
            Some("features backfill")
        );
        assert_eq!(
            lock_holder(&parse(&["job", "run", "backfill-social"])),
            Some("backfill-social")
        );
    }
    #[test]
    fn parses_job_run() {
        match Cli::try_parse_from(["daily-epub", "job", "run", "features-prune"])
            .unwrap()
            .command
        {
            Command::Job(JobCommand::Run { name }) => assert_eq!(name, "features-prune"),
            other => panic!("expected job run, got {other:?}"),
        }
        assert!(Cli::try_parse_from(["daily-epub", "job", "run"]).is_err());
        assert!(Cli::try_parse_from(["daily-epub", "job"]).is_err());
    }
    /// Dashboard plan §17 "Jobs": `job run` flips the dashboard's `requested`
    /// row to `running` and then `ok` with the command's message, in-process
    /// and without systemd.
    #[tokio::test]
    async fn job_run_flips_requested_to_running_to_ok() {
        use sqlx::Row as _;
        let dir = tempfile::tempdir().unwrap();
        let mut config = Config {
            database_path: dir.path().join("jobs.db"),
            ..Config::default()
        };
        let db = Db::open_and_migrate(&config.database_path).await.unwrap();
        let now = jiff::Timestamp::now();
        let job = jobs::Job::FeaturesPrune;
        let requested = jobs::insert_requested(&db, &job, None, now).await.unwrap();
        assert_eq!(
            jobs::get(&db, requested).await.unwrap().unwrap().status,
            "requested"
        );
        cmd_job_run(&config, &db, &job).await.unwrap();
        let row = jobs::get(&db, requested).await.unwrap().unwrap();
        assert_eq!(row.status, "ok", "{row:?}");
        assert!(row.started_at.is_some());
        assert!(row.finished_at.is_some());
        assert!(
            row.message
                .as_deref()
                .unwrap_or_default()
                .starts_with("pruned 0 embeddings"),
            "{row:?}"
        );
        assert_eq!(row.run_id, None);
        let rows: i64 = sqlx::query("SELECT COUNT(*) AS n FROM jobs")
            .fetch_one(db.pool())
            .await
            .unwrap()
            .get("n");
        assert_eq!(rows, 1, "the requested row was claimed, not duplicated");
        // A failing command records `failed` with the error and propagates it.
        config.voyage.enabled = false;
        let backfill = jobs::Job::FeaturesBackfill;
        let error = cmd_job_run(&config, &db, &backfill).await.unwrap_err();
        assert!(error.to_string().contains("voyage.enabled is false"));
        let failed = jobs::list(&db, 1).await.unwrap().remove(0);
        assert_eq!(failed.name, "features-backfill");
        assert_eq!(failed.status, "failed");
        assert_eq!(failed.requested_by, None, "started by hand: no requester");
        assert!(
            failed
                .message
                .as_deref()
                .unwrap_or_default()
                .contains("voyage.enabled is false"),
            "{failed:?}"
        );
    }
    #[test]
@@ -70,6 +70,7 @@ pub struct GenerateOptions {
 /// What one run produced, for the caller to print (§3.13).
 #[derive(Debug)]
 pub struct GenerateOutcome {
    pub run_id: i64,
    pub report: RunReport,
    /// `None` only when the run failed before assembly.
    pub issue: Option<Issue>,
@@ -271,12 +272,14 @@ pub async fn generate(config: &Config, db: &Db, opts: &GenerateOptions) -> Resul
                None,
                None,
                Some(&report.to_json()),
                None,
            )
            .await
    {
        tracing::warn!(error = %e, "could not attach the run report to the issue");
    }
    Ok(GenerateOutcome {
        run_id,
        report,
        issue: stages.issue,
        artifacts: stages.artifacts,
@@ -1045,6 +1048,12 @@ async fn record_issue(db: &Db, issue: &Issue, published: &Published) -> Result<(
    let x4_path = path_for(Edition::X4);
    let xtc_path = published.xtc.as_ref().map(|p| p.display().to_string());
    let mut stored_issue = issue.clone();
    for pick in &mut stored_issue.lineup.picks {
        pick.article.content_html.clear();
    }
    let issue_json = serde_json::to_string(&stored_issue).context("serializing issue snapshot")?;
    db.upsert_issue(
        issue.meta.date,
        issue.meta.issue_number,
@@ -1054,6 +1063,7 @@ async fn record_issue(db: &Db, issue: &Issue, published: &Published) -> Result<(
        xtc_path.as_deref(),
        Some(&issue.editorial.front_page_html),
        None,
        Some(&issue_json),
    )
    .await?;
    db.replace_issue_articles(issue.meta.date, &issue.lineup.picks)
@@ -874,6 +874,7 @@ type=\"application/epub+zip\" length=\"1700000\"/>"
            None,
            None,
            None,
            None,
        )
        .await
        .unwrap();
@@ -22,18 +22,23 @@
 //! `server.hmac_secret` is unset carries links this server rejects with 403.
 use std::path::{Path as FsPath, PathBuf};
 use std::sync::{Arc, RwLock};
 use axum::Router;
 use axum::body::Body;
 use axum::extract::{Path, Query, State};
 use axum::http::{HeaderMap, HeaderValue, StatusCode, header};
 use axum::middleware::{from_fn, from_fn_with_state};
 use axum::response::{IntoResponse, Response};
 use axum::routing::get;
 use axum_login::AuthManagerLayerBuilder;
 use axum_login::tower_sessions::{Expiry, SessionManagerLayer};
 use base64::Engine as _;
 use base64::engine::general_purpose::STANDARD as BASE64;
 use jiff::Timestamp;
 use jiff::civil::Date;
 use serde::Deserialize;
 use tower_http::request_id::{MakeRequestUuid, PropagateRequestIdLayer, SetRequestIdLayer};
 use tower_http::trace::TraceLayer;
 use crate::config::Config;
@@ -64,10 +69,61 @@ pub enum ServerError {
 }
 /// Shared axum state.
-#[derive(Debug, Clone)]
+#[derive(Clone)]
 pub struct AppState {
    pub db: Db,
-    pub config: Config,
+    pub config: Arc<RwLock<Arc<Config>>>,
    pub config_path: Option<PathBuf>,
    pub web: Arc<crate::web::WebState>,
 }
 impl std::fmt::Debug for AppState {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("AppState")
            .field("db", &self.db)
            .field("config_path", &self.config_path)
            .field("web", &self.web)
            .finish_non_exhaustive()
    }
 }
 impl AppState {
    pub fn new(db: Db, config: Config, config_path: Option<PathBuf>) -> Self {
        Self {
            db,
            config: Arc::new(RwLock::new(Arc::new(config))),
            config_path,
            web: Arc::new(crate::web::WebState {
                jobs: Arc::new(crate::web::DisabledRunner),
                started_at: Timestamp::now(),
                config_mtime: std::sync::Mutex::new(None),
            }),
        }
    }
    /// `new`, with a specific [`crate::web::JobRunner`]: `SystemdRunner` in
    /// `serve`, a `MockRunner` in router tests (dashboard plan §14.4).
    pub fn with_jobs(
        db: Db,
        config: Config,
        config_path: Option<PathBuf>,
        jobs: Arc<dyn crate::web::JobRunner>,
    ) -> Self {
        let mut state = Self::new(db, config, config_path);
        state.web = Arc::new(crate::web::WebState {
            jobs,
            started_at: Timestamp::now(),
            config_mtime: std::sync::Mutex::new(None),
        });
        state
    }
    pub fn config(&self) -> Arc<Config> {
        match self.config.read() {
            Ok(config) => Arc::clone(&config),
            Err(poisoned) => Arc::clone(&poisoned.into_inner()),
        }
    }
 }
 // ---------------------------------------------------------------------------
@@ -86,6 +142,22 @@ pub use crate::auth::{constant_time_eq, rating_token, rating_url, verify_token};
 /// `/files/epub/{name}`, `/files/xtc/{name}`, `/healthz`, `/issues.json`, with
 /// `tower-http` tracing (§3.12).
 pub fn router(state: AppState) -> Router {
    let config = state.config();
    let store = crate::web::session::SqliteSessionStore::new(state.db.pool().clone());
    let session_layer = SessionManagerLayer::new(store)
        .with_name("daily_session")
        .with_http_only(true)
        .with_same_site(axum_login::tower_sessions::cookie::SameSite::Lax)
        .with_secure(config.server.public_url.starts_with("https://"))
        .with_expiry(Expiry::OnInactivity(time::Duration::days(i64::from(
            config.server.session_days,
        ))));
    let auth_layer = AuthManagerLayerBuilder::new(
        crate::web::session::Backend::new(state.db.clone()),
        session_layer,
    )
    .build();
    Router::new()
        .route("/r/{date}/{article_id}/{vote}", get(handle_rating))
        .route(crate::publish::OPDS_PATH, get(handle_opds))
@@ -97,12 +169,25 @@ pub fn router(state: AppState) -> Router {
        .route("/files/xtc/{name}", get(handle_xtc_file))
        .route("/healthz", get(handle_healthz))
        .route("/issues.json", get(handle_issues_json))
        .merge(crate::web::router(&config))
        .layer(PropagateRequestIdLayer::x_request_id())
        .layer(TraceLayer::new_for_http())
        .layer(SetRequestIdLayer::x_request_id(MakeRequestUuid))
        .layer(auth_layer)
        .layer(from_fn_with_state(
            state.clone(),
            crate::web::session::require_same_origin,
        ))
        .layer(from_fn(crate::web::security_headers))
        .with_state(state)
 }
 /// `daily-epub serve` — bind, serve, graceful shutdown on SIGTERM (§3.12).
-pub async fn serve(config: Config, db: Db) -> Result<(), ServerError> {
+pub async fn serve(
    config: Config,
    config_path: Option<PathBuf>,
    db: Db,
 ) -> Result<(), ServerError> {
    if config.server.hmac_secret.is_none() {
        // Not fatal for the OPDS routes, but every rating link would 500.
        tracing::warn!("server.hmac_secret is unset — rating links will be rejected");
@@ -117,10 +202,36 @@ pub async fn serve(config: Config, db: Db) -> Result<(), ServerError> {
    let local = listener.local_addr().map(|a| a.to_string()).unwrap_or(addr);
    tracing::info!(bind = %local, public_url = %config.server.public_url, "serving");
-    let app = router(AppState { db, config });
+    let store = crate::web::session::SqliteSessionStore::new(db.pool().clone());
-    axum::serve(listener, app)
+    if let Err(error) = store.delete_expired().await {
-        .with_graceful_shutdown(shutdown_signal())
+        tracing::warn!(%error, "could not delete expired sessions at startup");
-        .await?;
+    }
    tokio::spawn(async move {
        let mut interval = tokio::time::interval(std::time::Duration::from_secs(3600));
        loop {
            interval.tick().await;
            if let Err(error) = store.delete_expired().await {
                tracing::warn!(%error, "could not delete expired sessions");
            }
        }
    });
    // The Jobs page starts `daily-epub-job@<name>.service` through systemd +
    // polkit (§14); `server.jobs_enabled = false` swaps in the runner whose
    // page says so.
    let jobs: Arc<dyn crate::web::JobRunner> = if config.server.jobs_enabled {
        Arc::new(crate::jobs::SystemdRunner::default())
    } else {
        tracing::info!("server.jobs_enabled is false; the Jobs page cannot start units");
        Arc::new(crate::web::DisabledRunner)
    };
    let app = router(AppState::with_jobs(db, config, config_path, jobs));
    axum::serve(
        listener,
        app.into_make_service_with_connect_info::<std::net::SocketAddr>(),
    )
    .with_graceful_shutdown(shutdown_signal())
    .await?;
    tracing::info!("server stopped");
    Ok(())
 }
@@ -219,7 +330,8 @@ async fn handle_rating(
        return page(StatusCode::BAD_REQUEST, "Bad link — invalid vote.", None);
    };
-    let Some(secret) = state.config.server.hmac_secret.as_deref() else {
+    let config = state.config();
    let Some(secret) = config.server.hmac_secret.as_deref() else {
        tracing::error!("rating request but server.hmac_secret is unset");
        return page(
            StatusCode::INTERNAL_SERVER_ERROR,
@@ -251,12 +363,13 @@ async fn handle_rating(
    };
    let event = RatingEvent {
        id: 0,
        user_id: None,
        issue_date: Some(date),
        article_id,
        kind: "explicit".into(),
        source: "epub".into(),
        label: label.into(),
-        value: vote.value(&state.config.curation.feedback),
+        value: vote.value(&config.curation.feedback),
        note: None,
        event_at: Timestamp::now(),
    };
@@ -278,23 +391,17 @@ async fn handle_rating(
        Vote::Good => "Recorded: Good — thanks.",
        Vote::NotForMe => "Recorded: Not for me — thanks.",
    };
-    confirmation_page(
+    confirmation_page(StatusCode::OK, message, &config, date, article_id, vote)
        StatusCode::OK,
        message,
        &state.config,
        date,
        article_id,
        vote,
    )
 }
 /// `GET /opds/daily.xml` — both EPUB editions of the last issues, newest first,
 /// rendered from the publish directory on each request (§3.11).
 async fn handle_opds(State(state): State<AppState>, headers: HeaderMap) -> Response {
-    if let Some(challenge) = check_basic_auth(&state.config, &headers) {
+    let config = state.config();
    if let Some(challenge) = check_basic_auth(&config, &headers) {
        return challenge;
    }
-    match crate::publish::build_opds(&state.db, &state.config).await {
+    match crate::publish::build_opds(&state.db, &config).await {
        Ok(feed) => (
            StatusCode::OK,
            [
@@ -321,9 +428,10 @@ async fn handle_epub_file(
    State(state): State<AppState>,
    Path(name): Path<String>,
    headers: HeaderMap,
    auth: crate::web::session::AuthSession,
 ) -> Response {
-    let dir = state.config.publish.epub_dir.clone();
+    let dir = state.config().publish.epub_dir.clone();
-    serve_file(&state, &dir, &name, &headers).await
+    serve_file(&state, &dir, &name, &headers, auth.user().await.is_some()).await
 }
 /// `GET /files/xtc/{name}` — download one XTC artifact (§3.11).
@@ -334,14 +442,25 @@ async fn handle_xtc_file(
    State(state): State<AppState>,
    Path(name): Path<String>,
    headers: HeaderMap,
    auth: crate::web::session::AuthSession,
 ) -> Response {
-    let dir = state.config.publish.xtc_dir.clone();
+    let dir = state.config().publish.xtc_dir.clone();
-    serve_file(&state, &dir, &name, &headers).await
+    serve_file(&state, &dir, &name, &headers, auth.user().await.is_some()).await
 }
-/// Stream one file out of `dir`, behind the OPDS Basic auth (§3.11).
+/// Stream one file out of `dir`. A signed-in web session (any role) bypasses
-async fn serve_file(state: &AppState, dir: &FsPath, name: &str, headers: &HeaderMap) -> Response {
+/// the OPDS Basic auth; without one the existing Basic auth policy applies
-    if let Some(challenge) = check_basic_auth(&state.config, headers) {
+/// unchanged, including "no credentials configured ⇒ public", so e-readers
 /// following the OPDS feed keep working (§3.11, dashboard plan §8).
 async fn serve_file(
    state: &AppState,
    dir: &FsPath,
    name: &str,
    headers: &HeaderMap,
    signed_in: bool,
 ) -> Response {
    let config = state.config();
    if !signed_in && let Some(challenge) = check_basic_auth(&config, headers) {
        return challenge;
    }
    let Some(path) = safe_join(dir, name) else {
@@ -498,10 +617,17 @@ fn confirmation_page(
    })
    .collect::<Vec<_>>()
    .join(" &nbsp; ");
    let issue_url = format!(
        "{}/issues/{date}",
        config.server.public_url.trim_end_matches('/')
    );
    let body = page_html(
        message,
        None,
-        Some(&format!("<p><small>Change it: {choices}</small></p>")),
+        Some(&format!(
            "<p><small>Change it: {choices}</small></p><p><small><a href=\"{}\">Open this issue on the site</a></small></p>",
            escape_attr(&issue_url)
        )),
    );
    (
        status,
@@ -681,8 +807,8 @@ mod tests {
        assert!(safe_join(dir, "../../etc/passwd").is_none());
    }
-    #[test]
+    #[tokio::test]
-    fn the_confirmation_page_is_tiny_and_self_contained() {
+    async fn the_confirmation_page_is_tiny_and_self_contained() {
        let html = page_html(
            "Recorded: Loved it — thanks.",
            Some("2026-08-15 · article 42"),
@@ -697,6 +823,25 @@ mod tests {
            StatusCode::FORBIDDEN
        );
        assert!(page_html("<b>x</b>", None, None).contains("&lt;b&gt;"));
        let mut config = Config::default();
        config.server.hmac_secret = Some("test-secret".into());
        config.server.public_url = "https://daily.example".into();
        let response =
            confirmation_page(StatusCode::OK, "Recorded", &config, date(), 42, Vote::Loved);
        let body = String::from_utf8(
            axum::body::to_bytes(response.into_body(), 4096)
                .await
                .unwrap()
                .to_vec(),
        )
        .unwrap();
        assert!(
            body.contains(
                "href=\"https://daily.example/issues/2026-08-15\">Open this issue on the site"
            ),
            "{body}"
        );
    }
    // -----------------------------------------------------------------
@@ -734,10 +879,7 @@ mod tests {
            let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
            let addr = listener.local_addr().unwrap();
-            let app = router(AppState {
+            let app = router(AppState::new(db.clone(), config, None));
                db: db.clone(),
                config,
            });
            let handle = tokio::spawn(async move {
                axum::serve(listener, app).await.unwrap();
            });
@@ -848,6 +990,7 @@ mod tests {
                    None,
                    None,
                    Some(&format!("{{\"selected\":{n}}}")),
                    None,
                )
                .await
                .unwrap();
@@ -705,6 +705,7 @@ impl Vote {
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct RatingEvent {
    pub id: i64,
    pub user_id: Option<i64>,
    pub article_id: ArticleId,
    pub issue_date: Option<Date>,
    pub kind: String,
@@ -733,6 +734,7 @@ pub struct Facets {
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct RatedArticle {
    pub article_id: ArticleId,
    pub user_id: Option<i64>,
    pub issue_date: Option<Date>,
    pub title: String,
    pub feed_title: String,
@@ -0,0 +1,932 @@
 //! Dashboard: articles list and article detail (dashboard plan §9.3).
 //!
 //! The list joins every article to its best entry, its **latest**
 //! `candidate_runs` row (via `idx_candidate_runs_article_run`), both
 //! assessments, the current explicit rating and the latest publication. The
 //! detail page shows everything the system knows about one article, in the
 //! order of §9.3, and wraps `telemetry::render_explain` verbatim in `<pre>`.
 use askama::Template;
 use axum::Router;
 use axum::extract::{Extension, Path, Query, State};
 use axum::response::{IntoResponse, Response};
 use axum::routing::get;
 use axum_login::tower_sessions::Session;
 use jiff::civil::Date;
 use serde::Deserialize;
 use sqlx::Row as _;
 use super::{
    Bind, Pager, REASONS, STAGES, SignalsView, admitted_by_parts, allow_listed, bind_all, db_err,
    dynamic_query, fmt_opt, fmt_opt_int, fmt_stored_time, like_pattern, non_empty, page_number,
    widget_label,
 };
 use crate::config::Config;
 use crate::curate::telemetry;
 use crate::curate::triage::{PROVIDER_REJECTED, TRIAGE_KINDS};
 use crate::db::Db;
 use crate::server::AppState;
 use crate::types::ArticleId;
 use crate::web::rate::RatingWidget;
 use crate::web::session::{AuthSession, Viewer};
 use crate::web::{Html, Page, Pagination, WebError, take_flash};
 const ARTICLES_PER_PAGE: u32 = 50;
 /// Routes contributed by this page group (merged by `dashboard::router`).
 pub fn routes() -> Router<AppState> {
    Router::new()
        .route("/dashboard/articles", get(list))
        .route("/dashboard/articles/{id}", get(detail))
 }
 // ---------------------------------------------------------------------------
 // Articles list
 // ---------------------------------------------------------------------------
 #[derive(Debug, Default, Deserialize)]
 pub struct ArticlesQuery {
    pub q: Option<String>,
    pub feed: Option<String>,
    pub stage: Option<String>,
    pub reason: Option<String>,
    pub rated: Option<String>,
    pub published: Option<String>,
    pub from: Option<String>,
    pub to: Option<String>,
    pub kind: Option<String>,
    pub sort: Option<String>,
    pub page: Option<u32>,
 }
 const RATED: [&str; 6] = ["any", "loved", "good", "down", "cleared", "none"];
 const PUBLISHED: [&str; 2] = ["yes", "no"];
 const ARTICLE_SORTS: [(&str, &str); 7] = [
    ("first_seen", "x.first_seen DESC, x.id DESC"),
    ("utility", "x.utility DESC, x.id DESC"),
    ("quality", "x.quality DESC, x.id DESC"),
    ("fit", "x.fit DESC, x.id DESC"),
    ("triage", "x.triage DESC, x.id DESC"),
    ("words", "x.word_count DESC, x.id DESC"),
    ("title", "x.title COLLATE NOCASE ASC, x.id ASC"),
 ];
 /// Validated article filters; see [`CandidateFilters`](super::runs::CandidateFilters).
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct ArticleFilters {
    pub q: Option<String>,
    pub feed: Option<i64>,
    pub stage: Option<String>,
    pub reason: Option<String>,
    pub rated: Option<String>,
    pub published: Option<String>,
    pub from: Option<String>,
    pub to: Option<String>,
    pub kind: Option<String>,
    pub sort: &'static str,
 }
 impl ArticleFilters {
    pub fn from_query(query: &ArticlesQuery) -> Self {
        let owned = |value: Option<&str>| value.map(str::to_string);
        let date = |value: Option<&str>| {
            non_empty(value)
                .and_then(|value| value.parse::<Date>().ok())
                .map(|date| date.to_string())
        };
        let mut kinds: Vec<&str> = TRIAGE_KINDS.to_vec();
        kinds.push(PROVIDER_REJECTED);
        Self {
            q: owned(non_empty(query.q.as_deref())),
            feed: non_empty(query.feed.as_deref()).and_then(|feed| feed.parse::<i64>().ok()),
            stage: owned(allow_listed(query.stage.as_deref(), &STAGES)),
            reason: owned(allow_listed(query.reason.as_deref(), &REASONS)),
            rated: owned(allow_listed(query.rated.as_deref(), &RATED)),
            published: owned(allow_listed(query.published.as_deref(), &PUBLISHED)),
            from: date(query.from.as_deref()),
            to: date(query.to.as_deref()),
            kind: owned(allow_listed(query.kind.as_deref(), &kinds)),
            sort: ARTICLE_SORTS
                .iter()
                .find(|(name, _)| Some(*name) == query.sort.as_deref())
                .map(|(name, _)| *name)
                .unwrap_or(ARTICLE_SORTS[0].0),
        }
    }
    fn order_by(&self) -> &'static str {
        ARTICLE_SORTS
            .iter()
            .find(|(name, _)| *name == self.sort)
            .map(|(_, sql)| *sql)
            .unwrap_or(ARTICLE_SORTS[0].1)
    }
    fn where_clauses(&self) -> (String, Vec<Bind>) {
        let mut sql = String::new();
        let mut binds = Vec::new();
        if let Some(q) = &self.q {
            sql.push_str(" AND (x.title LIKE ? ESCAPE '\\' OR x.canonical_url LIKE ? ESCAPE '\\')");
            binds.push(Bind::Text(like_pattern(q)));
            binds.push(Bind::Text(like_pattern(q)));
        }
        if let Some(feed) = self.feed {
            sql.push_str(" AND x.feed_id = ?");
            binds.push(Bind::Int(feed));
        }
        if let Some(stage) = &self.stage {
            sql.push_str(" AND x.stage = ?");
            binds.push(Bind::Text(stage.clone()));
        }
        if let Some(reason) = &self.reason {
            sql.push_str(" AND x.excluded_reason = ?");
            binds.push(Bind::Text(reason.clone()));
        }
        match self.rated.as_deref() {
            Some("any") => sql.push_str(" AND x.rating IS NOT NULL AND x.rating != 'cleared'"),
            Some("none") => sql.push_str(" AND x.rating IS NULL"),
            Some(label @ ("loved" | "good" | "cleared")) => {
                sql.push_str(" AND x.rating = ?");
                binds.push(Bind::Text(label.to_string()));
            }
            Some("down") => sql.push_str(" AND x.rating = 'not_for_me'"),
            _ => {}
        }
        match self.published.as_deref() {
            Some("yes") => sql.push_str(" AND x.published IS NOT NULL"),
            Some("no") => sql.push_str(" AND x.published IS NULL"),
            _ => {}
        }
        if let Some(from) = &self.from {
            sql.push_str(" AND substr(x.first_seen, 1, 10) >= ?");
            binds.push(Bind::Text(from.clone()));
        }
        if let Some(to) = &self.to {
            sql.push_str(" AND substr(x.first_seen, 1, 10) <= ?");
            binds.push(Bind::Text(to.clone()));
        }
        if let Some(kind) = &self.kind {
            sql.push_str(" AND x.triage_kind = ?");
            binds.push(Bind::Text(kind.clone()));
        }
        (sql, binds)
    }
    fn params(&self) -> Vec<(&'static str, Option<String>)> {
        vec![
            ("q", self.q.clone()),
            ("feed", self.feed.map(|feed| feed.to_string())),
            ("stage", self.stage.clone()),
            ("reason", self.reason.clone()),
            ("rated", self.rated.clone()),
            ("published", self.published.clone()),
            ("from", self.from.clone()),
            ("to", self.to.clone()),
            ("kind", self.kind.clone()),
            (
                "sort",
                (self.sort != ARTICLE_SORTS[0].0).then(|| self.sort.to_string()),
            ),
        ]
    }
 }
 /// One row of the articles table.
 #[derive(Debug, Clone)]
 pub struct ArticleListRow {
    pub id: ArticleId,
    pub href: String,
    pub title: String,
    pub feed_id: Option<i64>,
    pub feed: String,
    pub first_seen: String,
    pub words: i64,
    pub stage: Option<String>,
    pub reason: Option<String>,
    pub run_id: Option<i64>,
    pub run_date: Option<String>,
    pub utility: String,
    pub triage: String,
    pub quality: String,
    pub fit: String,
    pub rating: Option<String>,
    pub rating_class: &'static str,
    pub published: Option<String>,
 }
 const ARTICLE_INNER: &str =
    "SELECT a.id, COALESCE(a.title, '') AS title, a.canonical_url, a.first_seen,
                a.word_count, e.feed_id, COALESCE(e.feed_title, '') AS feed_title,
                l.run_id, l.stage, l.excluded_reason, l.utility, r.date AS run_date,
                t.score AS triage, t.kind AS triage_kind, d.score AS quality, d.fit AS fit,
                (SELECT re.label FROM rating_events re
                 WHERE re.article_id = a.id AND re.kind = 'explicit'
                 ORDER BY re.event_at DESC, re.id DESC LIMIT 1) AS rating,
                (SELECT ia.issue_date FROM issue_articles ia
                 WHERE ia.article_id = a.id ORDER BY ia.issue_date DESC LIMIT 1) AS published
         FROM articles a
         LEFT JOIN entries e ON e.id = a.best_entry_id
         LEFT JOIN candidate_runs l ON l.article_id = a.id
              AND l.run_id = (SELECT MAX(c2.run_id) FROM candidate_runs c2
                              WHERE c2.article_id = a.id)
         LEFT JOIN runs r ON r.id = l.run_id
         LEFT JOIN article_assessments t ON t.article_id = a.id AND t.stage = 'triage'
         LEFT JOIN article_assessments d ON d.article_id = a.id AND d.stage = 'deep'";
 pub async fn list_articles(
    db: &Db,
    config: &Config,
    filters: &ArticleFilters,
    page: u32,
 ) -> Result<(Vec<ArticleListRow>, Pagination), sqlx::Error> {
    let (clauses, binds) = filters.where_clauses();
    let count_sql = format!("SELECT COUNT(*) FROM ({ARTICLE_INNER}) x WHERE 1 = 1{clauses}");
    let total: i64 = bind_all(dynamic_query(count_sql), &binds)
        .fetch_one(db.pool())
        .await?
        .get(0);
    let pagination = Pagination {
        page,
        per_page: ARTICLES_PER_PAGE,
        total,
    };
    let select_sql = format!(
        "SELECT * FROM ({ARTICLE_INNER}) x WHERE 1 = 1{clauses} ORDER BY {} LIMIT ? OFFSET ?",
        filters.order_by()
    );
    let rows = bind_all(dynamic_query(select_sql), &binds)
        .bind(i64::from(ARTICLES_PER_PAGE))
        .bind(pagination.offset())
        .fetch_all(db.pool())
        .await?;
    let rows = rows
        .iter()
        .map(|row| {
            let id: ArticleId = row.get("id");
            let rating: Option<String> = row.get("rating");
            ArticleListRow {
                id,
                href: format!("/dashboard/articles/{id}"),
                title: row.get("title"),
                feed_id: row.get("feed_id"),
                feed: row.get("feed_title"),
                first_seen: fmt_stored_time(Some(&row.get::<String, _>("first_seen")), config),
                words: row.get("word_count"),
                stage: row.get("stage"),
                reason: row.get("excluded_reason"),
                run_id: row.get("run_id"),
                run_date: row.get("run_date"),
                utility: fmt_opt(row.get("utility"), 1),
                triage: fmt_opt(row.get("triage"), 1),
                quality: fmt_opt(row.get("quality"), 1),
                fit: fmt_opt(row.get("fit"), 1),
                rating_class: widget_label(rating.as_deref()),
                rating,
                published: row.get("published"),
            }
        })
        .collect();
    Ok((rows, pagination))
 }
 #[derive(Template)]
 #[template(path = "dashboard/articles.html")]
 struct ArticlesTemplate {
    page: Page,
    articles: Vec<ArticleListRow>,
    filters: ArticleFilters,
    feed_value: String,
    stages: Vec<&'static str>,
    reasons: Vec<&'static str>,
    rated: Vec<&'static str>,
    kinds: Vec<&'static str>,
    sorts: Vec<&'static str>,
    pager: Pager,
 }
 async fn list(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
    Query(query): Query<ArticlesQuery>,
 ) -> Result<Response, WebError> {
    let viewer = auth.user().await.map(Viewer::from);
    let config = state.config();
    let filters = ArticleFilters::from_query(&query);
    let page_no = page_number(query.page);
    let (articles, pagination) = list_articles(&state.db, &config, &filters, page_no)
        .await
        .map_err(db_err)?;
    let pager = Pager::new(pagination, "/dashboard/articles", &filters.params());
    let mut kinds: Vec<&'static str> = TRIAGE_KINDS.to_vec();
    kinds.push(PROVIDER_REJECTED);
    let mut page = Page::new("Articles", viewer, "articles");
    page.flash = take_flash(&session).await?;
    Ok(Html(ArticlesTemplate {
        page,
        articles,
        feed_value: filters
            .feed
            .map(|feed| feed.to_string())
            .unwrap_or_default(),
        filters,
        stages: STAGES.to_vec(),
        reasons: REASONS.to_vec(),
        rated: RATED.to_vec(),
        kinds,
        sorts: ARTICLE_SORTS.iter().map(|(name, _)| *name).collect(),
        pager,
    })
    .into_response())
 }
 // ---------------------------------------------------------------------------
 // Article detail
 // ---------------------------------------------------------------------------
 #[derive(Debug, Clone)]
 pub struct Facet {
    pub name: String,
    pub value: String,
 }
 /// One `article_assessments` row.
 #[derive(Debug, Clone)]
 pub struct AssessmentView {
    pub stage: String,
    pub rejected: bool,
    pub model: String,
    pub prompt_version: i64,
    pub profile_version: String,
    pub score: String,
    pub fit: String,
    pub kind: String,
    pub rationale: String,
    pub category: String,
    pub paywalled: bool,
    pub assessed_at: String,
    pub facets: Vec<Facet>,
 }
 /// One `candidate_runs` row of the article, newest first.
 #[derive(Debug, Clone)]
 pub struct HistoryRow {
    pub run_id: i64,
    pub run_href: String,
    pub date: String,
    pub status: String,
    pub stage: String,
    pub reason: Option<String>,
    pub admitted_first: Option<String>,
    pub admitted_rest: String,
    pub utility: String,
    pub rank: String,
    pub cluster: String,
    pub editor_why: Option<String>,
    pub signals: SignalsView,
 }
 #[derive(Debug, Clone)]
 pub struct EmbeddingView {
    pub model: String,
    pub dimension: i64,
    pub created_at: String,
    pub input_hash: String,
 }
 #[derive(Debug, Clone)]
 pub struct RatingEventView {
    pub id: i64,
    pub event_at: String,
    pub issue_date: Option<String>,
    pub kind: String,
    pub source: String,
    pub label: String,
    pub label_class: &'static str,
    pub value: String,
    pub note: Option<String>,
    pub user: Option<String>,
 }
 #[derive(Debug, Clone)]
 struct InIssue {
    date: String,
    href: String,
    section: String,
    position: i64,
    is_lead: bool,
 }
 #[derive(Debug, Clone)]
 struct SourceLine {
    kind: String,
    feed: String,
    category: Option<String>,
 }
 #[derive(Debug, Clone)]
 struct SocialLine {
    source: String,
    score: i64,
    comments: i64,
    url: Option<String>,
 }
 #[derive(Template)]
 #[template(path = "dashboard/article.html")]
 struct ArticleTemplate {
    page: Page,
    id: ArticleId,
    title: String,
    url: String,
    canonical_url: String,
    feed: String,
    feed_id: i64,
    category: Option<String>,
    author: Option<String>,
    published_at: String,
    first_seen: String,
    words: i64,
    excerpt_only: bool,
    image_count: i64,
    sources: Vec<SourceLine>,
    social: Vec<SocialLine>,
    in_issues: Vec<InIssue>,
    rating: Option<String>,
    rating_class: &'static str,
    widget: RatingWidget,
    explain: Option<String>,
    assessments: Vec<AssessmentView>,
    history: Vec<HistoryRow>,
    latest_signals: Option<SignalsView>,
    embedding: Option<EmbeddingView>,
    events: Vec<RatingEventView>,
 }
 pub async fn assessments(
    db: &Db,
    article_id: ArticleId,
    config: &Config,
 ) -> Result<Vec<AssessmentView>, sqlx::Error> {
    let rows = sqlx::query(
        "SELECT stage, model, prompt_version, profile_version, score, fit, kind, facets_json,
                rationale, category, paywalled_guess, assessed_at
         FROM article_assessments WHERE article_id = ? ORDER BY stage DESC",
    )
    .bind(article_id)
    .fetch_all(db.pool())
    .await?;
    Ok(rows
        .iter()
        .map(|row| {
            let kind: Option<String> = row.get("kind");
            let facets = row
                .get::<Option<String>, _>("facets_json")
                .and_then(|raw| serde_json::from_str::<serde_json::Value>(&raw).ok())
                .and_then(|value| value.as_object().cloned())
                .map(|object| {
                    object
                        .into_iter()
                        .map(|(name, value)| Facet {
                            name,
                            value: match value {
                                serde_json::Value::String(text) => text,
                                serde_json::Value::Array(items) => items
                                    .iter()
                                    .map(|item| {
                                        item.as_str()
                                            .map(str::to_string)
                                            .unwrap_or_else(|| item.to_string())
                                    })
                                    .collect::<Vec<_>>()
                                    .join(", "),
                                other => other.to_string(),
                            },
                        })
                        .collect()
                })
                .unwrap_or_default();
            AssessmentView {
                stage: row.get("stage"),
                rejected: kind.as_deref() == Some(PROVIDER_REJECTED),
                model: row.get("model"),
                prompt_version: row.get("prompt_version"),
                profile_version: fmt_opt_int(row.get("profile_version")),
                score: fmt_opt(row.get("score"), 1),
                fit: fmt_opt(row.get("fit"), 1),
                kind: kind.unwrap_or_else(|| "—".into()),
                rationale: row
                    .get::<Option<String>, _>("rationale")
                    .unwrap_or_default(),
                category: row
                    .get::<Option<String>, _>("category")
                    .unwrap_or_else(|| "—".into()),
                paywalled: row.get::<i64, _>("paywalled_guess") != 0,
                assessed_at: fmt_stored_time(Some(&row.get::<String, _>("assessed_at")), config),
                facets,
            }
        })
        .collect())
 }
 pub async fn run_history(db: &Db, article_id: ArticleId) -> Result<Vec<HistoryRow>, sqlx::Error> {
    let rows = sqlx::query(
        "SELECT cr.run_id, r.date, r.status, cr.stage, cr.excluded_reason, cr.admitted_by,
                cr.signals_json, cr.utility, cr.rank_utility, cr.cluster_id, cr.cluster_rank,
                cr.editor_why
         FROM candidate_runs cr JOIN runs r ON r.id = cr.run_id
         WHERE cr.article_id = ? ORDER BY cr.run_id DESC",
    )
    .bind(article_id)
    .fetch_all(db.pool())
    .await?;
    Ok(rows
        .iter()
        .map(|row| {
            let run_id: i64 = row.get("run_id");
            let (admitted_first, rest) =
                admitted_by_parts(row.get::<Option<String>, _>("admitted_by").as_deref());
            HistoryRow {
                run_id,
                run_href: format!("/dashboard/runs/{run_id}"),
                date: row.get("date"),
                status: row.get("status"),
                stage: row.get("stage"),
                reason: row.get("excluded_reason"),
                admitted_first,
                admitted_rest: rest.join(", "),
                utility: fmt_opt(row.get("utility"), 1),
                rank: fmt_opt_int(row.get("rank_utility")),
                cluster: match (
                    row.get::<Option<i64>, _>("cluster_id"),
                    row.get::<Option<i64>, _>("cluster_rank"),
                ) {
                    (Some(id), Some(rank)) => format!("{id} · {rank}"),
                    (Some(id), None) => id.to_string(),
                    _ => "—".into(),
                },
                editor_why: row.get("editor_why"),
                signals: SignalsView::from_json(&row.get::<String, _>("signals_json")),
            }
        })
        .collect())
 }
 pub async fn rating_events(
    db: &Db,
    article_id: ArticleId,
    config: &Config,
 ) -> Result<Vec<RatingEventView>, sqlx::Error> {
    let rows = sqlx::query(
        "SELECT re.id, re.issue_date, re.kind, re.source, re.label, re.value, re.note,
                re.event_at, u.username
         FROM rating_events re LEFT JOIN users u ON u.id = re.user_id
         WHERE re.article_id = ? ORDER BY re.event_at DESC, re.id DESC",
    )
    .bind(article_id)
    .fetch_all(db.pool())
    .await?;
    Ok(rows
        .iter()
        .map(|row| {
            let label: String = row.get("label");
            RatingEventView {
                id: row.get("id"),
                event_at: fmt_stored_time(Some(&row.get::<String, _>("event_at")), config),
                issue_date: row.get("issue_date"),
                kind: row.get("kind"),
                source: row.get("source"),
                label_class: widget_label(Some(&label)),
                label,
                value: format!("{:.2}", row.get::<f64, _>("value")),
                note: row.get("note"),
                user: row.get("username"),
            }
        })
        .collect())
 }
 async fn embedding(
    db: &Db,
    article_id: ArticleId,
    config: &Config,
 ) -> Result<Option<EmbeddingView>, sqlx::Error> {
    let row = sqlx::query(
        "SELECT model, dimension, created_at, input_hash FROM article_embeddings
         WHERE article_id = ?",
    )
    .bind(article_id)
    .fetch_optional(db.pool())
    .await?;
    Ok(row.map(|row| EmbeddingView {
        model: row.get("model"),
        dimension: row.get("dimension"),
        created_at: fmt_stored_time(Some(&row.get::<String, _>("created_at")), config),
        input_hash: row.get("input_hash"),
    }))
 }
 async fn detail(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
    Path(id): Path<ArticleId>,
 ) -> Result<Response, WebError> {
    let viewer = auth.user().await.map(Viewer::from);
    let config = state.config();
    let db = &state.db;
    let Some(article) = db.get_article(id).await? else {
        return Err(WebError::NotFound);
    };
    let in_issues = sqlx::query(
        "SELECT issue_date, section, position, is_lead FROM issue_articles
         WHERE article_id = ? ORDER BY issue_date DESC",
    )
    .bind(id)
    .fetch_all(db.pool())
    .await
    .map_err(db_err)?
    .iter()
    .map(|row| {
        let date: String = row.get("issue_date");
        InIssue {
            href: format!("/issues/{date}/articles/{id}"),
            date,
            section: row.get("section"),
            position: row.get("position"),
            is_lead: row.get("is_lead"),
        }
    })
    .collect::<Vec<_>>();
    let events = rating_events(db, id, &config).await.map_err(db_err)?;
    let rating = events
        .iter()
        .find(|event| event.kind == "explicit")
        .map(|event| event.label.clone());
    let widget = RatingWidget {
        article_id: id,
        issue_date: in_issues
            .first()
            .map(|issue| issue.date.clone())
            .unwrap_or_default(),
        next: format!("/dashboard/articles/{id}"),
        current: widget_label(rating.as_deref()).to_string(),
        show_note: true,
    };
    let history = run_history(db, id).await.map_err(db_err)?;
    let explain = match history.first() {
        Some(latest) => match telemetry::explain_row(db, latest.run_id, id)
            .await
            .map_err(db_err)?
        {
            Some(row) => Some(telemetry::render_explain(db, &row).await.map_err(db_err)?),
            None => None,
        },
        None => None,
    };
    let latest_signals = history
        .first()
        .map(|latest| latest.signals.clone())
        .filter(|signals| !signals.empty);
    let assessments = assessments(db, id, &config).await.map_err(db_err)?;
    let embedding = embedding(db, id, &config).await.map_err(db_err)?;
    let mut page = Page::new(article.title.clone(), viewer, "articles");
    page.flash = take_flash(&session).await?;
    Ok(Html(ArticleTemplate {
        page,
        id,
        title: article.title.clone(),
        url: article.url.clone(),
        canonical_url: article.canonical_url.clone(),
        feed: article.feed_title.clone(),
        feed_id: article.feed_id,
        category: article.category.clone(),
        author: article.author.clone(),
        published_at: article
            .published_at
            .map(|at| crate::web::format_time(at, &config))
            .unwrap_or_else(|| "—".into()),
        first_seen: crate::web::format_time(article.first_seen, &config),
        words: article.word_count,
        excerpt_only: article.excerpt_only,
        image_count: article.image_count,
        sources: article
            .sources
            .iter()
            .map(|source| SourceLine {
                kind: format!("{:?}", source.kind),
                feed: source.feed_title.clone(),
                category: source.category.clone(),
            })
            .collect(),
        social: article
            .social
            .iter()
            .map(|social| SocialLine {
                source: format!("{:?}", social.source).to_lowercase(),
                score: social.score,
                comments: social.num_comments,
                url: social.item_url.clone(),
            })
            .collect(),
        in_issues,
        rating_class: widget_label(rating.as_deref()),
        rating,
        widget,
        explain,
        assessments,
        history,
        latest_signals,
        embedding,
        events,
    })
    .into_response())
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use crate::web::dashboard::tests::{
        app_with_users, assert_admin_only, get, login_cookie, seed,
    };
    fn query(f: impl FnOnce(&mut ArticlesQuery)) -> ArticleFilters {
        let mut query = ArticlesQuery::default();
        f(&mut query);
        ArticleFilters::from_query(&query)
    }
    #[tokio::test]
    async fn articles_list_filters_and_sorts_are_allow_listed() {
        let seed = seed().await;
        let db = &seed.db;
        let config = Config::default();
        let all = query(|_| {});
        assert_eq!(all.sort, "first_seen");
        let (rows, pagination) = list_articles(db, &config, &all, 1).await.unwrap();
        assert_eq!(pagination.total, 8);
        assert_eq!(rows.len(), 8);
        let one = rows.iter().find(|row| row.id == 1).unwrap();
        assert_eq!(one.stage.as_deref(), Some("selected"), "latest run's row");
        assert_eq!(one.run_id, Some(seed.run_id));
        assert_eq!(one.rating.as_deref(), Some("loved"));
        assert_eq!(one.published.as_deref(), Some("2026-09-02"));
        assert_eq!(one.quality, "8.8");
        let bogus = query(|q| {
            q.sort = Some("id; DROP TABLE articles".into());
            q.stage = Some("nope".into());
            q.rated = Some("' OR 1=1".into());
            q.from = Some("not a date".into());
            q.feed = Some("abc".into());
        });
        assert_eq!(bogus.sort, "first_seen");
        assert_eq!(bogus.stage, None);
        assert_eq!(bogus.rated, None);
        assert_eq!(bogus.from, None);
        assert_eq!(bogus.feed, None);
        let (rows, _) = list_articles(db, &config, &bogus, 1).await.unwrap();
        assert_eq!(rows.len(), 8, "unknown values fall back, never error");
        let by_feed = query(|q| q.feed = Some("20".into()));
        let (rows, _) = list_articles(db, &config, &by_feed, 1).await.unwrap();
        assert_eq!(rows.len(), 4);
        assert!(rows.iter().all(|row| row.feed == "Beta Weekly"));
        let selected = query(|q| q.stage = Some("selected".into()));
        let (rows, _) = list_articles(db, &config, &selected, 1).await.unwrap();
        assert_eq!(rows.len(), 2);
        let reason = query(|q| q.reason = Some("blocked".into()));
        let (rows, _) = list_articles(db, &config, &reason, 1).await.unwrap();
        assert_eq!(rows.len(), 1);
        assert_eq!(rows[0].id, 7);
        let loved = query(|q| q.rated = Some("loved".into()));
        let (rows, _) = list_articles(db, &config, &loved, 1).await.unwrap();
        assert_eq!(rows.len(), 1);
        assert_eq!(rows[0].id, 1);
        let good = query(|q| q.rated = Some("good".into()));
        let (rows, _) = list_articles(db, &config, &good, 1).await.unwrap();
        assert!(rows.is_empty(), "superseded events do not count");
        let unrated = query(|q| q.rated = Some("none".into()));
        let (rows, _) = list_articles(db, &config, &unrated, 1).await.unwrap();
        assert_eq!(rows.len(), 7);
        let published = query(|q| q.published = Some("yes".into()));
        let (rows, _) = list_articles(db, &config, &published, 1).await.unwrap();
        assert_eq!(rows.len(), 2);
        let window = query(|q| {
            q.from = Some("2026-09-02".into());
            q.to = Some("2026-09-02".into());
        });
        let (rows, _) = list_articles(db, &config, &window, 1).await.unwrap();
        assert_eq!(rows.len(), 3, "ids 1, 4, 7 were first seen on the 2nd");
        let kind = query(|q| q.kind = Some("provider_rejected".into()));
        let (rows, _) = list_articles(db, &config, &kind, 1).await.unwrap();
        assert_eq!(rows.len(), 1);
        assert_eq!(rows[0].id, 3);
        let search = query(|q| q.q = Some("example.com/8".into()));
        let (rows, _) = list_articles(db, &config, &search, 1).await.unwrap();
        assert_eq!(rows.len(), 1);
        assert_eq!(rows[0].id, 8);
        let by_words = query(|q| q.sort = Some("words".into()));
        let (rows, _) = list_articles(db, &config, &by_words, 1).await.unwrap();
        assert_eq!(rows[0].id, 8);
        let by_utility = query(|q| q.sort = Some("utility".into()));
        let (rows, _) = list_articles(db, &config, &by_utility, 1).await.unwrap();
        assert_eq!(rows[0].id, 1);
        assert_eq!(rows[7].utility, "—");
        let by_title = query(|q| q.sort = Some("title".into()));
        let (rows, _) = list_articles(db, &config, &by_title, 1).await.unwrap();
        assert_eq!(rows[0].id, 1);
    }
    #[tokio::test]
    async fn article_detail_shows_assessments_run_history_and_rating_events() {
        let seed = seed().await;
        let config = Config::default();
        let views = assessments(&seed.db, 1, &config).await.unwrap();
        assert_eq!(views.len(), 2);
        assert_eq!(views[0].stage, "triage");
        assert_eq!(views[0].score, "7.0");
        assert_eq!(views[1].stage, "deep");
        assert_eq!(views[1].fit, "6.0");
        assert_eq!(views[1].category, "Top Stories");
        assert_eq!(views[1].facets[0].name, "depth");
        let rejected = assessments(&seed.db, 3, &config).await.unwrap();
        assert!(rejected[0].rejected);
        let history = run_history(&seed.db, 1).await.unwrap();
        assert_eq!(history.len(), 2);
        assert_eq!(history[0].run_id, seed.run_id);
        assert_eq!(history[0].stage, "selected");
        assert_eq!(history[0].admitted_first.as_deref(), Some("triage"));
        assert_eq!(history[1].run_id, seed.earlier_run_id);
        assert!(history[1].signals.empty);
        let events = rating_events(&seed.db, 1, &config).await.unwrap();
        assert_eq!(events.len(), 2);
        assert_eq!(events[0].label, "loved");
        assert_eq!(events[1].label, "good");
        assert_eq!(events[1].note.as_deref(), Some("note good"));
        let app = app_with_users(&seed.db).await;
        let list = assert_admin_only(&app, "/dashboard/articles").await;
        assert!(list.contains("Article 1 about prose"), "{list}");
        assert!(list.contains("/dashboard/articles/1"), "{list}");
        let body = assert_admin_only(&app, "/dashboard/articles/1").await;
        assert!(body.contains("Careful and first-hand"), "{body}");
        assert!(body.contains("A specific argument"), "{body}");
        assert!(body.contains("topic_group"), "{body}");
        assert!(
            body.contains(&format!("/dashboard/runs/{}", seed.earlier_run_id)),
            "{body}"
        );
        assert!(body.contains("note good"), "{body}");
        assert!(body.contains("note loved"), "{body}");
        assert!(body.contains("voyage-4-lite"), "{body}");
        assert!(body.contains("abc123"), "{body}");
        assert!(body.contains("Gaussian Splatting"), "{body}");
        assert!(
            body.contains("article 1: Article 1 about prose"),
            "explain: {body}"
        );
        assert!(body.contains("name=\"note\""), "note field: {body}");
        assert!(
            body.contains("value=\"loved\" data-label=\"loved\" class=\"active\""),
            "{body}"
        );
        assert!(body.contains("Top Stories"), "{body}");
        assert!(body.contains("Alpha Blog"), "{body}");
        let rejected = assert_admin_only(&app, "/dashboard/articles/3").await;
        assert!(rejected.contains("rejected by provider"), "{rejected}");
        assert!(rejected.contains("Content Exists Risk"), "{rejected}");
        let admin = login_cookie(&app, "admin", "correct horse battery").await;
        let missing = get(&app, "/dashboard/articles/999", Some(&admin)).await;
        assert_eq!(missing.status(), axum::http::StatusCode::NOT_FOUND);
        let filtered = get(
            &app,
            "/dashboard/articles?rated=loved&sort=nope&feed=x&page=0",
            Some(&admin),
        )
        .await;
        assert_eq!(filtered.status(), axum::http::StatusCode::OK);
        let filtered = crate::web::dashboard::tests::response_text(filtered).await;
        assert!(filtered.contains("Article 1 about prose"), "{filtered}");
        assert!(!filtered.contains("Article 2 about graphs"), "{filtered}");
    }
 }
@@ -0,0 +1,638 @@
 //! Dashboard: the Jobs pages (`/dashboard/jobs`, dashboard plan §14.4).
 //!
 //! The catalogue as cards, the `jobs` table, `POST /dashboard/jobs/{name}`
 //! (insert `requested`, ask the runner to start the unit) and the job page
 //! with the live unit status and the journal tail. The server never runs the
 //! pipeline in-process: `job run` inside the unit does the work (§14.2).
 use askama::Template;
 use axum::Router;
 use axum::body::Bytes;
 use axum::extract::{Extension, Path, State};
 use axum::http::StatusCode;
 use axum::response::{IntoResponse, Redirect, Response};
 use axum::routing::get;
 use axum_login::tower_sessions::Session;
 use jiff::Timestamp;
 use crate::config::Config;
 use crate::jobs::{self, EXITED_BEFORE_START, Job, JobRow};
 use crate::server::AppState;
 use crate::web::session::{AuthSession, Viewer};
 use crate::web::{Flash, Html, Page, UnitStatus, WebError, take_flash};
 use super::{db_err, duration_between, fmt_duration, fmt_stored_time};
 /// Routes contributed by this page group (merged by `dashboard::router`).
 pub fn routes() -> Router<AppState> {
    Router::new()
        .route("/dashboard/jobs", get(index))
        .route("/dashboard/jobs/{key}", get(show).post(start))
 }
 /// How many rows the jobs table shows.
 const TABLE_ROWS: i64 = 200;
 /// A `requested` row whose unit already stopped with a failure this long after
 /// the request is marked failed (§14.4).
 const EXIT_GRACE_SECS: i64 = 30;
 #[derive(Debug, Clone)]
 struct JobCard {
    name: String,
    description: &'static str,
    dangerous: bool,
    /// The `generate` card carries the date input for `generate-YYYY-MM-DD`.
    dated: bool,
    lock: Option<&'static str>,
 }
 #[derive(Debug, Clone)]
 struct JobLine {
    id: i64,
    name: String,
    requested_by: String,
    requested: String,
    started: String,
    finished: String,
    duration: String,
    status: String,
    message: Option<String>,
    run_id: Option<i64>,
 }
 #[derive(Template)]
 #[template(path = "dashboard/jobs.html")]
 struct JobsTemplate {
    page: Page,
    jobs_enabled: bool,
    cards: Vec<JobCard>,
    jobs: Vec<JobLine>,
    today: String,
 }
 #[derive(Template)]
 #[template(path = "dashboard/job.html")]
 struct JobTemplate {
    page: Page,
    job: JobLine,
    unit: String,
    description: &'static str,
    refresh: bool,
    status: Option<UnitStatus>,
    status_error: Option<String>,
    log: String,
    log_error: Option<String>,
    log_lines: u32,
 }
 fn cards() -> Vec<JobCard> {
    Job::CATALOGUE
        .iter()
        .map(|job| JobCard {
            name: job.name(),
            description: job.description(),
            dangerous: job.dangerous(),
            dated: matches!(job, Job::Generate { .. }),
            lock: job.takes_lock(),
        })
        .collect()
 }
 fn job_line(row: &JobRow, config: &Config) -> JobLine {
    JobLine {
        id: row.id,
        name: row.name.clone(),
        requested_by: match (&row.requested_by_name, row.requested_by) {
            (Some(name), _) => name.clone(),
            (None, Some(id)) => format!("user {id}"),
            (None, None) => "by hand".into(),
        },
        requested: fmt_stored_time(Some(&row.requested_at), config),
        started: fmt_stored_time(row.started_at.as_deref(), config),
        finished: fmt_stored_time(row.finished_at.as_deref(), config),
        duration: fmt_duration(
            row.started_at
                .as_deref()
                .and_then(|started| duration_between(started, row.finished_at.as_deref())),
        ),
        status: row.status.clone(),
        message: row.message.clone(),
        run_id: row.run_id,
    }
 }
 async fn jobs_template(
    state: &AppState,
    viewer: Option<Viewer>,
    flash: Option<Flash>,
 ) -> Result<JobsTemplate, WebError> {
    let config = state.config();
    let rows = jobs::list(&state.db, TABLE_ROWS).await.map_err(db_err)?;
    let mut page = Page::new("Jobs", viewer, "dashboard");
    page.flash = flash;
    let today = config
        .tz()
        .map(|tz| Timestamp::now().to_zoned(tz).date().to_string())
        .unwrap_or_else(|_| {
            Timestamp::now()
                .to_zoned(jiff::tz::TimeZone::UTC)
                .date()
                .to_string()
        });
    Ok(JobsTemplate {
        page,
        jobs_enabled: config.server.jobs_enabled,
        cards: cards(),
        jobs: rows.iter().map(|row| job_line(row, &config)).collect(),
        today,
    })
 }
 /// `GET /dashboard/jobs`: the catalogue cards and the jobs table.
 async fn index(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
 ) -> Result<Response, WebError> {
    let viewer = auth.user().await.map(Viewer::from);
    let flash = take_flash(&session).await?;
    Ok(Html(jobs_template(&state, viewer, flash).await?).into_response())
 }
 /// The `date` field of the start form, when present and non-empty.
 fn form_date(body: &[u8]) -> Option<String> {
    url::form_urlencoded::parse(body)
        .find(|(key, _)| key == "date")
        .map(|(_, value)| value.trim().to_string())
        .filter(|value| !value.is_empty())
 }
 async fn set_flash(session: &Session, kind: &str, text: String) -> Result<(), WebError> {
    session
        .insert(
            "flash",
            Flash {
                kind: kind.into(),
                text,
            },
        )
        .await
        .map_err(|error| WebError::Internal(error.into()))
 }
 /// `POST /dashboard/jobs/{name}` (admin, origin-checked): parse the name,
 /// refuse a duplicate `requested`/`running` unit (409), insert `requested`,
 /// start the unit; a failed start marks the row `failed`.
 async fn start(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
    Path(name): Path<String>,
    body: Bytes,
 ) -> Result<Response, WebError> {
    let viewer = auth
        .user()
        .await
        .map(Viewer::from)
        .ok_or_else(|| WebError::Unauthenticated {
            next: "/dashboard/jobs".into(),
        })?;
    let mut job = Job::parse(&name).ok_or(WebError::NotFound)?;
    if let (Job::Generate { date: None }, Some(date)) = (job, form_date(&body)) {
        let parsed = date
            .parse::<jiff::civil::Date>()
            .map_err(|_| WebError::BadRequest(format!("invalid date {date:?}")))?;
        job = Job::Generate { date: Some(parsed) };
    }
    let config = state.config();
    if !config.server.jobs_enabled {
        set_flash(
            &session,
            "error",
            "Jobs are disabled on this server (server.jobs_enabled = false).".into(),
        )
        .await?;
        return Ok(Redirect::to("/dashboard/jobs").into_response());
    }
    let unit = job.unit();
    if let Some(active) = jobs::active_for_unit(&state.db, &unit)
        .await
        .map_err(db_err)?
    {
        let flash = Flash {
            kind: "error".into(),
            text: format!(
                "{} is already requested or running (job {active}).",
                job.name()
            ),
        };
        let template = jobs_template(&state, Some(viewer), Some(flash)).await?;
        return Ok((StatusCode::CONFLICT, Html(template)).into_response());
    }
    // Pick up a hand-edited config.toml before the unit starts (§4.2); a file
    // that no longer loads keeps the previous config live and is only logged.
    if let Err(error) = crate::web::WebState::reload_if_changed(&state) {
        tracing::warn!(%error, "config.toml on disk does not load; keeping the previous config");
    }
    let now = Timestamp::now();
    let id = jobs::insert_requested(&state.db, &job, Some(viewer.id), now)
        .await
        .map_err(db_err)?;
    match state.web.jobs.start(&unit).await {
        Ok(()) => {
            tracing::info!(user = %viewer.username, job = %job.name(), job_id = id, %unit, "job requested");
            set_flash(&session, "success", format!("Started {}.", job.name())).await?;
        }
        Err(error) => {
            tracing::warn!(user = %viewer.username, job = %job.name(), job_id = id, %unit, %error, "job start failed");
            jobs::finish(
                &state.db,
                id,
                jobs::Outcome::Failed,
                &format!("could not start {unit}: {error}"),
                None,
                Timestamp::now(),
            )
            .await
            .map_err(db_err)?;
            set_flash(
                &session,
                "error",
                format!("Could not start {}: {error}", job.name()),
            )
            .await?;
        }
    }
    Ok(Redirect::to(&format!("/dashboard/jobs/{id}")).into_response())
 }
 /// `GET /dashboard/jobs/{id}`: the row, the live unit status and the journal
 /// tail; applies the 30-second "unit exited before the job started" rule.
 async fn show(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
    Path(key): Path<String>,
 ) -> Result<Response, WebError> {
    let viewer = auth.user().await.map(Viewer::from);
    let id: i64 = key.parse().map_err(|_| WebError::NotFound)?;
    let config = state.config();
    let db = &state.db;
    let mut row = jobs::get(db, id)
        .await
        .map_err(db_err)?
        .ok_or(WebError::NotFound)?;
    let job = Job::parse(&row.name);
    let (status, status_error) = match state.web.jobs.status(&row.unit).await {
        Ok(status) => (Some(status), None),
        Err(error) => (None, Some(error)),
    };
    if let Some(status) = &status
        && row.status == "requested"
        && status.exited_unsuccessfully()
        && requested_secs_ago(&row, Timestamp::now()) >= EXIT_GRACE_SECS
    {
        jobs::finish(
            db,
            id,
            jobs::Outcome::Failed,
            EXITED_BEFORE_START,
            None,
            Timestamp::now(),
        )
        .await
        .map_err(db_err)?;
        row = jobs::get(db, id)
            .await
            .map_err(db_err)?
            .ok_or(WebError::NotFound)?;
    }
    let lines = config.server.journal_lines;
    let (log, log_error) = match state.web.jobs.log(&row.unit, lines as usize).await {
        Ok(log) => (log, None),
        Err(error) => (String::new(), Some(error)),
    };
    let mut page = Page::new(format!("Job {id} · {}", row.name), viewer, "dashboard");
    page.flash = take_flash(&session).await?;
    Ok(Html(JobTemplate {
        page,
        refresh: row.is_active(),
        unit: row.unit.clone(),
        description: job.map(|job| job.description()).unwrap_or(""),
        job: job_line(&row, &config),
        status,
        status_error,
        log,
        log_error,
        log_lines: lines,
    })
    .into_response())
 }
 fn requested_secs_ago(row: &JobRow, now: Timestamp) -> i64 {
    row.requested_at
        .parse::<Timestamp>()
        .map(|requested| now.as_second() - requested.as_second())
        .unwrap_or(i64::MAX)
 }
 #[cfg(test)]
 mod tests {
    use std::sync::Arc;
    use axum::body::Body;
    use axum::http::{Method, Request, header};
    use tower::ServiceExt;
    use super::*;
    use crate::db::Db;
    use crate::server::router;
    use crate::web::MockRunner;
    use crate::web::dashboard::tests::{assert_admin_only, get, login_cookie, response_text};
    async fn app_with_runner(
        config: Config,
        runner: Arc<dyn crate::web::JobRunner>,
    ) -> (tempfile::TempDir, Db, axum::Router) {
        let dir = tempfile::tempdir().unwrap();
        let db = Db::open_and_migrate(&dir.path().join("db.sqlite"))
            .await
            .unwrap();
        crate::web::users::add(&db, "reader", "correct horse battery", false)
            .await
            .unwrap();
        crate::web::users::add(&db, "admin", "correct horse battery", true)
            .await
            .unwrap();
        let app = router(AppState::with_jobs(db.clone(), config, None, runner));
        (dir, db, app)
    }
    async fn post(app: &axum::Router, uri: &str, body: &str, cookie: &str) -> Response {
        app.clone()
            .oneshot(
                Request::builder()
                    .method(Method::POST)
                    .uri(uri)
                    .header(header::COOKIE, cookie)
                    .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
                    .header("sec-fetch-site", "same-origin")
                    .body(Body::from(body.to_string()))
                    .unwrap(),
            )
            .await
            .unwrap()
    }
    fn location(response: &Response) -> String {
        response
            .headers()
            .get(header::LOCATION)
            .unwrap()
            .to_str()
            .unwrap()
            .to_string()
    }
    #[test]
    fn form_date_reads_the_optional_field() {
        assert_eq!(form_date(b"date=2026-09-03"), Some("2026-09-03".into()));
        assert_eq!(form_date(b"date=+2026-09-03+"), Some("2026-09-03".into()));
        assert_eq!(form_date(b"date="), None);
        assert_eq!(form_date(b""), None);
        assert_eq!(form_date(b"other=1"), None);
    }
    #[tokio::test]
    async fn jobs_page_lists_the_catalogue_and_the_table() {
        let runner = Arc::new(MockRunner::default());
        let (_dir, db, app) = app_with_runner(Config::default(), runner).await;
        let now: Timestamp = "2026-09-03T10:00:00Z".parse().unwrap();
        let id = jobs::insert_requested(&db, &Job::FeaturesPrune, None, now)
            .await
            .unwrap();
        jobs::finish(&db, id, jobs::Outcome::Ok, "pruned 0 embeddings", None, now)
            .await
            .unwrap();
        let body = assert_admin_only(&app, "/dashboard/jobs").await;
        for job in Job::CATALOGUE {
            assert!(
                body.contains(&format!("action=\"/dashboard/jobs/{}\"", job.name())),
                "{}: {body}",
                job.name()
            );
            let escaped_description = job.description().replace('\'', "&#39;");
            assert!(body.contains(&escaped_description), "{}", job.name());
        }
        assert!(body.contains("data-confirm"), "generate needs confirmation");
        assert!(body.contains("type=\"date\""), "the dated generate input");
        assert!(body.contains("pruned 0 embeddings"), "{body}");
        assert!(body.contains(&format!("/dashboard/jobs/{id}")), "{body}");
        assert!(!body.contains("style=\""), "no inline styles under the CSP");
    }
    #[tokio::test]
    async fn starting_a_job_inserts_a_row_and_starts_the_unit() {
        let runner = Arc::new(MockRunner::default());
        let (_dir, db, app) = app_with_runner(
            Config::default(),
            runner.clone() as Arc<dyn crate::web::JobRunner>,
        )
        .await;
        let admin = login_cookie(&app, "admin", "correct horse battery").await;
        let response = post(&app, "/dashboard/jobs/features-prune", "", &admin).await;
        assert_eq!(response.status(), StatusCode::SEE_OTHER);
        let target = location(&response);
        assert!(target.starts_with("/dashboard/jobs/"), "{target}");
        let row = jobs::list(&db, 10).await.unwrap().remove(0);
        assert_eq!(target, format!("/dashboard/jobs/{}", row.id));
        assert_eq!(row.name, "features-prune");
        assert_eq!(row.unit, "daily-epub-job@features-prune.service");
        assert_eq!(row.status, "requested");
        assert_eq!(row.requested_by_name.as_deref(), Some("admin"));
        assert_eq!(
            runner.calls(),
            vec!["start daily-epub-job@features-prune.service".to_string()]
        );
        // The job page shows the row, the unit and refreshes while active.
        let page = get(&app, &target, Some(&admin)).await;
        assert_eq!(page.status(), StatusCode::OK);
        let body = response_text(page).await;
        assert!(
            body.contains("daily-epub-job@features-prune.service"),
            "{body}"
        );
        assert!(body.contains("data-refresh=\"5\""), "{body}");
        assert!(body.contains("badge requested"), "{body}");
        assert!(body.contains("Started features-prune."), "the flash");
        // Simulate the unit claiming the request, then prove a running
        // duplicate is refused with 409 and no second row.
        assert_eq!(
            jobs::claim(&db, &Job::FeaturesPrune, Timestamp::now())
                .await
                .unwrap(),
            row.id
        );
        let duplicate = post(&app, "/dashboard/jobs/features-prune", "", &admin).await;
        assert_eq!(duplicate.status(), StatusCode::CONFLICT);
        let body = response_text(duplicate).await;
        assert!(body.contains("already requested or running"), "{body}");
        assert_eq!(jobs::list(&db, 10).await.unwrap().len(), 1);
        assert_eq!(
            runner
                .calls()
                .iter()
                .filter(|call| call.starts_with("start "))
                .count(),
            1,
            "no second start"
        );
        // The dated generate form starts the dated unit.
        let dated = post(&app, "/dashboard/jobs/generate", "date=2026-09-03", &admin).await;
        assert_eq!(dated.status(), StatusCode::SEE_OTHER);
        let row = jobs::list(&db, 10).await.unwrap().remove(0);
        assert_eq!(row.name, "generate-2026-09-03");
        assert_eq!(
            runner.calls().last().unwrap(),
            "start daily-epub-job@generate-2026-09-03.service"
        );
        let bad_date = post(&app, "/dashboard/jobs/generate", "date=soon", &admin).await;
        assert_eq!(bad_date.status(), StatusCode::BAD_REQUEST);
        // Unknown names never reach the runner.
        for name in ["../x", "Generate", "backup"] {
            let unknown = post(&app, &format!("/dashboard/jobs/{name}"), "", &admin).await;
            assert_eq!(unknown.status(), StatusCode::NOT_FOUND, "{name}");
        }
        assert_eq!(
            runner
                .calls()
                .iter()
                .filter(|call| call.starts_with("start "))
                .count(),
            2
        );
        // Readers cannot start jobs.
        let reader = login_cookie(&app, "reader", "correct horse battery").await;
        let forbidden = post(&app, "/dashboard/jobs/features-prune", "", &reader).await;
        assert_eq!(forbidden.status(), StatusCode::FORBIDDEN);
    }
    #[tokio::test]
    async fn a_failed_start_marks_the_row_failed() {
        let runner = Arc::new(MockRunner::default());
        runner.fail_starts(Some("polkit: access denied"));
        let (_dir, db, app) = app_with_runner(
            Config::default(),
            runner.clone() as Arc<dyn crate::web::JobRunner>,
        )
        .await;
        let admin = login_cookie(&app, "admin", "correct horse battery").await;
        let response = post(&app, "/dashboard/jobs/dry-run", "", &admin).await;
        assert_eq!(response.status(), StatusCode::SEE_OTHER);
        let row = jobs::list(&db, 10).await.unwrap().remove(0);
        assert_eq!(row.status, "failed");
        assert!(row.finished_at.is_some());
        assert_eq!(
            row.message.as_deref(),
            Some("could not start daily-epub-job@dry-run.service: polkit: access denied")
        );
        let body = response_text(get(&app, &location(&response), Some(&admin)).await).await;
        assert!(body.contains("polkit: access denied"), "{body}");
        assert!(
            !body.contains("data-refresh"),
            "a finished job does not refresh"
        );
        // The unit is free again.
        runner.fail_starts(None);
        let again = post(&app, "/dashboard/jobs/dry-run", "", &admin).await;
        assert_eq!(again.status(), StatusCode::SEE_OTHER);
        assert_eq!(jobs::list(&db, 10).await.unwrap()[0].status, "requested");
    }
    #[tokio::test]
    async fn job_page_marks_a_unit_that_exited_before_the_job_started() {
        let runner = Arc::new(MockRunner::default());
        let unit = Job::ProfileRebuild.unit();
        runner.set_status(
            &unit,
            UnitStatus {
                active_state: "inactive".into(),
                sub_state: "dead".into(),
                result: "exit-code".into(),
                exit_status: Some(1),
                started: Some("Thu 2026-09-03 05:30:01 EDT".into()),
                exited: Some("Thu 2026-09-03 05:30:02 EDT".into()),
            },
        );
        runner.set_log("Sep 03 05:30:01 daily-epub[1]: Error: profile rebuild is already running");
        let (_dir, db, app) = app_with_runner(
            Config::default(),
            runner.clone() as Arc<dyn crate::web::JobRunner>,
        )
        .await;
        let admin = login_cookie(&app, "admin", "correct horse battery").await;
        // Requested a minute ago and never claimed.
        let requested_at = Timestamp::now() - jiff::Span::new().seconds(60);
        let id = jobs::insert_requested(&db, &Job::ProfileRebuild, None, requested_at)
            .await
            .unwrap();
        let body =
            response_text(get(&app, &format!("/dashboard/jobs/{id}"), Some(&admin)).await).await;
        assert!(body.contains(EXITED_BEFORE_START), "{body}");
        assert!(body.contains("badge failed"), "{body}");
        assert!(body.contains("exit-code"), "the live unit status");
        assert!(body.contains("is already running"), "the journal tail");
        assert_eq!(jobs::get(&db, id).await.unwrap().unwrap().status, "failed");
        assert!(runner.calls().contains(&format!(
            "log {unit} {}",
            Config::default().server.journal_lines
        )));
        // A fresh request whose unit has not run yet is left alone.
        runner.set_status(
            &Job::FeaturesPrune.unit(),
            UnitStatus {
                active_state: "inactive".into(),
                sub_state: "dead".into(),
                result: "success".into(),
                ..UnitStatus::default()
            },
        );
        let fresh = jobs::insert_requested(&db, &Job::FeaturesPrune, None, Timestamp::now())
            .await
            .unwrap();
        let body =
            response_text(get(&app, &format!("/dashboard/jobs/{fresh}"), Some(&admin)).await).await;
        assert!(body.contains("badge requested"), "{body}");
        assert_eq!(
            jobs::get(&db, fresh).await.unwrap().unwrap().status,
            "requested"
        );
        let missing = get(&app, "/dashboard/jobs/999999", Some(&admin)).await;
        assert_eq!(missing.status(), StatusCode::NOT_FOUND);
    }
    #[tokio::test]
    async fn disabled_jobs_refuse_starts_without_a_row() {
        let mut config = Config::default();
        config.server.jobs_enabled = false;
        let (_dir, db, app) = app_with_runner(config, Arc::new(crate::web::DisabledRunner)).await;
        let admin = login_cookie(&app, "admin", "correct horse battery").await;
        let body = response_text(get(&app, "/dashboard/jobs", Some(&admin)).await).await;
        assert!(body.contains("Jobs are disabled"), "{body}");
        let response = post(&app, "/dashboard/jobs/features-prune", "", &admin).await;
        assert_eq!(response.status(), StatusCode::SEE_OTHER);
        assert_eq!(location(&response), "/dashboard/jobs");
        assert!(jobs::list(&db, 10).await.unwrap().is_empty());
    }
 }
@@ -0,0 +1,786 @@
 //! Dashboard: the profile page (`/dashboard/profile`, web plan §11).
 //!
 //! Edits `profile.md` with version history, shows what the loader parses out
 //! of it, the standing OPML interests by theme, the stored system prompt and
 //! the weekly learned adjustments, and offers the `profile-rebuild` job.
 use std::path::Path;
 use askama::Template;
 use axum::Router;
 use axum::extract::{Extension, Form, State};
 use axum::response::{IntoResponse, Redirect, Response};
 use axum::routing::{get, post};
 use axum_login::tower_sessions::Session;
 use jiff::Timestamp;
 use serde::Deserialize;
 use sqlx::Row;
 use crate::curate::profile::{self, KV_LEARNED_ADJUSTMENTS, ProfileFile, REBUILD_INTERVAL_DAYS};
 use crate::db::{Db, DbError, KV_TASTE_PROFILE};
 use crate::server::AppState;
 use crate::web::session::{AuthSession, Viewer};
 use crate::web::{Flash, Html, Page, WebError, format_time, take_flash};
 /// Largest `profile.md` the editor accepts (§11).
 pub const MAX_PROFILE_BYTES: usize = 64 * 1024;
 const PREVIEW_CHARS: usize = 200;
 const VERSIONS_SHOWN: i64 = 50;
 /// Routes contributed by this page group (merged by `dashboard::router`).
 pub fn routes() -> Router<AppState> {
    Router::new()
        .route("/dashboard/profile", get(show).post(save))
        .route("/dashboard/profile/restore", post(restore))
 }
 // ---------------------------------------------------------------------------
 // File handling
 // ---------------------------------------------------------------------------
 /// Normalize a submitted profile: browser textareas send CRLF, the file is LF.
 pub fn normalize(content: &str) -> String {
    let mut text = content.replace("\r\n", "\n").replace('\r', "\n");
    if !text.ends_with('\n') {
        text.push('\n');
    }
    text
 }
 /// Reject empty or oversized profiles (§11); everything else parses.
 pub fn validate(content: &str) -> Result<(), String> {
    if content.trim().is_empty() {
        return Err("the profile cannot be empty".into());
    }
    if content.len() > MAX_PROFILE_BYTES {
        return Err(format!(
            "the profile is {} bytes; the limit is {} bytes",
            content.len(),
            MAX_PROFILE_BYTES
        ));
    }
    Ok(())
 }
 /// Write `<path>.tmp` and rename it over `path`, keeping the existing file's
 /// permissions (§11).
 pub fn write_atomically(path: &Path, content: &str) -> anyhow::Result<()> {
    let mut tmp_name = path
        .file_name()
        .map(|name| name.to_os_string())
        .unwrap_or_else(|| "profile.md".into());
    tmp_name.push(".tmp");
    let tmp = path.with_file_name(tmp_name);
    let permissions = std::fs::metadata(path)
        .ok()
        .map(|metadata| metadata.permissions());
    std::fs::write(&tmp, content)
        .map_err(|error| anyhow::anyhow!("writing {}: {error}", tmp.display()))?;
    if let Some(permissions) = permissions
        && let Err(error) = std::fs::set_permissions(&tmp, permissions)
    {
        let _ = std::fs::remove_file(&tmp);
        return Err(anyhow::anyhow!(
            "preserving permissions on {}: {error}",
            tmp.display()
        ));
    }
    if let Err(error) = std::fs::rename(&tmp, path) {
        let _ = std::fs::remove_file(&tmp);
        return Err(anyhow::anyhow!(
            "renaming {} over {}: {error}",
            tmp.display(),
            path.display()
        ));
    }
    Ok(())
 }
 fn read_profile(path: &Path) -> anyhow::Result<Option<String>> {
    match std::fs::read_to_string(path) {
        Ok(content) => Ok(Some(content)),
        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(None),
        Err(error) => Err(anyhow::anyhow!("reading {}: {error}", path.display())),
    }
 }
 /// The live preview of what the loader extracts (§11): the passthrough body
 /// and the `## Interests` lines.
 pub fn preview(content: &str) -> ProfileFile {
    profile::parse_profile_str(content)
 }
 fn short_preview(content: &str) -> String {
    let mut out: String = content.chars().take(PREVIEW_CHARS).collect();
    if content.chars().count() > PREVIEW_CHARS {
        out.push('…');
    }
    out
 }
 // ---------------------------------------------------------------------------
 // Versions
 // ---------------------------------------------------------------------------
 async fn record_version(
    db: &Db,
    content: &str,
    saved_by: i64,
    now: Timestamp,
 ) -> Result<i64, WebError> {
    let row = sqlx::query(
        "INSERT INTO profile_versions (content, saved_by, saved_at) VALUES (?, ?, ?) RETURNING id",
    )
    .bind(content)
    .bind(saved_by)
    .bind(crate::db::fmt_ts(now))
    .fetch_one(db.pool())
    .await
    .map_err(DbError::from)?;
    Ok(row.get("id"))
 }
 async fn version_content(db: &Db, id: i64) -> Result<Option<String>, WebError> {
    let row = sqlx::query("SELECT content FROM profile_versions WHERE id = ?")
        .bind(id)
        .fetch_optional(db.pool())
        .await
        .map_err(DbError::from)?;
    Ok(row.map(|row| row.get("content")))
 }
 struct VersionView {
    id: i64,
    saved_at: String,
    saved_by: String,
    bytes: usize,
    preview: String,
 }
 async fn versions(db: &Db, config: &crate::config::Config) -> Result<Vec<VersionView>, WebError> {
    let rows = sqlx::query(
        "SELECT pv.id, pv.content, pv.saved_at, u.username
         FROM profile_versions pv LEFT JOIN users u ON u.id = pv.saved_by
         ORDER BY pv.id DESC LIMIT ?",
    )
    .bind(VERSIONS_SHOWN)
    .fetch_all(db.pool())
    .await
    .map_err(DbError::from)?;
    let mut out = Vec::with_capacity(rows.len());
    for row in rows {
        let content: String = row.get("content");
        let saved_at = crate::db::parse_ts(
            "profile_versions.saved_at",
            &row.get::<String, _>("saved_at"),
        )?;
        out.push(VersionView {
            id: row.get("id"),
            saved_at: format_time(saved_at, config),
            saved_by: row
                .get::<Option<String>, _>("username")
                .unwrap_or_else(|| "—".into()),
            bytes: content.len(),
            preview: short_preview(&content),
        });
    }
    Ok(out)
 }
 // ---------------------------------------------------------------------------
 // Page
 // ---------------------------------------------------------------------------
 struct ThemeView {
    name: String,
    members: String,
    count: usize,
 }
 #[derive(Template)]
 #[template(path = "dashboard/profile.html")]
 struct ProfileTemplate {
    page: Page,
    path: String,
    exists: bool,
    content: String,
    bytes: usize,
    max_bytes: usize,
    preview_body: String,
    preview_interests: Vec<String>,
    versions: Vec<VersionView>,
    opml_path: String,
    opml_count: usize,
    opml_error: String,
    themes: Vec<ThemeView>,
    prompt: String,
    prompt_chars: usize,
    prompt_version: String,
    prompt_built_at: String,
    prompt_verdicts: usize,
    learned: String,
    learned_age: String,
    rebuild_interval_days: i64,
    rebuild_due: bool,
    jobs_enabled: bool,
 }
 fn count_verdict_lines(prompt: &str) -> usize {
    prompt
        .split_once("## Recent verdicts")
        .map(|(_, rest)| rest.lines().filter(|line| !line.trim().is_empty()).count())
        .unwrap_or(0)
 }
 async fn show(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
 ) -> Result<Response, WebError> {
    let viewer = auth
        .user()
        .await
        .map(Viewer::from)
        .ok_or_else(|| WebError::Unauthenticated {
            next: "/dashboard/profile".into(),
        })?;
    let config = state.config();
    let db = &state.db;
    let now = Timestamp::now();
    let path = config.profile_path.clone();
    let stored = read_profile(&path).map_err(WebError::Internal)?;
    let exists = stored.is_some();
    let content = stored.unwrap_or_default();
    let parsed = preview(&content);
    let (opml_count, opml_error, themes) = match profile::parse_interests(&config.interests_opml) {
        Ok(interests) => {
            let themes = profile::group_into_themes(&interests)
                .into_iter()
                .map(|(name, members)| ThemeView {
                    name,
                    count: members.len(),
                    members: members.join(", "),
                })
                .collect();
            (interests.len(), String::new(), themes)
        }
        Err(error) => (0, format!("{error:#}"), Vec::new()),
    };
    let prompt = db.kv_get(KV_TASTE_PROFILE).await?.unwrap_or_default();
    let learned = db.kv_get(KV_LEARNED_ADJUSTMENTS).await?.unwrap_or_default();
    let version = profile::stored_version(db)
        .await
        .map_err(WebError::Internal)?;
    let (prompt_version, prompt_built_at, learned_age) = match version {
        Some((version, built_at)) => {
            let age_days = (now.as_second() - built_at.as_second()).max(0) / 86_400;
            (
                version.to_string(),
                format_time(built_at, &config),
                format!("{age_days} days old"),
            )
        }
        None => ("—".into(), "never".into(), "never built".into()),
    };
    let rebuild_due = profile::is_stale(db).await.map_err(WebError::Internal)?;
    let mut page = Page::new("Profile", Some(viewer), "profile");
    page.flash = take_flash(&session).await?;
    Ok(Html(ProfileTemplate {
        page,
        path: path.display().to_string(),
        exists,
        bytes: content.len(),
        max_bytes: MAX_PROFILE_BYTES,
        content,
        preview_body: parsed.body,
        preview_interests: parsed.interests,
        versions: versions(db, &config).await?,
        opml_path: config.interests_opml.display().to_string(),
        opml_count,
        opml_error,
        themes,
        prompt_chars: prompt.len(),
        prompt_verdicts: count_verdict_lines(&prompt),
        prompt,
        prompt_version,
        prompt_built_at,
        learned,
        learned_age,
        rebuild_interval_days: REBUILD_INTERVAL_DAYS,
        rebuild_due,
        jobs_enabled: config.server.jobs_enabled,
    })
    .into_response())
 }
 // ---------------------------------------------------------------------------
 // Save and restore
 // ---------------------------------------------------------------------------
 #[derive(Debug, Deserialize)]
 pub struct SaveForm {
    #[serde(default)]
    content: String,
 }
 #[derive(Debug, Deserialize)]
 pub struct RestoreForm {
    version_id: i64,
 }
 async fn flash_and_redirect(
    session: &Session,
    kind: &str,
    text: String,
 ) -> Result<Response, WebError> {
    session
        .insert(
            "flash",
            Flash {
                kind: kind.into(),
                text,
            },
        )
        .await
        .map_err(|error| WebError::Internal(error.into()))?;
    Ok(Redirect::to("/dashboard/profile").into_response())
 }
 /// Replace `profile.md` with `content`, recording the previous text as a
 /// version. Returns the new version row's id when one was written.
 async fn replace_profile(
    state: &AppState,
    viewer: &Viewer,
    content: &str,
 ) -> Result<Option<i64>, WebError> {
    let config = state.config();
    let path = config.profile_path.clone();
    let previous = read_profile(&path).map_err(WebError::Internal)?;
    let version = match previous {
        Some(previous) if previous != content => {
            Some(record_version(&state.db, &previous, viewer.id, Timestamp::now()).await?)
        }
        _ => None,
    };
    write_atomically(&path, content).map_err(WebError::Internal)?;
    Ok(version)
 }
 async fn save(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
    Form(form): Form<SaveForm>,
 ) -> Result<Response, WebError> {
    let viewer = auth
        .user()
        .await
        .map(Viewer::from)
        .ok_or_else(|| WebError::Unauthenticated {
            next: "/dashboard/profile".into(),
        })?;
    let content = normalize(&form.content);
    validate(&content).map_err(WebError::BadRequest)?;
    let config = state.config();
    let current = read_profile(&config.profile_path).map_err(WebError::Internal)?;
    if current.as_deref() == Some(content.as_str()) {
        return flash_and_redirect(&session, "info", "No changes to save.".into()).await;
    }
    replace_profile(&state, &viewer, &content).await?;
    tracing::info!(
        user = %viewer.username,
        bytes = content.len(),
        path = %config.profile_path.display(),
        "profile.md saved from the dashboard"
    );
    flash_and_redirect(
        &session,
        "success",
        "Saved; the next run rebuilds the system prompt.".into(),
    )
    .await
 }
 async fn restore(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
    Form(form): Form<RestoreForm>,
 ) -> Result<Response, WebError> {
    let viewer = auth
        .user()
        .await
        .map(Viewer::from)
        .ok_or_else(|| WebError::Unauthenticated {
            next: "/dashboard/profile".into(),
        })?;
    let content = version_content(&state.db, form.version_id)
        .await?
        .ok_or(WebError::NotFound)?;
    validate(&content).map_err(WebError::BadRequest)?;
    replace_profile(&state, &viewer, &content).await?;
    tracing::info!(
        user = %viewer.username,
        version = form.version_id,
        "profile.md restored from the dashboard"
    );
    flash_and_redirect(
        &session,
        "success",
        format!(
            "Restored version #{}; the next run rebuilds the system prompt.",
            form.version_id
        ),
    )
    .await
 }
 #[cfg(test)]
 mod tests {
    use axum::body::{Body, to_bytes};
    use axum::http::{Method, Request, StatusCode, header};
    use tower::ServiceExt;
    use super::*;
    use crate::config::Config;
    use crate::web::users;
    #[test]
    fn preview_matches_the_loader() {
        let raw = "# Reader profile\n\n## Who\nProse.\n\n## Interests\n- Rust\nBoston\n\n## Notes\nKeep.\n";
        let parsed = preview(raw);
        assert_eq!(parsed, profile::parse_profile_str(raw));
        assert_eq!(
            parsed.body,
            "# Reader profile\n\n## Who\nProse.\n\n## Notes\nKeep.\n"
        );
        assert_eq!(parsed.interests, ["Rust", "Boston"]);
    }
    #[test]
    fn normalize_and_validate_bound_the_profile() {
        assert_eq!(normalize("a\r\nb"), "a\nb\n");
        assert_eq!(normalize("a\n"), "a\n");
        assert!(validate("   \n").is_err());
        assert!(validate("# ok\n").is_ok());
        let big = "x".repeat(MAX_PROFILE_BYTES + 1);
        assert!(validate(&big).is_err());
        assert!(validate(&"x".repeat(MAX_PROFILE_BYTES)).is_ok());
        assert_eq!(short_preview("short"), "short");
        let long = "y".repeat(PREVIEW_CHARS + 5);
        assert_eq!(short_preview(&long).chars().count(), PREVIEW_CHARS + 1);
    }
    #[cfg(unix)]
    #[test]
    fn atomic_write_preserves_mode_and_leaves_no_temp_file() {
        use std::os::unix::fs::PermissionsExt;
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("profile.md");
        std::fs::write(&path, "old\n").unwrap();
        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).unwrap();
        write_atomically(&path, "new\n").unwrap();
        assert_eq!(std::fs::read_to_string(&path).unwrap(), "new\n");
        let mode = std::fs::metadata(&path).unwrap().permissions().mode() & 0o777;
        assert_eq!(mode, 0o600);
        assert!(!dir.path().join("profile.md.tmp").exists());
        // A missing file is created rather than failing.
        let fresh = dir.path().join("fresh.md");
        write_atomically(&fresh, "created\n").unwrap();
        assert_eq!(std::fs::read_to_string(&fresh).unwrap(), "created\n");
    }
    #[test]
    fn verdict_lines_are_counted_from_the_prompt() {
        assert_eq!(count_verdict_lines("no block"), 0);
        assert_eq!(
            count_verdict_lines("intro\n\n## Recent verdicts\n\nLOVED | a\nGOOD | b\n"),
            2
        );
    }
    async fn setup() -> (tempfile::TempDir, AppState, axum::Router, String) {
        let dir = tempfile::tempdir().unwrap();
        let db = Db::open_and_migrate(&dir.path().join("db.sqlite"))
            .await
            .unwrap();
        users::add(&db, "tyler", "correct horse battery", true)
            .await
            .unwrap();
        users::add(&db, "reader", "correct horse battery", false)
            .await
            .unwrap();
        let config = Config {
            profile_path: dir.path().join("profile.md"),
            interests_opml: dir.path().join("interests.opml"),
            ..Config::default()
        };
        std::fs::write(&config.profile_path, "# Original\n\nProse.\n").unwrap();
        std::fs::write(
            &config.interests_opml,
            r#"<outline text="Rust"/><outline text="Boston"/>"#,
        )
        .unwrap();
        db.kv_set(
            KV_TASTE_PROFILE,
            "system prompt text\n\n## Recent verdicts\n\nLOVED | x\n",
        )
        .await
        .unwrap();
        db.kv_set(KV_LEARNED_ADJUSTMENTS, "- Rank depth higher.")
            .await
            .unwrap();
        let state = AppState::new(db, config, None);
        let app = crate::server::router(state.clone());
        let cookie = login(&app, "tyler").await;
        (dir, state, app, cookie)
    }
    async fn login(app: &axum::Router, username: &str) -> String {
        let response = app
            .clone()
            .oneshot(
                Request::builder()
                    .method(Method::POST)
                    .uri("/login")
                    .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
                    .header("sec-fetch-site", "same-origin")
                    .header("x-forwarded-for", "192.0.2.45")
                    .body(Body::from(format!(
                        "username={username}&password=correct+horse+battery&next=%2F"
                    )))
                    .unwrap(),
            )
            .await
            .unwrap();
        assert_eq!(response.status(), StatusCode::SEE_OTHER);
        response
            .headers()
            .get(header::SET_COOKIE)
            .unwrap()
            .to_str()
            .unwrap()
            .split(';')
            .next()
            .unwrap()
            .to_string()
    }
    async fn get(app: &axum::Router, cookie: Option<&str>) -> Response {
        let mut request = Request::builder().uri("/dashboard/profile");
        if let Some(cookie) = cookie {
            request = request.header(header::COOKIE, cookie);
        }
        app.clone()
            .oneshot(request.body(Body::empty()).unwrap())
            .await
            .unwrap()
    }
    async fn post(app: &axum::Router, uri: &str, body: String, cookie: Option<&str>) -> Response {
        let mut request = Request::builder()
            .method(Method::POST)
            .uri(uri)
            .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
            .header("sec-fetch-site", "same-origin");
        if let Some(cookie) = cookie {
            request = request.header(header::COOKIE, cookie);
        }
        app.clone()
            .oneshot(request.body(Body::from(body)).unwrap())
            .await
            .unwrap()
    }
    async fn text(response: Response) -> String {
        String::from_utf8(
            to_bytes(response.into_body(), 2 * 1024 * 1024)
                .await
                .unwrap()
                .to_vec(),
        )
        .unwrap()
    }
    async fn version_rows(db: &Db) -> Vec<(i64, String, Option<i64>)> {
        sqlx::query("SELECT id, content, saved_by FROM profile_versions ORDER BY id")
            .fetch_all(db.pool())
            .await
            .unwrap()
            .into_iter()
            .map(|row| (row.get("id"), row.get("content"), row.get("saved_by")))
            .collect()
    }
    #[tokio::test]
    async fn profile_page_shows_editor_preview_interests_prompt_and_rebuild_form() {
        let (_dir, _state, app, cookie) = setup().await;
        let response = get(&app, Some(&cookie)).await;
        assert_eq!(response.status(), StatusCode::OK);
        let body = text(response).await;
        assert!(body.contains("# Original"));
        assert!(body.contains("Prose."));
        assert!(body.contains("Rust, Boston") || body.contains("Rust") && body.contains("Boston"));
        assert!(body.contains("2 interests"));
        assert!(body.contains("system prompt text"));
        assert!(body.contains("Rank depth higher."));
        assert!(body.contains("never built"));
        assert!(body.contains("rebuild is due"));
        assert!(body.contains(r#"action="/dashboard/jobs/profile-rebuild""#));
        assert!(body.contains("No saved versions yet"));
    }
    #[tokio::test]
    async fn save_writes_the_file_and_records_the_previous_version() {
        let (_dir, state, app, cookie) = setup().await;
        let admin = users::find_by_username(&state.db, "tyler")
            .await
            .unwrap()
            .unwrap();
        let response = post(
            &app,
            "/dashboard/profile",
            "content=%23+New%0D%0A%0D%0A%23%23+Interests%0D%0A-+Writerdeck%0D%0A".into(),
            Some(&cookie),
        )
        .await;
        assert_eq!(response.status(), StatusCode::SEE_OTHER);
        assert_eq!(
            response.headers().get(header::LOCATION).unwrap(),
            "/dashboard/profile"
        );
        let path = state.config().profile_path.clone();
        assert_eq!(
            std::fs::read_to_string(&path).unwrap(),
            "# New\n\n## Interests\n- Writerdeck\n"
        );
        assert!(!path.with_file_name("profile.md.tmp").exists());
        let rows = version_rows(&state.db).await;
        assert_eq!(rows.len(), 1);
        assert_eq!(rows[0].1, "# Original\n\nProse.\n");
        assert_eq!(rows[0].2, Some(admin.id));
        let page = text(get(&app, Some(&cookie)).await).await;
        assert!(page.contains("Saved; the next run rebuilds the system prompt."));
        assert!(page.contains("Writerdeck"));
        assert!(page.contains("# Original"));
        assert!(page.contains(">tyler<"));
        // Saving identical content records nothing.
        let same = post(
            &app,
            "/dashboard/profile",
            "content=%23+New%0A%0A%23%23+Interests%0A-+Writerdeck%0A".into(),
            Some(&cookie),
        )
        .await;
        assert_eq!(same.status(), StatusCode::SEE_OTHER);
        assert_eq!(version_rows(&state.db).await.len(), 1);
    }
    #[tokio::test]
    async fn restore_swaps_the_file_and_records_the_current_one() {
        let (_dir, state, app, cookie) = setup().await;
        post(
            &app,
            "/dashboard/profile",
            "content=%23+Second%0A".into(),
            Some(&cookie),
        )
        .await;
        let first = version_rows(&state.db).await[0].0;
        let response = post(
            &app,
            "/dashboard/profile/restore",
            format!("version_id={first}"),
            Some(&cookie),
        )
        .await;
        assert_eq!(response.status(), StatusCode::SEE_OTHER);
        let path = state.config().profile_path.clone();
        assert_eq!(
            std::fs::read_to_string(&path).unwrap(),
            "# Original\n\nProse.\n"
        );
        let rows = version_rows(&state.db).await;
        assert_eq!(rows.len(), 2);
        assert_eq!(rows[1].1, "# Second\n");
        let missing = post(
            &app,
            "/dashboard/profile/restore",
            "version_id=999".into(),
            Some(&cookie),
        )
        .await;
        assert_eq!(missing.status(), StatusCode::NOT_FOUND);
    }
    #[tokio::test]
    async fn empty_and_oversized_profiles_are_rejected_and_the_file_is_untouched() {
        let (_dir, state, app, cookie) = setup().await;
        let empty = post(
            &app,
            "/dashboard/profile",
            "content=+%0A".into(),
            Some(&cookie),
        )
        .await;
        assert_eq!(empty.status(), StatusCode::BAD_REQUEST);
        let big = format!("content={}", "x".repeat(MAX_PROFILE_BYTES + 10));
        let oversized = post(&app, "/dashboard/profile", big, Some(&cookie)).await;
        assert_eq!(oversized.status(), StatusCode::BAD_REQUEST);
        assert_eq!(
            std::fs::read_to_string(&state.config().profile_path).unwrap(),
            "# Original\n\nProse.\n"
        );
        assert!(version_rows(&state.db).await.is_empty());
    }
    #[tokio::test]
    async fn profile_routes_are_admin_only() {
        let (_dir, state, app, _admin) = setup().await;
        let anonymous = get(&app, None).await;
        assert_eq!(anonymous.status(), StatusCode::FOUND);
        assert_eq!(
            anonymous.headers().get(header::LOCATION).unwrap(),
            "/login?next=%2Fdashboard%2Fprofile"
        );
        let reader = login(&app, "reader").await;
        assert_eq!(
            get(&app, Some(&reader)).await.status(),
            StatusCode::FORBIDDEN
        );
        let save = post(
            &app,
            "/dashboard/profile",
            "content=%23+Hacked%0A".into(),
            Some(&reader),
        )
        .await;
        assert_eq!(save.status(), StatusCode::FORBIDDEN);
        let restore = post(
            &app,
            "/dashboard/profile/restore",
            "version_id=1".into(),
            Some(&reader),
        )
        .await;
        assert_eq!(restore.status(), StatusCode::FORBIDDEN);
        let anonymous_save = post(
            &app,
            "/dashboard/profile",
            "content=%23+Hacked%0A".into(),
            None,
        )
        .await;
        assert_eq!(anonymous_save.status(), StatusCode::FOUND);
        assert_eq!(
            std::fs::read_to_string(&state.config().profile_path).unwrap(),
            "# Original\n\nProse.\n"
        );
    }
 }
@@ -0,0 +1,647 @@
 //! Dashboard: the stats page (`/dashboard/stats`, dashboard plan §12) and the
 //! server-rendered SVG sparkline the overview shares (§9.1).
 //!
 //! The figures come from `telemetry::stats_data`, the same source as
 //! `daily-epub stats`; the page shows them as tables plus three sparklines
 //! (cost per day stacked per provider, selected per issue, ratings per week by
 //! label) and the retriever yield with its up/down ratio.
 use std::collections::BTreeMap;
 use std::fmt::Write as _;
 use askama::Template;
 use axum::Router;
 use axum::extract::{Extension, Query, State};
 use axum::response::{IntoResponse, Response};
 use axum::routing::get;
 use axum_login::tower_sessions::Session;
 use jiff::Timestamp;
 use serde::Deserialize;
 use crate::curate::telemetry::{self, StatsData};
 use crate::report::RunReport;
 use crate::server::AppState;
 use crate::web::session::{AuthSession, Viewer};
 use crate::web::{Html, Page, WebError, take_flash};
 use super::fmt_usd;
 /// Routes contributed by this page group (merged by `dashboard::router`).
 pub fn routes() -> Router<AppState> {
    Router::new().route("/dashboard/stats", get(stats))
 }
 /// The windows the page offers; anything else falls back to the first.
 pub const WINDOWS: [i64; 3] = [14, 30, 90];
 // ---------------------------------------------------------------------------
 // Sparklines (§9.1, §12)
 // ---------------------------------------------------------------------------
 const SPARK_WIDTH: f64 = 240.0;
 const SPARK_HEIGHT: f64 = 48.0;
 const SPARK_PAD: f64 = 2.0;
 /// Fill classes cycle through this many series colours (`.spark .s0` …).
 pub const SERIES_CLASSES: usize = 6;
 /// One stacked-bar segment: pre-formatted SVG coordinates, a series index for
 /// its fill class and a `<title>` label.
 #[derive(Debug, Clone, PartialEq)]
 pub struct Bar {
    pub x: String,
    pub y: String,
    pub w: String,
    pub h: String,
    pub series: usize,
    pub label: String,
 }
 #[derive(Debug, Clone, PartialEq)]
 pub struct Legend {
    pub name: String,
    pub series: usize,
 }
 /// A small SVG chart rendered by `dashboard/_sparkline.html` from numbers
 /// only — presentation attributes and classes, no inline styles (the CSP is
 /// `style-src 'self'`) and no `|safe`.
 #[derive(Debug, Clone, PartialEq)]
 pub struct Sparkline {
    pub title: String,
    pub caption: String,
    pub width: u32,
    pub height: u32,
    /// `<polyline points>` of a line chart; empty for a bar chart.
    pub points: String,
    pub bars: Vec<Bar>,
    pub legend: Vec<Legend>,
    pub first_label: String,
    pub last_label: String,
    pub empty: bool,
 }
 fn coord(value: f64) -> String {
    let text = format!("{value:.1}");
    text.strip_suffix(".0").map(str::to_string).unwrap_or(text)
 }
 impl Sparkline {
    fn blank(title: &str) -> Self {
        Self {
            title: title.to_string(),
            caption: String::new(),
            width: SPARK_WIDTH as u32,
            height: SPARK_HEIGHT as u32,
            points: String::new(),
            bars: Vec::new(),
            legend: Vec::new(),
            first_label: String::new(),
            last_label: String::new(),
            empty: true,
        }
    }
    /// A line over `values` (baseline 0), labelled with the first and last
    /// point's label; the caption reports the count and the maximum.
    pub fn line(
        title: &str,
        values: &[f64],
        labels: (&str, &str),
        unit: &str,
        format_max: impl Fn(f64) -> String,
    ) -> Self {
        let mut spark = Self::blank(title);
        if values.is_empty() {
            return spark;
        }
        let max = values.iter().copied().fold(0.0_f64, f64::max);
        let inner_w = SPARK_WIDTH - 2.0 * SPARK_PAD;
        let inner_h = SPARK_HEIGHT - 2.0 * SPARK_PAD;
        let step = if values.len() > 1 {
            inner_w / (values.len() - 1) as f64
        } else {
            0.0
        };
        let mut points = String::new();
        for (index, value) in values.iter().enumerate() {
            let x = if values.len() > 1 {
                SPARK_PAD + step * index as f64
            } else {
                SPARK_WIDTH / 2.0
            };
            let y = if max > 0.0 {
                SPARK_HEIGHT - SPARK_PAD - value.max(0.0) / max * inner_h
            } else {
                SPARK_HEIGHT - SPARK_PAD
            };
            if !points.is_empty() {
                points.push(' ');
            }
            let _ = write!(points, "{},{}", coord(x), coord(y));
        }
        spark.points = points;
        spark.caption = format!("{} {unit} · max {}", values.len(), format_max(max));
        spark.first_label = labels.0.to_string();
        spark.last_label = labels.1.to_string();
        spark.empty = false;
        spark
    }
    /// Stacked bars: one column per `(label, segments)` where each segment is
    /// `(series name, value)`; series get fill classes in first-seen order.
    pub fn stacked(
        title: &str,
        columns: &[(String, Vec<(String, f64)>)],
        unit: &str,
        format_max: impl Fn(f64) -> String,
    ) -> Self {
        let mut spark = Self::blank(title);
        if columns.is_empty() {
            return spark;
        }
        let mut series: Vec<String> = Vec::new();
        for (_, segments) in columns {
            for (name, _) in segments {
                if !series.contains(name) {
                    series.push(name.clone());
                }
            }
        }
        let max = columns
            .iter()
            .map(|(_, segments)| segments.iter().map(|(_, v)| v.max(0.0)).sum::<f64>())
            .fold(0.0_f64, f64::max);
        let inner_w = SPARK_WIDTH - 2.0 * SPARK_PAD;
        let inner_h = SPARK_HEIGHT - 2.0 * SPARK_PAD;
        let slot = inner_w / columns.len() as f64;
        let gap = if slot > 3.0 { 1.0 } else { 0.0 };
        let bar_w = (slot - gap).max(0.5);
        let mut bars = Vec::new();
        for (index, (label, segments)) in columns.iter().enumerate() {
            let x = SPARK_PAD + slot * index as f64;
            let mut top = SPARK_HEIGHT - SPARK_PAD;
            for (name, value) in segments {
                let value = value.max(0.0);
                if value <= 0.0 || max <= 0.0 {
                    continue;
                }
                let h = value / max * inner_h;
                top -= h;
                let series_index = series.iter().position(|s| s == name).unwrap_or(0);
                bars.push(Bar {
                    x: coord(x),
                    y: coord(top),
                    w: coord(bar_w),
                    h: coord(h),
                    series: series_index % SERIES_CLASSES,
                    label: format!("{label} · {name}: {}", format_max(value)),
                });
            }
        }
        spark.bars = bars;
        spark.legend = series
            .iter()
            .enumerate()
            .map(|(index, name)| Legend {
                name: name.clone(),
                series: index % SERIES_CLASSES,
            })
            .collect();
        spark.caption = format!("{} {unit} · max {}", columns.len(), format_max(max));
        spark.first_label = columns[0].0.clone();
        spark.last_label = columns[columns.len() - 1].0.clone();
        spark.empty = false;
        spark
    }
 }
 // ---------------------------------------------------------------------------
 // Stats page (§12)
 // ---------------------------------------------------------------------------
 #[derive(Debug, Deserialize)]
 pub struct StatsQuery {
    days: Option<i64>,
 }
 #[derive(Debug, Clone)]
 struct KeyValue {
    key: String,
    value: String,
 }
 #[derive(Debug, Clone)]
 struct RetrieverLine {
    retriever: String,
    rated: i64,
    up: i64,
    down: i64,
    ratio: String,
 }
 #[derive(Debug, Clone)]
 struct CostRow {
    date: String,
    cells: Vec<String>,
    total: String,
 }
 #[derive(Debug, Clone)]
 struct RunLine {
    run_id: i64,
    date: String,
    status: String,
    cost: String,
    selected: i64,
    duration: String,
 }
 #[derive(Template)]
 #[template(path = "dashboard/stats.html")]
 struct StatsTemplate {
    page: Page,
    days: i64,
    windows: Vec<i64>,
    since_date: String,
    today: String,
    summary: Vec<KeyValue>,
    ratings: Vec<KeyValue>,
    retrievers: Vec<RetrieverLine>,
    exploration: Vec<KeyValue>,
    providers: Vec<String>,
    cost_rows: Vec<CostRow>,
    cost_per_day: Vec<KeyValue>,
    runs: Vec<RunLine>,
    sparklines: Vec<Sparkline>,
    text: String,
 }
 /// `?days=` clamped to one of [`WINDOWS`].
 pub fn window(days: Option<i64>) -> i64 {
    days.filter(|days| WINDOWS.contains(days))
        .unwrap_or(WINDOWS[0])
 }
 /// `GET /dashboard/stats?days=14|30|90`.
 async fn stats(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
    Query(query): Query<StatsQuery>,
 ) -> Result<Response, WebError> {
    let viewer = auth.user().await.map(Viewer::from);
    let days = window(query.days);
    let now = Timestamp::now();
    let data = telemetry::stats_data(&state.db, days, now)
        .await
        .map_err(WebError::Internal)?;
    let text = telemetry::render_stats_text(&data);
    let summary = vec![
        KeyValue {
            key: "Issues".into(),
            value: data.issues.to_string(),
        },
        KeyValue {
            key: "Articles published".into(),
            value: data.published.to_string(),
        },
        KeyValue {
            key: "Mean issue size".into(),
            value: format!("{} articles", data.mean_issue_size()),
        },
        KeyValue {
            key: "Explicit ratings".into(),
            value: data.total_ratings.to_string(),
        },
        KeyValue {
            key: "Ratings per issue".into(),
            value: data.ratings_per_issue(),
        },
        KeyValue {
            key: "Mean generation time".into(),
            value: match data.mean_generation_secs() {
                Some(secs) => format!(
                    "{} ({} runs)",
                    RunReport::format_duration(secs),
                    data.durations.len()
                ),
                None => "n/a (0 runs)".into(),
            },
        },
    ];
    let ratings = data
        .ratings_by_label
        .iter()
        .map(|(label, n)| KeyValue {
            key: label.clone(),
            value: n.to_string(),
        })
        .collect();
    let retrievers = data
        .per_retriever
        .iter()
        .map(|(retriever, counts)| RetrieverLine {
            retriever: retriever.clone(),
            rated: counts.rated,
            up: counts.up,
            down: counts.down,
            ratio: counts.ratio(),
        })
        .collect();
    let exploration = vec![
        KeyValue {
            key: "Admitted".into(),
            value: data.exploration_admitted.to_string(),
        },
        KeyValue {
            key: "Selected".into(),
            value: data.exploration_selected.to_string(),
        },
        KeyValue {
            key: "Rated positively".into(),
            value: data.exploration_positive.to_string(),
        },
    ];
    let providers: Vec<String> = data.provider_totals.keys().cloned().collect();
    let cost_rows = data
        .cost_by_day
        .iter()
        .map(|(date, by_provider)| CostRow {
            date: date.clone(),
            cells: providers
                .iter()
                .map(|provider| {
                    by_provider
                        .get(provider)
                        .map(|usd| format!("{usd:.3}"))
                        .unwrap_or_else(|| "—".into())
                })
                .collect(),
            total: format!("{:.3}", by_provider.values().sum::<f64>()),
        })
        .collect();
    let mut cost_per_day: Vec<KeyValue> = data
        .provider_totals
        .iter()
        .map(|(provider, total)| KeyValue {
            key: provider.clone(),
            value: format!("${:.3}", data.per_day(*total)),
        })
        .collect();
    cost_per_day.push(KeyValue {
        key: "total".into(),
        value: format!("${:.3}", data.per_day(data.grand_total())),
    });
    let runs = data
        .runs
        .iter()
        .map(|run| RunLine {
            run_id: run.run_id,
            date: run.date.clone(),
            status: run.status.clone(),
            cost: fmt_usd(run.cost_usd),
            selected: run.selected,
            duration: super::fmt_duration(run.duration_secs),
        })
        .collect();
    let mut page = Page::new("Stats", viewer, "dashboard");
    page.flash = take_flash(&session).await?;
    Ok(Html(StatsTemplate {
        page,
        days,
        windows: WINDOWS.to_vec(),
        since_date: data.since_date.clone(),
        today: data.today.clone(),
        summary,
        ratings,
        retrievers,
        exploration,
        providers,
        cost_rows,
        cost_per_day,
        runs,
        sparklines: stats_sparklines(&data),
        text,
    })
    .into_response())
 }
 /// Every UTC date from `since` to `today` inclusive.
 fn dates_between(since: &str, today: &str) -> Vec<String> {
    let (Ok(mut date), Ok(end)) = (
        since.parse::<jiff::civil::Date>(),
        today.parse::<jiff::civil::Date>(),
    ) else {
        return Vec::new();
    };
    let mut dates = Vec::new();
    while date <= end && dates.len() < 400 {
        dates.push(date.to_string());
        match date.tomorrow() {
            Ok(next) => date = next,
            Err(_) => break,
        }
    }
    dates
 }
 /// The stats page's three charts (§12).
 fn stats_sparklines(data: &StatsData) -> Vec<Sparkline> {
    let providers: Vec<String> = data.provider_totals.keys().cloned().collect();
    let empty = BTreeMap::new();
    let cost_columns: Vec<(String, Vec<(String, f64)>)> =
        dates_between(&data.since_date, &data.today)
            .into_iter()
            .map(|date| {
                let by_provider = data.cost_by_day.get(&date).unwrap_or(&empty);
                let segments = providers
                    .iter()
                    .map(|provider| {
                        (
                            provider.clone(),
                            by_provider.get(provider).copied().unwrap_or(0.0),
                        )
                    })
                    .collect();
                (date, segments)
            })
            .collect();
    let cost = if data.cost_by_day.is_empty() {
        Sparkline::stacked("Cost per day", &[], "days", fmt_usd)
    } else {
        Sparkline::stacked("Cost per day", &cost_columns, "days", |usd| {
            format!("${usd:.3}")
        })
    };
    let selected_values: Vec<f64> = data
        .selected_per_issue
        .iter()
        .map(|(_, n)| *n as f64)
        .collect();
    let selected = Sparkline::line(
        "Selected per issue",
        &selected_values,
        (
            data.selected_per_issue
                .first()
                .map(|(date, _)| date.as_str())
                .unwrap_or(""),
            data.selected_per_issue
                .last()
                .map(|(date, _)| date.as_str())
                .unwrap_or(""),
        ),
        "issues",
        |n| format!("{n:.0}"),
    );
    let week_columns: Vec<(String, Vec<(String, f64)>)> = data
        .ratings_per_week
        .iter()
        .map(|(week, by_label)| {
            (
                week.clone(),
                by_label
                    .iter()
                    .map(|(label, n)| (label.clone(), *n as f64))
                    .collect(),
            )
        })
        .collect();
    let weekly = Sparkline::stacked("Ratings per week", &week_columns, "weeks", |n| {
        format!("{n:.0}")
    });
    vec![cost, selected, weekly]
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use crate::web::dashboard::tests::{
        app_with_users, assert_admin_only, get, login_cookie, response_text, seed,
    };
    #[test]
    fn window_falls_back_to_fourteen_days() {
        assert_eq!(window(None), 14);
        assert_eq!(window(Some(30)), 30);
        assert_eq!(window(Some(90)), 90);
        assert_eq!(window(Some(7)), 14);
        assert_eq!(window(Some(-1)), 14);
    }
    #[test]
    fn line_sparkline_scales_to_the_maximum_and_marks_empties() {
        let spark = Sparkline::line(
            "Cost",
            &[0.0, 2.0, 1.0],
            ("2026-09-01", "2026-09-03"),
            "runs",
            fmt_usd,
        );
        assert!(!spark.empty);
        assert_eq!(spark.points, "2,46 120,2 238,24");
        assert_eq!(spark.caption, "3 runs · max $2.00");
        assert_eq!(spark.first_label, "2026-09-01");
        assert_eq!(spark.last_label, "2026-09-03");
        assert!(spark.bars.is_empty());
        let flat = Sparkline::line("Flat", &[0.0, 0.0], ("a", "b"), "runs", fmt_usd);
        assert_eq!(flat.points, "2,46 238,46");
        let none = Sparkline::line("None", &[], ("", ""), "runs", fmt_usd);
        assert!(none.empty);
        assert!(none.points.is_empty());
    }
    #[test]
    fn stacked_sparkline_assigns_series_classes_in_first_seen_order() {
        let columns = vec![
            (
                "2026-09-01".to_string(),
                vec![("deepseek".to_string(), 0.1), ("voyage".to_string(), 0.1)],
            ),
            (
                "2026-09-02".to_string(),
                vec![("deepseek".to_string(), 0.0), ("voyage".to_string(), 0.4)],
            ),
        ];
        let spark =
            Sparkline::stacked("Cost per day", &columns, "days", |usd| format!("${usd:.3}"));
        assert!(!spark.empty);
        assert_eq!(spark.legend.len(), 2);
        assert_eq!(spark.legend[0].name, "deepseek");
        assert_eq!(spark.legend[0].series, 0);
        assert_eq!(spark.legend[1].series, 1);
        // Three visible segments: the zero-valued one is skipped.
        assert_eq!(spark.bars.len(), 3);
        assert_eq!(spark.bars[0].series, 0);
        assert_eq!(spark.bars[0].h, "11");
        assert_eq!(spark.bars[0].y, "35");
        assert_eq!(spark.bars[1].y, "24", "stacked on top of the first");
        assert_eq!(spark.bars[2].h, "44");
        assert_eq!(spark.bars[2].label, "2026-09-02 · voyage: $0.400");
        assert_eq!(spark.caption, "2 days · max $0.400");
        let none = Sparkline::stacked("None", &[], "days", fmt_usd);
        assert!(none.empty);
    }
    #[test]
    fn dates_between_is_inclusive() {
        assert_eq!(
            dates_between("2026-08-30", "2026-09-01"),
            vec!["2026-08-30", "2026-08-31", "2026-09-01"]
        );
        assert!(dates_between("2026-09-02", "2026-09-01").is_empty());
        assert!(dates_between("bad", "2026-09-01").is_empty());
    }
    #[tokio::test]
    async fn stats_page_shows_tables_sparklines_and_the_text() {
        let seed = seed().await;
        // The seed is dated 2026-09-02; the page windows on `now`, so move the
        // runs and rating events into the last hour to keep the test stable.
        let now = Timestamp::now();
        let earlier = crate::db::fmt_ts(now - jiff::Span::new().hours(1));
        sqlx::query("UPDATE runs SET started_at = ?, finished_at = ?")
            .bind(&earlier)
            .bind(crate::db::fmt_ts(now))
            .execute(seed.db.pool())
            .await
            .unwrap();
        sqlx::query("UPDATE rating_events SET event_at = ?")
            .bind(&earlier)
            .execute(seed.db.pool())
            .await
            .unwrap();
        let app = app_with_users(&seed.db).await;
        let body = assert_admin_only(&app, "/dashboard/stats").await;
        assert!(body.contains("?days=30"), "{body}");
        assert!(body.contains("?days=90"), "{body}");
        assert!(body.contains("Retriever yield"), "{body}");
        assert!(body.contains("<rect"), "{body}");
        assert!(body.contains("Ratings per week"), "{body}");
        assert!(body.contains("badge loved"), "{body}");
        assert!(body.contains("deepseek"), "{body}");
        assert!(
            body.contains("mean generation time:"),
            "the CLI text is included"
        );
        assert!(!body.contains("style=\""), "no inline styles under the CSP");
        assert!(
            body.contains(&format!("/dashboard/runs/{}", seed.run_id)),
            "{body}"
        );
        // An out-of-catalogue window falls back to 14 days.
        let admin = login_cookie(&app, "admin", "correct horse battery").await;
        let fallback = get(&app, "/dashboard/stats?days=7", Some(&admin)).await;
        assert_eq!(fallback.status(), axum::http::StatusCode::OK);
        let body = response_text(fallback).await;
        assert!(body.contains("stats: last 14 days"), "{body}");
    }
 }
@@ -0,0 +1,80 @@
 //! Dashboard: the read-only Users page (`/dashboard/users`, plan §6.1).
 use askama::Template;
 use axum::Router;
 use axum::extract::{Extension, State};
 use axum::routing::get;
 use axum_login::tower_sessions::Session;
 use crate::server::AppState;
 use crate::web::session::{AuthSession, Viewer};
 use crate::web::{Html, Page, WebError, format_time, take_flash};
 #[derive(Debug)]
 struct UserLine {
    username: String,
    role: String,
    disabled: bool,
    created: String,
    last_login: String,
    open_sessions: i64,
 }
 #[derive(Template)]
 #[template(path = "dashboard/users.html")]
 struct UsersTemplate {
    page: Page,
    users: Vec<UserLine>,
 }
 /// Routes contributed by this page group (merged by `dashboard::router`).
 pub fn routes() -> Router<AppState> {
    Router::new().route("/dashboard/users", get(index))
 }
 async fn index(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
 ) -> Result<Html<UsersTemplate>, WebError> {
    let viewer = auth.user().await.map(Viewer::from);
    let config = state.config();
    let users = crate::web::users::list(&state.db)
        .await
        .map_err(WebError::Internal)?
        .into_iter()
        .map(|row| UserLine {
            username: row.user.username,
            role: row.user.role.to_string(),
            disabled: row.user.disabled,
            created: format_time(row.user.created_at, &config),
            last_login: row
                .user
                .last_login_at
                .map(|at| format_time(at, &config))
                .unwrap_or_else(|| "never".into()),
            open_sessions: row.open_sessions,
        })
        .collect();
    let mut page = Page::new("Users", viewer, "dashboard");
    page.flash = take_flash(&session).await?;
    Ok(Html(UsersTemplate { page, users }))
 }
 #[cfg(test)]
 mod tests {
    use crate::web::dashboard::tests::{app_with_users, assert_admin_only, seed};
    #[tokio::test]
    async fn users_page_is_admin_only_and_lists_accounts_and_sessions() {
        let seed = seed().await;
        let app = app_with_users(&seed.db).await;
        let body = assert_admin_only(&app, "/dashboard/users").await;
        assert!(body.contains("<h1>Users</h1>"), "{body}");
        assert!(body.contains("reader"), "{body}");
        assert!(body.contains("admin"), "{body}");
        assert!(body.contains("Open sessions"), "{body}");
        assert!(body.contains("daily-epub users"), "{body}");
    }
 }
@@ -0,0 +1,378 @@
 use askama::Template;
 use axum::extract::{Extension, Path, State};
 use axum::http::{HeaderMap, StatusCode, header};
 use axum::response::{IntoResponse, Response};
 use axum_login::tower_sessions::Session;
 use jiff::civil::Date;
 use crate::server::AppState;
 use crate::types::{Issue, SocialSource};
 use crate::web::issue::{self, Download};
 use crate::web::session::{AuthSession, Viewer};
 use crate::web::{Html, Page, WebError};
 #[derive(Debug, Clone)]
 pub struct PublicIssue {
    pub date: Date,
    pub issue_number: i64,
    pub display_date: String,
    pub article_count: i64,
    pub reading_minutes: i64,
    pub stats_line: String,
    pub sections: Vec<PublicSection>,
    pub generated_at: jiff::Timestamp,
 }
 #[derive(Debug, Clone)]
 pub struct PublicSection {
    pub name: String,
    pub entries: Vec<PublicEntry>,
 }
 #[derive(Debug, Clone)]
 pub struct PublicEntry {
    pub title: String,
    pub url: String,
    pub author: Option<String>,
    pub source: String,
    pub domain: String,
    pub reading_minutes: i64,
    pub word_count: i64,
    pub comment_links: Vec<CommentLink>,
    pub is_lead: bool,
 }
 #[derive(Debug, Clone)]
 pub struct CommentLink {
    pub label: String,
    pub url: String,
    pub meta: String,
 }
 impl From<&Issue> for PublicIssue {
    fn from(issue: &Issue) -> Self {
        let sections =
            issue
                .lineup
                .section_order
                .iter()
                .map(|name| PublicSection {
                    name: name.clone(),
                    entries: issue
                        .lineup
                        .section_picks(name)
                        .into_iter()
                        .map(|pick| {
                            let article = &pick.article;
                            let mut comment_links: Vec<CommentLink> = article
                                .social
                                .iter()
                                .filter_map(|social| {
                                    let url = social.item_url.clone()?;
                                    let label = match social.source {
                                        SocialSource::Hn => "Hacker News",
                                        SocialSource::Lobsters => "Lobsters",
                                        SocialSource::Reddit => "Reddit",
                                        SocialSource::X => "X",
                                    };
                                    Some(CommentLink {
                                        label: label.into(),
                                        url,
                                        meta: format!(
                                            "{} points · {} comments",
                                            social.score, social.num_comments
                                        ),
                                    })
                                })
                                .collect();
                            if let Some(url) = article.comments_url.as_ref().filter(|url| {
                                *url != &article.canonical_url && *url != &article.url
                            }) {
                                comment_links.push(CommentLink {
                                    label: "Comments".into(),
                                    url: url.clone(),
                                    meta: String::new(),
                                });
                            }
                            PublicEntry {
                                title: article.title.clone(),
                                url: article.canonical_url.clone(),
                                author: article.author.clone(),
                                source: article.feed_title.clone(),
                                domain: domain(&article.canonical_url),
                                reading_minutes: article.reading_minutes(),
                                word_count: article.word_count,
                                comment_links,
                                is_lead: pick.is_lead,
                            }
                        })
                        .collect(),
                })
                .collect();
        Self {
            date: issue.meta.date,
            issue_number: issue.meta.issue_number,
            display_date: issue.meta.display_date.clone(),
            article_count: issue.meta.article_count,
            reading_minutes: issue.meta.reading_minutes,
            stats_line: issue.meta.stats_line(),
            sections,
            generated_at: issue.meta.generated_at,
        }
    }
 }
 fn domain(raw: &str) -> String {
    url::Url::parse(raw)
        .ok()
        .and_then(|url| url.host_str().map(str::to_string))
        .map(|host| host.strip_prefix("www.").unwrap_or(&host).to_string())
        .unwrap_or_default()
 }
 #[derive(Template)]
 #[template(path = "issue_public.html")]
 struct IssuePublicTemplate {
    page: Page,
    issue: PublicIssue,
    downloads: Vec<Download>,
    empty: bool,
 }
 #[derive(Debug, Clone)]
 pub struct ArchiveMonth {
    pub label: String,
    pub issues: Vec<ArchiveIssue>,
 }
 #[derive(Debug, Clone)]
 pub struct ArchiveIssue {
    pub date: Date,
    pub display_date: String,
    pub issue_number: i64,
    pub article_count: i64,
 }
 #[derive(Template)]
 #[template(path = "issue_list.html")]
 struct IssueListTemplate {
    page: Page,
    months: Vec<ArchiveMonth>,
 }
 #[derive(Template)]
 #[template(path = "feed_entry.html")]
 struct FeedEntryTemplate<'a> {
    issue: &'a PublicIssue,
 }
 pub async fn latest(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
    headers: HeaderMap,
 ) -> Result<Response, WebError> {
    let Some(date) = state.db.latest_issue_date().await? else {
        let viewer = auth.user().await.map(Viewer::from);
        let response = Html(IssuePublicTemplate {
            page: Page::new("Latest issue", viewer, "latest"),
            issue: empty_issue(),
            downloads: Vec::new(),
            empty: true,
        })
        .into_response();
        return Ok(public_cache(response, &headers));
    };
    show_issue(State(state), auth, Extension(session), headers, Path(date)).await
 }
 pub async fn show_issue(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
    headers: HeaderMap,
    Path(date): Path<Date>,
 ) -> Result<Response, WebError> {
    let Some(view) = issue::load(&state.db, &state.config(), date).await? else {
        return Err(WebError::NotFound);
    };
    let viewer = auth.user().await.map(Viewer::from);
    if let Some(viewer) = viewer {
        let response = issue::render_full(&state, view, viewer, &session).await?;
        return Ok(public_cache(response, &headers));
    }
    let response = Html(IssuePublicTemplate {
        page: Page::new(format!("Issue {date}"), None, "latest"),
        issue: PublicIssue::from(&view.issue),
        downloads: Vec::new(),
        empty: false,
    })
    .into_response();
    Ok(public_cache(response, &headers))
 }
 pub async fn archive(
    State(state): State<AppState>,
    auth: AuthSession,
    headers: HeaderMap,
 ) -> Result<Response, WebError> {
    let rows = state.db.issue_dates(None).await?;
    let mut months: Vec<ArchiveMonth> = Vec::new();
    for row in rows {
        let key = format!("{:04}-{:02}", row.date.year(), row.date.month());
        if months.last().map(|month| month.label.as_str()) != Some(key.as_str()) {
            months.push(ArchiveMonth {
                label: key,
                issues: Vec::new(),
            });
        }
        if let Some(month) = months.last_mut() {
            month.issues.push(ArchiveIssue {
                date: row.date,
                display_date: crate::pipeline::display_date(row.date),
                issue_number: row.issue_number,
                article_count: row.article_count,
            });
        }
    }
    let response = Html(IssueListTemplate {
        page: Page::new(
            "Issue archive",
            auth.user().await.map(Viewer::from),
            "archive",
        ),
        months,
    })
    .into_response();
    Ok(public_cache(response, &headers))
 }
 pub async fn feed(State(state): State<AppState>) -> Result<Response, WebError> {
    let config = state.config();
    let rows = state.db.issue_dates(Some(30)).await?;
    let mut entries = String::new();
    let mut updated = jiff::Timestamp::UNIX_EPOCH;
    for row in rows {
        let Some(view) = issue::load(&state.db, &config, row.date).await? else {
            continue;
        };
        updated = updated.max(view.issue.meta.generated_at);
        let issue = PublicIssue::from(&view.issue);
        let content = FeedEntryTemplate { issue: &issue }
            .render()
            .map_err(|error| WebError::Internal(error.into()))?;
        let href = format!(
            "{}/issues/{}",
            config.server.public_url.trim_end_matches('/'),
            issue.date
        );
        entries.push_str(&format!(
            "<entry><id>tag:{},{}:issue/{}</id><title>The Daily EPUB — {}</title><updated>{}</updated><link rel=\"alternate\" href=\"{}\"/><content type=\"html\">{}</content></entry>",
            feed_host(&config.server.public_url),
            issue.date.year(),
            issue.date,
            issue.date,
            issue.generated_at,
            xml_escape(&href),
            xml_escape(&content),
        ));
    }
    let home = config.server.public_url.trim_end_matches('/');
    let body = format!(
        "<?xml version=\"1.0\" encoding=\"utf-8\"?><feed xmlns=\"http://www.w3.org/2005/Atom\"><id>{}</id><title>The Daily EPUB</title><updated>{}</updated><link rel=\"self\" href=\"{}/feed.xml\"/>{}</feed>",
        xml_escape(home),
        updated,
        xml_escape(home),
        entries
    );
    Ok((
        StatusCode::OK,
        [
            (header::CONTENT_TYPE, "application/atom+xml; charset=utf-8"),
            (header::CACHE_CONTROL, "public, max-age=300"),
        ],
        body,
    )
        .into_response())
 }
 pub async fn robots() -> Response {
    (
        StatusCode::OK,
        [(header::CONTENT_TYPE, "text/plain; charset=utf-8")],
        "User-agent: *\nAllow: /\nAllow: /issues\nDisallow: /dashboard\nDisallow: /login\nDisallow: /files\nDisallow: /r\nDisallow: /opds\n",
    )
        .into_response()
 }
 fn public_cache(mut response: Response, request_headers: &HeaderMap) -> Response {
    let value = if request_headers
        .get(header::COOKIE)
        .and_then(|value| value.to_str().ok())
        .is_some_and(|cookies| cookies.contains("daily_session="))
    {
        "private, no-store"
    } else {
        "public, max-age=300"
    };
    response.headers_mut().insert(
        header::CACHE_CONTROL,
        axum::http::HeaderValue::from_static(value),
    );
    response
 }
 fn feed_host(public_url: &str) -> String {
    url::Url::parse(public_url)
        .ok()
        .and_then(|url| url.host_str().map(str::to_string))
        .unwrap_or_else(|| "daily.hallada.net".into())
 }
 fn xml_escape(value: &str) -> String {
    value
        .replace('&', "&amp;")
        .replace('<', "&lt;")
        .replace('>', "&gt;")
        .replace('"', "&quot;")
        .replace('\'', "&apos;")
 }
 fn empty_issue() -> PublicIssue {
    PublicIssue {
        date: "1970-01-01".parse().expect("valid epoch date"),
        issue_number: 0,
        display_date: String::new(),
        article_count: 0,
        reading_minutes: 0,
        stats_line: String::new(),
        sections: Vec::new(),
        generated_at: jiff::Timestamp::UNIX_EPOCH,
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn public_issue_carries_no_generated_text() {
        let source = crate::epub::fixtures::issue();
        let public = PublicIssue::from(&source);
        let html = FeedEntryTemplate { issue: &public }.render().unwrap();
        assert!(html.contains("The Lead Story"));
        assert!(html.contains("Hacker News"));
        for private in [
            "Two stories today",
            "What it argues",
            "systems story",
            "Body of",
            "write path",
            "Agreed",
            "Something happened",
            "concise view of the day",
        ] {
            assert!(!html.contains(private), "leaked {private:?} in {html}");
        }
    }
 }
@@ -0,0 +1,229 @@
 use std::collections::HashMap;
 use axum::Form;
 use axum::extract::{Extension, FromRequest, Json, Request, State};
 use axum::http::{HeaderMap, header};
 use axum::response::{IntoResponse, Response};
 use axum_login::tower_sessions::Session;
 use jiff::civil::Date;
 use serde::{Deserialize, Serialize};
 use sqlx::Row;
 use crate::server::AppState;
 use crate::types::{ArticleId, RatingEvent, Vote};
 use crate::web::session::{self, AuthSession};
 use crate::web::{Flash, WebError};
 #[derive(Debug, Clone)]
 pub struct RatingWidget {
    pub article_id: ArticleId,
    pub issue_date: String,
    pub next: String,
    pub current: String,
    pub show_note: bool,
 }
 impl RatingWidget {
    pub fn for_issue(
        article_id: ArticleId,
        issue_date: Date,
        next: impl Into<String>,
        current: Option<&str>,
    ) -> Self {
        Self {
            article_id,
            issue_date: issue_date.to_string(),
            next: next.into(),
            current: web_label(current).to_string(),
            show_note: false,
        }
    }
 }
 fn web_label(label: Option<&str>) -> &str {
    match label {
        Some("not_for_me" | "down") => "down",
        Some("loved") => "loved",
        Some("good") => "good",
        Some("cleared") => "cleared",
        _ => "",
    }
 }
 pub async fn current_for_issue(
    state: &AppState,
    date: Date,
 ) -> Result<HashMap<ArticleId, String>, WebError> {
    let rows = sqlx::query(
        "WITH ranked AS (
             SELECT re.article_id, re.label,
                    ROW_NUMBER() OVER (
                        PARTITION BY re.article_id
                        ORDER BY re.event_at DESC, re.id DESC
                    ) AS event_rank
             FROM rating_events re
             JOIN issue_articles ia ON ia.article_id = re.article_id
             WHERE re.kind = 'explicit' AND ia.issue_date = ?
         )
         SELECT article_id, label FROM ranked WHERE event_rank = 1",
    )
    .bind(date.to_string())
    .fetch_all(state.db.pool())
    .await
    .map_err(crate::db::DbError::from)?;
    Ok(rows
        .into_iter()
        .map(|row| (row.get("article_id"), row.get("label")))
        .collect())
 }
 #[derive(Debug, Deserialize)]
 pub struct RatingInput {
    article_id: ArticleId,
    #[serde(default)]
    issue_date: Option<String>,
    label: String,
    #[serde(default)]
    note: Option<String>,
    #[serde(default)]
    next: Option<String>,
 }
 #[derive(Debug, Serialize)]
 struct RatingResponse {
    article_id: ArticleId,
    label: String,
    event_id: i64,
 }
 pub async fn post(
    State(state): State<AppState>,
    auth: AuthSession,
    Extension(session): Extension<Session>,
    headers: HeaderMap,
    request: Request,
 ) -> Result<Response, WebError> {
    let content_type = headers
        .get(header::CONTENT_TYPE)
        .and_then(|value| value.to_str().ok())
        .unwrap_or_default();
    let input = if content_type.starts_with("application/json") {
        Json::<RatingInput>::from_request(request, &state)
            .await
            .map(|Json(input)| input)
            .map_err(|_| WebError::BadRequest("invalid rating JSON".into()))?
    } else {
        Form::<RatingInput>::from_request(request, &state)
            .await
            .map(|Form(input)| input)
            .map_err(|_| WebError::BadRequest("invalid rating form".into()))?
    };
    let viewer = auth.user().await.ok_or_else(|| WebError::Unauthenticated {
        next: "/rate".into(),
    })?;
    if state.db.get_article(input.article_id).await?.is_none() {
        return Err(WebError::BadRequest(format!(
            "article {} does not exist",
            input.article_id
        )));
    }
    let issue_date = match input
        .issue_date
        .as_deref()
        .map(str::trim)
        .filter(|value| !value.is_empty())
    {
        Some(raw) => Some(
            raw.parse::<Date>()
                .map_err(|_| WebError::BadRequest("invalid issue date".into()))?,
        ),
        None => {
            state
                .db
                .latest_issue_date_for_article(input.article_id)
                .await?
        }
    };
    let config = state.config();
    let (event_label, value, response_label, flash_label) = match input.label.as_str() {
        "loved" => (
            "loved",
            Vote::Loved.value(&config.curation.feedback),
            "loved",
            "Loved it",
        ),
        "good" => (
            "good",
            Vote::Good.value(&config.curation.feedback),
            "good",
            "Good",
        ),
        "down" => (
            "not_for_me",
            Vote::NotForMe.value(&config.curation.feedback),
            "down",
            "Not for me",
        ),
        "cleared" => ("cleared", 0.0, "cleared", "Cleared"),
        _ => return Err(WebError::BadRequest("invalid rating label".into())),
    };
    let note = input
        .note
        .map(|note| note.trim().to_string())
        .filter(|note| !note.is_empty());
    let event_id = state
        .db
        .append_rating_event(&RatingEvent {
            id: 0,
            user_id: Some(viewer.id),
            article_id: input.article_id,
            issue_date,
            kind: "explicit".into(),
            source: "dashboard".into(),
            label: event_label.into(),
            value,
            note,
            event_at: jiff::Timestamp::now(),
        })
        .await?;
    let wants_json = headers
        .get(header::ACCEPT)
        .and_then(|value| value.to_str().ok())
        .is_some_and(|value| value.contains("application/json"));
    if wants_json {
        return Ok(Json(RatingResponse {
            article_id: input.article_id,
            label: response_label.into(),
            event_id,
        })
        .into_response());
    }
    session
        .insert(
            "flash",
            Flash {
                kind: "success".into(),
                text: format!("Rated: {flash_label}"),
            },
        )
        .await
        .map_err(|error| WebError::Internal(error.into()))?;
    let destination = session::valid_next(input.next.as_deref()).to_string();
    Ok(axum::response::Redirect::to(&destination).into_response())
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn database_and_widget_labels_are_mapped_explicitly() {
        assert_eq!(web_label(Some("not_for_me")), "down");
        assert_eq!(web_label(Some("cleared")), "cleared");
        assert_eq!(web_label(None), "");
    }
 }
@@ -0,0 +1,538 @@
 use std::collections::HashSet;
 use std::str::FromStr;
 use askama::Template;
 use async_trait::async_trait;
 use axum::Form;
 use axum::extract::{Query, Request, State};
 use axum::http::{StatusCode, header};
 use axum::middleware::Next;
 use axum::response::{IntoResponse, Response};
 use axum_login::tower_sessions::session::{Id, Record};
 use axum_login::tower_sessions::{SessionStore, session_store};
 use axum_login::{AuthUser, AuthnBackend, AuthzBackend};
 use serde::Deserialize;
 use sqlx::{Row, SqlitePool};
 use time::OffsetDateTime;
 use crate::db::{Db, fmt_ts};
 use crate::server::AppState;
 use crate::web::users::{self, Role, User};
 use crate::web::{Html, Page, WebError};
 const DUMMY_HASH: &str = "$argon2i$v=19$m=65536,t=1,p=1$c29tZXNhbHQAAAAAAAAAAA$+r0d29hqEB0yasKr55ZgICsQGSkl0v0kgwhd+U3wyRo";
 #[derive(Clone, Debug)]
 pub struct SqliteSessionStore {
    pool: SqlitePool,
 }
 impl SqliteSessionStore {
    pub fn new(pool: SqlitePool) -> Self {
        Self { pool }
    }
    pub async fn delete_expired(&self) -> Result<u64, sqlx::Error> {
        let result = sqlx::query("DELETE FROM sessions WHERE expiry <= unixepoch()")
            .execute(&self.pool)
            .await?;
        Ok(result.rows_affected())
    }
    pub async fn delete_for_user(&self, user_id: i64) -> Result<u64, sqlx::Error> {
        let result = sqlx::query("DELETE FROM sessions WHERE user_id = ?")
            .bind(user_id)
            .execute(&self.pool)
            .await?;
        Ok(result.rows_affected())
    }
 }
 fn store_error(error: impl std::fmt::Display) -> session_store::Error {
    session_store::Error::Backend(error.to_string())
 }
 #[async_trait]
 impl SessionStore for SqliteSessionStore {
    /// Insert a brand-new record, drawing a fresh id on the (astronomically
    /// unlikely) collision with an existing row instead of overwriting it.
    async fn create(&self, record: &mut Record) -> session_store::Result<()> {
        loop {
            let exists: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM sessions WHERE id = ?")
                .bind(record.id.to_string())
                .fetch_one(&self.pool)
                .await
                .map_err(store_error)?;
            if exists == 0 {
                return self.save(record).await;
            }
            record.id = Id::default();
        }
    }
    async fn save(&self, record: &Record) -> session_store::Result<()> {
        let data = serde_json::to_string(&record.data).map_err(store_error)?;
        let user_id = record
            .data
            .get("axum-login.data")
            .and_then(|value| value.get("user_id"))
            .and_then(serde_json::Value::as_i64);
        let now = fmt_ts(jiff::Timestamp::now());
        sqlx::query(
            "INSERT INTO sessions (id, data, expiry, user_id, created_at, updated_at)
             VALUES (?, ?, ?, ?, ?, ?)
             ON CONFLICT(id) DO UPDATE SET data = excluded.data, expiry = excluded.expiry,
                 user_id = excluded.user_id, updated_at = excluded.updated_at",
        )
        .bind(record.id.to_string())
        .bind(data)
        .bind(record.expiry_date.unix_timestamp())
        .bind(user_id)
        .bind(&now)
        .bind(now)
        .execute(&self.pool)
        .await
        .map_err(store_error)?;
        Ok(())
    }
    async fn load(&self, id: &Id) -> session_store::Result<Option<Record>> {
        let row =
            sqlx::query("SELECT data, expiry FROM sessions WHERE id = ? AND expiry > unixepoch()")
                .bind(id.to_string())
                .fetch_optional(&self.pool)
                .await
                .map_err(store_error)?;
        row.map(|row| {
            let data = serde_json::from_str(&row.get::<String, _>("data")).map_err(store_error)?;
            let expiry_date =
                OffsetDateTime::from_unix_timestamp(row.get("expiry")).map_err(store_error)?;
            Ok(Record {
                id: *id,
                data,
                expiry_date,
            })
        })
        .transpose()
    }
    async fn delete(&self, id: &Id) -> session_store::Result<()> {
        sqlx::query("DELETE FROM sessions WHERE id = ?")
            .bind(id.to_string())
            .execute(&self.pool)
            .await
            .map_err(store_error)?;
        Ok(())
    }
 }
 #[derive(Debug, Clone, Deserialize)]
 pub struct Credentials {
    pub username: String,
    pub password: String,
    #[serde(default)]
    pub next: Option<String>,
 }
 #[derive(Debug, thiserror::Error)]
 pub enum BackendError {
    #[error(transparent)]
    Db(#[from] crate::db::DbError),
    #[error("password verification task failed: {0}")]
    Join(#[from] tokio::task::JoinError),
 }
 #[derive(Clone)]
 pub struct Backend {
    db: Db,
 }
 impl Backend {
    pub fn new(db: Db) -> Self {
        Self { db }
    }
 }
 impl AuthUser for User {
    type Id = i64;
    fn id(&self) -> Self::Id {
        self.id
    }
    fn session_auth_hash(&self) -> &[u8] {
        self.password_hash.as_bytes()
    }
 }
 impl AuthnBackend for Backend {
    type User = User;
    type Credentials = Credentials;
    type Error = BackendError;
    async fn authenticate(&self, creds: Credentials) -> Result<Option<User>, BackendError> {
        let user = users::find_by_username(&self.db, &creds.username).await?;
        let hash = user
            .as_ref()
            .map(|user| user.password_hash.clone())
            .unwrap_or_else(|| DUMMY_HASH.to_string());
        let password = creds.password;
        let valid =
            tokio::task::spawn_blocking(move || users::verify_password(&hash, &password)).await?;
        Ok(user.filter(|user| valid && !user.disabled))
    }
    async fn get_user(&self, id: &i64) -> Result<Option<User>, BackendError> {
        Ok(users::find_by_id(&self.db, *id)
            .await?
            .filter(|user| !user.disabled))
    }
 }
 impl AuthzBackend for Backend {
    type Permission = Role;
    async fn get_user_permissions(&self, user: &User) -> Result<HashSet<Role>, BackendError> {
        let permissions = match user.role {
            Role::Admin => [Role::User, Role::Admin].into_iter().collect(),
            Role::User => [Role::User].into_iter().collect(),
        };
        Ok(permissions)
    }
 }
 pub type AuthSession = axum_login::AuthSession<Backend>;
 #[derive(Debug, Clone)]
 pub struct Viewer {
    pub id: i64,
    pub username: String,
    pub role: Role,
 }
 impl From<User> for Viewer {
    fn from(user: User) -> Self {
        Self {
            id: user.id,
            username: user.username,
            role: user.role,
        }
    }
 }
 pub fn valid_next(next: Option<&str>) -> &str {
    next.filter(|next| next.starts_with('/') && !next.starts_with("//"))
        .unwrap_or("/")
 }
 pub async fn require_same_origin(
    State(state): State<AppState>,
    request: Request,
    next: Next,
 ) -> Response {
    if request.method() != axum::http::Method::POST {
        return next.run(request).await;
    }
    let headers = request.headers();
    if let Some(site) = headers
        .get("sec-fetch-site")
        .and_then(|value| value.to_str().ok())
    {
        if !matches!(site, "same-origin" | "none") {
            return StatusCode::FORBIDDEN.into_response();
        }
    } else if let Some(origin) = request_origin(headers) {
        let config = state.config();
        let public_origin = url::Url::parse(&config.server.public_url)
            .ok()
            .map(|url| url.origin().ascii_serialization());
        let host_origin = headers
            .get(header::HOST)
            .and_then(|value| value.to_str().ok())
            .map(|host| format!("{}://{host}", forwarded_scheme(headers)));
        if public_origin.as_deref() != Some(origin.as_str())
            && host_origin.as_deref() != Some(origin.as_str())
        {
            return StatusCode::FORBIDDEN.into_response();
        }
    }
    next.run(request).await
 }
 #[derive(Debug, Default, Deserialize)]
 pub struct LoginQuery {
    #[serde(default)]
    next: Option<String>,
 }
 #[derive(Template)]
 #[template(path = "login.html")]
 struct LoginTemplate {
    page: Page,
    next: String,
    error: String,
 }
 #[derive(Template)]
 #[template(path = "account.html")]
 struct AccountTemplate {
    page: Page,
    error: String,
 }
 pub async fn login_page(auth: AuthSession, Query(query): Query<LoginQuery>) -> Response {
    let viewer = auth.user().await.map(Viewer::from);
    Html(LoginTemplate {
        page: Page::new("Sign in", viewer, "login"),
        next: valid_next(query.next.as_deref()).to_string(),
        error: String::new(),
    })
    .into_response()
 }
 pub async fn login(
    State(state): State<AppState>,
    auth: AuthSession,
    Form(credentials): Form<Credentials>,
 ) -> Result<Response, WebError> {
    let destination = valid_next(credentials.next.as_deref()).to_string();
    match auth
        .authenticate(credentials)
        .await
        .map_err(|error| WebError::Internal(error.into()))?
    {
        Some(user) => {
            auth.login(&user)
                .await
                .map_err(|error| WebError::Internal(error.into()))?;
            sqlx::query("UPDATE users SET last_login_at = ? WHERE id = ?")
                .bind(fmt_ts(jiff::Timestamp::now()))
                .bind(user.id)
                .execute(state.db.pool())
                .await
                .map_err(crate::db::DbError::from)?;
            Ok(axum::response::Redirect::to(&destination).into_response())
        }
        None => Ok((
            StatusCode::UNAUTHORIZED,
            Html(LoginTemplate {
                page: Page::new("Sign in", None, "login"),
                next: destination,
                error: "invalid username or password".into(),
            }),
        )
            .into_response()),
    }
 }
 pub async fn logout(auth: AuthSession) -> Result<Response, WebError> {
    auth.logout()
        .await
        .map_err(|error| WebError::Internal(error.into()))?;
    Ok(axum::response::Redirect::to("/").into_response())
 }
 pub async fn account(auth: AuthSession) -> Result<Response, WebError> {
    let user = auth.user().await.ok_or_else(|| WebError::Unauthenticated {
        next: "/account".into(),
    })?;
    Ok(Html(AccountTemplate {
        page: Page::new("Account", Some(user.into()), "account"),
        error: String::new(),
    })
    .into_response())
 }
 #[derive(Debug, Deserialize)]
 pub struct PasswordForm {
    current_password: String,
    new_password: String,
    confirm_password: String,
 }
 pub async fn change_password(
    State(state): State<AppState>,
    auth: AuthSession,
    Form(form): Form<PasswordForm>,
 ) -> Result<Response, WebError> {
    let user = auth.user().await.ok_or_else(|| WebError::Unauthenticated {
        next: "/account".into(),
    })?;
    let hash = user.password_hash.clone();
    let current = form.current_password;
    let valid = tokio::task::spawn_blocking(move || users::verify_password(&hash, &current))
        .await
        .map_err(|error| WebError::Internal(error.into()))?;
    let problem = if !valid {
        Some("current password is incorrect".to_string())
    } else if form.new_password != form.confirm_password {
        Some("the new passwords do not match".to_string())
    } else {
        users::validate_password(&form.new_password)
            .err()
            .map(|error| error.to_string())
    };
    if let Some(error) = problem {
        return Ok((
            StatusCode::BAD_REQUEST,
            Html(AccountTemplate {
                page: Page::new("Account", Some(user.into()), "account"),
                error,
            }),
        )
            .into_response());
    }
    let password = form.new_password;
    let password_hash = tokio::task::spawn_blocking(move || users::hash_password(&password))
        .await
        .map_err(|error| WebError::Internal(error.into()))?;
    sqlx::query("UPDATE users SET password_hash = ? WHERE id = ?")
        .bind(&password_hash)
        .bind(user.id)
        .execute(state.db.pool())
        .await
        .map_err(crate::db::DbError::from)?;
    SqliteSessionStore::new(state.db.pool().clone())
        .delete_for_user(user.id)
        .await
        .map_err(crate::db::DbError::from)?;
    let mut updated = user;
    updated.password_hash = password_hash;
    auth.login(&updated)
        .await
        .map_err(|error| WebError::Internal(error.into()))?;
    Ok(axum::response::Redirect::to("/account").into_response())
 }
 pub async fn logout_everywhere(
    State(state): State<AppState>,
    auth: AuthSession,
 ) -> Result<Response, WebError> {
    let user = auth.user().await.ok_or_else(|| WebError::Unauthenticated {
        next: "/account".into(),
    })?;
    SqliteSessionStore::new(state.db.pool().clone())
        .delete_for_user(user.id)
        .await
        .map_err(crate::db::DbError::from)?;
    auth.logout()
        .await
        .map_err(|error| WebError::Internal(error.into()))?;
    Ok(axum::response::Redirect::to("/").into_response())
 }
 fn forwarded_scheme(headers: &axum::http::HeaderMap) -> &str {
    headers
        .get("x-forwarded-proto")
        .and_then(|value| value.to_str().ok())
        .unwrap_or("http")
 }
 fn request_origin(headers: &axum::http::HeaderMap) -> Option<String> {
    if let Some(origin) = headers
        .get(header::ORIGIN)
        .and_then(|value| value.to_str().ok())
    {
        return Some(origin.trim_end_matches('/').to_string());
    }
    let referer = headers
        .get(header::REFERER)
        .and_then(|value| value.to_str().ok())?;
    let url = url::Url::from_str(referer).ok()?;
    Some(url.origin().ascii_serialization())
 }
 #[cfg(test)]
 mod tests {
    use std::collections::HashMap;
    use axum_login::tower_sessions::SessionStore;
    use serde_json::json;
    use time::Duration;
    use super::*;
    async fn store() -> (tempfile::TempDir, Db, SqliteSessionStore) {
        let dir = tempfile::tempdir().unwrap();
        let db = Db::open_and_migrate(&dir.path().join("db.sqlite"))
            .await
            .unwrap();
        let store = SqliteSessionStore::new(db.pool().clone());
        (dir, db, store)
    }
    fn record(user_id: Option<i64>, expiry: OffsetDateTime) -> Record {
        let mut data = HashMap::new();
        if let Some(user_id) = user_id {
            data.insert(
                "axum-login.data".into(),
                json!({"user_id": user_id, "auth_hash": [1, 2, 3]}),
            );
        }
        Record {
            id: Id::default(),
            data,
            expiry_date: expiry,
        }
    }
    #[tokio::test]
    async fn session_store_round_trips_denormalizes_and_deletes() {
        let (_dir, db, store) = store().await;
        let user = users::add(&db, "reader", "correct horse battery", false)
            .await
            .unwrap();
        let active = record(
            Some(user.id),
            OffsetDateTime::now_utc() + Duration::hours(1),
        );
        store.save(&active).await.unwrap();
        let loaded = store.load(&active.id).await.unwrap().unwrap();
        assert_eq!(loaded.id, active.id);
        assert_eq!(loaded.data, active.data);
        assert_eq!(
            loaded.expiry_date.unix_timestamp(),
            active.expiry_date.unix_timestamp()
        );
        let denormalized: Option<i64> =
            sqlx::query_scalar("SELECT user_id FROM sessions WHERE id = ?")
                .bind(active.id.to_string())
                .fetch_one(db.pool())
                .await
                .unwrap();
        assert_eq!(denormalized, Some(user.id));
        assert_eq!(store.delete_for_user(user.id).await.unwrap(), 1);
        assert!(store.load(&active.id).await.unwrap().is_none());
        let anonymous = record(None, OffsetDateTime::now_utc() + Duration::hours(1));
        store.save(&anonymous).await.unwrap();
        let denormalized: Option<i64> =
            sqlx::query_scalar("SELECT user_id FROM sessions WHERE id = ?")
                .bind(anonymous.id.to_string())
                .fetch_one(db.pool())
                .await
                .unwrap();
        assert_eq!(denormalized, None);
        store.delete(&anonymous.id).await.unwrap();
        assert!(store.load(&anonymous.id).await.unwrap().is_none());
    }
    #[tokio::test]
    async fn expired_sessions_are_hidden_and_pruned_and_errors_surface() {
        let (_dir, db, store) = store().await;
        let expired = record(None, OffsetDateTime::now_utc() - Duration::seconds(1));
        store.save(&expired).await.unwrap();
        assert!(store.load(&expired.id).await.unwrap().is_none());
        assert_eq!(store.delete_expired().await.unwrap(), 1);
        db.close().await;
        let error = store.save(&record(None, OffsetDateTime::now_utc())).await;
        assert!(matches!(error, Err(session_store::Error::Backend(_))));
    }
    #[test]
    fn next_targets_must_be_same_site_paths() {
        assert_eq!(valid_next(Some("/dashboard")), "/dashboard");
        assert_eq!(valid_next(Some("//evil.example/")), "/");
        assert_eq!(valid_next(Some("https://evil.example/")), "/");
    }
 }
@@ -0,0 +1,157 @@
 :root { --bg:#fbfaf6; --fg:#171713; --muted:#68665f; --rule:#c9c5b9; --accent:#8b1e1e; --loved:#286a3b; --good:#34688a; --down:#943b35; color-scheme:light dark; }
@media (prefers-color-scheme:dark) { :root { --bg:#171714; --fg:#eeeae0; --muted:#aaa69b; --rule:#4c4a44; --accent:#ef8c82; --loved:#75c58a; --good:#75aed0; --down:#e5867d; } }
 * { box-sizing:border-box; }
 body { margin:0 auto; padding:0 1rem; background:var(--bg); color:var(--fg); font:1rem/1.55 Georgia,serif; }
 a { color:var(--accent); }
 .masthead { max-width:72ch; margin:1.5rem auto .4rem; border-block:3px double var(--fg); padding:.45rem 0; text-align:center; font-size:2rem; font-weight:700; }
 .masthead a { color:inherit; text-decoration:none; }
 .primary,.admin,footer { max-width:72ch; margin:.7rem auto; text-align:center; color:var(--muted); }
 .admin { max-width:1200px; font-family:system-ui,sans-serif; }
 .flash { max-width:72rem; margin:1rem auto; padding:.75rem 1rem; border:1px solid var(--rule); }
 main { min-height:70vh; }
 .reading { max-width:72ch; margin:2rem auto; }
 .narrow { max-width:34rem; }
 .dateline,.stats,.byline,.comments,.strap,.meta,.social,.index-meta { color:var(--muted); }
 .issue section { border-top:1px solid var(--rule); margin-top:2rem; }
 .issue article { border-bottom:1px solid var(--rule); padding:.4rem 0 .8rem; }
 .issue .lead h3 { font-size:1.45rem; }
 .comments a,.downloads a { margin-right:.8rem; }
 .downloads { display:flex; flex-wrap:wrap; gap:.6rem; margin:1.5rem 0; }
 .button { border:1px solid currentColor; padding:.45rem .7rem; text-decoration:none; }
 .index-list { list-style:none; padding:0; }
 .index-entry { border-bottom:1px solid var(--rule); padding:.5rem 0 1rem; }
 .index-entry h3 { margin-bottom:.1rem; }
 .index-entry p { margin:.35rem 0; }
 .issue-chapters { border-block:1px solid var(--rule); margin:2rem 0; padding:1rem 0; text-align:center; font-size:1.15rem; }
 .colophon { max-width:none; margin:2rem 0; text-align:left; }
 .rule { border:0; border-top:1px solid var(--rule); margin:1.5rem 0; }
 .article-header h1 a { color:inherit; }
 .article-body img { display:block; max-width:100%; height:auto; margin:1rem auto; }
 .article-body pre { max-width:100%; overflow-x:auto; }
 .discussion { border-top:1px solid var(--rule); margin-top:2rem; padding-top:1rem; }
 .discussion blockquote { border-left:2px solid var(--rule); margin-left:.5rem; padding-left:1rem; }
 .discussion blockquote.reply { margin-left:1.5rem; }
 .comment-meta { color:var(--muted); font-size:.9rem; }
 .prev-next { display:grid; grid-template-columns:1fr 1fr; gap:1rem; margin:1.5rem 0; }
 .prev-next a:last-child { text-align:right; }
 form { display:grid; gap:.8rem; margin:1.5rem 0; }
 label { display:grid; gap:.25rem; }
 input,textarea,button { font:inherit; padding:.45rem; }
 .error { color:var(--down); }
 .dashboard { max-width:1200px; margin:2rem auto; font-family:system-ui,sans-serif; }
 .scroll-x { max-width:100%; overflow-x:auto; overscroll-behavior-inline:contain; }
 table { width:100%; border-collapse:collapse; font:0.9rem/1.35 system-ui,sans-serif; }
 th,td { border-bottom:1px solid var(--rule); padding:.35rem .5rem; text-align:left; }
 thead { position:sticky; top:0; background:var(--bg); }
 .badge { border:1px solid currentColor; border-radius:999px; padding:.1rem .45rem; }
 .badge.selected,.badge.loved { color:var(--loved); } .badge.good,.badge.assessed,.badge.triaged { color:var(--good); } .badge.down,.badge.excluded { color:var(--down); }
 .badge.shortlisted,.badge.admitted,.badge.eligible,.badge.cleared { color:var(--muted); }
 .kv { display:grid; grid-template-columns:minmax(10rem,1fr) 3fr; } .kv dt { color:var(--muted); }
 .funnel > * { background:var(--good); min-width:1px; margin:.2rem 0; }
 .spark { max-width:100%; height:auto; }
 .rating { display:flex; flex-wrap:wrap; align-items:center; gap:.3rem; }
 .rating button { border:1px solid var(--rule); background:transparent; color:var(--fg); cursor:pointer; }
 .rating button.active { background:var(--fg); color:var(--bg); border-color:var(--fg); }
 .rating button.clear { border:0; color:var(--muted); padding-inline:.25rem; text-decoration:underline; }
 .rating button.clear.active { background:transparent; color:var(--fg); font-weight:700; }
 .rating-prompt { margin-right:.25rem; }
 .rating-note { flex-basis:100%; }
@media (max-width:40rem) { .masthead { font-size:1.55rem; } .kv { display:block; } }
 /* step 4: ratings and profile pages */
 .preference-summary { font-size:1.05rem; }
 .notice { border-left:3px solid var(--accent); padding:.4rem .8rem; }
 .how ol { padding-left:1.2rem; } .how li { margin:.4rem 0; }
 .tabs { margin:1rem 0; } .tabs a { padding:.3rem .7rem; border:1px solid var(--rule); text-decoration:none; } .tabs a.active { background:var(--fg); color:var(--bg); border-color:var(--fg); }
 form.filters { display:flex; flex-wrap:wrap; align-items:end; gap:.8rem; margin:1rem 0; } form.filters label { gap:.15rem; }
 form.inline { display:inline-flex; flex-wrap:wrap; align-items:center; gap:.6rem; margin:.8rem 0; }
 .contributions td { vertical-align:top; } .contributions .rating { margin-top:.3rem; font-size:.85rem; } .contributions .rating-prompt { display:none; }
 tr.superseded td { color:var(--muted); }
 .pager { display:flex; gap:1rem; align-items:center; margin:1rem 0; }
 .profile-grid { display:grid; grid-template-columns:3fr 2fr; gap:1.5rem; }
 .profile-form textarea { width:100%; font:.9rem/1.4 ui-monospace,SFMono-Regular,Menlo,monospace; resize:vertical; }
 pre.preview { white-space:pre-wrap; overflow-wrap:anywhere; font:.85rem/1.4 ui-monospace,SFMono-Regular,Menlo,monospace; border:1px solid var(--rule); padding:.6rem; max-height:28rem; overflow:auto; margin:0; }
 .versions pre.preview { max-height:6rem; border:0; padding:0; }
 .versions form { margin:0; }
@media (max-width:60rem) { .profile-grid { display:block; } }
 /* step 3: dashboard reads (overview, runs, articles) */
 .dashboard h1 { font-size:1.5rem; margin:.5rem 0; }
 .dashboard h1 a { color:inherit; }
 .dashboard h2 { font-size:1.1rem; margin:1.75rem 0 .5rem; }
 .dashboard h3 { font-size:1rem; margin:.5rem 0; }
 .dashboard table td { vertical-align:top; }
 .cards { display:grid; grid-template-columns:repeat(auto-fit,minmax(20rem,1fr)); gap:1rem; margin:1rem 0; }
 .card { border:1px solid var(--rule); padding:.75rem 1rem; min-width:0; }
 .card h2 { margin-top:0; }
 .block { white-space:pre-wrap; overflow-wrap:anywhere; font:.85rem/1.4 ui-monospace,SFMono-Regular,Menlo,monospace; margin:.5rem 0; }
 .muted { color:var(--muted); }
 .num { text-align:right; font-variant-numeric:tabular-nums; white-space:nowrap; }
 .filters { display:flex; flex-wrap:wrap; gap:.5rem 1rem; align-items:end; margin:1rem 0; }
 .filters label { font-size:.85rem; }
 .filters input,.filters select { padding:.3rem; font-size:.9rem; }
 .run-nav { display:flex; flex-wrap:wrap; gap:1.5rem; margin:.5rem 0 1rem; }
 .funnel-cell { min-width:12rem; width:40%; }
 .funnel svg { display:block; }
 .funnel-table .reasons { color:var(--muted); font-size:.8rem; }
 .badge.reason,.badge.running,.badge.requested { color:var(--muted); }
 .badge.ok { color:var(--loved); } .badge.degraded { color:var(--good); } .badge.failed,.badge.dry_run { color:var(--down); }
 .pager { display:flex; flex-wrap:wrap; gap:1rem; margin:1rem 0; align-items:center; }
 details.signals summary { cursor:pointer; }
 details.signals summary a { display:inline; }
 .signals-body { margin:.5rem 0 .5rem 1rem; font-size:.85rem; }
 .signals-body table { width:auto; }
 .signals-body tr.muted td { color:var(--muted); }
 details.explain { margin:1rem 0; }
 .diff .before { color:var(--down); } .diff .after { color:var(--loved); }
 .picks,.jobs,.warnings { list-style:none; padding:0; }
 .picks li { border-bottom:1px solid var(--rule); padding:.5rem 0; }
 .budget meter { width:60%; max-width:14rem; height:.8rem; vertical-align:middle; margin-right:.5rem; }
 .table-filter { margin:.5rem 0; padding:.3rem; width:20rem; max-width:100%; }
 /* step 5: settings */
 .settings .card { border:1px solid var(--rule); padding:.75rem 1rem; margin:1rem 0; }
 .settings .card h2 { margin:.2rem 0 .6rem; font-size:1.1rem; font-family:ui-monospace,monospace; }
 .settings-form { display:block; }
 .setting { display:grid; grid-template-columns:minmax(14rem,1fr) 2fr; gap:.5rem 1rem; padding:.5rem 0; border-top:1px solid var(--rule); }
 .setting .help,.setting .default,.settings .meta { color:var(--muted); font-size:.85rem; margin:.2rem 0; }
 .setting-input input,.setting-input select,.setting-input textarea { width:100%; max-width:36rem; }
 .setting-input textarea { min-height:5rem; font-family:ui-monospace,monospace; }
 .setting-input input:disabled,.setting-input textarea:disabled { opacity:.6; }
 .setting .lines { white-space:pre-line; }
 .settings .banner { padding:.6rem .8rem; border:1px solid var(--down); margin:1rem 0; }
 .settings .reset,.settings .danger { font:inherit; font-size:.85rem; border:0; background:transparent; color:var(--accent); text-decoration:underline; padding:0; cursor:pointer; }
 .settings .actions { position:sticky; bottom:0; background:var(--bg); padding:.7rem 0; border-top:1px solid var(--rule); }
 .settings form.inline { display:none; }
 .settings .add-provider { max-width:36rem; }
 .history pre { margin:0; white-space:pre-wrap; font-size:.8rem; }
@media (max-width:40rem) { .setting { display:block; } }
 /* step 6: jobs and stats */
 .sparklines { display:grid; grid-template-columns:repeat(auto-fit,minmax(16rem,1fr)); gap:1rem 1.5rem; margin:1rem 0; }
 .spark-figure { margin:0; min-width:0; } .spark-figure figcaption { font-size:.9rem; margin-bottom:.2rem; }
 .spark { display:block; width:100%; max-width:26rem; height:auto; border-bottom:1px solid var(--rule); }
 .spark .s0 { fill:var(--good); } .spark .s1 { fill:var(--loved); } .spark .s2 { fill:var(--down); } .spark .s3 { fill:var(--accent); } .spark .s4 { fill:var(--muted); } .spark .s5 { fill:var(--fg); }
 .spark .line { stroke:var(--accent); }
 .spark-axis { display:flex; justify-content:space-between; max-width:26rem; font-size:.75rem; }
 .spark-legend { list-style:none; padding:0; margin:.3rem 0 0; display:flex; flex-wrap:wrap; gap:.2rem .8rem; font-size:.8rem; }
 .spark-legend svg { vertical-align:middle; }
 .job-cards form.inline { margin:.4rem 0 0; } .job-cards label { display:inline-grid; }
 td.message,dd.message { overflow-wrap:anywhere; max-width:32rem; }
 pre.journal { max-height:40rem; }
 /* step 7: dark-mode and narrow-screen polish */
 .primary,.admin { display:flex; flex-wrap:wrap; justify-content:center; gap:.35rem 1rem; }
 .masthead { line-height:1.15; overflow-wrap:anywhere; }
 .scroll-x > table { min-width:max-content; }
 input,textarea,select,button { max-width:100%; border-color:var(--rule); background:var(--bg); color:var(--fg); }
 button { border-style:solid; }
 input:focus-visible,textarea:focus-visible,select:focus-visible,button:focus-visible,a:focus-visible { outline:2px solid var(--accent); outline-offset:2px; }
 code,pre,.message { overflow-wrap:anywhere; }
 .prev-next a { overflow-wrap:anywhere; }
@media (max-width:40rem) {
  body { padding-inline:.75rem; }
  .masthead { margin-top:.75rem; padding-inline:.25rem; }
  .primary,.admin { gap:.25rem .75rem; line-height:1.35; }
  .dashboard,.reading { margin-block:1.25rem; }
  .cards { grid-template-columns:minmax(0,1fr); }
  .card { padding:.65rem .75rem; }
  .prev-next { display:flex; flex-wrap:wrap; justify-content:space-between; }
  .rating { align-items:stretch; }
  .rating-prompt,.rating-note { flex-basis:100%; }
 }
@@ -0,0 +1,72 @@
 document.addEventListener("submit", (event) => {
  const form = event.target;
  if (form.matches("form.rating") && event.submitter) {
    event.preventDefault();
    const submitted = event.submitter;
    const body = new URLSearchParams(new FormData(form));
    body.set(submitted.name, submitted.value);
    fetch(form.action, {
      method: "POST",
      body,
      credentials: "same-origin",
      headers: { Accept: "application/json" },
    }).then((response) => {
      if (!response.ok) throw new Error("rating request failed");
      return response.json();
    }).then((result) => {
      form.querySelectorAll("button[data-label]").forEach((button) => {
        const active = button.dataset.label === result.label;
        button.classList.toggle("active", active);
        button.setAttribute("aria-pressed", active ? "true" : "false");
      });
    }).catch(() => {
      const label = document.createElement("input");
      label.type = "hidden";
      label.name = submitted.name;
      label.value = submitted.value;
      form.appendChild(label);
      form.submit();
    });
    return;
  }
  const message = form.dataset.confirm;
  if (message && !window.confirm(message)) event.preventDefault();
 });
 document.querySelectorAll("details[id]").forEach((details) => {
  try {
    const key = "details:" + details.id;
    details.open = localStorage.getItem(key) === "open";
    details.addEventListener("toggle", () => localStorage.setItem(key, details.open ? "open" : "closed"));
  } catch (_) {}
 });
 /* step 3: filter-as-you-type on tables with data-filter (this page's rows only) */
 document.querySelectorAll("table[data-filter]").forEach((table) => {
  const rows = table.querySelectorAll("tbody tr");
  if (rows.length < 2) return;
  const input = document.createElement("input");
  input.type = "search";
  input.className = "table-filter";
  input.placeholder = "Filter rows on this page";
  input.setAttribute("aria-label", "Filter rows on this page");
  const host = table.closest(".scroll-x") || table;
  host.parentNode.insertBefore(input, host);
  input.addEventListener("input", () => {
    const needle = input.value.trim().toLowerCase();
    rows.forEach((row) => {
      row.hidden = needle !== "" && !row.textContent.toLowerCase().includes(needle);
    });
  });
 });
 /* step 5: settings — "reset to default" fills the field with its default */
 document.addEventListener("click", (event) => {
  const button = event.target.closest("button[data-reset]");
  if (!button) return;
  const input = document.getElementById(button.dataset.reset);
  if (!input) return;
  input.value = button.dataset.default;
 });
 /* step 6: reload a job page every N seconds while its job is requested/running */
 document.querySelectorAll("[data-refresh]").forEach((element) => {
  const seconds = Number(element.dataset.refresh);
  if (seconds > 0) setTimeout(() => window.location.reload(), seconds * 1000);
 });
@@ -0,0 +1 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="6" fill="#fbfaf6"/><path d="M13 12h38v40H13z" fill="none" stroke="#171713" stroke-width="3"/><path d="M20 21h24M20 29h24M20 37h18M20 45h20" stroke="#8b1e1e" stroke-width="3"/></svg>
@@ -0,0 +1,16 @@
 <tr>
 <td><details class="signals"><summary><a href="{{ candidate.href }}">{{ candidate.title }}</a></summary>{% let signals = candidate.signals %}{% include "_signals_table.html" %}</details></td>
 <td>{{ candidate.feed }}</td>
 <td class="num">{{ candidate.words }}</td>
 <td><span class="badge {{ candidate.stage }}">{{ candidate.stage }}</span></td>
 <td>{% if let Some(reason) = candidate.reason %}<span class="badge reason">{{ reason }}</span>{% endif %}</td>
 <td>{% if let Some(first) = candidate.admitted_first %}{{ first }}{% if !candidate.admitted_rest.is_empty() %} <span class="muted">({{ candidate.admitted_rest }})</span>{% endif %}{% endif %}</td>
 <td class="num">{{ candidate.utility }}</td>
 <td class="num">{{ candidate.rank }}</td>
 <td class="num">{{ candidate.cluster }}</td>
 <td class="num">{{ candidate.triage }}</td>
 <td class="num">{{ candidate.quality }}</td>
 <td class="num">{{ candidate.fit }}</td>
 <td>{% if candidate.exploration %}<span class="badge">exploration</span>{% endif %}{% if candidate.auto_include %}<span class="badge">auto</span>{% endif %}</td>
 <td>{% if let Some(why) = candidate.editor_why %}{{ why }}{% endif %}</td>
 </tr>
@@ -0,0 +1 @@
 {% if pagination.pages() > 1 %}<nav class="pagination">Page {{ pagination.page }} of {{ pagination.pages() }}</nav>{% endif %}
@@ -0,0 +1,11 @@
 <form class="rating" method="post" action="/rate">
  <input type="hidden" name="article_id" value="{{ widget.article_id }}">
  <input type="hidden" name="issue_date" value="{{ widget.issue_date }}">
  <input type="hidden" name="next" value="{{ widget.next }}">
  <span class="rating-prompt">Was this a good pick?</span>
  <button type="submit" name="label" value="loved" data-label="loved"{% if widget.current == "loved" %} class="active" aria-pressed="true"{% else %} aria-pressed="false"{% endif %}>Loved it</button>
  <button type="submit" name="label" value="good" data-label="good"{% if widget.current == "good" %} class="active" aria-pressed="true"{% else %} aria-pressed="false"{% endif %}>Good</button>
  <button type="submit" name="label" value="down" data-label="down"{% if widget.current == "down" %} class="active" aria-pressed="true"{% else %} aria-pressed="false"{% endif %}>Not for me</button>
 {% if widget.show_note %}<label class="rating-note">Note <input name="note"></label>{% endif %}
  <button class="clear{% if widget.current == "cleared" %} active{% endif %}" type="submit" name="label" value="cleared" data-label="cleared"{% if widget.current == "cleared" %} aria-pressed="true"{% else %} aria-pressed="false"{% endif %}>clear</button>
 </form>
@@ -0,0 +1,8 @@
 {% if signals.empty %}<p class="muted">No signals recorded for this row (hygiene exclusion or thin telemetry).</p>{% else %}<div class="signals-body">
 <div class="scroll-x"><table class="signals"><thead><tr><th>signal</th><th class="num">raw</th><th class="num">norm</th><th class="num">weight</th><th>present</th></tr></thead>
 <tbody>{% for line in signals.lines %}<tr{% if !line.present %} class="muted"{% endif %}><td>{{ line.name }}</td><td class="num">{{ line.raw }}</td><td class="num">{{ line.norm }}</td><td class="num">{{ line.weight }}</td><td>{% if line.present %}yes{% else %}absent{% endif %}</td></tr>{% endfor %}</tbody></table></div>
 <p class="muted">Preliminary blend {{ signals.blend }}{% if let Some(cos) = signals.top1_cos %} · interest top-1 cosine {{ cos }}{% endif %}{% if signals.exploration %} · <span class="badge">exploration</span>{% endif %}{% if signals.auto_include %} · <span class="badge">auto-include</span>{% endif %}</p>
 {% if !signals.top_interests.is_empty() %}<p><strong>Top interests</strong></p><ul>{% for interest in signals.top_interests %}<li>{{ interest.name }} <span class="muted">· z {{ interest.z }} · cos {{ interest.cos }}</span></li>{% endfor %}</ul>{% endif %}
 {% if !signals.neighbours.is_empty() %}<p><strong>Nearest rated neighbours</strong></p><ul>{% for neighbour in signals.neighbours %}<li><span class="badge {{ neighbour.label }}">{{ neighbour.label }}</span> <a href="/dashboard/articles/{{ neighbour.article_id }}">{{ neighbour.title }}</a> <span class="muted">· cos {{ neighbour.cos }}</span></li>{% endfor %}</ul>{% endif %}
 {% if !signals.notes.is_empty() %}<ul class="muted">{% for note in signals.notes %}<li>{{ note }}</li>{% endfor %}</ul>{% endif %}
 </div>{% endif %}
@@ -0,0 +1 @@
 {% extends "layout.html" %}{% block content %}<section class="reading narrow"><h1>Account</h1>{% if !error.is_empty() %}<p class="error">{{ error }}</p>{% endif %}<form method="post" action="/account/password"><label>Current password <input type="password" name="current_password" required></label><label>New password <input type="password" name="new_password" minlength="12" required></label><label>Confirm password <input type="password" name="confirm_password" minlength="12" required></label><button>Change password</button></form><form method="post" action="/account/logout-all" data-confirm="Sign out everywhere?"><button>Sign out everywhere</button></form><form method="post" action="/logout"><button>Sign out</button></form></section>{% endblock %}
@@ -0,0 +1,20 @@
 {% extends "layout.html" %}{% block content %}<article class="reading article-page">
 <header class="article-header">
 <h1><a href="{{ source_url }}">{{ title }}</a></h1>
 {% match byline %}{% when Some with (byline) %}<p class="byline">{{ byline }}</p>{% when None %}{% endmatch %}
 <p class="meta">{{ meta_line }}</p>
 {% match why %}{% when Some with (why) %}<p class="why"><em>Why it's here: {{ why }}</em></p>{% when None %}{% endmatch %}
 {% match social_line %}{% when Some with (social) %}<p class="social">{{ social }}</p>{% when None %}{% endmatch %}
 {% match summary %}{% when Some with (summary) %}<p class="summary">{{ summary }}</p>{% when None %}{% endmatch %}
 {% if excerpt_only %}<p class="notice">(excerpt only — read online)</p>{% endif %}
 </header>
 <hr class="rule">
 <div class="article-body">{{ body_html|safe }}</div>
 {% match discussion_html %}{% when Some with (discussion) %}<section class="discussion"><h2>Discussion</h2>{{ discussion|safe }}</section>{% when None %}{% endmatch %}
 <footer class="article-footer">
 {% match rating %}{% when Some with (widget) %}{% include "_rating_widget.html" %}{% when None %}{% endmatch %}
 <p><a href="{{ read_online_url }}">Read online ↗</a></p>
 <nav class="prev-next">{% match previous %}{% when Some with (previous) %}<a rel="prev" href="{{ previous.href }}">← {{ previous.title }}</a>{% when None %}<span></span>{% endmatch %}{% match next %}{% when Some with (next) %}<a rel="next" href="{{ next.href }}">{{ next.title }} →</a>{% when None %}{% endmatch %}</nav>
 <p><a href="{{ issue_href }}">← Back to this issue</a></p>
 </footer>
 </article>{% endblock %}
@@ -0,0 +1,7 @@
 {% extends "layout.html" %}{% block content %}<article class="reading behind">
 <h1>Behind the paper</h1>
 <p class="fact-line">{{ summary_line }}</p><p class="fact-line">{{ admitted_line }}</p><p class="fact-line">{{ learned_line }}</p>
 <h2>Near misses</h2><p><em>Highest utility not selected.</em></p>
 {% if near_misses.is_empty() %}<p>None recorded for this run.</p>{% else %}<ul class="near-misses">{% for near_miss in near_misses %}<li>{% if page.is_admin() %}<a href="/dashboard/articles/{{ near_miss.article_id }}">{{ near_miss.line }}</a>{% else %}{{ near_miss.line }}{% endif %}</li>{% endfor %}</ul>{% endif %}
 <p class="fact-line">{{ models_line }}</p><p><a href="{{ issue_href }}">← Back to this issue</a></p>
 </article>{% endblock %}
@@ -0,0 +1 @@
 {% if pager.pages > 1 %}<nav class="pager">{% if let Some(href) = pager.prev_href %}<a href="{{ href }}">← Previous</a>{% endif %}<span>Page {{ pager.page }} of {{ pager.pages }} · {{ pager.total }} rows</span>{% if let Some(href) = pager.next_href %}<a href="{{ href }}">Next →</a>{% endif %}</nav>{% else %}<p class="muted">{{ pager.total }} row{% if pager.total != 1 %}s{% endif %}</p>{% endif %}
@@ -0,0 +1,8 @@
 <figure class="spark-figure"><figcaption>{{ spark.title }}{% if !spark.caption.is_empty() %} <span class="muted">· {{ spark.caption }}</span>{% endif %}</figcaption>
 {% if spark.empty %}<p class="muted">No data yet.</p>{% else %}<svg class="spark" viewBox="0 0 {{ spark.width }} {{ spark.height }}" width="{{ spark.width }}" height="{{ spark.height }}" role="img" aria-label="{{ spark.title }}">
 {% for bar in spark.bars %}<rect class="s{{ bar.series }}" x="{{ bar.x }}" y="{{ bar.y }}" width="{{ bar.w }}" height="{{ bar.h }}"><title>{{ bar.label }}</title></rect>
 {% endfor %}{% if !spark.points.is_empty() %}<polyline class="line" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round" stroke-linecap="round" points="{{ spark.points }}"/>{% endif %}
 </svg>
 <div class="spark-axis muted"><span>{{ spark.first_label }}</span><span>{{ spark.last_label }}</span></div>
 {% if !spark.legend.is_empty() %}<ul class="spark-legend">{% for item in spark.legend %}<li><svg width="10" height="10" viewBox="0 0 10 10" aria-hidden="true"><rect class="s{{ item.series }}" width="10" height="10"/></svg> {{ item.name }}</li>{% endfor %}</ul>{% endif %}
 {% endif %}</figure>
@@ -0,0 +1,69 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard">
 <h1><a href="{{ url }}">{{ title }}</a></h1>
 <p class="muted">Article {{ id }} · <a href="/dashboard/articles?feed={{ feed_id }}">{{ feed }}</a>{% if let Some(category) = category %} · {{ category }}{% endif %}{% if let Some(author) = author %} · {{ author }}{% endif %}</p>
 <h2>Article</h2>
 <dl class="kv">
 <dt>Canonical URL</dt><dd><a href="{{ canonical_url }}">{{ canonical_url }}</a></dd>
 <dt>Published</dt><dd>{{ published_at }}</dd>
 <dt>First seen</dt><dd>{{ first_seen }}</dd>
 <dt>Words</dt><dd>{{ words }}{% if excerpt_only %} <span class="badge">excerpt only</span>{% endif %}</dd>
 <dt>Images</dt><dd>{{ image_count }}</dd>
 <dt>Sources</dt><dd>{% if sources.is_empty() %}<span class="muted">none recorded</span>{% else %}{% for source in sources %}{{ source.kind }} · {{ source.feed }}{% if let Some(category) = source.category %} ({{ category }}){% endif %}{% if !loop.last %}<br>{% endif %}{% endfor %}{% endif %}</dd>
 <dt>Social</dt><dd>{% if social.is_empty() %}<span class="muted">none</span>{% else %}{% for item in social %}{% if let Some(url) = item.url %}<a href="{{ url }}">{{ item.source }}</a>{% else %}{{ item.source }}{% endif %} · {{ item.score }} points · {{ item.comments }} comments{% if !loop.last %}<br>{% endif %}{% endfor %}{% endif %}</dd>
 <dt>In issues</dt><dd>{% if in_issues.is_empty() %}<span class="muted">never published</span>{% else %}{% for issue in in_issues %}<a href="{{ issue.href }}">{{ issue.date }}</a> · {{ issue.section }} · position {{ issue.position }}{% if issue.is_lead %} · lead{% endif %}{% if !loop.last %}<br>{% endif %}{% endfor %}{% endif %}</dd>
 <dt>Current rating</dt><dd>{% if let Some(rating) = rating %}<span class="badge {{ rating_class }}">{{ rating }}</span>{% else %}<span class="muted">unrated</span>{% endif %}</dd>
 </dl>
 {% include "_rating_widget.html" %}
 {% if let Some(text) = explain %}<details class="explain"><summary>Explain (text)</summary><pre class="block">{{ text }}</pre></details>{% endif %}
 <h2>Assessments</h2>
 {% if assessments.is_empty() %}<p class="muted">No LLM assessment stored.</p>{% else %}{% for assessment in assessments %}<section class="card">
 <h3>{{ assessment.stage }}{% if assessment.rejected %} <span class="badge down">rejected by provider</span>{% endif %}</h3>
 {% if assessment.rejected %}<p>{{ assessment.rationale }}</p><p class="muted">{{ assessment.model }} · prompt v{{ assessment.prompt_version }} · {{ assessment.assessed_at }}</p>{% else %}<dl class="kv">
 {% if assessment.stage == "deep" %}<dt>Quality</dt><dd>{{ assessment.score }}</dd><dt>Fit</dt><dd>{{ assessment.fit }}</dd><dt>Category</dt><dd>{{ assessment.category }}</dd><dt>Format</dt><dd>{{ assessment.kind }}</dd><dt>Paywalled guess</dt><dd>{% if assessment.paywalled %}yes{% else %}no{% endif %}</dd>{% else %}<dt>Interest</dt><dd>{{ assessment.score }}</dd><dt>Kind</dt><dd>{{ assessment.kind }}</dd>{% endif %}
 <dt>Rationale</dt><dd>{{ assessment.rationale }}</dd>
 <dt>Model</dt><dd>{{ assessment.model }} · prompt v{{ assessment.prompt_version }} · profile v{{ assessment.profile_version }}</dd>
 <dt>Assessed</dt><dd>{{ assessment.assessed_at }}</dd>
 </dl>
 {% if !assessment.facets.is_empty() %}<div class="scroll-x"><table class="facets"><thead><tr><th>facet</th><th>value</th></tr></thead><tbody>{% for facet in assessment.facets %}<tr><td>{{ facet.name }}</td><td>{{ facet.value }}</td></tr>{% endfor %}</tbody></table></div>{% endif %}{% endif %}
 </section>{% endfor %}{% endif %}
 <h2>Run history</h2>
 {% if history.is_empty() %}<p class="muted">Never considered by a run.</p>{% else %}<div class="scroll-x"><table class="history">
 <thead><tr><th>run</th><th>date</th><th>stage</th><th>reason</th><th>admitted by</th><th class="num">utility</th><th class="num">rank</th><th class="num">cluster</th><th>editor</th></tr></thead>
 <tbody>{% for row in history %}<tr>
 <td><details class="signals"><summary><a href="{{ row.run_href }}">run {{ row.run_id }}</a> <span class="badge {{ row.status }}">{{ row.status }}</span></summary>{% let signals = row.signals %}{% include "_signals_table.html" %}</details></td>
 <td>{{ row.date }}</td>
 <td><span class="badge {{ row.stage }}">{{ row.stage }}</span></td>
 <td>{% if let Some(reason) = row.reason %}{{ reason }}{% endif %}</td>
 <td>{% if let Some(first) = row.admitted_first %}{{ first }}{% if !row.admitted_rest.is_empty() %} <span class="muted">({{ row.admitted_rest }})</span>{% endif %}{% endif %}</td>
 <td class="num">{{ row.utility }}</td>
 <td class="num">{{ row.rank }}</td>
 <td class="num">{{ row.cluster }}</td>
 <td>{% if let Some(why) = row.editor_why %}{{ why }}{% endif %}</td>
 </tr>{% endfor %}</tbody></table></div>{% endif %}
 <h2>Neighbours and interests</h2>
 {% if let Some(signals) = latest_signals %}{% if signals.top_interests.is_empty() && signals.neighbours.is_empty() %}<p class="muted">The latest run recorded no interests or neighbours for this article.</p>{% else %}<div class="cards">
 <section class="card"><h3>Top interests</h3>{% if signals.top_interests.is_empty() %}<p class="muted">None.</p>{% else %}<div class="scroll-x"><table><thead><tr><th>interest</th><th class="num">z</th><th class="num">cos</th></tr></thead><tbody>{% for interest in signals.top_interests %}<tr><td>{{ interest.name }}</td><td class="num">{{ interest.z }}</td><td class="num">{{ interest.cos }}</td></tr>{% endfor %}</tbody></table></div>{% endif %}</section>
 <section class="card"><h3>Nearest rated neighbours</h3>{% if signals.neighbours.is_empty() %}<p class="muted">None.</p>{% else %}<div class="scroll-x"><table><thead><tr><th>label</th><th class="num">cos</th><th>article</th></tr></thead><tbody>{% for neighbour in signals.neighbours %}<tr><td><span class="badge {{ neighbour.label }}">{{ neighbour.label }}</span></td><td class="num">{{ neighbour.cos }}</td><td><a href="/dashboard/articles/{{ neighbour.article_id }}">{{ neighbour.title }}</a></td></tr>{% endfor %}</tbody></table></div>{% endif %}</section>
 </div>{% endif %}{% else %}<p class="muted">No signals recorded.</p>{% endif %}
 <h2>Embedding</h2>
 {% if let Some(embedding) = embedding %}<dl class="kv"><dt>Model</dt><dd>{{ embedding.model }}</dd><dt>Dimension</dt><dd>{{ embedding.dimension }}</dd><dt>Created</dt><dd>{{ embedding.created_at }}</dd><dt>Input hash</dt><dd><code>{{ embedding.input_hash }}</code></dd></dl>{% else %}<p class="muted">No embedding stored.</p>{% endif %}
 <h2>Rating events</h2>
 {% if events.is_empty() %}<p class="muted">No rating events.</p>{% else %}<div class="scroll-x"><table class="events">
 <thead><tr><th>when</th><th>label</th><th class="num">value</th><th>kind</th><th>source</th><th>user</th><th>issue</th><th>note</th></tr></thead>
 <tbody>{% for event in events %}<tr>
 <td>{{ event.event_at }}</td>
 <td><span class="badge {{ event.label_class }}">{{ event.label }}</span></td>
 <td class="num">{{ event.value }}</td>
 <td>{{ event.kind }}</td>
 <td>{{ event.source }}</td>
 <td>{% if let Some(user) = event.user %}{{ user }}{% else %}<span class="muted">—</span>{% endif %}</td>
 <td>{% if let Some(date) = event.issue_date %}<a href="/issues/{{ date }}">{{ date }}</a>{% endif %}</td>
 <td>{% if let Some(note) = event.note %}{{ note }}{% endif %}</td>
 </tr>{% endfor %}</tbody></table></div>{% endif %}
 </section>{% endblock %}
@@ -0,0 +1,34 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard">
 <h1>Articles</h1>
 <form class="filters" method="get" action="/dashboard/articles">
 <label>Title or URL <input type="search" name="q" value="{% if let Some(q) = filters.q %}{{ q }}{% endif %}"></label>
 <label>Feed id <input type="number" name="feed" value="{{ feed_value }}" min="1"></label>
 <label>Stage <select name="stage"><option value="">any</option>{% for name in stages %}<option value="{{ name }}"{% if let Some(current) = filters.stage %}{% if current.as_str() == *name %} selected{% endif %}{% endif %}>{{ name }}</option>{% endfor %}</select></label>
 <label>Reason <select name="reason"><option value="">any</option>{% for name in reasons %}<option value="{{ name }}"{% if let Some(current) = filters.reason %}{% if current.as_str() == *name %} selected{% endif %}{% endif %}>{{ name }}</option>{% endfor %}</select></label>
 <label>Rated <select name="rated"><option value="">all</option>{% for name in rated %}<option value="{{ name }}"{% if let Some(current) = filters.rated %}{% if current.as_str() == *name %} selected{% endif %}{% endif %}>{{ name }}</option>{% endfor %}</select></label>
 <label>Published <select name="published"><option value="">all</option><option value="yes"{% if let Some(current) = filters.published %}{% if current == "yes" %} selected{% endif %}{% endif %}>yes</option><option value="no"{% if let Some(current) = filters.published %}{% if current == "no" %} selected{% endif %}{% endif %}>no</option></select></label>
 <label>First seen from <input type="date" name="from" value="{% if let Some(from) = filters.from %}{{ from }}{% endif %}"></label>
 <label>to <input type="date" name="to" value="{% if let Some(to) = filters.to %}{{ to }}{% endif %}"></label>
 <label>Triage kind <select name="kind"><option value="">any</option>{% for name in kinds %}<option value="{{ name }}"{% if let Some(current) = filters.kind %}{% if current.as_str() == *name %} selected{% endif %}{% endif %}>{{ name }}</option>{% endfor %}</select></label>
 <label>Sort <select name="sort">{% for name in sorts %}<option value="{{ name }}"{% if filters.sort == *name %} selected{% endif %}>{{ name }}</option>{% endfor %}</select></label>
 <button type="submit">Apply</button> <a href="/dashboard/articles">Reset</a>
 </form>
 {% include "dashboard/_pager.html" %}
 <div class="scroll-x"><table class="articles" data-filter>
 <thead><tr><th>first seen</th><th>title</th><th>feed</th><th class="num">words</th><th>last stage</th><th>reason</th><th class="num">utility</th><th class="num">triage</th><th class="num">quality</th><th class="num">fit</th><th>rating</th><th>published</th></tr></thead>
 <tbody>{% for article in articles %}<tr>
 <td>{{ article.first_seen }}</td>
 <td><a href="{{ article.href }}">{{ article.title }}</a></td>
 <td>{% if let Some(feed_id) = article.feed_id %}<a href="/dashboard/articles?feed={{ feed_id }}">{{ article.feed }}</a>{% else %}{{ article.feed }}{% endif %}</td>
 <td class="num">{{ article.words }}</td>
 <td>{% if let Some(stage) = article.stage %}<span class="badge {{ stage }}">{{ stage }}</span>{% if let Some(run_id) = article.run_id %} <a class="muted" href="/dashboard/runs/{{ run_id }}">{% if let Some(date) = article.run_date %}{{ date }}{% else %}run {{ run_id }}{% endif %}</a>{% endif %}{% else %}<span class="muted">never considered</span>{% endif %}</td>
 <td>{% if let Some(reason) = article.reason %}{{ reason }}{% endif %}</td>
 <td class="num">{{ article.utility }}</td>
 <td class="num">{{ article.triage }}</td>
 <td class="num">{{ article.quality }}</td>
 <td class="num">{{ article.fit }}</td>
 <td>{% if let Some(rating) = article.rating %}<span class="badge {{ article.rating_class }}">{{ rating }}</span>{% endif %}</td>
 <td>{% if let Some(date) = article.published %}<a href="/issues/{{ date }}">{{ date }}</a>{% endif %}</td>
 </tr>{% endfor %}</tbody></table></div>
 {% include "dashboard/_pager.html" %}
 </section>{% endblock %}
@@ -0,0 +1,32 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard"{% if refresh %} data-refresh="5"{% endif %}>
 <h1><a href="/dashboard/jobs">Jobs</a> › Job {{ job.id }} · {{ job.name }} <span class="badge {{ job.status }}">{{ job.status }}</span></h1>
 {% if !description.is_empty() %}<p class="muted">{{ description }}</p>{% endif %}
 <div class="cards">
 <section class="card"><h2>Job</h2>
 <dl class="kv">
 <dt>Unit</dt><dd><code>{{ unit }}</code></dd>
 <dt>Requested</dt><dd>{{ job.requested }} · {{ job.requested_by }}</dd>
 <dt>Started</dt><dd>{{ job.started }}</dd>
 <dt>Finished</dt><dd>{{ job.finished }} · {{ job.duration }}</dd>
 <dt>Status</dt><dd><span class="badge {{ job.status }}">{{ job.status }}</span></dd>
 {% if let Some(message) = job.message %}<dt>Message</dt><dd class="message">{{ message }}</dd>{% endif %}
 {% if let Some(run_id) = job.run_id %}<dt>Run</dt><dd><a href="/dashboard/runs/{{ run_id }}">Run {{ run_id }}</a></dd>{% endif %}
 </dl>
 {% if refresh %}<p class="muted">This page reloads every 5 seconds while the job is requested or running.</p>{% endif %}
 </section>
 <section class="card"><h2>Unit</h2>
 {% if let Some(status) = status %}<dl class="kv">
 <dt>Active</dt><dd>{{ status.active_state }}{% if !status.sub_state.is_empty() %} ({{ status.sub_state }}){% endif %}</dd>
 <dt>Result</dt><dd>{{ status.result }}{% if let Some(code) = status.exit_status %} · exit status {{ code }}{% endif %}</dd>
 {% if let Some(started) = status.started %}<dt>Main started</dt><dd>{{ started }}</dd>{% endif %}
 {% if let Some(exited) = status.exited %}<dt>Main exited</dt><dd>{{ exited }}</dd>{% endif %}
 </dl>{% endif %}
 {% if let Some(error) = status_error %}<p class="error">Unit status unavailable: {{ error }}</p>{% endif %}
 <p class="muted">From <code>systemctl show {{ unit }}</code>.</p>
 </section>
 </div>
 <h2>Log</h2>
 {% if let Some(error) = log_error %}<p class="error">Journal unavailable: {{ error }}</p>{% endif %}
 <p class="muted">Last {{ log_lines }} lines of <code>journalctl -u {{ unit }}</code>.</p>
 <pre class="preview journal">{{ log }}</pre>
 </section>{% endblock %}
@@ -0,0 +1,28 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard">
 <h1>Jobs</h1>
 {% if jobs_enabled %}<p class="muted">Each job starts <code>daily-epub-job@&lt;name&gt;.service</code> through systemd; the unit runs <code>daily-epub job run &lt;name&gt;</code> and records itself here. Jobs that take the run lock wait for nothing: a second <code>generate</code> while one is running fails immediately.</p>{% else %}<p class="notice">Jobs are disabled on this server (<code>server.jobs_enabled = false</code>); run the commands by hand instead.</p>{% endif %}
 <div class="cards job-cards">{% for card in cards %}<section class="card">
 <h2>{{ card.name }}</h2>
 <p>{{ card.description }}</p>
 {% if let Some(lock) = card.lock %}<p class="muted">Takes the <code>{{ lock }}</code> lock.</p>{% endif %}
 <form method="post" action="/dashboard/jobs/{{ card.name }}" class="inline"{% if card.dangerous %} data-confirm="Start {{ card.name }}? This republishes the issue of that date."{% endif %}>
 {% if card.dated %}<label>Date <input type="date" name="date" value="{{ today }}"></label>{% endif %}
 <button type="submit"{% if !jobs_enabled %} disabled{% endif %}>Start</button>
 </form>
 </section>{% endfor %}</div>
 <h2>History</h2>
 {% if jobs.is_empty() %}<p class="muted">No jobs recorded yet.</p>{% else %}<div class="scroll-x"><table data-filter>
 <thead><tr><th>job</th><th>name</th><th>requested by</th><th>requested</th><th>started</th><th>finished</th><th class="num">duration</th><th>status</th><th>message</th><th>run</th></tr></thead>
 <tbody>{% for job in jobs %}<tr>
 <td><a href="/dashboard/jobs/{{ job.id }}">{{ job.id }}</a></td>
 <td>{{ job.name }}</td>
 <td>{{ job.requested_by }}</td>
 <td>{{ job.requested }}</td>
 <td>{{ job.started }}</td>
 <td>{{ job.finished }}</td>
 <td class="num">{{ job.duration }}</td>
 <td><span class="badge {{ job.status }}">{{ job.status }}</span></td>
 <td class="message">{% if let Some(message) = job.message %}{{ message }}{% endif %}</td>
 <td>{% if let Some(run_id) = job.run_id %}<a href="/dashboard/runs/{{ run_id }}">{{ run_id }}</a>{% endif %}</td>
 </tr>{% endfor %}</tbody></table></div>{% endif %}
 </section>{% endblock %}
@@ -0,0 +1,41 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard">
 <h1>Overview</h1>
 <div class="cards">
 <section class="card"><h2>Last run</h2>
 {% if let Some(run) = last_run %}<p><a href="/dashboard/runs/{{ run.id }}">Run {{ run.id }}</a> · {{ run.date }} · <span class="badge {{ run.status }}">{{ run.status }}</span></p>
 <p class="muted">Started {{ run.started }} · {{ run.duration }}</p>
 <pre class="block">{% for line in run.lines %}{{ line }}
 {% endfor %}</pre>
 {% if run.warnings > 0 %}<p><a href="/dashboard/runs/{{ run.id }}#warnings">{{ run.warnings }} warning{% if run.warnings != 1 %}s{% endif %}</a></p>{% endif %}
 {% if let Some(error) = run.error %}<p class="error">{{ error }}</p>{% endif %}
 {% else %}<p class="muted">No runs recorded yet.</p>{% endif %}
 </section>
 <section class="card"><h2>Budget today</h2>
 {% if budget.is_empty() %}<p class="muted">No providers configured.</p>{% else %}<dl class="kv budget">
 {% for line in budget %}<dt>{{ line.provider }}</dt><dd><meter value="{{ line.value }}" max="{{ line.max }}"{% if line.over %} class="over"{% endif %}></meter> {{ line.spent }} of {{ line.ceiling }}{% if line.over %} <strong class="error">ceiling reached</strong>{% endif %}</dd>
 {% endfor %}</dl>{% endif %}
 <p class="muted">Spend on the current UTC day across every recorded run.</p>
 </section>
 <section class="card"><h2>Ratings this week</h2>
 {% if ratings.is_empty() %}<p class="muted">No explicit ratings in the last seven days.</p>{% else %}<p>{{ ratings_total }} verdict{% if ratings_total != 1 %}s{% endif %}: {% for count in ratings %}<span class="badge {{ count.label }}">{{ count.label }}</span> {{ count.count }}{% if !loop.last %} · {% endif %}{% endfor %}</p>{% endif %}
 <p><a href="/dashboard/ratings">Rating history</a></p>
 </section>
 <section class="card"><h2>Jobs</h2>
 {% if active_jobs.is_empty() && finished_jobs.is_empty() %}<p class="muted">No jobs recorded.</p>{% else %}
 {% if !active_jobs.is_empty() %}<ul class="jobs">{% for job in active_jobs %}<li><a href="/dashboard/jobs/{{ job.id }}">{{ job.name }}</a> <span class="badge {{ job.status }}">{{ job.status }}</span> <span class="muted">requested {{ job.requested }}</span></li>{% endfor %}</ul>{% endif %}
 {% if !finished_jobs.is_empty() %}<p class="muted">Recently finished</p><ul class="jobs">{% for job in finished_jobs %}<li><a href="/dashboard/jobs/{{ job.id }}">{{ job.name }}</a> <span class="badge {{ job.status }}">{{ job.status }}</span> <span class="muted">{{ job.finished }}</span>{% if let Some(message) = job.message %} <span class="muted">— {{ message }}</span>{% endif %}</li>{% endfor %}</ul>{% endif %}
 {% endif %}
 <p><a href="/dashboard/jobs">All jobs</a></p>
 </section>
 {% if !config_warnings.is_empty() %}<section class="card"><h2>Config on disk</h2>
 <ul class="warnings">{% for line in config_warnings %}<li class="error">{{ line }}</li>{% endfor %}</ul>
 <p><a href="/dashboard/settings">Settings</a></p>
 </section>{% endif %}
 </div>
 <h2>Last 30 runs</h2>
 <div class="sparklines">{% for item in sparklines %}{% let spark = item %}{% include "dashboard/_sparkline.html" %}{% endfor %}</div>
 <h2>Unrated picks</h2>
 {% if unrated.is_empty() %}<p class="muted">Every pick from the last three issues has a verdict.</p>{% else %}<p class="muted">Picks from the last three issues without a verdict yet.</p>
 <ul class="picks">{% for pick in unrated %}<li><a href="{{ pick.issue_href }}">{{ pick.title }}</a> <span class="muted">· {{ pick.feed }} · {{ pick.issue_date }}</span>
 {% let widget = pick.widget %}{% include "_rating_widget.html" %}</li>{% endfor %}</ul>{% endif %}
 </section>{% endblock %}
@@ -0,0 +1,51 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard profile">
 <h1>Profile</h1>
 <div class="profile-grid">
 <div class="profile-editor">
 <h2>profile.md</h2>
 <p class="meta"><code>{{ path }}</code>{% if !exists %} — <strong>missing</strong>; saving creates it{% else %} · {{ bytes }} bytes{% endif %} · limit {{ max_bytes }} bytes. Any <code>## Interests</code> section is parsed one interest per line; everything else goes into the system prompt verbatim.</p>
 <form method="post" action="/dashboard/profile" class="profile-form">
 <textarea name="content" rows="28" spellcheck="true" required>{{ content }}</textarea>
 <div><button type="submit">Save</button> <span class="meta">The next run rebuilds the system prompt from the saved file.</span></div>
 </form>
 </div>
 <div class="profile-preview">
 <h2>What the loader parses</h2>
 <h3>Passthrough sections</h3>
 {% if preview_body.trim().is_empty() %}<p class="meta">Nothing passes through — the file is empty or only has an Interests section.</p>{% else %}<pre class="preview">{{ preview_body }}</pre>{% endif %}
 <h3>Extracted <code>## Interests</code> lines</h3>
 {% if preview_interests.is_empty() %}<p class="meta">None. The prompt uses the OPML interests alone.</p>{% else %}<ul>{% for interest in preview_interests %}<li>{{ interest }}</li>{% endfor %}</ul>{% endif %}
 </div>
 </div>
 <h2>History</h2>
 {% if versions.is_empty() %}<p class="meta">No saved versions yet. The first save records the current file as version 1.</p>{% else %}
 <p class="meta">Each row is the text that was replaced by a save (or a restore). Restore writes it back and records what is on disk now as a new version.</p>
 <div class="scroll-x"><table class="versions">
 <thead><tr><th>Version</th><th>Replaced at</th><th>By</th><th>Size</th><th>Preview</th><th></th></tr></thead>
 <tbody>{% for version in versions %}<tr>
 <td>#{{ version.id }}</td>
 <td>{{ version.saved_at }}</td>
 <td>{{ version.saved_by }}</td>
 <td>{{ version.bytes }} bytes</td>
 <td><pre class="preview">{{ version.preview }}</pre></td>
 <td><form method="post" action="/dashboard/profile/restore" data-confirm="Restore version #{{ version.id }}? The current file is kept as a new version."><input type="hidden" name="version_id" value="{{ version.id }}"><button type="submit">Restore</button></form></td>
 </tr>{% endfor %}</tbody></table></div>
 {% endif %}
 <h2>Standing interests</h2>
 <p class="meta"><code>{{ opml_path }}</code> · {{ opml_count }} interests, grouped the way the system prompt lists them. The union of these and the <code>## Interests</code> lines above is what the prompt uses; edit the OPML file to change them.</p>
 {% if !opml_error.is_empty() %}<p class="error">! {{ opml_error }}</p>{% endif %}
 {% if !themes.is_empty() %}<dl class="kv themes">{% for theme in themes %}<dt>{{ theme.name }} <span class="meta">({{ theme.count }})</span></dt><dd>{{ theme.members }}</dd>{% endfor %}</dl>{% endif %}
 <h2>Learned adjustments</h2>
 <p class="meta">Rebuilt weekly from ratings by the editor model (prompt version {{ prompt_version }}, built {{ prompt_built_at }}, {{ learned_age }}). {% if rebuild_due %}<strong>A rebuild is due</strong> — the next run performs it, or start it now.{% else %}The next scheduled rebuild is at least {{ rebuild_interval_days }} days after the last one; the next run performs it when due.{% endif %}</p>
 {% if learned.trim().is_empty() %}<p class="meta">No learned adjustments stored yet.</p>{% else %}<pre class="preview learned">{{ learned }}</pre>{% endif %}
 <form method="post" action="/dashboard/jobs/profile-rebuild" class="inline" data-confirm="Rebuild the learned adjustments now? This calls the editor model."><button type="submit"{% if !jobs_enabled %} disabled{% endif %}>Rebuild profile now</button>{% if !jobs_enabled %} <span class="meta">Jobs are disabled on this server (<code>server.jobs_enabled = false</code>); run <code>daily-epub profile rebuild</code> instead.</span>{% else %} <span class="meta">Starts the <code>profile-rebuild</code> job through systemd.</span>{% endif %}</form>
 <h2>System prompt</h2>
 <p class="meta">Stored after the last run: version {{ prompt_version }}, {{ prompt_chars }} characters, {{ prompt_verdicts }} verdict lines. Every LLM call of a run receives exactly this text.</p>
 {% if prompt.is_empty() %}<p class="meta">No prompt has been built yet.</p>{% else %}<details id="profile-prompt"><summary>Show the system prompt</summary><pre class="preview prompt">{{ prompt }}</pre></details>{% endif %}
 </section>{% endblock %}
@@ -0,0 +1,76 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard ratings">
 <h1>Ratings</h1>
 <p class="preference-summary">{{ summary_line }}</p>
 {% if no_embedding_count > 0 %}<p class="notice">{{ no_embedding_count }} rated articles have no embedding and cannot act as neighbours — run the <code>features-backfill</code> job (<code>features backfill --rated-only</code>).</p>{% endif %}
 <details id="ratings-how" class="how">
 <summary>How ratings enter the algorithm</summary>
 <ol>
 <li><strong>Prompt verdict block.</strong> The {{ how.verdicts_in_prompt }} most recent non-cleared verdicts, newest first, are written into every LLM call's system prompt as one line each (<code>LOVED | title | feed | summary</code>). Only the rank matters here — a verdict never ages out of this block, it is pushed out by newer ones. Tune <a href="/dashboard/settings#curation.feedback"><code>curation.feedback.verdicts_in_prompt</code></a>.</li>
 <li><strong>Weekly learned adjustments.</strong> Every {{ how.rebuild_interval_days }} days the editor model rewrites the profile's "Learned adjustments" bullets from the {{ how.max_ratings_in_rebuild }} most recent non-cleared verdicts, including notes and deep-assessment facets. See the <a href="/dashboard/profile">Profile</a> page.</li>
 <li><strong>Rated-neighbour signal.</strong> Each verdict with an embedding is an example with weight <code>value × 0.5^(age / {{ how.half_life_days }} days)</code>, where loved = {{ how.loved }}, good = {{ how.good }}, not for me = {{ how.not_for_me }}; ratings older than {{ how.lookback_days }} days are not loaded. A candidate's signal is the weighted mean cosine to its {{ how.neighbour_k }} nearest positive examples minus {{ how.negative_coefficient }} × the same over its nearest negative ones. The signal's preliminary weight ({{ how.knn_weight }}) is scaled by a gate that opens above {{ how.knn_floor }} embedded verdicts and is fully open at {{ how.knn_full }}. Tune <a href="/dashboard/settings#curation.ranking"><code>curation.ranking.rating_half_life_days</code>, <code>knn_floor</code>, <code>knn_full</code>, <code>neighbour_k</code></a> and <a href="/dashboard/settings#curation.ranking.weights.preliminary"><code>weights.preliminary.knn</code></a>.</li>
 <li><strong>Feed affinity.</strong> The same decayed weight is credited to the rated article's direct feeds, split evenly; each feed's Beta-smoothed rate <code>(up + 1) / (up + down + 2)</code> becomes a candidate's signal (the mean over its rated direct feeds). Its weight ({{ how.feed_weight }}) is gated between {{ how.feed_floor }} and {{ how.feed_full }} attributable ratings. Tune <a href="/dashboard/settings#curation.ranking"><code>curation.ranking.feed_floor</code>, <code>feed_full</code></a> and <a href="/dashboard/settings#curation.ranking.weights.preliminary"><code>weights.preliminary.feed</code></a>.</li>
 </ol>
 <p>Clearing a verdict removes it from all four paths without deleting history; ratings are append-only.</p>
 </details>
 <nav class="tabs"><a href="{{ current_href }}"{% if tab == "current" %} class="active"{% endif %}>Current ({{ current_total }})</a> <a href="{{ events_href }}"{% if tab == "events" %} class="active"{% endif %}>Events</a></nav>
 {% if tab == "events" %}
 <form class="filters" method="get" action="/dashboard/ratings">
 <input type="hidden" name="tab" value="events">
 <label>Label <select name="label"><option value="">any</option><option value="loved"{% if filter_label == "loved" %} selected{% endif %}>Loved it</option><option value="good"{% if filter_label == "good" %} selected{% endif %}>Good</option><option value="down"{% if filter_label == "down" %} selected{% endif %}>Not for me</option><option value="cleared"{% if filter_label == "cleared" %} selected{% endif %}>Cleared</option></select></label>
 <label>Source <select name="source"><option value="">any</option>{% for source in sources %}<option value="{{ source }}"{% if filter_source == source.as_str() %} selected{% endif %}>{{ source }}</option>{% endfor %}</select></label>
 <label>User <select name="user"><option value="">any</option>{% for username in usernames %}<option value="{{ username }}"{% if filter_user == username.as_str() %} selected{% endif %}>{{ username }}</option>{% endfor %}</select></label>
 <label>From <input type="date" name="from" value="{{ filter_from }}"></label>
 <label>To <input type="date" name="to" value="{{ filter_to }}"></label>
 <button type="submit">Filter</button>
 </form>
 <p class="meta">{{ pagination.total }} events, newest first. History is append-only; a later explicit event for the same article marks the earlier one <em>superseded</em>. Use the clear verdict to retract.</p>
 <div class="scroll-x"><table>
 <thead><tr><th>Event</th><th>Verdict</th><th>Value</th><th>Article</th><th>Issue</th><th>When</th><th>Source</th><th>By</th><th>Note</th></tr></thead>
 <tbody>
 {% for event in events %}<tr{% if event.superseded %} class="superseded"{% endif %}>
 <td>#{{ event.id }}{% if event.kind != "explicit" %} <span class="badge">{{ event.kind }}</span>{% endif %}{% if event.superseded %} <span class="badge cleared">superseded</span>{% endif %}</td>
 <td><span class="badge {{ event.badge }}">{{ event.verdict }}</span></td>
 <td>{{ event.value }}</td>
 <td><a href="/dashboard/articles/{{ event.article_id }}">{{ event.title }}</a></td>
 <td>{% if !event.issue_date.is_empty() %}<a href="/issues/{{ event.issue_date }}">{{ event.issue_date }}</a>{% endif %}</td>
 <td>{{ event.when }}</td>
 <td>{{ event.source }}</td>
 <td>{{ event.username }}</td>
 <td>{{ event.note }}</td>
 </tr>
 {% endfor %}
 {% if events.is_empty() %}<tr><td colspan="9">No rating events match.</td></tr>{% endif %}
 </tbody></table></div>
 <div class="pager">{% if !prev_href.is_empty() %}<a href="{{ prev_href }}">← Newer</a>{% endif %} {% include "_pagination.html" %} {% if !next_href.is_empty() %}<a href="{{ next_href }}">Older →</a>{% endif %}</div>
 {% else %}
 <form class="filters" method="get" action="/dashboard/ratings">
 <input type="hidden" name="tab" value="current">
 <label>Label <select name="label"><option value="">any</option><option value="loved"{% if filter_label == "loved" %} selected{% endif %}>Loved it</option><option value="good"{% if filter_label == "good" %} selected{% endif %}>Good</option><option value="down"{% if filter_label == "down" %} selected{% endif %}>Not for me</option><option value="cleared"{% if filter_label == "cleared" %} selected{% endif %}>Cleared</option></select></label>
 <label>Source <select name="source"><option value="">any</option>{% for source in sources %}<option value="{{ source }}"{% if filter_source == source.as_str() %} selected{% endif %}>{{ source }}</option>{% endfor %}</select></label>
 <label>Feed <select name="feed"><option value="">any</option>{% for feed in feeds %}<option value="{{ feed.id }}"{% if filter_feed == feed.id.to_string() %} selected{% endif %}>{{ feed.title }}</option>{% endfor %}</select></label>
 <label>Title <input type="search" name="q" value="{{ filter_q }}" placeholder="contains…"></label>
 <button type="submit">Filter</button>
 </form>
 <p class="meta">One row per rated article (its latest explicit event), newest first. {% match last_run %}{% when Some with (run) %}"Used last run" counts the candidates of run #{{ run.id }} ({{ run.date }}, {{ run.status }}) that listed the article among their nearest rated neighbours, and how many of those were selected.{% when None %}No run has happened yet, so "Used last run" is empty.{% endmatch %}</p>
 <div class="scroll-x"><table class="contributions">
 <thead><tr><th>Verdict</th><th>Article</th><th>When · by</th><th>Note</th><th>Age → decay</th><th>Neighbour weight</th><th>Feed credit</th><th>In prompt</th><th>In rebuild</th><th>Used last run</th></tr></thead>
 <tbody>
 {% for row in current %}<tr>
 <td><span class="badge {{ row.badge }}">{{ row.verdict }}</span>{% let widget = row.widget %}{% include "_rating_widget.html" %}</td>
 <td><a href="/dashboard/articles/{{ row.article_id }}">{{ row.title }}</a><br><span class="meta">{{ row.feed_title }}{% if !row.issue_date.is_empty() %} · <a href="/issues/{{ row.issue_date }}">{{ row.issue_date }}</a>{% endif %}</span></td>
 <td>{{ row.when }}<br><span class="meta">{{ row.source }} · <span class="by">{{ row.username }}</span></span></td>
 <td>{{ row.note }}</td>
 <td>{{ row.age_days }} d → {{ row.decay }}</td>
 <td>{% if row.has_embedding && !row.neighbour_weight.is_empty() %}{{ row.neighbour_weight }}{% if row.beyond_lookback %} <span class="meta">(beyond lookback)</span>{% endif %}{% else if row.badge == "cleared" %}<span class="meta">—</span>{% else %}<span class="meta">no embedding</span>{% endif %}</td>
 <td>{% for credit in row.feed_credits %}{{ credit.title }} {{ credit.credit }}{% if !loop.last %}<br>{% endif %}{% endfor %}</td>
 <td>{% if row.in_prompt %}✓{% endif %}</td>
 <td>{% if row.in_rebuild %}✓{% endif %}</td>
 <td>{% if row.used_total > 0 %}{{ row.used_total }} ({{ row.used_selected }} selected){% endif %}</td>
 </tr>
 {% endfor %}
 {% if current.is_empty() %}<tr><td colspan="10">No current verdicts match.</td></tr>{% endif %}
 </tbody></table></div>
 {% endif %}
 </section>{% endblock %}
@@ -0,0 +1,56 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard">
 <h1>Run {{ run.id }} · {{ run.date }} <span class="badge {{ run.status }}">{{ run.status }}</span>{% if run.dry_run %} <span class="muted">dry run</span>{% endif %}</h1>
 <p class="muted">Started {{ run.started }} · finished {{ run.finished }} · {{ run.duration }} · {{ run.total_cost }}</p>
 <nav class="run-nav">{% if let Some(prev) = run.prev_id %}<a href="/dashboard/runs/{{ prev }}">← Run {{ prev }}</a>{% endif %}{% if let Some(href) = run.issue_href %}<a href="{{ href }}">Issue {{ run.date }}</a>{% else %}<span class="muted">No issue for {{ run.date }}</span>{% endif %}{% if let Some(next) = run.next_id %}<a href="/dashboard/runs/{{ next }}">Run {{ next }} →</a>{% endif %}</nav>
 {% if let Some(error) = run.error %}<p class="error">{{ error }}</p>{% endif %}
 <h2>Funnel</h2>
 <div class="scroll-x"><table class="funnel-table">
 <thead><tr><th>stage</th><th>reached</th><th class="num">reached</th><th class="num">stopped here</th><th>why</th></tr></thead>
 <tbody>{% for stage in funnel %}<tr>
 <td><span class="badge {{ stage.stage }}">{{ stage.stage }}</span></td>
 <td class="funnel-cell"><div class="funnel"><svg width="{{ stage.percent }}%" height="12" role="img" aria-label="{{ stage.reached }} reached"></svg></div></td>
 <td class="num">{{ stage.reached }}</td>
 <td class="num">{{ stage.stopped }}</td>
 <td class="reasons">{% for reason in stage.reasons %}{{ reason.reason }} {{ reason.count }}{% if !loop.last %} · {% endif %}{% endfor %}</td>
 </tr>{% endfor %}</tbody></table></div>
 {% if has_report %}<div class="cards">
 <section class="card"><h2>Admission mix</h2>{% if admission.is_empty() %}<p class="muted">Nothing admitted.</p>{% else %}<dl class="kv">{% for line in admission %}<dt>{{ line.name }}</dt><dd>{{ line.count }}</dd>{% endfor %}</dl>{% endif %}</section>
 <section class="card"><h2>Preference state</h2><dl class="kv">
 <dt>rated with embeddings</dt><dd>{{ preference.rated_with_embeddings }}</dd>
 <dt>knn gate</dt><dd>{{ preference.knn_gate }}</dd>
 <dt>feed gate</dt><dd>{{ preference.feed_gate }}</dd>
 <dt>verdicts in prompt</dt><dd>{{ preference.verdicts_in_prompt }}</dd>
 </dl></section>
 <section class="card"><h2>Timings</h2><div class="scroll-x"><table><thead><tr><th>stage</th><th class="num">seconds</th></tr></thead><tbody>{% for line in timings %}<tr><td>{{ line.stage }}</td><td class="num">{{ line.seconds }}</td></tr>{% endfor %}<tr><th>total</th><th class="num">{{ timings_total }}</th></tr></tbody></table></div></section>
 <section class="card"><h2>Provider usage</h2><div class="scroll-x"><table><thead><tr><th>provider</th><th class="num">in</th><th class="num">cached</th><th class="num">cache write</th><th class="num">out</th><th class="num">cost</th></tr></thead><tbody>{% for line in providers %}<tr><td>{{ line.provider }}</td><td class="num">{{ line.input }}</td><td class="num">{{ line.cached }}</td><td class="num">{{ line.cache_write }}</td><td class="num">{{ line.output }}</td><td class="num">{{ line.cost }}</td></tr>{% endfor %}</tbody></table></div></section>
 <section class="card" id="warnings"><h2>Warnings</h2>{% if warnings.is_empty() %}<p class="muted">None.</p>{% else %}<ul>{% for warning in warnings %}<li>{{ warning }}</li>{% endfor %}</ul>{% endif %}</section>
 <section class="card"><h2>Feeds (top {{ feeds.len() }})</h2><div class="scroll-x"><table><thead><tr><th>feed</th><th class="num">entries</th></tr></thead><tbody>{% for line in feeds %}<tr><td>{{ line.name }}</td><td class="num">{{ line.count }}</td></tr>{% endfor %}</tbody></table></div></section>
 </div>{% else %}<p class="muted">This run has no stored report; only the funnel and candidates are available.</p>{% endif %}
 <h2>Config diff</h2>
 {% if let Some(against) = diff_against %}{% if config_diff.is_empty() %}<p class="muted">No settings changed since <a href="/dashboard/runs/{{ against }}">run {{ against }}</a>.</p>{% else %}<p class="muted">Against the previous non-dry run, <a href="/dashboard/runs/{{ against }}">run {{ against }}</a>.</p>
 <div class="scroll-x"><table class="diff"><thead><tr><th>key</th><th>before</th><th>after</th></tr></thead><tbody>{% for row in config_diff %}<tr><td><code>{{ row.key }}</code></td><td class="before">{{ row.before }}</td><td class="after">{{ row.after }}</td></tr>{% endfor %}</tbody></table></div>{% endif %}{% else %}<p class="muted">No earlier non-dry run to compare against.</p>{% endif %}
 <h2>Near misses</h2>
 {% if near_misses.is_empty() %}<p class="muted">None recorded.</p>{% else %}<div class="scroll-x"><table>
 <thead><tr><th>#</th><th class="num">score</th><th>title</th><th>feed</th><th class="num">quality</th><th class="num">fit</th><th>stage</th><th>reason</th></tr></thead>
 <tbody>{% for miss in near_misses %}<tr><td>{{ loop.index }}</td><td class="num">{{ miss.score }}</td><td><a href="{{ miss.href }}">{{ miss.title }}</a></td><td>{{ miss.feed }}</td><td class="num">{{ miss.quality }}</td><td class="num">{{ miss.fit }}</td><td><span class="badge {{ miss.stage }}">{{ miss.stage }}</span></td><td>{% if let Some(reason) = miss.reason %}{{ reason }}{% endif %}</td></tr>{% endfor %}</tbody></table></div>{% endif %}
 <h2>Candidates</h2>
 <form class="filters" method="get" action="/dashboard/runs/{{ run.id }}">
 <label>Stage <select name="stage"><option value="">any</option>{% for name in stages %}<option value="{{ name }}"{% if let Some(current) = filters.stage %}{% if current.as_str() == *name %} selected{% endif %}{% endif %}>{{ name }}</option>{% endfor %}</select></label>
 <label>Reason <select name="reason"><option value="">any</option>{% for name in reasons %}<option value="{{ name }}"{% if let Some(current) = filters.reason %}{% if current.as_str() == *name %} selected{% endif %}{% endif %}>{{ name }}</option>{% endfor %}</select></label>
 <label>Admitted by <select name="admitted_by"><option value="">any</option>{% for name in retrievers %}<option value="{{ name }}"{% if let Some(current) = filters.admitted_by %}{% if current.as_str() == *name %} selected{% endif %}{% endif %}>{{ name }}</option>{% endfor %}</select></label>
 <label>Flag <select name="flag"><option value="">any</option><option value="exploration"{% if let Some(current) = filters.flag %}{% if current == "exploration" %} selected{% endif %}{% endif %}>exploration</option><option value="auto"{% if let Some(current) = filters.flag %}{% if current == "auto" %} selected{% endif %}{% endif %}>auto-include</option></select></label>
 <label>Title <input type="search" name="q" value="{% if let Some(q) = filters.q %}{{ q }}{% endif %}"></label>
 <label>Sort <select name="sort">{% for name in sorts %}<option value="{{ name }}"{% if filters.sort == *name %} selected{% endif %}>{{ name }}</option>{% endfor %}</select></label>
 <button type="submit">Apply</button> <a href="/dashboard/runs/{{ run.id }}">Reset</a>
 </form>
 {% include "dashboard/_pager.html" %}
 <div class="scroll-x"><table class="candidates" data-filter>
 <thead><tr><th>title</th><th>feed</th><th class="num">words</th><th>stage</th><th>reason</th><th>admitted by</th><th class="num">utility</th><th class="num">rank</th><th class="num">cluster</th><th class="num">triage</th><th class="num">quality</th><th class="num">fit</th><th>flags</th><th>editor</th></tr></thead>
 <tbody>{% for candidate in candidates %}{% include "_candidate_row.html" %}{% endfor %}</tbody></table></div>
 {% include "dashboard/_pager.html" %}
 </section>{% endblock %}
@@ -0,0 +1,21 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard">
 <h1>Runs</h1>
 <form class="filters" method="get" action="/dashboard/runs">
 <label>Status <select name="status"><option value="">any</option>{% for name in statuses %}<option value="{{ name }}"{% if status == *name %} selected{% endif %}>{{ name }}</option>{% endfor %}</select></label>
 <button type="submit">Filter</button>
 </form>
 <div class="scroll-x"><table data-filter>
 <thead><tr><th>run</th><th>date</th><th>status</th><th>started</th><th>duration</th><th>considered → eligible → triaged → assessed → shortlisted → selected</th><th>cost</th><th class="num">total</th><th>warnings</th></tr></thead>
 <tbody>{% for run in runs %}<tr>
 <td><a href="/dashboard/runs/{{ run.id }}">{{ run.id }}</a></td>
 <td><a href="/issues/{{ run.date }}">{{ run.date }}</a></td>
 <td><span class="badge {{ run.status }}">{{ run.status }}</span>{% if run.dry_run %} <span class="muted">dry</span>{% endif %}</td>
 <td>{{ run.started }}</td>
 <td>{{ run.duration }}</td>
 <td>{{ run.funnel }}</td>
 <td>{{ run.costs }}</td>
 <td class="num">{{ run.total }}</td>
 <td class="num">{% if run.warnings > 0 %}<a href="/dashboard/runs/{{ run.id }}#warnings">{{ run.warnings }}</a>{% else %}0{% endif %}</td>
 </tr>{% endfor %}</tbody></table></div>
 {% include "dashboard/_pager.html" %}
 </section>{% endblock %}
@@ -0,0 +1,41 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard settings">
 <h1>Settings</h1>
 <p class="meta">{% match config_path %}{% when Some with (path) %}Editing <code>{{ path }}</code>. Saved settings apply to the next run; a hand edit on disk shows up on the next page view.{% when None %}No config file is configured; start the server with <code>--config</code> to edit settings here. The values below are the built-in defaults plus the environment.{% endmatch %} · <a href="/dashboard/settings/history">History</a></p>
 {% match load_error %}{% when Some with (error) %}<p class="error banner">! config.toml on disk does not load: {{ error }} — the previous configuration stays live.</p>{% when None %}{% endmatch %}
 {% if !errors.is_empty() %}<ul class="error banner">{% for error in errors %}<li>{{ error }}</li>{% endfor %}</ul>{% endif %}
 <form method="post" action="/dashboard/settings" class="settings-form" id="settings-form">
 {% for group in groups %}<section class="card" id="{{ group.id }}">
 <h2>{{ group.title }}</h2>
 {% match group.provider %}{% when Some with (provider) %}<p class="meta">Key: <code>{{ crate::config::ProviderConfig::api_key_env_var(provider.name) }}</code> in the env file. {% if provider.removable() %}Not named by any <code>[llm]</code> role. <button type="submit" form="remove-{{ provider.name }}" class="danger">Remove provider</button>{% else if provider.built_in %}Built in: declared by the defaults, so it can be edited and left unreferenced but not removed.{% else %}Named by <code>llm.{{ provider.roles() }}</code>; reassign the role before removing it.{% endif %}</p>{% when None %}{% endmatch %}
 {% if group.is_weights() %}<p class="meta">Weights need not sum to 1; they are renormalized over the signals present for each article.</p>{% endif %}
 {% for field in group.fields %}<div class="setting kind-{{ field.kind_name() }}">
 <div class="setting-label"><label for="{{ field.input_id() }}"><code>{{ field.key }}</code></label>{% if field.restart_required %} <span class="badge">restart</span>{% endif %}{% match field.help %}{% when Some with (help) %}<p class="help">{{ help }}</p>{% when None %}{% endmatch %}</div>
 <div class="setting-input">
 {% if field.is_secret() %}<p class="secret">{% if field.is_set() %}set{% if field.is_env() %} (from <code>{{ field.env_var() }}</code>){% else if field.is_file() %} (in the config file — move it to the env file){% endif %}{% else %}not set — set <code>{{ field.env_var() }}</code> in the env file{% endif %}</p>
 {% else if field.is_env() %}{% if field.is_text_list() %}<textarea id="{{ field.input_id() }}" disabled>{{ field.current }}</textarea>{% else %}<input id="{{ field.input_id() }}" type="text" value="{{ field.current }}" disabled>{% endif %}<p class="help">locked by <code>{{ field.env_var() }}</code> in the env file</p>
 {% else if field.is_bool() %}<select id="{{ field.input_id() }}" name="{{ field.path }}"><option value="true"{% if field.current == "true" %} selected{% endif %}>true</option><option value="false"{% if field.current == "false" %} selected{% endif %}>false</option></select>
 {% else if field.is_enum() %}<select id="{{ field.input_id() }}" name="{{ field.path }}">{% for option in field.options() %}<option value="{{ option }}"{% if field.current == option.as_str() %} selected{% endif %}>{% if option.is_empty() %}(none){% else %}{{ option }}{% endif %}</option>{% endfor %}</select>
 {% else if field.is_text_list() %}<textarea id="{{ field.input_id() }}" name="{{ field.path }}" rows="4" spellcheck="false">{{ field.current }}</textarea>
 {% else if field.is_number() %}<input id="{{ field.input_id() }}" name="{{ field.path }}" type="number" step="{% if field.is_integer() %}1{% else %}any{% endif %}" value="{{ field.current }}">
 {% else %}<input id="{{ field.input_id() }}" name="{{ field.path }}" type="text" value="{{ field.current }}" spellcheck="false">
 {% endif %}
 {% if !field.is_secret() && !field.is_env() %}<p class="default">default: {% if field.default.is_empty() %}<em>unset</em>{% else if field.is_text_list() %}<code class="lines">{{ field.default }}</code>{% else %}<code>{{ field.default }}</code>{% endif %}{% if field.current != field.default %} <button type="button" class="reset" data-reset="{{ field.input_id() }}" data-default="{{ field.default }}">reset to default</button>{% endif %}</p>{% endif %}
 </div>
 </div>
 {% endfor %}
 </section>
 {% endfor %}
 <div class="actions">{% match config_path %}{% when Some with (_path) %}<button type="submit">Save settings</button>{% when None %}<button type="submit" disabled>Save settings</button>{% endmatch %}</div>
 </form>
 {% for group in groups %}{% match group.provider %}{% when Some with (provider) %}{% if provider.removable() %}<form method="post" action="/dashboard/settings/providers" id="remove-{{ provider.name }}" class="inline" data-confirm="Remove [providers.{{ provider.name }}] from config.toml?"><input type="hidden" name="action" value="remove"><input type="hidden" name="name" value="{{ provider.name }}"></form>{% endif %}{% when None %}{% endmatch %}{% endfor %}
 <section class="card" id="add-provider">
 <h2>Add provider</h2>
 <form method="post" action="/dashboard/settings/providers" class="add-provider">
 <input type="hidden" name="action" value="add">
 <label>Name <input name="name" type="text" pattern="[a-z0-9_]+" placeholder="mistral" required{% if config_path.is_none() %} disabled{% endif %}></label>
 <label>Kind <select name="kind">{% for kind in provider_kinds %}<option value="{{ kind }}">{{ kind }}</option>{% endfor %}</select></label>
 <p class="help">Inserts <code>[providers.&lt;name&gt;]</code> with placeholder <code>base_url</code> and <code>model</code>; edit them above afterwards and put <code>DAILY_EPUB_PROVIDERS__&lt;NAME&gt;__API_KEY</code> in the env file.</p>
 <button type="submit"{% if config_path.is_none() %} disabled{% endif %}>Add provider</button>
 </form>
 </section>
 </section>{% endblock %}
@@ -0,0 +1,18 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard">
 <h1>Settings history</h1>
 <p class="meta"><a href="/dashboard/settings">Settings</a> · every change made through the dashboard, newest first.</p>
 {% if changes.is_empty() %}<p>No settings have been changed through the dashboard yet.</p>{% else %}<div class="scroll-x"><table class="history">
 <thead><tr><th>When</th><th>Who</th><th>Key</th><th>Before</th><th>After</th></tr></thead>
 <tbody>{% for change in changes %}<tr>
 <td>{{ change.changed_at }}</td>
 <td>{% match change.username %}{% when Some with (name) %}{{ name }}{% when None %}<em>removed user</em>{% endmatch %}</td>
 <td><code>{{ change.key }}</code></td>
 <td>{% match change.old_value %}{% when Some with (value) %}<pre>{{ value }}</pre>{% when None %}<em>absent</em>{% endmatch %}</td>
 <td>{% match change.new_value %}{% when Some with (value) %}<pre>{{ value }}</pre>{% when None %}<em>removed</em>{% endmatch %}</td>
 </tr>{% endfor %}</tbody>
 </table></div>
 {% include "_pagination.html" %}
 {% if pagination.page < pagination.pages() %}<p><a href="/dashboard/settings/history?page={{ pagination.page + 1 }}">Older</a></p>{% endif %}
 {% if pagination.page > 1 %}<p><a href="/dashboard/settings/history?page={{ pagination.page - 1 }}">Newer</a></p>{% endif %}
 {% endif %}
 </section>{% endblock %}
@@ -0,0 +1,31 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard">
 <h1>Stats</h1>
 <p class="muted">Last {{ days }} days ({{ since_date }} → {{ today }}) · window: {% for window in windows %}{% if *window == days %}<strong>{{ window }}</strong>{% else %}<a href="/dashboard/stats?days={{ window }}">{{ window }}</a>{% endif %}{% if !loop.last %} · {% endif %}{% endfor %} days · the same figures as <code>daily-epub stats --days {{ days }}</code>.</p>
 <div class="sparklines">{% for item in sparklines %}{% let spark = item %}{% include "dashboard/_sparkline.html" %}{% endfor %}</div>
 <div class="cards">
 <section class="card"><h2>Issues and ratings</h2>
 <dl class="kv">{% for line in summary %}<dt>{{ line.key }}</dt><dd>{{ line.value }}</dd>{% endfor %}</dl>
 {% if ratings.is_empty() %}<p class="muted">No explicit ratings in the window.</p>{% else %}<p>{% for line in ratings %}<span class="badge {{ line.key }}">{{ line.key }}</span> {{ line.value }}{% if !loop.last %} · {% endif %}{% endfor %}</p>{% endif %}
 </section>
 <section class="card"><h2>Retriever yield</h2>
 {% if retrievers.is_empty() %}<p class="muted">No rated picks by admitting retriever in the window.</p>{% else %}<div class="scroll-x"><table>
 <thead><tr><th>admitted by</th><th class="num">rated</th><th class="num">up</th><th class="num">down</th><th class="num">ratio</th></tr></thead>
 <tbody>{% for line in retrievers %}<tr><td>{{ line.retriever }}</td><td class="num">{{ line.rated }}</td><td class="num">{{ line.up }}</td><td class="num">{{ line.down }}</td><td class="num">{{ line.ratio }}</td></tr>{% endfor %}</tbody></table></div>{% endif %}
 <h3>Exploration</h3>
 <dl class="kv">{% for line in exploration %}<dt>{{ line.key }}</dt><dd>{{ line.value }}</dd>{% endfor %}</dl>
 </section>
 <section class="card"><h2>Cost per day</h2>
 <dl class="kv">{% for line in cost_per_day %}<dt>{{ line.key }}</dt><dd>{{ line.value }}</dd>{% endfor %}</dl>
 <p class="muted">Window spend divided by {{ days }} days, per provider.</p>
 </section>
 </div>
 <h2>Spend by day</h2>
 {% if cost_rows.is_empty() %}<p class="muted">No provider costs recorded in the window.</p>{% else %}<div class="scroll-x"><table data-filter>
 <thead><tr><th>day (UTC)</th>{% for provider in providers %}<th class="num">{{ provider }}</th>{% endfor %}<th class="num">total</th></tr></thead>
 <tbody>{% for row in cost_rows %}<tr><td>{{ row.date }}</td>{% for cell in row.cells %}<td class="num">{{ cell }}</td>{% endfor %}<td class="num">{{ row.total }}</td></tr>{% endfor %}</tbody></table></div>{% endif %}
 <h2>Runs in the window</h2>
 {% if runs.is_empty() %}<p class="muted">No finished runs in the window.</p>{% else %}<div class="scroll-x"><table data-filter>
 <thead><tr><th>run</th><th>date</th><th>status</th><th class="num">cost</th><th class="num">selected</th><th class="num">duration</th></tr></thead>
 <tbody>{% for run in runs %}<tr><td><a href="/dashboard/runs/{{ run.run_id }}">{{ run.run_id }}</a></td><td><a href="/issues/{{ run.date }}">{{ run.date }}</a></td><td><span class="badge {{ run.status }}">{{ run.status }}</span></td><td class="num">{{ run.cost }}</td><td class="num">{{ run.selected }}</td><td class="num">{{ run.duration }}</td></tr>{% endfor %}</tbody></table></div>{% endif %}
 <details class="explain"><summary>As text (<code>daily-epub stats --days {{ days }}</code>)</summary><pre class="preview">{{ text }}</pre></details>
 </section>{% endblock %}
@@ -0,0 +1,15 @@
 {% extends "layout.html" %}{% block content %}<section class="dashboard">
 <h1>Users</h1>
 <p class="muted">Accounts are read-only here. Create, change, disable, enable, or sign out users with the <code>daily-epub users</code> CLI on the server.</p>
 <div class="scroll-x"><table data-filter>
 <thead><tr><th>Username</th><th>Role</th><th>Status</th><th>Created</th><th>Last login</th><th class="num">Open sessions</th></tr></thead>
 <tbody>{% for user in users %}<tr>
 <td>{{ user.username }}</td>
 <td><span class="badge">{{ user.role }}</span></td>
 <td>{% if user.disabled %}<span class="badge down">disabled</span>{% else %}<span class="badge loved">enabled</span>{% endif %}</td>
 <td>{{ user.created }}</td>
 <td>{{ user.last_login }}</td>
 <td class="num">{{ user.open_sessions }}</td>
 </tr>{% endfor %}{% if users.is_empty() %}<tr><td colspan="6">No users. Bootstrap an admin with <code>daily-epub users add &lt;username&gt; --admin</code>.</td></tr>{% endif %}</tbody>
 </table></div>
 </section>{% endblock %}
@@ -0,0 +1 @@
 {% extends "layout.html" %}{% block content %}<section class="reading"><h1>{{ heading }}</h1><p>{{ message }}</p></section>{% endblock %}
@@ -0,0 +1 @@
 {% for section in issue.sections %}<h2>{{ section.name }}</h2><ul>{% for entry in section.entries %}<li><a href="{{ entry.url }}">{{ entry.title }}</a> — {{ entry.source }} ({{ entry.domain }}){% if !entry.comment_links.is_empty() %} · {% for link in entry.comment_links %}<a href="{{ link.url }}">{{ link.label }}</a>{% endfor %}{% endif %}</li>{% endfor %}</ul>{% endfor %}
@@ -0,0 +1,33 @@
 {% extends "layout.html" %}{% block content %}<article class="reading issue full-issue">
 <p class="dateline">{{ display_date }} · No. {{ issue_number }}</p>
 <p class="stats">{{ stats_line }}</p>
 <hr class="rule">
 <h1 class="kicker">The Brief</h1>
 <div class="editorial">{{ front_page_html|safe }}</div>
 {% if !downloads.is_empty() %}<p class="downloads">{% for download in downloads %}<a class="button" href="{{ download.href }}">Download {{ download.label }} <small>({{ download.size }})</small></a>{% endfor %}</p>{% endif %}
 <hr class="rule">
 <h1>In This Issue</h1>
 {% for section in sections %}<section><h2>{{ section.name }}</h2><ul class="index-list">{% for entry in section.entries %}<li class="index-entry">
 <h3><a href="{{ entry.href }}">{{ entry.title }}</a></h3>
 <p class="index-meta">{{ entry.source }} · {{ entry.reading_minutes }} min read</p>
 {% if !entry.summary.is_empty() %}<p class="index-summary">{{ entry.summary }}</p>{% endif %}
 {% match entry.why %}{% when Some with (why) %}<p class="index-why"><em>Why it's here: {{ why }}</em></p>{% when None %}{% endmatch %}
 {% match entry.rating %}{% when Some with (widget) %}{% include "_rating_widget.html" %}{% when None %}{% endmatch %}
 </li>{% endfor %}</ul></section>{% endfor %}
 {% if has_world || has_behind %}<nav class="issue-chapters">{% if has_world %}<a href="/issues/{{ date }}/world">World Briefing</a>{% endif %}{% if has_world && has_behind %} · {% endif %}{% if has_behind %}<a href="/issues/{{ date }}/behind">Behind the paper</a>{% endif %}</nav>{% endif %}
 <footer class="colophon"><h2>Colophon</h2>
 <p><em>The Daily EPUB</em> is assembled every morning from a personal feed reader.</p>
 <dl class="kv">
 <dt>Generated</dt><dd>{{ colophon.generated_at }}</dd>
 <dt>Bulk model</dt><dd>{{ colophon.bulk_model }}</dd>
 <dt>Editor model</dt><dd>{{ colophon.editor_model }}</dd>
 <dt>Summaries model</dt><dd>{{ colophon.summaries_model }}</dd>
 <dt>Entries considered</dt><dd>{{ colophon.entries_fetched }} from {{ colophon.feeds_seen }} feeds</dd>
 <dt>Candidates scored</dt><dd>{{ colophon.candidates }}</dd>
 <dt>Articles selected</dt><dd>{{ colophon.article_count }} across {{ colophon.section_count }} sections</dd>
 <dt>Words</dt><dd>{{ colophon.total_words }} · ~{{ colophon.reading_minutes }} min read</dd>
 {% for cost in colophon.provider_costs %}<dt>{{ cost.provider }} cost</dt><dd>{{ cost.cost }}</dd>{% endfor %}
 <dt>Total token cost</dt><dd>{{ colophon.cost_usd }}</dd>
 <dt>Generator</dt><dd>{{ colophon.generator_version }}</dd>
 </dl></footer>
 </article>{% endblock %}
@@ -0,0 +1 @@
 {% extends "layout.html" %}{% block content %}<section class="reading"><h1>Issue archive</h1>{% for month in months %}<h2>{{ month.label }}</h2><ul>{% for issue in month.issues %}<li><a href="/issues/{{ issue.date }}">{{ issue.display_date }}</a> · No. {{ issue.issue_number }} · {{ issue.article_count }} articles</li>{% endfor %}</ul>{% endfor %}</section>{% endblock %}
@@ -0,0 +1,7 @@
 {% extends "layout.html" %}{% block content %}<article class="reading issue">
 {% if empty %}<h1>No issue yet</h1><p>The first issue has not been published.</p>{% else %}
 <p class="dateline">{{ issue.display_date }} · No. {{ issue.issue_number }}</p><p class="stats">{{ issue.stats_line }}</p>
 <p class="strap">A personal morning paper, assembled daily; the selection is the reader's, the words are the authors'.</p>
 {% if !downloads.is_empty() %}<p class="downloads">{% for download in downloads %}<a href="{{ download.href }}">{{ download.label }} ({{ download.size }})</a>{% endfor %}</p>{% endif %}
 {% for section in issue.sections %}<section><h2>{{ section.name }}</h2>{% for entry in section.entries %}<article{% if entry.is_lead %} class="lead"{% endif %}><h3><a href="{{ entry.url }}">{{ entry.title }}</a></h3><p class="byline">{% match entry.author %}{% when Some with (author) %}{{ author }} · {% when None %}{% endmatch %}{{ entry.source }} ({{ entry.domain }}) · {{ entry.reading_minutes }} min · {{ entry.word_count }} words</p>{% if !entry.comment_links.is_empty() %}<p class="comments">{% for link in entry.comment_links %}<a rel="noopener" target="_blank" href="{{ link.url }}">{{ link.label }}{% if !link.meta.is_empty() %}: {{ link.meta }}{% endif %}</a>{% endfor %}</p>{% endif %}</article>{% endfor %}</section>{% endfor %}
 <p><a href="/issues">Browse the archive</a></p>{% endif %}</article>{% endblock %}
@@ -0,0 +1,20 @@
 <!doctype html>
 <html lang="en">
 <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>{{ page.title }} · The Daily EPUB</title>
  <link rel="stylesheet" href="/static/app.css?v={{ page.version }}">
  <link rel="alternate" type="application/atom+xml" title="The Daily EPUB" href="/feed.xml">
  <link rel="icon" href="/static/favicon.svg">
 </head>
 <body>
  <header class="masthead"><a href="/">The Daily EPUB</a></header>
  <nav class="primary" aria-label="Site"><a href="/">Latest</a><a href="/issues">Archive</a><a href="/feed.xml">Feed</a>{% match page.viewer %}{% when Some with (viewer) %}<a href="/account">{{ viewer.username }}</a>{% when None %}<a href="/login">Sign in</a>{% endmatch %}</nav>
  {% if page.is_admin() %}<nav class="admin" aria-label="Dashboard"><a href="/dashboard">Overview</a><a href="/dashboard/runs">Runs</a><a href="/dashboard/articles">Articles</a><a href="/dashboard/ratings">Ratings</a><a href="/dashboard/profile">Profile</a><a href="/dashboard/stats">Stats</a><a href="/dashboard/jobs">Jobs</a><a href="/dashboard/settings">Settings</a><a href="/dashboard/users">Users</a></nav>{% endif %}
  {% match page.flash %}{% when Some with (flash) %}<div class="flash {{ flash.kind }}" role="status">{{ flash.text }}</div>{% when None %}{% endmatch %}
  <main>{% block content %}{% endblock %}</main>
  <footer>daily-epub {{ page.version }}</footer>
  <script src="/static/app.js?v={{ page.version }}"></script>
 </body>
 </html>
@@ -0,0 +1 @@
 {% extends "layout.html" %}{% block content %}<section class="reading narrow"><h1>Sign in</h1>{% if !error.is_empty() %}<p class="error">{{ error }}</p>{% endif %}<form method="post" action="/login"><input type="hidden" name="next" value="{{ next }}"><label>Username <input name="username" autocomplete="username" required></label><label>Password <input type="password" name="password" autocomplete="current-password" required></label><button type="submit">Sign in</button></form></section>{% endblock %}
@@ -0,0 +1,5 @@
 {% extends "layout.html" %}{% block content %}<article class="reading world-briefing">
 <h1>World Briefing</h1><p class="dateline">{{ display_date }}</p><hr class="rule">
 <div class="world-body">{{ body_html|safe }}</div>
 <p><a href="{{ issue_href }}">← Back to this issue</a></p>
 </article>{% endblock %}
@@ -0,0 +1,312 @@
 use std::fmt;
 use std::str::FromStr;
 use jiff::Timestamp;
 use sqlx::Row;
 use crate::db::{Db, DbError, fmt_ts, parse_ts};
 pub const MIN_PASSWORD_LEN: usize = 12;
 pub const MAX_PASSWORD_LEN: usize = 1024;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum Role {
    User,
    Admin,
 }
 impl Role {
    pub fn as_str(self) -> &'static str {
        match self {
            Self::User => "user",
            Self::Admin => "admin",
        }
    }
 }
 impl fmt::Display for Role {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str(self.as_str())
    }
 }
 impl FromStr for Role {
    type Err = String;
    fn from_str(value: &str) -> Result<Self, Self::Err> {
        match value {
            "user" => Ok(Self::User),
            "admin" => Ok(Self::Admin),
            _ => Err(format!("invalid role {value:?}; expected user or admin")),
        }
    }
 }
 #[derive(Clone)]
 pub struct User {
    pub id: i64,
    pub username: String,
    pub password_hash: String,
    pub role: Role,
    pub disabled: bool,
    pub created_at: Timestamp,
    pub last_login_at: Option<Timestamp>,
 }
 impl fmt::Debug for User {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.debug_struct("User")
            .field("id", &self.id)
            .field("username", &self.username)
            .field("password_hash", &"[REDACTED]")
            .field("role", &self.role)
            .field("disabled", &self.disabled)
            .field("created_at", &self.created_at)
            .field("last_login_at", &self.last_login_at)
            .finish()
    }
 }
 #[derive(Debug, Clone)]
 pub struct UserListRow {
    pub user: User,
    pub open_sessions: i64,
 }
 pub fn validate_username(username: &str) -> anyhow::Result<()> {
    if username.is_empty()
        || username.len() > 32
        || !username
            .bytes()
            .all(|c| c.is_ascii_alphanumeric() || matches!(c, b'.' | b'_' | b'-'))
    {
        anyhow::bail!("username must be 1-32 characters from A-Z, a-z, 0-9, '.', '_' or '-'");
    }
    Ok(())
 }
 pub fn validate_password(password: &str) -> anyhow::Result<()> {
    if password.len() < MIN_PASSWORD_LEN {
        anyhow::bail!("password must be at least {MIN_PASSWORD_LEN} characters");
    }
    if password.len() > MAX_PASSWORD_LEN {
        anyhow::bail!("password must be at most {MAX_PASSWORD_LEN} characters");
    }
    Ok(())
 }
 pub fn hash_password(plain: &str) -> String {
    password_auth::generate_hash(plain)
 }
 pub fn verify_password(hash: &str, plain: &str) -> bool {
    password_auth::verify_password(plain, hash).is_ok()
 }
 pub async fn find_by_username(db: &Db, username: &str) -> Result<Option<User>, DbError> {
    let row = sqlx::query(
        "SELECT id, username, password_hash, role, disabled, created_at, last_login_at
         FROM users WHERE username = ? COLLATE NOCASE",
    )
    .bind(username)
    .fetch_optional(db.pool())
    .await?;
    row.as_ref().map(user_from_row).transpose()
 }
 pub async fn find_by_id(db: &Db, id: i64) -> Result<Option<User>, DbError> {
    let row = sqlx::query(
        "SELECT id, username, password_hash, role, disabled, created_at, last_login_at
         FROM users WHERE id = ?",
    )
    .bind(id)
    .fetch_optional(db.pool())
    .await?;
    row.as_ref().map(user_from_row).transpose()
 }
 pub async fn add(db: &Db, username: &str, password: &str, admin: bool) -> anyhow::Result<User> {
    validate_username(username)?;
    validate_password(password)?;
    if find_by_username(db, username).await?.is_some() {
        anyhow::bail!("user {username:?} already exists");
    }
    let hash = hash_password(password);
    let created_at = Timestamp::now();
    let role = if admin { Role::Admin } else { Role::User };
    let id: i64 = sqlx::query_scalar(
        "INSERT INTO users (username, password_hash, role, created_at)
         VALUES (?, ?, ?, ?) RETURNING id",
    )
    .bind(username)
    .bind(&hash)
    .bind(role.as_str())
    .bind(fmt_ts(created_at))
    .fetch_one(db.pool())
    .await?;
    Ok(User {
        id,
        username: username.to_string(),
        password_hash: hash,
        role,
        disabled: false,
        created_at,
        last_login_at: None,
    })
 }
 pub async fn passwd(db: &Db, username: &str, password: &str) -> anyhow::Result<u64> {
    validate_password(password)?;
    let hash = hash_password(password);
    let result =
        sqlx::query("UPDATE users SET password_hash = ? WHERE username = ? COLLATE NOCASE")
            .bind(hash)
            .bind(username)
            .execute(db.pool())
            .await?;
    require_one(username, result.rows_affected())?;
    logout(db, username).await
 }
 pub async fn set_role(db: &Db, username: &str, role: Role) -> anyhow::Result<()> {
    let result = sqlx::query("UPDATE users SET role = ? WHERE username = ? COLLATE NOCASE")
        .bind(role.as_str())
        .bind(username)
        .execute(db.pool())
        .await?;
    require_one(username, result.rows_affected())
 }
 pub async fn set_disabled(db: &Db, username: &str, disabled: bool) -> anyhow::Result<u64> {
    let result = sqlx::query("UPDATE users SET disabled = ? WHERE username = ? COLLATE NOCASE")
        .bind(disabled)
        .bind(username)
        .execute(db.pool())
        .await?;
    require_one(username, result.rows_affected())?;
    if disabled {
        logout(db, username).await
    } else {
        Ok(0)
    }
 }
 pub async fn logout(db: &Db, username: &str) -> anyhow::Result<u64> {
    let Some(user) = find_by_username(db, username).await? else {
        anyhow::bail!("user {username:?} was not found");
    };
    let result = sqlx::query("DELETE FROM sessions WHERE user_id = ?")
        .bind(user.id)
        .execute(db.pool())
        .await?;
    Ok(result.rows_affected())
 }
 pub async fn list(db: &Db) -> anyhow::Result<Vec<UserListRow>> {
    let rows = sqlx::query(
        "SELECT u.id, u.username, u.password_hash, u.role, u.disabled, u.created_at,
                u.last_login_at, COUNT(s.id) AS open_sessions
         FROM users u LEFT JOIN sessions s ON s.user_id = u.id AND s.expiry > unixepoch()
         GROUP BY u.id ORDER BY u.username COLLATE NOCASE",
    )
    .fetch_all(db.pool())
    .await?;
    rows.iter()
        .map(|row| {
            Ok(UserListRow {
                user: user_from_row(row)?,
                open_sessions: row.get("open_sessions"),
            })
        })
        .collect()
 }
 fn require_one(username: &str, count: u64) -> anyhow::Result<()> {
    if count == 0 {
        anyhow::bail!("user {username:?} was not found");
    }
    Ok(())
 }
 fn user_from_row(row: &sqlx::sqlite::SqliteRow) -> Result<User, DbError> {
    let role_raw: String = row.get("role");
    let role = role_raw.parse().map_err(|_| DbError::Decode {
        column: "users.role",
        value: role_raw,
    })?;
    Ok(User {
        id: row.get("id"),
        username: row.get("username"),
        password_hash: row.get("password_hash"),
        role,
        disabled: row.get("disabled"),
        created_at: parse_ts("users.created_at", &row.get::<String, _>("created_at"))?,
        last_login_at: row
            .get::<Option<String>, _>("last_login_at")
            .map(|value| parse_ts("users.last_login_at", &value))
            .transpose()?,
    })
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn password_hashes_round_trip_and_fail_safely() {
        let hash = hash_password("correct horse battery");
        assert!(verify_password(&hash, "correct horse battery"));
        assert!(!verify_password(&hash, "wrong password"));
        assert!(!verify_password("not a phc string", "anything"));
        assert!(
            !format!(
                "{:?}",
                User {
                    id: 1,
                    username: "reader".into(),
                    password_hash: hash.clone(),
                    role: Role::User,
                    disabled: false,
                    created_at: Timestamp::now(),
                    last_login_at: None,
                }
            )
            .contains(&hash)
        );
    }
    #[tokio::test]
    async fn user_operations_validate_and_are_case_insensitive() {
        let dir = tempfile::tempdir().unwrap();
        let db = Db::open_and_migrate(&dir.path().join("db.sqlite"))
            .await
            .unwrap();
        assert!(add(&db, "reader", "too-short", false).await.is_err());
        let user = add(&db, "Reader", "correct horse battery", true)
            .await
            .unwrap();
        assert_eq!(user.role, Role::Admin);
        assert!(
            add(&db, "reader", "another valid password", false)
                .await
                .is_err()
        );
        set_role(&db, "READER", Role::User).await.unwrap();
        assert_eq!(
            find_by_username(&db, "reader").await.unwrap().unwrap().role,
            Role::User
        );
        passwd(&db, "reader", "a replacement password")
            .await
            .unwrap();
        set_disabled(&db, "reader", true).await.unwrap();
        assert!(
            find_by_username(&db, "reader")
                .await
                .unwrap()
                .unwrap()
                .disabled
        );
        set_disabled(&db, "reader", false).await.unwrap();
    }
 }
@@ -0,0 +1,8 @@
 polkit.addRule(function (action, subject) {
  if (action.id == "org.freedesktop.systemd1.manage-units" &&
      subject.user == "daily-epub" &&
      action.lookup("verb") == "start" &&
      /^daily-epub-job@[a-z0-9-]+\.service$/.test(action.lookup("unit"))) {
    return polkit.Result.YES;
  }
 });
@@ -0,0 +1,69 @@
 # The Daily EPUB — one operator job (dashboard plan §14): an instance of this
 # template runs `daily-epub job run <name>` for a catalogue name such as
 # `generate`, `generate-2026-09-03`, `dry-run`, `profile-rebuild`,
 # `features-backfill`, `backfill-social` or `features-prune`. The Jobs page
 # starts instances through systemd + polkit (systemd/50-daily-epub.rules); by
 # hand: `sudo systemctl start daily-epub-job@features-prune`.
 #
 # Install: sudo install -m0644 systemd/daily-epub-job@.service /etc/systemd/system/
 #          (same binary, config and env file as daily-epub.service).
 # Logs: journalctl -u daily-epub-job@<name> -f
 [Unit]
 Description=The Daily EPUB job %i
 Documentation=https://github.com/thallada/the-daily-epub
 After=network-online.target miniflux.service
 Wants=network-online.target
 [Service]
 Type=oneshot
 User=daily-epub
 Group=daily-epub
 ExecStart=/usr/local/bin/daily-epub --config /etc/daily-epub/config.toml job run %i
 EnvironmentFile=-/etc/daily-epub/env
 Environment=RUST_LOG=info,sqlx=warn,hyper=warn
 # Same ceiling as the timer-driven generate unit: a generate job is the same
 # network-bound run, and nothing else in the catalogue takes longer.
 TimeoutStartSec=45min
 Nice=10
 IOSchedulingClass=idle
 # --- state + writable paths ---------------------------------------------
 StateDirectory=daily-epub
 StateDirectoryMode=0750
 WorkingDirectory=/var/lib/daily-epub
 # The publish dirs from [publish] in config.toml — keep these in sync.
 # Every path listed here must exist at start, or the unit fails with 226/NAMESPACE.
 ReadWritePaths=/home/thallada/bookorbit/books/daily-epub /var/lib/daily-epub/xtc
 # --- hardening (spec §3.15) ---------------------------------------------
 ProtectSystem=strict
 # read-only (not yes): the BookOrbit publish dir lives under /home, and
 # ProtectHome=yes would mask it even with the ReadWritePaths entry above.
 ProtectHome=read-only
 PrivateTmp=yes
 PrivateDevices=yes
 NoNewPrivileges=yes
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes
 ProtectControlGroups=yes
 ProtectClock=yes
 ProtectHostname=yes
 ProtectProc=invisible
 RestrictNamespaces=yes
 RestrictRealtime=yes
 RestrictSUIDSGID=yes
 RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
 LockPersonality=yes
 # No MemoryDenyWriteExecute here: this unit spawns Node (epub-to-xtc-converter),
 # whose JIT needs W+X pages (§3.11).
 SystemCallArchitectures=native
 SystemCallFilter=@system-service
 SystemCallErrorNumber=EPERM
 UMask=0027
 # Template instances are normally started on demand by the dashboard.
 [Install]
 WantedBy=multi-user.target
@@ -23,6 +23,8 @@ Wants=network-online.target
 Type=exec
 User=daily-epub
 Group=daily-epub
 # The Jobs page reads `journalctl -u daily-epub-job@<name>` (dashboard plan §14.3).
 SupplementaryGroups=systemd-journal
 ExecStart=/usr/local/bin/daily-epub --config /etc/daily-epub/config.toml serve
 EnvironmentFile=-/etc/daily-epub/env
 Environment=RUST_LOG=info,sqlx=warn,hyper=warn
@@ -36,9 +38,10 @@ TimeoutStopSec=20s
 StateDirectory=daily-epub
 StateDirectoryMode=0750
 WorkingDirectory=/var/lib/daily-epub
-# The publish dirs from [publish] in config.toml — keep these in sync.
+# The publish dirs from [publish] in config.toml — keep these in sync — plus
 # /etc/daily-epub so the dashboard settings page can rewrite config.toml.
 # Every path listed here must exist at start, or the unit fails with 226/NAMESPACE.
-ReadWritePaths=/home/thallada/bookorbit/books/daily-epub /var/lib/daily-epub/xtc
+ReadWritePaths=/home/thallada/bookorbit/books/daily-epub /var/lib/daily-epub/xtc /etc/daily-epub
 # --- hardening (spec §3.15) ---------------------------------------------
 ProtectSystem=strict
@@ -364,6 +364,7 @@ async fn assemble_build_publish(
        None,
        Some(&issue.editorial.front_page_html),
        Some("{\"status\":\"ok\"}"),
        None,
    )
    .await
    .expect("record the issue");
@@ -106,6 +106,49 @@ impl Server {
    fn get_auth(&self, path: &str, credentials: &str) -> HttpResponse {
        try_get(self.port, path, Some(credentials)).expect("request failed")
    }
    fn add_admin(&self, username: &str, password: &str) {
        let mut child = Command::new(env!("CARGO_BIN_EXE_daily-epub"))
            .args(["users", "add", username, "--admin", "--password-stdin"])
            .current_dir(self.dir.path())
            .env_clear()
            .env("PATH", std::env::var("PATH").unwrap_or_default())
            .env(
                "DAILY_EPUB_DATABASE_PATH",
                self.dir.path().join("daily-epub.db"),
            )
            .stdin(Stdio::piped())
            .stdout(Stdio::null())
            .stderr(Stdio::inherit())
            .spawn()
            .expect("spawning users add");
        child
            .stdin
            .take()
            .expect("users add stdin")
            .write_all(format!("{password}\n").as_bytes())
            .expect("writing users add password");
        assert!(child.wait().expect("waiting for users add").success());
    }
    fn post_form(&self, path: &str, body: &str) -> HttpResponse {
        try_request(
            self.port,
            "POST",
            path,
            &format!(
                "Content-Type: application/x-www-form-urlencoded\r\nSec-Fetch-Site: same-origin\r\nContent-Length: {}\r\n",
                body.len()
            ),
            body,
        )
        .expect("request failed")
    }
    fn get_cookie(&self, path: &str, cookie: &str) -> HttpResponse {
        try_request(self.port, "GET", path, &format!("Cookie: {cookie}\r\n"), "")
            .expect("request failed")
    }
 }
 #[derive(Debug)]
@@ -135,15 +178,26 @@ fn free_port() -> u16 {
 /// A minimal HTTP/1.1 `GET`; `None` when the connection could not be made.
 fn try_get(port: u16, path: &str, credentials: Option<&str>) -> Option<HttpResponse> {
    let auth = credentials
        .map(|c| format!("Authorization: Basic {c}\r\n"))
        .unwrap_or_default();
    try_request(port, "GET", path, &auth, "")
 }
 fn try_request(
    port: u16,
    method: &str,
    path: &str,
    extra_headers: &str,
    body: &str,
 ) -> Option<HttpResponse> {
    let mut stream = TcpStream::connect(("127.0.0.1", port)).ok()?;
    stream
        .set_read_timeout(Some(Duration::from_secs(10)))
        .ok()?;
-    let auth = credentials
+    let request = format!(
-        .map(|c| format!("Authorization: Basic {c}\r\n"))
+        "{method} {path} HTTP/1.1\r\nHost: 127.0.0.1:{port}\r\nConnection: close\r\n{extra_headers}\r\n{body}"
-        .unwrap_or_default();
+    );
    let request =
        format!("GET {path} HTTP/1.1\r\nHost: 127.0.0.1:{port}\r\nConnection: close\r\n{auth}\r\n");
    stream.write_all(request.as_bytes()).ok()?;
    stream.flush().ok()?;
    // No half-close here: hyper drops a connection whose peer has shut down its
@@ -171,6 +225,32 @@ fn try_get(port: u16, path: &str, credentials: Option<&str>) -> Option<HttpRespo
 fn binary_serves_health_issues_and_rating_endpoints() {
    let server = Server::start(false);
    for path in ["/", "/issues", "/feed.xml", "/login"] {
        assert_eq!(server.get(path).status, 200, "{path}");
    }
    let dashboard = server.get("/dashboard");
    assert_eq!(dashboard.status, 302);
    assert_eq!(
        dashboard.header("location"),
        Some("/login?next=%2Fdashboard")
    );
    server.add_admin("admin", "correct horse battery");
    let login = server.post_form(
        "/login",
        "username=admin&password=correct+horse+battery&next=%2Faccount",
    );
    assert_eq!(login.status, 303, "{login:?}");
    let cookie = login
        .header("set-cookie")
        .expect("login cookie")
        .split(';')
        .next()
        .expect("cookie pair");
    let account = server.get_cookie("/account", cookie);
    assert_eq!(account.status, 200, "{account:?}");
    assert!(account.body.contains("admin"));
    let res = server.get("/healthz");
    assert_eq!(res.status, 200);
    assert_eq!(res.body, "ok");
Author	SHA1	Message	Date
thalladaandClaude Fable 5.1	9b1c137c80	Session store: implement create with id-collision retry Silences tower-sessions' warning about the default create and never overwrites an existing row on a session id collision. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 18:22:41 +00:00
thalladaandClaude Fable 5.1	eb960f1b57	Web dashboard step 7: docs, users page, polish Users page, README and config.example updates, implementation notes, the rollout runbook, site-layout 404/500 pages, human-readable download sizes, dark-mode and narrow-screen polish, and a smoke test over every dashboard route; also removes zdiff3 ancestor markers left by earlier merges. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 18:19:08 +00:00
thalladaandClaude Fable 5.1	10cbe9ed79	Web dashboard: step 7 brief follow-ups from reviews Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 18:03:50 +00:00
thallada	f6e317a9fe	Merge branch 'step6' into web-dashboard # Conflicts: # src/web/static/app.css	2026-09-03 18:01:36 +00:00
thalladaandClaude Fable 5.1	aa3de51d9c	Web dashboard step 6: jobs and stats Job catalogue and daily-epub job run, the systemd job unit and polkit rule, SystemdRunner/MockRunner, the Jobs pages with status and journal tail, the stats_data refactor with a byte-identical CLI, the stats page and the overview sparklines. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 18:01:21 +00:00
thalladaandClaude Fable 5.1	d404946c78	Settings test: inject the env probe instead of mutating the environment The env-detection test briefly set a real DAILY_EPUB_* variable, which raced with the config test that loads the shipped example through figment. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 17:53:47 +00:00
thallada	073a85f3c7	Merge branch 'step5' into web-dashboard # Conflicts: # src/web/static/app.css # src/web/static/app.js	2026-09-03 17:50:02 +00:00
thalladaandClaude Fable 5.1	572056ce3b	Web dashboard step 5: settings page with toml_edit writer Schema derived from Config::default() and the live config, help text for every shipped key, env locks and presence-only secrets, typed saves that preserve comments and validate through Config::load before an atomic rename, provider add/remove, the change history, and config reload on mtime. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 17:49:48 +00:00
thallada	d36f203e4c	Merge branch 'step3' into web-dashboard # Conflicts: # src/web/static/app.css	2026-09-03 05:27:28 +00:00
thalladaandClaude Fable 5.1	63eee6bbd3	Web dashboard step 3: overview, runs and articles pages Fill in the dashboard read pages of the web dashboard plan (§9): the overview card set (last run from report_json, budget today per provider, ratings this week, unrated picks with the rating widget, jobs summary, config-on-disk warnings), the runs list and run detail (funnel, admission mix, preference state, timings, provider usage, warnings, top feeds, config diff against the previous non-dry run, near misses, and the candidates table with allow-listed filters/sorts and per-row signals), and the articles list and article detail (assessments including provider rejections, run history, neighbours and interests, embedding metadata, rating events, and the text explain). Dynamic list queries go through AssertSqlSafe with SQL built only from constants and allow-listed fragments; every user value is bound. Adds the shared signals-table, candidate-row and pager partials, a CSS block and the data-filter table behaviour in app.js, plus the step 3 handoff. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 05:26:52 +00:00
thalladaandClaude Fable 5.1	da065437c0	Web dashboard step 4: ratings page and profile editor Add /dashboard/ratings with the preference-state header, the "How ratings enter the algorithm" explainer, the Current tab (decayed neighbour weight, feed credit, prompt/rebuild membership, last-run neighbour usage, inline rating widget with note) and the paginated, filterable Events tab with superseded marking. Add /dashboard/profile: profile.md editor with atomic mode-preserving writes and profile_versions history plus restore, the parsed preview, OPML interests by theme, learned adjustments with staleness, the stored system prompt, and the profile-rebuild job form. Make profile::MAX_RATINGS_IN_REBUILD and profile::stored_version pub. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 05:21:33 +00:00
thalladaandClaude Fable 5.1	849231e49a	Web dashboard: dashboard module scaffold for parallel steps Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 04:59:29 +00:00
thalladaandClaude Fable 5.1	4995a8bd5d	Web dashboard step 2: full issue pages, article chapters, POST /rate Signed-in issue page with the Brief, downloads, index and colophon; article, World Briefing and Behind the paper pages under the login guard; the rating widget with its fetch enhancement; the admin-only POST /rate writing dashboard-attributed rating events; the HMAC confirmation page links to the site. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 04:56:29 +00:00
thalladaandClaude Fable 5.1	69cd736455	Web dashboard step 1: migration, sessions, users CLI, public site Migration 0004 (users, sessions, config_changes, profile_versions, jobs, rating_events.user_id, runs.report_json, issues.issue_json), the issue snapshot writer and loader, the web module skeleton with layout and static assets, axum-login/tower-sessions over a sqlx session store, password-auth users with a CLI, the login throttle, the origin check, security headers, and the public issue pages, archive, Atom feed and robots.txt. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 04:38:22 +00:00
thalladaandClaude Fable 5.1	a70de4af06	Web dashboard: briefs for steps 2-7 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 04:03:11 +00:00
thalladaandClaude Fable 5.1	bf2ab8441e	Web dashboard: shared and step 1 agent briefs Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 04:01:25 +00:00
thalladaandClaude Fable 5.1	89423f01fa	Add web site and operator dashboard plan Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM	2026-09-03 04:00:23 +00:00
		`@@ -0,0 +1 @@`
							`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="6" fill="#fbfaf6"/><path d="M13 12h38v40H13z" fill="none" stroke="#171713" stroke-width="3"/><path d="M20 21h24M20 29h24M20 37h18M20 45h20" stroke="#8b1e1e" stroke-width="3"/></svg>`
		`@@ -0,0 +1 @@`
							`{% if pagination.pages() > 1 %}<nav class="pagination">Page {{ pagination.page }} of {{ pagination.pages() }}</nav>{% endif %}`
		`@@ -0,0 +1 @@`
							{% extends "layout.html" %}{% block content %}<section class="reading narrow"><h1>Account</h1>{% if !error.is_empty() %}<p class="error">{{ error }}</p>{% endif %}<form method="post" action="/account/password"><label>Current password <input type="password" name="current_password" required></label><label>New password <input type="password" name="new_password" minlength="12" required></label><label>Confirm password <input type="password" name="confirm_password" minlength="12" required></label><button>Change password</button></form><form method="post" action="/account/logout-all" data-confirm="Sign out everywhere?"><button>Sign out everywhere</button></form><form method="post" action="/logout"><button>Sign out</button></form></section>{% endblock %}
		`@@ -0,0 +1 @@`
							`{% if pager.pages > 1 %}<nav class="pager">{% if let Some(href) = pager.prev_href %}<a href="{{ href }}">← Previous</a>{% endif %}<span>Page {{ pager.page }} of {{ pager.pages }} · {{ pager.total }} rows</span>{% if let Some(href) = pager.next_href %}<a href="{{ href }}">Next →</a>{% endif %}</nav>{% else %}<p class="muted">{{ pager.total }} row{% if pager.total != 1 %}s{% endif %}</p>{% endif %}`
		`@@ -0,0 +1 @@`
							`{% extends "layout.html" %}{% block content %}<section class="reading"><h1>{{ heading }}</h1><p>{{ message }}</p></section>{% endblock %}`
		`@@ -0,0 +1 @@`
							`{% for section in issue.sections %}<h2>{{ section.name }}</h2><ul>{% for entry in section.entries %}<li><a href="{{ entry.url }}">{{ entry.title }}</a> — {{ entry.source }} ({{ entry.domain }}){% if !entry.comment_links.is_empty() %} · {% for link in entry.comment_links %}<a href="{{ link.url }}">{{ link.label }}</a>{% endfor %}{% endif %}</li>{% endfor %}</ul>{% endfor %}`