docs: note that the server's compose and env are copied by hand

The variable rename landed in the repository but not on the server, which
keeps its own compose.yaml and .env. Neither is pulled from here, so the
container came up against the old names. A release touching either now has to
say so in its notes.

.env.example

@@ -1,22 +1,29 @@
 # Copy to .env and fill in. .env is gitignored — the real registry hostname
 # must not end up in the repository.
 
-# Image coordinates. FOODSTER_REPO carries no tag.
+# Image coordinates. REPO carries no tag.
-FOODSTER_REPO=registry.example.com/you/foodster
+REPO=registry.example.com/you/foodster
-FOODSTER_TAG=latest
+TAG=latest
 
 # Shared household password. The app will not start without it.
-FOODSTER_PASSWORD=changeme
+PASSWORD=changeme
 
 # Hostname Traefik routes to. Kept here rather than in compose.yaml so no
 # infrastructure detail is committed.
-FOODSTER_HOST=foodster.example.com
+HOST=foodster.example.com
+
+# Anything other than prod is written into the browser tab title, so a dev
+# instance open beside the real one can be told apart.
+ENV=prod
 
 # The database lives in ./data, bind-mounted into the container. These must
 # match whoever owns that directory on the host, or the container cannot
 # write to it. `id -u` and `id -g` will tell you.
-FOODSTER_UID=1000
+#
-FOODSTER_GID=1000
+# Named PUID/PGID because UID is read-only in bash and a plain UID here would
+# be quietly replaced by the invoking shell's own.
+PUID=1000
+PGID=1000
 
 # Used for every calendar-day calculation. Set it in development too: under
 # UTC the date rolls over three hours late, which is exactly when dinner

.gitignore

@@ -4,6 +4,9 @@
 # Build output
 /foodster
 
+# The tag `make image` last built, handed to `make push`.
+/.release-tag
+
 # Generated by `templ generate` during the container build.
 *_templ.go
 

CONTRIBUTING.md

@@ -0,0 +1,104 @@
+# Contributing
+
+A household project, so this is less a set of rules than a note to whoever
+picks it up next — including me in six months.
+
+## Getting set up
+
+```sh
+cp .env.example .env      # then edit it
+make run                  # http://localhost:8080, tab titled "dev · Foodster"
+make                      # every target, with a one-line description
+```
+
+`make check` is the gate: `go vet`, gofmt, unit tests, and `scripts/smoke.sh`,
+which drives a real server over HTTP. Run it before every commit.
+
+## Branches
+
+`dev` is where work happens. `main` holds released versions only — it is
+protected on the remote and takes no direct pushes, so a release arrives as a
+pull request from `dev`, squash-merged.
+
+After a squash merge, reset `dev` onto it or the next pull request will offer
+the same commits again:
+
+```sh
+git switch main && git pull --ff-only
+git switch dev && git reset --hard main
+git push --force-with-lease origin dev
+```
+
+`make image` refuses to run outside `main`. That check has to be local: the
+tag and the image are made before anything reaches the remote, so branch
+protection cannot catch a release built from the wrong branch.
+
+## Commit messages
+
+Conventional Commits — a type, an optional scope, then a short subject in the
+imperative.
+
+```
+feat(kirjaa): expand the selected day in place
+fix: redirect the catalog to /ruuat, not /ruoat
+chore(deps): bump the vendored Datastar client
+```
+
+| Type | For |
+|---|---|
+| `feat` | new behaviour someone will notice |
+| `fix` | a bug, ideally naming what broke |
+| `refactor` | same behaviour, different shape |
+| `test` | tests only |
+| `docs` | documentation only |
+| `build` | Makefile, Containerfile, compose, CI |
+| `chore` | anything else: dependencies, seeds, tidying |
+
+**The body matters more than the type.** Explain *why*, and what the
+alternative was — the diff already says what changed. If a fix was subtle,
+say what made it subtle; if a test caught something, say what. Commits here
+are the only design record this project has.
+
+### Release pull requests
+
+Because `main` is squash-merged, a pull request title becomes a commit message
+on `main`. A release spans a fix, a feature and some chores at once, so none
+of the types above fits it honestly. Use `release:` instead:
+
+```
+release: repair the catalog 404 and stop the page jumping
+```
+
+`main`'s log is then one line per deployment, which is what that branch is
+for, and the pull request body serves as the release notes. No version in the
+title — the CalVer tag is not created until `make image` runs after the merge.
+
+The types above are for `dev`, where a commit really does do one thing.
+
+## Deploying
+
+The server keeps its own `compose.yaml` and `.env`. Neither is pulled from
+here, so a release that renames a variable, adds one, or changes a mount
+needs both copied across **in the same deploy** — otherwise the container
+comes up against the old names and the app refuses to start.
+
+Anything in this repository that reaches the server by hand belongs in the
+release notes, flagged as breaking.
+
+## Things that are easy to get wrong
+
+- **The interface is Finnish.** Code, comments, this file and the PRD are
+  English. There is no i18n layer and no language switcher.
+- **No infrastructure detail is committed** — no hostnames, registry paths or
+  ports. They live in `.env`, which is gitignored, because the PRD leaves the
+  door open to publishing this repository.
+- **Migrations are immutable once shipped.** A released migration has run on a
+  live database and will not run again. Add a new numbered file instead.
+- **Interactions patch, they do not navigate.** Anything that reloads the page
+  loses the scroll position, which on a long list is maddening. Links stay
+  links and forms stay forms so it works without JavaScript; Datastar layers
+  over them with `data-on:click__prevent` and `data-on:submit__prevent`.
+- **A `ponytail:` comment marks a deliberate shortcut** and names its ceiling,
+  so the next reader can tell a decision from an oversight.
+- **Assert what a response does, not just that it responded.** A redirect to a
+  dead URL is still a 303; that one shipped.

Makefile

@@ -5,6 +5,11 @@ BIN     := foodster
 PKG     := ./cmd/foodster
 STATIC  := cmd/foodster/static
 
+# What `make image` last built. push reads it rather than re-deriving the tag:
+# sorting tags by date is ambiguous when two point at the same commit, and
+# re-deriving is what let a parallel make push the wrong one.
+TAGFILE := .release-tag
+
 # Vendored Datastar client. Bump, run `make vendor`, commit the result.
 DATASTAR_VERSION ?= v1.0.3
 SEED             ?= seeds/testi.json
@@ -33,7 +38,7 @@ build: generate ## Build ./foodster
 		-ldflags="-s -w -X main.version=dev" -o $(BIN) $(PKG)
 
 run: generate ## Run locally on :8080 (database in ./data)
-	FOODSTER_PASSWORD=$${FOODSTER_PASSWORD:-dev} go run $(PKG)
+	PASSWORD=$${PASSWORD:-dev} ENV=dev go run $(PKG)
 
 seed: ## Import a dish bundle (SEED=seeds/testi.json)
 	go run $(PKG) -import $(SEED)
@@ -80,7 +85,7 @@ fix: ## Format Go and templ sources, tidy go.mod
 	go mod tidy
 
 image: ## Build and tag an image as vYYYYMMDD-N. Creates a git tag.
-	@test -n "$(FOODSTER_REPO)" || { echo "set FOODSTER_REPO in .env"; exit 1; }
+	@test -n "$(REPO)" || { echo "set REPO in .env"; exit 1; }
 	@# A release tag must point into main, or the tag records a commit that
 	@# was never released.
 	@branch=$$(git symbolic-ref --short HEAD); \
@@ -94,16 +99,41 @@ image: ## Build and tag an image as vYYYYMMDD-N. Creates a git tag.
 	echo "==> $$tag"; \
 	git tag "$$tag"; \
 	podman build --platform linux/amd64 --build-arg VERSION="$$tag" \
-		-t "$(FOODSTER_REPO):$$tag" -t "$(FOODSTER_REPO):latest" .
+		-t "$(REPO):$$tag" -t "$(REPO):latest" . ; \
+	echo "$$tag" > $(TAGFILE)
 
-push: ## Push the newest tag and :latest
+# Pushing reported success while uploading the previous release once, because
-	@test -n "$(FOODSTER_REPO)" || { echo "set FOODSTER_REPO in .env"; exit 1; }
+# nothing compared what was built against what arrived. So afterwards, ask the
-	@tag=$$(git tag -l 'v*' --sort=-creatordate | head -n1); \
+# registry what it actually serves for each tag and fail if it is not the
-	test -n "$$tag" || { echo "no tags yet - run make image"; exit 1; }; \
+# image we just built.
-	podman push "$(FOODSTER_REPO):$$tag"; \
+push: ## Push the newest tag and :latest, then verify the registry
-	podman push "$(FOODSTER_REPO):latest"
+	@test -n "$(REPO)" || { echo "set REPO in .env"; exit 1; }
+	@test -f $(TAGFILE) || { echo "nothing built - run make image"; exit 1; }; \
+	tag=$$(cat $(TAGFILE)); \
+	built=$$(podman image inspect "$(REPO):$$tag" --format '{{.Id}}' 2>/dev/null) || \
+		{ echo "no local image tagged $$tag - run make image"; exit 1; }; \
+	podman push "$(REPO):$$tag"; \
+	podman push "$(REPO):latest"; \
+	echo "==> verifying $$tag"; \
+	for ref in "$$tag" latest; do \
+		podman pull -q "$(REPO):$$ref" >/dev/null 2>&1 || \
+			{ echo "  FAIL  $$ref is not in the registry"; exit 1; }; \
+		served=$$(podman image inspect "$(REPO):$$ref" --format '{{.Id}}'); \
+		if [ "$$served" != "$$built" ]; then \
+			echo "  FAIL  $$ref serves $$served"; \
+			echo "        expected $$built"; \
+			exit 1; \
+		fi; \
+		echo "  ok    $$ref"; \
+	done
 
-release: image push ## Build, tag and push in one go
+# Sub-makes, not prerequisites. Under `make -j` — and -j16 is the default on
+# at least one machine here — these run concurrently, so push resolves the
+# newest tag and uploads :latest before image has finished building and
+# tagging. That silently ships the previous release a second time.
+release: ## Build, tag and push in one go
+	@$(MAKE) --no-print-directory image
+	@$(MAKE) --no-print-directory push
 
 up: ## Start the stack
 	@mkdir -p data   # or the engine creates it root-owned and the app cannot write

PRD.md

@@ -113,6 +113,23 @@ in English.
 Side dishes live in their own table and have no category. The pool is
 expected to stay small.
 
+### Tähteet — leftovers (stage 1)
+
+A single built-in entry, flagged `special` on the main dish table. It is
+**not food**: it exists so a day can be recorded as "we ate what was already
+there" without inventing a meal that was never cooked.
+
+- No category, which is why it cannot be an ordinary main: those must have
+  at least one.
+- Created by a migration. The household does not add, edit or delete it, and
+  it never appears in the Ruuat catalog.
+- Loggable exactly like any other entry, and shown on the log board apart
+  from the categories.
+- **The stage 2 suggester must never propose it.** It is excluded from the
+  eligible pool outright, so cooldown, category coverage (§8.1) and
+  frequency weighting (§8.2) all skip it — despite it being among the
+  most-logged entries.
+
 ### Meal log entry ("what was actually eaten") (stage 1)
 - `id`
 - `date` — SQL `DATE`, day granularity only. There is no time-of-day field
@@ -334,7 +351,7 @@ build and no asset bundler.
   is imported because the runtime image carries no zoneinfo. All date logic
   uses that location explicitly and never `time.Local`.
 - **Auth**: HTTP Basic with one shared household password read from
-  `FOODSTER_PASSWORD`; the username is ignored. Compared using
+  `PASSWORD`; the username is ignored. Compared using
   `subtle.ConstantTimeCompare` over SHA-256 digests so neither the value nor
   its length leaks through timing. `/healthz` is the only route outside auth.
 - **Exposure**: the app is served on a public hostname behind Traefik, which
@@ -378,21 +395,25 @@ on the server and run with Docker Compose.
   `/data/foodster.db`, bind-mounted from `./data` on the host rather than
   kept in a named volume, so the file can be listed and copied without going
   through the container engine. Backup is `cp -r data`. Because the image
-  runs as UID 65534, compose sets `user:` from `FOODSTER_UID`/`FOODSTER_GID`
+  runs as UID 65534, compose sets `user:` from `PUID`/`PGID`
   to match whoever owns that directory. `restart: unless-stopped`.
 - **Configuration**, entirely through environment variables (see
   `.env.example`):
-  - `FOODSTER_REPO` and `FOODSTER_TAG` — image coordinates.
+  Names carry no application prefix: the container namespaces them already.
-  - `FOODSTER_PASSWORD` — the shared password. Required; the app refuses to
+  - `REPO` and `TAG` — image coordinates.
-    start without it.
+  - `PASSWORD` — the shared password. Required; the app refuses to start
-  - `FOODSTER_DB` — database file path, default `./data/foodster.db`. The
+    without it.
-    directory is created on startup if missing.
+  - `DB` — database file path, default `./data/foodster.db`. The directory is
-  - `FOODSTER_UID` / `FOODSTER_GID` — host owner of `./data`.
+    created on startup if missing.
+  - `ENV` — anything but `prod` is prefixed to the browser tab title, so a
+    dev instance open beside the real one can be told apart.
+  - `PUID` / `PGID` — host owner of `./data`. Not `UID`, which is read-only
+    in bash and would be replaced by the invoking shell's own value.
   - `TZ` — default `Europe/Helsinki`.
 - The registry hostname exists only in `.env`, which is gitignored, because
   §11 leaves open the possibility of publishing this repository.
 - **Routing**: Traefik on an external `traefik` network, matching on
-  `FOODSTER_HOST` and terminating TLS. The container publishes no ports —
+  `HOST` and terminating TLS. The container publishes no ports —
   doing so would put an unencrypted copy of the app on the host, bypassing
   the proxy. The hostname lives in `.env` rather than `compose.yaml`, so no
   infrastructure detail is committed.

README.md

@@ -58,6 +58,9 @@ One static Go binary. No Node.js, no bundler, no separate database server.
 | Auth | HTTP Basic, one shared household password |
 | Runtime image | `FROM scratch` |
 
+Working on it: [CONTRIBUTING.md](CONTRIBUTING.md) — branches, commit messages,
+and the conventions that are easy to miss.
+
 ## Branches
 
 `main` holds released versions only. Every release tag points at a commit on
@@ -173,13 +176,19 @@ Everything is environment variables. `.env` is gitignored; start from
 
 | Variable | Default | Purpose |
 |---|---|---|
-| `FOODSTER_PASSWORD` | *required* | Shared password. The app will not start without it. |
+| `PASSWORD` | *required* | Shared password. The app will not start without it. |
-| `FOODSTER_DB` | `./data/foodster.db` | SQLite file path; the directory is created if missing. |
+| `DB` | `./data/foodster.db` | SQLite file path; the directory is created if missing. |
-| `FOODSTER_UID` / `FOODSTER_GID` | `1000` | Host owner of `./data`, for the bind mount. |
+| `ENV` | `prod` | Anything else is prefixed to the tab title (`dev · Foodster`). |
+| `ADDR` | `:8080` | Listen address. Only useful for a second local instance. |
+| `PUID` / `PGID` | `1000` | Host owner of `./data`, for the bind mount. |
 | `TZ` | `Europe/Helsinki` | Used for every calendar-day calculation. |
-| `FOODSTER_REPO` | *required to build* | Image repository, no tag. |
+
-| `FOODSTER_TAG` | `latest` | Tag to run under compose. |
+Names carry no prefix: the container gives them their own namespace already.
-| `FOODSTER_PORT` | `8080` | Host port to publish. |
+`PUID`/`PGID` are the exception — `UID` is read-only in bash, so a value set
+in `.env` would be silently replaced by the invoking shell's own.
+| `REPO` | *required to build* | Image repository, no tag. |
+| `TAG` | `latest` | Tag to run under compose. |
+| `HOST` | *required to run* | Hostname Traefik routes to. |
 
 Set `TZ` in development too. Under UTC the date rolls over three hours late,
 which is exactly when dinner gets logged.
@@ -204,7 +213,7 @@ the container, so a backup is `cp -r data` and you can inspect the file with
 any sqlite client without going through the engine.
 
 That directory must exist and be owned by the user compose runs as — `make up`
-creates it, and `FOODSTER_UID`/`FOODSTER_GID` in `.env` tell the container who
+creates it, and `PUID`/`PGID` in `.env` tell the container who
 that is. Get them from `id -u` and `id -g`.
 
 If the app exits with `cannot open /data/foodster.db ... unable to open
@@ -213,7 +222,7 @@ bind-mount directory as root, and the container is not root:
 
 ```sh
 ls -ldn data                      # whose is it?
-sudo chown -R 1000:1000 data      # match FOODSTER_UID / FOODSTER_GID
+sudo chown -R 1000:1000 data      # match PUID / PGID
 docker compose restart
 ```
 
@@ -235,7 +244,7 @@ counting it would lock the household out for simply opening the app.
 address, meaning it arrived through the proxy. A client connecting directly
 could otherwise forge a new address per attempt and skip the limiter.
 
-**None of this replaces a strong `FOODSTER_PASSWORD`.** Rate limiting removes
+**None of this replaces a strong `PASSWORD`.** Rate limiting removes
 brute force as a practical route; it does not make a guessable password safe.
 
 ## Mockups

cmd/foodster/catalog_test.go

@@ -131,6 +131,55 @@ func TestSoftDeleteHidesDishButKeepsHistory(t *testing.T) {
 	}
 }
 
+func TestTahteetIsLoggableButNotFood(t *testing.T) {
+	h := seeded(t)
+
+	// The migration creates it; nobody adds it.
+	special, err := listSpecial(h.db, "")
+	if err != nil {
+		t.Fatalf("listSpecial: %v", err)
+	}
+	if len(special) != 1 || special[0].Name != "Tähteet" {
+		t.Fatalf("special = %+v, want exactly Tähteet", special)
+	}
+
+	// It must not turn up among the dishes: not on the board's categories,
+	// not in the catalog, and not in whatever the suggester later draws from.
+	dishes, err := listDishes(h.db, "")
+	if err != nil {
+		t.Fatalf("listDishes: %v", err)
+	}
+	for _, d := range dishes {
+		if d.Name == "Tähteet" {
+			t.Fatal("Tähteet appears among the dishes")
+		}
+	}
+
+	// It carries no category at all, which is why it cannot be an ordinary
+	// dish: those are required to have one.
+	if len(special[0].Categories) != 0 {
+		t.Errorf("categories = %v, want none", special[0].Categories)
+	}
+	// And it gets its own mark: no categories is not the same as several, so
+	// it must not fall through to the mixed Sekalaiset one.
+	if got := special[0].CategoryKey(); got != "tahteet" {
+		t.Errorf("CategoryKey = %q, want tahteet", got)
+	}
+
+	// Logging it has to work exactly like logging a real meal.
+	date := day(t, "2026-09-05")
+	if err := saveEntry(h.db, date, special[0].ID, nil); err != nil {
+		t.Fatalf("saveEntry: %v", err)
+	}
+	entry, err := entryFor(h.db, date)
+	if err != nil || entry == nil {
+		t.Fatalf("entryFor: %v, %v", entry, err)
+	}
+	if entry.Main.Name != "Tähteet" {
+		t.Errorf("logged %q, want Tähteet", entry.Main.Name)
+	}
+}
+
 func TestSoftDeleteSideHidesItFromPickers(t *testing.T) {
 	h := seeded(t)
 	id := h.sideNamed(t, "Riisi")

cmd/foodster/handlers.go

@@ -86,6 +86,7 @@ type logView struct {
 	ShowBoard   bool
 	Dishes      []Dish      // flat, only to know whether anything matched
 	Groups      []DishGroup // what the board actually renders
+	Special     []Dish      // Tähteet and the like: loggable, but not food
 	Sides       []Side
 	New         mainForm // inline "add the dish you were looking for"
 	History     HistoryPage
@@ -97,17 +98,57 @@ type logView struct {
 	Confirming bool
 }
 
+// logOptions is what the Kirjaa screen is being asked to show. Pulled out of
+// the request for a page load or a patch, and set directly after a write,
+// where the answer is simply "that day, nothing else open".
+type logOptions struct {
+	Date       time.Time
+	Dish       string // ?ruoka=, opening the sides step
+	Changing   bool   // ?muuta=, swapping the dish on a logged day
+	Confirming bool   // ?poista=, asking before deleting the entry
+	Search     string
+}
+
+func (a *app) logOptionsFrom(r *http.Request) logOptions {
+	q := r.URL.Query()
+	return logOptions{
+		Date:       a.date(r),
+		Dish:       q.Get("ruoka"),
+		Changing:   q.Get("muuta") != "",
+		Confirming: q.Get("poista") != "",
+		Search:     strings.TrimSpace(q.Get("haku")),
+	}
+}
+
 func (a *app) index(w http.ResponseWriter, r *http.Request) {
-	date := a.date(r)
+	render(w, r, logPage(a.buildLog(r, a.logOptionsFrom(r))))
+}
+
+// day patches the list in place. Every link in it calls here rather than
+// loading a page, so opening a day leaves the scroll position alone.
+func (a *app) day(w http.ResponseWriter, r *http.Request) {
+	fragment(w, r, dayList(a.buildLog(r, a.logOptionsFrom(r))))
+}
+
+// finishDay answers a write: a patch for Datastar, a redirect otherwise.
+func (a *app) finishDay(w http.ResponseWriter, r *http.Request, date time.Time) {
+	if isDatastar(r) {
+		fragment(w, r, dayList(a.buildLog(r, logOptions{Date: date})))
+		return
+	}
+	a.redirectToDay(w, r, date)
+}
+
+func (a *app) buildLog(r *http.Request, o logOptions) logView {
+	date := o.Date
 	v := logView{
 		Date:       date,
 		Today:      today(a.loc),
-		Search:  strings.TrimSpace(r.URL.Query().Get("haku")),
+		Search:     o.Search,
 		Checked:    map[int64]bool{},
+		Confirming: o.Confirming,
 	}
 
-	v.Confirming = r.URL.Query().Get("poista") != ""
-
 	entry, err := entryFor(a.db, date)
 	if err != nil {
 		log.Printf("entry for %s: %v", date.Format(dateLayout), err)
@@ -117,8 +158,8 @@ func (a *app) index(w http.ResponseWriter, r *http.Request) {
 	// ?ruoka= opens the sides step for that dish. When it is the dish already
 	// logged, the existing sides come back ticked, which makes editing an
 	// entry the same screen as creating one.
-	if raw := r.URL.Query().Get("ruoka"); raw != "" {
+	if o.Dish != "" {
-		if id, err := strconv.ParseInt(raw, 10, 64); err == nil {
+		if id, err := strconv.ParseInt(o.Dish, 10, 64); err == nil {
 			if dish, err := dishByID(a.db, id); err == nil {
 				v.Chosen = dish
 				if entry != nil && entry.Main.ID == id {
@@ -133,7 +174,7 @@ func (a *app) index(w http.ResponseWriter, r *http.Request) {
 	// The board shows when there is nothing logged yet, or when the entry is
 	// being changed. "Muokkaa" on a logged day sets ?muuta=1 and lands here,
 	// so swapping the dish and picking one for the first time are one path.
-	changing := r.URL.Query().Get("muuta") != "" || v.Search != ""
+	changing := o.Changing || v.Search != ""
 	if v.Chosen == nil && (v.Entry == nil || changing) {
 		v.ShowBoard = true
 		if v.Dishes, err = listDishes(a.db, v.Search); err != nil {
@@ -142,6 +183,9 @@ func (a *app) index(w http.ResponseWriter, r *http.Request) {
 		// listDishes already orders by frequency then name, so grouping keeps
 		// the favourites at the top of each category.
 		v.Groups = groupDishes(v.Dishes)
+		if v.Special, err = listSpecial(a.db, v.Search); err != nil {
+			log.Printf("list special: %v", err)
+		}
 		// Seed the inline add form with whatever was searched for, so a miss
 		// turns straight into "add it" without retyping.
 		v.New = mainForm{Name: v.Search, Categories: map[string]bool{}, HasSides: true}
@@ -152,13 +196,33 @@ func (a *app) index(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	v.HistoryDays = historyWindow(r)
+	a.loadDays(r, &v)
-	v.HistoryMore = v.HistoryDays + historyDays
+	return v
-	if v.History, err = history(a.db, a.loc, today(a.loc), v.HistoryDays); err != nil {
-		log.Printf("history: %v", err)
 }
 
-	render(w, r, logPage(v))
+// loadDays fills the day list. The selected day expands inside it rather than
+// in a panel above it, so choosing a day from the list does not reorder the
+// list underneath the tap.
+func (a *app) loadDays(r *http.Request, v *logView) {
+	v.HistoryDays = historyWindow(r)
+
+	// The window has to reach the selected day, or it would have nowhere to
+	// expand.
+	if reach := int(v.Today.Sub(v.Date).Hours()/24) + 1; reach > v.HistoryDays {
+		v.HistoryDays = min(reach, maxHistoryDays)
+	}
+	v.HistoryMore = v.HistoryDays + historyDays
+
+	page, err := history(a.db, a.loc, v.Today, v.HistoryDays)
+	if err != nil {
+		log.Printf("history: %v", err)
+	}
+	// Nothing logged ever: the selected day is still the one being worked on,
+	// so it needs a row of its own to open in.
+	if len(page.Rows) == 0 {
+		page.Rows = []HistoryRow{{Date: v.Date, Entry: v.Entry}}
+	}
+	v.History = page
 }
 
 // searchSignals is what Datastar sends back: for a GET it JSON-encodes the
@@ -191,6 +255,50 @@ func fragment(w http.ResponseWriter, r *http.Request, c templ.Component) {
 	}
 }
 
+// isDatastar reports whether the request came from the client library, which
+// tags its own. Everything below keeps working without JavaScript: the same
+// handlers redirect instead of patching when the header is absent.
+func isDatastar(r *http.Request) bool {
+	return r.Header.Get("Datastar-Request") != ""
+}
+
+// patchElements sends one Datastar event carrying several elements, each
+// matched to the page by its id. A text/html response can only replace one
+// element, and the catalog has to move its list and its forms together —
+// opening an edit form also has to un-highlight whatever was open before.
+//
+// ponytail: about twenty lines instead of the SDK, which brought four modules
+// for an SSE generator we would otherwise never call.
+func patchElements(w http.ResponseWriter, r *http.Request, components ...templ.Component) {
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+
+	var out strings.Builder
+	out.WriteString("event: datastar-patch-elements\n")
+	for _, c := range components {
+		var html strings.Builder
+		if err := c.Render(r.Context(), &html); err != nil {
+			log.Printf("patch %s: %v", r.URL.Path, err)
+			return
+		}
+		// One `data: elements` line per line of HTML, as the protocol wants.
+		for _, line := range strings.Split(html.String(), "\n") {
+			if strings.TrimSpace(line) == "" {
+				continue
+			}
+			out.WriteString("data: elements ")
+			out.WriteString(line)
+			out.WriteString("\n")
+		}
+	}
+	out.WriteString("\n")
+
+	io.WriteString(w, out.String())
+	if f, ok := w.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
 // searchBoard re-renders the dish board as the search box is typed into.
 func (a *app) searchBoard(w http.ResponseWriter, r *http.Request) {
 	var signals searchSignals
@@ -210,6 +318,9 @@ func (a *app) searchBoard(w http.ResponseWriter, r *http.Request) {
 	}
 	v.Dishes = dishes
 	v.Groups = groupDishes(dishes)
+	if v.Special, err = listSpecial(a.db, v.Search); err != nil {
+		log.Printf("search special: %v", err)
+	}
 	v.New = mainForm{Name: v.Search, Categories: map[string]bool{}, HasSides: true}
 
 	fragment(w, r, boardList(v))
@@ -273,6 +384,12 @@ func (a *app) quickAdd(w http.ResponseWriter, r *http.Request) {
 			log.Printf("quick add: %v", err)
 			form.Err = "Tallennus epäonnistui."
 		default:
+			// Created: straight on to its sides step.
+			opts := logOptions{Date: date, Dish: strconv.FormatInt(id, 10)}
+			if isDatastar(r) {
+				fragment(w, r, dayList(a.buildLog(r, opts)))
+				return
+			}
 			a.redirectToPick(w, r, date, id)
 			return
 		}
@@ -280,23 +397,11 @@ func (a *app) quickAdd(w http.ResponseWriter, r *http.Request) {
 
 	// Rejected: back to the board with the form filled in and the search
 	// still narrowed, so the add card stays on screen.
-	v := logView{
+	v := a.buildLog(r, logOptions{Date: date, Search: form.Name})
-		Date:      date,
+	v.New = form
-		Today:     today(a.loc),
+	if isDatastar(r) {
-		Search:    form.Name,
+		fragment(w, r, dayList(v))
-		Checked:   map[int64]bool{},
+		return
-		New:       form,
-		ShowBoard: true,
-	}
-	var err error
-	if v.Dishes, err = listDishes(a.db, v.Search); err != nil {
-		log.Printf("list dishes: %v", err)
-	}
-	v.Groups = groupDishes(v.Dishes)
-	v.HistoryDays = historyWindow(r)
-	v.HistoryMore = v.HistoryDays + historyDays
-	if v.History, err = history(a.db, a.loc, today(a.loc), v.HistoryDays); err != nil {
-		log.Printf("history: %v", err)
 	}
 	render(w, r, logPage(v))
 }
@@ -332,7 +437,7 @@ func (a *app) save(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "tallennus epäonnistui", http.StatusInternalServerError)
 		return
 	}
-	a.redirectToDay(w, r, date)
+	a.finishDay(w, r, date)
 }
 
 func (a *app) delete(w http.ResponseWriter, r *http.Request) {
@@ -342,15 +447,12 @@ func (a *app) delete(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "poisto epäonnistui", http.StatusInternalServerError)
 		return
 	}
-	a.redirectToDay(w, r, date)
+	a.finishDay(w, r, date)
 }
 
+// redirectToDay is the no-JavaScript path back after a write.
 func (a *app) redirectToDay(w http.ResponseWriter, r *http.Request, date time.Time) {
-	target := "/"
+	http.Redirect(w, r, dayURL("/", date, today(a.loc)), http.StatusSeeOther)
-	if !date.Equal(today(a.loc)) {
-		target += "?pvm=" + date.Format(dateLayout)
-	}
-	http.Redirect(w, r, target, http.StatusSeeOther)
 }
 
 // mainForm and sideForm carry what the user typed, so a rejected submission
@@ -384,7 +486,20 @@ type catalogView struct {
 	DeleteKind string
 }
 
+// catalog renders the whole page. show patches the same state in place, so
+// nothing navigates: both build the view the same way.
 func (a *app) catalog(w http.ResponseWriter, r *http.Request) {
+	a.renderCatalog(w, r, a.catalogState(r))
+}
+
+// show is what every catalog link actually calls. It patches the list and both
+// forms rather than loading a page, so opening an edit form or asking to
+// delete a row leaves the scroll position exactly where it was.
+func (a *app) show(w http.ResponseWriter, r *http.Request) {
+	a.patchCatalog(w, r, a.catalogState(r))
+}
+
+func (a *app) catalogState(r *http.Request) catalogView {
 	v := catalogView{
 		Main:   mainForm{Categories: map[string]bool{}, HasSides: true},
 		Search: strings.TrimSpace(r.URL.Query().Get("haku")),
@@ -420,10 +535,11 @@ func (a *app) catalog(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	a.renderCatalog(w, r, v)
+	return v
 }
 
-func (a *app) renderCatalog(w http.ResponseWriter, r *http.Request, v catalogView) {
+// fillCatalog loads the lists into a view built from the request.
+func (a *app) fillCatalog(v *catalogView) {
 	if v.Main.Categories == nil {
 		v.Main.Categories = map[string]bool{}
 	}
@@ -439,9 +555,20 @@ func (a *app) renderCatalog(w http.ResponseWriter, r *http.Request, v catalogVie
 	if v.Sides, err = listSides(a.db, v.Search); err != nil {
 		log.Printf("list sides: %v", err)
 	}
+}
+
+func (a *app) renderCatalog(w http.ResponseWriter, r *http.Request, v catalogView) {
+	a.fillCatalog(&v)
 	render(w, r, catalogPage(v))
 }
 
+// patchCatalog swaps the list and both forms in one event. They move together:
+// opening an edit form also has to clear whatever delete was being confirmed.
+func (a *app) patchCatalog(w http.ResponseWriter, r *http.Request, v catalogView) {
+	a.fillCatalog(&v)
+	patchElements(w, r, catalogList(v), mainForm_(v.Main), sideForm_(v.Side))
+}
+
 // saveMain adds or updates a main dish. A rejected form is re-rendered with
 // the values still in it; a good one redirects, so refresh cannot re-submit.
 func (a *app) saveMain(w http.ResponseWriter, r *http.Request) {
@@ -482,11 +609,28 @@ func (a *app) saveMain(w http.ResponseWriter, r *http.Request) {
 			log.Printf("save main: %v", err)
 			form.Err = "Tallennus epäonnistui."
 		default:
-			http.Redirect(w, r, "/ruoat", http.StatusSeeOther)
+			// Saved: hand back a blank form so it collapses, and a list with
+			// the dish in it.
+			a.finishCatalog(w, r, catalogView{})
 			return
 		}
 	}
-	a.renderCatalog(w, r, catalogView{Main: form})
+	a.finishCatalog(w, r, catalogView{Main: form})
+}
+
+// finishCatalog answers a catalog write: a patch for Datastar, a redirect for
+// a plain form post. Without the redirect, submitting with JavaScript off
+// would leave the browser sitting on a POST it could not reload.
+func (a *app) finishCatalog(w http.ResponseWriter, r *http.Request, v catalogView) {
+	if isDatastar(r) {
+		a.patchCatalog(w, r, v)
+		return
+	}
+	if v.Main.Err != "" || v.Side.Err != "" {
+		a.renderCatalog(w, r, v)
+		return
+	}
+	http.Redirect(w, r, "/ruuat", http.StatusSeeOther)
 }
 
 func (a *app) saveSide(w http.ResponseWriter, r *http.Request) {
@@ -511,11 +655,11 @@ func (a *app) saveSide(w http.ResponseWriter, r *http.Request) {
 			log.Printf("save side: %v", err)
 			form.Err = "Tallennus epäonnistui."
 		default:
-			http.Redirect(w, r, "/ruoat", http.StatusSeeOther)
+			a.finishCatalog(w, r, catalogView{})
 			return
 		}
 	}
-	a.renderCatalog(w, r, catalogView{Side: form})
+	a.finishCatalog(w, r, catalogView{Side: form})
 }
 
 // deleteDish soft-deletes, so log entries keep resolving the name (PRD §6).
@@ -539,7 +683,7 @@ func (a *app) deleteDish(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "poisto epäonnistui", http.StatusInternalServerError)
 		return
 	}
-	http.Redirect(w, r, "/ruoat", http.StatusSeeOther)
+	a.finishCatalog(w, r, catalogView{})
 }
 
 // importDishes takes a bundle either pasted into the textarea or uploaded as a

cmd/foodster/main.go

@@ -35,6 +35,21 @@ var staticFS embed.FS
 // version is replaced at build time with the CalVer tag (see `make image`).
 var version = "dev"
 
+// envTag marks the browser tab of anything that is not production, so a dev
+// instance and the real one open side by side are told apart at a glance.
+// Empty in production, which is the default.
+var envTag string
+
+func setEnvTag(value string) {
+	value = strings.TrimSpace(value)
+	if value == "" || strings.EqualFold(value, "prod") || strings.EqualFold(value, "production") {
+		envTag = ""
+		return
+	}
+	// Whatever it says, so ENV=staging labels itself too.
+	envTag = strings.ToLower(value)
+}
+
 const (
 	listenAddr = ":8080"
 	defaultTZ  = "Europe/Helsinki"
@@ -55,7 +70,7 @@ func run() error {
 		"import a JSON dish bundle (PRD §7.3 shape) and exit")
 	flag.Parse()
 
-	db, err := openDB(cmp.Or(os.Getenv("FOODSTER_DB"), defaultDB))
+	db, err := openDB(cmp.Or(os.Getenv("DB"), defaultDB))
 	if err != nil {
 		return err
 	}
@@ -66,9 +81,9 @@ func run() error {
 		return runImport(db, *importPath)
 	}
 
-	password := os.Getenv("FOODSTER_PASSWORD")
+	password := os.Getenv("PASSWORD")
 	if password == "" {
-		return errors.New("FOODSTER_PASSWORD is not set")
+		return errors.New("PASSWORD is not set")
 	}
 
 	// Fail rather than fall back to UTC: a silently wrong zone shifts logged
@@ -79,9 +94,11 @@ func run() error {
 		return fmt.Errorf("TZ: %w", err)
 	}
 
-	// The container always publishes :8080; FOODSTER_ADDR exists so tests and
+	setEnvTag(os.Getenv("ENV"))
-	// a second local instance can pick another port.
+
-	addr := cmp.Or(os.Getenv("FOODSTER_ADDR"), listenAddr)
+	// The container always publishes :8080; ADDR exists so tests and a second
+	// local instance can pick another port.
+	addr := cmp.Or(os.Getenv("ADDR"), listenAddr)
 
 	srv := &http.Server{
 		Addr:              addr,
@@ -159,9 +176,11 @@ func routes(db *sql.DB, loc *time.Location, password string) http.Handler {
 	mux.HandleFunc("POST /kirjaa", a.save)
 	mux.HandleFunc("POST /lisaa", a.quickAdd)
 	mux.HandleFunc("GET /etsi", a.searchBoard)
+	mux.HandleFunc("GET /paiva", a.day)
 	mux.HandleFunc("POST /poista", a.delete)
 	mux.HandleFunc("GET /ruuat", a.catalog)
 	mux.HandleFunc("GET /ruuat/etsi", a.searchCatalog)
+	mux.HandleFunc("GET /ruuat/nayta", a.show)
 	mux.HandleFunc("POST /ruuat/paaruoka", a.saveMain)
 	mux.HandleFunc("POST /ruuat/lisuke", a.saveSide)
 	mux.HandleFunc("POST /ruuat/poista", a.deleteDish)

cmd/foodster/main_test.go

@@ -105,6 +105,29 @@ func TestReadSignals(t *testing.T) {
 	}
 }
 
+func TestEnvTagMarksNonProduction(t *testing.T) {
+	t.Cleanup(func() { envTag = "" })
+
+	cases := []struct{ env, want string }{
+		// Production is the default and must stay unmarked: the tag exists to
+		// pick the dev tab out of two identical ones.
+		{"", "Foodster"},
+		{"prod", "Foodster"},
+		{"PRODUCTION", "Foodster"},
+		{"  ", "Foodster"},
+		{"dev", "dev · Foodster"},
+		{"DEV", "dev · Foodster"},
+		{"staging", "staging · Foodster"},
+	}
+
+	for _, c := range cases {
+		setEnvTag(c.env)
+		if got := pageTitle("Foodster"); got != c.want {
+			t.Errorf("ENV=%q: title = %q, want %q", c.env, got, c.want)
+		}
+	}
+}
+
 func TestMigrateCreatesSchema(t *testing.T) {
 	db, err := openDB(t.TempDir() + "/test.db")
 	if err != nil {
@@ -246,14 +269,16 @@ func TestMealLogOneEntryPerDate(t *testing.T) {
 	}
 	defer db.Close()
 
-	if _, err := db.Exec(`INSERT INTO main_dishes (id, name) VALUES (1, 'Lohikeitto'), (2, 'Lihapullat')`); err != nil {
+	// Ids well clear of anything the migrations create.
+	if _, err := db.Exec(
+		`INSERT INTO main_dishes (id, name) VALUES (101, 'Lohikeitto'), (102, 'Lihapullat')`); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
-	if _, err := db.Exec(`INSERT INTO meal_log (date, main_dish_id) VALUES ('2026-09-05', 1)`); err != nil {
+	if _, err := db.Exec(`INSERT INTO meal_log (date, main_dish_id) VALUES ('2026-09-05', 101)`); err != nil {
 		t.Fatalf("first entry: %v", err)
 	}
 	// PRD §6: a second dinner for the same day must be refused.
-	if _, err := db.Exec(`INSERT INTO meal_log (date, main_dish_id) VALUES ('2026-09-05', 2)`); err == nil {
+	if _, err := db.Exec(`INSERT INTO meal_log (date, main_dish_id) VALUES ('2026-09-05', 102)`); err == nil {
 		t.Error("second entry for the same date was accepted, want a unique violation")
 	}
 }
@@ -265,18 +290,18 @@ func TestDuplicateNamesAreCaseInsensitive(t *testing.T) {
 	}
 	defer db.Close()
 
-	if _, err := db.Exec(`INSERT INTO main_dishes (id, name) VALUES (1, 'Kanacurry')`); err != nil {
+	if _, err := db.Exec(`INSERT INTO main_dishes (id, name) VALUES (101, 'Kanacurry')`); err != nil {
 		t.Fatalf("first insert: %v", err)
 	}
-	if _, err := db.Exec(`INSERT INTO main_dishes (id, name) VALUES (2, 'kanacurry')`); err == nil {
+	if _, err := db.Exec(`INSERT INTO main_dishes (id, name) VALUES (102, 'kanacurry')`); err == nil {
 		t.Error("case-variant duplicate was accepted, want a unique violation")
 	}
 
 	// Soft-deleting the original frees the name again (PRD §7.3).
-	if _, err := db.Exec(`UPDATE main_dishes SET deleted_at = datetime('now') WHERE id = 1`); err != nil {
+	if _, err := db.Exec(`UPDATE main_dishes SET deleted_at = datetime('now') WHERE id = 101`); err != nil {
 		t.Fatalf("soft delete: %v", err)
 	}
-	if _, err := db.Exec(`INSERT INTO main_dishes (id, name) VALUES (2, 'kanacurry')`); err != nil {
+	if _, err := db.Exec(`INSERT INTO main_dishes (id, name) VALUES (102, 'kanacurry')`); err != nil {
 		t.Errorf("name still blocked after soft delete: %v", err)
 	}
 }

cmd/foodster/migrations/0002_tahteet.sql

@@ -0,0 +1,19 @@
+-- Tähteet: leftovers.
+--
+-- Not a dish. It exists so a day can be recorded as "we ate what was already
+-- there" without inventing a meal that was never cooked. It has no category,
+-- it is not something the household adds or edits, and the stage 2 suggester
+-- must never propose it (PRD §8).
+--
+-- Modelled as a flagged row in main_dishes rather than a nullable
+-- main_dish_id on meal_log: the log keeps one shape, and every foreign key
+-- and join carries on working untouched.
+
+ALTER TABLE main_dishes
+    ADD COLUMN special INTEGER NOT NULL DEFAULT 0 CHECK (special IN (0, 1));
+
+-- OR IGNORE in case a household already typed a dish by this name: the unique
+-- index on lower(name) would otherwise fail the migration. Their row stays as
+-- an ordinary dish, which is wrong but harmless and fixable by hand.
+INSERT OR IGNORE INTO main_dishes (name, has_sides, special)
+VALUES ('Tähteet', 0, 1);

cmd/foodster/static/app.css

@@ -134,6 +134,8 @@ html[data-theme="light"] .themetoggle .i-moon { display: none; }
 .c-kana   { color: var(--kana); }
 .c-kala   { color: var(--kala); }
 .c-kasvis { color: var(--kasvis); }
+/* Not a category, so not a category colour. */
+.c-tahteet { color: var(--muted); }
 
 /* Day switcher */
 .dayseg { display: flex; gap: 6px; margin-top: 11px; flex-wrap: wrap; }
@@ -208,6 +210,20 @@ html[data-theme="light"] .themetoggle .i-moon { display: none; }
   font-size: 10px;
   color: var(--muted);
 }
+/* Not food: set apart from the categories, and deliberately quiet. */
+.special {
+  margin-top: 22px;
+  padding-top: 16px;
+  border-top: 1px dashed var(--line);
+}
+.pill.plain {
+  font-size: 16px;
+  padding: 12px 16px;
+  background: var(--sunk);
+  color: var(--muted);
+  font-weight: 600;
+}
+
 .pill.xl { font-size: 22px;   padding: 14px 18px; flex: 1 1 100%; }
 .pill.lg { font-size: 18px;   padding: 12px 16px; }
 .pill.md { font-size: 15.5px; padding: 11px 14px; }
@@ -310,8 +326,26 @@ html[data-theme="light"] .themetoggle .i-moon { display: none; }
   text-transform: uppercase;
   color: var(--muted);
 }
-/* History sits under the logger on the same page, so whole rows are links. */
+/* The day list is the page; rows are links and the selected one expands. */
-.history { margin-top: 8px; }
+.history { margin-top: 4px; }
+
+/* Marked with a bar down the side, not rules above and below: the rows either
+   side already draw a bottom border, so a horizontal rule here doubled up.
+   scroll-margin keeps the anchor off the viewport edge. */
+.open {
+  scroll-margin-top: 12px;
+  margin: 8px 0 18px;
+  padding: 10px 0 4px 13px;
+  border-left: 3px solid var(--accent);
+}
+.openday {
+  margin: 0 0 12px;
+  font-size: 12px;
+  font-weight: 700;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--accent);
+}
 .entry, .gapline {
   display: flex;
   gap: 12px;

cmd/foodster/store.go

@@ -28,14 +28,25 @@ type Dish struct {
 	TimesEaten int
 }
 
-// CategoryKey is the class suffix for the colour dot. A dish covering several
+// Rows flagged `special` in the database — Tähteet — are loggable but are not
-// categories (tortillas, build-your-own pizza) gets the mixed marker.
+// food. They carry no category, never appear in the catalog, and PRD §8
+// excludes them from the suggester: cooldown, coverage and weighting all skip
+// them. dishByID deliberately does not filter on the flag, because logging one
+// has to work like logging anything else.
+
+// CategoryKey picks the mark for a dish. One covering several categories
+// (tortillas, build-your-own pizza) gets the mixed one; carrying none at all
+// means it is not food, and Tähteet is not a mixture of anything.
 func (d Dish) CategoryKey() string {
-	if len(d.Categories) == 1 {
+	switch len(d.Categories) {
+	case 0:
+		return "tahteet"
+	case 1:
 		return categoryFI[d.Categories[0]]
-	}
+	default:
 		return "sek"
 	}
+}
 
 // Size buckets the dish by how often it has been eaten. The board draws
 // favourites as bigger targets, so the likely answer is the easiest to hit.
@@ -77,6 +88,17 @@ func (e Entry) SidesLabel() string {
 // listDishes returns live mains ordered by how often they have been eaten.
 // An empty search matches everything.
 func listDishes(db *sql.DB, search string) ([]Dish, error) {
+	return queryDishes(db, search, false)
+}
+
+// listSpecial returns the entries that are not food — Tähteet and anything
+// like it. They are loggable but never suggested, and never appear in the
+// catalog, so they are fetched deliberately rather than by accident.
+func listSpecial(db *sql.DB, search string) ([]Dish, error) {
+	return queryDishes(db, search, true)
+}
+
+func queryDishes(db *sql.DB, search string, special bool) ([]Dish, error) {
 	rows, err := db.Query(`
 		SELECT m.id, m.name, m.has_sides,
 		       coalesce((SELECT group_concat(c.category)
@@ -85,8 +107,9 @@ func listDishes(db *sql.DB, search string) ([]Dish, error) {
 		       (SELECT count(*) FROM meal_log l WHERE l.main_dish_id = m.id)
 		FROM main_dishes m
 		WHERE m.deleted_at IS NULL
+		  AND m.special = ?
 		  AND (? = '' OR lower(m.name) LIKE '%' || lower(?) || '%')
-		ORDER BY 5 DESC, m.name`, search, search)
+		ORDER BY 5 DESC, m.name`, special, search, search)
 	if err != nil {
 		return nil, err
 	}

cmd/foodster/views.templ

@@ -43,6 +43,23 @@ func dayURL(base string, d, now time.Time) string {
 	return base + "?pvm=" + isoDate(d)
 }
 
+// showURL turns a catalog page link into the patch endpoint behind it, so the
+// href and the Datastar call never drift apart.
+func showURL(pageURL string) string {
+	return strings.Replace(pageURL, "/ruuat?", "/ruuat/nayta?", 1)
+}
+
+// dayPatch is the endpoint behind every link in the day list. The href beside
+// it stays a real page URL for anyone without JavaScript; Datastar calls this
+// instead and swaps the list where it stands.
+func dayPatch(d time.Time, param string) string {
+	url := "/paiva?pvm=" + isoDate(d)
+	if param != "" {
+		url += "&" + param
+	}
+	return url
+}
+
 // pickSeparator joins a dish onto a day URL, which already carries ?pvm= for
 // any day but today.
 func pickSeparator(v logView) string {
@@ -52,6 +69,16 @@ func pickSeparator(v logView) string {
 	return "&"
 }
 
+// stepURL is the page URL for a link inside the open day: the fallback when
+// there is no JavaScript to intercept it.
+func stepURL(v logView, param string) string {
+	url := dayURL("/", v.Date, v.Today)
+	if param != "" {
+		url += pickSeparator(v) + param
+	}
+	return url
+}
+
 // jsString renders a Go string as a JavaScript literal, for the data-signals
 // attribute that seeds the search box.
 func jsString(s string) string {
@@ -81,6 +108,16 @@ func categoryLabels(d Dish) string {
 	return strings.Join(names, ", ")
 }
 
+// pageTitle prefixes the tab title on any instance that is not production.
+// The tab is the only place a browser shows which of two identical apps you
+// are looking at.
+func pageTitle(title string) string {
+	if envTag == "" {
+		return title
+	}
+	return envTag + " · " + title
+}
+
 // countFI renders "1 pääruoka" but "16 pääruokaa": Finnish takes the partitive
 // after every number except one.
 func countFI(n int, one, many string) string {
@@ -103,7 +140,7 @@ templ page(title, current string) {
 			// header rather than butting against it.
 			<meta name="theme-color" media="(prefers-color-scheme: light)" content="#FFFFFF"/>
 			<meta name="theme-color" media="(prefers-color-scheme: dark)" content="#1C1E22"/>
-			<title>{ title }</title>
+			<title>{ pageTitle(title) }</title>
 			<link rel="icon" href="/static/favicon.svg" type="image/svg+xml"/>
 			<link rel="apple-touch-icon" href="/static/apple-touch-icon.png"/>
 			<!-- use-credentials: the manifest is fetched behind Basic auth and
@@ -183,6 +220,10 @@ templ categoryIcon(key string) {
 			<span class="cat c-kasvis">
 				@glyphKasvis()
 			</span>
+		case "tahteet":
+			<span class="cat c-tahteet">
+				@glyphTahteet()
+			</span>
 		default:
 			<span class="cat">
 				@glyphSekalaiset()
@@ -190,6 +231,15 @@ templ categoryIcon(key string) {
 	}
 }
 
+// A lidded tub. Tähteet is not food and not a mixture of categories, so it
+// gets neither a category colour nor the quartered mark.
+templ glyphTahteet() {
+	<svg viewBox="0 0 16 16" aria-hidden="true" focusable="false" fill="currentColor">
+		<rect x="1.4" y="2.6" width="13.2" height="3" rx="1.3"></rect>
+		<path d="M2.8 6.8h10.4l-.9 6.6a1.6 1.6 0 0 1-1.6 1.4H5.3a1.6 1.6 0 0 1-1.6-1.4z"></path>
+	</svg>
+}
+
 // A steak, its bone knocked out with fill-rule so the hole is transparent on
 // whatever background the icon lands on.
 templ glyphLiha() {
@@ -268,6 +318,30 @@ templ logPage(v logView) {
 			@daySwitch(v)
 		</header>
 		<main class="pad">
+			@dayList(v)
+		</main>
+	}
+}
+
+// dayList is the whole page: every day back through the window, with the
+// selected one expanded where it sits. Opening a day used to swap in a panel
+// above the list and drop that day out of it, so the rows below jumped up
+// under the tap. Now nothing moves — the row grows.
+templ dayList(v logView) {
+	<section class="history" id="paivat">
+		for i, row := range v.History.Rows {
+			if i == 0 || v.History.Rows[i-1].Date.Month() != row.Date.Month() {
+				<p class="monthrule">{ monthFI(row.Date) }</p>
+			}
+			if row.Date.Equal(v.Date) {
+				<div class="open">
+					<p class="openday">
+						if row.Date.Equal(v.Today) {
+							Tänään
+						} else {
+							{ longDateFI(row.Date) }
+						}
+					</p>
 					switch  {
 						case v.Chosen != nil:
 							@sidesStep(v)
@@ -276,26 +350,13 @@ templ logPage(v logView) {
 						default:
 							@loggedCard(v)
 					}
-			@historyList(v)
+				</div>
-		</main>
+			} else if row.Entry != nil {
-	}
+				<a
-}
+					class="entry"
-
+					href={ templ.SafeURL(dayURL("/", row.Date, v.Today)) }
-// historyList sits under the day being logged: the two were always one thing,
+					data-on:click__prevent={ "@get('" + dayPatch(row.Date, "") + "')" }
-// since every row here is a link back into the logger above it.
+				>
-templ historyList(v logView) {
-	<section class="history">
-		<h3 class="sechead">Aiemmin</h3>
-		if len(v.History.Rows) == 0 {
-			<p class="muted small">Ei vielä merkintöjä.</p>
-		}
-		for i, row := range v.History.Rows {
-			if !row.Date.Equal(v.Date) {
-				if i == 0 || v.History.Rows[i-1].Date.Month() != row.Date.Month() {
-					<p class="monthrule">{ monthFI(row.Date) }</p>
-				}
-				if row.Entry != nil {
-					<a class="entry" href={ templ.SafeURL(dayURL("/", row.Date, v.Today)) }>
 					<time>{ dayLabelFI(row.Date) }</time>
 					<div>
 						<div class="nm">
@@ -307,18 +368,22 @@ templ historyList(v logView) {
 					<span class="chev">›</span>
 				</a>
 			} else {
-					<a class="gapline" href={ templ.SafeURL(dayURL("/", row.Date, v.Today)) }>
+				<a
+					class="gapline"
+					href={ templ.SafeURL(dayURL("/", row.Date, v.Today)) }
+					data-on:click__prevent={ "@get('" + dayPatch(row.Date, "") + "')" }
+				>
 					<time>{ dayLabelFI(row.Date) }</time>
 					<span>Ei merkintää</span>
 					<span class="act">Merkitse</span>
 				</a>
 			}
 		}
-		}
 		if v.History.More {
 			<a
 				class="more"
 				href={ templ.SafeURL(dayURL("/", v.Date, v.Today) + pickSeparator(v) + "paivat=" + strconv.Itoa(v.HistoryMore)) }
+				data-on:click__prevent={ "@get('" + dayPatch(v.Date, "paivat="+strconv.Itoa(v.HistoryMore)) + "')" }
 			>Näytä lisää</a>
 		}
 	</section>
@@ -385,6 +450,29 @@ templ boardList(v logView) {
 				}
 			</div>
 		}
+		// Tähteet is not food, so it sits apart from the categories rather
+		// than inside one. Fixed size: it will be among the most-logged
+		// entries, and it should not tower over the actual cooking.
+		if len(v.Special) > 0 {
+			<div class="special">
+				for _, d := range v.Special {
+					<a
+						class="pill plain"
+						href={ templ.SafeURL(stepURL(v, "ruoka="+strconv.FormatInt(d.ID, 10))) }
+						data-on:click__prevent={ "@get('" + dayPatch(v.Date, "ruoka="+strconv.FormatInt(d.ID, 10)) + "')" }
+					>
+						@categoryIcon(d.CategoryKey())
+						{ d.Name }
+						if d.TimesEaten > 0 {
+							<span class="n">{ strconv.Itoa(d.TimesEaten) }</span>
+						}
+					</a>
+				}
+			</div>
+		}
+		// Tähteet always matches an empty search, so the add card keys off the
+		// real dishes only: otherwise a fresh install would show leftovers and
+		// no way to add anything.
 		if len(v.Dishes) == 0 {
 			@quickAddCard(v)
 		}
@@ -407,7 +495,11 @@ templ quickAddCard(v logView) {
 		if v.New.Err != "" {
 			<p class="formerr">{ v.New.Err }</p>
 		}
-		<form method="post" action="/lisaa">
+		<form
+			method="post"
+			action="/lisaa"
+			data-on:submit__prevent="@post('/lisaa', {contentType: 'form'})"
+		>
 			<input type="hidden" name="pvm" value={ isoDate(v.Date) }/>
 			<label class="field">
 				<span>Nimi</span>
@@ -438,7 +530,8 @@ templ quickAddCard(v logView) {
 templ dishPill(d Dish, v logView) {
 	<a
 		class={ "pill", d.Size() }
-		href={ templ.SafeURL(dayURL("/", v.Date, v.Today) + pickSeparator(v) + "ruoka=" + strconv.FormatInt(d.ID, 10)) }
+		href={ templ.SafeURL(stepURL(v, "ruoka="+strconv.FormatInt(d.ID, 10))) }
+		data-on:click__prevent={ "@get('" + dayPatch(v.Date, "ruoka="+strconv.FormatInt(d.ID, 10)) + "')" }
 	>
 		@categoryIcon(d.CategoryKey())
 		{ d.Name }
@@ -454,7 +547,11 @@ templ sidesStep(v logView) {
 			@categoryIcon(v.Chosen.CategoryKey())
 			{ v.Chosen.Name }
 		</h3>
-		<form method="post" action="/kirjaa">
+		<form
+			method="post"
+			action="/kirjaa"
+			data-on:submit__prevent="@post('/kirjaa', {contentType: 'form'})"
+		>
 			<input type="hidden" name="pvm" value={ isoDate(v.Date) }/>
 			<input type="hidden" name="ruoka" value={ strconv.FormatInt(v.Chosen.ID, 10) }/>
 			if v.Chosen.HasSides && len(v.Sides) > 0 {
@@ -476,7 +573,11 @@ templ sidesStep(v logView) {
 			}
 			<button class="primary" type="submit">Tallenna</button>
 		</form>
-		<a class="ghost" href={ templ.SafeURL(dayURL("/", v.Date, v.Today)) }>Peruuta</a>
+		<a
+			class="ghost"
+			href={ templ.SafeURL(stepURL(v, "")) }
+			data-on:click__prevent={ "@get('" + dayPatch(v.Date, "") + "')" }
+		>Peruuta</a>
 	</section>
 }
 
@@ -497,21 +598,31 @@ templ loggedCard(v logView) {
 		if v.Confirming {
 			<p class="q">Poistetaanko merkintä?</p>
 			<div class="pair">
-				<form method="post" action="/poista">
+				<form
+					method="post"
+					action="/poista"
+					data-on:submit__prevent="@post('/poista', {contentType: 'form'})"
+				>
 					<input type="hidden" name="pvm" value={ isoDate(v.Date) }/>
 					<button class="btn del" type="submit">Kyllä, poista</button>
 				</form>
-				<a class="btn" href={ templ.SafeURL(dayURL("/", v.Date, v.Today)) }>Peruuta</a>
+				<a
+					class="btn"
+					href={ templ.SafeURL(stepURL(v, "")) }
+					data-on:click__prevent={ "@get('" + dayPatch(v.Date, "") + "')" }
+				>Peruuta</a>
 			</div>
 		} else {
 			<div class="pair">
 				<a
 					class="btn"
-					href={ templ.SafeURL(dayURL("/", v.Date, v.Today) + pickSeparator(v) + "muuta=1") }
+					href={ templ.SafeURL(stepURL(v, "muuta=1")) }
+					data-on:click__prevent={ "@get('" + dayPatch(v.Date, "muuta=1") + "')" }
 				>Muokkaa</a>
 				<a
 					class="btn del"
-					href={ templ.SafeURL(dayURL("/", v.Date, v.Today) + pickSeparator(v) + "poista=1") }
+					href={ templ.SafeURL(stepURL(v, "poista=1")) }
+					data-on:click__prevent={ "@get('" + dayPatch(v.Date, "poista=1") + "')" }
 				>Poista</a>
 			</div>
 		}
@@ -625,25 +736,39 @@ templ emptyNote(search string) {
 // rowActions is a pencil and a bin, until the bin is tapped: then the row
 // asks. An icon is a smaller target to hit by accident than a word, and the
 // dish disappears from every picker the moment it goes.
+// Every control here is a real link or form, so the page still works without
+// JavaScript. Datastar intercepts them and patches the list in place instead,
+// which is the whole point: a delete confirmation halfway down a long list
+// must not send the browser back to the top.
 templ rowActions(v catalogView, editURL string, id int64, kind string) {
 	if v.DeleteID == id && v.DeleteKind == kind {
 		<div class="rowactions confirming">
 			<span>Poista?</span>
-			<form method="post" action="/ruuat/poista">
+			<form
+				method="post"
+				action="/ruuat/poista"
+				data-on:submit__prevent="@post('/ruuat/poista', {contentType: 'form'})"
+			>
 				<input type="hidden" name="id" value={ strconv.FormatInt(id, 10) }/>
 				<input type="hidden" name="tyyppi" value={ kind }/>
 				<button type="submit" class="del">Kyllä</button>
 			</form>
-			<a href="/ruuat">Peruuta</a>
+			<a href="/ruuat" data-on:click__prevent="@get('/ruuat/nayta')">Peruuta</a>
 		</div>
 	} else {
 		<div class="rowactions">
-			<a href={ templ.SafeURL(editURL) } aria-label="Muokkaa" title="Muokkaa">
+			<a
+				href={ templ.SafeURL(editURL) }
+				data-on:click__prevent={ "@get('" + showURL(editURL) + "')" }
+				aria-label="Muokkaa"
+				title="Muokkaa"
+			>
 				@iconPencil()
 			</a>
 			<a
 				class="del"
 				href={ templ.SafeURL("/ruuat?poista=" + strconv.FormatInt(id, 10) + "&tyyppi=" + kind) }
+				data-on:click__prevent={ "@get('/ruuat/nayta?poista=" + strconv.FormatInt(id, 10) + "&tyyppi=" + kind + "')" }
 				aria-label="Poista"
 				title="Poista"
 			>
@@ -682,7 +807,11 @@ templ mainForm_(f mainForm) {
 		if f.Err != "" {
 			<p class="formerr">{ f.Err }</p>
 		}
-		<form method="post" action="/ruuat/paaruoka">
+		<form
+			method="post"
+			action="/ruuat/paaruoka"
+			data-on:submit__prevent="@post('/ruuat/paaruoka', {contentType: 'form'})"
+		>
 			if f.ID != 0 {
 				<input type="hidden" name="id" value={ strconv.FormatInt(f.ID, 10) }/>
 			}
@@ -710,7 +839,7 @@ templ mainForm_(f mainForm) {
 			<button class="primary" type="submit">Tallenna</button>
 		</form>
 		if f.ID != 0 {
-			<a class="ghost" href="/ruuat">Peruuta</a>
+			<a class="ghost" href="/ruuat" data-on:click__prevent="@get('/ruuat/nayta')">Peruuta</a>
 		}
 	</details>
 }
@@ -739,7 +868,11 @@ templ sideForm_(f sideForm) {
 		if f.Err != "" {
 			<p class="formerr">{ f.Err }</p>
 		}
-		<form method="post" action="/ruuat/lisuke">
+		<form
+			method="post"
+			action="/ruuat/lisuke"
+			data-on:submit__prevent="@post('/ruuat/lisuke', {contentType: 'form'})"
+		>
 			if f.ID != 0 {
 				<input type="hidden" name="id" value={ strconv.FormatInt(f.ID, 10) }/>
 			}
@@ -750,7 +883,7 @@ templ sideForm_(f sideForm) {
 			<button class="primary" type="submit">Tallenna</button>
 		</form>
 		if f.ID != 0 {
-			<a class="ghost" href="/ruuat">Peruuta</a>
+			<a class="ghost" href="/ruuat" data-on:click__prevent="@get('/ruuat/nayta')">Peruuta</a>
 		}
 	</details>
 }

compose.yaml

@@ -1,19 +1,23 @@
 services:
   app:
-    image: ${FOODSTER_REPO:?set FOODSTER_REPO in .env}:${FOODSTER_TAG:-latest}
+    image: ${REPO:?set REPO in .env}:${TAG:-latest}
     restart: unless-stopped
 
-    # The database is a bind mount, not a named volume: it sits in ./data on
+    # A bind mount rather than a named volume: the database sits in ./data on
-    # the host where it can be listed, copied and opened with any sqlite
+    # the host, where it can be listed, copied and backed up without going
-    # client. The image runs as UID 65534, so the container has to be told
+    # through the container engine. The image runs as UID 65534, so the
-    # which host user owns that directory.
+    # container has to be told which host user owns that directory.
-    user: "${FOODSTER_UID:-1000}:${FOODSTER_GID:-1000}"
+    #
+    # PUID/PGID rather than UID/GID: UID is a read-only variable in bash, so a
+    # value set here would be silently replaced by the invoking shell's own.
+    user: "${PUID:-1000}:${PGID:-1000}"
     volumes:
       - ./data:/data
 
     environment:
-      FOODSTER_PASSWORD: ${FOODSTER_PASSWORD:?set FOODSTER_PASSWORD in .env}
+      PASSWORD: ${PASSWORD:?set PASSWORD in .env}
-      FOODSTER_DB: /data/foodster.db
+      DB: /data/foodster.db
+      ENV: ${ENV:-prod}
       TZ: ${TZ:-Europe/Helsinki}
 
     # No published ports: Traefik reaches the container over the shared
@@ -22,7 +26,7 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.foodster.entrypoints=websecure
-      - traefik.http.routers.foodster.rule=Host(`${FOODSTER_HOST:?set FOODSTER_HOST in .env}`)
+      - traefik.http.routers.foodster.rule=Host(`${HOST:?set HOST in .env}`)
       - traefik.http.routers.foodster.tls=true
       - traefik.http.services.foodster.loadbalancer.server.port=8080
       - traefik.docker.network=traefik

scripts/smoke.sh

@@ -11,12 +11,18 @@ cd "$(dirname "$0")/.."
 
 addr=127.0.0.1:8099
 pass=smoke
+
+# Dates are relative, never literal. A hardcoded one turns into "some day in
+# the past" at the next midnight, and the assertions quietly start meaning
+# something else.
+d0=$(date +%F)
+d1=$(date -d yesterday +%F)
 tmp=$(mktemp -d)
 trap 'kill ${srv:-0} 2>/dev/null || true; rm -rf "$tmp"' EXIT
 
 go build -o "$tmp/foodster" ./cmd/foodster
 
-FOODSTER_PASSWORD="$pass" FOODSTER_DB="$tmp/smoke.db" FOODSTER_ADDR="$addr" \
+PASSWORD="$pass" DB="$tmp/smoke.db" ADDR="$addr" \
 	"$tmp/foodster" >"$tmp/server.log" 2>&1 &
 srv=$!
 
@@ -72,6 +78,8 @@ check "theme script is served" \
 
 home=$(curl -s -u ":$pass" "http://$addr/")
 check "the header carries the brand" "$home" "Foodster"
+# ENV is unset here, so this instance is production and unmarked.
+check "production tabs are not tagged" "$home" "<title>Foodster</title>"
 check "dark is the default without JavaScript" "$home" '<html lang="fi" data-theme="dark">'
 check "the theme toggle is present" "$home" "data-theme-toggle"
 check "both theme icons ship so CSS can pick one" "$home" 'class="i-moon"'
@@ -114,6 +122,11 @@ check "malformed JSON is explained" \
 board=$(curl -s -u ":$pass" "http://$addr/")
 check "board lists imported dishes" "$board" "Lihapullat"
 
+# Tähteet is loggable but is not food: on the board, never in the catalog.
+check "leftovers are on the board" "$board" "Tähteet"
+refute "leftovers are not in the catalog" \
+	"$(curl -s -u ":$pass" "http://$addr/ruuat")" "Tähteet"
+
 # Pull a real dish id out of the board rather than assuming one.
 ruoka=$(printf '%s' "$board" | grep -o 'ruoka=[0-9]*' | head -n1 | cut -d= -f2)
 if [ -z "$ruoka" ]; then
@@ -127,25 +140,53 @@ check "picking a dish opens the sides step" \
 
 check "saving redirects back to the day" \
 	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" \
-		-d "pvm=2026-09-05&ruoka=$ruoka" "http://$addr/kirjaa")" "303"
+		-d "pvm=$d0&ruoka=$ruoka" "http://$addr/kirjaa")" "303"
 
 check "the saved day shows what was eaten" \
-	"$(curl -s -u ":$pass" "http://$addr/?pvm=2026-09-05")" "kirjattu"
+	"$(curl -s -u ":$pass" "http://$addr/?pvm=$d0")" "kirjattu"
 
-check "history is on the same page as the logger" \
+# The selected day expands inside the list rather than in a panel above it,
-	"$(curl -s -u ":$pass" "http://$addr/")" "Aiemmin"
+# so the rows below do not shift when one is tapped.
+day=$(curl -s -u ":$pass" "http://$addr/?pvm=$d0")
+check "the selected day expands in place" "$day" 'class="open"'
+check "and stays in the list rather than being lifted out" "$day" "kirjattu"
+
+# ---- the day list patches in place instead of navigating ----------------
+
+dayp=$(curl -s -u ":$pass" -H 'Datastar-Request: true' "http://$addr/paiva?pvm=$d0")
+check "opening a day patches the list" "$dayp" 'id="paivat"'
+refute "and returns a fragment, not a page" "$dayp" "<html"
+
+check "picking a dish patches to the sides step" \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
+		"http://$addr/paiva?pvm=$d0&ruoka=$ruoka")" "Tallenna"
+
+check "saving from Datastar patches back" \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
+		-d "pvm=$d1&ruoka=$ruoka" "http://$addr/kirjaa")" 'id="paivat"'
+
+check "deleting from Datastar patches back" \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
+		-d "pvm=$d1" "http://$addr/poista")" 'id="paivat"'
+
+# Without the header it must still redirect, for no JavaScript.
+check "a plain save still redirects to the day" \
+	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
+		-d "pvm=$d1&ruoka=$ruoka" "http://$addr/kirjaa")" "pvm=$d1"
 
 # Deleting a logged meal drops the row outright, so it asks first.
-saved=$(curl -s -u ":$pass" "http://$addr/?pvm=2026-09-05&poista=1")
+saved=$(curl -s -u ":$pass" "http://$addr/?pvm=$d0&poista=1")
 check "deleting a meal asks first" "$saved" "Poistetaanko merkintä?"
-refute "and does not delete while asking" "$saved" "Ei merkintää"
+# Assert the entry is still shown, rather than that no gap row exists anywhere
+# on the page: other days are legitimately unlogged and render their own.
+check "and the entry is still there while asking" "$saved" "kirjattu"
 
 check "deleting redirects back" \
 	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" \
-		-d "pvm=2026-09-05" "http://$addr/poista")" "303"
+		-d "pvm=$d0" "http://$addr/poista")" "303"
 
 check "the day is empty again" \
-	"$(curl -s -u ":$pass" "http://$addr/?pvm=2026-09-05")" "Etsi"
+	"$(curl -s -u ":$pass" "http://$addr/?pvm=$d0")" "Etsi"
 
 check "search filters the board" \
 	"$(curl -s -u ":$pass" "http://$addr/?haku=keitto")" "keitto"
@@ -207,9 +248,12 @@ check "the quick-added dish is on the board" \
 
 # ---- catalog CRUD from the UI -------------------------------------------
 
-check "adding a main redirects" \
+# Assert where it redirects, not just that it does: these pointed at the old
-	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" \
+# /ruoat spelling for a while and every 303-only check was happy.
-		-d 'nimi=uunikala&kategoria=fish&lisukkeita=1' "http://$addr/ruuat/paaruoka")" "303"
+check "adding a main redirects back to the catalog" \
+	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
+		-d 'nimi=uunikala&kategoria=fish&lisukkeita=1' "http://$addr/ruuat/paaruoka")" \
+	"/ruuat"
 
 catalog=$(curl -s -u ":$pass" "http://$addr/ruuat")
 check "the new main is listed, sentence-cased" "$catalog" "Uunikala"
@@ -226,9 +270,10 @@ check "a nameless dish is refused" \
 	"$(curl -s -u ":$pass" -d 'nimi=+++&kategoria=fish' "http://$addr/ruuat/paaruoka")" \
 	"Anna nimi."
 
-check "adding a side redirects" \
+check "adding a side redirects back to the catalog" \
-	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" \
+	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
-		-d 'nimi=lohkoperunat' "http://$addr/ruuat/lisuke")" "303"
+		-d 'nimi=lohkoperunat' "http://$addr/ruuat/lisuke")" \
+	"/ruuat"
 
 check "the new side is listed" \
 	"$(curl -s -u ":$pass" "http://$addr/ruuat")" "Lohkoperunat"
@@ -251,9 +296,35 @@ check "the bin asks before deleting" \
 check "the dish is still there while it asks" \
 	"$(curl -s -u ":$pass" "http://$addr/ruuat?poista=$uusi&tyyppi=paa")" "Uunikala"
 
-check "confirming the delete redirects" \
+# ---- the catalog patches in place instead of navigating -----------------
-	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" \
+
-		-d "id=$uusi&tyyppi=paa" "http://$addr/ruuat/poista")" "303"
+# A delete confirmation halfway down a long list must not send the browser
+# back to the top, so these answer with a Datastar patch rather than a page.
+patch=$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
+	"http://$addr/ruuat/nayta?poista=$uusi&tyyppi=paa")
+check "asking to delete patches rather than navigates" "$patch" "event: datastar-patch-elements"
+check "the patch carries the list" "$patch" 'id="ruokalista"'
+check "and both forms, so an open one closes" "$patch" 'id="paaruoka"'
+check "the row it patches in is asking" "$patch" "Poista?"
+
+check "patches are served as an event stream" \
+	"$(curl -s -o /dev/null -w '%{content_type}' -u ":$pass" -H 'Datastar-Request: true' \
+		"http://$addr/ruuat/nayta")" "text/event-stream"
+
+check "deleting from Datastar patches too" \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
+		-d "id=$uusi&tyyppi=paa" "http://$addr/ruuat/poista")" \
+	"event: datastar-patch-elements"
+
+refute "and the dish is gone from the patched list" \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' "http://$addr/ruuat/nayta")" \
+	"Uunikala"
+
+# Without the header it must still be an ordinary redirect, for no JavaScript.
+check "a plain form post still redirects" \
+	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
+		-d 'nimi=Testiruoka&kategoria=fish' "http://$addr/ruuat/paaruoka")" \
+	"/ruuat"
 
 refute "the dish is gone once confirmed" \
 	"$(curl -s -u ":$pass" "http://$addr/ruuat")" "Uunikala"

seeds/kotiruoat.json

@@ -1,19 +1,56 @@
 {
   "mains": [
-    {"name": "Uunilohi",         "categories": ["fish"],       "has_sides": true},
+    {"name": "Jauheliha-perunasiivu pelti", "categories": ["meat"],     "has_sides": false},
-    {"name": "Lasagnette",       "categories": ["meat"],       "has_sides": false},
     {"name": "Jauhelihakastike",          "categories": ["meat"],       "has_sides": true},
-    {"name": "Risotto",          "categories": ["vegetarian"], "has_sides": false},
+    {"name": "Jauhelihakeitto",           "categories": ["meat"],       "has_sides": false},
+    {"name": "Jauhelihapihvit",           "categories": ["meat"],       "has_sides": true},
+    {"name": "Kebab",                     "categories": ["meat"],       "has_sides": true},
+    {"name": "Kinkkukiusaus",             "categories": ["meat"],       "has_sides": false},
+    {"name": "Lasagnette",                "categories": ["meat"],       "has_sides": false},
+    {"name": "Lihapullat/pihvit",         "categories": ["meat"],       "has_sides": true},
+    {"name": "Makaronilaatikko",          "categories": ["meat"],       "has_sides": false},
+    {"name": "Makaronimössö",             "categories": ["meat"],       "has_sides": false},
+    {"name": "Maksalaatikko",             "categories": ["meat"],       "has_sides": false},
+    {"name": "Nachopelti",                "categories": ["meat"],       "has_sides": false},
+    {"name": "Nakkikeitto",               "categories": ["meat"],       "has_sides": false},
     {"name": "Pakastepizza",              "categories": ["meat"],       "has_sides": false},
+    {"name": "Possunsuikalekastike",      "categories": ["meat"],       "has_sides": true},
+    {"name": "Possurisotto",              "categories": ["meat"],       "has_sides": false},
+    {"name": "Pyttipannu",                "categories": ["meat"],       "has_sides": false},
+    {"name": "Uuniliha",                  "categories": ["meat"],       "has_sides": true},
+    {"name": "Uunimakkara",               "categories": ["meat"],       "has_sides": true},
+
+    {"name": "Broilerin koipireidet",     "categories": ["chicken"],    "has_sides": true},
+    {"name": "Kanakastike",               "categories": ["chicken"],    "has_sides": true},
     {"name": "Kanakeitto",                "categories": ["chicken"],    "has_sides": false},
-    {"name": "Kasvissosekeitto", "categories": ["vegetarian"], "has_sides": false}
+    {"name": "Kanamakaronilaatikko",      "categories": ["chicken"],    "has_sides": false},
+    {"name": "Kanapasta",                 "categories": ["chicken"],    "has_sides": false},
+    {"name": "Kanarisotto",               "categories": ["chicken"],    "has_sides": false},
+
+    {"name": "Kalakeitto",                "categories": ["fish"],       "has_sides": false},
+    {"name": "Lohicuscus-salaatti",       "categories": ["fish"],       "has_sides": false},
+    {"name": "Lohipyörykät",              "categories": ["fish"],       "has_sides": true},
+    {"name": "Uunilohi",                  "categories": ["fish"],       "has_sides": true},
+    {"name": "Uuniperunat (lohitäytteellä)", "categories": ["fish"],    "has_sides": false},
+
+    {"name": "Hernekeitto",               "categories": ["vegetarian"], "has_sides": false},
+    {"name": "Italianpata (lihaton)",     "categories": ["vegetarian"], "has_sides": true},
+    {"name": "Kasvispihvit",              "categories": ["vegetarian"], "has_sides": true},
+    {"name": "Kasvissosekeitto",          "categories": ["vegetarian"], "has_sides": false},
+    {"name": "Pinaattiletut",             "categories": ["vegetarian"], "has_sides": false},
+    {"name": "Risotto",                   "categories": ["vegetarian"], "has_sides": false},
+
+    {"name": "Tortillat", "categories": ["meat", "chicken", "fish", "vegetarian"], "has_sides": false}
   ],
   "sides": [
     {"name": "Keitetyt perunat"},
-    {"name": "Ranskalaiset"},
     {"name": "Lohkoperunat"},
-    {"name": "Muussi"},
+    {"name": "Muusi"},
+    {"name": "Pasta"},
+    {"name": "Ranskalaiset"},
     {"name": "Riisi"},
-    {"name": "Pasta"}
+    {"name": "Spagetti"},
+    {"name": "Tillikastike"},
+    {"name": "Wokkivihannekset"}
   ]
 }