docs: note that the server's compose and env are copied by hand

The variable rename landed in the repository but not on the server, which
keeps its own compose.yaml and .env. Neither is pulled from here, so the
container came up against the old names. A release touching either now has to
say so in its notes.

CONTRIBUTING.md

@@ -75,6 +75,16 @@ title — the CalVer tag is not created until `make image` runs after the merge.
 
 The types above are for `dev`, where a commit really does do one thing.
 
+## Deploying
+
+The server keeps its own `compose.yaml` and `.env`. Neither is pulled from
+here, so a release that renames a variable, adds one, or changes a mount
+needs both copied across **in the same deploy** — otherwise the container
+comes up against the old names and the app refuses to start.
+
+Anything in this repository that reaches the server by hand belongs in the
+release notes, flagged as breaking.
+
 ## Things that are easy to get wrong
 
 - **The interface is Finnish.** Code, comments, this file and the PRD are

scripts/smoke.sh

@@ -11,6 +11,12 @@ cd "$(dirname "$0")/.."
 
 addr=127.0.0.1:8099
 pass=smoke
+
+# Dates are relative, never literal. A hardcoded one turns into "some day in
+# the past" at the next midnight, and the assertions quietly start meaning
+# something else.
+d0=$(date +%F)
+d1=$(date -d yesterday +%F)
 tmp=$(mktemp -d)
 trap 'kill ${srv:-0} 2>/dev/null || true; rm -rf "$tmp"' EXIT
 
@@ -134,51 +140,53 @@ check "picking a dish opens the sides step" \
 
 check "saving redirects back to the day" \
 	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" \
-		-d "pvm=2026-09-05&ruoka=$ruoka" "http://$addr/kirjaa")" "303"
+		-d "pvm=$d0&ruoka=$ruoka" "http://$addr/kirjaa")" "303"
 
 check "the saved day shows what was eaten" \
-	"$(curl -s -u ":$pass" "http://$addr/?pvm=2026-09-05")" "kirjattu"
+	"$(curl -s -u ":$pass" "http://$addr/?pvm=$d0")" "kirjattu"
 
 # The selected day expands inside the list rather than in a panel above it,
 # so the rows below do not shift when one is tapped.
-day=$(curl -s -u ":$pass" "http://$addr/?pvm=2026-09-05")
+day=$(curl -s -u ":$pass" "http://$addr/?pvm=$d0")
 check "the selected day expands in place" "$day" 'class="open"'
 check "and stays in the list rather than being lifted out" "$day" "kirjattu"
 
 # ---- the day list patches in place instead of navigating ----------------
 
-dayp=$(curl -s -u ":$pass" -H 'Datastar-Request: true' "http://$addr/paiva?pvm=2026-09-05")
+dayp=$(curl -s -u ":$pass" -H 'Datastar-Request: true' "http://$addr/paiva?pvm=$d0")
 check "opening a day patches the list" "$dayp" 'id="paivat"'
 refute "and returns a fragment, not a page" "$dayp" "<html"
 
 check "picking a dish patches to the sides step" \
 	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
-		"http://$addr/paiva?pvm=2026-09-05&ruoka=$ruoka")" "Tallenna"
+		"http://$addr/paiva?pvm=$d0&ruoka=$ruoka")" "Tallenna"
 
 check "saving from Datastar patches back" \
 	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
-		-d "pvm=2026-09-04&ruoka=$ruoka" "http://$addr/kirjaa")" 'id="paivat"'
+		-d "pvm=$d1&ruoka=$ruoka" "http://$addr/kirjaa")" 'id="paivat"'
 
 check "deleting from Datastar patches back" \
 	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
-		-d "pvm=2026-09-04" "http://$addr/poista")" 'id="paivat"'
+		-d "pvm=$d1" "http://$addr/poista")" 'id="paivat"'
 
 # Without the header it must still redirect, for no JavaScript.
 check "a plain save still redirects to the day" \
 	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
-		-d "pvm=2026-09-04&ruoka=$ruoka" "http://$addr/kirjaa")" "pvm=2026-09-04"
+		-d "pvm=$d1&ruoka=$ruoka" "http://$addr/kirjaa")" "pvm=$d1"
 
 # Deleting a logged meal drops the row outright, so it asks first.
-saved=$(curl -s -u ":$pass" "http://$addr/?pvm=2026-09-05&poista=1")
+saved=$(curl -s -u ":$pass" "http://$addr/?pvm=$d0&poista=1")
 check "deleting a meal asks first" "$saved" "Poistetaanko merkintä?"
-refute "and does not delete while asking" "$saved" "Ei merkintää"
+# Assert the entry is still shown, rather than that no gap row exists anywhere
+# on the page: other days are legitimately unlogged and render their own.
+check "and the entry is still there while asking" "$saved" "kirjattu"
 
 check "deleting redirects back" \
 	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" \
-		-d "pvm=2026-09-05" "http://$addr/poista")" "303"
+		-d "pvm=$d0" "http://$addr/poista")" "303"
 
 check "the day is empty again" \
-	"$(curl -s -u ":$pass" "http://$addr/?pvm=2026-09-05")" "Etsi"
+	"$(curl -s -u ":$pass" "http://$addr/?pvm=$d0")" "Etsi"
 
 check "search filters the board" \
 	"$(curl -s -u ":$pass" "http://$addr/?haku=keitto")" "keitto"