Colour themes, defaulting to gruvbox dark

Every colour was a 256-colour ANSI index hardcoded in styles.go, so changing
the palette meant editing the styles themselves. This puts a semantic token set
between the two: styles name roles, a theme supplies the colours.

internal/theme holds the twelve tokens, the two built-ins (gruvbox-dark, the
new default, and gruvbox-light) and the loader for user themes in
~/.config/terdut-tui/themes/. A user file may 'extends:' a built-in and
override only what it cares about, and may shadow a built-in name to tweak it
in place. Unknown keys, malformed colours and incomplete themes are refused
with a message naming what went wrong.

Colours are truecolor hex now: lipgloss downsamples for 256- and 16-colour
terminals and honours NO_COLOR, so themes carry no fallbacks of their own.
An ANSI index is still accepted for anyone who would rather follow their
terminal's own palette.

The 21 package-level style vars become a Styles struct on the Model, which is
what rule 3 asked for all along; the four free functions in view.go take one as
their first argument. The embedded bubbles components are restyled from the
same tokens — otherwise a theme would leave a pink selected row and grey help
text behind. Note that the table's Cell style deliberately keeps no foreground:
bubbles renders cells before wrapping the row in Selected, so a colour there
cuts the selection highlight short.

.gitea/workflows/ci.yaml

@@ -0,0 +1,89 @@
+name: CI
+
+# The release workflow gates a tag, which is late: a broken commit sits green until
+# somebody decides to publish. This runs the same checks on the way in.
+#
+# push is scoped to main so that a branch pushed as part of a pull request is not checked
+# twice.
+#
+# No actions/checkout, deliberately -- same as the terdut-server, letsvisit and charts
+# workflows. The runner image is ubuntu:22.04 whose `nodejs` package is Node 12, and
+# actions/checkout@v4 is built with ES2022 static initialiser blocks, so it dies with
+# `SyntaxError: Unexpected token '{'` before running. Cloning with git directly avoids JS
+# actions entirely. This repo is public, so the clone needs no credential at all.
+#
+# `${{ }}` values are passed through `env:` and referenced as quoted shell variables: a
+# ref name is attacker-influenced by anyone who can push a branch or open a PR, and
+# expanding one straight into `run:` is a shell-injection vector.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# A rapid series of pushes only needs the last one checked.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REPO_URL: https://git.ryuvia.com/niklas/terdut-tui.git
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      # act_runner destroys a job's own volumes when it finishes, so without these every
+      # run re-downloads the whole module graph. The names must appear in the runner's
+      # container.valid_volumes allowlist (charts/act-runner in the k8s repo); unlisted
+      # volumes are dropped silently, so a workflow that looks correct can still be
+      # running uncached.
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ -n "$HEAD_SHA" ]; then
+            # A pull_request ref_name is "<n>/merge", which is not a fetchable branch.
+            git clone "$REPO_URL" .
+            git checkout -q "$HEAD_SHA"
+          else
+            git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+          fi
+
+      # This exists because `go vet` does not look at import order: the move to
+      # git.ryuvia.com rewrote every import path without re-sorting, the new path sorts
+      # before github.com/..., and both repos sat unformatted through a green CI run and
+      # a release before anyone noticed.
+      #
+      # Both of gofmt's failure modes need handling, and they are not alike. A file that
+      # is merely misformatted is listed on stdout with exit 0 -- so the failure has to
+      # be raised by hand. A file that does not parse is the opposite: nothing on stdout
+      # and exit 2, which a naive `[ -n "$unformatted" ]` reads as success. The first
+      # draft of this step had exactly that hole.
+      - name: Format
+        run: |
+          if ! unformatted=$(gofmt -l .); then
+            echo "::error::gofmt could not parse the tree"
+            gofmt -l .    # re-run unredirected so the parse errors reach the log
+            exit 1
+          fi
+          if [ -n "$unformatted" ]; then
+            echo "::error::not gofmt'd:"
+            echo "$unformatted"
+            gofmt -d .
+            exit 1
+          fi
+
+      - name: Vet
+        run: go vet ./...
+
+      # Covers the API client against a stub server, the Update state machine, and View
+      # rendering -- all three are pure enough to test without a terminal.
+      - name: Test
+        run: go test ./...

.gitea/workflows/release.yaml

@@ -0,0 +1,142 @@
+name: Release
+
+# Checkout, interpolation and caching conventions match ci.yaml -- see the header there
+# for why there are no JS actions and why every `${{ }}` goes through `env:`.
+#
+# There is no upload-artifact/download-artifact equivalent here (both are JS actions, and
+# this Gitea has no artifact store wired up), so the job that builds the binaries is also
+# the job that publishes them. Nothing is handed between jobs.
+#
+# The asset names matter beyond being tidy: internal/updater looks for exactly
+# terdut-tui-<tag>-<goos>-<goarch> in the latest release and reports every available name
+# when it cannot find one. Renaming the pattern here breaks self-update for every
+# installed binary.
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REPO_URL: https://git.ryuvia.com/niklas/terdut-tui.git
+  API: https://git.ryuvia.com/api/v1/repos/niklas/terdut-tui
+
+jobs:
+  # Gates the build, so a tag that fails here publishes no binaries.
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+
+      # This exists because `go vet` does not look at import order: the move to
+      # git.ryuvia.com rewrote every import path without re-sorting, the new path sorts
+      # before github.com/..., and both repos sat unformatted through a green CI run and
+      # a release before anyone noticed.
+      #
+      # Both of gofmt's failure modes need handling, and they are not alike. A file that
+      # is merely misformatted is listed on stdout with exit 0 -- so the failure has to
+      # be raised by hand. A file that does not parse is the opposite: nothing on stdout
+      # and exit 2, which a naive `[ -n "$unformatted" ]` reads as success. The first
+      # draft of this step had exactly that hole.
+      - name: Format
+        run: |
+          if ! unformatted=$(gofmt -l .); then
+            echo "::error::gofmt could not parse the tree"
+            gofmt -l .    # re-run unredirected so the parse errors reach the log
+            exit 1
+          fi
+          if [ -n "$unformatted" ]; then
+            echo "::error::not gofmt'd:"
+            echo "$unformatted"
+            gofmt -d .
+            exit 1
+          fi
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
+  binaries:
+    needs: test
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+
+      - name: Build every target
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -eu
+          mkdir -p dist
+          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
+            GOOS="${target%/*}"
+            GOARCH="${target#*/}"
+            out="dist/terdut-tui-${REF_NAME}-${GOOS}-${GOARCH}"
+            echo "building $out"
+            GOOS="$GOOS" GOARCH="$GOARCH" go build \
+              -ldflags "-X main.version=${REF_NAME}" \
+              -o "$out" .
+          done
+
+      # Creating the release is made idempotent rather than assumed-new: a re-run of a
+      # failed release must not die on the release that already exists. Assets are
+      # replaced the same way, so a re-run repairs a partial upload.
+      - name: Publish the release
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          auth="Authorization: token $TOKEN"
+
+          body=$(curl -sf -H "$auth" "$API/releases/tags/$REF_NAME" || true)
+          if [ -z "$body" ]; then
+            body=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
+              -d "{\"tag_name\":\"$REF_NAME\",\"name\":\"$REF_NAME\"}" \
+              "$API/releases")
+          fi
+
+          # The release object serialises `id` first, so the first match is the release's
+          # own id and not one of the nested author/asset ids.
+          release_id=$(printf '%s' "$body" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+          [ -n "$release_id" ] || { echo "::error::could not determine release id"; exit 1; }
+          echo "release id $release_id"
+
+          for f in dist/*; do
+            name=$(basename "$f")
+            # Drop an existing asset of the same name first: Gitea happily stores two
+            # attachments with one name, and the updater matches by name.
+            old=$(curl -sf -H "$auth" "$API/releases/$release_id/assets" \
+                  | tr '}' '\n' | grep "\"name\":\"$name\"" \
+                  | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2 || true)
+            if [ -n "$old" ]; then
+              curl -sf -X DELETE -H "$auth" "$API/releases/$release_id/assets/$old" || true
+            fi
+            echo "uploading $name"
+            curl -sf -X POST -H "$auth" -F "attachment=@$f" \
+              "$API/releases/$release_id/assets?name=$name" > /dev/null
+          done

CLAUDE.md

@@ -1,6 +1,19 @@
 # terdut-tui
 
-TUI client for [terdut-server](https://github.com/terdut-server), a Prometheus Alertmanager receiver and on-call scheduler.
+TUI client for [terdut-server](https://git.ryuvia.com/niklas/terdut-server), a Prometheus Alertmanager receiver and incident manager. Requires server **v0.4.0+**.
+
+## Domain model
+
+The server splits alerts from incidents, and this client mirrors it:
+
+- **Alert** — Alertmanager's record. Firing or resolved, read-only, no workflow state.
+- **Incident** — the work item: triggered → acknowledged → resolved, with an
+  assignee, snooze, notes and an append-only timeline. Many alerts to one incident,
+  correlated by Alertmanager's `groupKey`.
+
+All user actions target incidents. Two server behaviours the UI has to respect:
+manual resolve is **terminal** (hence the confirmation prompt), and snooze is the
+non-destructive "not now" alternative.
 
 ## Tech stack
 
@@ -15,12 +28,13 @@ TUI client for [terdut-server](https://github.com/terdut-server), a Prometheus A
 main.go                      CLI entry point: flags, config load, health check, start TUI
 internal/api/client.go       REST API client — one method per endpoint
 internal/config/config.go    Config loader (~/.config/terdut-tui/config.yaml)
+internal/theme/              Colour themes: semantic tokens, built-ins, user file loader
 internal/tui/                Bubbletea UI
   model.go                   Model struct, mode/section constants, Init(), tea.Cmd constructors
   update.go                  Update() — dispatch only, no API calls inline
   view.go                    View() — pure rendering
   keys.go                    keyMap (bubbles/key pattern)
-  styles.go                  All lipgloss styles
+  styles.go                  Styles struct — every lipgloss style, built from a theme
 internal/updater/updater.go  Self-update via GitHub Releases
 ```
 
@@ -30,6 +44,9 @@ internal/updater/updater.go  Self-update via GitHub Releases
 2. **`View()` is pure** — no side effects, no state mutations.
 3. **All state in `Model`** — no globals.
 4. **All styles in `styles.go`** — never use lipgloss inline in `view.go`.
+   Styles live on `Model.styles`, built once by `newStyles(theme.Theme)`; the
+   handful of free functions in `view.go` take a `Styles` as their first
+   argument. No colour literal appears outside `internal/theme`.
 
 ## Config
 
@@ -39,8 +56,13 @@ Location: `~/.config/terdut-tui/config.yaml`
 server_url: https://terdut.example.com
 api_key: <64-char hex key>
 refresh_interval: 30  # seconds, optional, default 30
+theme: gruvbox-dark   # optional, default gruvbox-dark
 ```
 
+Built-in themes are `gruvbox-dark` and `gruvbox-light`; user themes are YAML
+files in `~/.config/terdut-tui/themes/`, optionally `extends:`-ing a built-in.
+See the README for the token list.
+
 The API key is a one-time secret generated by terdut-server (`POST /api/users/{id}/api-keys`).
 
 ## Running
@@ -57,6 +79,12 @@ go run . --self-update
 go build -ldflags="-X main.version=v0.1.0" -o terdut-tui .
 ```
 
+## Sections
+
+`Incidents` (the queue, and the default) · `Alerts` (raw read-only feed) ·
+`Stats` (MTTA/MTTR and alert frequency charts) ·
+`Archived` (archived incidents) · `Schedule` · `Users`
+
 ## Development stages
 
 | Stage | Feature |
@@ -66,3 +94,17 @@ go build -ldflags="-X main.version=v0.1.0" -o terdut-tui .
 | 3 | Alert detail: acknowledge, comment, statistics charts |
 | 4 | On-call schedule calendar view |
 | 5 | User management and API key lifecycle |
+| 6 | Incidents: queue, timeline, ack/assign/snooze/resolve, MTTA/MTTR |
+
+<!-- graymatter:instructions:begin — managed by `graymatter init`; edits inside this block are overwritten -->
+## Memory (GrayMatter)
+
+This project has persistent agent memory via the `graymatter` MCP tools:
+
+- `memory_search` (`agent_id`, `query`) — call at the **start of a task** when prior context might matter.
+- `memory_add` (`agent_id`, `text`) — call whenever you learn something **durable**: user preferences, decisions, conventions, gotchas.
+- `memory_reflect` (`action`, `agent`, `text`/`target`) — update or forget stale facts. ⚠ takes `agent`, not `agent_id`.
+- `checkpoint_save` / `checkpoint_resume` (`agent_id`) — snapshot/restore session state before major refactors or across restarts.
+
+Use a stable `agent_id` of the form `<project>-<role>` (e.g. `myapp-backend`). Store conclusions, not conversation logs. Err on the side of remembering.
+<!-- graymatter:instructions:end -->

Makefile

@@ -0,0 +1,12 @@
+VERSION := $(shell git describe --tags --always --dirty)
+
+.PHONY: build install test
+
+build:
+	go build -ldflags "-X main.version=$(VERSION)" -o terdut-tui .
+
+install:
+	go install -ldflags "-X main.version=$(VERSION)" .
+
+test:
+	go test ./...

README.md

@@ -1,22 +1,64 @@
 # terdut-tui
 
-A terminal user interface for [terdut-server](https://github.com/terdut-server). Communicates with the server over its REST API.
+A terminal user interface for [terdut-server](https://git.ryuvia.com/niklas/terdut-server). Communicates with the server over its REST API.
 
 Written in Go using [Bubbletea](https://github.com/charmbracelet/bubbletea).
 
 ## Features
 
-- **Alert dashboard** — live view of firing and resolved alerts with auto-refresh
+- **Incident queue** — open incidents with severity, status, assignee and age, auto-refreshing
-- **Alert actions** — acknowledge, comment, and view per-alert statistics
+- **Incident actions** — acknowledge, assign, snooze, note, resolve and archive
+- **Timeline** — the full history of an incident, system events, pages and notes together
+- **Alert feed** — the raw read-only alerts underneath, each linked to its incident
 - **On-call schedule** — visual calendar of who is on duty, assign and remove entries
-- **User management** — add and remove users, manage API keys
+- **Statistics** — MTTA and MTTR, plus alert frequency by name, hour and day
+- **User management** — add and remove users, manage API keys, set each user's ntfy topic
+
+> Requires terdut-server **v0.4.0 or later**. Earlier servers have no incidents API;
+> use terdut-tui v0.3.x with those.
+
+## Alerts and incidents
+
+The server keeps two objects and this client follows that split:
+
+- An **alert** is Alertmanager's record — firing or resolved, and read-only here.
+- An **incident** is the work item. It is what you acknowledge, assign, snooze,
+  discuss and resolve, and it is where all the actions live.
+
+Incidents are correlated by the `groupKey` Alertmanager already computed from your
+`group_by` configuration, so several alerts commonly share one incident.
+
+Two behaviours worth knowing before you press a key:
+
+- **Resolving is final.** The server treats a manual resolve as terminal: a later
+  occurrence opens a *new* incident rather than reopening this one, and if the alert
+  underneath never stops firing the incident stays closed. The TUI asks for
+  confirmation before doing it.
+- **Snooze is the "not now" button.** It hides an incident from the default queue
+  without closing it, and expires on its own.
+
+## Push notifications
+
+When the server is configured for ntfy, an incident that opens pages whoever is
+on call. Each user has their own topic, shown as a column in the Users section
+and edited with `t`. A user with no topic falls back to the server's shared
+fallback topic, which carries **no Acknowledge button** — the topic is shared, so
+a button on it would let any subscriber acknowledge as somebody else.
+
+Every delivery lands on the incident's timeline: `Notified <user> (triggered)`
+when ntfy accepted the page, and `Notification to <user> failed` when it ran out
+of retries. That second one is the one to look for when nobody's phone rang.
+
+Editing topics needs terdut-server **v0.6.0 or later**; the timeline entries need
+**v0.7.0 or later**. Against an older server the topic column stays empty and
+editing one reports the server's 404.
 
 ## Installation
 
-Download the latest release binary for your platform from the [releases page](https://github.com/yeniklas/terdut-tui/releases), or build from source:
+Download the latest release binary for your platform from the [releases page](https://git.ryuvia.com/niklas/terdut-tui/releases), or build from source:
 
 ```bash
-go install github.com/yeniklas/terdut-tui@latest
+go install git.ryuvia.com/niklas/terdut-tui@latest
 ```
 
 ## Configuration
@@ -27,10 +69,49 @@ Create `~/.config/terdut-tui/config.yaml`:
 server_url: https://terdut.example.com
 api_key: <your-api-key>
 refresh_interval: 30  # seconds, optional
+theme: gruvbox-dark   # optional, this is the default
 ```
 
 The API key is generated in terdut-server. See the server documentation for how to bootstrap a user and issue an API key.
 
+## Themes
+
+Two themes ship with the client: `gruvbox-dark` (the default) and
+`gruvbox-light`. Both colour foregrounds only — the terminal supplies the
+background — so pick the one that matches the background you already run.
+
+To make your own, drop a file in `~/.config/terdut-tui/themes/` and name it in
+`theme:`. `extends` inherits a built-in, so a file only has to list what it
+changes:
+
+```yaml
+# ~/.config/terdut-tui/themes/mine.yaml
+extends: gruvbox-dark
+primary: "#d3869b"
+accent: "#fabd2f"
+```
+
+A file may shadow a built-in name — `themes/gruvbox-dark.yaml` is how you tweak
+the default without renaming it.
+
+Without `extends`, every token must be set. The twelve are:
+
+| Token | Where it shows |
+|---|---|
+| `primary` | header, active tab, selected row, cursors |
+| `on_primary` | text drawn *on* `primary` — the active tab and selected row |
+| `text` | incident titles and other emphasis |
+| `muted` | secondary text, dividers, footer, table headers |
+| `accent` | status line, acknowledged incidents, the by-day chart |
+| `firing` | firing alerts, triggered incidents, the by-hour chart |
+| `resolved` | resolved alerts and incidents, the top-alerts chart |
+| `error` | error banners |
+| `sev_critical`, `sev_error`, `sev_warning`, `sev_info` | the `severity` label |
+
+Values are hex (`#83a598` or `#abc`) or an ANSI palette index (`0`–`255`) if you
+would rather follow your terminal's own colours. Colours are downsampled
+automatically on 256- and 16-colour terminals, and `NO_COLOR` is honoured.
+
 ## Usage
 
 ```
@@ -41,13 +122,74 @@ terdut-tui --self-update   update to the latest release
 
 ### Keybindings
 
+Global:
+
 | Key | Action |
 |-----|--------|
 | `j` / `↓` | Move down |
 | `k` / `↑` | Move up |
-| `tab` | Switch section (Alerts / Schedule / Users) |
+| `tab` / `shift+tab` | Next / previous section |
-| `enter` | Select / open detail |
+| `enter` | Open detail |
 | `esc` | Go back |
 | `r` | Refresh |
-| `f` | Filter / cycle filter |
+| `f` | Cycle filter |
 | `q` | Quit |
+
+The sections, in `tab` order: Incidents · Alerts · Stats · Archived · Schedule · Users.
+
+Incidents section:
+
+| Key | Action |
+|-----|--------|
+| `f` | Cycle: open → triggered → acknowledged → resolved → snoozed |
+| `x` | Archive (resolved incidents only) |
+
+Incident detail:
+
+| Key | Action |
+|-----|--------|
+| `a` / `A` | Acknowledge / clear acknowledgement |
+| `R` | Resolve — asks to confirm, and is final |
+| `s` | Assign to a user |
+| `z` / `Z` | Snooze for a duration / un-snooze |
+| `c` | Add a note |
+| `[` / `]` | Select a note |
+| `d` | Delete the selected note (your own only) |
+| `x` | Archive / un-archive |
+
+Alerts section (read-only):
+
+| Key | Action |
+|-----|--------|
+| `f` | Cycle: firing → resolved → all → archived |
+| `i` | In detail: jump to the alert's incident |
+
+Stats section:
+
+| Key | Action |
+|-----|--------|
+| `j` / `k`, `pgup` / `pgdn` | Scroll |
+
+Schedule section:
+
+| Key | Action |
+|-----|--------|
+| `+` / `W` | Assign a day / a whole week |
+| `d` | Remove the assignment |
+| `←` / `→` | Shift the week window |
+
+One person holds a given day. Assigning over days somebody else already has
+asks first — naming them and how many days are being taken — and moves the whole
+selection at once when you accept, so reassigning a week is one confirmation
+rather than seven deletions. Taking somebody's shift needs terdut-server
+**v0.8.0 or later**; against an older server the assignment is refused with
+`date already assigned`.
+
+Users section:
+
+| Key | Action |
+|-----|--------|
+| `n` | Create a user |
+| `t` | Edit the user's ntfy topic — submit empty to clear it |
+| `d` | Delete a user |
+| `k` | API keys for the selected user |

go.mod

@@ -1,4 +1,4 @@
-module github.com/yeniklas/terdut-tui
+module git.ryuvia.com/niklas/terdut-tui
 
 go 1.25.9
 

internal/api/client.go

@@ -61,12 +61,20 @@ func (c *Client) do(req *http.Request, out any) error {
 	return nil
 }
 
-// ListAlerts fetches alerts from the server. status may be "firing", "resolved", or "" for all.
+// ListAlerts fetches alerts. status may be "firing", "resolved", or "" for all.
-func (c *Client) ListAlerts(status string, limit int) ([]Alert, error) {
+// Set archived=true to fetch only archived alerts; false returns only non-archived.
+//
+// Alerts are read-only on the server — there is nothing to acknowledge or
+// archive here. This is the raw feed, useful for checking what Alertmanager is
+// actually sending; the work queue is ListIncidents.
+func (c *Client) ListAlerts(status string, archived bool, limit int) ([]Alert, error) {
 	q := url.Values{}
 	if status != "" {
 		q.Set("status", status)
 	}
+	if archived {
+		q.Set("archived", "true")
+	}
 	if limit > 0 {
 		q.Set("limit", strconv.Itoa(limit))
 	}
@@ -117,49 +125,172 @@ func (c *Client) GetAlert(id int64) (*Alert, error) {
 	return &alert, c.do(req, &alert)
 }
 
-func (c *Client) AcknowledgeAlert(id int64) (*Alert, error) {
+// ── Incidents ──────────────────────────────────────────────────────────────
-	req, err := c.newRequest(http.MethodPost, fmt.Sprintf("/api/alerts/%d/acknowledge", id))
+
+// ListIncidents fetches the work queue. status may be "triggered",
+// "acknowledged", "resolved", or "" for the server default of open incidents
+// only. archived and snoozed each switch the list to that set rather than
+// adding to it, matching the server's filters.
+func (c *Client) ListIncidents(status string, archived, snoozed bool, limit int) ([]Incident, error) {
+	q := url.Values{}
+	if status != "" {
+		q.Set("status", status)
+	}
+	if archived {
+		q.Set("archived", "true")
+	}
+	if snoozed {
+		q.Set("snoozed", "true")
+	}
+	if limit > 0 {
+		q.Set("limit", strconv.Itoa(limit))
+	}
+	path := "/api/incidents"
+	if len(q) > 0 {
+		path += "?" + q.Encode()
+	}
+
+	req, err := c.newRequest(http.MethodGet, path)
 	if err != nil {
 		return nil, err
 	}
-	var alert Alert
+	var incidents []Incident
-	return &alert, c.do(req, &alert)
+	return incidents, c.do(req, &incidents)
 }
 
-func (c *Client) UnacknowledgeAlert(id int64) error {
+// GetIncident returns one incident with its member alerts inline.
-	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/alerts/%d/acknowledge", id))
+func (c *Client) GetIncident(id int64) (*Incident, error) {
+	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/incidents/%d", id))
+	if err != nil {
+		return nil, err
+	}
+	var incident Incident
+	return &incident, c.do(req, &incident)
+}
+
+func (c *Client) GetIncidentTimeline(id int64) ([]IncidentEvent, error) {
+	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/incidents/%d/timeline", id))
+	if err != nil {
+		return nil, err
+	}
+	var events []IncidentEvent
+	return events, c.do(req, &events)
+}
+
+func (c *Client) AcknowledgeIncident(id int64) (*Incident, error) {
+	req, err := c.newRequest(http.MethodPost, fmt.Sprintf("/api/incidents/%d/acknowledge", id))
+	if err != nil {
+		return nil, err
+	}
+	var incident Incident
+	return &incident, c.do(req, &incident)
+}
+
+func (c *Client) UnacknowledgeIncident(id int64) error {
+	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/incidents/%d/acknowledge", id))
 	if err != nil {
 		return err
 	}
 	return c.do(req, nil)
 }
 
-func (c *Client) GetComments(alertID int64) ([]Comment, error) {
+// ResolveIncident closes an incident by hand. This is terminal on the server: a
-	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/alerts/%d/comments", alertID))
+// later occurrence in the same group opens a new incident rather than reopening
+// this one, and if the alert underneath never stops firing the incident stays
+// closed. Use SnoozeIncident for "not now".
+func (c *Client) ResolveIncident(id int64) (*Incident, error) {
+	req, err := c.newRequest(http.MethodPost, fmt.Sprintf("/api/incidents/%d/resolve", id))
 	if err != nil {
 		return nil, err
 	}
-	var comments []Comment
+	var incident Incident
-	return comments, c.do(req, &comments)
+	return &incident, c.do(req, &incident)
 }
 
-func (c *Client) AddComment(alertID int64, content string) (*Comment, error) {
+func (c *Client) AssignIncident(id, userID int64) (*Incident, error) {
-	req, err := c.newRequestWithBody(http.MethodPost, fmt.Sprintf("/api/alerts/%d/comments", alertID), map[string]string{"content": content})
+	body := struct {
+		UserID int64 `json:"user_id"`
+	}{UserID: userID}
+	req, err := c.newRequestWithBody(http.MethodPost, fmt.Sprintf("/api/incidents/%d/assign", id), body)
 	if err != nil {
 		return nil, err
 	}
-	var comment Comment
+	var incident Incident
-	return &comment, c.do(req, &comment)
+	return &incident, c.do(req, &incident)
 }
 
-func (c *Client) DeleteComment(alertID, commentID int64) error {
+// SnoozeIncident hides an incident from the default queue for a duration,
-	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/alerts/%d/comments/%d", alertID, commentID))
+// without closing it.
+func (c *Client) SnoozeIncident(id int64, duration string) (*Incident, error) {
+	body := struct {
+		Duration string `json:"duration"`
+	}{Duration: duration}
+	req, err := c.newRequestWithBody(http.MethodPost, fmt.Sprintf("/api/incidents/%d/snooze", id), body)
+	if err != nil {
+		return nil, err
+	}
+	var incident Incident
+	return &incident, c.do(req, &incident)
+}
+
+func (c *Client) UnsnoozeIncident(id int64) error {
+	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/incidents/%d/snooze", id))
 	if err != nil {
 		return err
 	}
 	return c.do(req, nil)
 }
 
+func (c *Client) ArchiveIncident(id int64) (*Incident, error) {
+	req, err := c.newRequest(http.MethodPost, fmt.Sprintf("/api/incidents/%d/archive", id))
+	if err != nil {
+		return nil, err
+	}
+	var incident Incident
+	return &incident, c.do(req, &incident)
+}
+
+func (c *Client) UnarchiveIncident(id int64) error {
+	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/incidents/%d/archive", id))
+	if err != nil {
+		return err
+	}
+	return c.do(req, nil)
+}
+
+// AddNote appends a note to the incident's timeline.
+func (c *Client) AddNote(incidentID int64, content string) (*IncidentEvent, error) {
+	req, err := c.newRequestWithBody(http.MethodPost,
+		fmt.Sprintf("/api/incidents/%d/notes", incidentID), map[string]string{"content": content})
+	if err != nil {
+		return nil, err
+	}
+	var event IncidentEvent
+	return &event, c.do(req, &event)
+}
+
+// DeleteNote removes one of your own notes. Only notes are deletable — the rest
+// of the timeline is a record of what happened.
+func (c *Client) DeleteNote(incidentID, eventID int64) error {
+	req, err := c.newRequest(http.MethodDelete,
+		fmt.Sprintf("/api/incidents/%d/notes/%d", incidentID, eventID))
+	if err != nil {
+		return err
+	}
+	return c.do(req, nil)
+}
+
+func (c *Client) GetIncidentStats() (*IncidentStats, error) {
+	req, err := c.newRequest(http.MethodGet, "/api/stats/incidents")
+	if err != nil {
+		return nil, err
+	}
+	var stats IncidentStats
+	return &stats, c.do(req, &stats)
+}
+
+// ── Statistics ─────────────────────────────────────────────────────────────
+
 func (c *Client) GetTopAlerts(limit int) ([]TopAlert, error) {
 	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/stats/alerts/top?limit=%d", limit))
 	if err != nil {
@@ -211,7 +342,9 @@ func (c *Client) GetCurrentOnCall() (*ScheduleEntry, error) {
 		return nil, nil
 	}
 	if resp.StatusCode >= 400 {
-		var e struct{ Error string `json:"error"` }
+		var e struct {
+			Error string `json:"error"`
+		}
 		_ = json.NewDecoder(resp.Body).Decode(&e)
 		if e.Error != "" {
 			return nil, fmt.Errorf("server returned %d: %s", resp.StatusCode, e.Error)
@@ -225,11 +358,17 @@ func (c *Client) GetCurrentOnCall() (*ScheduleEntry, error) {
 	return &entry, nil
 }
 
-func (c *Client) AssignSchedule(userID int64, dates []string) ([]ScheduleEntry, error) {
+// AssignSchedule puts one user on call for the given dates.
+//
+// The server holds one person per day and refuses a date somebody already has,
+// so replace is what takes a shift off its current holder. It is all-or-nothing
+// either way: a week of free and taken days moves as a unit, or not at all.
+func (c *Client) AssignSchedule(userID int64, dates []string, replace bool) ([]ScheduleEntry, error) {
 	body := struct {
-		UserID int64    `json:"user_id"`
+		UserID  int64    `json:"user_id"`
-		Dates  []string `json:"dates"`
+		Dates   []string `json:"dates"`
-	}{UserID: userID, Dates: dates}
+		Replace bool     `json:"replace,omitempty"`
+	}{UserID: userID, Dates: dates, Replace: replace}
 	req, err := c.newRequestWithBody(http.MethodPost, "/api/schedule", body)
 	if err != nil {
 		return nil, err
@@ -268,6 +407,23 @@ func (c *Client) CreateUser(username, email string) (*User, error) {
 	return &user, c.do(req, &user)
 }
 
+// SetUserNotifyTarget points a user's push notifications at an ntfy topic.
+//
+// An empty topic clears it: the server stores NULL, and that user's incidents
+// page the shared fallback topic instead — which carries no Acknowledge button,
+// because anyone subscribed to it could otherwise acknowledge as somebody else.
+func (c *Client) SetUserNotifyTarget(userID int64, topic string) (*User, error) {
+	body := struct {
+		NtfyTopic string `json:"ntfy_topic"`
+	}{NtfyTopic: topic}
+	req, err := c.newRequestWithBody(http.MethodPut, fmt.Sprintf("/api/users/%d/notify", userID), body)
+	if err != nil {
+		return nil, err
+	}
+	var user User
+	return &user, c.do(req, &user)
+}
+
 func (c *Client) DeleteUser(id int64) error {
 	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/users/%d", id))
 	if err != nil {

internal/api/client_test.go

@@ -0,0 +1,365 @@
+package api
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+// call records what the client actually put on the wire. The paths and methods
+// are the contract with terdut-server, and getting one wrong is exactly how this
+// client broke when the server split alerts from incidents.
+type call struct {
+	method string
+	path   string
+	query  string
+	body   string
+	auth   string
+}
+
+// stub serves one canned response and records the request that fetched it.
+func stub(t *testing.T, status int, response string) (*Client, *call) {
+	t.Helper()
+	got := &call{}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		got.method, got.path, got.query = r.Method, r.URL.Path, r.URL.RawQuery
+		got.body, got.auth = string(body), r.Header.Get("Authorization")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(status)
+		io.WriteString(w, response)
+	}))
+	t.Cleanup(srv.Close)
+	return NewClient(srv.URL, "test-key"), got
+}
+
+func TestClient_SendsBearerToken(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[]`)
+	if _, err := c.ListIncidents("", false, false, 0); err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	if got.auth != "Bearer test-key" {
+		t.Errorf("expected bearer token, got %q", got.auth)
+	}
+}
+
+// Every incident action, with the method and path terdut-server exposes.
+func TestClient_IncidentEndpoints(t *testing.T) {
+	tests := []struct {
+		name   string
+		invoke func(*Client) error
+		method string
+		path   string
+		// resp defaults to a JSON object; endpoints returning a list need an array.
+		resp string
+	}{
+		{"get", func(c *Client) error { _, err := c.GetIncident(7); return err },
+			http.MethodGet, "/api/incidents/7", ""},
+		{"timeline", func(c *Client) error { _, err := c.GetIncidentTimeline(7); return err },
+			http.MethodGet, "/api/incidents/7/timeline", `[]`},
+		{"acknowledge", func(c *Client) error { _, err := c.AcknowledgeIncident(7); return err },
+			http.MethodPost, "/api/incidents/7/acknowledge", ""},
+		{"unacknowledge", func(c *Client) error { return c.UnacknowledgeIncident(7) },
+			http.MethodDelete, "/api/incidents/7/acknowledge", ""},
+		{"resolve", func(c *Client) error { _, err := c.ResolveIncident(7); return err },
+			http.MethodPost, "/api/incidents/7/resolve", ""},
+		{"assign", func(c *Client) error { _, err := c.AssignIncident(7, 3); return err },
+			http.MethodPost, "/api/incidents/7/assign", ""},
+		{"snooze", func(c *Client) error { _, err := c.SnoozeIncident(7, "2h"); return err },
+			http.MethodPost, "/api/incidents/7/snooze", ""},
+		{"unsnooze", func(c *Client) error { return c.UnsnoozeIncident(7) },
+			http.MethodDelete, "/api/incidents/7/snooze", ""},
+		{"archive", func(c *Client) error { _, err := c.ArchiveIncident(7); return err },
+			http.MethodPost, "/api/incidents/7/archive", ""},
+		{"unarchive", func(c *Client) error { return c.UnarchiveIncident(7) },
+			http.MethodDelete, "/api/incidents/7/archive", ""},
+		{"add note", func(c *Client) error { _, err := c.AddNote(7, "hi"); return err },
+			http.MethodPost, "/api/incidents/7/notes", ""},
+		{"delete note", func(c *Client) error { return c.DeleteNote(7, 12) },
+			http.MethodDelete, "/api/incidents/7/notes/12", ""},
+		{"stats", func(c *Client) error { _, err := c.GetIncidentStats(); return err },
+			http.MethodGet, "/api/stats/incidents", ""},
+		{"set notify target", func(c *Client) error { _, err := c.SetUserNotifyTarget(7, "t"); return err },
+			http.MethodPut, "/api/users/7/notify", ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resp := tt.resp
+			if resp == "" {
+				resp = `{}`
+			}
+			c, got := stub(t, http.StatusOK, resp)
+			if err := tt.invoke(c); err != nil {
+				t.Fatalf("%s: %v", tt.name, err)
+			}
+			if got.method != tt.method || got.path != tt.path {
+				t.Errorf("expected %s %s, got %s %s", tt.method, tt.path, got.method, got.path)
+			}
+		})
+	}
+}
+
+func TestListIncidents_Filters(t *testing.T) {
+	tests := []struct {
+		name     string
+		status   string
+		archived bool
+		snoozed  bool
+		limit    int
+		want     string
+	}{
+		{"default is the open queue", "", false, false, 0, ""},
+		{"status", "triggered", false, false, 0, "status=triggered"},
+		{"archived", "resolved", true, false, 0, "archived=true&status=resolved"},
+		{"snoozed", "", false, true, 0, "snoozed=true"},
+		{"limit", "", false, false, 500, "limit=500"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c, got := stub(t, http.StatusOK, `[]`)
+			if _, err := c.ListIncidents(tt.status, tt.archived, tt.snoozed, tt.limit); err != nil {
+				t.Fatalf("list: %v", err)
+			}
+			if got.query != tt.want {
+				t.Errorf("expected query %q, got %q", tt.want, got.query)
+			}
+		})
+	}
+}
+
+func TestClient_RequestBodies(t *testing.T) {
+	t.Run("assign", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.AssignIncident(1, 42); err != nil {
+			t.Fatalf("assign: %v", err)
+		}
+		var body struct {
+			UserID int64 `json:"user_id"`
+		}
+		if err := json.Unmarshal([]byte(got.body), &body); err != nil {
+			t.Fatalf("decode body %q: %v", got.body, err)
+		}
+		if body.UserID != 42 {
+			t.Errorf("expected user_id 42, got %d", body.UserID)
+		}
+	})
+
+	t.Run("snooze", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.SnoozeIncident(1, "90m"); err != nil {
+			t.Fatalf("snooze: %v", err)
+		}
+		var body struct {
+			Duration string `json:"duration"`
+		}
+		if err := json.Unmarshal([]byte(got.body), &body); err != nil {
+			t.Fatalf("decode body %q: %v", got.body, err)
+		}
+		if body.Duration != "90m" {
+			t.Errorf("expected duration 90m, got %q", body.Duration)
+		}
+	})
+
+	// replace is what takes a day off its current holder, so it has to reach the
+	// wire when asked for — and stay off it when not.
+	t.Run("assign schedule", func(t *testing.T) {
+		c, got := stub(t, http.StatusCreated, `[]`)
+		if _, err := c.AssignSchedule(3, []string{"2026-07-27"}, false); err != nil {
+			t.Fatalf("assign: %v", err)
+		}
+		if got.body != `{"user_id":3,"dates":["2026-07-27"]}` {
+			t.Errorf("unexpected body %q", got.body)
+		}
+	})
+
+	t.Run("assign schedule with replace", func(t *testing.T) {
+		c, got := stub(t, http.StatusCreated, `[]`)
+		if _, err := c.AssignSchedule(3, []string{"2026-07-27"}, true); err != nil {
+			t.Fatalf("assign: %v", err)
+		}
+		if got.body != `{"user_id":3,"dates":["2026-07-27"],"replace":true}` {
+			t.Errorf("unexpected body %q", got.body)
+		}
+	})
+
+	t.Run("set notify target", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.SetUserNotifyTarget(3, "terdut-niklas"); err != nil {
+			t.Fatalf("set notify target: %v", err)
+		}
+		if got.body != `{"ntfy_topic":"terdut-niklas"}` {
+			t.Errorf("unexpected body %q", got.body)
+		}
+	})
+
+	// Clearing has to put an explicit empty string on the wire: omitting the
+	// field would leave the topic untouched instead of removing it.
+	t.Run("clear notify target", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.SetUserNotifyTarget(3, ""); err != nil {
+			t.Fatalf("clear notify target: %v", err)
+		}
+		if got.body != `{"ntfy_topic":""}` {
+			t.Errorf("expected an explicit empty topic, got %q", got.body)
+		}
+	})
+}
+
+func TestUser_TopicFlattensNilAndEmpty(t *testing.T) {
+	var users []User
+	if err := json.Unmarshal([]byte(
+		`[{"id":1,"username":"a"},{"id":2,"username":"b","ntfy_topic":""},
+		  {"id":3,"username":"c","ntfy_topic":"terdut-c"}]`), &users); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	want := []string{"", "", "terdut-c"}
+	for i, u := range users {
+		if got := u.Topic(); got != want[i] {
+			t.Errorf("user %d: expected topic %q, got %q", u.ID, want[i], got)
+		}
+	}
+}
+
+// The 409 on re-resolving is the server telling the user why nothing happened,
+// so the message has to survive into the error the TUI displays.
+func TestClient_SurfacesServerErrorMessage(t *testing.T) {
+	c, _ := stub(t, http.StatusConflict, `{"error":"incident is resolved"}`)
+	_, err := c.ResolveIncident(1)
+	if err == nil {
+		t.Fatal("expected an error on 409")
+	}
+	if !strings.Contains(err.Error(), "incident is resolved") || !strings.Contains(err.Error(), "409") {
+		t.Errorf("expected status and server message in %q", err.Error())
+	}
+}
+
+func TestClient_ErrorWithoutBody(t *testing.T) {
+	c, _ := stub(t, http.StatusInternalServerError, ``)
+	if _, err := c.GetIncident(1); err == nil || !strings.Contains(err.Error(), "500") {
+		t.Errorf("expected a 500 error, got %v", err)
+	}
+}
+
+// Nobody on call is a normal state, not a failure.
+func TestGetCurrentOnCall_404IsNotAnError(t *testing.T) {
+	c, _ := stub(t, http.StatusNotFound, `{"error":"no one is on call today"}`)
+	entry, err := c.GetCurrentOnCall()
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+	if entry != nil {
+		t.Errorf("expected nil entry, got %+v", entry)
+	}
+}
+
+// Optional fields are omitted by the server rather than sent null, so decoding
+// has to leave them zero instead of failing.
+func TestIncident_DecodesSparseServerShape(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{
+		"id": 1,
+		"group_key": "{}:{alertname=\"DiskFull\"}",
+		"title": "DiskFull (namespace=prod)",
+		"group_labels": {"alertname": "DiskFull", "namespace": "prod"},
+		"status": "triggered",
+		"severity": "critical",
+		"triggered_at": "2026-07-30T10:00:00Z"
+	}`)
+
+	inc, err := c.GetIncident(1)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if inc.Title != "DiskFull (namespace=prod)" || inc.Severity != "critical" {
+		t.Errorf("unexpected incident %+v", inc)
+	}
+	if inc.GroupLabels["namespace"] != "prod" {
+		t.Errorf("expected group labels decoded, got %v", inc.GroupLabels)
+	}
+	if !inc.IsOpen() {
+		t.Error("an incident with no resolved_at is open")
+	}
+	if inc.IsSnoozed() {
+		t.Error("an incident with no snoozed_until is not snoozed")
+	}
+	if inc.AcknowledgedByID != nil || inc.AssignedToID != nil {
+		t.Error("expected acknowledgement and assignment to be absent")
+	}
+}
+
+// A snooze expires by falling into the past; the server sweeps nothing, so the
+// client is what decides a stale snooze no longer counts.
+func TestIncident_IsSnoozed(t *testing.T) {
+	past := time.Now().Add(-time.Hour)
+	future := time.Now().Add(time.Hour)
+
+	tests := []struct {
+		name  string
+		until *time.Time
+		want  bool
+	}{
+		{"never snoozed", nil, false},
+		{"snooze in the past has expired", &past, false},
+		{"snooze in the future holds", &future, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := (Incident{SnoozedUntil: tt.until}).IsSnoozed(); got != tt.want {
+				t.Errorf("expected %v, got %v", tt.want, got)
+			}
+		})
+	}
+}
+
+func TestIncident_IsOpen(t *testing.T) {
+	now := time.Now()
+	if !(Incident{}).IsOpen() {
+		t.Error("no resolved_at means open")
+	}
+	if (Incident{ResolvedAt: &now}).IsOpen() {
+		t.Error("resolved_at means closed")
+	}
+}
+
+func TestAlert_DecodesIncidentLink(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{"id":3,"name":"DiskFull","status":"firing","incident_id":7}`)
+	a, err := c.GetAlert(3)
+	if err != nil {
+		t.Fatalf("get alert: %v", err)
+	}
+	if a.IncidentID == nil || *a.IncidentID != 7 {
+		t.Errorf("expected incident_id 7, got %v", a.IncidentID)
+	}
+}
+
+func TestListAlerts_ArchivedFilter(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[]`)
+	if _, err := c.ListAlerts("", true, 50); err != nil {
+		t.Fatalf("list alerts: %v", err)
+	}
+	if got.path != "/api/alerts" || got.query != "archived=true&limit=50" {
+		t.Errorf("unexpected request %s?%s", got.path, got.query)
+	}
+}
+
+// MTTA and MTTR are null until something has been acknowledged or resolved. That
+// is "no data", and it must not decode to a confident zero.
+func TestIncidentStats_NullAveragesStayNil(t *testing.T) {
+	c, _ := stub(t, http.StatusOK,
+		`{"total":2,"triggered":2,"acknowledged":0,"resolved":0,"mtta_seconds":null,"mttr_seconds":null}`)
+	stats, err := c.GetIncidentStats()
+	if err != nil {
+		t.Fatalf("stats: %v", err)
+	}
+	if stats.Total != 2 || stats.Triggered != 2 {
+		t.Errorf("unexpected counts %+v", stats)
+	}
+	if stats.MTTASeconds != nil || stats.MTTRSeconds != nil {
+		t.Errorf("expected nil averages, got %v / %v", stats.MTTASeconds, stats.MTTRSeconds)
+	}
+}

internal/api/types.go

@@ -2,20 +2,120 @@ package api
 
 import "time"
 
+// Alert is the server's record of what Alertmanager said. It is read-only:
+// acknowledging, assigning, noting and resolving all happen on the Incident an
+// alert belongs to.
 type Alert struct {
-	ID               int64             `json:"id"`
+	ID           int64             `json:"id"`
-	Fingerprint      string            `json:"fingerprint"`
+	Fingerprint  string            `json:"fingerprint"`
-	Name             string            `json:"name"`
+	Name         string            `json:"name"`
-	Status           string            `json:"status"`
+	Status       string            `json:"status"`
-	Labels           map[string]string `json:"labels"`
+	Labels       map[string]string `json:"labels"`
-	Annotations      map[string]string `json:"annotations"`
+	Annotations  map[string]string `json:"annotations"`
-	StartsAt         time.Time         `json:"starts_at"`
+	StartsAt     time.Time         `json:"starts_at"`
-	EndsAt           *time.Time        `json:"ends_at"`
+	EndsAt       *time.Time        `json:"ends_at"`
-	GeneratorURL     string            `json:"generator_url"`
+	GeneratorURL string            `json:"generator_url"`
-	ReceivedAt       time.Time         `json:"received_at"`
+	ReceivedAt   time.Time         `json:"received_at"`
-	AcknowledgedByID *int64            `json:"acknowledged_by_id"`
+	ArchivedAt   *time.Time        `json:"archived_at,omitempty"`
-	AcknowledgedBy   string            `json:"acknowledged_by"`
+
-	AcknowledgedAt   *time.Time        `json:"acknowledged_at"`
+	// IncidentID is the most recent incident this alert belongs to. An alert row
+	// is reused across occurrences of the same fingerprint, so it belongs to a
+	// series of incidents over its life and this is only the newest.
+	IncidentID *int64 `json:"incident_id,omitempty"`
+
+	// ResolutionSource records why a resolved alert left the firing state:
+	// "alertmanager" for a real resolved webhook, "expiry" when the server
+	// inferred it after the alert stopped being refreshed.
+	ResolutionSource *string `json:"resolution_source,omitempty"`
+}
+
+// Incident statuses.
+const (
+	StatusTriggered    = "triggered"
+	StatusAcknowledged = "acknowledged"
+	StatusResolved     = "resolved"
+)
+
+// Incident is the work item: what a person acknowledges, assigns, snoozes,
+// discusses and resolves. Many alerts map to one incident, correlated by the
+// groupKey Alertmanager computed from the operator's group_by configuration.
+type Incident struct {
+	ID          int64             `json:"id"`
+	GroupKey    string            `json:"group_key"`
+	Title       string            `json:"title"`
+	GroupLabels map[string]string `json:"group_labels"`
+	Status      string            `json:"status"`
+
+	// Severity is a high-water mark across the incident's alerts, never lowered,
+	// so a resolved incident still says how bad it got.
+	Severity string `json:"severity,omitempty"`
+
+	TriggeredAt time.Time `json:"triggered_at"`
+
+	AcknowledgedByID *int64     `json:"acknowledged_by_id,omitempty"`
+	AcknowledgedBy   string     `json:"acknowledged_by,omitempty"`
+	AcknowledgedAt   *time.Time `json:"acknowledged_at,omitempty"`
+
+	AssignedToID *int64 `json:"assigned_to_id,omitempty"`
+	AssignedTo   string `json:"assigned_to,omitempty"`
+
+	SnoozedUntil *time.Time `json:"snoozed_until,omitempty"`
+
+	ResolvedAt *time.Time `json:"resolved_at,omitempty"`
+
+	// ResolutionSource is "alerts" when every alert stopped firing, or "manual"
+	// when a person closed it. Treat the value set as open.
+	ResolutionSource *string `json:"resolution_source,omitempty"`
+
+	ArchivedAt *time.Time `json:"archived_at,omitempty"`
+
+	// Alerts is populated by GET /api/incidents/{id} only.
+	Alerts []Alert `json:"alerts,omitempty"`
+}
+
+// IsSnoozed reports whether the incident is currently quietened. A snooze
+// expires by falling into the past; nothing on the server sweeps it.
+func (i Incident) IsSnoozed() bool {
+	return i.SnoozedUntil != nil && i.SnoozedUntil.After(time.Now())
+}
+
+// IsOpen reports whether the incident is still work in progress.
+func (i Incident) IsOpen() bool { return i.ResolvedAt == nil }
+
+// Incident timeline event types written by the server. New ones may be added,
+// so render unrecognised types generically rather than dropping them.
+const (
+	EventTriggered      = "triggered"
+	EventAlertAdded     = "alert_added"
+	EventAlertResolved  = "alert_resolved"
+	EventAcknowledged   = "acknowledged"
+	EventUnacknowledged = "unacknowledged"
+	EventAssigned       = "assigned"
+	EventSnoozed        = "snoozed"
+	EventUnsnoozed      = "unsnoozed"
+	EventResolved       = "resolved"
+	EventNote           = "note"
+
+	// Written by the server's notifier from the delivery result, not at enqueue.
+	// Detail carries the notification kind ("triggered", "reminder", "resolved"),
+	// and on a failure the reason after it. An absent user means the page went to
+	// the shared fallback topic rather than to a person.
+	EventNotified     = "notified"
+	EventNotifyFailed = "notify_failed"
+)
+
+// IncidentEvent is one entry in an incident's timeline. An empty Username means
+// the server acted rather than a person. On an "assigned" event the user is the
+// assignee, not the actor.
+type IncidentEvent struct {
+	ID         int64     `json:"id"`
+	IncidentID int64     `json:"incident_id"`
+	Type       string    `json:"type"`
+	UserID     *int64    `json:"user_id,omitempty"`
+	Username   string    `json:"username,omitempty"`
+	AlertID    *int64    `json:"alert_id,omitempty"`
+	Detail     string    `json:"detail,omitempty"`
+	CreatedAt  time.Time `json:"created_at"`
 }
 
 type AlertStats struct {
@@ -24,13 +124,16 @@ type AlertStats struct {
 	Resolved int `json:"resolved"`
 }
 
-type Comment struct {
+// IncidentStats carries the queue counts plus mean time to acknowledge and to
-	ID        int64     `json:"id"`
+// resolve. Both averages are nil until something has actually been acknowledged
-	AlertID   int64     `json:"alert_id"`
+// or resolved — that is "no data", not zero.
-	UserID    int64     `json:"user_id"`
+type IncidentStats struct {
-	Username  string    `json:"username"`
+	Total        int      `json:"total"`
-	Content   string    `json:"content"`
+	Triggered    int      `json:"triggered"`
-	CreatedAt time.Time `json:"created_at"`
+	Acknowledged int      `json:"acknowledged"`
+	Resolved     int      `json:"resolved"`
+	MTTASeconds  *float64 `json:"mtta_seconds"`
+	MTTRSeconds  *float64 `json:"mttr_seconds"`
 }
 
 type TopAlert struct {
@@ -62,6 +165,21 @@ type User struct {
 	Username  string    `json:"username"`
 	Email     string    `json:"email"`
 	CreatedAt time.Time `json:"created_at"`
+
+	// NtfyTopic is where this user's push notifications go. Nil and empty mean
+	// the same thing — no topic of their own — because the server stores a blank
+	// string as NULL. Their incidents fall back to the server's shared fallback
+	// topic, which carries no Acknowledge button.
+	NtfyTopic *string `json:"ntfy_topic,omitempty"`
+}
+
+// Topic reads the user's ntfy topic, flattening the nil and empty cases the
+// server treats alike.
+func (u User) Topic() string {
+	if u.NtfyTopic == nil {
+		return ""
+	}
+	return *u.NtfyTopic
 }
 
 type APIKey struct {

internal/config/config.go

@@ -15,12 +15,14 @@ type Config struct {
 	ServerURL       string
 	APIKey          string
 	RefreshInterval time.Duration
+	Theme           string
 }
 
 type rawConfig struct {
 	ServerURL       string `yaml:"server_url"`
 	APIKey          string `yaml:"api_key"`
 	RefreshInterval int    `yaml:"refresh_interval,omitempty"` // seconds
+	Theme           string `yaml:"theme,omitempty"`
 }
 
 func Load() (*Config, error) {
@@ -33,7 +35,7 @@ func Load() (*Config, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
-			return nil, fmt.Errorf("config file not found at %s\n\nCreate it with:\n  server_url: https://terdut.example.com\n  api_key: <your-api-key>", path)
+			return nil, fmt.Errorf("config file not found at %s\n\nCreate it with:\n  server_url: https://terdut.example.com\n  api_key: <your-api-key>\n  theme: gruvbox-dark  # optional", path)
 		}
 		return nil, fmt.Errorf("cannot read config file: %w", err)
 	}
@@ -59,5 +61,6 @@ func Load() (*Config, error) {
 		ServerURL:       raw.ServerURL,
 		APIKey:          raw.APIKey,
 		RefreshInterval: interval,
+		Theme:           raw.Theme,
 	}, nil
 }

internal/theme/builtin.go

@@ -0,0 +1,88 @@
+package theme
+
+import "sort"
+
+// The gruvbox palettes, in the author's original names. Dark uses the bright
+// variants and light the faded ones, which is what keeps each readable against
+// its own background.
+const (
+	darkBg0  = "#282828"
+	darkFg1  = "#ebdbb2"
+	darkGray = "#928374"
+	darkRed  = "#fb4934"
+	darkGrn  = "#b8bb26"
+	darkYel  = "#fabd2f"
+	darkBlu  = "#83a598"
+	darkAqua = "#8ec07c"
+	darkOrng = "#fe8019"
+
+	lightBg0  = "#fbf1c7"
+	lightFg1  = "#3c3836"
+	lightFg4  = "#7c6f64"
+	lightRed  = "#9d0006"
+	lightGrn  = "#79740e"
+	lightYel  = "#b57614"
+	lightBlu  = "#076678"
+	lightAqua = "#427b58"
+	lightOrng = "#af3a03"
+)
+
+// GruvboxDark is the default scheme. It assumes a dark terminal background:
+// themes colour foregrounds only, so the terminal supplies the canvas.
+var GruvboxDark = Theme{
+	Name: "gruvbox-dark",
+
+	Primary:   darkBlu,
+	OnPrimary: darkBg0,
+	Text:      darkFg1,
+	Muted:     darkGray,
+	Accent:    darkOrng,
+
+	Firing:   darkRed,
+	Resolved: darkGrn,
+	Error:    darkRed,
+
+	SevCritical: darkRed,
+	SevError:    darkOrng,
+	SevWarning:  darkYel,
+	SevInfo:     darkAqua,
+}
+
+// GruvboxLight is the same scheme against a light terminal background.
+var GruvboxLight = Theme{
+	Name: "gruvbox-light",
+
+	Primary:   lightBlu,
+	OnPrimary: lightBg0,
+	Text:      lightFg1,
+	Muted:     lightFg4,
+	Accent:    lightOrng,
+
+	Firing:   lightRed,
+	Resolved: lightGrn,
+	Error:    lightRed,
+
+	SevCritical: lightRed,
+	SevError:    lightOrng,
+	SevWarning:  lightYel,
+	SevInfo:     lightAqua,
+}
+
+// Default is the theme used when the config names none.
+var Default = GruvboxDark
+
+var builtins = map[string]Theme{
+	GruvboxDark.Name:  GruvboxDark,
+	GruvboxLight.Name: GruvboxLight,
+}
+
+// BuiltinNames lists the compiled-in themes, sorted, for error messages and
+// documentation.
+func BuiltinNames() []string {
+	names := make([]string, 0, len(builtins))
+	for name := range builtins {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	return names
+}

internal/theme/load.go

@@ -0,0 +1,196 @@
+package theme
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"gopkg.in/yaml.v3"
+)
+
+// rawTheme is the on-disk form. Every token is a pointer so an absent key is
+// distinguishable from an empty one, which is what lets 'extends' overwrite
+// only what the file actually mentions.
+type rawTheme struct {
+	Extends *string `yaml:"extends"`
+
+	Primary   *string `yaml:"primary"`
+	OnPrimary *string `yaml:"on_primary"`
+	Text      *string `yaml:"text"`
+	Muted     *string `yaml:"muted"`
+	Accent    *string `yaml:"accent"`
+
+	Firing   *string `yaml:"firing"`
+	Resolved *string `yaml:"resolved"`
+	Error    *string `yaml:"error"`
+
+	SevCritical *string `yaml:"sev_critical"`
+	SevError    *string `yaml:"sev_error"`
+	SevWarning  *string `yaml:"sev_warning"`
+	SevInfo     *string `yaml:"sev_info"`
+}
+
+// binding ties a YAML key to its raw value and the field it fills, so parsing,
+// merging and the missing-token report all walk the same list.
+type binding struct {
+	key string
+	src *string
+	dst *lipgloss.Color
+}
+
+func bindings(r *rawTheme, t *Theme) []binding {
+	return []binding{
+		{"primary", r.Primary, &t.Primary},
+		{"on_primary", r.OnPrimary, &t.OnPrimary},
+		{"text", r.Text, &t.Text},
+		{"muted", r.Muted, &t.Muted},
+		{"accent", r.Accent, &t.Accent},
+		{"firing", r.Firing, &t.Firing},
+		{"resolved", r.Resolved, &t.Resolved},
+		{"error", r.Error, &t.Error},
+		{"sev_critical", r.SevCritical, &t.SevCritical},
+		{"sev_error", r.SevError, &t.SevError},
+		{"sev_warning", r.SevWarning, &t.SevWarning},
+		{"sev_info", r.SevInfo, &t.SevInfo},
+	}
+}
+
+// tokenKeys lists the colour keys a theme file may set, in the order they are
+// documented.
+func tokenKeys() []string {
+	bs := bindings(&rawTheme{}, &Theme{})
+	keys := make([]string, len(bs))
+	for i, b := range bs {
+		keys[i] = b.key
+	}
+	return keys
+}
+
+func isTokenKey(k string) bool {
+	if k == "extends" {
+		return true
+	}
+	for _, want := range tokenKeys() {
+		if k == want {
+			return true
+		}
+	}
+	return false
+}
+
+// Load resolves a theme by name. An empty name is the default; otherwise a file
+// in the user's themes directory wins over a built-in of the same name, so the
+// documented way to tweak a built-in is to shadow it rather than rename it.
+func Load(name string) (Theme, error) {
+	if name == "" {
+		return Default, nil
+	}
+
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		// Built-ins do not need the disk, so a missing config directory only
+		// matters for user themes.
+		if t, ok := builtins[name]; ok {
+			return t, nil
+		}
+		return Theme{}, fmt.Errorf("cannot determine config directory: %w", err)
+	}
+
+	return loadFrom(filepath.Join(dir, "terdut-tui", "themes"), name)
+}
+
+func loadFrom(dir, name string) (Theme, error) {
+	if strings.ContainsAny(name, `/\`) || name == "." || name == ".." {
+		return Theme{}, fmt.Errorf("invalid theme name %q: a theme is a bare name, not a path", name)
+	}
+
+	path := filepath.Join(dir, name+".yaml")
+	data, err := os.ReadFile(path)
+	switch {
+	case err == nil:
+		return parse(name, data)
+	case !os.IsNotExist(err):
+		return Theme{}, fmt.Errorf("cannot read theme file %s: %w", path, err)
+	}
+
+	if t, ok := builtins[name]; ok {
+		return t, nil
+	}
+
+	return Theme{}, fmt.Errorf("unknown theme %q\n\nBuilt-in themes: %s\nOr define your own at %s",
+		name, strings.Join(BuiltinNames(), ", "), path)
+}
+
+func parse(name string, data []byte) (Theme, error) {
+	// Check the keys before decoding, so a typo'd token reports itself by name
+	// alongside the ones that would have worked rather than surfacing yaml's
+	// message about an internal Go type.
+	var keys map[string]yaml.Node
+	if err := yaml.Unmarshal(data, &keys); err != nil {
+		return Theme{}, fmt.Errorf("invalid theme %q: %w", name, err)
+	}
+	for k := range keys {
+		if !isTokenKey(k) {
+			return Theme{}, fmt.Errorf("theme %q: unknown key %q\n\nValid keys: extends, %s",
+				name, k, strings.Join(tokenKeys(), ", "))
+		}
+	}
+
+	var raw rawTheme
+	if err := yaml.Unmarshal(data, &raw); err != nil {
+		return Theme{}, fmt.Errorf("invalid theme %q: %w", name, err)
+	}
+
+	t := Theme{Name: name}
+	if raw.Extends != nil {
+		base, ok := builtins[*raw.Extends]
+		if !ok {
+			return Theme{}, fmt.Errorf("theme %q: 'extends' names unknown theme %q (built-ins: %s)",
+				name, *raw.Extends, strings.Join(BuiltinNames(), ", "))
+		}
+		t = base
+		t.Name = name
+	}
+
+	var missing []string
+	for _, b := range bindings(&raw, &t) {
+		if b.src == nil {
+			if raw.Extends == nil {
+				missing = append(missing, b.key)
+			}
+			continue
+		}
+		c, err := parseColor(*b.src)
+		if err != nil {
+			return Theme{}, fmt.Errorf("theme %q: %s: %w", name, b.key, err)
+		}
+		*b.dst = c
+	}
+
+	if len(missing) > 0 {
+		return Theme{}, fmt.Errorf("theme %q is missing %s\n\nEither set every token or add 'extends: %s' to inherit the rest",
+			name, strings.Join(missing, ", "), Default.Name)
+	}
+
+	return t, nil
+}
+
+var hexColor = regexp.MustCompile(`^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$`)
+
+// parseColor accepts what lipgloss can actually render: a hex value, or an ANSI
+// palette index for people who would rather follow their terminal's colours.
+func parseColor(s string) (lipgloss.Color, error) {
+	if hexColor.MatchString(s) {
+		return lipgloss.Color(s), nil
+	}
+	// strconv.Itoa round-trips to reject "+7" and "007", which lipgloss would
+	// pass to the terminal verbatim.
+	if n, err := strconv.Atoi(s); err == nil && n >= 0 && n <= 255 && strconv.Itoa(n) == s {
+		return lipgloss.Color(s), nil
+	}
+	return "", fmt.Errorf("invalid colour %q, want a hex value like \"#83a598\" or an ANSI index 0-255", s)
+}

internal/theme/load_test.go

@@ -0,0 +1,180 @@
+package theme
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// write drops a theme file into dir and returns the directory, so each test
+// works against its own themes directory rather than the user's.
+func write(t *testing.T, dir, name, body string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(dir, name+".yaml"), []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestLoad_EmptyNameIsTheDefault(t *testing.T) {
+	got, err := Load("")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got.Name != Default.Name {
+		t.Errorf("got theme %q, want %q", got.Name, Default.Name)
+	}
+}
+
+func TestLoadFrom_BuiltinsResolveWithoutAFile(t *testing.T) {
+	dir := t.TempDir()
+	for _, name := range BuiltinNames() {
+		got, err := loadFrom(dir, name)
+		if err != nil {
+			t.Fatalf("%s: unexpected error: %v", name, err)
+		}
+		if got.Name != name {
+			t.Errorf("got theme %q, want %q", got.Name, name)
+		}
+		if got.Primary == "" {
+			t.Errorf("%s: primary is unset", name)
+		}
+	}
+}
+
+func TestLoadFrom_ExtendsOverridesOnlyWhatIsNamed(t *testing.T) {
+	dir := t.TempDir()
+	write(t, dir, "mine", "extends: gruvbox-dark\nprimary: \"#d3869b\"\n")
+
+	got, err := loadFrom(dir, "mine")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got.Name != "mine" {
+		t.Errorf("got name %q, want %q", got.Name, "mine")
+	}
+	if got.Primary != "#d3869b" {
+		t.Errorf("got primary %q, want the override", got.Primary)
+	}
+	if got.Muted != GruvboxDark.Muted {
+		t.Errorf("got muted %q, want inherited %q", got.Muted, GruvboxDark.Muted)
+	}
+	if got.SevInfo != GruvboxDark.SevInfo {
+		t.Errorf("got sev_info %q, want inherited %q", got.SevInfo, GruvboxDark.SevInfo)
+	}
+}
+
+func TestLoadFrom_UserFileShadowsABuiltin(t *testing.T) {
+	dir := t.TempDir()
+	write(t, dir, "gruvbox-dark", "extends: gruvbox-dark\naccent: \"#fabd2f\"\n")
+
+	got, err := loadFrom(dir, "gruvbox-dark")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got.Accent != "#fabd2f" {
+		t.Errorf("got accent %q, want the shadowing file's value", got.Accent)
+	}
+}
+
+func TestLoadFrom_WithoutExtendsEveryTokenIsRequired(t *testing.T) {
+	dir := t.TempDir()
+	write(t, dir, "partial", "primary: \"#83a598\"\n")
+
+	_, err := loadFrom(dir, "partial")
+	if err == nil {
+		t.Fatal("expected an error for a theme missing tokens")
+	}
+	for _, want := range []string{"muted", "sev_info", "extends"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("error should mention %q, got: %v", want, err)
+		}
+	}
+}
+
+func TestLoadFrom_CompleteThemeNeedsNoExtends(t *testing.T) {
+	dir := t.TempDir()
+	write(t, dir, "full", `primary: "#000001"
+on_primary: "#000002"
+text: "#000003"
+muted: "#000004"
+accent: "#000005"
+firing: "#000006"
+resolved: "#000007"
+error: "#000008"
+sev_critical: "#000009"
+sev_error: "#00000a"
+sev_warning: "#00000b"
+sev_info: "#00000c"
+`)
+
+	got, err := loadFrom(dir, "full")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got.Primary != "#000001" || got.SevInfo != "#00000c" {
+		t.Errorf("tokens not applied: %+v", got)
+	}
+}
+
+func TestLoadFrom_Errors(t *testing.T) {
+	tests := []struct {
+		name string
+		file string // empty means: write no file at all
+		body string
+		want string
+	}{
+		{"unknown name", "", "", "unknown theme"},
+		{"unknown key", "typo", "extends: gruvbox-dark\nprimry: \"#83a598\"\n", `unknown key "primry"`},
+		{"unknown key lists the valid ones", "typo2", "primry: \"#83a598\"\n", "Valid keys: extends, primary,"},
+		{"bad colour", "bad", "extends: gruvbox-dark\nprimary: notacolour\n", "invalid colour"},
+		{"bad colour names the token", "badkey", "extends: gruvbox-dark\nsev_warning: \"#gggggg\"\n", "sev_warning"},
+		{"unknown base", "orphan", "extends: solarized\nprimary: \"#83a598\"\n", "unknown theme \"solarized\""},
+		{"malformed yaml", "broken", "extends: [\n", "invalid theme"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			name := tt.file
+			if name == "" {
+				name = "missing"
+			} else {
+				write(t, dir, name, tt.body)
+			}
+
+			_, err := loadFrom(dir, name)
+			if err == nil {
+				t.Fatal("expected an error")
+			}
+			if !strings.Contains(err.Error(), tt.want) {
+				t.Errorf("error should mention %q, got: %v", tt.want, err)
+			}
+		})
+	}
+}
+
+func TestLoadFrom_RejectsPathsAsNames(t *testing.T) {
+	dir := t.TempDir()
+	for _, name := range []string{"../secrets", "sub/theme", ".."} {
+		if _, err := loadFrom(dir, name); err == nil {
+			t.Errorf("%q: expected an error", name)
+		}
+	}
+}
+
+func TestParseColor(t *testing.T) {
+	ok := []string{"#83a598", "#FFF", "#abc", "0", "15", "255"}
+	for _, s := range ok {
+		if _, err := parseColor(s); err != nil {
+			t.Errorf("parseColor(%q) = %v, want no error", s, err)
+		}
+	}
+
+	bad := []string{"", "83a598", "#ab", "#abcd", "#gggggg", "256", "-1", "+7", "007", "red"}
+	for _, s := range bad {
+		if _, err := parseColor(s); err == nil {
+			t.Errorf("parseColor(%q) = nil, want an error", s)
+		}
+	}
+}

internal/theme/theme.go

@@ -0,0 +1,32 @@
+// Package theme resolves the named colour scheme the TUI renders with. A theme
+// is a flat set of semantic tokens — roles like "muted" or "firing", never hues
+// — so a new scheme is a table of colours rather than a change to the views.
+package theme
+
+import "github.com/charmbracelet/lipgloss"
+
+// Theme is the palette the UI draws from. Every token is a foreground except
+// OnPrimary, which is the text colour for the two places that invert: the
+// active tab and the selected table row.
+//
+// Colours are truecolor hex; lipgloss downsamples them for 256- and 16-colour
+// terminals and drops them entirely under NO_COLOR, so themes do not carry
+// fallbacks of their own.
+type Theme struct {
+	Name string
+
+	Primary   lipgloss.Color // header, tab highlight, selection
+	OnPrimary lipgloss.Color // text drawn on a Primary background
+	Text      lipgloss.Color // default emphasis foreground
+	Muted     lipgloss.Color // secondary text, dividers, borders
+	Accent    lipgloss.Color // status line, acknowledged, by-day chart
+
+	Firing   lipgloss.Color
+	Resolved lipgloss.Color
+	Error    lipgloss.Color
+
+	SevCritical lipgloss.Color
+	SevError    lipgloss.Color
+	SevWarning  lipgloss.Color
+	SevInfo     lipgloss.Color
+}

internal/tui/model.go

@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"time"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
 	"github.com/charmbracelet/bubbles/help"
 	"github.com/charmbracelet/bubbles/table"
 	"github.com/charmbracelet/bubbles/textinput"
 	"github.com/charmbracelet/bubbles/viewport"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/charmbracelet/lipgloss"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
 // ── Enums ──────────────────────────────────────────────────────────────────
@@ -18,21 +18,29 @@ import (
 type section int
 
 const (
-	sectionAlerts section = iota
+	// Incidents lead: they are the work. Alerts is the raw feed underneath.
+	sectionIncidents section = iota
+	sectionAlerts
+	sectionStats
+	sectionArchived
 	sectionSchedule
 	sectionUsers
+
+	sectionCount = 6
 )
 
 type mode int
 
 const (
 	modeDashboard mode = iota
-	modeDetail
+	modeIncidentDetail
-	modeComment
+	modeAlertDetail
-	modeConfirmDelete
+	modeNote
-	modeStats
+	modeSnooze
-	modeScheduleUserPicker
+	modeConfirm
+	modeUserPicker
 	modeUserCreate
+	modeUserNotifyEdit
 	modeAPIKeyMenu
 	modeAPIKeyCreate
 	modeAPIKeyReveal
@@ -42,28 +50,71 @@ const (
 type confirmTarget int
 
 const (
-	confirmDeleteComment confirmTarget = iota
+	confirmDeleteNote confirmTarget = iota
+	confirmResolveIncident
 	confirmDeleteScheduleEntry
 	confirmDeleteUser
+	confirmReassignSchedule
 )
 
+// pickerTarget says what the user picker is choosing a person for.
+type pickerTarget int
+
+const (
+	pickerSchedule pickerTarget = iota
+	pickerIncidentAssignee
+)
+
+// incidentFilters is the cycle the f key walks in the Incidents section. The
+// empty string is the server default: open, unsnoozed incidents — the queue.
+var incidentFilters = []string{"", api.StatusTriggered, api.StatusAcknowledged, api.StatusResolved, "snoozed"}
+
+// alertFilters is the equivalent cycle for the raw alert feed.
+var alertFilters = []string{"firing", "resolved", "", "archived"}
+
+// incidentQuery translates a filter from the cycle into server query terms.
+func incidentQuery(filter string) (status string, snoozed bool) {
+	if filter == "snoozed" {
+		return "", true
+	}
+	return filter, false
+}
+
+// filterLabel renders a filter for the status bar.
+func filterLabel(filter string) string {
+	if filter == "" {
+		return "open"
+	}
+	return filter
+}
+
 // ── Messages ───────────────────────────────────────────────────────────────
 
 // dashboard
 type connectedMsg struct{}
 type connectErrMsg struct{ err error }
+type incidentsFetchedMsg struct{ incidents []api.Incident }
+type archivedIncidentsFetchedMsg struct{ incidents []api.Incident }
+type incidentActionDoneMsg struct {
+	incidents []api.Incident
+	status    string
+}
 type alertsFetchedMsg struct{ alerts []api.Alert }
-type statsFetchedMsg struct{ stats api.AlertStats }
+type statsFetchedMsg struct {
+	incidents api.IncidentStats
+	alerts    api.AlertStats
+}
 type fetchDataErrMsg struct{ err error }
 type tickMsg time.Time
 type clearStatusMsg struct{}
 
 // detail
-type alertDetailFetchedMsg struct {
+type incidentDetailFetchedMsg struct {
-	alert    api.Alert
+	incident api.Incident
-	comments []api.Comment
+	timeline []api.IncidentEvent
 }
-type alertDetailErrMsg struct{ err error }
+type alertDetailFetchedMsg struct{ alert api.Alert }
+type detailErrMsg struct{ err error }
 type actionErrMsg struct{ err error }
 type detailStatsFetchedMsg struct {
 	top    []api.TopAlert
@@ -93,6 +144,18 @@ type scheduleDay struct {
 	entry *api.ScheduleEntry
 }
 
+// pendingAssign is an on-call assignment held back by the reassignment
+// confirmation, because some of its dates belong to somebody else.
+type pendingAssign struct {
+	userID   int64
+	username string
+	dates    []string
+	// taken are the dates currently held by other people, and holders the
+	// distinct names holding them — both only for wording the prompt.
+	taken   []string
+	holders []string
+}
+
 type Model struct {
 	client          *api.Client
 	serverURL       string
@@ -104,34 +167,55 @@ type Model struct {
 	height        int
 
 	// Connection & dashboard
-	connected    bool
+	connected     bool
-	loading      bool
+	loading       bool
-	err          error
+	err           error
-	statusMsg    string
+	statusMsg     string
-	alerts       []api.Alert
+	incidentStats *api.IncidentStats
-	stats        *api.AlertStats
+	alertStats    *api.AlertStats
-	filterStatus string
-	alertTable   table.Model
 
-	// Detail
+	// Incidents
-	selectedAlert  api.Alert
+	incidents      []api.Incident
-	comments       []api.Comment
+	incidentFilter string
-	commentCursor  int
+	incidentTable  table.Model
-	detailLoading  bool
-	detailViewport viewport.Model
 
-	// Comment compose
+	// Alerts (read-only feed)
-	commentInput textinput.Model
+	alerts      []api.Alert
+	alertFilter string
+	alertTable  table.Model
 
-	// Confirm delete
+	// Archived incidents
-	confirmTarget       confirmTarget
+	archivedIncidents []api.Incident
-	pendingDeleteID     int64          // comment ID
+	archivedLoading   bool
-	pendingDeleteEntry  *api.ScheduleEntry
+	archivedTable     table.Model
+
+	// Incident detail
+	selectedIncident api.Incident
+	timeline         []api.IncidentEvent
+	noteCursor       int
+	detailLoading    bool
+	detailViewport   viewport.Model
+
+	// Alert detail
+	selectedAlert api.Alert
+
+	// Note compose & snooze
+	noteInput   textinput.Model
+	snoozeInput textinput.Model
+
+	// Confirm
+	confirmTarget      confirmTarget
+	pendingDeleteID    int64 // note event ID
+	pendingDeleteEntry *api.ScheduleEntry
+	pendingAssign      *pendingAssign
 
 	// Stats
-	topAlerts     []api.TopAlert
+	topAlerts []api.TopAlert
-	hourStats     []api.HourStat
+	hourStats []api.HourStat
-	dayStats      []api.DayStat
+	dayStats  []api.DayStat
+	// statsLoaded tracks the first fetch separately from emptiness: a server with
+	// no alerts yet legitimately returns three empty slices.
+	statsLoaded   bool
 	statsLoading  bool
 	statsViewport viewport.Model
 
@@ -143,10 +227,11 @@ type Model struct {
 	scheduleLoading bool
 	scheduleTable   table.Model
 
-	// User picker (schedule assignment)
+	// User picker (schedule assignment and incident assignee)
 	users            []api.User
 	usersLoading     bool
 	userPickerTable  table.Model
+	pickerTarget     pickerTarget
 	pickerAssignWeek bool
 
 	// User management section
@@ -154,20 +239,29 @@ type Model struct {
 	selectedUser      api.User
 	userFormInputs    [2]textinput.Model
 	userFormFocus     int
+	ntfyTopicInput    textinput.Model
 	apiKeyNameInput   textinput.Model
 	apiKeyRevokeInput textinput.Model
 	revealedAPIKey    api.APIKey
 
-	help help.Model
+	help   help.Model
-	keys keyMap
+	keys   keyMap
+	styles Styles
 }
 
-func NewModel(client *api.Client, serverURL string, refreshInterval time.Duration) Model {
+func NewModel(client *api.Client, serverURL string, refreshInterval time.Duration, th theme.Theme) Model {
-	ts := defaultTableStyles()
+	st := newStyles(th)
+	ts := st.Table()
+
+	incidentT := table.New(table.WithFocused(true))
+	incidentT.SetStyles(ts)
 
 	alertT := table.New(table.WithFocused(true))
 	alertT.SetStyles(ts)
 
+	archivedT := table.New(table.WithFocused(true))
+	archivedT.SetStyles(ts)
+
 	schedT := table.New(table.WithFocused(true))
 	schedT.SetStyles(ts)
 
@@ -177,9 +271,17 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 	manageT := table.New(table.WithFocused(true))
 	manageT.SetStyles(ts)
 
-	ti := textinput.New()
+	// Sized by the first tea.WindowSizeMsg; built here so it carries the default
-	ti.Placeholder = "type your comment…"
+	// scroll keymap, which the zero value lacks.
-	ti.CharLimit = 1000
+	statsVP := viewport.New(0, 0)
+
+	noteIn := textinput.New()
+	noteIn.Placeholder = "type your note…"
+	noteIn.CharLimit = 1000
+
+	snoozeIn := textinput.New()
+	snoozeIn.Placeholder = "duration, e.g. 2h or 30m"
+	snoozeIn.CharLimit = 16
 
 	usernameIn := textinput.New()
 	usernameIn.Placeholder = "username"
@@ -189,6 +291,10 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 	emailIn.Placeholder = "email"
 	emailIn.CharLimit = 128
 
+	topicIn := textinput.New()
+	topicIn.Placeholder = "ntfy topic — empty clears it"
+	topicIn.CharLimit = 128
+
 	keyNameIn := textinput.New()
 	keyNameIn.Placeholder = "key name (e.g. laptop)"
 	keyNameIn.CharLimit = 64
@@ -197,6 +303,15 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 	revokeIn.Placeholder = "integer key ID"
 	revokeIn.CharLimit = 20
 
+	for _, in := range []*textinput.Model{
+		&noteIn, &snoozeIn, &usernameIn, &emailIn, &topicIn, &keyNameIn, &revokeIn,
+	} {
+		*in = st.Input(*in)
+	}
+
+	helpModel := help.New()
+	helpModel.Styles = st.Help()
+
 	now := time.Now().UTC()
 	today := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, time.UTC)
 	weekday := int(today.Weekday())
@@ -209,22 +324,29 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 		client:            client,
 		serverURL:         serverURL,
 		refreshInterval:   refreshInterval,
-		activeSection:     sectionAlerts,
+		activeSection:     sectionIncidents,
 		mode:              modeDashboard,
 		loading:           true,
-		filterStatus:      "firing",
+		incidentFilter:    "",
-		commentCursor:     -1,
+		alertFilter:       "firing",
+		noteCursor:        -1,
+		incidentTable:     incidentT,
 		alertTable:        alertT,
-		commentInput:      ti,
+		archivedTable:     archivedT,
+		statsViewport:     statsVP,
+		noteInput:         noteIn,
+		snoozeInput:       snoozeIn,
 		scheduleWindow:    window,
 		scheduleTable:     schedT,
 		userPickerTable:   pickerT,
 		userManageTable:   manageT,
 		userFormInputs:    [2]textinput.Model{usernameIn, emailIn},
+		ntfyTopicInput:    topicIn,
 		apiKeyNameInput:   keyNameIn,
 		apiKeyRevokeInput: revokeIn,
-		help:              help.New(),
+		help:              helpModel,
 		keys:              keys,
+		styles:            st,
 	}
 }
 
@@ -234,34 +356,46 @@ func (m Model) Init() tea.Cmd {
 
 // ── Table rebuilders ───────────────────────────────────────────────────────
 
-func defaultTableStyles() table.Styles {
+// setRows replaces a table's rows and keeps its cursor in a state the rest of
-	s := table.DefaultStyles()
+// this package can rely on: valid whenever the table has any rows at all.
-	s.Header = s.Header.Bold(true)
+//
-	s.Selected = s.Selected.
+// bubbles does not do that on its own. SetRows only clamps the cursor *down*
-		Foreground(lipgloss.Color("0")).
+// (`if m.cursor > len(rows)-1`), so setting zero rows drives it to -1 and
-		Background(colorPrimary).
+// nothing ever brings it back — filling the table later leaves -1 in place,
-		Bold(true)
+// because -1 is not greater than len-1. Every table here is rebuilt from empty
-	return s
+// once at startup, when the first WindowSizeMsg arrives before any fetch has
+// returned, so without this every cursor is -1 until the user happens to press
+// up or down. Indexing a slice with that panics, which is exactly what
+// assigning an on-call week did.
+func setRows(t *table.Model, rows []table.Row) {
+	t.SetRows(rows)
+	if len(rows) > 0 && t.Cursor() < 0 {
+		t.SetCursor(0)
+	}
+}
+
+func (m *Model) rebuildIncidentTable() {
+	m.incidentTable.SetColumns(incidentColumns(m.width))
+	setRows(&m.incidentTable, incidentRows(m.incidents))
+	m.incidentTable.SetHeight(tableHeight(m.height, 8))
 }
 
 func (m *Model) rebuildTable() {
 	m.alertTable.SetColumns(alertColumns(m.width))
-	m.alertTable.SetRows(alertRows(m.alerts))
+	setRows(&m.alertTable, alertRows(m.alerts))
-	h := m.height - 8
+	m.alertTable.SetHeight(tableHeight(m.height, 8))
-	if h < 1 {
+}
-		h = 1
+
-	}
+func (m *Model) rebuildArchivedTable() {
-	m.alertTable.SetHeight(h)
+	m.archivedTable.SetColumns(incidentColumns(m.width))
+	setRows(&m.archivedTable, incidentRows(m.archivedIncidents))
+	m.archivedTable.SetHeight(tableHeight(m.height, 8))
 }
 
 func (m *Model) rebuildScheduleTable() {
 	m.scheduleTable.SetColumns(scheduleColumns(m.width))
-	m.scheduleTable.SetRows(scheduleRows(m.scheduleDays))
+	setRows(&m.scheduleTable, scheduleRows(m.scheduleDays))
-	h := m.height - 10
+	m.scheduleTable.SetHeight(tableHeight(m.height, 10))
-	if h < 1 {
-		h = 1
-	}
-	m.scheduleTable.SetHeight(h)
 }
 
 func (m *Model) rebuildUserPickerTable() {
@@ -270,42 +404,60 @@ func (m *Model) rebuildUserPickerTable() {
 	for i, u := range m.users {
 		rows[i] = table.Row{u.Username, u.Email}
 	}
-	m.userPickerTable.SetRows(rows)
+	setRows(&m.userPickerTable, rows)
-	h := m.height - 10
+	m.userPickerTable.SetHeight(tableHeight(m.height, 10))
-	if h < 1 {
-		h = 1
-	}
-	m.userPickerTable.SetHeight(h)
 }
 
 func (m *Model) rebuildUserManageTable() {
 	m.userManageTable.SetColumns(userManageColumns(m.width))
 	rows := make([]table.Row, len(m.users))
 	for i, u := range m.users {
-		rows[i] = table.Row{u.Username, u.Email, u.CreatedAt.UTC().Format("2006-01-02")}
+		topic := u.Topic()
+		if topic == "" {
+			topic = "—"
+		}
+		rows[i] = table.Row{u.Username, u.Email, topic, u.CreatedAt.UTC().Format("2006-01-02")}
 	}
-	m.userManageTable.SetRows(rows)
+	setRows(&m.userManageTable, rows)
-	h := m.height - 10
+	m.userManageTable.SetHeight(tableHeight(m.height, 10))
+}
+
+func tableHeight(windowHeight, chrome int) int {
+	h := windowHeight - chrome
 	if h < 1 {
 		h = 1
 	}
-	m.userManageTable.SetHeight(h)
+	return h
 }
 
 func (m *Model) refreshDetailContent() {
 	if m.width == 0 {
 		return
 	}
-	m.detailViewport.SetContent(buildDetailContent(m.selectedAlert, m.comments, m.commentCursor, m.width))
+	if m.mode == modeAlertDetail {
+		m.detailViewport.SetContent(buildAlertDetailContent(m.styles, m.selectedAlert, m.width))
+		return
+	}
+	m.detailViewport.SetContent(
+		buildIncidentDetailContent(m.styles, m.selectedIncident, m.timeline, m.noteCursor, m.width))
 }
 
 func (m *Model) refreshStatsContent() {
-	m.statsViewport.SetContent(buildStatsContent(m.topAlerts, m.hourStats, m.dayStats, m.width))
+	m.statsViewport.SetContent(
+		buildStatsContent(m.styles, m.incidentStats, m.topAlerts, m.hourStats, m.dayStats, m.width))
+}
+
+func (m Model) statsViewportHeight() int {
+	h := m.height - 5
+	if h < 1 {
+		h = 1
+	}
+	return h
 }
 
 func (m Model) detailViewportHeight() int {
 	h := m.height - 5
-	if m.mode == modeComment {
+	if m.mode == modeNote || m.mode == modeSnooze {
 		h -= 2
 	}
 	if h < 1 {
@@ -314,22 +466,57 @@ func (m Model) detailViewportHeight() int {
 	return h
 }
 
+// noteEvents filters a timeline down to the deletable entries, which is what
+// the [ and ] cursor walks.
+func noteEvents(timeline []api.IncidentEvent) []api.IncidentEvent {
+	notes := make([]api.IncidentEvent, 0, len(timeline))
+	for _, e := range timeline {
+		if e.Type == api.EventNote {
+			notes = append(notes, e)
+		}
+	}
+	return notes
+}
+
 // ── Column definitions ─────────────────────────────────────────────────────
 
+func incidentColumns(width int) []table.Column {
+	const sevW, statusW, timeW = 9, 15, 12
+	titleW := width/2 - 10
+	if titleW < 20 {
+		titleW = 20
+	}
+	// 10 = bubbles' Padding(0, 1) on each of the five cells.
+	assigneeW := width - sevW - titleW - statusW - timeW - 10
+	if assigneeW < 8 {
+		assigneeW = 8
+	}
+	return []table.Column{
+		{Title: "Sev", Width: sevW},
+		{Title: "Incident", Width: titleW},
+		{Title: "Status", Width: statusW},
+		{Title: "Assignee", Width: assigneeW},
+		{Title: "Triggered", Width: timeW},
+	}
+}
+
 func alertColumns(width int) []table.Column {
-	nameW := width/2 - 8
+	const statusW, timeW = 10, 12
+	nameW := width/2 - 14
 	if nameW < 20 {
 		nameW = 20
 	}
-	ackW := width - nameW - 10 - 12 - 6
+	// 10 = bubbles' Padding(0, 1) on each of the five cells.
-	if ackW < 8 {
+	incW := width - nameW - statusW - 2*timeW - 10
-		ackW = 8
+	if incW < 8 {
+		incW = 8
 	}
 	return []table.Column{
 		{Title: "Name", Width: nameW},
-		{Title: "Status", Width: 10},
+		{Title: "Status", Width: statusW},
-		{Title: "Started", Width: 12},
+		{Title: "Started", Width: timeW},
-		{Title: "Ack By", Width: ackW},
+		{Title: "Last Seen", Width: timeW},
+		{Title: "Incident", Width: incW},
 	}
 }
 
@@ -360,24 +547,54 @@ func userPickerColumns(width int) []table.Column {
 func userManageColumns(width int) []table.Column {
 	createdW := 12
 	usernameW := 25
-	emailW := width - usernameW - createdW - 8
+	topicW := 22
+	// 8 = bubbles' Padding(0, 1) on each of the four cells.
+	emailW := width - usernameW - topicW - createdW - 8
 	if emailW < 15 {
 		emailW = 15
 	}
 	return []table.Column{
 		{Title: "Username", Width: usernameW},
 		{Title: "Email", Width: emailW},
+		{Title: "Ntfy Topic", Width: topicW},
 		{Title: "Created", Width: createdW},
 	}
 }
 
 // ── Row builders ───────────────────────────────────────────────────────────
 
+func incidentRows(incidents []api.Incident) []table.Row {
+	now := time.Now()
+	rows := make([]table.Row, len(incidents))
+	for i, inc := range incidents {
+		severity := inc.Severity
+		if severity == "" {
+			severity = "—"
+		}
+		// bubbles' table renders plain strings, so a snoozed incident is marked
+		// in the status cell rather than styled.
+		status := inc.Status
+		if inc.IsSnoozed() {
+			status += " (zzz)"
+		}
+		assignee := inc.AssignedTo
+		if assignee == "" {
+			assignee = "—"
+		}
+		rows[i] = table.Row{severity, inc.Title, status, assignee, humanAgo(now, inc.TriggeredAt)}
+	}
+	return rows
+}
+
 func alertRows(alerts []api.Alert) []table.Row {
 	now := time.Now()
 	rows := make([]table.Row, len(alerts))
 	for i, a := range alerts {
-		rows[i] = table.Row{a.Name, a.Status, humanAgo(now, a.StartsAt), a.AcknowledgedBy}
+		incident := "—"
+		if a.IncidentID != nil {
+			incident = fmt.Sprintf("#%d", *a.IncidentID)
+		}
+		rows[i] = table.Row{a.Name, a.Status, humanAgo(now, a.StartsAt), humanAgo(now, a.ReceivedAt), incident}
 	}
 	return rows
 }
@@ -431,28 +648,49 @@ func humanAgo(now, t time.Time) string {
 	if d < 0 {
 		d = 0
 	}
+	return humanDuration(d) + " ago"
+}
+
+// humanUntil renders a future deadline, used for snooze expiry.
+func humanUntil(now, t time.Time) string {
+	d := t.Sub(now)
+	if d <= 0 {
+		return "expired"
+	}
+	return "in " + humanDuration(d)
+}
+
+func humanDuration(d time.Duration) string {
 	switch {
 	case d < time.Minute:
-		return "just now"
+		return "moments"
 	case d < time.Hour:
-		return fmt.Sprintf("%dm ago", int(d.Minutes()))
+		return fmt.Sprintf("%dm", int(d.Minutes()))
 	case d < 24*time.Hour:
 		h := int(d.Hours())
 		m := int(d.Minutes()) % 60
 		if m == 0 {
-			return fmt.Sprintf("%dh ago", h)
+			return fmt.Sprintf("%dh", h)
 		}
-		return fmt.Sprintf("%dh %dm ago", h, m)
+		return fmt.Sprintf("%dh %dm", h, m)
 	default:
 		days := int(d.Hours()) / 24
 		h := int(d.Hours()) % 24
 		if h == 0 {
-			return fmt.Sprintf("%dd ago", days)
+			return fmt.Sprintf("%dd", days)
 		}
-		return fmt.Sprintf("%dd %dh ago", days, h)
+		return fmt.Sprintf("%dd %dh", days, h)
 	}
 }
 
+// humanSeconds renders an MTTA/MTTR average.
+func humanSeconds(secs *float64) string {
+	if secs == nil {
+		return "—"
+	}
+	return humanDuration(time.Duration(*secs) * time.Second)
+}
+
 // ── Commands ───────────────────────────────────────────────────────────────
 
 func connectCmd(client *api.Client) tea.Cmd {
@@ -464,9 +702,36 @@ func connectCmd(client *api.Client) tea.Cmd {
 	}
 }
 
-func fetchAlertsCmd(client *api.Client, status string) tea.Cmd {
+func fetchIncidentsCmd(client *api.Client, filter string) tea.Cmd {
 	return func() tea.Msg {
-		alerts, err := client.ListAlerts(status, 500)
+		status, snoozed := incidentQuery(filter)
+		incidents, err := client.ListIncidents(status, false, snoozed, 500)
+		if err != nil {
+			return fetchDataErrMsg{err}
+		}
+		return incidentsFetchedMsg{incidents}
+	}
+}
+
+func fetchArchivedIncidentsCmd(client *api.Client) tea.Cmd {
+	return func() tea.Msg {
+		// Archived incidents are all resolved, so the status filter has to be
+		// widened past the server's open-only default or nothing comes back.
+		incidents, err := client.ListIncidents(api.StatusResolved, true, false, 500)
+		if err != nil {
+			return fetchDataErrMsg{err}
+		}
+		return archivedIncidentsFetchedMsg{incidents}
+	}
+}
+
+func fetchAlertsCmd(client *api.Client, filter string) tea.Cmd {
+	return func() tea.Msg {
+		status, archived := filter, false
+		if filter == "archived" {
+			status, archived = "", true
+		}
+		alerts, err := client.ListAlerts(status, archived, 500)
 		if err != nil {
 			return fetchDataErrMsg{err}
 		}
@@ -476,11 +741,120 @@ func fetchAlertsCmd(client *api.Client, status string) tea.Cmd {
 
 func fetchStatsCmd(client *api.Client) tea.Cmd {
 	return func() tea.Msg {
-		stats, err := client.GetAlertStats()
+		incidents, err := client.GetIncidentStats()
 		if err != nil {
 			return fetchDataErrMsg{err}
 		}
-		return statsFetchedMsg{*stats}
+		alerts, err := client.GetAlertStats()
+		if err != nil {
+			return fetchDataErrMsg{err}
+		}
+		return statsFetchedMsg{incidents: *incidents, alerts: *alerts}
+	}
+}
+
+// incidentDetail reloads an incident and its timeline. Every detail-mode action
+// funnels through it so the view always reflects what the server just did.
+func incidentDetail(client *api.Client, id int64) tea.Msg {
+	incident, err := client.GetIncident(id)
+	if err != nil {
+		return detailErrMsg{err}
+	}
+	timeline, err := client.GetIncidentTimeline(id)
+	if err != nil {
+		return detailErrMsg{err}
+	}
+	return incidentDetailFetchedMsg{incident: *incident, timeline: timeline}
+}
+
+func fetchIncidentDetailCmd(client *api.Client, id int64) tea.Cmd {
+	return func() tea.Msg { return incidentDetail(client, id) }
+}
+
+// incidentActionCmd performs an action then reloads the detail view, reporting
+// the server's error rather than a stale success.
+func incidentActionCmd(client *api.Client, id int64, action func() error) tea.Cmd {
+	return func() tea.Msg {
+		if err := action(); err != nil {
+			return actionErrMsg{err}
+		}
+		return incidentDetail(client, id)
+	}
+}
+
+func acknowledgeIncidentCmd(client *api.Client, id int64) tea.Cmd {
+	return incidentActionCmd(client, id, func() error {
+		_, err := client.AcknowledgeIncident(id)
+		return err
+	})
+}
+
+func unacknowledgeIncidentCmd(client *api.Client, id int64) tea.Cmd {
+	return incidentActionCmd(client, id, func() error { return client.UnacknowledgeIncident(id) })
+}
+
+func resolveIncidentCmd(client *api.Client, id int64) tea.Cmd {
+	return incidentActionCmd(client, id, func() error {
+		_, err := client.ResolveIncident(id)
+		return err
+	})
+}
+
+func assignIncidentCmd(client *api.Client, id, userID int64) tea.Cmd {
+	return incidentActionCmd(client, id, func() error {
+		_, err := client.AssignIncident(id, userID)
+		return err
+	})
+}
+
+func snoozeIncidentCmd(client *api.Client, id int64, duration string) tea.Cmd {
+	return incidentActionCmd(client, id, func() error {
+		_, err := client.SnoozeIncident(id, duration)
+		return err
+	})
+}
+
+func unsnoozeIncidentCmd(client *api.Client, id int64) tea.Cmd {
+	return incidentActionCmd(client, id, func() error { return client.UnsnoozeIncident(id) })
+}
+
+func addNoteCmd(client *api.Client, id int64, content string) tea.Cmd {
+	return incidentActionCmd(client, id, func() error {
+		_, err := client.AddNote(id, content)
+		return err
+	})
+}
+
+func deleteNoteCmd(client *api.Client, id, eventID int64) tea.Cmd {
+	return incidentActionCmd(client, id, func() error { return client.DeleteNote(id, eventID) })
+}
+
+// archiveIncidentCmd archives from the list view, so it reloads the list rather
+// than a detail pane.
+func archiveIncidentCmd(client *api.Client, id int64, filter string) tea.Cmd {
+	return func() tea.Msg {
+		if _, err := client.ArchiveIncident(id); err != nil {
+			return actionErrMsg{err}
+		}
+		status, snoozed := incidentQuery(filter)
+		incidents, err := client.ListIncidents(status, false, snoozed, 500)
+		if err != nil {
+			return actionErrMsg{err}
+		}
+		return incidentActionDoneMsg{incidents: incidents, status: "Incident archived"}
+	}
+}
+
+func unarchiveIncidentCmd(client *api.Client, id int64) tea.Cmd {
+	return func() tea.Msg {
+		if err := client.UnarchiveIncident(id); err != nil {
+			return actionErrMsg{err}
+		}
+		incidents, err := client.ListIncidents(api.StatusResolved, true, false, 500)
+		if err != nil {
+			return actionErrMsg{err}
+		}
+		return archivedIncidentsFetchedMsg{incidents}
 	}
 }
 
@@ -488,78 +862,9 @@ func fetchAlertDetailCmd(client *api.Client, alertID int64) tea.Cmd {
 	return func() tea.Msg {
 		alert, err := client.GetAlert(alertID)
 		if err != nil {
-			return alertDetailErrMsg{err}
+			return detailErrMsg{err}
 		}
-		comments, err := client.GetComments(alertID)
+		return alertDetailFetchedMsg{alert: *alert}
-		if err != nil {
-			return alertDetailErrMsg{err}
-		}
-		return alertDetailFetchedMsg{alert: *alert, comments: comments}
-	}
-}
-
-func acknowledgeCmd(client *api.Client, alertID int64) tea.Cmd {
-	return func() tea.Msg {
-		alert, err := client.AcknowledgeAlert(alertID)
-		if err != nil {
-			return actionErrMsg{err}
-		}
-		comments, err := client.GetComments(alertID)
-		if err != nil {
-			return actionErrMsg{err}
-		}
-		return alertDetailFetchedMsg{alert: *alert, comments: comments}
-	}
-}
-
-func unacknowledgeCmd(client *api.Client, alertID int64) tea.Cmd {
-	return func() tea.Msg {
-		if err := client.UnacknowledgeAlert(alertID); err != nil {
-			return actionErrMsg{err}
-		}
-		alert, err := client.GetAlert(alertID)
-		if err != nil {
-			return actionErrMsg{err}
-		}
-		comments, err := client.GetComments(alertID)
-		if err != nil {
-			return actionErrMsg{err}
-		}
-		return alertDetailFetchedMsg{alert: *alert, comments: comments}
-	}
-}
-
-func addCommentCmd(client *api.Client, alertID int64, content string) tea.Cmd {
-	return func() tea.Msg {
-		if _, err := client.AddComment(alertID, content); err != nil {
-			return actionErrMsg{err}
-		}
-		alert, err := client.GetAlert(alertID)
-		if err != nil {
-			return actionErrMsg{err}
-		}
-		comments, err := client.GetComments(alertID)
-		if err != nil {
-			return actionErrMsg{err}
-		}
-		return alertDetailFetchedMsg{alert: *alert, comments: comments}
-	}
-}
-
-func deleteCommentCmd(client *api.Client, alertID, commentID int64) tea.Cmd {
-	return func() tea.Msg {
-		if err := client.DeleteComment(alertID, commentID); err != nil {
-			return actionErrMsg{err}
-		}
-		alert, err := client.GetAlert(alertID)
-		if err != nil {
-			return actionErrMsg{err}
-		}
-		comments, err := client.GetComments(alertID)
-		if err != nil {
-			return actionErrMsg{err}
-		}
-		return alertDetailFetchedMsg{alert: *alert, comments: comments}
 	}
 }
 
@@ -595,9 +900,9 @@ func fetchScheduleCmd(client *api.Client, from, to time.Time) tea.Cmd {
 	}
 }
 
-func assignScheduleCmd(client *api.Client, userID int64, dates []string, from, to time.Time) tea.Cmd {
+func assignScheduleCmd(client *api.Client, userID int64, dates []string, replace bool, from, to time.Time) tea.Cmd {
 	return func() tea.Msg {
-		if _, err := client.AssignSchedule(userID, dates); err != nil {
+		if _, err := client.AssignSchedule(userID, dates, replace); err != nil {
 			return scheduleActionErrMsg{err}
 		}
 		entries, err := client.GetSchedule(from.Format("2006-01-02"), to.Format("2006-01-02"))
@@ -652,6 +957,22 @@ func createUserCmd(client *api.Client, username, email string) tea.Cmd {
 	}
 }
 
+// setUserNotifyTargetCmd points a user's pages at a topic, or clears it when
+// topic is empty. It re-lists afterwards so the table shows what the server
+// stored rather than what was typed.
+func setUserNotifyTargetCmd(client *api.Client, userID int64, topic string) tea.Cmd {
+	return func() tea.Msg {
+		if _, err := client.SetUserNotifyTarget(userID, topic); err != nil {
+			return userActionErrMsg{err}
+		}
+		users, err := client.ListUsers()
+		if err != nil {
+			return userActionErrMsg{err}
+		}
+		return usersFetchedMsg{users: users}
+	}
+}
+
 func deleteUserCmd(client *api.Client, userID int64) tea.Cmd {
 	return func() tea.Msg {
 		if err := client.DeleteUser(userID); err != nil {

internal/tui/model_test.go

@@ -0,0 +1,372 @@
+package tui
+
+import (
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	"github.com/charmbracelet/bubbles/table"
+)
+
+func TestNextFilter(t *testing.T) {
+	tests := []struct {
+		name    string
+		cycle   []string
+		current string
+		want    string
+	}{
+		{"advances", incidentFilters, "", api.StatusTriggered},
+		{"advances again", incidentFilters, api.StatusTriggered, api.StatusAcknowledged},
+		{"wraps back to the open queue", incidentFilters, "snoozed", ""},
+		{"alerts advance", alertFilters, "firing", "resolved"},
+		{"alerts wrap", alertFilters, "archived", "firing"},
+		{"unknown current restarts the cycle", incidentFilters, "bogus", ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := nextFilter(tt.cycle, tt.current); got != tt.want {
+				t.Errorf("expected %q, got %q", tt.want, got)
+			}
+		})
+	}
+}
+
+// "snoozed" is a pseudo-status in the filter cycle: the server has no such
+// status, it is a separate query axis.
+func TestIncidentQuery(t *testing.T) {
+	tests := []struct {
+		filter      string
+		wantStatus  string
+		wantSnoozed bool
+	}{
+		{"", "", false},
+		{api.StatusTriggered, api.StatusTriggered, false},
+		{api.StatusResolved, api.StatusResolved, false},
+		{"snoozed", "", true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.filter, func(t *testing.T) {
+			status, snoozed := incidentQuery(tt.filter)
+			if status != tt.wantStatus || snoozed != tt.wantSnoozed {
+				t.Errorf("expected (%q, %v), got (%q, %v)",
+					tt.wantStatus, tt.wantSnoozed, status, snoozed)
+			}
+		})
+	}
+}
+
+func TestFilterLabel(t *testing.T) {
+	if got := filterLabel(""); got != "open" {
+		t.Errorf("the empty filter is the open queue, got %q", got)
+	}
+	if got := filterLabel("resolved"); got != "resolved" {
+		t.Errorf("expected resolved, got %q", got)
+	}
+}
+
+func TestNoteEvents(t *testing.T) {
+	timeline := []api.IncidentEvent{
+		{Type: api.EventTriggered},
+		{Type: api.EventNote, Detail: "first"},
+		{Type: api.EventAcknowledged},
+		{Type: api.EventNote, Detail: "second"},
+	}
+	notes := noteEvents(timeline)
+	if len(notes) != 2 {
+		t.Fatalf("expected 2 notes, got %d", len(notes))
+	}
+	if notes[0].Detail != "first" || notes[1].Detail != "second" {
+		t.Errorf("notes out of order: %v", notes)
+	}
+	if len(noteEvents(nil)) != 0 {
+		t.Error("an empty timeline has no notes")
+	}
+}
+
+func TestHumanDuration(t *testing.T) {
+	tests := []struct {
+		d    time.Duration
+		want string
+	}{
+		{5 * time.Second, "moments"},
+		{90 * time.Second, "1m"},
+		{45 * time.Minute, "45m"},
+		{2 * time.Hour, "2h"},
+		{150 * time.Minute, "2h 30m"},
+		{48 * time.Hour, "2d"},
+		{50 * time.Hour, "2d 2h"},
+	}
+	for _, tt := range tests {
+		if got := humanDuration(tt.d); got != tt.want {
+			t.Errorf("humanDuration(%v) = %q, want %q", tt.d, got, tt.want)
+		}
+	}
+}
+
+func TestHumanAgo_ClampsFutureToNow(t *testing.T) {
+	now := time.Now()
+	// Server and client clocks disagree often enough that this must not render
+	// as a negative age.
+	if got := humanAgo(now, now.Add(time.Hour)); got != "moments ago" {
+		t.Errorf("expected a future timestamp to clamp, got %q", got)
+	}
+}
+
+func TestHumanUntil(t *testing.T) {
+	now := time.Now()
+	if got := humanUntil(now, now.Add(2*time.Hour)); got != "in 2h" {
+		t.Errorf("expected 'in 2h', got %q", got)
+	}
+	if got := humanUntil(now, now.Add(-time.Minute)); got != "expired" {
+		t.Errorf("a deadline in the past has expired, got %q", got)
+	}
+}
+
+// MTTA and MTTR are nil until something has been acknowledged or resolved, and
+// that has to read as "no data" rather than an instant response.
+func TestHumanSeconds(t *testing.T) {
+	if got := humanSeconds(nil); got != "—" {
+		t.Errorf("expected an em dash for no data, got %q", got)
+	}
+	secs := 150.0
+	if got := humanSeconds(&secs); got != "2m" {
+		t.Errorf("expected 2m, got %q", got)
+	}
+}
+
+func TestIncidentRows(t *testing.T) {
+	future := time.Now().Add(time.Hour)
+	rows := incidentRows([]api.Incident{
+		{Title: "DiskFull", Status: api.StatusTriggered, Severity: "critical",
+			AssignedTo: "admin", TriggeredAt: time.Now()},
+		{Title: "Unowned", Status: api.StatusTriggered, TriggeredAt: time.Now()},
+		{Title: "Quiet", Status: api.StatusTriggered, Severity: "info",
+			AssignedTo: "alice", SnoozedUntil: &future, TriggeredAt: time.Now()},
+	})
+	if len(rows) != 3 {
+		t.Fatalf("expected 3 rows, got %d", len(rows))
+	}
+	if rows[0][0] != "critical" || rows[0][3] != "admin" {
+		t.Errorf("unexpected first row %v", rows[0])
+	}
+	if rows[1][0] != "—" || rows[1][3] != "—" {
+		t.Errorf("missing severity and assignee should show an em dash, got %v", rows[1])
+	}
+	// bubbles' table renders plain strings, so snooze has to be marked in text.
+	if rows[2][2] != "triggered (zzz)" {
+		t.Errorf("expected a snooze marker in the status cell, got %q", rows[2][2])
+	}
+}
+
+func TestAlertRows_ShowIncidentLink(t *testing.T) {
+	id := int64(7)
+	rows := alertRows([]api.Alert{
+		{Name: "DiskFull", Status: "firing", IncidentID: &id},
+		{Name: "Orphan", Status: "resolved"},
+	})
+	if rows[0][4] != "#7" {
+		t.Errorf("expected #7, got %q", rows[0][4])
+	}
+	if rows[1][4] != "—" {
+		t.Errorf("an alert with no incident shows an em dash, got %q", rows[1][4])
+	}
+}
+
+// A user with no ntfy topic gets no pages of their own — the row has to say so
+// rather than leaving a blank that reads as "not loaded yet".
+func TestUserManageRows_ShowMissingTopic(t *testing.T) {
+	topic := "terdut-niklas"
+	empty := ""
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	m.users = []api.User{
+		{ID: 1, Username: "niklas", NtfyTopic: &topic},
+		{ID: 2, Username: "alex"},
+		// The server stores a blank topic as NULL, but a stale client or an older
+		// server can still hand one back; it means the same thing.
+		{ID: 3, Username: "sam", NtfyTopic: &empty},
+	}
+	m.rebuildUserManageTable()
+
+	rows := m.userManageTable.Rows()
+	if rows[0][2] != "terdut-niklas" {
+		t.Errorf("expected the topic in the row, got %q", rows[0][2])
+	}
+	if rows[1][2] != "—" || rows[2][2] != "—" {
+		t.Errorf("expected an em dash for nil and empty topics, got %q and %q",
+			rows[1][2], rows[2][2])
+	}
+}
+
+// A previous release overflowed the terminal by two columns because the padding
+// budget was wrong. Columns plus bubbles' per-cell padding must land exactly on
+// the window width.
+func TestColumnWidthsFitTheTerminal(t *testing.T) {
+	for _, width := range []int{100, 110, 140, 200} {
+		for name, cols := range map[string][]int{
+			"incident": widths(incidentColumns(width)),
+			"alert":    widths(alertColumns(width)),
+		} {
+			sum := 0
+			for _, w := range cols {
+				sum += w
+			}
+			const padding = 10 // bubbles applies Padding(0, 1) to each of five cells
+			if sum+padding != width {
+				t.Errorf("%s columns at width %d sum to %d+%d = %d",
+					name, width, sum, padding, sum+padding)
+			}
+		}
+
+		// The users table is four cells, so its padding budget differs.
+		sum := 0
+		for _, w := range widths(userManageColumns(width)) {
+			sum += w
+		}
+		const userPadding = 8
+		if sum+userPadding != width {
+			t.Errorf("user columns at width %d sum to %d+%d = %d",
+				width, sum, userPadding, sum+userPadding)
+		}
+	}
+}
+
+// Narrow terminals fall back to minimum widths, which legitimately overflow;
+// what must not happen is a negative or zero column.
+func TestColumnWidthsStayPositiveWhenNarrow(t *testing.T) {
+	for _, width := range []int{20, 40, 60} {
+		cols := append(widths(incidentColumns(width)), widths(alertColumns(width))...)
+		cols = append(cols, widths(userManageColumns(width))...)
+		for _, w := range cols {
+			if w < 1 {
+				t.Errorf("width %d produced a non-positive column %d", width, w)
+			}
+		}
+	}
+}
+
+func widths(cols []table.Column) []int {
+	out := make([]int, len(cols))
+	for i, c := range cols {
+		out[i] = c.Width
+	}
+	return out
+}
+
+func TestTableHeight_NeverGoesBelowOne(t *testing.T) {
+	if got := tableHeight(3, 10); got != 1 {
+		t.Errorf("expected a floor of 1, got %d", got)
+	}
+	if got := tableHeight(40, 8); got != 32 {
+		t.Errorf("expected 32, got %d", got)
+	}
+}
+
+func TestBuildScheduleDays(t *testing.T) {
+	monday := time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
+	days := buildScheduleDays(monday, []api.ScheduleEntry{
+		{Date: "2026-07-29", Username: "alice"},
+	})
+	if len(days) != 7 {
+		t.Fatalf("expected a 7-day window, got %d", len(days))
+	}
+	if days[2].entry == nil || days[2].entry.Username != "alice" {
+		t.Errorf("expected alice on the third day, got %+v", days[2].entry)
+	}
+	if days[0].entry != nil {
+		t.Error("expected unassigned days to have no entry")
+	}
+}
+
+// ── Schedule reassignment ─────────────────────────────────────────────────
+
+// scheduledWeek builds a model showing the week of 2026-07-27 with the given
+// entries already on the rota.
+func scheduledWeek(entries []api.ScheduleEntry) Model {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	m.connected = true
+	m.activeSection = sectionSchedule
+	m.scheduleWindow = time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
+	m.scheduleEntries = entries
+	m.scheduleDays = buildScheduleDays(m.scheduleWindow, entries)
+	m.rebuildScheduleTable()
+	return m
+}
+
+func TestScheduleConflicts(t *testing.T) {
+	m := scheduledWeek([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+		{ID: 2, Date: "2026-07-28", UserID: 3, Username: "sam"},
+		{ID: 3, Date: "2026-07-29", UserID: 2, Username: "alex"},
+	})
+	week := []string{"2026-07-27", "2026-07-28", "2026-07-29", "2026-07-30"}
+
+	// Assigning alex: the days niklas and sam hold are conflicts, the day alex
+	// already holds is not, and the free day is not.
+	taken, holders := m.scheduleConflicts(week, 2)
+	if len(taken) != 2 || taken[0] != "2026-07-27" || taken[1] != "2026-07-28" {
+		t.Errorf("expected the two other people's days, got %v", taken)
+	}
+	if len(holders) != 2 || holders[0] != "niklas" || holders[1] != "sam" {
+		t.Errorf("expected both holders named once, got %v", holders)
+	}
+}
+
+// Reassigning somebody to a day they already hold takes nothing from anyone, so
+// it must not raise a prompt — but it still needs replace, because the server
+// rejects any date that already exists.
+func TestScheduleConflicts_OwnDayIsNotAConflict(t *testing.T) {
+	m := scheduledWeek([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 2, Username: "alex"},
+	})
+	dates := []string{"2026-07-27"}
+
+	if taken, _ := m.scheduleConflicts(dates, 2); len(taken) != 0 {
+		t.Errorf("expected no conflict on the user's own day, got %v", taken)
+	}
+	if !m.scheduleOccupied(dates) {
+		t.Error("expected the day to still count as occupied, so replace is sent")
+	}
+}
+
+func TestScheduleOccupied_FreeDays(t *testing.T) {
+	m := scheduledWeek(nil)
+	if m.scheduleOccupied([]string{"2026-07-27", "2026-07-28"}) {
+		t.Error("expected an empty rota to need no replace")
+	}
+}
+
+func TestDayCount(t *testing.T) {
+	tests := []struct {
+		taken, total int
+		want         string
+	}{
+		{1, 1, "This day is"},
+		{7, 7, "All 7 days are"},
+		{3, 7, "3 of 7 days are"},
+	}
+	for _, tt := range tests {
+		if got := dayCount(tt.taken, tt.total); got != tt.want {
+			t.Errorf("dayCount(%d, %d) = %q, want %q", tt.taken, tt.total, got, tt.want)
+		}
+	}
+}
+
+func TestJoinNames(t *testing.T) {
+	tests := []struct {
+		names []string
+		want  string
+	}{
+		{nil, "somebody else"},
+		{[]string{"niklas"}, "niklas"},
+		{[]string{"niklas", "alex"}, "niklas and alex"},
+		{[]string{"niklas", "alex", "sam"}, "niklas, alex and sam"},
+	}
+	for _, tt := range tests {
+		if got := joinNames(tt.names); got != tt.want {
+			t.Errorf("joinNames(%v) = %q, want %q", tt.names, got, tt.want)
+		}
+	}
+}

internal/tui/styles.go

@@ -1,45 +1,175 @@
 package tui
 
-import "github.com/charmbracelet/lipgloss"
+import (
+	"strings"
 
-var (
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
-	colorPrimary  = lipgloss.Color("69")  // blue
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
-	colorMuted    = lipgloss.Color("240") // gray
+	"github.com/charmbracelet/bubbles/help"
-	colorFiring   = lipgloss.Color("196") // red
+	"github.com/charmbracelet/bubbles/table"
-	colorResolved = lipgloss.Color("70")  // green
+	"github.com/charmbracelet/bubbles/textinput"
-	colorAccent   = lipgloss.Color("214") // orange
+	"github.com/charmbracelet/lipgloss"
-
-	styleHeader = lipgloss.NewStyle().
-			Bold(true).
-			Foreground(colorPrimary).
-			Padding(0, 1)
-
-	styleTabActive = lipgloss.NewStyle().
-			Bold(true).
-			Foreground(lipgloss.Color("0")).
-			Background(colorPrimary).
-			Padding(0, 2)
-
-	styleTabInactive = lipgloss.NewStyle().
-				Foreground(colorMuted).
-				Padding(0, 2)
-
-	styleFooter = lipgloss.NewStyle().
-			Foreground(colorMuted)
-
-	styleStatus = lipgloss.NewStyle().
-			Foreground(colorAccent).
-			Bold(true)
-
-	styleError = lipgloss.NewStyle().
-			Foreground(colorFiring).
-			Bold(true)
-
-	styleFiring    = lipgloss.NewStyle().Foreground(colorFiring).Bold(true)
-	styleResolved  = lipgloss.NewStyle().Foreground(colorResolved)
-	styleMuted     = lipgloss.NewStyle().Foreground(colorMuted)
-	styleAlertName = lipgloss.NewStyle().Bold(true)
-	styleBold      = lipgloss.NewStyle().Bold(true)
-	styleSelected  = lipgloss.NewStyle().Foreground(colorPrimary).Bold(true)
-	styleAccent    = lipgloss.NewStyle().Foreground(colorAccent)
 )
+
+// Styles is every style the views draw with, built once from a theme and held
+// on the Model. Nothing here reads a colour literal: the theme is the only
+// place a colour is named.
+type Styles struct {
+	Header      lipgloss.Style
+	TabActive   lipgloss.Style
+	TabInactive lipgloss.Style
+	Footer      lipgloss.Style
+	Status      lipgloss.Style
+
+	Error     lipgloss.Style
+	Firing    lipgloss.Style
+	Resolved  lipgloss.Style
+	Muted     lipgloss.Style
+	Accent    lipgloss.Style
+	AlertName lipgloss.Style
+	Bold      lipgloss.Style
+	Selected  lipgloss.Style
+
+	// Incident status. Triggered is unclaimed work and reads as loudly as a
+	// firing alert; acknowledged means somebody has it.
+	Triggered    lipgloss.Style
+	Acknowledged lipgloss.Style
+	Snoozed      lipgloss.Style
+
+	// Severity, over the conventional Alertmanager label values.
+	SevCritical lipgloss.Style
+	SevError    lipgloss.Style
+	SevWarning  lipgloss.Style
+	SevInfo     lipgloss.Style
+
+	theme theme.Theme
+}
+
+func newStyles(t theme.Theme) Styles {
+	return Styles{
+		Header: lipgloss.NewStyle().
+			Bold(true).
+			Foreground(t.Primary).
+			Padding(0, 1),
+
+		TabActive: lipgloss.NewStyle().
+			Bold(true).
+			Foreground(t.OnPrimary).
+			Background(t.Primary).
+			Padding(0, 2),
+
+		TabInactive: lipgloss.NewStyle().
+			Foreground(t.Muted).
+			Padding(0, 2),
+
+		Footer: lipgloss.NewStyle().Foreground(t.Muted),
+
+		Status: lipgloss.NewStyle().
+			Foreground(t.Accent).
+			Bold(true),
+
+		Error: lipgloss.NewStyle().
+			Foreground(t.Error).
+			Bold(true),
+
+		Firing:    lipgloss.NewStyle().Foreground(t.Firing).Bold(true),
+		Resolved:  lipgloss.NewStyle().Foreground(t.Resolved),
+		Muted:     lipgloss.NewStyle().Foreground(t.Muted),
+		Accent:    lipgloss.NewStyle().Foreground(t.Accent),
+		AlertName: lipgloss.NewStyle().Foreground(t.Text).Bold(true),
+		Bold:      lipgloss.NewStyle().Foreground(t.Text).Bold(true),
+		Selected:  lipgloss.NewStyle().Foreground(t.Primary).Bold(true),
+
+		Triggered:    lipgloss.NewStyle().Foreground(t.Firing).Bold(true),
+		Acknowledged: lipgloss.NewStyle().Foreground(t.Accent).Bold(true),
+		Snoozed:      lipgloss.NewStyle().Foreground(t.Muted).Italic(true),
+
+		SevCritical: lipgloss.NewStyle().Foreground(t.SevCritical).Bold(true),
+		SevError:    lipgloss.NewStyle().Foreground(t.SevError).Bold(true),
+		SevWarning:  lipgloss.NewStyle().Foreground(t.SevWarning),
+		SevInfo:     lipgloss.NewStyle().Foreground(t.SevInfo),
+
+		theme: t,
+	}
+}
+
+// Severity picks the style for a severity label, falling back to muted for
+// values this client does not recognise rather than dropping them.
+func (s Styles) Severity(severity string) lipgloss.Style {
+	switch strings.ToLower(severity) {
+	case "critical":
+		return s.SevCritical
+	case "error":
+		return s.SevError
+	case "warning":
+		return s.SevWarning
+	case "info":
+		return s.SevInfo
+	default:
+		return s.Muted
+	}
+}
+
+// IncidentStatus picks the style for an incident status, falling back to muted
+// for statuses added after this client was built.
+func (s Styles) IncidentStatus(status string) lipgloss.Style {
+	switch status {
+	case api.StatusTriggered:
+		return s.Triggered
+	case api.StatusAcknowledged:
+		return s.Acknowledged
+	case api.StatusResolved:
+		return s.Resolved
+	default:
+		return s.Muted
+	}
+}
+
+// ── Embedded bubbles components ────────────────────────────────────────────
+//
+// Each ships its own hardcoded palette, so a theme that stopped at this
+// package's own styles would leave a pink selected row and grey help text
+// behind. These three restyle them from the same tokens.
+
+// Table styles the six tables. Padding comes from the bubbles defaults; only
+// the colours are ours.
+func (s Styles) Table() table.Styles {
+	ts := table.DefaultStyles()
+	ts.Header = ts.Header.Foreground(s.theme.Muted).Bold(true)
+	// Cell deliberately keeps no foreground: bubbles renders each cell before
+	// wrapping the whole row in Selected, so a colour here would emit a reset
+	// mid-row and cut the selection highlight short.
+	ts.Selected = ts.Selected.
+		Foreground(s.theme.OnPrimary).
+		Background(s.theme.Primary).
+		Bold(true)
+	return ts
+}
+
+// Help styles the key hints in the footer.
+func (s Styles) Help() help.Styles {
+	key := lipgloss.NewStyle().Foreground(s.theme.Text)
+	desc := lipgloss.NewStyle().Foreground(s.theme.Muted)
+	sep := lipgloss.NewStyle().Foreground(s.theme.Muted)
+
+	return help.Styles{
+		Ellipsis:       sep,
+		ShortKey:       key,
+		ShortDesc:      desc,
+		ShortSeparator: sep,
+		FullKey:        key,
+		FullDesc:       desc,
+		FullSeparator:  sep,
+	}
+}
+
+// Input styles a text input and returns it, so NewModel can wrap each one as
+// it is built.
+func (s Styles) Input(ti textinput.Model) textinput.Model {
+	ti.PromptStyle = lipgloss.NewStyle().Foreground(s.theme.Primary)
+	ti.TextStyle = lipgloss.NewStyle().Foreground(s.theme.Text)
+	ti.PlaceholderStyle = lipgloss.NewStyle().Foreground(s.theme.Muted)
+	ti.CompletionStyle = lipgloss.NewStyle().Foreground(s.theme.Muted)
+	ti.Cursor.Style = lipgloss.NewStyle().Foreground(s.theme.Primary)
+	return ti
+}

internal/tui/styles_test.go

@@ -0,0 +1,131 @@
+package tui
+
+import (
+	"testing"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	"github.com/charmbracelet/bubbles/textinput"
+	"github.com/charmbracelet/lipgloss"
+)
+
+// Assertions here read the colours off the styles rather than off rendered
+// output: under `go test` stdout is not a TTY, so lipgloss strips every escape
+// sequence and rendered strings would all compare equal.
+
+func wantFg(t *testing.T, s lipgloss.Style, want lipgloss.Color, what string) {
+	t.Helper()
+	if got := s.GetForeground(); got != want {
+		t.Errorf("%s foreground = %v, want %v", what, got, want)
+	}
+}
+
+func TestStyles_TokensReachTheStyles(t *testing.T) {
+	th := theme.GruvboxDark
+	s := newStyles(th)
+
+	wantFg(t, s.Header, th.Primary, "header")
+	wantFg(t, s.Firing, th.Firing, "firing")
+	wantFg(t, s.Resolved, th.Resolved, "resolved")
+	wantFg(t, s.Muted, th.Muted, "muted")
+	wantFg(t, s.Status, th.Accent, "status")
+	wantFg(t, s.Error, th.Error, "error")
+	wantFg(t, s.SevWarning, th.SevWarning, "sev warning")
+
+	// The two inverted spots need the pair, not just a foreground.
+	wantFg(t, s.TabActive, th.OnPrimary, "active tab")
+	if got := s.TabActive.GetBackground(); got != th.Primary {
+		t.Errorf("active tab background = %v, want %v", got, th.Primary)
+	}
+
+	// Attributes the old package-level styles carried must survive.
+	if !s.Firing.GetBold() {
+		t.Error("firing lost its bold")
+	}
+	if !s.Snoozed.GetItalic() {
+		t.Error("snoozed lost its italic")
+	}
+	if top, right, bottom, left := s.TabActive.GetPadding(); top != 0 || right != 2 || bottom != 0 || left != 2 {
+		t.Errorf("active tab padding = %d %d %d %d, want 0 2 0 2", top, right, bottom, left)
+	}
+}
+
+func TestStyles_EachBuiltinIsFullyPopulated(t *testing.T) {
+	for _, th := range []theme.Theme{theme.GruvboxDark, theme.GruvboxLight} {
+		s := newStyles(th)
+		for what, style := range map[string]lipgloss.Style{
+			"header": s.Header, "tab inactive": s.TabInactive, "footer": s.Footer,
+			"status": s.Status, "error": s.Error, "firing": s.Firing,
+			"resolved": s.Resolved, "muted": s.Muted, "accent": s.Accent,
+			"alert name": s.AlertName, "bold": s.Bold, "selected": s.Selected,
+			"triggered": s.Triggered, "acknowledged": s.Acknowledged, "snoozed": s.Snoozed,
+			"sev critical": s.SevCritical, "sev error": s.SevError,
+			"sev warning": s.SevWarning, "sev info": s.SevInfo,
+		} {
+			if style.GetForeground() == (lipgloss.NoColor{}) {
+				t.Errorf("%s: %s has no foreground", th.Name, what)
+			}
+		}
+	}
+}
+
+func TestStyles_SeverityFallsBackToMuted(t *testing.T) {
+	s := newStyles(theme.GruvboxDark)
+
+	for _, sev := range []string{"critical", "CRITICAL", "error", "warning", "info"} {
+		if s.Severity(sev).GetForeground() == s.Muted.GetForeground() {
+			t.Errorf("severity %q should have its own colour", sev)
+		}
+	}
+	for _, sev := range []string{"", "page", "unknown"} {
+		if s.Severity(sev).GetForeground() != s.Muted.GetForeground() {
+			t.Errorf("severity %q should fall back to muted", sev)
+		}
+	}
+}
+
+func TestStyles_IncidentStatusFallsBackToMuted(t *testing.T) {
+	s := newStyles(theme.GruvboxDark)
+
+	for _, status := range []string{api.StatusTriggered, api.StatusAcknowledged, api.StatusResolved} {
+		if s.IncidentStatus(status).GetForeground() == s.Muted.GetForeground() {
+			t.Errorf("status %q should have its own colour", status)
+		}
+	}
+	if s.IncidentStatus("invented-later").GetForeground() != s.Muted.GetForeground() {
+		t.Error("an unknown status should fall back to muted")
+	}
+}
+
+// The bubbles components ship their own palettes — a pink selected row, grey
+// help text, a 240 placeholder. These check we replaced them.
+func TestStyles_BubblesComponentsFollowTheTheme(t *testing.T) {
+	th := theme.GruvboxDark
+	s := newStyles(th)
+
+	ts := s.Table()
+	wantFg(t, ts.Selected, th.OnPrimary, "table selection")
+	if got := ts.Selected.GetBackground(); got != th.Primary {
+		t.Errorf("table selection background = %v, want %v", got, th.Primary)
+	}
+	wantFg(t, ts.Header, th.Muted, "table header")
+	if _, right, _, left := ts.Cell.GetPadding(); right != 1 || left != 1 {
+		t.Error("table cell padding was lost")
+	}
+	// A foreground on Cell would emit a reset mid-row and truncate the
+	// selection highlight, so it must stay unset.
+	if ts.Cell.GetForeground() != (lipgloss.NoColor{}) {
+		t.Error("table cells must not carry a foreground")
+	}
+
+	h := s.Help()
+	wantFg(t, h.ShortKey, th.Text, "help key")
+	wantFg(t, h.ShortDesc, th.Muted, "help description")
+	wantFg(t, h.FullSeparator, th.Muted, "help separator")
+
+	in := s.Input(textinput.New())
+	wantFg(t, in.PlaceholderStyle, th.Muted, "input placeholder")
+	wantFg(t, in.TextStyle, th.Text, "input text")
+	wantFg(t, in.PromptStyle, th.Primary, "input prompt")
+	wantFg(t, in.Cursor.Style, th.Primary, "input cursor")
+}

internal/tui/update_test.go

@@ -0,0 +1,726 @@
+package tui
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// press sends one key and returns the resulting model and command. A nil command
+// means the model decided to do nothing, which is what most of these tests are
+// really asserting.
+func press(t *testing.T, m Model, key string) (Model, tea.Cmd) {
+	t.Helper()
+	var msg tea.KeyMsg
+	switch key {
+	case "esc":
+		msg = tea.KeyMsg{Type: tea.KeyEsc}
+	case "enter":
+		msg = tea.KeyMsg{Type: tea.KeyEnter}
+	case "tab":
+		msg = tea.KeyMsg{Type: tea.KeyTab}
+	default:
+		msg = tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(key)}
+	}
+	next, cmd := m.Update(msg)
+	return next.(Model), cmd
+}
+
+// sized returns a connected model with a usable window, which most handlers need.
+func sized() Model {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	m.connected = true
+	return m
+}
+
+// onIncident opens the incident detail view directly, skipping the fetch.
+func onIncident(inc api.Incident, timeline []api.IncidentEvent) Model {
+	m := sized()
+	m.mode = modeIncidentDetail
+	m.selectedIncident = inc
+	m.timeline = timeline
+	m.noteCursor = -1
+	return m
+}
+
+func openIncidentFixture() api.Incident {
+	return api.Incident{ID: 1, Title: "DiskFull", Status: api.StatusTriggered,
+		Severity: "critical", TriggeredAt: time.Now()}
+}
+
+func resolvedIncidentFixture() api.Incident {
+	now := time.Now()
+	source := "manual"
+	inc := openIncidentFixture()
+	inc.Status = api.StatusResolved
+	inc.ResolvedAt = &now
+	inc.ResolutionSource = &source
+	return inc
+}
+
+// Resolving is terminal on the server: a later occurrence opens a new incident
+// rather than reopening this one. A stray keypress must not be able to do that.
+func TestResolve_AsksBeforeDoingIt(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+
+	m, cmd := press(t, m, "R")
+	if m.mode != modeConfirm {
+		t.Fatalf("expected a confirmation prompt, got mode %v", m.mode)
+	}
+	if m.confirmTarget != confirmResolveIncident {
+		t.Errorf("expected the resolve target, got %v", m.confirmTarget)
+	}
+	if cmd != nil {
+		t.Error("nothing should be sent to the server before confirming")
+	}
+	if !containsAll(m.confirmPrompt(), "final", "new incident") {
+		t.Errorf("the prompt should say resolving is final, got %q", m.confirmPrompt())
+	}
+}
+
+func TestResolve_CancelReturnsToDetailWithoutActing(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "R")
+
+	m, cmd := press(t, m, "n")
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to land back on the incident, got mode %v", m.mode)
+	}
+	if cmd != nil {
+		t.Error("cancelling must not act")
+	}
+}
+
+func TestResolve_ConfirmActs(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "R")
+
+	m, cmd := press(t, m, "y")
+	if cmd == nil {
+		t.Error("confirming should issue the resolve")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+// The server answers 409 on all of these; saying so up front beats a round trip.
+func TestResolvedIncident_RejectsWorkflowActions(t *testing.T) {
+	for _, key := range []string{"a", "A", "R", "s", "z", "Z"} {
+		t.Run(key, func(t *testing.T) {
+			m := onIncident(resolvedIncidentFixture(), nil)
+			m, cmd := press(t, m, key)
+			if cmd == nil {
+				t.Error("expected a status message command")
+			}
+			if m.statusMsg == "" {
+				t.Error("expected an explanation in the status line")
+			}
+			if m.mode != modeIncidentDetail {
+				t.Errorf("expected to stay on the incident, got mode %v", m.mode)
+			}
+		})
+	}
+}
+
+func TestOpenIncident_AcknowledgeTwiceIsRejected(t *testing.T) {
+	inc := openIncidentFixture()
+	id := int64(2)
+	at := time.Now()
+	inc.Status = api.StatusAcknowledged
+	inc.AcknowledgedByID = &id
+	inc.AcknowledgedBy = "alice"
+	inc.AcknowledgedAt = &at
+
+	m, _ := press(t, onIncident(inc, nil), "a")
+	if !containsAll(m.statusMsg, "already acknowledged", "alice") {
+		t.Errorf("expected to be told who holds it, got %q", m.statusMsg)
+	}
+}
+
+func TestOpenIncident_UnacknowledgeRequiresAnAcknowledgement(t *testing.T) {
+	m, _ := press(t, onIncident(openIncidentFixture(), nil), "A")
+	if m.statusMsg != "not acknowledged" {
+		t.Errorf("expected 'not acknowledged', got %q", m.statusMsg)
+	}
+}
+
+func TestOpenIncident_UnsnoozeRequiresASnooze(t *testing.T) {
+	m, _ := press(t, onIncident(openIncidentFixture(), nil), "Z")
+	if m.statusMsg != "not snoozed" {
+		t.Errorf("expected 'not snoozed', got %q", m.statusMsg)
+	}
+}
+
+// Archiving unresolved work only hides it, so the client refuses rather than
+// letting the queue be cleared by pressing x.
+func TestArchive_RefusesOpenIncident(t *testing.T) {
+	t.Run("from the detail view", func(t *testing.T) {
+		m, cmd := press(t, onIncident(openIncidentFixture(), nil), "x")
+		if cmd == nil || m.statusMsg == "" {
+			t.Error("expected a refusal message")
+		}
+		if m.mode != modeIncidentDetail {
+			t.Errorf("expected to stay put, got mode %v", m.mode)
+		}
+	})
+
+	t.Run("from the queue", func(t *testing.T) {
+		m := sized()
+		m.incidents = []api.Incident{openIncidentFixture()}
+		m.rebuildIncidentTable()
+
+		m, _ = press(t, m, "x")
+		if m.statusMsg == "" {
+			t.Error("expected a refusal message")
+		}
+	})
+}
+
+func TestArchive_AllowedOnResolvedIncident(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{resolvedIncidentFixture()}
+	m.rebuildIncidentTable()
+
+	m, cmd := press(t, m, "x")
+	if cmd == nil {
+		t.Error("archiving a resolved incident should act")
+	}
+	if m.statusMsg != "" {
+		t.Errorf("expected no refusal, got %q", m.statusMsg)
+	}
+}
+
+func TestSnooze_PromptThenSubmit(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+
+	m, _ = press(t, m, "z")
+	if m.mode != modeSnooze {
+		t.Fatalf("expected the snooze prompt, got mode %v", m.mode)
+	}
+
+	// Typing goes to the input, not the key handler.
+	for _, r := range "2h" {
+		m, _ = press(t, m, string(r))
+	}
+	if m.snoozeInput.Value() != "2h" {
+		t.Fatalf("expected the typed duration, got %q", m.snoozeInput.Value())
+	}
+
+	m, cmd := press(t, m, "enter")
+	if cmd == nil {
+		t.Error("expected the snooze to be sent")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+func TestSnooze_EmptyInputDoesNothing(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "z")
+
+	m, cmd := press(t, m, "enter")
+	if cmd != nil {
+		t.Error("an empty duration should not be sent")
+	}
+	if m.mode != modeSnooze {
+		t.Errorf("expected to stay on the prompt, got mode %v", m.mode)
+	}
+}
+
+func TestNote_EscapeAbandonsWithoutPosting(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "c")
+	if m.mode != modeNote {
+		t.Fatalf("expected the note prompt, got mode %v", m.mode)
+	}
+
+	m, cmd := press(t, m, "esc")
+	if cmd != nil {
+		t.Error("escaping must not post the note")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+func TestNoteCursor_WrapsOverNotesOnly(t *testing.T) {
+	timeline := []api.IncidentEvent{
+		{ID: 1, Type: api.EventTriggered},
+		{ID: 2, Type: api.EventNote, Detail: "first"},
+		{ID: 3, Type: api.EventAcknowledged},
+		{ID: 4, Type: api.EventNote, Detail: "second"},
+	}
+	m := onIncident(openIncidentFixture(), timeline)
+
+	m, _ = press(t, m, "]")
+	if m.noteCursor != 0 {
+		t.Fatalf("expected the first note, got %d", m.noteCursor)
+	}
+	m, _ = press(t, m, "]")
+	if m.noteCursor != 1 {
+		t.Fatalf("expected the second note, got %d", m.noteCursor)
+	}
+	m, _ = press(t, m, "]")
+	if m.noteCursor != 0 {
+		t.Errorf("expected to wrap to the first note, got %d", m.noteCursor)
+	}
+	m, _ = press(t, m, "[")
+	if m.noteCursor != 1 {
+		t.Errorf("expected to wrap backwards to the last note, got %d", m.noteCursor)
+	}
+}
+
+func TestDeleteNote_RequiresASelection(t *testing.T) {
+	m := onIncident(openIncidentFixture(), []api.IncidentEvent{{Type: api.EventTriggered}})
+	m, _ = press(t, m, "d")
+	if m.mode == modeConfirm {
+		t.Error("nothing is selected, so there is nothing to confirm")
+	}
+	if !containsAll(m.statusMsg, "select a note") {
+		t.Errorf("expected guidance, got %q", m.statusMsg)
+	}
+}
+
+func TestDeleteNote_ConfirmsThenActs(t *testing.T) {
+	timeline := []api.IncidentEvent{{ID: 9, Type: api.EventNote, Detail: "hi"}}
+	m := onIncident(openIncidentFixture(), timeline)
+
+	m, _ = press(t, m, "]")
+	m, _ = press(t, m, "d")
+	if m.mode != modeConfirm || m.confirmTarget != confirmDeleteNote {
+		t.Fatalf("expected a delete confirmation, got mode %v target %v", m.mode, m.confirmTarget)
+	}
+	if m.pendingDeleteID != 9 {
+		t.Errorf("expected the selected note's id, got %d", m.pendingDeleteID)
+	}
+
+	m, cmd := press(t, m, "y")
+	if cmd == nil {
+		t.Error("confirming should issue the delete")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+// ── Schedule reassignment ─────────────────────────────────────────────────
+
+// pickingOnCall opens the user picker for the schedule day at dayIndex, which
+// is where a reassignment actually starts.
+func pickingOnCall(entries []api.ScheduleEntry, dayIndex int, week bool) Model {
+	m := scheduledWeek(entries)
+	m.users = []api.User{
+		{ID: 1, Username: "niklas", Email: "n@example.com"},
+		{ID: 2, Username: "alex", Email: "a@example.com"},
+	}
+	m.rebuildUserPickerTable()
+	m.scheduleTable.SetCursor(dayIndex)
+	m.pickerAssignWeek = week
+	m.pickerTarget = pickerSchedule
+	m.mode = modeUserPicker
+	m.userPickerTable.SetCursor(1) // alex
+	return m
+}
+
+// The bug: a day somebody already holds could not be handed to anybody else.
+// The server refuses it, so the TUI has to ask first and then say so.
+func TestSchedule_ReassigningATakenDayAsksFirst(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+
+	m, cmd := press(t, m, "enter")
+
+	if m.mode != modeConfirm || m.confirmTarget != confirmReassignSchedule {
+		t.Fatalf("expected a reassignment confirmation, got mode %v target %v",
+			m.mode, m.confirmTarget)
+	}
+	if cmd != nil {
+		t.Error("expected nothing sent to the server before confirming")
+	}
+	mustContain(t, m.confirmPrompt(), "This day is assigned to niklas", "Reassign to alex?")
+}
+
+func TestSchedule_ReassignConfirmedSends(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+	m, _ = press(t, m, "enter")
+
+	m, cmd := press(t, m, "y")
+	if cmd == nil {
+		t.Fatal("expected the confirmed reassignment to be sent")
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("expected a return to the dashboard, got mode %v", m.mode)
+	}
+	if m.pendingAssign != nil {
+		t.Error("expected the pending assignment cleared")
+	}
+}
+
+// Declining must leave the rota alone — that is the whole point of the guard.
+func TestSchedule_ReassignDeclinedSendsNothing(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+	m, _ = press(t, m, "enter")
+
+	m, cmd := press(t, m, "n")
+	if cmd != nil {
+		t.Error("expected nothing sent when the reassignment is declined")
+	}
+	if m.pendingAssign != nil {
+		t.Error("expected the pending assignment discarded")
+	}
+}
+
+// A free day is the path that always worked, and must not grow a prompt.
+func TestSchedule_AssigningAFreeDayDoesNotAsk(t *testing.T) {
+	m := pickingOnCall(nil, 0, false)
+
+	m, cmd := press(t, m, "enter")
+	if m.mode != modeDashboard {
+		t.Errorf("expected no prompt for a free day, got mode %v", m.mode)
+	}
+	if cmd == nil {
+		t.Error("expected the assignment to be sent straight away")
+	}
+}
+
+// The week case is the one that was worst: a single taken day rejected all
+// seven. One prompt now covers the lot, and it says how much is being taken.
+func TestSchedule_ReassigningAPartlyTakenWeekAsksOnce(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-28", UserID: 1, Username: "niklas"},
+		{ID: 2, Date: "2026-07-30", UserID: 3, Username: "sam"},
+	}, 0, true)
+
+	m, _ = press(t, m, "enter")
+	if m.confirmTarget != confirmReassignSchedule {
+		t.Fatalf("expected one confirmation for the week, got target %v", m.confirmTarget)
+	}
+	if got := len(m.pendingAssign.dates); got != 7 {
+		t.Errorf("expected all 7 days in the assignment, got %d", got)
+	}
+	mustContain(t, m.confirmPrompt(), "2 of 7 days are assigned to niklas and sam")
+}
+
+// ── Ntfy topic ────────────────────────────────────────────────────────────
+
+// onUsers puts the model in the Users section with a loaded table.
+func onUsers(users []api.User) Model {
+	m := sized()
+	m.activeSection = sectionUsers
+	m.users = users
+	m.rebuildUserManageTable()
+	return m
+}
+
+func userFixtures() []api.User {
+	topic := "terdut-niklas"
+	return []api.User{
+		{ID: 1, Username: "niklas", Email: "niklas@example.com", NtfyTopic: &topic},
+		{ID: 2, Username: "alex", Email: "alex@example.com"},
+	}
+}
+
+func TestNotifyTopic_EditPrefillsTheCurrentTopic(t *testing.T) {
+	m, _ := press(t, onUsers(userFixtures()), "t")
+
+	if m.mode != modeUserNotifyEdit {
+		t.Fatalf("expected the topic editor, got mode %v", m.mode)
+	}
+	if m.selectedUser.ID != 1 {
+		t.Errorf("expected the user under the cursor, got %d", m.selectedUser.ID)
+	}
+	// Prefilled, so editing a topic does not mean retyping it from scratch.
+	if got := m.ntfyTopicInput.Value(); got != "terdut-niklas" {
+		t.Errorf("expected the current topic prefilled, got %q", got)
+	}
+}
+
+// A user with no topic opens an empty field rather than the previous user's.
+func TestNotifyTopic_EditStartsEmptyWhenUnset(t *testing.T) {
+	m := onUsers(userFixtures())
+	m, _ = press(t, m, "t")
+	m, _ = press(t, m, "esc")
+	m.userManageTable.SetCursor(1)
+
+	m, _ = press(t, m, "t")
+	if got := m.ntfyTopicInput.Value(); got != "" {
+		t.Errorf("expected an empty field for a user with no topic, got %q", got)
+	}
+}
+
+func TestNotifyTopic_EscapeAbandonsWithoutSaving(t *testing.T) {
+	m, _ := press(t, onUsers(userFixtures()), "t")
+	m, cmd := press(t, m, "esc")
+
+	if cmd != nil {
+		t.Error("expected escape to save nothing")
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("expected a return to the dashboard, got mode %v", m.mode)
+	}
+}
+
+// Clearing a topic is a real action, not a no-op: it is how a user is taken off
+// their own topic and back onto the shared fallback. Contrast the snooze prompt,
+// where an empty value means "I changed my mind".
+func TestNotifyTopic_EmptyInputStillSubmits(t *testing.T) {
+	m, _ := press(t, onUsers(userFixtures()), "t")
+	m.ntfyTopicInput.SetValue("")
+
+	m, cmd := press(t, m, "enter")
+	if cmd == nil {
+		t.Fatal("expected clearing the topic to call the server")
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("expected a return to the dashboard, got mode %v", m.mode)
+	}
+}
+
+func TestNotifyTopic_IsUsersSectionOnly(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionIncidents
+	if next, cmd := press(t, m, "t"); cmd != nil || next.mode != modeDashboard {
+		t.Error("expected t to do nothing outside the Users section")
+	}
+}
+
+func TestTab_CyclesEverySection(t *testing.T) {
+	m := sized()
+	if m.activeSection != sectionIncidents {
+		t.Fatal("incidents is the section the client opens on")
+	}
+
+	want := []section{sectionAlerts, sectionStats, sectionArchived, sectionSchedule,
+		sectionUsers, sectionIncidents}
+	for i, expected := range want {
+		m, _ = press(t, m, "tab")
+		if m.activeSection != expected {
+			t.Fatalf("after %d tabs expected section %v, got %v", i+1, expected, m.activeSection)
+		}
+	}
+}
+
+func TestFilter_CyclesPerSection(t *testing.T) {
+	m := sized()
+	m, _ = press(t, m, "f")
+	if m.incidentFilter != api.StatusTriggered {
+		t.Errorf("expected the incident filter to advance, got %q", m.incidentFilter)
+	}
+
+	m.activeSection = sectionAlerts
+	m, _ = press(t, m, "f")
+	if m.alertFilter != "resolved" {
+		t.Errorf("expected the alert filter to advance, got %q", m.alertFilter)
+	}
+	if m.incidentFilter != api.StatusTriggered {
+		t.Error("the two filters are independent")
+	}
+}
+
+// Stats is a section like any other: no key of its own, no mode of its own, and
+// it loads once on first visit rather than on every tab-in — the three empty
+// slices a quiet server returns are a real answer, not a missing one.
+func TestStats_IsAnOrdinarySection(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionAlerts
+
+	m, cmd := press(t, m, "tab")
+	if m.activeSection != sectionStats {
+		t.Fatalf("expected the stats section, got %v", m.activeSection)
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("stats is a section, not a mode: got mode %v", m.mode)
+	}
+	if cmd == nil {
+		t.Error("the first visit should fetch")
+	}
+
+	m.statsLoaded = true
+	m.statsLoading = false
+	if cmd := m.loadSectionIfEmpty(); cmd != nil {
+		t.Error("a second visit should reuse what was already fetched")
+	}
+}
+
+// S used to open the stats overlay from anywhere. It is gone, and must not
+// disturb the view it is pressed in.
+func TestStats_KeyIsGone(t *testing.T) {
+	m, _ := press(t, sized(), "S")
+	if m.activeSection != sectionIncidents || m.mode != modeDashboard {
+		t.Errorf("S should do nothing on the queue, got section %v mode %v",
+			m.activeSection, m.mode)
+	}
+
+	m, _ = press(t, onIncident(openIncidentFixture(), nil), "S")
+	if m.mode != modeIncidentDetail {
+		t.Errorf("S should leave the incident open, got mode %v", m.mode)
+	}
+}
+
+// The overlay never auto-refreshed, because the tick skipped every non-dashboard
+// mode. As a section it rides the tick like the rest.
+func TestStats_RefreshesOnTick(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionStats
+	if m.refreshActiveSection() == nil {
+		t.Error("the stats section should refresh on the tick")
+	}
+}
+
+// Alerts carry no workflow state, so the detail view offers nothing but a way
+// through to the incident.
+func TestAlertDetail_IsReadOnly(t *testing.T) {
+	m := sized()
+	m.mode = modeAlertDetail
+	m.selectedAlert = api.Alert{ID: 3, Name: "DiskFull", Status: "firing"}
+
+	for _, key := range []string{"a", "A", "R", "c", "x", "z"} {
+		next, cmd := press(t, m, key)
+		if cmd != nil {
+			t.Errorf("key %q should do nothing on an alert", key)
+		}
+		if next.mode != modeAlertDetail {
+			t.Errorf("key %q changed mode to %v", key, next.mode)
+		}
+	}
+}
+
+func TestAlertDetail_JumpToIncident(t *testing.T) {
+	m := sized()
+	m.mode = modeAlertDetail
+
+	t.Run("without an incident", func(t *testing.T) {
+		m.selectedAlert = api.Alert{ID: 3, Name: "Orphan"}
+		next, _ := press(t, m, "i")
+		if next.mode != modeAlertDetail || next.statusMsg == "" {
+			t.Errorf("expected a refusal, got mode %v msg %q", next.mode, next.statusMsg)
+		}
+	})
+
+	t.Run("with an incident", func(t *testing.T) {
+		id := int64(7)
+		m.selectedAlert = api.Alert{ID: 3, Name: "DiskFull", IncidentID: &id}
+		next, cmd := press(t, m, "i")
+		if next.mode != modeIncidentDetail {
+			t.Fatalf("expected the incident view, got mode %v", next.mode)
+		}
+		if next.selectedIncident.ID != 7 {
+			t.Errorf("expected incident 7, got %d", next.selectedIncident.ID)
+		}
+		if cmd == nil {
+			t.Error("expected the incident to be fetched")
+		}
+	})
+}
+
+// A refresh underneath a prompt would move the ground under the user.
+func TestRefreshTick_SkipsModalStates(t *testing.T) {
+	modal := []mode{modeNote, modeSnooze, modeConfirm, modeUserPicker, modeUserCreate}
+	for _, md := range modal {
+		m := sized()
+		m.mode = md
+		if cmd := m.refreshActiveSection(); cmd != nil {
+			t.Errorf("mode %v should not auto-refresh", md)
+		}
+	}
+
+	m := sized()
+	if cmd := m.refreshActiveSection(); cmd == nil {
+		t.Error("the dashboard should auto-refresh")
+	}
+}
+
+func TestIncidentsFetched_ClearsLoading(t *testing.T) {
+	m := sized()
+	m.loading = true
+	next, _ := m.Update(incidentsFetchedMsg{incidents: []api.Incident{openIncidentFixture()}})
+	got := next.(Model)
+	if got.loading {
+		t.Error("expected loading to clear")
+	}
+	if len(got.incidents) != 1 {
+		t.Errorf("expected the incidents stored, got %d", len(got.incidents))
+	}
+}
+
+// A note deleted elsewhere must not leave the cursor pointing past the end.
+func TestIncidentDetailFetched_ClampsNoteCursor(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m.noteCursor = 3
+
+	next, _ := m.Update(incidentDetailFetchedMsg{
+		incident: openIncidentFixture(),
+		timeline: []api.IncidentEvent{{Type: api.EventTriggered}},
+	})
+	if got := next.(Model).noteCursor; got != -1 {
+		t.Errorf("expected the cursor reset, got %d", got)
+	}
+}
+
+func containsAll(s string, subs ...string) bool {
+	for _, sub := range subs {
+		if !strings.Contains(s, sub) {
+			return false
+		}
+	}
+	return true
+}
+
+// The bug: assigning an on-call week panicked with "index out of range [-1]"
+// on a perfectly normal schedule, as long as nobody had moved the cursor first.
+//
+// The cause is not in this package. bubbles' SetRows clamps the cursor down but
+// never up, so the empty rebuild every table gets from the first WindowSizeMsg
+// -- which arrives before any fetch returns -- pins the cursor at -1, and
+// loading real rows afterwards leaves it there. Pressing up or down hid it,
+// which is why every existing test missed it: they all call SetCursor, and
+// SetCursor clamps.
+//
+// So this test must NOT touch the cursor. It reproduces the real order of
+// events: size first, data second, keys third.
+func TestSchedule_AssignWeekAfterStartupSizingDoesNotPanic(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.connected = true
+	m.activeSection = sectionSchedule
+	m.scheduleWindow = time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
+
+	// 1. Terminal size arrives while every table is still empty.
+	next, _ := m.Update(tea.WindowSizeMsg{Width: 120, Height: 40})
+	m = next.(Model)
+
+	// 2. The schedule and the user list land.
+	next, _ = m.Update(scheduleFetchedMsg{entries: []api.ScheduleEntry{}})
+	m = next.(Model)
+	next, _ = m.Update(usersFetchedMsg{users: []api.User{
+		{ID: 1, Username: "niklas", Email: "n@example.com"},
+	}})
+	m = next.(Model)
+
+	if got := m.scheduleTable.Cursor(); got < 0 {
+		t.Fatalf("schedule cursor is %d after loading %d days; a populated table must have a usable cursor",
+			got, len(m.scheduleDays))
+	}
+
+	// 3. Assign the week to the first user, without ever moving a cursor.
+	m, _ = press(t, m, "W")
+	if m.mode != modeUserPicker {
+		t.Fatalf("W did not open the user picker, got mode %v", m.mode)
+	}
+	m, _ = press(t, m, "enter") // panicked here
+
+	if m.mode == modeUserPicker {
+		t.Fatal("enter left the picker open; the assignment never went anywhere")
+	}
+}

internal/tui/view_test.go

@@ -0,0 +1,351 @@
+package tui
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// ansi matches the escape sequences lipgloss emits when it decides the output
+// supports colour, so assertions can be made against the text alone.
+var ansi = regexp.MustCompile(`\x1b\[[0-9;]*m`)
+
+func plain(s string) string { return ansi.ReplaceAllString(s, "") }
+
+// testStyles is the default theme, so assertions here run against what a user
+// with no 'theme:' key actually sees.
+func testStyles() Styles { return newStyles(theme.GruvboxDark) }
+
+func mustContain(t *testing.T, got string, wants ...string) {
+	t.Helper()
+	got = plain(got)
+	for _, w := range wants {
+		if !strings.Contains(got, w) {
+			t.Errorf("expected output to contain %q\n--- got ---\n%s", w, got)
+		}
+	}
+}
+
+func TestIncidentDetail_RendersTheWholeStory(t *testing.T) {
+	now := time.Now()
+	ackID := int64(1)
+	alertID := int64(3)
+	inc := api.Incident{
+		ID: 1, Title: "DiskFull (namespace=prod)", Status: api.StatusAcknowledged,
+		Severity:    "critical",
+		GroupLabels: map[string]string{"alertname": "DiskFull", "namespace": "prod"},
+		TriggeredAt: now.Add(-2 * time.Hour),
+		AssignedTo:  "admin", AcknowledgedByID: &ackID, AcknowledgedBy: "admin",
+		AcknowledgedAt: &now,
+		Alerts: []api.Alert{
+			{ID: 3, Name: "DiskFull", Status: "firing",
+				Labels: map[string]string{"instance": "node-1"}, ReceivedAt: now},
+			{ID: 4, Name: "DiskFull", Status: "resolved",
+				Labels: map[string]string{"instance": "node-2"}, ReceivedAt: now},
+		},
+	}
+	timeline := []api.IncidentEvent{
+		{Type: api.EventTriggered, CreatedAt: now},
+		{Type: api.EventAssigned, Username: "admin", CreatedAt: now},
+		{Type: api.EventAlertAdded, AlertID: &alertID, CreatedAt: now},
+		{Type: api.EventAcknowledged, Username: "admin", CreatedAt: now},
+		{Type: api.EventNote, Username: "admin", Detail: "draining node-2", CreatedAt: now},
+	}
+
+	out := buildIncidentDetailContent(testStyles(), inc, timeline, -1, 110)
+	mustContain(t, out,
+		"DiskFull (namespace=prod)", "ACKNOWLEDGED", "CRITICAL",
+		"Assigned:", "admin",
+		"Grouped By", "namespace", "prod",
+		"Alerts (2)", "node-1", "node-2",
+		"Timeline (5 events, 1 notes)",
+		"Incident opened", "Assigned to admin", "Alert #3 joined", "Acknowledged by admin",
+		"admin wrote", "draining node-2",
+	)
+}
+
+func TestIncidentDetail_ShowsSnooze(t *testing.T) {
+	future := time.Now().Add(2 * time.Hour)
+	inc := api.Incident{
+		Title: "Noisy", Status: api.StatusTriggered,
+		TriggeredAt: time.Now(), SnoozedUntil: &future,
+	}
+	// The exact remaining time is humanUntil's business, not this test's — a few
+	// microseconds of elapsed clock turn "in 2h" into "in 1h 59m".
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110),
+		"TRIGGERED (snoozed)", "Snoozed:", "until", "in 1h")
+}
+
+// An expired snooze is not a snooze, so it must not be reported as one.
+func TestIncidentDetail_HidesExpiredSnooze(t *testing.T) {
+	past := time.Now().Add(-time.Hour)
+	inc := api.Incident{
+		Title: "Noisy", Status: api.StatusTriggered,
+		TriggeredAt: time.Now(), SnoozedUntil: &past,
+	}
+	if strings.Contains(plain(buildIncidentDetailContent(testStyles(), inc, nil, -1, 110)), "Snoozed:") {
+		t.Error("an expired snooze should not be rendered")
+	}
+}
+
+func TestIncidentDetail_ShowsResolutionSource(t *testing.T) {
+	now := time.Now()
+	source := "manual"
+	inc := api.Incident{
+		Title: "Done", Status: api.StatusResolved, TriggeredAt: now.Add(-time.Hour),
+		ResolvedAt: &now, ResolutionSource: &source,
+	}
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110),
+		"RESOLVED", "Resolved:", "manual")
+}
+
+func TestIncidentDetail_UnassignedAndUnacknowledged(t *testing.T) {
+	inc := api.Incident{Title: "Fresh", Status: api.StatusTriggered, TriggeredAt: time.Now()}
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110), "nobody", "not acknowledged")
+}
+
+func TestIncidentDetail_EmptyTimeline(t *testing.T) {
+	inc := api.Incident{Title: "Fresh", Status: api.StatusTriggered, TriggeredAt: time.Now()}
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110), "Nothing recorded yet")
+}
+
+func TestIncidentDetail_MarksSelectedNote(t *testing.T) {
+	now := time.Now()
+	timeline := []api.IncidentEvent{
+		{Type: api.EventNote, Username: "admin", Detail: "first", CreatedAt: now},
+		{Type: api.EventNote, Username: "alice", Detail: "second", CreatedAt: now},
+	}
+	inc := api.Incident{Title: "X", Status: api.StatusTriggered, TriggeredAt: now}
+
+	out := plain(buildIncidentDetailContent(testStyles(), inc, timeline, 1, 110))
+	for _, line := range strings.Split(out, "\n") {
+		if strings.Contains(line, "alice") && !strings.HasPrefix(line, "> ") {
+			t.Errorf("expected the selected note marked, got %q", line)
+		}
+		if strings.Contains(line, "admin wrote") && strings.HasPrefix(line, "> ") {
+			t.Errorf("expected the unselected note unmarked, got %q", line)
+		}
+	}
+}
+
+func TestIncidentStatusLabel(t *testing.T) {
+	future := time.Now().Add(time.Hour)
+	tests := []struct {
+		name string
+		inc  api.Incident
+		want string
+	}{
+		{"triggered", api.Incident{Status: api.StatusTriggered}, "● TRIGGERED"},
+		{"acknowledged", api.Incident{Status: api.StatusAcknowledged}, "◐ ACKNOWLEDGED"},
+		{"resolved", api.Incident{Status: api.StatusResolved}, "✓ RESOLVED"},
+		{"snoozed", api.Incident{Status: api.StatusTriggered, SnoozedUntil: &future},
+			"● TRIGGERED (snoozed)"},
+		// A status this client does not know about still has to render.
+		{"unknown", api.Incident{Status: "escalated"}, "ESCALATED"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := incidentStatusLabel(tt.inc); got != tt.want {
+				t.Errorf("expected %q, got %q", tt.want, got)
+			}
+		})
+	}
+}
+
+// The server may add event types after this client ships. An unknown one must
+// still appear on the timeline rather than silently vanishing.
+func TestEventLabel_UnknownTypeFallsBackToItsName(t *testing.T) {
+	got := eventLabel(api.IncidentEvent{Type: "escalated", Detail: "to sre-oncall"})
+	mustContain(t, got, "escalated", "to sre-oncall")
+}
+
+func TestEventLabel_KnownTypes(t *testing.T) {
+	alertID := int64(9)
+	tests := []struct {
+		event api.IncidentEvent
+		want  string
+	}{
+		{api.IncidentEvent{Type: api.EventTriggered}, "Incident opened"},
+		{api.IncidentEvent{Type: api.EventAlertAdded, AlertID: &alertID}, "Alert #9 joined"},
+		{api.IncidentEvent{Type: api.EventAlertResolved, AlertID: &alertID}, "Alert #9 resolved"},
+		{api.IncidentEvent{Type: api.EventAcknowledged, Username: "bo"}, "Acknowledged by bo"},
+		{api.IncidentEvent{Type: api.EventAssigned, Username: "bo"}, "Assigned to bo"},
+		{api.IncidentEvent{Type: api.EventSnoozed, Detail: "2026-08-01T00:00:00Z"},
+			"Snoozed until 2026-08-01T00:00:00Z"},
+		{api.IncidentEvent{Type: api.EventResolved, Username: "bo"}, "Resolved by bo"},
+		// No user means the server closed it via the alert cascade.
+		{api.IncidentEvent{Type: api.EventResolved}, "all alerts stopped firing"},
+		{api.IncidentEvent{Type: api.EventNotified, Username: "bo", Detail: "triggered"},
+			"Notified bo (triggered)"},
+		{api.IncidentEvent{Type: api.EventNotified, Username: "bo", Detail: "reminder"},
+			"Notified bo (reminder)"},
+		// On a notification, no user means the shared fallback topic — not that
+		// the server acted on its own.
+		{api.IncidentEvent{Type: api.EventNotified, Detail: "triggered"},
+			"Notified the fallback topic (triggered)"},
+		{api.IncidentEvent{Type: api.EventNotifyFailed, Username: "bo", Detail: "triggered: ntfy returned 502"},
+			"Notification to bo failed"},
+		{api.IncidentEvent{Type: api.EventNotifyFailed, Detail: "triggered: no route to host"},
+			"Notification to the fallback topic failed"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.event.Type, func(t *testing.T) {
+			mustContain(t, eventLabel(tt.event), tt.want)
+		})
+	}
+}
+
+// The timeline is where a page that never landed becomes visible, so both
+// outcomes have to survive into the rendered pane.
+func TestIncidentDetail_RendersNotifications(t *testing.T) {
+	now := time.Now()
+	inc := api.Incident{ID: 1, Title: "DiskFull", Status: api.StatusTriggered, TriggeredAt: now}
+	timeline := []api.IncidentEvent{
+		{Type: api.EventTriggered, CreatedAt: now},
+		{Type: api.EventNotified, Username: "niklas", Detail: "triggered", CreatedAt: now},
+		{Type: api.EventNotifyFailed, Username: "niklas",
+			Detail: "reminder: ntfy returned 502", CreatedAt: now},
+	}
+
+	got := buildIncidentDetailContent(testStyles(), inc, timeline, -1, 120)
+	mustContain(t, got, "Notified niklas (triggered)", "Notification to niklas failed")
+}
+
+func TestUserNotifyEdit_SaysWhatAnEmptyValueDoes(t *testing.T) {
+	m := sized()
+	m.mode = modeUserNotifyEdit
+	m.selectedUser = api.User{ID: 1, Username: "niklas"}
+
+	mustContain(t, m.View(), "niklas", "empty to clear it", "fallback topic")
+	// The footer has to repeat it: that is where the reader looks for what a key does.
+	mustContain(t, m.renderFooter(), "empty clears the topic")
+}
+
+func TestAlertDetail_SaysItIsReadOnlyAndLinksTheIncident(t *testing.T) {
+	now := time.Now()
+	id := int64(7)
+	alert := api.Alert{
+		ID: 3, Name: "DiskFull", Status: "firing", StartsAt: now.Add(-time.Hour),
+		ReceivedAt: now, IncidentID: &id,
+		Labels:      map[string]string{"instance": "node-1", "severity": "critical"},
+		Annotations: map[string]string{"summary": "disk 90%"},
+	}
+	mustContain(t, buildAlertDetailContent(testStyles(), alert, 110),
+		"DiskFull", "FIRING", "Incident:", "#7", "press i to open it",
+		"instance", "node-1", "summary", "disk 90%",
+		"Alerts are read-only")
+}
+
+func TestAlertDetail_NoIncident(t *testing.T) {
+	alert := api.Alert{ID: 3, Name: "Orphan", Status: "resolved", ReceivedAt: time.Now()}
+	mustContain(t, buildAlertDetailContent(testStyles(), alert, 110), "Incident:", "none")
+}
+
+func TestAlertDetail_ShowsResolutionSource(t *testing.T) {
+	source := "expiry"
+	alert := api.Alert{Name: "Gone", Status: "resolved", ReceivedAt: time.Now(),
+		ResolutionSource: &source}
+	mustContain(t, buildAlertDetailContent(testStyles(), alert, 110), "RESOLVED", "expiry")
+}
+
+// Null MTTA means nothing has been acknowledged, which is a different claim
+// from an instant response.
+func TestStats_RendersDashForMissingAverages(t *testing.T) {
+	stats := &api.IncidentStats{Total: 2, Triggered: 2}
+	out := buildStatsContent(testStyles(), stats, nil, nil, nil, 110)
+	mustContain(t, out, "Incident Response", "Mean time to acknowledge", "—",
+		"nothing has been acknowledged or resolved yet")
+}
+
+func TestStats_RendersAverages(t *testing.T) {
+	mtta, mttr := 150.0, 3600.0
+	stats := &api.IncidentStats{Total: 3, Resolved: 1, MTTASeconds: &mtta, MTTRSeconds: &mttr}
+	out := buildStatsContent(testStyles(), stats, []api.TopAlert{{Name: "DiskFull", Count: 4}}, nil, nil, 110)
+	mustContain(t, out, "2m", "1h", "Top Alerts", "DiskFull")
+}
+
+func TestStats_HandlesNoIncidentData(t *testing.T) {
+	mustContain(t, buildStatsContent(testStyles(), nil, nil, nil, nil, 110), "Incident Response", "No data")
+}
+
+func TestView_TabsAndDashboardRender(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{{
+		ID: 1, Title: "DiskFull", Status: api.StatusTriggered, Severity: "critical",
+		AssignedTo: "admin", TriggeredAt: time.Now(),
+	}}
+	m.incidentStats = &api.IncidentStats{Triggered: 1}
+	m.rebuildIncidentTable()
+
+	mustContain(t, m.View(),
+		"Incidents", "Alerts", "Stats", "Archived", "Schedule", "Users",
+		"Triggered: 1", "filter: open",
+		"DiskFull", "critical", "admin",
+		"enter·detail")
+}
+
+func TestView_EmptyStates(t *testing.T) {
+	m := sized()
+	m.loading = false
+	mustContain(t, m.View(), "No open incidents.")
+
+	m.activeSection = sectionArchived
+	mustContain(t, m.View(), "No archived incidents.")
+}
+
+// The stats page renders inside the normal section chrome now, so it has to
+// survive the real path: a window size message sizes the viewport and fills it.
+func TestView_StatsSectionRendersInPlace(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.connected = true
+	m.incidentStats = &api.IncidentStats{Total: 3, Triggered: 1}
+	m.topAlerts = []api.TopAlert{{Name: "DiskFull", Count: 4}}
+	m.statsLoaded = true
+
+	next, _ := m.Update(tea.WindowSizeMsg{Width: 120, Height: 40})
+	m = next.(Model)
+	m.activeSection = sectionStats
+
+	out := m.View()
+	mustContain(t, out, "Stats", "Incident Response", "Top Alerts", "DiskFull",
+		"tab·section")
+	if strings.Contains(plain(out), "Loading statistics") {
+		t.Error("loaded stats should not show the loading placeholder")
+	}
+}
+
+func TestView_ConnectionError(t *testing.T) {
+	m := sized()
+	m.connected = false
+	m.err = errFixture{}
+	mustContain(t, m.View(), "Error:", "Press r to retry")
+}
+
+// The footer is the only place the terminal states are explained, so the
+// destructive one has to be visible before it is pressed.
+func TestFooter_IncidentDetailOffersResolveOnlyWhileOpen(t *testing.T) {
+	open := onIncident(openIncidentFixture(), nil)
+	mustContain(t, open.renderFooter(), "R·resolve", "z·snooze", "a·ack")
+
+	closed := onIncident(resolvedIncidentFixture(), nil)
+	if strings.Contains(plain(closed.renderFooter()), "R·resolve") {
+		t.Error("a resolved incident should not offer resolve")
+	}
+	mustContain(t, closed.renderFooter(), "x·archive", "c·note")
+}
+
+func TestView_ZeroWidthRendersNothing(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	if m.View() != "" {
+		t.Error("expected no output before the first window size message")
+	}
+}
+
+type errFixture struct{}
+
+func (errFixture) Error() string { return "connection refused" }

internal/updater/updater.go

@@ -12,7 +12,14 @@ import (
 	"strings"
 )
 
-const releaseAPI = "https://api.github.com/repos/yeniklas/terdut-tui/releases/latest"
+// Gitea's release payload carries the same tag_name, and its attachments the same name
+// and browser_download_url, so the types below are unchanged from the GitHub original.
+//
+// A binary installed before the move still polls api.github.com and will never see a
+// release published here. That GitHub repository is still in place, so such a build
+// reports itself up to date rather than erroring -- its last GitHub release is the
+// bridge, and crossing it is a one-time manual download.
+const releaseAPI = "https://git.ryuvia.com/api/v1/repos/niklas/terdut-tui/releases/latest"
 
 type release struct {
 	TagName string  `json:"tag_name"`
@@ -125,7 +132,7 @@ func fetchLatest() (*release, error) {
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("Accept", "application/json")
 
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
@@ -134,7 +141,7 @@ func fetchLatest() (*release, error) {
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("GitHub API returned %s", resp.Status)
+		return nil, fmt.Errorf("Gitea API returned %s", resp.Status)
 	}
 
 	var rel release

main.go

@@ -5,11 +5,12 @@ import (
 	"fmt"
 	"os"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/config"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	"git.ryuvia.com/niklas/terdut-tui/internal/tui"
+	"git.ryuvia.com/niklas/terdut-tui/internal/updater"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/yeniklas/terdut-tui/internal/api"
-	"github.com/yeniklas/terdut-tui/internal/config"
-	"github.com/yeniklas/terdut-tui/internal/tui"
-	"github.com/yeniklas/terdut-tui/internal/updater"
 )
 
 var version = "dev"
@@ -38,8 +39,14 @@ func main() {
 		os.Exit(1)
 	}
 
+	th, err := theme.Load(cfg.Theme)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+
 	client := api.NewClient(cfg.ServerURL, cfg.APIKey)
-	model := tui.NewModel(client, cfg.ServerURL, cfg.RefreshInterval)
+	model := tui.NewModel(client, cfg.ServerURL, cfg.RefreshInterval, th)
 
 	p := tea.NewProgram(model, tea.WithAltScreen())
 	if _, err := p.Run(); err != nil {