Say what the comment is for, not what the bug was

Keep the reader in place when the drawer closes, and stop the CSS promising a header it deleted
A page is a document: drop the sticky chrome and the bounded-frame opt-out
2026-09-09 16:05:20 +02:00 · 2026-09-09 15:52:46 +02:00 · 2026-09-09 15:26:45 +02:00 · 2026-09-09 15:16:36 +02:00 · 2026-09-09 15:01:15 +02:00 · 2026-09-09 14:41:19 +02:00
56 changed files with 689 additions and 253 deletions
@@ -19,4 +19,4 @@ jobs:
        run: |
          docker run --rm -v "$PWD:/repo" -w /repo \
            -e REGISTRY_TOKEN -e REGISTRY_USER -e REPO_TOKEN -e REPOSITORY -e SERVER_URL \
-            node:24.19.0-alpine3.24 node registry-cleanup/cleanup.ts
+            node:24.20.0-alpine3.24 node registry-cleanup/cleanup.ts
@@ -21,7 +21,7 @@ jobs:
          GIT_TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
-          docker run --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
+          docker run --rm -v "$PWD:/repo" -w /repo node:24.20.0-alpine3.24 \
            node release-tooling/contract-version.ts "$GIT_TAG" src/plugin-host/plugin.ts
      - name: Promote the commit-hash image to semver + latest
        env:
@@ -98,9 +98,9 @@ jobs:
          VERSION=${INPUT_VERSION:-${GIT_TAG#v}}
          VERSION=${VERSION#v}
          # An empty dispatch input falls back to the branch name, so gate this like a tag.
-          docker run --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
+          docker run --rm -v "$PWD:/repo" -w /repo node:24.20.0-alpine3.24 \
            node release-tooling/contract-version.ts "$VERSION" src/plugin-host/plugin.ts
          docker run --rm -v "$PWD:/repo" -w /repo \
            -e DOCKERHUB_REPO -e DOCKERHUB_TOKEN -e DOCKERHUB_USER \
-            node:24.19.0-alpine3.24 \
+            node:24.20.0-alpine3.24 \
            node release-tooling/dockerhub-overview.ts "$VERSION"
@@ -21,7 +21,7 @@ jobs:
            -e RENOVATE_PLATFORM=gitea \
            -e RENOVATE_REPOSITORIES=${{ github.repository }} \
            -e RENOVATE_TOKEN \
-            renovate/renovate:44.39.2
+            renovate/renovate:44.61.6

  # After the renovate job, cut ONE tag covering the renovate-bot commits merged to main since the
  # last tag (batch per run). Targets origin/main — the real post-merge tip; the checkout SHA is the
@@ -58,11 +58,11 @@ jobs:
          if [ -z "$BUMPS" ]; then
            echo "Renovate commits since ${LATEST}, but none carry Release-Bump — nothing reached a running Plainpages; skipping"; exit 0
          fi
-          NEXT=$(docker run --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
+          NEXT=$(docker run --rm -v "$PWD:/repo" -w /repo node:24.20.0-alpine3.24 \
                 node release-tooling/next-version.ts "$LATEST" $BUMPS)
          # Read the constant off origin/main, not the checkout, which lags the merges this run made.
          git show origin/main:src/plugin-host/plugin.ts \
-            | docker run -i --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
+            | docker run -i --rm -v "$PWD:/repo" -w /repo node:24.20.0-alpine3.24 \
                     node release-tooling/contract-version.ts "$NEXT" -
          echo "Releasing $LATEST -> $NEXT"
          git tag "$NEXT" origin/main
@@ -36,6 +36,15 @@ branch, create a PR and merge it when the CI/CD turns green.
 ## Project priorities (do not erode)

 1. **Simplicity** — prefer the solution that is easiest to understand, smallest, and most readable.
+   **A page is a document**: it scrolls, and the chrome scrolls with it. Nothing may bound the
+   viewport to hold content still — no `height: 100dvh` frame, no `overflow: hidden` on `body`, no
+   `position: sticky` header. Each such box buys an app-like look with CSS the next reader has to
+   reverse-engineer, and is one more thing to undo before the content under it can be reached.
+   Overlays are not this: the skip link, the mobile off-canvas nav and its scrim sit *above* the
+   document rather than holding it still, and have no other spelling — the document keeps scrolling
+   behind the open nav, accepted rather than overlooked. Only the document scroller gets keyboard
+   paging unconditionally and back/forward scroll restoration, and a page a box clips fails silently:
+   nothing in a test or a console says content is unreachable below the fold.
 2. **Few dependencies** — runtime deps stay minimal (today `ejs`, `lucide-static`, `@larvit/log`,
   `postgres`). Prefer the Node standard library; justify any new dependency; do not add frameworks.
   The **host is stateless — it owns no schema and stores nothing of its own**; a plugin may own a
@@ -182,6 +191,22 @@ Revisit only if the stated reason stops holding.
    example it keeps the route table and the in-handler guard deriving from one function, so 29 routes
    × 2 gate sites cannot drift. Generalised, it would make authorization a function of the transport
    verb — a route table must answer "what does this need?" on its own.
+- **A gate is one of three, named exactly once, and `session` is a first-class one.** A route or nav
+  node names exactly one of `public`, `session`, `permission` — discovery refuses none, two, and a
+  flag spelled anything but `true`, so a forgotten gate fails the boot rather than publishing a page.
+  `src/auth/gate.ts` is the one home of the rule the plugin router, the host's own route table and
+  the menu all read. Exactly-one-gate is a discovery-time rule on manifests, not a runtime
+  invariant: `allows({}, user)` stays open **by design**, because the central override's `groups`
+  builds header nodes that carry no gate. Making `allows` fail closed would hide every
+  operator-grouped section. `session` exists because a plugin whose data is
+  the visitor's own — their upstream account, their own tokens — has no distinction a permission could
+  name; the alternative, granting every newly registered user a permission, couples the identity
+  lifecycle to a Keto write that nothing retries when it fails. A page scoped to "mine" joins on
+  `ctx.user.id`, never the email — an address is user-changeable and can be reassigned to someone
+  who would then inherit the previous holder's rows.
+- **The reference plugin's two shift pages duplicate a view model and markup on purpose.** An example
+  is read far more often than it is changed, and each page reads top to bottom on its own. **Valid
+  while `examples/plugins/scheduling` stays a teaching artifact rather than a maintained product.**
 - **A `:read`-only holder must never be shown a write affordance.** The list/detail models carry
  `canWrite` and the views drop create/save/delete/add/remove; the permission picker still renders,
  disabled, because *seeing* who holds what is the point of `:read`. A **write-intent GET** (a create
@@ -254,11 +279,18 @@ Revisit only if the stated reason stops holding.
  open-state style and the old-browser fallback both read; the partial **requires a caller-named
  `id`** and fails loud without one, since that is the `popovertarget` idref (never generate one —
  nondeterministic HTML forecloses the caching decision); and **neither `aria-expanded` nor
-  `aria-haspopup` is written**, because a zero-JS invoker cannot keep the first truthful and the
-  second would promise `role="menu"` semantics these panels don't implement. `<details>` stays where
+  `aria-haspopup` is written**: every engine maintains the first itself on a declarative
+  `popovertarget` invoker, so a hand-written one replaces a live state with a static lie, and the
+  second would promise `role="menu"` semantics these panels don't implement. **That guarantee is the
+  declarative attribute's alone** — open a panel from script and no engine applies it, so
+  "enhancing" one of these triggers is what would cost it its accessibility. `<details>` stays where
  it means disclosure rather than popup: the nav tree. `shell.ejs` hand-rolls the same block for the
  profile menu (its trigger composes escaped user values and its one item is a CSRF POST form) — keep
  the two in step.
+- **One scroller, the document** (priority 1). `.app` is `min-height: 100dvh`. `.nav`'s
+  `overflow-y: auto` and `.side-footer`'s `flex: 0 0 auto` are not leftovers of a bounded frame:
+  they are what makes the off-canvas panel usable with a long tree. `#nav-toggle` is `position: fixed` —
+  a label click focuses it, and a browser scrolls a focused element into view.
 - **`ICON_NAMES` (`src/ui/icons.ts`) is a host-owned registry, not a frozen plugin contract**, so it
  is deliberately not re-exported from `@plainpages/plugin-api`. The palette may narrow when the last reference
  to an id goes, and a plugin needing one gets it re-registered in the same change. Accepted cost: an
@@ -0,0 +1,88 @@
+# Changelog
+
+The release version **is** the plugin contract version (`HOST_API_VERSION`), so a minor is a
+contract break: a plugin's `apiVersion` must match the host's `major.minor` or discovery refuses it
+at boot. Entries start at 0.3.0.
+
+## 0.4.0
+
+**Breaking.** Set `apiVersion: "0.4.0"`. The app shell no longer bounds the content column, so a page
+that relied on filling it scrolls the document instead.
+
+### The document scrolls, and the chrome scrolls with it
+
+`.app` was a `100dvh` box with `overflow: hidden`, so a page was only reachable below the fold if its
+own wrapper was a flex child with `overflow-y: auto`. `.table-wrap` and `.shell-auth` were; nothing
+else was, and a long page in `.form-page` clipped everything past the window in every engine.
+
+Now the shell is `min-height: 100dvh` and nothing bounds the viewport. The sidebar and topbar scroll
+with the page, and keyboard paging, back/forward scroll restoration and find-in-page work without a
+page doing anything.
+
+The sticky `thead` on `data-table` goes with it: a header only sticks to a scrollport that moves, and
+there is no longer one. A plugin that wants a full-height pane owns that in its own stylesheet; the
+shell offers no opt-out, per the simplicity priority in `AGENTS.md`.
+
+### Upgrading a plugin
+
+1. Set `apiVersion: "0.4.0"`.
+2. A page that scrolled the whole window needs no change — it now scrolls the document.
+3. A page holding a region that filled the content column (`flex: 1 1 auto; min-height: 0` with its
+   own `overflow`) no longer gets a bounded column to fill, so that region grows and the page scrolls.
+   Either let it, or give the region its own height in the plugin's stylesheet.
+4. A `data-table` no longer scrolls its rows in a bounded region: the page scrolls, and the header
+   scrolls with it.
+
+The sidebar stretches the whole document, so on a long page its footer — theme, language, profile and
+**Sign out** — sits at the end of that page rather than the bottom of the screen.
+
+## 0.3.0
+
+**Breaking.** Set `apiVersion: "0.3.0"`, and name a gate on every route and nav node.
+
+### A session is a gate of its own
+
+`session: true` takes any signed-in user, with no grant to hold — for a page whose data is the
+visitor's own (their upstream account, their own tokens), where there is no distinction a permission
+could name. An anonymous visitor is bounced to `/login` with the page as `return_to`, exactly as a
+permission gate does.
+
+Every route and nav node now names **exactly one** of `public: true`, `session: true` or
+`permission: "<resource>:<action>"`, and a gate is spelled `true`:
+
+- Naming **none** is refused. It used to mean public, so a forgotten gate published a page; it now
+  fails the boot instead.
+- Naming **two** is refused, as before.
+- Spelling one anything but `true` is refused — `public: false` and `session: "yes"` both set no gate
+  while reading as if they set one.
+
+A section header gates nothing itself, so it takes `public: true` and lets each child decide; the
+host still drops a header whose children all filtered out.
+
+`Gate` is exported from `@plainpages/plugin-api`, and `Route` and `NavNode` extend it.
+
+### Filter bars take a multi-select
+
+The `filter-bar` partial gains a `multiselect` control — the same checkboxes on the same query
+parameter as `chips`, but behind a button once the list is too long to lay on the bar. Config is
+`{ name, legend?, note?, value?, options }`, and the panel says what a capped list left out.
+
+### Fixed
+
+- An identity carrying no email no longer yields a session at all. Login used to mint a JWT for one,
+  which every later request then rejected as anonymous — leaving the browser holding a dead cookie
+  and no way to tell why.
+
+### Dependencies
+
+- Node 24.20.0.
+
+### Upgrading a plugin
+
+1. Set `apiVersion: "0.3.0"`.
+2. Give every route and nav node a gate. Anything that relied on omitting one was public — say
+   `public: true` outright.
+
+A page that scopes rows to the signed-in visitor should join on `ctx.user.id`. An email address is
+user-changeable and can be reassigned to someone else, who would then inherit the previous holder's
+rows. The reference plugin's new `/scheduling/mine` page shows the shape.
@@ -1,5 +1,5 @@
 # Node 24 runs TypeScript directly (type stripping) — no build step. Pinned exact tag.
-FROM node:24.19.0-alpine3.24
+FROM node:24.20.0-alpine3.24

 # Above WORKDIR so dev's `.:/app` bind mount can't shadow them; a volume at /app/node_modules
 # instead leaves a root-owned dir in the checkout (the daemon creates mount destinations as root).
@@ -47,7 +47,7 @@ folder under `plugins/` goes live after a restart. Create `plugins/hello/plugin.
 import { definePlugin } from "@plainpages/plugin-api";

 export default definePlugin({
-  apiVersion: "0.2.0",
+  apiVersion: "0.4.0",
  nav: [{ href: "/hello", id: "hello", label: "Hello", public: true }],
  routes: [
    { method: "GET", path: "/", public: true, handler: () => ({ html: "<h1>Hello from my plugin</h1>" }) },
@@ -231,6 +231,7 @@ Against the reference plugins' actual routes:
 | Request | Gate | alice | bob | carol | anonymous |
 | --- | --- | --- | --- | --- | --- |
 | `GET /scheduling` | `public: true` | ✅ | ✅ | ✅ | ✅ |
+| `GET /scheduling/mine` | `session: true` | ✅ | ✅ | ✅ | → `/login` |
 | `GET /scheduling/shifts` | `scheduling:read` | ✅ | ✅ | 403 | → `/login` |
 | `GET /scheduling/shifts/new` | `scheduling:write` | ✅ | 403 | 403 | → `/login` |
 | `POST /scheduling/shifts` | `scheduling:write` | ✅ | 403 | 403 | → `/login` |
@@ -349,9 +350,9 @@ import { definePlugin } from "@plainpages/plugin-api";
 import { listThings, createThings } from "./handlers.ts";

 export default definePlugin({
-  apiVersion: "0.2.0",                // semver string of the host contract this plugin was built against (see Versioning)
+  apiVersion: "0.4.0",                // semver string of the host contract this plugin was built against (see Versioning)

-  // Nav fragment, merged into the global menu and permission-filtered per user.
+  // Nav fragment, merged into the global menu and gate-filtered per user.
  // `icon` is a Lucide icon by its sprite id (src/ui/icons.ts).
  nav: [{ href: "/things", icon: "i-cal", id: "things:list", label: "Things", permission: "things:read" }],

@@ -361,7 +362,7 @@ export default definePlugin({
    { description: "Create and edit things", name: "things:write" },
  ],

-  // Route handlers, mounted under the plugin's path (/things). `permission` gates first.
+  // Route handlers, mounted under the plugin's path (/things). The gate runs first.
  routes: [
    { method: "GET",  path: "/", permission: "things:read",  handler: listThings },
    { method: "POST", path: "/", permission: "things:write", handler: createThings },
@@ -378,7 +379,7 @@ folder-derived `id` to produce the loaded `Plugin`.
 | `apiVersion` | yes | Semver string of the host contract the plugin was built against. See [Versioning](#contract-versioning). |
 | `home` | no | A `RouteHandler` that owns the **public** landing `/`. At most one plugin may declare it. See [The landing pages](#the-landing-pages-home--dashboard). |
 | `dashboard` | no | A `RouteHandler` that owns the **gated** app home `/dashboard`. At most one plugin may declare it. See [The landing pages](#the-landing-pages-home--dashboard). |
-| `nav` | no | `NavNode[]` fragment (same shape `composeNav` consumes). `icon` is a Lucide sprite id (`src/ui/icons.ts`); node `id`s must be globally unique. A `label` that names a catalog key is [translated](#languages-i18n); anything else renders as written. |
+| `nav` | no | `NavNode[]` fragment (same shape `composeNav` consumes). Every node names [exactly one gate](#public-pages--menu-items). `icon` is a Lucide sprite id (`src/ui/icons.ts`); node `id`s must be globally unique. A `label` that names a catalog key is [translated](#languages-i18n); anything else renders as written. |
 | `permissions` | no | Permissions this plugin gates on. See [Nav & permission gates](#nav--permission-gates). |
 | `routes` | no | See [Routes & handlers](#routes--handlers). |
 | `hooks` | no | See [Hooks](#hooks). |
@@ -389,13 +390,13 @@ A plugin may be routes-only, nav-only, or hooks-only — every collection field

 ### Routes & handlers

-A route is `{ method, path, permission?, public?, handler }`. `path` is **relative to the plugin's
+A route is `{ method, path, handler }` plus [exactly one gate](#public-pages--menu-items) —
+`permission`, `public: true` or `session: true`. `path` is **relative to the plugin's
 mount path `/<id>`** (so `path: "/:id"` in the `things` plugin serves `/things/:id`); the host matches
 `method` + the resolved full path, extracts `:name` segments into `ctx.params.name`, runs the
-`permission` gate ([a coarse JWT-claim check](#nav--permission-gates)), then calls the handler with
+gate ([a coarse JWT-claim check](#nav--permission-gates)), then calls the handler with
 the [request context](#requestcontext). A failed gate redirects an **anonymous** visitor to `/login`
 with the page as `return_to`; a **signed-in** user lacking the permission gets the **403** page.
-`public: true` means no gate at all (see [Public pages](#public-pages--menu-items)).

 `method` is one of `GET HEAD POST PUT PATCH DELETE`. A `GET` route also answers `HEAD`.

@@ -470,7 +471,7 @@ import { definePlugin } from "@plainpages/plugin-api";
 import { landing, board } from "./pages.ts";

 export default definePlugin({
-  apiVersion: "0.2.0",
+  apiVersion: "0.4.0",
  home: landing,     // owns "/" — the public front page
  dashboard: board,  // owns "/dashboard" — the post-login app home
 });
@@ -569,20 +570,28 @@ system plugins you author or vendor. An ordinary domain plugin ignores it.

 A plugin's `nav` fragment is merged into the global menu by `composeNav` (`src/ui/nav.ts`), which
 applies the central override and then **filters per user** by the permissions in the session JWT: a
-node shows iff it is `public`, declares no `permission`, or the user holds that name. A node's `icon`
-is a **Lucide icon** by sprite id (e.g. `i-cal` → lucide `calendar`); the available ids are
-`ICON_NAMES` in `src/ui/icons.ts`, and adding one means registering its lucide name there.
+node shows iff it is `public`, is `session` and someone is signed in, or names a `permission` the
+user holds. A node's `icon` is a **Lucide icon** by sprite id (e.g. `i-cal` → lucide `calendar`); the
+available ids are `ICON_NAMES` in `src/ui/icons.ts`, and adding one means registering its lucide name
+there.

 **Gating a section header.** A `permission` on the header takes the whole subtree with it. When the
-children need *different* permissions, leave the header ungated and gate each child — `composeNav`
-drops a header whose children all filtered out. That only works while the header carries **no
-`href`**: give it one and it survives as an ungated leaf, visible to everyone.
+children need *different* permissions, mark the header `public: true` — it then gates nothing, each
+child decides, and `composeNav` drops a header whose children all filtered out. That only works while
+the header carries **no `href`**: give it one and it survives as a leaf, visible to everyone.

 #### Public pages & menu items

-A route or nav node marked **`public: true`** is reachable by anyone and shows in everyone's menu.
-That is the same as omitting `permission`, but stated outright so public is a deliberate choice
-rather than a forgotten gate. The two are **mutually exclusive** — declaring both is refused at boot.
+A route or nav node marked **`public: true`** is reachable by anyone and shows in everyone's menu —
+open stated outright, so it is a deliberate choice rather than a forgotten gate.
+
+**`session: true`** takes any signed-in user, with no grant to hold — for a plugin whose data is the
+visitor's own. An anonymous visitor is bounced to `/login` with the page as `return_to`, exactly as a
+permission gate does.
+
+Every route and nav node names **exactly one** of the three, spelled `true` (or a permission name).
+Naming none, naming two, or spelling one `false` is refused at boot — so a forgotten gate fails the
+plugin instead of publishing a page.

 A public page still renders in the native shell; for an anonymous visitor `ctx.user` is `null`, the
 shell shows a **Sign in** link in place of the profile block, the gated **Dashboard** link is hidden,
@@ -617,6 +626,7 @@ provider/consumer semantics in `checkApiVersion`:
 The plugin pins one exact version (no ranges, per the project's pinning rules); the *host* supplies
 the compatibility. One digit carries the whole release, so a **minor** means either the plugin
 contract changed or a dependency moved far enough to warrant one.
+[`CHANGELOG.md`](CHANGELOG.md) is what a minor sends you to: what broke, and what to change.


 ### Conflict rules
@@ -635,7 +645,7 @@ The host detects collisions across all discovered plugins with `findConflicts` a
 Mount-path uniqueness needs no rule of its own — it follows from the id check. Discovery also
 rejects **per-manifest shape errors**: a non-array `nav`/`routes`/`permissions`, a non-function
 `home`/`dashboard`, a permission name that isn't [`<resource>:<action>`](#naming-a-permission), or a
-route/nav node setting both `public` and `permission`.
+route/nav node that does not name [exactly one gate](#public-pages--menu-items).

 ### Hooks

@@ -747,7 +757,7 @@ camel humps both becoming underscores — so `upstream` on the `scheduling` plug

 ```ts
 export default definePlugin({
-  apiVersion: "0.2.0",
+  apiVersion: "0.4.0",
  settings: [
    { key: "upstream", type: "url", required: true, description: "Base URL of the backend" },
    { key: "pageSize", type: "number", default: 25 },
@@ -801,7 +811,7 @@ import { definePlugin } from "@plainpages/plugin-api";
 let sql: ReturnType<typeof postgres>;

 export default definePlugin({
-  apiVersion: "0.2.0",
+  apiVersion: "0.4.0",
  storage: true,
  hooks: {
    onBoot: async (boot) => {
@@ -911,9 +921,10 @@ The menu is **driven entirely by config** and assembled from two sources:
   export default defineMenu({ branding: { name: "Acme Ops" }, override: { hide: ["teams"] } });
   ```

-Every nav item may carry a `permission`; the rendered tree is **filtered per user** from the session
-JWT (no per-request authz call), so the menu only shows what that person can reach. An item may
-instead be **`public: true`** to show it to everyone — mutually exclusive with `permission`.
+Every nav node a **plugin** declares names one gate — a `permission`, **`public: true`** (everyone)
+or **`session: true`** (anyone signed in); a header this override groups takes none, and shows
+whenever a child does. The rendered tree is **filtered per user** from the session JWT (no
+per-request authz call), so the menu only shows what that person can reach.
 Branding (name, logo, default theme) renders in the app shell.

 **One menu, one shell, everywhere.** A single menu (`src/ui/chrome.ts` `buildPluginChrome`) renders
@@ -922,6 +933,11 @@ recovery / front pages — so it looks identical signed in or out and just shows
 anonymous visitor. The sidebar collapses to a burger on a narrow screen; a page wanting a
 chrome-free layout opts out with the shell's `menu: false`.

+**The document scrolls, and the chrome scrolls with it.** Nothing bounds the viewport, so a page is
+reachable below the fold without adding a scroll region of its own, and browser paging, scroll
+restoration and find-in-page work without a page doing anything. A plugin that wants a full-height
+pane owns that in its own stylesheet.
+
 ## Building blocks

 Plainpages is a **component library, not a page generator** — reusable EJS partials + TS helpers,
@@ -1720,6 +1736,7 @@ e2e-tests/           Playwright specs + their Dockerfile and compose.{visual,aut
 release-tooling/     Everything the release runs: next-version (the bump math), contract-version
                     (the HOST_API_VERSION↔tag gate), dockerhub-overview (+ its .md.tmpl)
 registry-cleanup/    Nightly image pruning — the Gitea client plus what survives (select-versions.ts)
+CHANGELOG.md         What changed per release, and how to upgrade a plugin across a minor
 ci.sh                The full gate: typecheck → unit tests → every E2E suite on a fresh stack
 .gitea/workflows/    Gitea Actions — see CI/CD
 ```
@@ -49,7 +49,7 @@ services:
  # backs it (PLUGIN_SETTING_SCHEDULING_UPSTREAM above points here). Stand-in for the customer's real service —
  # stdlib-only, in-memory, no auth. Prod points PLUGIN_SETTING_SCHEDULING_UPSTREAM at the real backend instead.
  shifts-upstream:
-    image: node:24.19.0-alpine3.24
+    image: node:24.20.0-alpine3.24
    command: node /srv/server.ts
    restart: unless-stopped
    volumes:
@@ -58,7 +58,7 @@ services:
  # Dev mail catcher — Kratos recovery/verification emails land here (web UI on 8025).
  # kratos.yml points the courier at smtp://mailpit:1025; prod uses a real SMTP via env.
  mailpit:
-    image: axllent/mailpit:v1.31.0
+    image: axllent/mailpit:v1.31.1
    ports:
      - "8025:8025"
    restart: unless-stopped
@@ -1,6 +1,6 @@
 # Playwright runner — browsers preinstalled, pinned to match @playwright/test in e2e-tests/.
 # Built/run via e2e-tests/compose.visual.yml; targets the `web` service over the network.
-FROM mcr.microsoft.com/playwright:v1.62.1-noble
+FROM mcr.microsoft.com/playwright:v1.63.0-noble

 WORKDIR /e2e-tests

@@ -53,7 +53,7 @@ services:

  # The reference plugin's upstream (examples/shifts-upstream) so /scheduling/shifts shows real rows.
  shifts-upstream:
-    image: node:24.19.0-alpine3.24
+    image: node:24.20.0-alpine3.24
    command: ["node", "/server.ts"]
    volumes:
      - ./examples/shifts-upstream/server.ts:/server.ts:ro
@@ -66,7 +66,7 @@ services:
  # Mock OIDC provider for the SSO login test — stdlib Node, auto-approves, signs an id_token Kratos
  # verifies via its jwks. Reachable as the same host (mock-oidc:9000) by both the browser and Kratos.
  mock-oidc:
-    image: node:24.19.0-alpine3.24
+    image: node:24.20.0-alpine3.24
    command: ["node", "/mock-oidc.ts"]
    environment:
      ISSUER: http://mock-oidc:9000
@@ -81,7 +81,7 @@ services:

  # Same-origin gateway: Kratos-owned paths → kratos, everything else → web (e2e-tests/proxy.ts).
  proxy:
-    image: node:24.19.0-alpine3.24
+    image: node:24.20.0-alpine3.24
    command: ["node", "/proxy.ts"]
    depends_on:
      web:
@@ -193,6 +193,12 @@ test.describe.serial("authenticated admin journey", () => {
    await page.goto("/scheduling/shifts");
    await expect(page.locator("h1")).toHaveText("Shifts");
    await expect(page.locator("table")).toContainText("Morning — Front desk"); // seeded by the mock upstream
+
+    // The admin owns none of the demo's rows, so an empty page is the no-leak assertion.
+    await page.goto("/scheduling/mine");
+    await expect(page.locator("h1")).toHaveText("My shifts");
+    await expect(page.getByText("No shifts are assigned to admin@plainpages.local")).toBeVisible();
+    await expect(page.locator("table")).not.toContainText("Morning — Front desk");
  });

  test("plugin settings: the screen names the variable that sets each declared key", async () => {
@@ -6,17 +6,17 @@
    "": {
      "name": "plainpages-e2e",
      "devDependencies": {
-        "@playwright/test": "1.62.1"
+        "@playwright/test": "1.63.0"
      }
    },
    "node_modules/@playwright/test": {
-      "version": "1.62.1",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.62.1.tgz",
-      "integrity": "sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ==",
+      "version": "1.63.0",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.63.0.tgz",
+      "integrity": "sha512-oxMK4vllB9RK5NQ2l1pq1IfOf2AvnEuj/vYGDj0H2nMtmtZpKtCwt/l00GEO6xjGfpBNAvjovvYdCm50dRQkpQ==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
-        "playwright": "1.62.1"
+        "playwright": "1.63.0"
      },
      "bin": {
        "playwright": "cli.js"
@@ -25,44 +25,26 @@
        "node": ">=20"
      }
    },
-    "node_modules/fsevents": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
-      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
    "node_modules/playwright": {
-      "version": "1.62.1",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.62.1.tgz",
-      "integrity": "sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg==",
+      "version": "1.63.0",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.63.0.tgz",
+      "integrity": "sha512-+7ziBLidS4NaNCdt57SUDT+wYmmd5fmiQejUic/kb+YsYSCPyOOE9sebzMjNmQrsnNpDJqd4WHvV/8lfKfUDUg==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
-        "playwright-core": "1.62.1"
+        "playwright-core": "1.63.0"
      },
      "bin": {
        "playwright": "cli.js"
      },
      "engines": {
        "node": ">=20"
-      },
-      "optionalDependencies": {
-        "fsevents": "2.3.2"
      }
    },
    "node_modules/playwright-core": {
-      "version": "1.62.1",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.62.1.tgz",
-      "integrity": "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==",
+      "version": "1.63.0",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.63.0.tgz",
+      "integrity": "sha512-rYCsBF/M5HjUch52bbtVONEFjv6Xu8sm8h72dNlR5bzIE1fvC/bxgspzkjSfU+MweEMmPM8KJebG6nnyxo5mCg==",
      "dev": true,
      "license": "Apache-2.0",
      "bin": {
@@ -7,6 +7,6 @@
    "test": "playwright test"
  },
  "devDependencies": {
-    "@playwright/test": "1.62.1"
+    "@playwright/test": "1.63.0"
  }
 }
@@ -28,6 +28,45 @@ test.beforeEach(async ({ context }) => {
  await context.addCookies([{ name: SESSION_COOKIE, url: BASE_URL, value: devSession() }]);
 });

+// A key press, not scrollIntoView (a script can scroll a box no reader can) and not the wheel
+// (Firefox's synthetic event never reaches the document).
+for (const [name, path, tail] of [
+  ["the starter dashboard", "/dashboard", ".form-actions .btn"],
+  ["the public landing", "/", ".landing-actions .btn"],
+] as const) {
+  for (const width of [1280, 390]) {
+    test(`${name} scrolls to its end at ${width}px wide`, async ({ page }) => {
+      await page.setViewportSize({ width, height: 200 });
+      await page.goto(path);
+
+      const overflows = await page.evaluate(() => document.documentElement.scrollHeight > window.innerHeight);
+      expect(overflows, "the page must overflow, or it proves nothing").toBe(true);
+      await page.keyboard.press("End");
+      await expect(page.locator(tail).last()).toBeInViewport({ ratio: 1 });
+    });
+  }
+}
+
+// Green only while #nav-toggle is position: fixed — a label tap focuses it, and focus scrolls into view.
+test("closing the mobile drawer leaves the reader where the scrim found them", async ({ page }) => {
+  await page.setViewportSize({ width: 390, height: 200 });
+  await page.goto("/dashboard");
+
+  await page.locator(".hamburger").click();
+  await expect(page.locator("#nav-toggle")).toBeChecked();
+  // Scripted, because a key press with focus on the toggle does not scroll in every engine — and
+  // what is under test is closing the drawer, not how the reader got down the page.
+  await page.evaluate(() => window.scrollTo(0, 120));
+  const at = await page.evaluate(() => window.scrollY);
+  expect(at, "the page must have somewhere to scroll behind the scrim").toBeGreaterThan(0);
+
+  // The exposed strip beside the 264px panel: the scrim spans the viewport, so its centre is under
+  // the drawer and a centre click lands on the panel instead.
+  await page.locator(".scrim").click({ position: { x: 340, y: 100 } });
+  await expect(page.locator("#nav-toggle")).not.toBeChecked();
+  expect(await page.evaluate(() => window.scrollY), "closing the drawer must not move the page").toBe(at);
+});
+
 test("captures the live pages for review", async ({ page }) => {
  await page.goto("/dashboard");
  await expect(page.locator(".sidebar")).toBeVisible();
@@ -94,6 +133,7 @@ test("a popover menu sits on its trigger and closes on an outside click or Esc
  await expect(panel).toBeVisible();
  await page.keyboard.press("Escape");
  await expect(panel).toBeHidden();
+  await expect(trigger).toBeFocused(); // the browser returns focus, so no trigger needs a tabindex
 });

 test("mobile layout hides the sidebar off-canvas behind the hamburger", async ({ page }) => {
@@ -142,11 +182,11 @@ test("unknown routes serve the 404 page (a real user-facing flow, covered end-to
  await expect(page.getByRole("link", { name: "Back home" })).toBeVisible();
 });

-// The reference plugin (plugins/scheduling) ships discovered in the image. Its public Overview is
-// reachable by anyone and its menu header shows for everyone; the shifts list stays permission-gated,
-// so an anonymous visitor is bounced to sign in. The authenticated list/form flow is the full
-// E2E (full-flow.spec). Side-effect-free.
-test("the reference plugin: public Overview is open to all, the gated Shifts redirects to /login", async ({ page, request }) => {
+// The reference plugin (plugins/scheduling) ships discovered in the image, and shows all three
+// gates: the public Overview is reachable by anyone, My shifts takes any session, and the shifts
+// list needs a permission. The authenticated list/form flow is the full E2E (full-flow.spec).
+// Side-effect-free.
+test("the reference plugin: public Overview is open to all, My shifts takes any session, the gated Shifts redirects to /login", async ({ page, request }) => {
  // `request` is the isolated API context — it doesn't carry the beforeEach session cookie, so these
  // probes are genuinely anonymous.
  // The public overview is reachable with no session (200), not bounced to sign in.
@@ -165,10 +205,23 @@ test("the reference plugin: public Overview is open to all, the gated Shifts red
  expect(res.status()).toBe(303);
  expect(res.headers()["location"]).toBe("/login?return_to=%2Fscheduling%2Fshifts");

+  // A `session: true` route bounces an anonymous visitor the same way — no permission involved.
+  const mine = await request.get("/scheduling/mine", { maxRedirects: 0 });
+  expect(mine.status()).toBe(303);
+  expect(mine.headers()["location"]).toBe("/login?return_to=%2Fscheduling%2Fmine");
+
  // The signed-in member (no scheduling permission) sees the public Scheduling → Overview leaf in the nav,
  // but the gated Shifts leaf is filtered out.
  await page.goto("/dashboard");
  await expect(page.locator('.sidebar a[href="/dashboard"]')).toHaveCount(1); // the one unified menu renders
  await expect(page.locator('.sidebar a[href="/scheduling"]')).toHaveCount(1); // public Overview shown
  await expect(page.locator('.sidebar a[href="/scheduling/shifts"]')).toHaveCount(0); // gated leaf filtered out
+  await expect(page.locator('.sidebar a[href="/scheduling/mine"]')).toHaveCount(1); // session gate: a session is enough
+
+  // No shifts upstream on this stack, so this also pins the degraded page: the reason, never a 500
+  // and never a claim about what is assigned.
+  await page.goto("/scheduling/mine");
+  await expect(page.getByRole("heading", { name: "My shifts" })).toBeVisible();
+  await expect(page.getByText("Couldn't reach the scheduling service")).toBeVisible();
+  await expect(page.getByText("No shifts are assigned to")).toHaveCount(0);
 });
@@ -35,10 +35,9 @@ export function actionForMethod(method: string): AdminAction {
  return verb === "GET" || verb === "HEAD" ? "read" : "write";
 }

-// The plugin's nav fragment: an ungated "Admin" header + its three screens, each gated on its own
-// read permission. The header carries no `permission` because a user may hold one screen's and not
-// another's; composeNav drops a header left with no visible children, so a user holding none of the
-// three never sees the section. The host current-marks the active item — no `current`/`open` here.
+// The plugin's nav fragment: the "Admin" header + its four screens, each gated on its own read
+// permission. composeNav drops a header left with no visible children, so a user holding none of
+// them never sees the section. The host current-marks the active item — no `current`/`open` here.
 export const ADMIN_NAV: NavNode = {
  children: [
    { href: ADMIN_USERS_BASE, icon: "i-users", id: "users", label: "admin.nav.users", permission: permissionName("users", "read") },
@@ -49,6 +48,7 @@ export const ADMIN_NAV: NavNode = {
  icon: "i-shield",
  id: "admin",
  label: "admin.nav.section", // a key in this plugin's catalog; the host translates nav labels
+  public: true, // the header gates nothing; every child needs a permission, and an empty header is dropped
 };

 // The screen gate: a signed-in user holding this request's `<resource>:<action>`. Each route already
@@ -28,7 +28,7 @@ const clients = on("oauth2-clients");
 const pluginSettings = on("plugin-settings");

 export default definePlugin({
-  apiVersion: "0.2.0", // the host contract this was built against — a literal, never HOST_API_VERSION
+  apiVersion: "0.4.0", // the host contract this was built against — a literal, never HOST_API_VERSION

  nav: [ADMIN_NAV],

@@ -15,8 +15,12 @@ What it demonstrates:
  `POST /scheduling/shifts` CSRF-verifies it (`ctx.verifyCsrf`) and forwards the create upstream,
  then POST-redirect-GET. The form body lives in the plugin's own `views/partials/shift-form.ejs`,
  reusing the core `field` partial.
- **Permission-gated nav** — the "Shifts" nav leaf and routes are gated on `scheduling:read` /
-  `scheduling:write`; the whole "Scheduling" section is invisible to anyone without the grant.
+- **All three route gates** — the Overview is `public` (anyone), "My shifts" is `session` (any
+  signed-in visitor, showing only rows assigned to them), and "Shifts" is gated on `scheduling:read` /
+  `scheduling:write`; a leaf whose gate a visitor fails is invisible in the menu.
+- **Ownership joined on the identity id** — "My shifts" asks the upstream for `assigneeId=ctx.user.id`,
+  the opaque subject id, and renders the row's separate `assignee` display name. An email address is
+  user-changeable and can be reassigned to someone else, who would then inherit those rows.
 - **Its own translations** — every string comes from `i18n/en-US.ts` (`sv-SE.ts` beside it), including
  the nav labels, which are catalog keys in the manifest. `shifts.count` shows a plural message, and
  the views carry the visitor's language onto their links with `localeHref()`.
@@ -38,9 +42,14 @@ Your backend must expose two routes; the plugin treats any non-2xx as a recovera

 | Route | Request | Success | Response body |
 | --- | --- | --- | --- |
-| `GET /shifts` | `Accept: application/json` | `200` | JSON array of `{ id, title, assignee, start, end }` (all strings; missing fields coerce to `""`) |
+| `GET /shifts` | `Accept: application/json`, optional `?assigneeId=<id>` | `200` | JSON array of `{ id, title, assignee, assigneeId, start, end }` (all strings; missing fields coerce to `""`). With `assigneeId`, only that person's rows |
 | `POST /shifts` | JSON body `{ title, assignee, start, end }` | `2xx` | ignored (the plugin POST-redirect-GETs back to the list) |

+`POST /shifts` carries the assignee as a **display name only**, so a shift created through this
+plugin's form belongs to nobody and surfaces on no one's "My shifts" — don't go hunting for it
+there. Resolving a name to an identity id needs a directory this demo has none of; a real backend
+does that join at create time and stores the `assigneeId` alongside the name.
+
 Domain rules (overlap, capacity, time ordering) live in your backend — reject with a 4xx and the
 form re-renders. The plugin only validates that `title` and `assignee` are non-empty.

@@ -50,6 +59,8 @@ cosmetically) — normalise to your backend's format there if it matters.

 ## Granting access

-A user sees Scheduling once they hold the `scheduling:read` permission in Keto (and `scheduling:write`
-to create). The one-command bootstrap grants both to the demo admin, so the seeded
-`admin@plainpages.local` can use it immediately.
+A user sees the shift list once they hold the `scheduling:read` permission in Keto (and
+`scheduling:write` to create). The one-command bootstrap grants both to the demo admin, so the seeded
+`admin@plainpages.local` can use it immediately. "My shifts" needs no grant at all — signing in is
+its whole gate; it lists the rows this demo upstream holds against the signed-in visitor's id, and
+the demo's seeded rows belong to three made-up people, so a freshly seeded admin sees it empty.
@@ -13,12 +13,16 @@ const messages = {
  "scheduling.filter.searchLabel": "Search shifts",
  "scheduling.filter.searchPlaceholder": "Search title or assignee…",
  "scheduling.form.submit": "Create shift",
+  "scheduling.mine.empty": "No shifts are assigned to {{email}}.",
+  "scheduling.mine.title": "My shifts",
+  "scheduling.nav.mine": "My shifts",
  "scheduling.nav.overview": "Overview",
  "scheduling.nav.section": "Scheduling",
  "scheduling.nav.shifts": "Shifts",
  "scheduling.new.title": "New shift",
  "scheduling.overview.lead":
    "Scheduling coordinates shifts across your team. Anyone can read this overview; the shift list itself is available to people with the <code>scheduling:read</code> permission.",
+  "scheduling.overview.mine": "See my shifts",
  "scheduling.overview.signIn": "Sign in to view shifts",
  "scheduling.overview.title": "Scheduling",
  "scheduling.overview.view": "View shifts",
@@ -9,12 +9,16 @@ const messages: SchedulingMessages = {
  "scheduling.filter.searchLabel": "Sök pass",
  "scheduling.filter.searchPlaceholder": "Sök på namn eller person…",
  "scheduling.form.submit": "Skapa pass",
+  "scheduling.mine.empty": "Inga pass är tilldelade {{email}}.",
+  "scheduling.mine.title": "Mina pass",
+  "scheduling.nav.mine": "Mina pass",
  "scheduling.nav.overview": "Översikt",
  "scheduling.nav.section": "Schemaläggning",
  "scheduling.nav.shifts": "Pass",
  "scheduling.new.title": "Nytt pass",
  "scheduling.overview.lead":
    "Schemaläggningen samordnar teamets pass. Alla kan läsa den här översikten; själva passlistan kräver behörigheten <code>scheduling:read</code>.",
+  "scheduling.overview.mine": "Visa mina pass",
  "scheduling.overview.signIn": "Logga in för att se passen",
  "scheduling.overview.title": "Schemaläggning",
  "scheduling.overview.view": "Visa pass",
@@ -3,7 +3,7 @@
 // folder, rename it, point it at your own backend. Full contract: README.md → Building plugins.

 import { definePlugin } from "@plainpages/plugin-api";
-import { createShift, createUpstream, listShifts, newShiftForm, overview, READ, SCHEDULING_PATH, SHIFTS_PATH, WRITE } from "./shifts.ts";
+import { createShift, createUpstream, listShifts, MINE_PATH, myShifts, newShiftForm, overview, READ, SCHEDULING_PATH, SHIFTS_PATH, WRITE } from "./shifts.ts";

 // The upstream this plugin reads/writes — a stand-in for your real backend (the plugin is
 // stateless). Its URL is a declared setting, so it is resolved and validated before onBoot hands it
@@ -12,7 +12,7 @@ let upstreamUrl = "";
 const upstream = createUpstream(() => upstreamUrl);

 export default definePlugin({
-  apiVersion: "0.2.0", // the host contract this was built against — a literal, never HOST_API_VERSION
+  apiVersion: "0.4.0", // the host contract this was built against — a literal, never HOST_API_VERSION

  // onBoot runs after discovery, before the server listens — where a plugin receives its resolved
  // settings. A malformed URL already failed the boot by then; the host validated the declared type.
@@ -25,11 +25,13 @@ export default definePlugin({
  nav: [{
    children: [
      { href: SCHEDULING_PATH, id: "scheduling:overview", label: "scheduling.nav.overview", public: true },
+      { href: MINE_PATH, id: "scheduling:mine", label: "scheduling.nav.mine", session: true },
      { href: SHIFTS_PATH, id: "scheduling:shifts", label: "scheduling.nav.shifts", permission: READ },
    ],
    icon: "i-cal",
    id: "scheduling",
    label: "scheduling.nav.section",
+    public: true, // the header gates nothing; each child names its own gate, and an empty header is dropped
  }],

  // Roles this plugin introduces (docs + Keto seeding). Namespaced `<id>:<action>`.
@@ -38,10 +40,9 @@ export default definePlugin({
    { description: "Create and edit shifts", name: WRITE },
  ],

-  // Mounted under /scheduling; `permission` gates before the handler runs. The overview is `public`
-  // (anyone may reach /scheduling, signed in or not); the rest need a permission.
  routes: [
    { handler: overview(), method: "GET", path: "/", public: true },
+    { handler: myShifts(upstream), method: "GET", path: "/mine", session: true },
    { handler: listShifts(upstream), method: "GET", path: "/shifts", permission: READ },
    { handler: newShiftForm(), method: "GET", path: "/shifts/new", permission: WRITE },
    { handler: createShift(upstream), method: "POST", path: "/shifts", permission: WRITE },
@@ -4,29 +4,29 @@ import { Readable } from "node:stream";
 import test from "node:test";
 // Import only from the @plainpages/plugin-api barrel — the same contract boundary shifts.ts uses (the host may
 // refactor any deeper src/* freely behind it); the test models the dev/test story the contract preaches.
-import { englishTranslator, GuardError, Log, type PageChrome, type RequestContext, type RouteResult } from "@plainpages/plugin-api";
+import { englishTranslator, GuardError, Log, type PageChrome, type RequestContext, type RouteResult, type User } from "@plainpages/plugin-api";
 import enUS from "./i18n/en-US.ts";
 import {
-  buildFormModel, createShift, createUpstream, listShifts, newShiftForm, overview, readInput,
+  buildFormModel, createShift, createUpstream, listShifts, myShifts, newShiftForm, overview, readInput,
  SHIFTS_PATH, type Shift, type ShiftInput, type ShiftsUpstream, UpstreamError, validate,
 } from "./shifts.ts";

 const t = englishTranslator(enUS); // this plugin's catalog then the host's, as the host would chain them
 const CHROME: PageChrome = { brand: { name: "Test" }, csrfToken: "tok", nav: [], signInHref: "/login", user: { email: "", initials: "T", name: "Tester" } };

-function fakeCtx(opts: { body?: string; permissions?: string[]; url?: string; verifyCsrf?: (s: string | null | undefined) => boolean } = {}): RequestContext {
+function fakeCtx(opts: { body?: string; permissions?: string[]; url?: string; user?: User; verifyCsrf?: (s: string | null | undefined) => boolean } = {}): RequestContext {
  const url = new URL(opts.url ?? "http://localhost/scheduling/shifts");
  const req = Readable.from(opts.body != null ? [Buffer.from(opts.body)] : []) as unknown as IncomingMessage;
  return {
-    chrome: CHROME, declaredPermissions: [], declaredSettings: [], user: null, locale: "en-US", localeHref: (href) => href, locales: ["en-US"], log: new Log("none"), params: {},
+    chrome: CHROME, declaredPermissions: [], declaredSettings: [], user: opts.user ?? null, locale: "en-US", localeHref: (href) => href, locales: ["en-US"], log: new Log("none"), params: {},
    query: url.searchParams, req, res: {} as ServerResponse, permissions: opts.permissions ?? [], t, url,
    verifyCsrf: opts.verifyCsrf ?? (() => true),
  };
 }

 const SHIFTS: Shift[] = [
-  { assignee: "Avery Kline", end: "12:00", id: "1", start: "08:00", title: "Morning desk" },
-  { assignee: "Blair Mora", end: "17:00", id: "2", start: "12:00", title: "Afternoon support" },
+  { assignee: "Avery Kline", assigneeId: "019bdc1a-3f27-7c41-9a6e-2b1d4f8e05a3", end: "12:00", id: "1", start: "08:00", title: "Morning desk" },
+  { assignee: "Blair Mora", assigneeId: "019bdc1a-4a83-7de2-8f05-6c93a71be4d8", end: "17:00", id: "2", start: "12:00", title: "Afternoon support" },
 ];
 const fakeUpstream = (over: Partial<ShiftsUpstream> = {}): ShiftsUpstream => ({ create: async () => {}, list: async () => SHIFTS, ...over });

@@ -63,11 +63,11 @@ test("createUpstream.list fetches /shifts, asks for JSON, and maps the rows", as
  const http = (async (url, init) => {
    seen = String(url);
    assert.equal((init?.headers as Record<string, string>).accept, "application/json");
-    return new Response(JSON.stringify([{ assignee: "A", end: "2", id: "x", start: "1", title: "T", extra: "ignored" }]), { status: 200 });
+    return new Response(JSON.stringify([{ assignee: "A", assigneeId: "019bdc1a-5b6e-7a90-b3c7-84f01d2ea9b6", end: "2", id: "x", start: "1", title: "T", extra: "ignored" }]), { status: 200 });
  }) as typeof fetch;
  const shifts = await createUpstream(() => "http://up:4000/", http).list(); // trailing slash trimmed
  assert.equal(seen, "http://up:4000/shifts");
-  assert.deepEqual(shifts, [{ assignee: "A", end: "2", id: "x", start: "1", title: "T" }]);
+  assert.deepEqual(shifts, [{ assignee: "A", assigneeId: "019bdc1a-5b6e-7a90-b3c7-84f01d2ea9b6", end: "2", id: "x", start: "1", title: "T" }]);
 });

 test("createUpstream throws UpstreamError carrying the status on a non-2xx", async () => {
@@ -115,14 +115,21 @@ test("listShifts degrades to a recoverable error page when the upstream is down

 // ---- public overview handler (a page anyone can reach, gated data stays behind the permission) ----

-test("overview renders a public page for anyone; it links straight to Shifts only for a reader", async () => {
+test("overview renders a public page for anyone, and its CTA names the best gate the visitor passes", async () => {
  const anon = asView(await overview()(fakeCtx())); // user null, no permissions
  assert.equal(anon.view, "overview");
  assert.equal(anon.data["chrome"], CHROME);
  assert.equal(anon.data["canRead"], false); // anonymous → prompt to sign in, no shifts link
+  assert.equal(anon.data["signedIn"], false);

  const reader = asView(await overview()(fakeCtx({ permissions: ["scheduling:read"] })));
  assert.equal(reader.data["canRead"], true); // a reader gets a link straight to the shifts list
+
+  // Signed in but ungranted: the page must not invite them to sign in again.
+  const member = asView(await overview()(fakeCtx({ user: { email: "m@example.test", id: "01a06091-baa3-7a1f-9c62-0e3ab6d2f5c1", permissions: [] } })));
+  assert.equal(member.data["canRead"], false);
+  assert.equal(member.data["signedIn"], true);
+  assert.equal(member.data["mineHref"], "/scheduling/mine");
 });

 // ---- create handler ----
@@ -171,3 +178,38 @@ test("buildFormModel marks title/assignee required and attaches field errors", (
  assert.equal(title.error, "needed");
  assert.equal(fields.find((f) => f.name === "start")!.required, undefined);
 });
+
+// ---- the session-gated page: the visitor's own rows ----
+
+test("my shifts scopes the upstream read by the visitor's id, and names them in the empty state", async () => {
+  const user: User = { email: "Blair.Mora@example.test", id: "01a06091-baa3-71f4-a068-4879972979ff", permissions: [] };
+  const mine: Shift = { assignee: "Blair Mora", assigneeId: user.id, end: "22:00", id: "3", start: "17:00", title: "Evening on-call" };
+  let asked: { assigneeId?: string } | undefined;
+
+  const upstream = fakeUpstream({ list: async (opts) => { asked = opts; return [mine]; } });
+  const r = asView(await myShifts(upstream)(fakeCtx({ url: "http://localhost/scheduling/mine", user })));
+  assert.equal(r.view, "mine");
+  assert.deepEqual(asked, { assigneeId: "01a06091-baa3-71f4-a068-4879972979ff" }); // the id, never the address
+  const table = r.data["table"] as { emptyText: string; rows: { name: string }[] };
+  assert.deepEqual(table.rows.map((row) => row.name), ["Evening on-call"]);
+  assert.match(table.emptyText, /Blair\.Mora@example\.test/); // an empty page still says whose it is
+
+  // `requireSession` narrows `ctx.user` from `User | null` to `User` — the one part of the route's
+  // `session: true` guarantee the contract cannot state in the handler's type.
+  await assert.rejects(async () => { await myShifts(fakeUpstream())(fakeCtx()); }, GuardError);
+});
+
+test("my shifts degrades to the reason alone when the upstream is down, claiming nothing about what is assigned", async () => {
+  const user: User = { email: "Blair.Mora@example.test", id: "01a06091-baa3-71f4-a068-4879972979ff", permissions: [] };
+  const down = fakeUpstream({ list: async () => { throw new UpstreamError("down", 503); } });
+  const r = asView(await myShifts(down)(fakeCtx({ url: "http://localhost/scheduling/mine", user })));
+  assert.match(String(r.data["error"]), /scheduling service/i);
+  assert.deepEqual((r.data["table"] as { rows: unknown[] }).rows, []); // mine.ejs drops the count + table while `error` is set
+});
+
+test("my shifts drops a row the upstream returned that is not the visitor's", async () => {
+  const user: User = { email: "Blair.Mora@example.test", id: "01a06091-baa3-71f4-a068-4879972979ff", permissions: [] };
+  const theirs: Shift = { assignee: "Avery Kline", assigneeId: "019bdc1a-3f27-7c41-9a6e-2b1d4f8e05a3", end: "12:00", id: "9", start: "08:00", title: "Not mine" };
+  const r = asView(await myShifts(fakeUpstream({ list: async () => [theirs] }))(fakeCtx({ url: "http://localhost/scheduling/mine", user })));
+  assert.deepEqual((r.data["table"] as { rows: unknown[] }).rows, []); // a backend ignoring the scope must not leak through this page
+});
@@ -6,7 +6,7 @@
 // pure functions against a mock upstream with no network (README.md → Local dev & test story).

 // One import from the host's @plainpages/plugin-api barrel — the stable author surface (see README.md → Building plugins).
-import { can, CSRF_FIELD, englishTranslator, GuardError, type PageChrome, parseListQuery, readFormBody, type RouteHandler, type Translate, tracedFetch } from "@plainpages/plugin-api";
+import { can, CSRF_FIELD, englishTranslator, GuardError, type PageChrome, parseListQuery, readFormBody, requireSession, type RouteHandler, type Translate, tracedFetch } from "@plainpages/plugin-api";
 import enUS from "./i18n/en-US.ts";

 // The plugin's own English (its catalog, then the host's), for a view model built outside a request:
@@ -16,12 +16,14 @@ const EN: Translate = englishTranslator(enUS);

 export const SCHEDULING_PATH = "/scheduling"; // the plugin's public overview page
 export const SHIFTS_PATH = "/scheduling/shifts";
+export const MINE_PATH = "/scheduling/mine"; // the visitor's own shifts — a session is the whole gate
 export const READ = "scheduling:read"; // the permission gating the list + nav
 export const WRITE = "scheduling:write"; // the permission gating create

 export interface Shift {
  id: string;
-  assignee: string;
+  assignee: string; // display name, rendered in the table
+  assigneeId: string; // who the shift belongs to — an opaque id, the same one `ctx.user.id` carries
  end: string;
  start: string;
  title: string;
@@ -46,7 +48,9 @@ export class UpstreamError extends Error {

 export interface ShiftsUpstream {
  create(input: ShiftInput): Promise<void>;
-  list(): Promise<Shift[]>;
+  // `assigneeId` scopes the read at the source, which is where an ownership rule belongs (README →
+  // Three tiers of "may I?"); without it the caller would hold everyone's rows to render one page.
+  list(opts?: { assigneeId?: string }): Promise<Shift[]>;
 }

 // REST client over the upstream service (a stand-in for the customer's real backend). `fetch`
@@ -65,8 +69,9 @@ export function createUpstream(baseUrl: () => string, fetchImpl: typeof fetch =
      });
      if (!res.ok) throw new UpstreamError(`create shift failed (${res.status})`, res.status);
    },
-    async list() {
-      const res = await fetchImpl(`${base()}/shifts`, { headers: { accept: "application/json" } });
+    async list(opts = {}) {
+      const query = opts.assigneeId == null ? "" : `?${new URLSearchParams({ assigneeId: opts.assigneeId })}`;
+      const res = await fetchImpl(`${base()}/shifts${query}`, { headers: { accept: "application/json" } });
      if (!res.ok) throw new UpstreamError(`list shifts failed (${res.status})`, res.status);
      const data: unknown = await res.json();
      return Array.isArray(data) ? data.map(toShift) : [];
@@ -78,7 +83,7 @@ const str = (v: unknown): string => (typeof v === "string" ? v : v == null ? ""

 function toShift(raw: unknown): Shift {
  const r = (raw ?? {}) as Record<string, unknown>;
-  return { assignee: str(r["assignee"]), end: str(r["end"]), id: str(r["id"]), start: str(r["start"]), title: str(r["title"]) };
+  return { assignee: str(r["assignee"]), assigneeId: str(r["assigneeId"]), end: str(r["end"]), id: str(r["id"]), start: str(r["start"]), title: str(r["title"]) };
 }

 // ---- view models (pure; the EJS views read these) -----------------------------------
@@ -186,6 +191,41 @@ export function newShiftForm(): RouteHandler {
  return (ctx) => ({ data: buildFormModel({ chrome: ctx.chrome, t: ctx.t }), view: "shift-new" });
 }

+export function myShifts(upstream: ShiftsUpstream): RouteHandler {
+  return async (ctx) => {
+    const user = requireSession(ctx);
+    let shifts: Shift[] = [];
+    let error: string | undefined;
+    try {
+      // Join on the id, never the email: an address is user-changeable and can be reassigned to
+      // someone else, which would hand them the previous holder's rows. The re-filter is
+      // defence-in-depth: a backend that ignores an unknown query param would answer with everyone.
+      shifts = (await upstream.list({ assigneeId: user.id })).filter((s) => s.assigneeId === user.id);
+    } catch (err) {
+      ctx.log.warn("scheduling upstream unreachable", { error: String(err) });
+      error = ctx.t("scheduling.upstream.list");
+    }
+    return { data: buildMineModel({ chrome: ctx.chrome, email: user.email, ...(error ? { error } : {}), shifts, t: ctx.t }), view: "mine" };
+  };
+}
+
+export function buildMineModel(opts: { chrome: PageChrome; email: string; error?: string; shifts: Shift[]; t?: Translate }) {
+  const t = opts.t ?? EN;
+  return {
+    breadcrumbs: [{ label: t("scheduling.mine.title") }],
+    chrome: opts.chrome,
+    count: t("scheduling.shifts.count", { count: opts.shifts.length }),
+    ...(opts.error ? { error: opts.error } : {}),
+    table: {
+      caption: t("scheduling.mine.title"),
+      columns: [{ label: t("scheduling.table.shift") }, { label: t("scheduling.table.start") }, { label: t("scheduling.table.end") }],
+      emptyText: t("scheduling.mine.empty", { email: opts.email }),
+      rows: opts.shifts.map((s) => ({ cells: [{ rowHeader: { text: s.title } }, s.start, s.end], name: s.title })),
+    },
+    title: t("scheduling.mine.title"),
+  };
+}
+
 // Public overview: a page anyone may reach — its route + nav node are marked `public`, so the
 // gate lets an anonymous visitor through and the menu option shows for everyone. The real data
 // (the shifts list) stays behind `scheduling:read`; a reader gets a link straight to it, anyone
@@ -196,7 +236,9 @@ export function overview(): RouteHandler {
      breadcrumbs: [{ label: ctx.t("scheduling.nav.overview") }],
      canRead: can(ctx, READ),
      chrome: ctx.chrome,
+      mineHref: ctx.localeHref(MINE_PATH),
      shiftsHref: ctx.localeHref(SHIFTS_PATH), // a plugin carries the visitor's locale onto its own links
+      signedIn: ctx.user !== null,
      signInHref: ctx.localeHref(`/login?return_to=${encodeURIComponent(ctx.localeHref(SHIFTS_PATH))}`),
      title: ctx.t("scheduling.overview.title"),
    },
@@ -0,0 +1,19 @@
+<%#
+  Scheduling · the visitor's own shifts (reference plugin).
+  Data: chrome, title, breadcrumbs, count, table, error?
+%><%
+  const navHtml = include("partials/nav-tree", { nodes: chrome.nav });
+  const tableHtml = include("partials/data-table", table);
+  const alertHtml = locals.error ? include("partials/alert", { text: locals.error, tone: "neg" }) : "";
+-%>
+<%- include("partials/shell", {
+  body: '<div class="scheduling-page">' + alertHtml + (locals.error ? '' : '<p class="shift-count">' + count + '</p>' + tableHtml) + '</div>',
+  brand: chrome.brand,
+  breadcrumbs,
+  csrfToken: chrome.csrfToken,
+  nav: navHtml,
+  styles: ["/public/scheduling/scheduling.css"],
+  theme: chrome.theme,
+  title,
+  user: chrome.user,
+}) %>
@@ -3,12 +3,16 @@
  nav node are marked `public`, so an anonymous visitor is let through and the menu option shows for
  everyone. The actual shifts data stays behind `scheduling:read`: a reader gets a link straight to
  it, anyone else a prompt to sign in. Rendered in the native shell via ctx.chrome.
-  Data: chrome, title, breadcrumbs, canRead, shiftsHref, signInHref
+  Data: chrome, title, breadcrumbs, canRead, mineHref, shiftsHref, signedIn, signInHref
 %><%
  const navHtml = include("partials/nav-tree", { nodes: chrome.nav });
+  // One CTA per gate the visitor passes: the list needs the permission, "My shifts" only a session,
+  // and sign-in is offered to nobody who already has one.
  const cta = canRead
    ? '<a class="btn btn-primary" href="' + shiftsHref + '">' + t("scheduling.overview.view") + '</a>'
-    : '<a class="btn btn-primary" href="' + signInHref + '">' + t("scheduling.overview.signIn") + '</a>';
+    : signedIn
+      ? '<a class="btn btn-primary" href="' + mineHref + '">' + t("scheduling.overview.mine") + '</a>'
+      : '<a class="btn btn-primary" href="' + signInHref + '">' + t("scheduling.overview.signIn") + '</a>';
 -%>
 <%- include("partials/shell", {
  actions: "",
@@ -3,7 +3,7 @@
 // of the app: stdlib only, in-memory (state resets on restart), no auth. Point PLUGIN_SETTING_SCHEDULING_UPSTREAM
 // at your real service in production.
 //
-//   GET  /shifts  → 200 [ { id, title, assignee, start, end }, … ]
+//   GET  /shifts  → 200 [ { id, title, assigneeId, assignee, start, end }, … ]   (?assigneeId=<id> → only theirs)
 //   POST /shifts  → 201 { id, … }   (body: { title, assignee, start, end })

 import { randomUUID } from "node:crypto";
@@ -11,10 +11,12 @@ import { createServer } from "node:http";

 const PORT = Number(process.env.PORT ?? 4000);

+// `assigneeId` is the identity the rows are owned by — an opaque, stable subject id, which is what
+// `ctx.user.id` carries. These are this demo's own people; a real backend joins on your IdP's ids.
 const shifts = [
-  { id: randomUUID(), title: "Morning — Front desk", assignee: "Avery Kline", start: "2026-06-22 08:00", end: "2026-06-22 12:00" },
-  { id: randomUUID(), title: "Afternoon — Support", assignee: "Blair Mora", start: "2026-06-22 12:00", end: "2026-06-22 17:00" },
-  { id: randomUUID(), title: "Evening — On-call", assignee: "Casey Nguyen", start: "2026-06-22 17:00", end: "2026-06-22 22:00" },
+  { id: randomUUID(), title: "Morning — Front desk", assigneeId: "019bdc1a-3f27-7c41-9a6e-2b1d4f8e05a3", assignee: "Avery Kline", start: "2026-06-22 08:00", end: "2026-06-22 12:00" },
+  { id: randomUUID(), title: "Afternoon — Support", assigneeId: "019bdc1a-4a83-7de2-8f05-6c93a71be4d8", assignee: "Blair Mora", start: "2026-06-22 12:00", end: "2026-06-22 17:00" },
+  { id: randomUUID(), title: "Evening — On-call", assigneeId: "019bdc1a-5b6e-7a90-b3c7-84f01d2ea9b6", assignee: "Casey Nguyen", start: "2026-06-22 17:00", end: "2026-06-22 22:00" },
 ];

 const json = (res, status, body) => {
@@ -33,10 +35,14 @@ const readBody = (req) =>

 createServer(async (req, res) => {
  const url = new URL(req.url ?? "/", "http://localhost");
-  if (url.pathname === "/shifts" && req.method === "GET") return json(res, 200, shifts);
+  if (url.pathname === "/shifts" && req.method === "GET") {
+    const assigneeId = url.searchParams.get("assigneeId");
+    if (assigneeId === null) return json(res, 200, shifts);
+    return json(res, 200, shifts.filter((s) => s.assigneeId === assigneeId));
+  }
  if (url.pathname === "/shifts" && req.method === "POST") {
    const b = await readBody(req);
-    const shift = { id: randomUUID(), assignee: String(b.assignee ?? ""), end: String(b.end ?? ""), start: String(b.start ?? ""), title: String(b.title ?? "") };
+    const shift = { id: randomUUID(), assignee: String(b.assignee ?? ""), assigneeId: "", end: String(b.end ?? ""), start: String(b.start ?? ""), title: String(b.title ?? "") };
    shifts.push(shift);
    return json(res, 201, shift);
  }
@@ -8,7 +8,7 @@
      "dependencies": {
        "@larvit/log": "2.3.0",
        "ejs": "6.0.1",
-        "lucide-static": "1.33.0",
+        "lucide-static": "1.34.0",
        "postgres": "3.4.9"
      },
      "devDependencies": {
@@ -399,9 +399,9 @@
      }
    },
    "node_modules/lucide-static": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.33.0.tgz",
-      "integrity": "sha512-jNGgvTNcLUfVRX4N9PH9pVVTJzoph/BmYmgU838bYBQodkUJL4nAThkuymFz1x3OUYMhJxPndC7rdg1sxOPYKg==",
+      "version": "1.34.0",
+      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.34.0.tgz",
+      "integrity": "sha512-pSUvFhfhvDnhXN1fXerZEMgKLQQ3DneKwFYlqB5ji8OEAN0iPi/qgwQvCkcL519QgMeR66IpS/pT342VyT/g4g==",
      "license": "ISC"
    },
    "node_modules/postgres": {
@@ -18,7 +18,7 @@
  "dependencies": {
    "@larvit/log": "2.3.0",
    "ejs": "6.0.1",
-    "lucide-static": "1.33.0",
+    "lucide-static": "1.34.0",
    "postgres": "3.4.9"
  },
  "devDependencies": {
@@ -111,7 +111,6 @@ html:has(#theme-light:checked) {

 /* ---------- 2. RESET ---------------------------------------- */
 *, *::before, *::after { box-sizing: border-box; }
-html, body { height: 100%; }
 body { margin: 0; background: var(--bg); color: var(--text);
  -webkit-font-smoothing: antialiased; }
 button { font: inherit; color: inherit; }
@@ -151,8 +150,7 @@ summary { list-style: none; cursor: pointer; }
 .app {
  display: grid;
  grid-template-columns: var(--nav-w) minmax(0, 1fr);
-  height: 100dvh;
-  overflow: hidden;
+  min-height: 100dvh;
 }

 /* ---------- 4. SIDEBAR -------------------------------------- */
@@ -160,7 +158,6 @@ summary { list-style: none; cursor: pointer; }
  grid-column: 1;
  display: flex;
  flex-direction: column;
-  min-height: 0;
  background: var(--surface);
  border-right: 1px solid var(--border);
 }
@@ -316,6 +313,11 @@ span.nav-self { cursor: default; }                 /* static / non-clickable */
 .btn-primary:hover { filter: brightness(1.06); }
 .btn-ghost { background: transparent; border-color: transparent; }
 .btn-ghost:hover { background: var(--surface-2); }
+.btn-menu::after {
+  content: ""; width: 7px; height: 7px; margin: -2px 1px 0 1px;
+  border-right: 1.5px solid var(--text-faint); border-bottom: 1.5px solid var(--text-faint);
+  transform: rotate(45deg);
+}
 .icon-btn {
  width: 30px; height: 30px; padding: 0; justify-content: center;
  color: var(--text-muted);
@@ -326,7 +328,7 @@ span.nav-self { cursor: default; }                 /* static / non-clickable */
 .content {
  grid-column: 2;
  display: flex; flex-direction: column;
-  min-width: 0; min-height: 0;
+  min-width: 0;
  background: var(--bg);
 }

@@ -494,7 +496,8 @@ span.nav-self { cursor: default; }                 /* static / non-clickable */
  position-anchor: auto;
  position-try-fallbacks: flip-block, flip-inline;
  top: anchor(bottom); right: anchor(right);
-  min-width: 210px; padding: 6px;
+  min-width: 210px; max-width: min(320px, 92vw); padding: 6px;
+  max-height: 60vh; overflow-y: auto; overflow-wrap: anywhere;
  background: var(--surface); color: var(--text);
  border: 1px solid var(--border-2); border-radius: var(--radius);
  box-shadow: 0 8px 28px rgba(0,0,0,.16);
@@ -553,13 +556,12 @@ span.nav-self { cursor: default; }                 /* static / non-clickable */
 .pill-clear:hover { text-decoration: underline; }

 /* ---------- 9. TABLE --------------------------------------- */
-.table-wrap { flex: 1 1 auto; min-height: 0; overflow: auto; }
+.table-wrap { overflow-x: auto; }
 table.table {
  width: 100%; border-collapse: separate; border-spacing: 0;
  font-size: var(--fz); font-variant-numeric: tabular-nums;
 }
 .table thead th {
-  position: sticky; top: 0; z-index: 10;
  background: var(--surface-3);
  border-bottom: 1px solid var(--border-2);
  color: var(--text-muted); font-weight: 600; font-size: var(--fz-xs);
@@ -691,7 +693,7 @@ th[aria-sort="descending"] .sort-ico { transform: rotate(180deg); }
 }

 /* the nav-toggle checkbox itself is visually hidden but focusable */
-#nav-toggle { position: absolute; opacity: 0; pointer-events: none; }
+#nav-toggle { position: fixed; top: 0; left: 0; opacity: 0; pointer-events: none; }

 /* admin forms: create/edit user, account actions */
 .form-page { padding: 16px; display: flex; flex-direction: column; gap: 14px; max-width: 560px; }
@@ -716,5 +718,6 @@ th[aria-sort="descending"] .sort-ico { transform: rotate(180deg); }
 /* Chromeless shell: a page may drop the sidebar for a focused single column. */
 .app-bare { grid-template-columns: minmax(0, 1fr); }
 .app-bare .content { grid-column: 1; }
+
 /* Auth/landing rendered inside the app shell: a roomy, centered column in the content area. */
-.shell-auth { flex: 1 1 auto; overflow-y: auto; display: flex; justify-content: center; align-items: flex-start; padding: 40px 20px 80px; }
+.shell-auth { flex: 1 1 auto; display: flex; justify-content: center; align-items: flex-start; padding: 40px 20px 80px; }
@@ -12,7 +12,7 @@ test("readHostApiVersion pulls the constant out of the real source, and returns
 test("bumping HOST_API_VERSION is a deliberate act, so pin the shipped value", () => {
  // Not a substitute for the release gate — this test cannot see a tag. It is the tripwire that
  // makes an accidental edit fail here rather than at release time.
-  assert.equal(readHostApiVersion(readFileSync("src/plugin-host/plugin.ts", "utf8")), "0.2.0");
+  assert.equal(readHostApiVersion(readFileSync("src/plugin-host/plugin.ts", "utf8")), "0.4.0");
 });

 test("every author-facing apiVersion sample matches the shipped contract", () => {
@@ -131,7 +131,7 @@ services:

  # Catches Kratos' recovery/verification emails — UI on http://localhost:8025
  mailpit:
-    image: axllent/mailpit:v1.31.0
+    image: axllent/mailpit:v1.31.1
    ports:
      - "8025:8025"
    restart: unless-stopped
@@ -182,7 +182,7 @@ into the app. Create `plugins/hello/plugin.ts`:
 import { definePlugin } from "@plainpages/plugin-api";

 export default definePlugin({
-  apiVersion: "0.2.0",
+  apiVersion: "0.4.0",
  nav: [{ href: "/hello", id: "hello", label: "Hello", public: true }],
  routes: [
    { method: "GET", path: "/", public: true, handler: () => ({ html: "<h1>Hello from my plugin</h1>" }) },
@@ -0,0 +1,28 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import type { User } from "../http/context.ts";
+import { allows, gatesSet } from "./gate.ts";
+
+const holder: User = { email: "holder@example.test", id: "01a06091-ba9f-765f-abf4-b5144c314bc7", permissions: ["x:read"] };
+const stranger: User = { email: "stranger@example.test", id: "01a06091-baa3-7b4d-810a-c9ee7e559d98", permissions: [] };
+
+test("allows: ungated and public are open to anyone; session needs a user; permission needs the token", () => {
+  assert.equal(allows({}, null), true);
+  assert.equal(allows({ public: true }, null), true);
+
+  assert.equal(allows({ session: true }, null), false);
+  assert.equal(allows({ session: true }, stranger), true); // signed in is the whole gate — no grant
+
+  assert.equal(allows({ permission: "x:read" }, null), false);
+  assert.equal(allows({ permission: "x:read" }, stranger), false);
+  assert.equal(allows({ permission: "x:read" }, holder), true);
+});
+
+test("gatesSet names the gates a declaration sets, so discovery can refuse more than one", () => {
+  assert.deepEqual(gatesSet({}), []);
+  assert.deepEqual(gatesSet({ session: true }), ["session"]);
+  assert.deepEqual(gatesSet({ permission: "x:read", public: true }), ["public", "permission"]);
+  assert.deepEqual(gatesSet({ permission: "x:read", public: true, session: true }), ["public", "session", "permission"]);
+  // Only `true` sets a gate, so a manifest spelling one `false` names none — which discovery refuses.
+  assert.deepEqual(gatesSet({ public: false, session: false }), []);
+});
@@ -0,0 +1,22 @@
+// One home for the gate rule, so the router and the menu can never disagree about what a visitor
+// may reach. README → Public pages & menu items.
+import type { User } from "../http/context.ts";
+
+const GATES = ["public", "session", "permission"] as const;
+
+export interface Gate {
+  permission?: string; // the Keto Permission the caller must hold, `<resource>:<action>`
+  public?: boolean; // anyone, signed in or not
+  session?: boolean; // any signed-in user, no grant to hold; anonymous is sent to /login
+}
+
+export function allows(gate: Gate, user: User | null): boolean {
+  if (gate.public === true) return true;
+  if (gate.session === true) return user !== null;
+  return gate.permission == null || (user?.permissions.includes(gate.permission) ?? false);
+}
+
+export function gatesSet(gate: Gate | null | undefined): string[] {
+  if (gate == null) return [];
+  return GATES.filter((name) => (name === "permission" ? gate.permission != null : gate[name] === true));
+}
@@ -92,12 +92,24 @@ test("completeLogin returns null and touches nothing when there is no active ses
  assert.equal(touched, false);
 });

-test("completeLogin maps a missing email trait to null and throws if the tokenizer yields no JWT", async () => {
-  const identity: Identity = { id: ID, traits: {} };
+test("completeLogin throws if the tokenizer yields no JWT", async () => {
+  const identity: Identity = { id: ID, traits: { email: "admin@plainpages.local" } };
  const kratosPublic = publicStub({ whoami: async () => ({ active: true, identity }) as Session }); // never returns a tokenized JWT
  await assert.rejects(completeLogin({ keto: ketoStub(), kratosAdmin: adminStub(), kratosPublic }, "c"), /tokenizer returned no JWT/);
 });

+// An identity with no email is no session, decided here so /auth/complete and remintSession cannot
+// disagree: `claimsToUser` reads a token carrying none as anonymous, so minting one would hand the
+// browser a cookie every later request refuses.
+test("completeLogin refuses an identity carrying no email, before it mints anything", async () => {
+  const identity: Identity = { id: ID, traits: {} };
+  let touched = false;
+  const kratosAdmin = adminStub({ updateMetadataPublic: async () => { touched = true; return { id: ID }; } });
+  const kratosPublic = publicStub({ whoami: async () => ({ active: true, identity, tokenized: "h.p.s" }) as Session });
+  assert.equal(await completeLogin({ keto: ketoStub(), kratosAdmin, kratosPublic }, "c"), null);
+  assert.equal(touched, false); // no Keto read, no metadata write, no JWT
+});
+
 test("remintSession: a live Kratos session → fresh cookie + refreshed user; a dead session → a clearing cookie + null", async () => {
  const identity: Identity = { id: ID, traits: { email: "admin@plainpages.local" } };
  const kratosPublic = publicStub({ whoami: async (o) => (o?.tokenizeAs ? { active: true, identity, tokenized: "h.p.s" } : { active: true, identity }) as Session });
@@ -31,7 +31,7 @@ export interface LoginDeps {
 }

 export interface CompletedLogin {
-  email: string | null;
+  email: string;
  userId: string;
  jwt: string;
  permissions: string[];
@@ -61,7 +61,13 @@ export async function completeLogin(deps: LoginDeps, cookie: string | undefined)
  if (!session?.identity) return null;
  const userId = session.identity.id;
  const emailTrait = session.identity.traits?.["email"];
-  const email = typeof emailTrait === "string" ? emailTrait : null;
+  const email = typeof emailTrait === "string" ? emailTrait : "";
+  // No email is no session: `claimsToUser` reads a token carrying none as anonymous, so minting one
+  // would hand the browser a cookie every later request refuses.
+  if (!email) {
+    currentLog()?.warn("session dropped: identity has no email", { sub: userId });
+    return null;
+  }

  const permissions = await readPermissions(deps.keto, userId);
  await deps.kratosAdmin.updateMetadataPublic(userId, { permissions });
@@ -87,7 +93,7 @@ export interface Reminted {
 export async function remintSession(deps: LoginDeps, cookie: string | undefined, options: { secure?: boolean } = {}): Promise<Reminted> {
  const completed = await completeLogin(deps, cookie);
  if (!completed) return { setCookie: clearSessionCookie(options), user: null };
-  return { setCookie: sessionCookie(completed.jwt, options), user: { email: completed.email ?? "", id: completed.userId, permissions: completed.permissions } };
+  return { setCookie: sessionCookie(completed.jwt, options), user: { email: completed.email, id: completed.userId, permissions: completed.permissions } };
 }

 // Build the Set-Cookie for our session JWT. HttpOnly + SameSite=Lax by default; `secure` is
@@ -4,6 +4,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { AUTH_FLOWS } from "./flow-view.ts";
+import { gatesSet } from "./gate.ts";
 import type { HydraAdmin } from "./hydra-admin.ts";
 import type { KetoClient } from "./keto-client.ts";
 import type { KratosAdmin } from "./kratos-admin.ts";
@@ -39,8 +40,12 @@ test("hydra alone ⇒ only RP-initiated logout of the OAuth2 group (login/consen
 });

 test("everything wired ⇒ the full group: OAuth2 challenges, consent GET+POST, /auth/complete", () => {
-  const got = keys(buildAuthRoutes(deps({ hydra, keto, kratos, kratosAdmin })));
+  const routes = buildAuthRoutes(deps({ hydra, keto, kratos, kratosAdmin }));
+  const got = keys(routes);
  for (const key of ["GET /auth/complete", "GET /login", "GET /oauth2/consent", "GET /oauth2/login", "GET /oauth2/logout", "POST /logout", "POST /oauth2/consent"]) {
    assert.ok(got.includes(key), key);
  }
+  // Discovery enforces exactly one gate per plugin declaration; nothing checks the host's own table
+  // at boot, so a route added here without a gate would be silently public.
+  for (const route of routes) assert.deepEqual(gatesSet(route), ["public"], `${route.method} ${route.path}`);
 });
@@ -240,20 +240,20 @@ export function buildAuthRoutes({ hydra, keto, kratos, kratosAdmin, menu, secure
  const routes: BuiltinRoute[] = [];
  if (kratos) {
    for (const [path, flowType] of Object.entries(AUTH_FLOWS)) {
-      routes.push({ handler: flowPage(kratos, flowType, secureCookies), method: "GET", path });
+      routes.push({ handler: flowPage(kratos, flowType, secureCookies), method: "GET", path, public: true });
    }
-    routes.push({ handler: logout(kratos, secureCookies), method: "POST", path: "/logout" });
+    routes.push({ handler: logout(kratos, secureCookies), method: "POST", path: "/logout", public: true });
  }
  if (hydra && kratos) {
    const provider = { hydra, kratos };
-    routes.push({ handler: oauthLogin(provider, secureCookies), method: "GET", path: "/oauth2/login" });
-    routes.push({ handler: consentScreen(provider, menu.branding.name), method: "GET", path: "/oauth2/consent" });
-    routes.push({ handler: consentDecision(provider), method: "POST", path: "/oauth2/consent" });
+    routes.push({ handler: oauthLogin(provider, secureCookies), method: "GET", path: "/oauth2/login", public: true });
+    routes.push({ handler: consentScreen(provider, menu.branding.name), method: "GET", path: "/oauth2/consent", public: true });
+    routes.push({ handler: consentDecision(provider), method: "POST", path: "/oauth2/consent", public: true });
  }
-  if (hydra) routes.push({ handler: oauthLogout(hydra), method: "GET", path: "/oauth2/logout" });
+  if (hydra) routes.push({ handler: oauthLogout(hydra), method: "GET", path: "/oauth2/logout", public: true });
  if (kratos && kratosAdmin && keto) {
-    routes.push({ handler: completeAuth({ keto, kratosAdmin, kratosPublic: kratos }, secureCookies), method: "GET", path: "/auth/complete" });
+    routes.push({ handler: completeAuth({ keto, kratosAdmin, kratosPublic: kratos }, secureCookies), method: "GET", path: "/auth/complete", public: true });
  }
-  routes.push({ handler: errorSink, method: "GET", path: "/error" });
+  routes.push({ handler: errorSink, method: "GET", path: "/error", public: true });
  return routes;
 }
@@ -609,6 +609,7 @@ test("guards map to responses: requireSession → /login, a failed can/check →
      { handler: (ctx) => { if (!can(ctx, "admin")) throw new GuardError(403, "no"); return { html: "ok" }; }, method: "GET", path: "/admin-only" },
      { handler: async (ctx) => { if (!(await check(keto, ctx, { namespace: "Resource", object: ctx.params.id ?? "", relation: "view" }))) throw new GuardError(403, "no"); return { html: "seen" }; }, method: "GET", path: "/doc/:id" },
      { handler: () => ({ html: "gated" }), method: "GET", path: "/gated", permission: "secret:read" }, // declarative route gate
+      { handler: () => ({ html: "mine" }), method: "GET", path: "/mine", session: true }, // declarative session gate
    ],
  };
  const app = createApp({ jwks: staticJwks([ecJwk]), plugins: [guarded] });
@@ -642,6 +643,12 @@ test("guards map to responses: requireSession → /login, a failed can/check →
  assert.equal(gDenied.status, 403);
  assert.match(await gDenied.text(), /403/); // the rendered 403.ejs over HTTP
  assert.equal((await fetch(url + "/guarded/gated", auth(["secret:read"]))).status, 200);
+
+  // declarative `session` gate: anonymous → sign in, and any signed-in user through, grant or none.
+  const sAnon = await fetch(url + "/guarded/mine", { redirect: "manual" });
+  assert.equal(sAnon.status, 303);
+  assert.equal(sAnon.headers.get("location"), "/login?return_to=%2Fguarded%2Fmine");
+  assert.equal((await fetch(url + "/guarded/mine", auth([]))).status, 200);
 });

 test("plugin hooks: onRequest can short-circuit a request and onResponse observes the handler result", async (t) => {
@@ -28,7 +28,8 @@ import { DEFAULT_MENU, type MenuConfig } from "../ui/menu-config.ts";
 import { declaredPermissions, type Plugin, type RouteHandler, type RouteResult } from "../plugin-host/plugin.ts";
 import type { PluginSettings } from "../plugin-host/settings.ts";
 import type { SystemCapabilities } from "../plugin-host/system.ts";
-import { allowedMethods, isAuthorized, matchRoute } from "../plugin-host/router.ts";
+import { allows, type Gate } from "../auth/gate.ts";
+import { allowedMethods, matchRoute } from "../plugin-host/router.ts";
 import { buildAuthRoutes } from "../auth/routes.ts";
 import { securityHeaders } from "./security-headers.ts";
 import { localPath } from "./safe-url.ts";
@@ -156,7 +157,6 @@ export function createApp(options: AppOptions = {}): Server {
  // "/dashboard", gated to a signed-in user. A plugin may own it via `dashboard`; else the built-in
  // starter page.
  const serveDashboard = async (ctx: RequestContext, csrf: RequestCsrf, contextFor: PluginContextFactory): Promise<RouteResult | null> => {
-    if (!ctx.user) return { redirect: loginRedirect(ctx), status: 303 };
    // The page carries the Sign-out form, so Set-Cookie a fresh CSRF token here when absent.
    csrf.setCookie();
    if (dashboardPlugin) {
@@ -173,8 +173,8 @@ export function createApp(options: AppOptions = {}): Server {
  // routes.ts, capability-gated on the wired clients) plus the two landing slots above.
  const builtinRoutes: BuiltinRoute[] = [
    ...buildAuthRoutes({ hydra, keto, kratos, kratosAdmin, menu, secureCookies }),
-    { handler: serveHome, method: "GET", path: "/" },
-    { handler: serveDashboard, method: "GET", path: "/dashboard" },
+    { handler: serveHome, method: "GET", path: "/", public: true },
+    { handler: serveDashboard, method: "GET", path: "/dashboard", session: true },
  ];

  // The request handler. Run inside runWithLog (below) so the per-request logger is ambient: every
@@ -278,15 +278,19 @@ export function createApp(options: AppOptions = {}): Server {
        }
      }

+      // Anonymous → sign in, remembering the page as return_to; a signed-in user who simply lacks
+      // the permission gets the 403 page.
+      const refuse = async (gate: Gate, gateCtx: RequestContext): Promise<void> => {
+        if (!gateCtx.user) { res.writeHead(303, { location: carryLocale(loginRedirect(gateCtx)) }).end(); return; }
+        reqLog.warn("forbidden: missing permission", { path: pathname, required: gate.permission ?? "", sub: gateCtx.user.id });
+        sendHtml(res, 403, await renderPage("403", {}));
+      };
+
      const match = matchRoute(plugins, method, pathname);
      if (match) {
        const routeCtx = contextFor(match.plugin.id, match.params);
-        if (!isAuthorized(match.route, routeCtx.permissions)) {
-          // Anonymous → sign in, remembering the page as return_to; a signed-in user who simply
-          // lacks the permission gets the 403 page.
-          if (!routeCtx.user) { res.writeHead(303, { location: loginRedirect(routeCtx) }).end(); return; }
-          reqLog.warn("forbidden: missing permission", { path: pathname, required: match.route.permission ?? "", sub: routeCtx.user.id });
-          sendHtml(res, 403, await renderPage("403", {}));
+        if (!allows(match.route, routeCtx.user)) {
+          await refuse(match.route, routeCtx);
          return;
        }
        csrfMint.setCookie();
@@ -300,6 +304,7 @@ export function createApp(options: AppOptions = {}): Server {

      const builtin = matchBuiltinRoute(builtinRoutes, method, pathname);
      if (builtin) {
+        if (!allows(builtin, ctx.user)) { await refuse(builtin, ctx); return; }
        await sendResult(res, await builtin.handler(ctx, csrfMint, contextFor), viewsFor(ctx), carryLocale);
        return;
      }
@@ -3,6 +3,7 @@
 // mint (host-only — a plugin reads the token via ctx.chrome instead). app.ts matches this table
 // after plugin routes — exact path, a GET route also answering HEAD like the plugin router — and
 // pipes the result through sendResult against the core views.
+import type { Gate } from "../auth/gate.ts";
 import type { RequestContext } from "./context.ts";
 import type { RouteResult } from "../plugin-host/plugin.ts";

@@ -19,7 +20,7 @@ export interface RequestCsrf {
 // own context — otherwise the plugin's keys render as bare keys on the pages it owns.
 export type PluginContextFactory = (pluginId: string) => RequestContext;

-export interface BuiltinRoute {
+export interface BuiltinRoute extends Gate {
  // Returns a RouteResult, or null when the handler wrote to ctx.res itself
  // (the landing slots dispatch a plugin's own result against that plugin's views).
  handler: (ctx: RequestContext, csrf: RequestCsrf, contextFor: PluginContextFactory) => Promise<RouteResult | null> | RouteResult | null;
@@ -100,6 +100,7 @@ const messages = {
  "filter.remove": "Remove {{label}} filter",
  "filter.reset": "Reset",
  "filter.search": "Search",
+  "filter.selected": "{{label}}, {{count}} selected",
  "filter.to": "To",
  "filter.toSeparator": "to",

@@ -91,6 +91,7 @@ const messages: CoreMessages = {
  "filter.remove": "Ta bort filtret {{label}}",
  "filter.reset": "Återställ",
  "filter.search": "Sök",
+  "filter.selected": "{{label}}, {{count}} valda",
  "filter.to": "Till",
  "filter.toSeparator": "till",

@@ -20,8 +20,8 @@ function scaffold(t: TestContext, files: Record<string, string>): string {
 }

 const full = (id: string): string =>
-  `export default { apiVersion: "${HOST_API_VERSION}", nav: [{ id: "${id}:root", label: "${id}" }], ` +
-  `routes: [{ method: "GET", path: "/", handler: () => ({ html: "${id}" }) }] };`;
+  `export default { apiVersion: "${HOST_API_VERSION}", nav: [{ id: "${id}:root", label: "${id}", public: true }], ` +
+  `routes: [{ method: "GET", path: "/", public: true, handler: () => ({ html: "${id}" }) }] };`;

 test("a missing plugins/ dir means zero plugins, not an error (clean clone)", async () => {
  assert.deepEqual(await discoverPlugins({ dir: join(tmpdir(), "pp-does-not-exist-xyz") }), []);
@@ -62,6 +62,15 @@ const badCases: Array<{ name: string; files: Record<string, string>; match: RegE
  { name: "duplicate nav id across plugins", files: { "a/plugin.ts": full("a").replace("a:root", "dup"), "b/plugin.ts": full("b").replace("b:root", "dup") }, match: /nav id "dup"/ },
  { name: "a route marked public AND permission is contradictory", files: { "contra/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", routes: [{ method: "GET", path: "/", public: true, permission: "x:read", handler: () => ({ html: "x" }) }] };` }, match: /contra.*public.*permission/s },
  { name: "a nav node marked public AND permission is contradictory", files: { "contranav/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", nav: [{ id: "n", label: "N", public: true, permission: "x:read" }] };` }, match: /contranav.*public.*permission/s },
+  { name: "a route marked session AND permission is contradictory", files: { "contrasess/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", routes: [{ method: "GET", path: "/", session: true, permission: "x:read", handler: () => ({ html: "x" }) }] };` }, match: /contrasess.*session.*permission/s },
+  { name: "a route marked public AND session is contradictory", files: { "contrapub/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", routes: [{ method: "GET", path: "/", public: true, session: true, handler: () => ({ html: "x" }) }] };` }, match: /contrapub.*public.*session/s },
+  { name: "a route whose session flag is a truthy non-boolean is refused, not read as ungated", files: { "truthy/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", routes: [{ method: "GET", path: "/", session: "yes", handler: () => ({ html: "x" }) }] };` }, match: /truthy.*session.*true/s },
+  { name: "a nav node whose public flag is a truthy non-boolean is refused too", files: { "truthynav/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", nav: [{ id: "n", label: "N", public: 1 }] };` }, match: /truthynav.*public.*true/s },
+  { name: "a nav node marked session AND permission is contradictory", files: { "contrasessnav/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", nav: [{ id: "n", label: "N", session: true, permission: "x:read" }] };` }, match: /contrasessnav.*session.*permission/s },
+  // A gate is named, never forgotten: a route or node without one would be an open page nobody chose.
+  { name: "a route naming no gate at all is refused, not served to everyone", files: { "nogate/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", routes: [{ method: "GET", path: "/", handler: () => ({ html: "x" }) }] };` }, match: /nogate.*names no gate/s },
+  { name: "a nav node naming no gate at all is refused too — a section header says `public` outright", files: { "nogatenav/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", nav: [{ id: "n", label: "N" }] };` }, match: /nogatenav.*names no gate/s },
+  { name: "a gate set to false is refused — it reads as a gate but sets none", files: { "falsegate/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", routes: [{ method: "GET", path: "/", public: false, handler: () => ({ html: "x" }) }] };` }, match: /falsegate.*public.*true/s },
  // A permission name is <resource>:<action> wherever the manifest mentions one. Enforced here, not
  // only in the admin GUI, so it holds for a plugin installed without that GUI.
  { name: "a route gating on a bare word", files: { "bare/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", routes: [{ method: "GET", path: "/", permission: "admin", handler: () => ({ html: "x" }) }] };` }, match: /bare.*admin.*<resource>:<action>/s },
@@ -96,12 +105,19 @@ test("a discovery failure tells the operator their plugins/ copy may just be out
  });
 });

-test("a route + nav node may be marked public and load fine", async (t) => {
-  const dir = scaffold(t, { "pub/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", nav: [{ href: "/pub", id: "n", label: "N", public: true }], routes: [{ method: "GET", path: "/", public: true, handler: () => ({ html: "x" }) }] };` });
+test("a route + nav node may be marked public, or session, and load fine", async (t) => {
+  const dir = scaffold(t, {
+    "pub/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", nav: [{ href: "/pub", id: "n", label: "N", public: true }], routes: [{ method: "GET", path: "/", public: true, handler: () => ({ html: "x" }) }] };`,
+    "sess/plugin.ts": `export default { apiVersion: "${HOST_API_VERSION}", nav: [{ href: "/sess", id: "s", label: "S", session: true }], routes: [{ method: "GET", path: "/", session: true, handler: () => ({ html: "x" }) }] };`,
+  });
  const plugins = await discoverPlugins({ dir });
-  assert.equal(plugins.length, 1);
-  assert.equal(plugins[0]?.routes?.[0]?.public, true);
-  assert.equal(plugins[0]?.nav?.[0]?.public, true);
+  assert.equal(plugins.length, 2);
+  const pub = plugins.find((p) => p.id === "pub");
+  const sess = plugins.find((p) => p.id === "sess");
+  assert.equal(pub?.routes?.[0]?.public, true);
+  assert.equal(pub?.nav?.[0]?.public, true);
+  assert.equal(sess?.routes?.[0]?.session, true);
+  assert.equal(sess?.nav?.[0]?.session, true);
 });

 test("`admin` is not reserved — the admin screens ship as a drop-in plugin mounted at /admin", async (t) => {
@@ -127,7 +143,7 @@ test("a plugin may carry its own package.json, node_modules and dependencies", a
    "shop/node_modules/price-tag/package.json": `{ "name": "price-tag", "version": "1.0.0", "type": "module", "exports": "./index.js" }`,
    "shop/node_modules/price-tag/index.js": `export default (n) => \`\${n} kr\`;`,
    "shop/plugin.ts": `import { definePlugin } from "@plainpages/plugin-api";\nimport price from "price-tag";\n` +
-      `export default definePlugin({ apiVersion: "${HOST_API_VERSION}", routes: [{ method: "GET", path: "/", handler: () => ({ html: price(20) }) }] });`,
+      `export default definePlugin({ apiVersion: "${HOST_API_VERSION}", routes: [{ method: "GET", path: "/", public: true, handler: () => ({ html: price(20) }) }] });`,
  });

  const plugins = await discoverPlugins({ dir });
@@ -7,6 +7,7 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { type Gate, gatesSet } from "../auth/gate.ts";
 import { checkApiVersion, findConflicts, isValidPermissionName, isValidPluginId, RESERVED_PLUGIN_IDS, type Plugin, type PluginManifest } from "./plugin.ts";
 import { settingsDeclError } from "./settings.ts";
 import { isValidStoragePluginId, MAX_STORAGE_PLUGIN_ID_LENGTH } from "./storage.ts";
@@ -146,46 +147,43 @@ function shapeError(manifest: PluginManifest): string | null {
    const settings = settingsDeclError(manifest.settings);
    if (settings) return settings;
  }
-  // `public` and `permission` are contradictory on the same route/nav node — "open to all" vs
-  // "needs this permission". Refuse rather than silently pick one, so the author's intent is unambiguous.
  for (const route of Array.isArray(manifest.routes) ? manifest.routes : []) {
-    if (route?.public === true && route.permission != null) return `route "${route.method} ${route.path}" sets both public and permission — they are mutually exclusive`;
-  }
-  const navContradiction = findPublicNavContradiction(manifest.nav);
-  if (navContradiction) return navContradiction;
-  // Every permission name the manifest mentions — gated on or declared — must be `<resource>:<action>`.
-  // A bare word names a role, and roles are groups here (README → Naming a permission).
-  for (const route of Array.isArray(manifest.routes) ? manifest.routes : []) {
-    if (route?.permission != null && !isValidPermissionName(route.permission)) {
-      return `route "${route.method} ${route.path}" gates on "${route.permission}"; a permission name is <resource>:<action>, e.g. "things:read"`;
-    }
+    const gate = gateError(`route "${route?.method} ${route?.path}"`, route);
+    if (gate) return gate;
  }
+  const navGate = findNavGateError(manifest.nav);
+  if (navGate) return navGate;
  for (const decl of Array.isArray(manifest.permissions) ? manifest.permissions : []) {
    if (decl?.name == null || !isValidPermissionName(decl.name)) {
      return `declared permission "${decl?.name}" is not <resource>:<action>, e.g. "things:read"`;
    }
  }
-  const navPermission = findInvalidNavPermission(manifest.nav);
-  if (navPermission) return navPermission;
  return null;
 }

-// Recurse the nav fragment: a node that is both `public` and `permission`-gated is contradictory.
-function findPublicNavContradiction(nodes: PluginManifest["nav"]): string | null {
-  for (const node of Array.isArray(nodes) ? nodes : []) {
-    if (node?.public === true && node.permission != null) return `nav node "${node.label ?? node.id ?? "?"}" sets both public and permission — they are mutually exclusive`;
-    const inChild = findPublicNavContradiction(node?.children);
-    if (inChild) return inChild;
+// Every rule a declaration's gate must satisfy. Exactly one gate, always: a missing one would be an
+// open page nobody chose, and anything but `true` (a `false`, a `"yes"`) sets no gate while looking
+// like it does. A permission name is `<resource>:<action>` because a bare word names a role, and
+// roles are groups here (README → Naming a permission).
+function gateError(what: string, gate: Gate | null | undefined): string | null {
+  for (const flag of ["public", "session"] as const) {
+    const value = gate?.[flag];
+    if (value !== undefined && value !== true) return `${what} sets ${flag} to ${JSON.stringify(value)}; a gate is declared with \`true\``;
+  }
+  const gates = gatesSet(gate);
+  if (gates.length === 0) return `${what} names no gate; name exactly one — public, session or permission`;
+  if (gates.length > 1) return `${what} sets ${gates.join(" and ")}; name exactly one — public, session or permission`;
+  if (gate?.permission != null && !isValidPermissionName(gate.permission)) {
+    return `${what} gates on "${gate.permission}"; a permission name is <resource>:<action>, e.g. "things:read"`;
  }
  return null;
 }

-function findInvalidNavPermission(nodes: PluginManifest["nav"]): string | null {
+function findNavGateError(nodes: PluginManifest["nav"]): string | null {
  for (const node of Array.isArray(nodes) ? nodes : []) {
-    if (node?.permission != null && !isValidPermissionName(node.permission)) {
-      return `nav node "${node.label ?? node.id ?? "?"}" gates on "${node.permission}"; a permission name is <resource>:<action>, e.g. "things:read"`;
-    }
-    const inChild = findInvalidNavPermission(node?.children);
+    const err = gateError(`nav node "${node?.label ?? node?.id ?? "?"}"`, node);
+    if (err) return err;
+    const inChild = findNavGateError(node?.children);
    if (inChild) return inChild;
  }
  return null;
@@ -14,6 +14,8 @@ export type { RequestContext, User } from "../http/context.ts";
 export type { PageChrome } from "../ui/chrome.ts";
 export type { NavNode } from "../ui/nav.ts";
 export { can, check, GuardError, requireSession } from "../auth/guards.ts";
+// The three coarse gates a route or nav node may declare — `Route` and `NavNode` both extend it.
+export type { Gate } from "../auth/gate.ts";
 // Translation: `ctx.t` and the view-level `t(...)` do the work at runtime — these are for
 // authoring a plugin's own catalogs (plugins/<id>/i18n/<locale>.ts) and for building a translator
 // in a unit test. `PluralMessage` types a message that varies with a count.
@@ -4,13 +4,14 @@
 // A plugin's identity is its folder under plugins/: folder name = `id` (isValidPluginId), mount =
 // `/<id>`. Neither is in the manifest — the host derives them, so they can't drift or be claimed twice.

+import type { Gate } from "../auth/gate.ts";
 import type { RequestContext } from "../http/context.ts";
 import type { NavNode } from "../ui/nav.ts";
 import { envName, type SettingDecl, type SettingsOf } from "./settings.ts";
 import type { StorageCredentials } from "./storage.ts";

 // The Plainpages release this contract ships in — see README → Contract versioning.
-export const HOST_API_VERSION = "0.2.0";
+export const HOST_API_VERSION = "0.4.0";

 export type HttpMethod = "DELETE" | "GET" | "HEAD" | "PATCH" | "POST" | "PUT";

@@ -24,14 +25,10 @@ export type RouteResult =

 export type RouteHandler = (ctx: RequestContext) => Promise<RouteResult | void> | RouteResult | void;

-export interface Route {
+export interface Route extends Gate {
  handler: RouteHandler;
  method: HttpMethod;
  path: string; // relative to the plugin's mount path `/<id>`; ":name" segments → ctx.params.name
-  permission?: string; // coarse gate — the Keto Permission the caller must hold; checked before the handler runs
-  // Same as omitting `permission`, but stated outright so public is a deliberate choice rather than
-  // a forgotten gate. Mutually exclusive with `permission` (discovery refuses both).
-  public?: boolean;
 }

 // A Keto Permission this plugin gates on — declared for docs/seeding. Names are a shared global
@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import { test } from "node:test";
 import type { Plugin, Route } from "./plugin.ts";
-import { allowedMethods, isAuthorized, matchRoute } from "./router.ts";
+import { allowedMethods, matchRoute } from "./router.ts";

 const noop: Route["handler"] = () => ({ html: "x" });

@@ -54,14 +54,3 @@ test("allowedMethods lists methods at a path (GET implies HEAD); empty when the
  assert.deepEqual(allowedMethods(plugins, "/x/a"), ["GET", "HEAD", "POST"]);
  assert.deepEqual(allowedMethods(plugins, "/x/missing"), []);
 });
-
-test("isAuthorized: open routes pass; gated routes require the permission token; public is explicitly open", () => {
-  const open: Route = { handler: noop, method: "GET", path: "/" };
-  const gated: Route = { handler: noop, method: "GET", path: "/", permission: "x:read" };
-  const pub: Route = { handler: noop, method: "GET", path: "/", public: true }; // blessed public alias
-  assert.equal(isAuthorized(open, []), true);
-  assert.equal(isAuthorized(gated, []), false);
-  assert.equal(isAuthorized(gated, ["x:read"]), true);
-  assert.equal(isAuthorized(gated, ["other"]), false);
-  assert.equal(isAuthorized(pub, []), true); // open to anonymous, like omitting permission — but stated outright
-});
@@ -73,10 +73,3 @@ export function allowedMethods(plugins: Plugin[], pathname: string): string[] {
  }
  return [...methods].sort();
 }
-
-// Coarse permission gate: a route marked `public` (or one with no `permission`) is open; otherwise
-// the user's permissions (from the session JWT) must include the token. The same rule composeNav uses
-// for the menu. `public` and `permission` are mutually exclusive (discovery refuses both).
-export function isAuthorized(route: Route, permissions: string[]): boolean {
-  return route.public === true || route.permission == null || permissions.includes(route.permission);
-}
@@ -10,7 +10,7 @@ import { composeNav, type NavNode } from "./nav.ts";
 import type { Plugin } from "../plugin-host/plugin.ts";
 import { branding, shellUser, type ShellUser } from "./shell-context.ts";

-const DASHBOARD_NAV: NavNode = { href: "/dashboard", icon: "i-grid", id: "dashboard", label: "nav.dashboard" };
+const DASHBOARD_NAV: NavNode = { href: "/dashboard", icon: "i-grid", id: "dashboard", label: "nav.dashboard", session: true };

 export interface PageChrome {
  brand: { logo?: string; name: string; sub?: string };
@@ -35,8 +35,7 @@ export interface ChromeOptions {
 export function buildPluginChrome(opts: ChromeOptions): PageChrome {
  const t = opts.t ?? ENGLISH;
  const carryLocale = opts.localeHref ?? ((href: string) => href);
-  // Dashboard is gated, so an anonymous click would only dead-end at /login.
-  const fragments: NavNode[][] = opts.user ? [[DASHBOARD_NAV]] : [];
+  const fragments: NavNode[][] = [[DASHBOARD_NAV]];
  // A plugin's nav labels are keys in *its* catalog, so translate each fragment with that plugin's
  // translator before merging. composeNav then runs the core one over the result; already-translated
  // text passes through it.
@@ -44,8 +43,7 @@ export function buildPluginChrome(opts: ChromeOptions): PageChrome {
    if (p.nav?.length) fragments.push(translateNav(p.nav, opts.translatorFor?.(p.id) ?? t));
  }

-  const permissions = opts.user?.permissions ?? [];
-  const nav = composeNav(fragments, opts.menu.override, permissions, t);
+  const nav = composeNav(fragments, opts.menu.override, opts.user ?? null, t);
  if (opts.currentPath) {
    // Mark by the *best* (longest) href that is the path or a parent of it, so a sub-path like
    // /admin/users/new marks the Users base leaf (/admin/users) and the dashboard marks Dashboard.
@@ -37,6 +37,15 @@ const config = {
        options: [{ value: "engineering", label: "Engineering" }, { value: "design", label: "Design" }, { value: "oncall", label: "On-call" }],
      },
      { type: "daterange", legend: "Joined", from: { name: "joined_from", value: "2026-01-01", label: "Joined from" }, to: { name: "joined_to", value: "2026-06-14", label: "Joined to" } },
+      {
+        type: "multiselect",
+        name: "owner",
+        legend: "Owner",
+        note: "30 of 45",
+        value: ["ann"],
+        options: [{ value: "ann", label: "Ann Berg" }, { value: "bo", label: "Bo Falk" }],
+      },
+      { type: "multiselect", name: "room", legend: "Room", options: [{ value: "lab", label: "Lab" }] },
    ],
  ],
  pills: [{ label: "Team", value: "Engineering", remove: "?tag=oncall" }],
@@ -64,6 +73,14 @@ test("filter-bar renders a GET form with every control type, reflecting current
  assert.match(html, /<input type="checkbox" name="tag" value="oncall" checked>On-call/);
  assert.match(html, /<input type="checkbox" name="tag" value="design">Design/);

+  // multiselect — a disclosure: the trigger names the filter and counts what is chosen, the options
+  // are checkboxes in a fieldset the popover holds, so a long list costs one line of the bar.
+  assert.match(html, /<div class="menu"><button class="btn btn-menu" type="button" popovertarget="f-owner-menu" aria-label="Owner, 1 selected">Owner<span class="badge">1<\/span><\/button><div id="f-owner-menu" class="menu-pop left" popover>/);
+  assert.match(html, /popover><div class="menu-head">30 of 45<\/div><fieldset class="menu-field"><legend class="menu-head">Owner<\/legend><label class="menu-check"><input type="checkbox" name="owner" value="ann" checked>Ann Berg<\/label><label class="menu-check"><input type="checkbox" name="owner" value="bo">Bo Falk<\/label><\/fieldset>/);
+
+  // Nothing chosen — no badge and no count in the accessible name.
+  assert.match(html, /<button class="btn btn-menu" type="button" popovertarget="f-room-menu">Room<\/button>/);
+
  // daterange — calendar icon + two date inputs with values.
  assert.match(html, /<div class="daterange"><svg class="ico ico-sm" aria-hidden="true"><use href="#i-cal"\s*\/?><\/svg>.*?<input type="date" id="f-joined_from" name="joined_from" value="2026-01-01">.*?<span class="to" aria-hidden="true">to<\/span>.*?<input type="date" id="f-joined_to" name="joined_to" value="2026-06-14">/);

@@ -12,7 +12,7 @@ const flat = (s: string): string => s.replace(/>\s+</g, "><").replace(/\s+/g, "
 test("menu renders trigger, positioning, the item matrix and check groups", async () => {
  const html = flat(await render({
    id: "cols-menu",
-    trigger: { icon: "i-cols", text: "Columns", label: "Column settings" },
+    trigger: { count: 3, icon: "i-cols", text: "Columns", label: "Column settings" },
    align: "left", up: true, width: 240,
    items: [
      { head: "Actions" },
@@ -30,7 +30,7 @@ test("menu renders trigger, positioning, the item matrix and check groups", asyn

  // Trigger: icon + text + aria-label, wired to the panel by id; popover carries align/up + width.
  // The panel is the trigger's next sibling inside the wrapper — the CSS open state reads that.
-  assert.match(html, /<div class="menu"><button class="btn" type="button" popovertarget="cols-menu" aria-label="Column settings"><svg class="ico ico-sm"><use href="#i-cols"\s*\/?><\/svg>Columns<\/button><div id="cols-menu" class="menu-pop left up" popover style="min-width:240px">/);
+  assert.match(html, /<div class="menu"><button class="btn" type="button" popovertarget="cols-menu" aria-label="Column settings"><svg class="ico ico-sm"><use href="#i-cols"\s*\/?><\/svg>Columns<span class="badge">3<\/span><\/button><div id="cols-menu" class="menu-pop left up" popover style="min-width:240px">/);

  // Item matrix: head, button-with-icon, link, separator, danger button.
  assert.match(html, /<div class="menu-head">Actions<\/div>/);
@@ -1,7 +1,12 @@
 import assert from "node:assert/strict";
 import { test } from "node:test";
+import type { User } from "../http/context.ts";
 import { composeNav, type NavNode } from "./nav.ts";

+function viewer(...permissions: string[]): User {
+  return { email: "viewer@example.test", id: "01a06091-ba9f-765f-abf4-b5144c314bc7", permissions };
+}
+
 // Two plugin fragments; ids let the override target nodes, `permission` gates per permission.
 const fragments: NavNode[][] = [
  [{
@@ -15,7 +20,7 @@ const fragments: NavNode[][] = [
 ];

 test("composeNav merges fragments, filters by permission, and emits clean render nodes", () => {
-  const tree = composeNav(fragments, {}, ["scheduling:read"]);
+  const tree = composeNav(fragments, {}, viewer("scheduling:read"));

  // Reports gone (no reports:read), Manage gone (no scheduling:admin), header kept with Shifts.
  // Output carries no `id`/`permission` and omits absent fields — ready for nav-tree.ejs.
@@ -30,7 +35,7 @@ test("composeNav drops gated subtrees, empty headers, and (with no permissions)
    { id: "admin", label: "Admin", permission: "users:read", children: [{ href: "/u", id: "u", label: "Users" }] },
    { id: "free", label: "Free", children: [{ href: "/d", id: "d", label: "Docs" }] },
  ]];
-  assert.deepEqual(composeNav(gatedHeader, {}, []), [
+  assert.deepEqual(composeNav(gatedHeader, {}, viewer()), [
    { label: "Free", children: [{ href: "/d", label: "Docs" }] },
  ]);

@@ -39,26 +44,31 @@ test("composeNav drops gated subtrees, empty headers, and (with no permissions)
    { id: "sec", label: "Section", children: [{ href: "/x", id: "x", label: "X", permission: "x:read" }] },
    { href: "/hub", id: "hub", label: "Hub", children: [{ href: "/y", id: "y", label: "Y", permission: "y:read" }] },
  ]];
-  assert.deepEqual(composeNav(emptyHeader, {}, []), [{ href: "/hub", label: "Hub" }]);
+  assert.deepEqual(composeNav(emptyHeader, {}, viewer()), [{ href: "/hub", label: "Hub" }]);

  // No fragments / no permissions → empty tree, never throws.
  assert.deepEqual(composeNav(), []);
 });

-test("composeNav keeps a node marked public for everyone — the blessed public alias", () => {
-  // A header with one public child + one gated child: with no permissions, the public child keeps the
-  // header alive (the gated child is filtered out) — so a plugin can show a public menu option to all.
+test("composeNav shows a public node to everyone and a session node to any signed-in user", () => {
+  // A header with a public child, a session child and a gated child: the public child keeps the
+  // header alive for an anonymous visitor — so a plugin can show a menu option to all.
  const frag: NavNode[][] = [[{
    icon: "i-cal", id: "sched", label: "Scheduling",
    children: [
      { href: "/scheduling", id: "overview", label: "Overview", public: true },
+      { href: "/scheduling/mine", id: "mine", label: "Mine", session: true },
      { href: "/scheduling/shifts", id: "shifts", label: "Shifts", permission: "scheduling:read" },
    ],
  }]];
-  // `public` is filter-only (like id/permission) — never rendered into the output node.
-  assert.deepEqual(composeNav(frag, {}, []), [
+  // `public`/`session` are filter-only (like id/permission) — never rendered into the output node.
+  assert.deepEqual(composeNav(frag, {}, null), [
    { icon: "i-cal", label: "Scheduling", children: [{ href: "/scheduling", label: "Overview" }] },
  ]);
+  // Signed in with no permission at all: the session node appears, the permission-gated one does not.
+  assert.deepEqual(composeNav(frag, {}, viewer()), [
+    { icon: "i-cal", label: "Scheduling", children: [{ href: "/scheduling", label: "Overview" }, { href: "/scheduling/mine", label: "Mine" }] },
+  ]);
 });

 test("composeNav applies the override: rename, group, order, hide (then filters)", () => {
@@ -74,7 +84,7 @@ test("composeNav applies the override: rename, group, order, hide (then filters)
    groups: [{ icon: "i-box", id: "grp", label: "Group", open: true, children: ["b", "c"] }], // wrap b+c
    order: ["grp", "a"],                                     // grp before the lone a
    hide: ["c"],                                             // remove c from inside the group
-  }, ["secrets:read"]);
+  }, viewer("secrets:read"));

  // grp emitted (b only, c hidden), reordered before a; Secret kept now that permission "secrets:read" is present.
  assert.deepEqual(tree, [
@@ -1,12 +1,14 @@
 // composeNav: merge each plugin's nav fragment into one tree, apply the central override, then
-// permission-filter per user. Pure and I/O-free — menu gating reads the JWT `permissions` claim,
-// never Keto. A node is visible iff it is `public`, declares no `permission`, or the user holds that
-// name; a gated header hides its whole subtree, and a pure header left with no children is dropped.
+// filter per user. Pure and I/O-free — menu gating reads the JWT `permissions` claim, never Keto.
+// A node is visible iff `allows` passes its gate; a gated header hides its whole subtree, and a pure
+// header left with no children is dropped.

+import { allows, type Gate } from "../auth/gate.ts";
+import type { User } from "../http/context.ts";
 import { ENGLISH } from "../i18n/english.ts";
 import type { Translate } from "../i18n/translate.ts";

-export interface NavNode {
+export interface NavNode extends Gate {
  id?: string; // stable key for override targeting; stripped from the rendered tree
  children?: NavNode[];
  count?: number;
@@ -15,12 +17,10 @@ export interface NavNode {
  icon?: string;
  label: string;
  open?: boolean;
-  permission?: string; // required permission token; consumed by the filter, never rendered
-  public?: boolean; // show to everyone, signed in or not — the blessed alias for "no permission", stated outright; consumed by the filter, never rendered. Mutually exclusive with permission (discovery refuses both).
 }

 // Central override (config/menu.ts). Targets nodes by `id`; applied rename → group →
-// order → hide, then the per-user permission filter runs last.
+// order → hide, then the per-user gate filter runs last.
 export interface NavOverride {
  groups?: NavGroupSpec[]; // wrap top-level nodes (by id) under a new header
  hide?: string[]; // remove nodes by id, at any depth (incl. a group's id)
@@ -39,7 +39,7 @@ export interface NavGroupSpec {
 export function composeNav(
  fragments: NavNode[][] = [],
  override: NavOverride = {},
-  permissions: string[] = [],
+  user: User | null = null,
  t: Translate = ENGLISH,
 ): NavNode[] {
  let nodes: NavNode[] = fragments.flat();
@@ -47,7 +47,7 @@ export function composeNav(
  if (override.groups?.length) nodes = applyGroups(nodes, override.groups);
  if (override.order?.length) nodes = applyOrder(nodes, override.order);
  if (override.hide?.length) nodes = hideTree(nodes, new Set(override.hide));
-  return filterByRoles(nodes, new Set(permissions)).map((node) => toRenderNode(node, t));
+  return filterByGate(nodes, user).map((node) => toRenderNode(node, t));
 }

 function renameTree(nodes: NavNode[], rename: Record<string, string>): NavNode[] {
@@ -104,19 +104,19 @@ function hideTree(nodes: NavNode[], hide: Set<string>): NavNode[] {
  return out;
 }

-function filterByRoles(nodes: NavNode[], permissions: Set<string>): NavNode[] {
+function filterByGate(nodes: NavNode[], user: User | null): NavNode[] {
  const out: NavNode[] = [];
  for (const n of nodes) {
-    if (n.public !== true && n.permission != null && !permissions.has(n.permission)) continue; // gated → drop node + subtree (public always shows)
+    if (!allows(n, user)) continue; // gated → drop node + subtree
    if (!n.children) { out.push(n); continue; }
-    const children = filterByRoles(n.children, permissions);
+    const children = filterByGate(n.children, user);
    if (children.length === 0 && n.href == null) continue; // empty pure header → drop
    out.push({ ...n, children });
  }
  return out;
 }

-// Strip the helper-only fields (id/permission) and drop absent ones, so the tree is exactly
+// Strip the helper-only fields (id and the gate) and drop absent ones, so the tree is exactly
 // what nav-tree.ejs reads. Labels (a manifest's, or the central override's rename) pass through
 // `t` on the way out: a label that names a catalog key is translated, any other renders as written.
 function toRenderNode(n: NavNode, t: Translate): NavNode {
@@ -20,6 +20,7 @@
 - [ ] Decide what `ICON_NAMES` (`src/ui/icons.ts`) actually is. `i-chart`, `i-copy`, `i-download` and `i-sliders` have no caller anywhere — so either they go, or the comment should say the palette is curated and may carry an id ahead of its first use. Not cosmetic: the sprite is inlined into every page, and the rule decides whether a future removal is routine cleanup or a plugin-facing regression.
 - [ ] Decide (once) whether the CSRF token staying unbound to `sub`/session is accepted. `src/auth/csrf.ts` signs `<nonce>.<HMAC(secret, nonce)>` with no session binding, so any validly-signed token passes for any user — an attacker who can write cookies on the origin can fix a token they know. Standard for unbound signed double-submit and plausibly fine behind `SameSite=Lax` + HSTS. Accepted ⇒ record it in AGENTS.md and README → Security model; not accepted ⇒ bind the nonce to `sub`.
 - [ ] Verify the documented Docker commands on macOS and fix whatever misbehaves — **macOS is a supported dev host**, but nothing here has been run on one. Two suspects, both from the `--user "$(id -u):$(id -g)"` idiom: a macOS `id -g` is `20`, which is `dialout` inside the noble image rather than a user group, and Docker Desktop remaps bind-mount ownership in its own VM layer. The same question covers rootless Docker, where README already says to *drop* the flag.
+- [ ] Map Kratos' 401 on a self-service flow init, so an anonymous `GET /settings` with no `?flow` renders instead of 500ing. `flowPage` (`src/auth/routes.ts`) maps 403/404/410 → restart the flow, 400 `session_already_available` → `/auth/complete`, and ≥500 → the themed 503, then rethrows everything else — and Kratos answers the settings-flow init with 401 when there is no session. `/settings` is correctly `public` (the recovery flow lands there with a live Kratos session but no app JWT), so the gate is not the fix: a 401 should redirect to `/login` with the page as `return_to`. No E2E covers an anonymous hit on a flow page that needs a session.

 ### Architectural review findings (2026-07-02)

@@ -14,7 +14,7 @@
        <p>${t("dashboard.starter.intro")}</p>
        <p>${t("dashboard.starter.replace")}</p>
 <pre class="code-block"><code>export default definePlugin({
-  apiVersion: "0.2.0",
+  apiVersion: "0.4.0",
  // view names plugins/&lt;id&gt;/views/&lt;view&gt;.ejs, rendered in this same shell
  dashboard: (ctx) =&gt; ({ view: "dashboard", data: { /* … */ } }),
 });</code></pre>
@@ -2,12 +2,15 @@
  Filter bar: a real GET form so filtering is server-side and zero-JS. Config:
    rows: Control[][]            rows of controls, laid out left→right
    pills, clearHref, label, action, applyLabel
-  Control.type ∈ search | segmented | select | chips | daterange | spacer.
-    search    { name, placeholder?, value?, label? }
-    segmented { name, legend?, value?, options:{value,label,count?}[] }      (radios)
-    select    { name, label, value?, options:{value,label}[] }
-    chips     { name, legend?, value?:string[], options:{value,label}[] }    (checkboxes)
-    daterange { legend?, from:{name,value?,label?}, to:{name,value?,label?} }
+  Control.type ∈ search | segmented | select | chips | multiselect | daterange | spacer.
+    search      { name, placeholder?, value?, label? }
+    segmented   { name, legend?, value?, options:{value,label,count?}[] }      (radios)
+    select      { name, label, value?, options:{value,label}[] }
+    chips       { name, legend?, value?:string[], options:{value,label}[] }    (checkboxes)
+    multiselect { name, legend?, note?, value?:string[], options:{value,label}[] }  (checkboxes in a popover)
+    daterange   { legend?, from:{name,value?,label?}, to:{name,value?,label?} }
+  chips and multiselect are the same checkboxes on the same parameter: on the bar, or behind a
+  button once the list is too long to lay there.
  The form is a GET, which replaces the whole query string — so the visitor's chosen language rides
  along as a hidden input, and every href here (pills, clear) is run through localeHref.
 %><%
@@ -34,6 +37,16 @@
    <span class="filter"><label class="sr-only" for="f-<%= c.name %>"><%= c.label %></label><span class="select"><select id="f-<%= c.name %>" name="<%= c.name %>"><% c.options.forEach((o) => { %><option value="<%= o.value %>"<% if (eq(c.value, o.value)) { %> selected<% } %>><%= o.label %></option><% }) %></select></span></span>
 <% } else if (c.type === "chips") { -%>
    <fieldset class="filter-field"><legend class="sr-only"><%= c.legend || c.name %></legend><span class="filter-legend" aria-hidden="true"><%= c.legend || c.name %></span><div class="chips"><% (c.options).forEach((o) => { const on = (c.value || []).map(String).includes(String(o.value)); %><label class="chip"><span class="chip-dot" aria-hidden="true"></span><input type="checkbox" name="<%= c.name %>" value="<%= o.value %>"<% if (on) { %> checked<% } %>><%= o.label %></label><% }) %></div></fieldset>
+<% } else if (c.type === "multiselect") { const legend = c.legend || c.name; const on = (c.value || []).map(String); -%>
+    <%- include("menu", {
+      id: "f-" + c.name + "-menu",
+      align: "left", kebab: false, up: false, width: null, // explicit: EJS would otherwise inherit the page's own
+      trigger: { class: "btn btn-menu", count: on.length || null, label: on.length ? t("filter.selected", { count: on.length, label: legend }) : null, text: legend },
+      items: [
+        ...(c.note ? [{ head: c.note }] : []),
+        { group: { legend, name: c.name, options: c.options.map((o) => ({ checked: on.includes(String(o.value)), label: o.label, value: o.value })) } },
+      ],
+    }) %>
 <% } else if (c.type === "daterange") { -%>
    <fieldset class="filter-field"><legend class="sr-only"><%= c.legend || t("filter.dateRange") %></legend><span class="filter-legend" aria-hidden="true"><%= c.legend || t("filter.dateRange") %></span><div class="daterange"><svg class="ico ico-sm" aria-hidden="true"><use href="#i-cal"/></svg><label class="sr-only" for="f-<%= c.from.name %>"><%= c.from.label || t("filter.from") %></label><input type="date" id="f-<%= c.from.name %>" name="<%= c.from.name %>"<% if (c.from.value) { %> value="<%= c.from.value %>"<% } %>><span class="to" aria-hidden="true"><%= t("filter.toSeparator") %></span><label class="sr-only" for="f-<%= c.to.name %>"><%= c.to.label || t("filter.to") %></label><input type="date" id="f-<%= c.to.name %>" name="<%= c.to.name %>"<% if (c.to.value) { %> value="<%= c.to.value %>"<% } %>></div></fieldset>
 <% } else if (c.type === "spacer") { -%>
@@ -7,7 +7,7 @@
  Config:
    id      string          REQUIRED — the panel's id and the trigger's popovertarget. Name it for what
                            the menu is (`locale-menu`); it must be unique on the page.
-    trigger { class?(="btn", "" ⇒ none) · label?(aria-label) · icon? · text? · html?(raw inner, wins) }
+    trigger { class?(="btn", "" ⇒ none) · label?(aria-label) · icon? · text? · count?(badge) · html?(raw inner, wins) }
    align?  "left"          left-align the popover (default right)
    up?     boolean         open upward (footer menus)
    kebab?  boolean         bare kebab trigger (adds .kebab)
@@ -26,7 +26,7 @@
  const popCls = "menu-pop" + (locals.align === "left" ? " left" : "") + (locals.up ? " up" : "");
  const width = locals.width;
 -%>
-<div class="menu"><button<% if (btnCls) { %> class="<%= btnCls %>"<% } %> type="button" popovertarget="<%= locals.id %>"<% if (trigger.label) { %> aria-label="<%= trigger.label %>"<% } %>><% if (trigger.html != null) { %><%- trigger.html %><% } else { if (trigger.icon) { %><svg class="ico ico-sm"><use href="#<%= trigger.icon %>"/></svg><% } if (trigger.text) { %><%= trigger.text %><% } } %></button><div id="<%= locals.id %>" class="<%= popCls %>" popover<% if (width != null) { %> style="min-width:<%= typeof width === "number" ? width + "px" : width %>"<% } %>>
+<div class="menu"><button<% if (btnCls) { %> class="<%= btnCls %>"<% } %> type="button" popovertarget="<%= locals.id %>"<% if (trigger.label) { %> aria-label="<%= trigger.label %>"<% } %>><% if (trigger.html != null) { %><%- trigger.html %><% } else { if (trigger.icon) { %><svg class="ico ico-sm"><use href="#<%= trigger.icon %>"/></svg><% } if (trigger.text) { %><%= trigger.text %><% } if (trigger.count != null) { %><span class="badge"><%= trigger.count %></span><% } } %></button><div id="<%= locals.id %>" class="<%= popCls %>" popover<% if (width != null) { %> style="min-width:<%= typeof width === "number" ? width + "px" : width %>"<% } %>>
 <% items.forEach((it) => { -%>
 <% if (it.head != null) { -%>
  <div class="menu-head"><%= it.head %></div>
Author	SHA1	Message	Date
lilleman	25239cd978	Say what the comment is for, not what the bug was CI / full-gate (push) Successful in 2m47s Details	2026-09-09 16:05:20 +02:00
lilleman	8128ec2f42	Keep the reader in place when the drawer closes, and stop the CSS promising a header it deleted CI / full-gate (push) Successful in 2m54s Details	2026-09-09 15:52:46 +02:00
lilleman	f959404c6f	A page is a document: drop the sticky chrome and the bounded-frame opt-out CI / full-gate (push) Successful in 2m49s Details	2026-09-09 15:26:45 +02:00
lilleman	33065afd18	Point the contract doc at a heading that exists, and let the table say which axes it scrolls CI / full-gate (push) Successful in 2m48s Details	2026-09-09 15:16:36 +02:00
lilleman	09d86eddad	Make the scroll-lock test able to fail, and name the tell a broken chain actually shows CI / full-gate (push) Successful in 2m49s Details	2026-09-09 15:01:15 +02:00
lilleman	9fbda833d5	One home per fact: cut the copied rationale, and give the seam test room to mean something CI / full-gate (push) Successful in 2m57s Details	2026-09-09 14:41:19 +02:00
lilleman	098359e298	Name the table's local after the class it applies, and let a broken chain show itself CI / full-gate (push) Successful in 2m51s Details	2026-09-09 14:18:36 +02:00
lilleman	4ae9326741	Split the fill seam where ownership splits: the shell bounds, the page fills CI / full-gate (push) Successful in 3m1s Details	2026-09-09 14:11:10 +02:00
lilleman	11ba843ab1	Name the bounded frame: fill:true on the shell, and the contract minor that ships it CI / full-gate (push) Successful in 2m52s Details	2026-09-08 17:27:21 +02:00
lilleman	706abf1204	Scroll the document by default; a bounded region is a page's own opt-in CI / full-gate (push) Successful in 2m46s Details	2026-09-07 07:57:33 +02:00
renovate-bot	f5c3d93837	Update axllent/mailpit Docker tag to v1.31.1 CI / full-gate (push) Successful in 2m46s Details Mirror / github-mirror (push) Successful in 3s Details	2026-09-06 04:17:53 +00:00
renovate-bot	ea320f6a28	Update Playwright to v1.63.0 CI / full-gate (push) Successful in 3m47s Details Mirror / github-mirror (push) Successful in 2s Details	2026-09-05 04:18:23 +00:00
renovate-bot	d3151f222a	Update renovate/renovate Docker tag to v44.61.6 CI / full-gate (push) Successful in 5m14s Details Mirror / github-mirror (push) Successful in 4s Details	2026-09-04 04:18:28 +00:00
lilleman	54956fe627	Release the gate change as 0.3.0, and start a changelog CI / full-gate (push) Successful in 2m50s Details Mirror / github-mirror (push) Successful in 4s Details Release / retag-image (push) Successful in 22s Details Release / publish-overview (push) Successful in 3s Details	2026-09-03 17:58:09 +02:00
lilleman	9912dd64f1	Offer a signed-in visitor the page they can reach, and say where the assignee join belongs CI / full-gate (push) Successful in 2m53s Details Mirror / github-mirror (push) Successful in 4s Details	2026-09-03 17:22:49 +02:00
lilleman	76fa6a96ea	Merge branch 'main' into session-gate CI / full-gate (push) Successful in 2m51s Details	2026-09-03 12:00:18 +02:00
renovate-bot	e81c281c1a	Update renovate/renovate Docker tag to v44.59.3 CI / full-gate (push) Successful in 2m50s Details Mirror / github-mirror (push) Successful in 4s Details	2026-09-03 04:18:29 +00:00
lilleman	1fb19f6c26	Merge branch 'main' into session-gate CI / full-gate (push) Successful in 2m53s Details	2026-09-02 19:51:46 +02:00
lilleman	18dc4f3136	Refuse an emailless identity where the session is minted, and rows the upstream should not have sent CI / full-gate (push) Successful in 2m53s Details	2026-09-02 18:24:56 +02:00
lilleman	390ac5f112	Say where the one-gate rule applies, and record why allows stays open	2026-09-02 14:03:06 +02:00
lilleman	6a0d11d9d3	Name exactly one gate on every declaration, and own a shift by identity id	2026-09-02 14:00:04 +02:00
lilleman	dfb043c3bd	Read one gate everywhere, and check a declaration's gate in one pass	2026-09-02 12:32:51 +02:00
lilleman	5d1e8f2309	Say the gate rule once, and key the example's shifts by the identifier it scopes on CI / full-gate (push) Successful in 3m4s Details	2026-09-02 08:50:44 +02:00
lilleman	bf146c07e7	Bump the contract for the new gate, and close the ways it could read as open CI / full-gate (push) Successful in 2m45s Details	2026-09-02 08:36:16 +02:00
lilleman	a17ed96b54	Say gate where the code now gates, in the two contracts that still said permission CI / full-gate (push) Failing after 2m38s Details	2026-09-02 08:17:10 +02:00
lilleman	c7e6d66750	Scope My shifts at the upstream, and give Route and NavNode one gate declaration CI / full-gate (push) Successful in 2m56s Details	2026-09-02 08:15:08 +02:00
renovate-bot	a113d14e42	Update renovate/renovate Docker tag to v44.56.3 CI / full-gate (push) Successful in 2m50s Details Mirror / github-mirror (push) Successful in 4s Details	2026-09-02 05:55:37 +00:00
lilleman	8da75b4ca7	Gate a route or nav node on a session, not only a permission CI / full-gate (push) Successful in 3m6s Details	2026-09-02 07:36:08 +02:00
renovate-bot	4ad8653a06	Update renovate/renovate Docker tag to v44.53.0 CI / full-gate (push) Successful in 2m52s Details Mirror / github-mirror (push) Successful in 3s Details	2026-09-01 06:03:12 +00:00
renovate-bot	cfcb7a7dc2	Update renovate/renovate Docker tag to v44.52.1 CI / full-gate (push) Successful in 2m49s Details Mirror / github-mirror (push) Successful in 3s Details	2026-08-31 04:18:59 +00:00
renovate-bot	814005d267	Update renovate/renovate Docker tag to v44.51.2 CI / full-gate (push) Successful in 2m49s Details Mirror / github-mirror (push) Successful in 3s Details	2026-08-30 04:18:55 +00:00
renovate-bot	d7bc7fbd36	Update renovate/renovate Docker tag to v44.50.3 CI / full-gate (push) Successful in 4m6s Details Mirror / github-mirror (push) Successful in 3s Details	2026-08-29 10:42:26 +00:00
renovate-bot	7bde22713f	Update Node.js to v24.20.0 CI / full-gate (push) Successful in 3m13s Details Mirror / github-mirror (push) Successful in 4s Details Release-Bump: minor	2026-08-28 04:18:08 +00:00
renovate-bot	566c286f87	Update renovate/renovate Docker tag to v44.46.4 CI / full-gate (push) Successful in 2m53s Details Mirror / github-mirror (push) Successful in 4s Details	2026-08-27 04:18:29 +00:00
lilleman	0ad4c6b09c	Say what the browser gives a popover trigger, and pin the part all engines can prove CI / full-gate (push) Successful in 2m51s Details Mirror / github-mirror (push) Successful in 3s Details	2026-08-26 09:10:46 +02:00
renovate-bot	ebc1398906	Update renovate/renovate Docker tag to v44.45.4 CI / full-gate (push) Successful in 2m51s Details Mirror / github-mirror (push) Successful in 4s Details	2026-08-26 04:18:07 +00:00
lilleman	cf48b3014c	Merge branch 'main' into renovate/renovate-renovate-44.x CI / full-gate (push) Successful in 2m50s Details Mirror / github-mirror (push) Successful in 4s Details	2026-08-25 15:09:02 +02:00
lilleman	43bb004ae7	Keep the control-choosing rule where a caller picks one CI / full-gate (push) Successful in 2m50s Details Mirror / github-mirror (push) Successful in 3s Details	2026-08-25 09:38:33 +02:00
lilleman	f4693af3df	Let a multi-select say what a capped list left out, inside the panel CI / full-gate (push) Successful in 2m52s Details	2026-08-25 09:15:30 +02:00
lilleman	c702a347dc	Offer a long filter list as a popover multi-select instead of a wall of chips CI / full-gate (push) Successful in 2m51s Details	2026-08-25 09:10:23 +02:00
renovate-bot	fb480973b7	Update renovate/renovate Docker tag to v44.41.1 CI / full-gate (push) Successful in 2m51s Details	2026-08-25 04:18:24 +00:00
renovate-bot	26ba278eb3	Update dependency lucide-static to v1.34.0 CI / full-gate (push) Successful in 3m0s Details Mirror / github-mirror (push) Successful in 3s Details Release-Bump: minor	2026-08-25 04:18:15 +00:00
renovate-bot	952af3f107	Update renovate/renovate Docker tag to v44.39.3 CI / full-gate (push) Successful in 2m50s Details Mirror / github-mirror (push) Successful in 2s Details	2026-08-24 05:41:22 +00:00