Follow terdut-server into teams: switch team, per-team schedule

terdut-server v0.12 made everything team-scoped and v0.20 is what this
client now targets. Against it the old client was wrong in three ways:
the schedule moved to /api/teams/{id}/schedule, GET /api/schedule/current
became a list with one entry per team, and users, incidents, alerts and
schedule entries all grew fields the client ignored.

T steps through all teams and then each of yours. The header names what
is showing, and incident and alert rows gain a Team column when more than
one team can appear. team: in config.yaml picks the team to start on, by
name or id; an unknown one is reported and falls back to all teams.

The schedule is one team's rota, so it shows the active team, or with
all teams showing the first one you own. Writes need an owner or an
administrator, and the picker offers only the team's members, since the
server answers 404 for anybody else. Both are checked up front and the
reason goes in the status bar, rather than surfacing as a 403 after the
user has picked somebody. Stats are not team-scoped by the server and
stay that way here.

Users shows an admin/disabled Flags column. Creating and deleting users
is administrators only, and topic, keys and password work on your own
row or on anyone's for an administrator; the server enforces the same
rule, this only explains it before the round trip.

The server has no version endpoint, so an older one is recognised by
GET /api/teams answering 404, and the TUI says it needs v0.20 or later.
Connecting now also loads /api/teams and /api/me with the key, which
means a wrong key fails on start instead of on the first list; /healthz
does not check it. There is no fallback to the pre-team paths.

Rebuilding a table whose column count changes under loaded rows panicked
inside bubbles, because it re-renders the old rows on SetColumns. The
rows are now cleared first and the cursor put back, so a refresh still
does not jump to the top.

Escalation ladders, invites, integrations and the admin settings are
left to the server's web UI. Checked against a real v0.20.1 server with
two teams, an administrator and a plain member.

Breaking: requires terdut-server v0.20.0 or later. Use terdut-tui v0.9.x
with servers before v0.12.

.gitea/workflows/ci.yaml

@@ -0,0 +1,89 @@
+name: CI
+
+# The release workflow gates a tag, which is late: a broken commit sits green until
+# somebody decides to publish. This runs the same checks on the way in.
+#
+# push is scoped to main so that a branch pushed as part of a pull request is not checked
+# twice.
+#
+# No actions/checkout, deliberately -- same as the terdut-server, letsvisit and charts
+# workflows. The runner image is ubuntu:22.04 whose `nodejs` package is Node 12, and
+# actions/checkout@v4 is built with ES2022 static initialiser blocks, so it dies with
+# `SyntaxError: Unexpected token '{'` before running. Cloning with git directly avoids JS
+# actions entirely. This repo is public, so the clone needs no credential at all.
+#
+# `${{ }}` values are passed through `env:` and referenced as quoted shell variables: a
+# ref name is attacker-influenced by anyone who can push a branch or open a PR, and
+# expanding one straight into `run:` is a shell-injection vector.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# A rapid series of pushes only needs the last one checked.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REPO_URL: https://git.ryuvia.com/niklas/terdut-tui.git
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      # act_runner destroys a job's own volumes when it finishes, so without these every
+      # run re-downloads the whole module graph. The names must appear in the runner's
+      # container.valid_volumes allowlist (charts/act-runner in the k8s repo); unlisted
+      # volumes are dropped silently, so a workflow that looks correct can still be
+      # running uncached.
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ -n "$HEAD_SHA" ]; then
+            # A pull_request ref_name is "<n>/merge", which is not a fetchable branch.
+            git clone "$REPO_URL" .
+            git checkout -q "$HEAD_SHA"
+          else
+            git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+          fi
+
+      # This exists because `go vet` does not look at import order: the move to
+      # git.ryuvia.com rewrote every import path without re-sorting, the new path sorts
+      # before github.com/..., and both repos sat unformatted through a green CI run and
+      # a release before anyone noticed.
+      #
+      # Both of gofmt's failure modes need handling, and they are not alike. A file that
+      # is merely misformatted is listed on stdout with exit 0 -- so the failure has to
+      # be raised by hand. A file that does not parse is the opposite: nothing on stdout
+      # and exit 2, which a naive `[ -n "$unformatted" ]` reads as success. The first
+      # draft of this step had exactly that hole.
+      - name: Format
+        run: |
+          if ! unformatted=$(gofmt -l .); then
+            echo "::error::gofmt could not parse the tree"
+            gofmt -l .    # re-run unredirected so the parse errors reach the log
+            exit 1
+          fi
+          if [ -n "$unformatted" ]; then
+            echo "::error::not gofmt'd:"
+            echo "$unformatted"
+            gofmt -d .
+            exit 1
+          fi
+
+      - name: Vet
+        run: go vet ./...
+
+      # Covers the API client against a stub server, the Update state machine, and View
+      # rendering -- all three are pure enough to test without a terminal.
+      - name: Test
+        run: go test ./...

.gitea/workflows/release.yaml

@@ -0,0 +1,142 @@
+name: Release
+
+# Checkout, interpolation and caching conventions match ci.yaml -- see the header there
+# for why there are no JS actions and why every `${{ }}` goes through `env:`.
+#
+# There is no upload-artifact/download-artifact equivalent here (both are JS actions, and
+# this Gitea has no artifact store wired up), so the job that builds the binaries is also
+# the job that publishes them. Nothing is handed between jobs.
+#
+# The asset names matter beyond being tidy: internal/updater looks for exactly
+# terdut-tui-<tag>-<goos>-<goarch> in the latest release and reports every available name
+# when it cannot find one. Renaming the pattern here breaks self-update for every
+# installed binary.
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REPO_URL: https://git.ryuvia.com/niklas/terdut-tui.git
+  API: https://git.ryuvia.com/api/v1/repos/niklas/terdut-tui
+
+jobs:
+  # Gates the build, so a tag that fails here publishes no binaries.
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+
+      # This exists because `go vet` does not look at import order: the move to
+      # git.ryuvia.com rewrote every import path without re-sorting, the new path sorts
+      # before github.com/..., and both repos sat unformatted through a green CI run and
+      # a release before anyone noticed.
+      #
+      # Both of gofmt's failure modes need handling, and they are not alike. A file that
+      # is merely misformatted is listed on stdout with exit 0 -- so the failure has to
+      # be raised by hand. A file that does not parse is the opposite: nothing on stdout
+      # and exit 2, which a naive `[ -n "$unformatted" ]` reads as success. The first
+      # draft of this step had exactly that hole.
+      - name: Format
+        run: |
+          if ! unformatted=$(gofmt -l .); then
+            echo "::error::gofmt could not parse the tree"
+            gofmt -l .    # re-run unredirected so the parse errors reach the log
+            exit 1
+          fi
+          if [ -n "$unformatted" ]; then
+            echo "::error::not gofmt'd:"
+            echo "$unformatted"
+            gofmt -d .
+            exit 1
+          fi
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
+  binaries:
+    needs: test
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+
+      - name: Build every target
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -eu
+          mkdir -p dist
+          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
+            GOOS="${target%/*}"
+            GOARCH="${target#*/}"
+            out="dist/terdut-tui-${REF_NAME}-${GOOS}-${GOARCH}"
+            echo "building $out"
+            GOOS="$GOOS" GOARCH="$GOARCH" go build \
+              -ldflags "-X main.version=${REF_NAME}" \
+              -o "$out" .
+          done
+
+      # Creating the release is made idempotent rather than assumed-new: a re-run of a
+      # failed release must not die on the release that already exists. Assets are
+      # replaced the same way, so a re-run repairs a partial upload.
+      - name: Publish the release
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          auth="Authorization: token $TOKEN"
+
+          body=$(curl -sf -H "$auth" "$API/releases/tags/$REF_NAME" || true)
+          if [ -z "$body" ]; then
+            body=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
+              -d "{\"tag_name\":\"$REF_NAME\",\"name\":\"$REF_NAME\"}" \
+              "$API/releases")
+          fi
+
+          # The release object serialises `id` first, so the first match is the release's
+          # own id and not one of the nested author/asset ids.
+          release_id=$(printf '%s' "$body" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+          [ -n "$release_id" ] || { echo "::error::could not determine release id"; exit 1; }
+          echo "release id $release_id"
+
+          for f in dist/*; do
+            name=$(basename "$f")
+            # Drop an existing asset of the same name first: Gitea happily stores two
+            # attachments with one name, and the updater matches by name.
+            old=$(curl -sf -H "$auth" "$API/releases/$release_id/assets" \
+                  | tr '}' '\n' | grep "\"name\":\"$name\"" \
+                  | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2 || true)
+            if [ -n "$old" ]; then
+              curl -sf -X DELETE -H "$auth" "$API/releases/$release_id/assets/$old" || true
+            fi
+            echo "uploading $name"
+            curl -sf -X POST -H "$auth" -F "attachment=@$f" \
+              "$API/releases/$release_id/assets?name=$name" > /dev/null
+          done

.github/workflows/release.yml

@@ -1,57 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        include:
-          - goos: linux
-            goarch: amd64
-          - goos: linux
-            goarch: arm64
-          - goos: darwin
-            goarch: amd64
-          - goos: darwin
-            goarch: arm64
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Build
-        env:
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
-        run: |
-          go build \
-            -ldflags "-X main.version=${{ github.ref_name }}" \
-            -o terdut-tui-${{ github.ref_name }}-${{ matrix.goos }}-${{ matrix.goarch }} \
-            .
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: terdut-tui-${{ github.ref_name }}-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: terdut-tui-${{ github.ref_name }}-${{ matrix.goos }}-${{ matrix.goarch }}
-
-  release:
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          merge-multiple: true
-
-      - uses: softprops/action-gh-release@v2
-        with:
-          files: 'terdut-tui-*'

CLAUDE.md

@@ -1,6 +1,6 @@
 # terdut-tui
 
-TUI client for [terdut-server](https://github.com/terdut-server), a Prometheus Alertmanager receiver and incident manager. Requires server **v0.4.0+**.
+TUI client for [terdut-server](https://git.ryuvia.com/niklas/terdut-server), a Prometheus Alertmanager receiver and incident manager. Requires server **v0.20.0+** (team-scoped API).
 
 ## Domain model
 
@@ -11,6 +11,14 @@ The server splits alerts from incidents, and this client mirrors it:
   assignee, snooze, notes and an append-only timeline. Many alerts to one incident,
   correlated by Alertmanager's `groupKey`.
 
+The server is multi-team: incidents, alerts and the schedule belong to a team, and
+the caller only sees their own teams. `Model.activeTeamID` (0 = all) narrows the
+incident and alert lists via `team_id`; the schedule is per team and uses
+`Model.scheduleTeam()`. Users have `is_admin`, and the TUI mirrors the server's
+permission rules up front (`canEditSchedule`, `canManageUser`, `isAdmin`) so a 403 is
+explained before the round trip, not after. The server has no version endpoint;
+an old one is recognised by `GET /api/teams` answering 404 (`errServerTooOld`).
+
 All user actions target incidents. Two server behaviours the UI has to respect:
 manual resolve is **terminal** (hence the confirmation prompt), and snooze is the
 non-destructive "not now" alternative.
@@ -25,16 +33,17 @@ non-destructive "not now" alternative.
 ## Project layout
 
 ```
-main.go                      CLI entry point: flags, config load, health check, start TUI
+main.go                      CLI entry point: flags, config load, start TUI
 internal/api/client.go       REST API client — one method per endpoint
 internal/config/config.go    Config loader (~/.config/terdut-tui/config.yaml)
+internal/theme/              Colour themes: semantic tokens, built-ins, user file loader
 internal/tui/                Bubbletea UI
   model.go                   Model struct, mode/section constants, Init(), tea.Cmd constructors
   update.go                  Update() — dispatch only, no API calls inline
   view.go                    View() — pure rendering
   keys.go                    keyMap (bubbles/key pattern)
-  styles.go                  All lipgloss styles
+  styles.go                  Styles struct — every lipgloss style, built from a theme
-internal/updater/updater.go  Self-update via GitHub Releases
+internal/updater/updater.go  Self-update via Gitea releases
 ```
 
 ## Architecture rules
@@ -43,6 +52,9 @@ internal/updater/updater.go  Self-update via GitHub Releases
 2. **`View()` is pure** — no side effects, no state mutations.
 3. **All state in `Model`** — no globals.
 4. **All styles in `styles.go`** — never use lipgloss inline in `view.go`.
+   Styles live on `Model.styles`, built once by `newStyles(theme.Theme)`; the
+   handful of free functions in `view.go` take a `Styles` as their first
+   argument. No colour literal appears outside `internal/theme`.
 
 ## Config
 
@@ -52,8 +64,14 @@ Location: `~/.config/terdut-tui/config.yaml`
 server_url: https://terdut.example.com
 api_key: <64-char hex key>
 refresh_interval: 30  # seconds, optional, default 30
+theme: gruvbox-dark   # optional, default gruvbox-dark
+team: Ops             # optional, team name or id to start on, default all
 ```
 
+Built-in themes are `gruvbox-dark` and `gruvbox-light`; user themes are YAML
+files in `~/.config/terdut-tui/themes/`, optionally `extends:`-ing a built-in.
+See the README for the token list.
+
 The API key is a one-time secret generated by terdut-server (`POST /api/users/{id}/api-keys`).
 
 ## Running
@@ -73,6 +91,7 @@ go build -ldflags="-X main.version=v0.1.0" -o terdut-tui .
 ## Sections
 
 `Incidents` (the queue, and the default) · `Alerts` (raw read-only feed) ·
+`Stats` (MTTA/MTTR and alert frequency charts) ·
 `Archived` (archived incidents) · `Schedule` · `Users`
 
 ## Development stages
@@ -85,6 +104,7 @@ go build -ldflags="-X main.version=v0.1.0" -o terdut-tui .
 | 4 | On-call schedule calendar view |
 | 5 | User management and API key lifecycle |
 | 6 | Incidents: queue, timeline, ack/assign/snooze/resolve, MTTA/MTTR |
+| 7 | Teams: `T` switcher, per-team schedule, admin/disabled markers (server v0.20) |
 
 <!-- graymatter:instructions:begin — managed by `graymatter init`; edits inside this block are overwritten -->
 ## Memory (GrayMatter)

README.md

@@ -1,6 +1,6 @@
 # terdut-tui
 
-A terminal user interface for [terdut-server](https://github.com/terdut-server). Communicates with the server over its REST API.
+A terminal user interface for [terdut-server](https://git.ryuvia.com/niklas/terdut-server). Communicates with the server over its REST API.
 
 Written in Go using [Bubbletea](https://github.com/charmbracelet/bubbletea).
 
@@ -8,14 +8,35 @@ Written in Go using [Bubbletea](https://github.com/charmbracelet/bubbletea).
 
 - **Incident queue** — open incidents with severity, status, assignee and age, auto-refreshing
 - **Incident actions** — acknowledge, assign, snooze, note, resolve and archive
-- **Timeline** — the full history of an incident, system events and notes together
+- **Timeline** — the full history of an incident, system events, pages and notes together
 - **Alert feed** — the raw read-only alerts underneath, each linked to its incident
-- **On-call schedule** — visual calendar of who is on duty, assign and remove entries
+- **Teams** — switch between your teams, or see all of them at once
+- **On-call schedule** — visual calendar of who is on duty in a team, assign and remove entries
 - **Statistics** — MTTA and MTTR, plus alert frequency by name, hour and day
-- **User management** — add and remove users, manage API keys
+- **User management** — add and remove users, manage API keys, set each user's ntfy topic
 
-> Requires terdut-server **v0.4.0 or later**. Earlier servers have no incidents API;
+> Requires terdut-server **v0.20.0 or later**. The server became team-scoped in
-> use terdut-tui v0.3.x with those.
+> v0.12 and this client follows it; earlier servers answer 404 for `/api/teams`
+> and the TUI says so on start. Use terdut-tui v0.9.x with servers before v0.12.
+> Escalation ladders, invites, integrations and the admin settings stay in the
+> server's web UI.
+
+## Teams
+
+Everything the server returns is scoped to the teams your key's user belongs
+to. The header shows which are on screen, and `T` steps through *all* → each of
+your teams in turn. With several teams showing, incident and alert rows carry a
+Team column.
+
+The schedule is one team's rota, so the Schedule section shows the active team,
+or with *all* showing the first team you own. Only a team's owners, and
+administrators, can change its rota; anyone else gets the reason in the status
+bar instead of a picker. The picker offers only that team's members, because the
+server refuses anybody else. Stats are not team-scoped by the server and always
+cover all your teams.
+
+Administrators are the only users who can create or delete users, or act on
+someone else's password, topic or API keys. Everyone can manage their own.
 
 ## Alerts and incidents
 
@@ -37,12 +58,25 @@ Two behaviours worth knowing before you press a key:
 - **Snooze is the "not now" button.** It hides an incident from the default queue
   without closing it, and expires on its own.
 
+## Push notifications
+
+When the server is configured for ntfy, an incident that opens pages whoever is
+on call. Each user has their own topic, shown as a column in the Users section
+and edited with `t`. A user with no topic falls back to the server's shared
+fallback topic, which carries **no Acknowledge button** — the topic is shared, so
+a button on it would let any subscriber acknowledge as somebody else.
+
+Every delivery lands on the incident's timeline: `Notified <user> (triggered)`
+when ntfy accepted the page, and `Notification to <user> failed` when it ran out
+of retries. That second one is the one to look for when nobody's phone rang.
+
+
 ## Installation
 
-Download the latest release binary for your platform from the [releases page](https://github.com/yeniklas/terdut-tui/releases), or build from source:
+Download the latest release binary for your platform from the [releases page](https://git.ryuvia.com/niklas/terdut-tui/releases), or build from source:
 
 ```bash
-go install github.com/yeniklas/terdut-tui@latest
+go install git.ryuvia.com/niklas/terdut-tui@latest
 ```
 
 ## Configuration
@@ -53,10 +87,50 @@ Create `~/.config/terdut-tui/config.yaml`:
 server_url: https://terdut.example.com
 api_key: <your-api-key>
 refresh_interval: 30  # seconds, optional
+theme: gruvbox-dark   # optional, this is the default
+team: Ops             # optional, a team name or id to start on; default is all
 ```
 
 The API key is generated in terdut-server. See the server documentation for how to bootstrap a user and issue an API key.
 
+## Themes
+
+Two themes ship with the client: `gruvbox-dark` (the default) and
+`gruvbox-light`. Both colour foregrounds only — the terminal supplies the
+background — so pick the one that matches the background you already run.
+
+To make your own, drop a file in `~/.config/terdut-tui/themes/` and name it in
+`theme:`. `extends` inherits a built-in, so a file only has to list what it
+changes:
+
+```yaml
+# ~/.config/terdut-tui/themes/mine.yaml
+extends: gruvbox-dark
+primary: "#d3869b"
+accent: "#fabd2f"
+```
+
+A file may shadow a built-in name — `themes/gruvbox-dark.yaml` is how you tweak
+the default without renaming it.
+
+Without `extends`, every token must be set. The twelve are:
+
+| Token | Where it shows |
+|---|---|
+| `primary` | header, active tab, selected row, cursors |
+| `on_primary` | text drawn *on* `primary` — the active tab and selected row |
+| `text` | incident titles and other emphasis |
+| `muted` | secondary text, dividers, footer, table headers |
+| `accent` | status line, acknowledged incidents, the by-day chart |
+| `firing` | firing alerts, triggered incidents, the by-hour chart |
+| `resolved` | resolved alerts and incidents, the top-alerts chart |
+| `error` | error banners |
+| `sev_critical`, `sev_error`, `sev_warning`, `sev_info` | the `severity` label |
+
+Values are hex (`#83a598` or `#abc`) or an ANSI palette index (`0`–`255`) if you
+would rather follow your terminal's own colours. Colours are downsampled
+automatically on 256- and 16-colour terminals, and `NO_COLOR` is honoured.
+
 ## Usage
 
 ```
@@ -78,9 +152,11 @@ Global:
 | `esc` | Go back |
 | `r` | Refresh |
 | `f` | Cycle filter |
-| `S` | Statistics |
+| `T` | Switch team: all → each of your teams (when you have more than one) |
 | `q` | Quit |
 
+The sections, in `tab` order: Incidents · Alerts · Stats · Archived · Schedule · Users.
+
 Incidents section:
 
 | Key | Action |
@@ -108,6 +184,12 @@ Alerts section (read-only):
 | `f` | Cycle: firing → resolved → all → archived |
 | `i` | In detail: jump to the alert's incident |
 
+Stats section:
+
+| Key | Action |
+|-----|--------|
+| `j` / `k`, `pgup` / `pgdn` | Scroll |
+
 Schedule section:
 
 | Key | Action |
@@ -116,10 +198,23 @@ Schedule section:
 | `d` | Remove the assignment |
 | `←` / `→` | Shift the week window |
 
+One person holds a given day. Assigning over days somebody else already has
+asks first — naming them and how many days are being taken — and moves the whole
+selection at once when you accept, so reassigning a week is one confirmation
+rather than seven deletions. The header line names the team whose rota this is,
+and "On-call today" lists everyone on call across your teams.
+
 Users section:
 
 | Key | Action |
 |-----|--------|
 | `n` | Create a user |
+| `t` | Edit the user's ntfy topic — submit empty to clear it |
 | `d` | Delete a user |
 | `k` | API keys for the selected user |
+| `p` | Set the selected user's web UI password — asks for the current one when it is your own |
+
+In Users, `k` and `d` act on the selected row, so move with `↑`/`↓` there rather
+than `k`. The Flags column marks administrators and disabled accounts. `n` and `d`
+are for administrators; `t`, `k` and `p` work on your own row, or on anyone's if you
+are one.

go.mod

@@ -1,4 +1,4 @@
-module github.com/yeniklas/terdut-tui
+module git.ryuvia.com/niklas/terdut-tui
 
 go 1.25.9
 

internal/api/client.go

@@ -37,6 +37,20 @@ func (c *Client) newRequest(method, path string) (*http.Request, error) {
 	return req, nil
 }
 
+// StatusError is a response the server answered with a 4xx or 5xx. Message is
+// the server's own {"error": ...} text, empty when the body carried none.
+type StatusError struct {
+	Code    int
+	Message string
+}
+
+func (e *StatusError) Error() string {
+	if e.Message != "" {
+		return fmt.Sprintf("server returned %d: %s", e.Code, e.Message)
+	}
+	return fmt.Sprintf("server returned %d", e.Code)
+}
+
 func (c *Client) do(req *http.Request, out any) error {
 	resp, err := c.httpClient.Do(req)
 	if err != nil {
@@ -49,10 +63,7 @@ func (c *Client) do(req *http.Request, out any) error {
 			Error string `json:"error"`
 		}
 		_ = json.NewDecoder(resp.Body).Decode(&e)
-		if e.Error != "" {
+		return &StatusError{Code: resp.StatusCode, Message: e.Error}
-			return fmt.Errorf("server returned %d: %s", resp.StatusCode, e.Error)
-		}
-		return fmt.Errorf("server returned %d", resp.StatusCode)
 	}
 
 	if out != nil {
@@ -61,14 +72,18 @@ func (c *Client) do(req *http.Request, out any) error {
 	return nil
 }
 
-// ListAlerts fetches alerts. status may be "firing", "resolved", or "" for all.
+// ListAlerts fetches alerts. teamID limits them to one team; 0 means every team
+// the caller belongs to. status may be "firing", "resolved", or "" for all.
 // Set archived=true to fetch only archived alerts; false returns only non-archived.
 //
 // Alerts are read-only on the server — there is nothing to acknowledge or
 // archive here. This is the raw feed, useful for checking what Alertmanager is
 // actually sending; the work queue is ListIncidents.
-func (c *Client) ListAlerts(status string, archived bool, limit int) ([]Alert, error) {
+func (c *Client) ListAlerts(teamID int64, status string, archived bool, limit int) ([]Alert, error) {
 	q := url.Values{}
+	if teamID > 0 {
+		q.Set("team_id", strconv.FormatInt(teamID, 10))
+	}
 	if status != "" {
 		q.Set("status", status)
 	}
@@ -127,12 +142,16 @@ func (c *Client) GetAlert(id int64) (*Alert, error) {
 
 // ── Incidents ──────────────────────────────────────────────────────────────
 
-// ListIncidents fetches the work queue. status may be "triggered",
+// ListIncidents fetches the work queue. teamID limits it to one team; 0 means
+// every team the caller belongs to. status may be "triggered",
 // "acknowledged", "resolved", or "" for the server default of open incidents
 // only. archived and snoozed each switch the list to that set rather than
 // adding to it, matching the server's filters.
-func (c *Client) ListIncidents(status string, archived, snoozed bool, limit int) ([]Incident, error) {
+func (c *Client) ListIncidents(teamID int64, status string, archived, snoozed bool, limit int) ([]Incident, error) {
 	q := url.Values{}
+	if teamID > 0 {
+		q.Set("team_id", strconv.FormatInt(teamID, 10))
+	}
 	if status != "" {
 		q.Set("status", status)
 	}
@@ -318,8 +337,37 @@ func (c *Client) GetStatsByDay() ([]DayStat, error) {
 	return result, c.do(req, &result)
 }
 
-func (c *Client) GetSchedule(from, to string) ([]ScheduleEntry, error) {
+// ── Teams ──────────────────────────────────────────────────────────────────
-	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/schedule?from=%s&to=%s", from, to))
+
+// ListTeams returns the teams the caller belongs to, with the caller's role in
+// each. Everything else the server returns is scoped to these. A server that
+// predates teams (v0.12) answers 404, which is how the TUI spots one.
+func (c *Client) ListTeams() ([]Team, error) {
+	req, err := c.newRequest(http.MethodGet, "/api/teams")
+	if err != nil {
+		return nil, err
+	}
+	var teams []Team
+	return teams, c.do(req, &teams)
+}
+
+// ListTeamMembers returns who belongs to a team. A schedule can only be given to
+// its own members, so this is the assignee list for one.
+func (c *Client) ListTeamMembers(teamID int64) ([]TeamMember, error) {
+	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/teams/%d/members", teamID))
+	if err != nil {
+		return nil, err
+	}
+	var members []TeamMember
+	return members, c.do(req, &members)
+}
+
+// ── Schedule ───────────────────────────────────────────────────────────────
+
+// GetSchedule returns a team's on-call entries between two YYYY-MM-DD dates.
+func (c *Client) GetSchedule(teamID int64, from, to string) ([]ScheduleEntry, error) {
+	q := url.Values{"from": {from}, "to": {to}}
+	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/teams/%d/schedule?%s", teamID, q.Encode()))
 	if err != nil {
 		return nil, err
 	}
@@ -327,43 +375,30 @@ func (c *Client) GetSchedule(from, to string) ([]ScheduleEntry, error) {
 	return entries, c.do(req, &entries)
 }
 
-// GetCurrentOnCall returns today's on-call entry, or nil if nobody is scheduled.
+// GetCurrentOnCall returns today's on-call entries, one per team that has
-func (c *Client) GetCurrentOnCall() (*ScheduleEntry, error) {
+// somebody scheduled. It is empty, not an error, when nobody is.
+func (c *Client) GetCurrentOnCall() ([]ScheduleEntry, error) {
 	req, err := c.newRequest(http.MethodGet, "/api/schedule/current")
 	if err != nil {
 		return nil, err
 	}
-	resp, err := c.httpClient.Do(req)
+	var entries []ScheduleEntry
-	if err != nil {
+	return entries, c.do(req, &entries)
-		return nil, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode == http.StatusNotFound {
-		return nil, nil
-	}
-	if resp.StatusCode >= 400 {
-		var e struct {
-			Error string `json:"error"`
-		}
-		_ = json.NewDecoder(resp.Body).Decode(&e)
-		if e.Error != "" {
-			return nil, fmt.Errorf("server returned %d: %s", resp.StatusCode, e.Error)
-		}
-		return nil, fmt.Errorf("server returned %d", resp.StatusCode)
-	}
-	var entry ScheduleEntry
-	if err := json.NewDecoder(resp.Body).Decode(&entry); err != nil {
-		return nil, err
-	}
-	return &entry, nil
 }
 
-func (c *Client) AssignSchedule(userID int64, dates []string) ([]ScheduleEntry, error) {
+// AssignSchedule puts one team member on call for the given dates. Only a team
+// owner or an administrator may.
+//
+// The server holds one person per day and refuses a date somebody already has,
+// so replace is what takes a shift off its current holder. It is all-or-nothing
+// either way: a week of free and taken days moves as a unit, or not at all.
+func (c *Client) AssignSchedule(teamID, userID int64, dates []string, replace bool) ([]ScheduleEntry, error) {
 	body := struct {
-		UserID int64    `json:"user_id"`
+		UserID  int64    `json:"user_id"`
-		Dates  []string `json:"dates"`
+		Dates   []string `json:"dates"`
-	}{UserID: userID, Dates: dates}
+		Replace bool     `json:"replace,omitempty"`
-	req, err := c.newRequestWithBody(http.MethodPost, "/api/schedule", body)
+	}{UserID: userID, Dates: dates, Replace: replace}
+	req, err := c.newRequestWithBody(http.MethodPost, fmt.Sprintf("/api/teams/%d/schedule", teamID), body)
 	if err != nil {
 		return nil, err
 	}
@@ -371,14 +406,16 @@ func (c *Client) AssignSchedule(userID int64, dates []string) ([]ScheduleEntry,
 	return entries, c.do(req, &entries)
 }
 
-func (c *Client) DeleteScheduleEntry(id int64) error {
+func (c *Client) DeleteScheduleEntry(teamID, id int64) error {
-	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/schedule/%d", id))
+	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/teams/%d/schedule/%d", teamID, id))
 	if err != nil {
 		return err
 	}
 	return c.do(req, nil)
 }
 
+// ── Users ──────────────────────────────────────────────────────────────────
+
 func (c *Client) ListUsers() ([]User, error) {
 	req, err := c.newRequest(http.MethodGet, "/api/users")
 	if err != nil {
@@ -401,6 +438,23 @@ func (c *Client) CreateUser(username, email string) (*User, error) {
 	return &user, c.do(req, &user)
 }
 
+// SetUserNotifyTarget points a user's push notifications at an ntfy topic.
+//
+// An empty topic clears it: the server stores NULL, and that user's incidents
+// page the shared fallback topic instead — which carries no Acknowledge button,
+// because anyone subscribed to it could otherwise acknowledge as somebody else.
+func (c *Client) SetUserNotifyTarget(userID int64, topic string) (*User, error) {
+	body := struct {
+		NtfyTopic string `json:"ntfy_topic"`
+	}{NtfyTopic: topic}
+	req, err := c.newRequestWithBody(http.MethodPut, fmt.Sprintf("/api/users/%d/notify", userID), body)
+	if err != nil {
+		return nil, err
+	}
+	var user User
+	return &user, c.do(req, &user)
+}
+
 func (c *Client) DeleteUser(id int64) error {
 	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/users/%d", id))
 	if err != nil {
@@ -429,7 +483,33 @@ func (c *Client) DeleteAPIKey(userID, keyID int64) error {
 	return c.do(req, nil)
 }
 
-// HealthCheck calls GET /healthz (unauthenticated path, no auth needed but we send it anyway).
+// Me returns the user the API key belongs to, and whether they have a web UI
+// password.
+func (c *Client) Me() (*Me, error) {
+	req, err := c.newRequest(http.MethodGet, "/api/me")
+	if err != nil {
+		return nil, err
+	}
+	var me Me
+	return &me, c.do(req, &me)
+}
+
+// SetPassword sets a user's web UI password. current is only checked by the
+// server when a user changes their own existing password; pass "" otherwise.
+func (c *Client) SetPassword(userID int64, password, current string) error {
+	body := struct {
+		Password        string `json:"password"`
+		CurrentPassword string `json:"current_password,omitempty"`
+	}{Password: password, CurrentPassword: current}
+	req, err := c.newRequestWithBody(http.MethodPut, fmt.Sprintf("/api/users/%d/password", userID), body)
+	if err != nil {
+		return err
+	}
+	return c.do(req, nil)
+}
+
+// HealthCheck calls GET /healthz, which is unauthenticated and does no database
+// check, so it says the process is up, not that the API key works.
 func (c *Client) HealthCheck() error {
 	req, err := http.NewRequest(http.MethodGet, c.baseURL+"/healthz", nil)
 	if err != nil {

internal/api/client_test.go

@@ -0,0 +1,497 @@
+package api
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+// call records what the client actually put on the wire. The paths and methods
+// are the contract with terdut-server, and getting one wrong is exactly how this
+// client broke when the server split alerts from incidents.
+type call struct {
+	method string
+	path   string
+	query  string
+	body   string
+	auth   string
+}
+
+// stub serves one canned response and records the request that fetched it.
+func stub(t *testing.T, status int, response string) (*Client, *call) {
+	t.Helper()
+	got := &call{}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		got.method, got.path, got.query = r.Method, r.URL.Path, r.URL.RawQuery
+		got.body, got.auth = string(body), r.Header.Get("Authorization")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(status)
+		io.WriteString(w, response)
+	}))
+	t.Cleanup(srv.Close)
+	return NewClient(srv.URL, "test-key"), got
+}
+
+func TestClient_SendsBearerToken(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[]`)
+	if _, err := c.ListIncidents(0, "", false, false, 0); err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	if got.auth != "Bearer test-key" {
+		t.Errorf("expected bearer token, got %q", got.auth)
+	}
+}
+
+// Every incident action, with the method and path terdut-server exposes.
+func TestClient_IncidentEndpoints(t *testing.T) {
+	tests := []struct {
+		name   string
+		invoke func(*Client) error
+		method string
+		path   string
+		// resp defaults to a JSON object; endpoints returning a list need an array.
+		resp string
+	}{
+		{"get", func(c *Client) error { _, err := c.GetIncident(7); return err },
+			http.MethodGet, "/api/incidents/7", ""},
+		{"timeline", func(c *Client) error { _, err := c.GetIncidentTimeline(7); return err },
+			http.MethodGet, "/api/incidents/7/timeline", `[]`},
+		{"acknowledge", func(c *Client) error { _, err := c.AcknowledgeIncident(7); return err },
+			http.MethodPost, "/api/incidents/7/acknowledge", ""},
+		{"unacknowledge", func(c *Client) error { return c.UnacknowledgeIncident(7) },
+			http.MethodDelete, "/api/incidents/7/acknowledge", ""},
+		{"resolve", func(c *Client) error { _, err := c.ResolveIncident(7); return err },
+			http.MethodPost, "/api/incidents/7/resolve", ""},
+		{"assign", func(c *Client) error { _, err := c.AssignIncident(7, 3); return err },
+			http.MethodPost, "/api/incidents/7/assign", ""},
+		{"snooze", func(c *Client) error { _, err := c.SnoozeIncident(7, "2h"); return err },
+			http.MethodPost, "/api/incidents/7/snooze", ""},
+		{"unsnooze", func(c *Client) error { return c.UnsnoozeIncident(7) },
+			http.MethodDelete, "/api/incidents/7/snooze", ""},
+		{"archive", func(c *Client) error { _, err := c.ArchiveIncident(7); return err },
+			http.MethodPost, "/api/incidents/7/archive", ""},
+		{"unarchive", func(c *Client) error { return c.UnarchiveIncident(7) },
+			http.MethodDelete, "/api/incidents/7/archive", ""},
+		{"add note", func(c *Client) error { _, err := c.AddNote(7, "hi"); return err },
+			http.MethodPost, "/api/incidents/7/notes", ""},
+		{"delete note", func(c *Client) error { return c.DeleteNote(7, 12) },
+			http.MethodDelete, "/api/incidents/7/notes/12", ""},
+		{"stats", func(c *Client) error { _, err := c.GetIncidentStats(); return err },
+			http.MethodGet, "/api/stats/incidents", ""},
+		{"set notify target", func(c *Client) error { _, err := c.SetUserNotifyTarget(7, "t"); return err },
+			http.MethodPut, "/api/users/7/notify", ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resp := tt.resp
+			if resp == "" {
+				resp = `{}`
+			}
+			c, got := stub(t, http.StatusOK, resp)
+			if err := tt.invoke(c); err != nil {
+				t.Fatalf("%s: %v", tt.name, err)
+			}
+			if got.method != tt.method || got.path != tt.path {
+				t.Errorf("expected %s %s, got %s %s", tt.method, tt.path, got.method, got.path)
+			}
+		})
+	}
+}
+
+func TestListIncidents_Filters(t *testing.T) {
+	tests := []struct {
+		name     string
+		teamID   int64
+		status   string
+		archived bool
+		snoozed  bool
+		limit    int
+		want     string
+	}{
+		{"default is the open queue", 0, "", false, false, 0, ""},
+		{"status", 0, "triggered", false, false, 0, "status=triggered"},
+		{"archived", 0, "resolved", true, false, 0, "archived=true&status=resolved"},
+		{"snoozed", 0, "", false, true, 0, "snoozed=true"},
+		{"limit", 0, "", false, false, 500, "limit=500"},
+		{"one team", 4, "", false, false, 0, "team_id=4"},
+		{"no team means all of them", 0, "triggered", false, false, 0, "status=triggered"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c, got := stub(t, http.StatusOK, `[]`)
+			if _, err := c.ListIncidents(tt.teamID, tt.status, tt.archived, tt.snoozed, tt.limit); err != nil {
+				t.Fatalf("list: %v", err)
+			}
+			if got.query != tt.want {
+				t.Errorf("expected query %q, got %q", tt.want, got.query)
+			}
+		})
+	}
+}
+
+func TestClient_RequestBodies(t *testing.T) {
+	t.Run("assign", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.AssignIncident(1, 42); err != nil {
+			t.Fatalf("assign: %v", err)
+		}
+		var body struct {
+			UserID int64 `json:"user_id"`
+		}
+		if err := json.Unmarshal([]byte(got.body), &body); err != nil {
+			t.Fatalf("decode body %q: %v", got.body, err)
+		}
+		if body.UserID != 42 {
+			t.Errorf("expected user_id 42, got %d", body.UserID)
+		}
+	})
+
+	t.Run("snooze", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.SnoozeIncident(1, "90m"); err != nil {
+			t.Fatalf("snooze: %v", err)
+		}
+		var body struct {
+			Duration string `json:"duration"`
+		}
+		if err := json.Unmarshal([]byte(got.body), &body); err != nil {
+			t.Fatalf("decode body %q: %v", got.body, err)
+		}
+		if body.Duration != "90m" {
+			t.Errorf("expected duration 90m, got %q", body.Duration)
+		}
+	})
+
+	// replace is what takes a day off its current holder, so it has to reach the
+	// wire when asked for — and stay off it when not.
+	t.Run("assign schedule", func(t *testing.T) {
+		c, got := stub(t, http.StatusCreated, `[]`)
+		if _, err := c.AssignSchedule(9, 3, []string{"2026-07-27"}, false); err != nil {
+			t.Fatalf("assign: %v", err)
+		}
+		if got.method != "POST" || got.path != "/api/teams/9/schedule" {
+			t.Errorf("expected POST /api/teams/9/schedule, got %s %s", got.method, got.path)
+		}
+		if got.body != `{"user_id":3,"dates":["2026-07-27"]}` {
+			t.Errorf("unexpected body %q", got.body)
+		}
+	})
+
+	t.Run("assign schedule with replace", func(t *testing.T) {
+		c, got := stub(t, http.StatusCreated, `[]`)
+		if _, err := c.AssignSchedule(9, 3, []string{"2026-07-27"}, true); err != nil {
+			t.Fatalf("assign: %v", err)
+		}
+		if got.body != `{"user_id":3,"dates":["2026-07-27"],"replace":true}` {
+			t.Errorf("unexpected body %q", got.body)
+		}
+	})
+
+	t.Run("set notify target", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.SetUserNotifyTarget(3, "terdut-niklas"); err != nil {
+			t.Fatalf("set notify target: %v", err)
+		}
+		if got.body != `{"ntfy_topic":"terdut-niklas"}` {
+			t.Errorf("unexpected body %q", got.body)
+		}
+	})
+
+	// Clearing has to put an explicit empty string on the wire: omitting the
+	// field would leave the topic untouched instead of removing it.
+	t.Run("clear notify target", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.SetUserNotifyTarget(3, ""); err != nil {
+			t.Fatalf("clear notify target: %v", err)
+		}
+		if got.body != `{"ntfy_topic":""}` {
+			t.Errorf("expected an explicit empty topic, got %q", got.body)
+		}
+	})
+}
+
+func TestUser_TopicFlattensNilAndEmpty(t *testing.T) {
+	var users []User
+	if err := json.Unmarshal([]byte(
+		`[{"id":1,"username":"a"},{"id":2,"username":"b","ntfy_topic":""},
+		  {"id":3,"username":"c","ntfy_topic":"terdut-c"}]`), &users); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	want := []string{"", "", "terdut-c"}
+	for i, u := range users {
+		if got := u.Topic(); got != want[i] {
+			t.Errorf("user %d: expected topic %q, got %q", u.ID, want[i], got)
+		}
+	}
+}
+
+// The 409 on re-resolving is the server telling the user why nothing happened,
+// so the message has to survive into the error the TUI displays.
+func TestClient_SurfacesServerErrorMessage(t *testing.T) {
+	c, _ := stub(t, http.StatusConflict, `{"error":"incident is resolved"}`)
+	_, err := c.ResolveIncident(1)
+	if err == nil {
+		t.Fatal("expected an error on 409")
+	}
+	if !strings.Contains(err.Error(), "incident is resolved") || !strings.Contains(err.Error(), "409") {
+		t.Errorf("expected status and server message in %q", err.Error())
+	}
+}
+
+func TestClient_ErrorWithoutBody(t *testing.T) {
+	c, _ := stub(t, http.StatusInternalServerError, ``)
+	if _, err := c.GetIncident(1); err == nil || !strings.Contains(err.Error(), "500") {
+		t.Errorf("expected a 500 error, got %v", err)
+	}
+}
+
+// Nobody on call is a normal state, not a failure: the server answers with an
+// empty list, one entry per team that has somebody scheduled.
+func TestGetCurrentOnCall_ListsOnePerTeam(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[
+		{"id":1,"team_id":1,"team_name":"Ops","user_id":5,"username":"alice","date":"2026-09-23"},
+		{"id":2,"team_id":2,"team_name":"Dev","user_id":6,"username":"bob","date":"2026-09-23"}]`)
+	entries, err := c.GetCurrentOnCall()
+	if err != nil {
+		t.Fatalf("on call: %v", err)
+	}
+	if got.path != "/api/schedule/current" {
+		t.Errorf("unexpected path %q", got.path)
+	}
+	if len(entries) != 2 || entries[0].TeamName != "Ops" || entries[1].Username != "bob" {
+		t.Errorf("unexpected entries %+v", entries)
+	}
+
+	c, _ = stub(t, http.StatusOK, `[]`)
+	if entries, err := c.GetCurrentOnCall(); err != nil || len(entries) != 0 {
+		t.Errorf("expected no entries and no error, got %v, %v", entries, err)
+	}
+}
+
+// Schedules belong to a team, so every call for one has to say which.
+func TestSchedule_IsPerTeam(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[]`)
+	if _, err := c.GetSchedule(7, "2026-09-21", "2026-09-27"); err != nil {
+		t.Fatalf("get schedule: %v", err)
+	}
+	if got.path != "/api/teams/7/schedule" || got.query != "from=2026-09-21&to=2026-09-27" {
+		t.Errorf("unexpected request %s?%s", got.path, got.query)
+	}
+
+	c, got = stub(t, http.StatusNoContent, ``)
+	if err := c.DeleteScheduleEntry(7, 12); err != nil {
+		t.Fatalf("delete: %v", err)
+	}
+	if got.method != "DELETE" || got.path != "/api/teams/7/schedule/12" {
+		t.Errorf("unexpected request %s %s", got.method, got.path)
+	}
+}
+
+func TestTeams(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[{"id":3,"name":"Ops","created_at":"2026-09-20T10:00:00Z","role":"owner"}]`)
+	teams, err := c.ListTeams()
+	if err != nil {
+		t.Fatalf("list teams: %v", err)
+	}
+	if got.path != "/api/teams" || len(teams) != 1 || teams[0].Role != RoleOwner || teams[0].Name != "Ops" {
+		t.Errorf("unexpected %s %+v", got.path, teams)
+	}
+
+	c, got = stub(t, http.StatusOK, `[{"team_id":3,"user_id":5,"username":"alice","role":"member"}]`)
+	members, err := c.ListTeamMembers(3)
+	if err != nil {
+		t.Fatalf("list members: %v", err)
+	}
+	if got.path != "/api/teams/3/members" || len(members) != 1 || members[0].UserID != 5 {
+		t.Errorf("unexpected %s %+v", got.path, members)
+	}
+}
+
+// A server that predates teams has no /api/teams, and the TUI recognises one by
+// that 404, so it must come back as a StatusError carrying the code.
+func TestListTeams_OldServerIs404(t *testing.T) {
+	c, _ := stub(t, http.StatusNotFound, `{"error":"not found"}`)
+	_, err := c.ListTeams()
+	var se *StatusError
+	if !errors.As(err, &se) || se.Code != http.StatusNotFound {
+		t.Errorf("expected a 404 StatusError, got %v", err)
+	}
+}
+
+func TestUser_DecodesAdminAndDisabled(t *testing.T) {
+	var u User
+	if err := json.Unmarshal([]byte(
+		`{"id":1,"username":"a","is_admin":true,"disabled_at":"2026-09-22T08:00:00Z"}`), &u); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if !u.IsAdmin || !u.IsDisabled() {
+		t.Errorf("expected an admin who is disabled, got %+v", u)
+	}
+	var other User
+	if err := json.Unmarshal([]byte(`{"id":2,"username":"b","is_admin":false}`), &other); err != nil || other.IsDisabled() {
+		t.Errorf("a user with no disabled_at must not be disabled")
+	}
+}
+
+// Optional fields are omitted by the server rather than sent null, so decoding
+// has to leave them zero instead of failing.
+func TestIncident_DecodesSparseServerShape(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{
+		"id": 1,
+		"group_key": "{}:{alertname=\"DiskFull\"}",
+		"title": "DiskFull (namespace=prod)",
+		"group_labels": {"alertname": "DiskFull", "namespace": "prod"},
+		"status": "triggered",
+		"severity": "critical",
+		"triggered_at": "2026-07-30T10:00:00Z"
+	}`)
+
+	inc, err := c.GetIncident(1)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if inc.Title != "DiskFull (namespace=prod)" || inc.Severity != "critical" {
+		t.Errorf("unexpected incident %+v", inc)
+	}
+	if inc.GroupLabels["namespace"] != "prod" {
+		t.Errorf("expected group labels decoded, got %v", inc.GroupLabels)
+	}
+	if !inc.IsOpen() {
+		t.Error("an incident with no resolved_at is open")
+	}
+	if inc.IsSnoozed() {
+		t.Error("an incident with no snoozed_until is not snoozed")
+	}
+	if inc.AcknowledgedByID != nil || inc.AssignedToID != nil {
+		t.Error("expected acknowledgement and assignment to be absent")
+	}
+}
+
+// A snooze expires by falling into the past; the server sweeps nothing, so the
+// client is what decides a stale snooze no longer counts.
+func TestIncident_IsSnoozed(t *testing.T) {
+	past := time.Now().Add(-time.Hour)
+	future := time.Now().Add(time.Hour)
+
+	tests := []struct {
+		name  string
+		until *time.Time
+		want  bool
+	}{
+		{"never snoozed", nil, false},
+		{"snooze in the past has expired", &past, false},
+		{"snooze in the future holds", &future, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := (Incident{SnoozedUntil: tt.until}).IsSnoozed(); got != tt.want {
+				t.Errorf("expected %v, got %v", tt.want, got)
+			}
+		})
+	}
+}
+
+func TestIncident_IsOpen(t *testing.T) {
+	now := time.Now()
+	if !(Incident{}).IsOpen() {
+		t.Error("no resolved_at means open")
+	}
+	if (Incident{ResolvedAt: &now}).IsOpen() {
+		t.Error("resolved_at means closed")
+	}
+}
+
+func TestAlert_DecodesIncidentLink(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{"id":3,"name":"DiskFull","status":"firing","incident_id":7}`)
+	a, err := c.GetAlert(3)
+	if err != nil {
+		t.Fatalf("get alert: %v", err)
+	}
+	if a.IncidentID == nil || *a.IncidentID != 7 {
+		t.Errorf("expected incident_id 7, got %v", a.IncidentID)
+	}
+}
+
+func TestListAlerts_ArchivedFilter(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[]`)
+	if _, err := c.ListAlerts(0, "", true, 50); err != nil {
+		t.Fatalf("list alerts: %v", err)
+	}
+	if got.path != "/api/alerts" || got.query != "archived=true&limit=50" {
+		t.Errorf("unexpected request %s?%s", got.path, got.query)
+	}
+}
+
+// MTTA and MTTR are null until something has been acknowledged or resolved. That
+// is "no data", and it must not decode to a confident zero.
+func TestIncidentStats_NullAveragesStayNil(t *testing.T) {
+	c, _ := stub(t, http.StatusOK,
+		`{"total":2,"triggered":2,"acknowledged":0,"resolved":0,"mtta_seconds":null,"mttr_seconds":null}`)
+	stats, err := c.GetIncidentStats()
+	if err != nil {
+		t.Fatalf("stats: %v", err)
+	}
+	if stats.Total != 2 || stats.Triggered != 2 {
+		t.Errorf("unexpected counts %+v", stats)
+	}
+	if stats.MTTASeconds != nil || stats.MTTRSeconds != nil {
+		t.Errorf("expected nil averages, got %v / %v", stats.MTTASeconds, stats.MTTRSeconds)
+	}
+}
+
+func TestClient_Me(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `{"user":{"id":3,"username":"erik"},"has_password":true}`)
+	me, err := c.Me()
+	if err != nil {
+		t.Fatalf("me: %v", err)
+	}
+	if got.method != http.MethodGet || got.path != "/api/me" {
+		t.Errorf("expected GET /api/me, got %s %s", got.method, got.path)
+	}
+	if me.User.ID != 3 || !me.HasPassword {
+		t.Errorf("unexpected decode %+v", me)
+	}
+}
+
+func TestClient_SetPassword(t *testing.T) {
+	c, got := stub(t, http.StatusNoContent, ``)
+	if err := c.SetPassword(2, "a brand new secret", ""); err != nil {
+		t.Fatalf("set password: %v", err)
+	}
+	if got.method != http.MethodPut || got.path != "/api/users/2/password" {
+		t.Errorf("expected PUT /api/users/2/password, got %s %s", got.method, got.path)
+	}
+	// Setting someone else's password carries no current_password at all,
+	// rather than an empty one.
+	if got.body != `{"password":"a brand new secret"}` {
+		t.Errorf("unexpected body %s", got.body)
+	}
+
+	c, got = stub(t, http.StatusNoContent, ``)
+	c.SetPassword(1, "a brand new secret", "the old one")
+	if !strings.Contains(got.body, `"current_password":"the old one"`) {
+		t.Errorf("current password missing from %s", got.body)
+	}
+}
+
+// Older servers have no /api/me; the caller tells that apart by the status
+// code, so the typed error has to carry it.
+func TestClient_StatusErrorKeepsCodeAndMessage(t *testing.T) {
+	c, _ := stub(t, http.StatusNotFound, `404 page not found`)
+	_, err := c.Me()
+	var se *StatusError
+	if !errors.As(err, &se) || se.Code != http.StatusNotFound {
+		t.Fatalf("expected a 404 StatusError, got %v", err)
+	}
+	if err.Error() != "server returned 404" {
+		t.Errorf("message changed: %q", err.Error())
+	}
+}

internal/api/types.go

@@ -7,6 +7,8 @@ import "time"
 // alert belongs to.
 type Alert struct {
 	ID           int64             `json:"id"`
+	TeamID       int64             `json:"team_id"`
+	TeamName     string            `json:"team_name,omitempty"`
 	Fingerprint  string            `json:"fingerprint"`
 	Name         string            `json:"name"`
 	Status       string            `json:"status"`
@@ -25,7 +27,8 @@ type Alert struct {
 
 	// ResolutionSource records why a resolved alert left the firing state:
 	// "alertmanager" for a real resolved webhook, "expiry" when the server
-	// inferred it after the alert stopped being refreshed.
+	// inferred it after the alert stopped being refreshed, "deadman" for a
+	// dead man's switch that came back. Treat the value set as open.
 	ResolutionSource *string `json:"resolution_source,omitempty"`
 }
 
@@ -41,6 +44,8 @@ const (
 // groupKey Alertmanager computed from the operator's group_by configuration.
 type Incident struct {
 	ID          int64             `json:"id"`
+	TeamID      int64             `json:"team_id"`
+	TeamName    string            `json:"team_name,omitempty"`
 	GroupKey    string            `json:"group_key"`
 	Title       string            `json:"title"`
 	GroupLabels map[string]string `json:"group_labels"`
@@ -63,10 +68,17 @@ type Incident struct {
 
 	ResolvedAt *time.Time `json:"resolved_at,omitempty"`
 
-	// ResolutionSource is "alerts" when every alert stopped firing, or "manual"
+	// ResolutionSource is "alerts" when every alert stopped firing, "manual"
-	// when a person closed it. Treat the value set as open.
+	// when a person closed it, or "recovered" when a dead man's switch came back.
+	// Treat the value set as open.
 	ResolutionSource *string `json:"resolution_source,omitempty"`
 
+	// EscalationLevel is how far up the team's escalation ladder the incident has
+	// climbed (0 = not escalated). EscalationDueAt is when the next step fires,
+	// and is nil once the ladder is exhausted or the incident is acknowledged.
+	EscalationLevel int        `json:"escalation_level"`
+	EscalationDueAt *time.Time `json:"escalation_due_at,omitempty"`
+
 	ArchivedAt *time.Time `json:"archived_at,omitempty"`
 
 	// Alerts is populated by GET /api/incidents/{id} only.
@@ -95,6 +107,16 @@ const (
 	EventUnsnoozed      = "unsnoozed"
 	EventResolved       = "resolved"
 	EventNote           = "note"
+
+	// Written when a team's dead man's switch stops reporting.
+	EventDeadmanSilent = "deadman_silent"
+
+	// Written by the server's notifier from the delivery result, not at enqueue.
+	// Detail carries the notification kind ("triggered", "reminder", "resolved"),
+	// and on a failure the reason after it. An absent user means the page went to
+	// the shared fallback topic rather than to a person.
+	EventNotified     = "notified"
+	EventNotifyFailed = "notify_failed"
 )
 
 // IncidentEvent is one entry in an incident's timeline. An empty Username means
@@ -147,6 +169,8 @@ type DayStat struct {
 
 type ScheduleEntry struct {
 	ID        int64     `json:"id"`
+	TeamID    int64     `json:"team_id"`
+	TeamName  string    `json:"team_name,omitempty"`
 	UserID    int64     `json:"user_id"`
 	Username  string    `json:"username"`
 	Date      string    `json:"date"` // YYYY-MM-DD
@@ -158,6 +182,63 @@ type User struct {
 	Username  string    `json:"username"`
 	Email     string    `json:"email"`
 	CreatedAt time.Time `json:"created_at"`
+
+	// IsAdmin marks a system administrator: the only kind of user who can create
+	// or delete users and act on other people's passwords and keys.
+	IsAdmin bool `json:"is_admin"`
+
+	// DisabledAt is set when an administrator has disabled the account. A
+	// disabled user cannot sign in or use their keys.
+	DisabledAt *time.Time `json:"disabled_at,omitempty"`
+
+	// NtfyTopic is where this user's push notifications go. Nil and empty mean
+	// the same thing — no topic of their own — because the server stores a blank
+	// string as NULL. Their incidents fall back to the server's shared fallback
+	// topic, which carries no Acknowledge button.
+	NtfyTopic *string `json:"ntfy_topic,omitempty"`
+}
+
+// Topic reads the user's ntfy topic, flattening the nil and empty cases the
+// server treats alike.
+func (u User) Topic() string {
+	if u.NtfyTopic == nil {
+		return ""
+	}
+	return *u.NtfyTopic
+}
+
+// IsDisabled reports whether the account has been disabled.
+func (u User) IsDisabled() bool { return u.DisabledAt != nil }
+
+// Me is GET /api/me: the caller, and whether they can sign in to the web UI.
+type Me struct {
+	User        User `json:"user"`
+	HasPassword bool `json:"has_password"`
+}
+
+// Team roles.
+const (
+	RoleOwner  = "owner"
+	RoleMember = "member"
+)
+
+// Team is a group that owns integrations, incidents, a schedule and an
+// escalation ladder. Role is the caller's role in it, and is only present on
+// the caller's own team lists (GET /api/teams).
+type Team struct {
+	ID        int64     `json:"id"`
+	Name      string    `json:"name"`
+	CreatedAt time.Time `json:"created_at"`
+	Role      string    `json:"role,omitempty"`
+}
+
+// TeamMember is one person's membership of a team.
+type TeamMember struct {
+	TeamID   int64     `json:"team_id"`
+	UserID   int64     `json:"user_id"`
+	Username string    `json:"username"`
+	Role     string    `json:"role"`
+	JoinedAt time.Time `json:"joined_at"`
 }
 
 type APIKey struct {

internal/config/config.go

@@ -15,12 +15,19 @@ type Config struct {
 	ServerURL       string
 	APIKey          string
 	RefreshInterval time.Duration
+	Theme           string
+
+	// Team is the team to start on, by name or id. Empty shows every team the
+	// key's user belongs to.
+	Team string
 }
 
 type rawConfig struct {
 	ServerURL       string `yaml:"server_url"`
 	APIKey          string `yaml:"api_key"`
 	RefreshInterval int    `yaml:"refresh_interval,omitempty"` // seconds
+	Theme           string `yaml:"theme,omitempty"`
+	Team            string `yaml:"team,omitempty"`
 }
 
 func Load() (*Config, error) {
@@ -33,7 +40,7 @@ func Load() (*Config, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
-			return nil, fmt.Errorf("config file not found at %s\n\nCreate it with:\n  server_url: https://terdut.example.com\n  api_key: <your-api-key>", path)
+			return nil, fmt.Errorf("config file not found at %s\n\nCreate it with:\n  server_url: https://terdut.example.com\n  api_key: <your-api-key>\n  theme: gruvbox-dark  # optional\n  team: Ops            # optional, team to start on", path)
 		}
 		return nil, fmt.Errorf("cannot read config file: %w", err)
 	}
@@ -59,5 +66,7 @@ func Load() (*Config, error) {
 		ServerURL:       raw.ServerURL,
 		APIKey:          raw.APIKey,
 		RefreshInterval: interval,
+		Theme:           raw.Theme,
+		Team:            raw.Team,
 	}, nil
 }

internal/config/config_test.go

@@ -0,0 +1,39 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeConfig(t *testing.T, body string) {
+	t.Helper()
+	dir := t.TempDir()
+	t.Setenv("XDG_CONFIG_HOME", dir)
+	if err := os.MkdirAll(filepath.Join(dir, "terdut-tui"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "terdut-tui", "config.yaml"), []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestLoad_TeamIsOptional(t *testing.T) {
+	writeConfig(t, "server_url: https://terdut.example.com\napi_key: k\n")
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.Team != "" {
+		t.Errorf("expected no default team, got %q", cfg.Team)
+	}
+
+	writeConfig(t, "server_url: https://terdut.example.com\napi_key: k\nteam: Ops\n")
+	cfg, err = Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.Team != "Ops" {
+		t.Errorf("expected team Ops, got %q", cfg.Team)
+	}
+}

internal/theme/builtin.go

@@ -0,0 +1,88 @@
+package theme
+
+import "sort"
+
+// The gruvbox palettes, in the author's original names. Dark uses the bright
+// variants and light the faded ones, which is what keeps each readable against
+// its own background.
+const (
+	darkBg0  = "#282828"
+	darkFg1  = "#ebdbb2"
+	darkGray = "#928374"
+	darkRed  = "#fb4934"
+	darkGrn  = "#b8bb26"
+	darkYel  = "#fabd2f"
+	darkBlu  = "#83a598"
+	darkAqua = "#8ec07c"
+	darkOrng = "#fe8019"
+
+	lightBg0  = "#fbf1c7"
+	lightFg1  = "#3c3836"
+	lightFg4  = "#7c6f64"
+	lightRed  = "#9d0006"
+	lightGrn  = "#79740e"
+	lightYel  = "#b57614"
+	lightBlu  = "#076678"
+	lightAqua = "#427b58"
+	lightOrng = "#af3a03"
+)
+
+// GruvboxDark is the default scheme. It assumes a dark terminal background:
+// themes colour foregrounds only, so the terminal supplies the canvas.
+var GruvboxDark = Theme{
+	Name: "gruvbox-dark",
+
+	Primary:   darkBlu,
+	OnPrimary: darkBg0,
+	Text:      darkFg1,
+	Muted:     darkGray,
+	Accent:    darkOrng,
+
+	Firing:   darkRed,
+	Resolved: darkGrn,
+	Error:    darkRed,
+
+	SevCritical: darkRed,
+	SevError:    darkOrng,
+	SevWarning:  darkYel,
+	SevInfo:     darkAqua,
+}
+
+// GruvboxLight is the same scheme against a light terminal background.
+var GruvboxLight = Theme{
+	Name: "gruvbox-light",
+
+	Primary:   lightBlu,
+	OnPrimary: lightBg0,
+	Text:      lightFg1,
+	Muted:     lightFg4,
+	Accent:    lightOrng,
+
+	Firing:   lightRed,
+	Resolved: lightGrn,
+	Error:    lightRed,
+
+	SevCritical: lightRed,
+	SevError:    lightOrng,
+	SevWarning:  lightYel,
+	SevInfo:     lightAqua,
+}
+
+// Default is the theme used when the config names none.
+var Default = GruvboxDark
+
+var builtins = map[string]Theme{
+	GruvboxDark.Name:  GruvboxDark,
+	GruvboxLight.Name: GruvboxLight,
+}
+
+// BuiltinNames lists the compiled-in themes, sorted, for error messages and
+// documentation.
+func BuiltinNames() []string {
+	names := make([]string, 0, len(builtins))
+	for name := range builtins {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	return names
+}

internal/theme/load.go

@@ -0,0 +1,196 @@
+package theme
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"gopkg.in/yaml.v3"
+)
+
+// rawTheme is the on-disk form. Every token is a pointer so an absent key is
+// distinguishable from an empty one, which is what lets 'extends' overwrite
+// only what the file actually mentions.
+type rawTheme struct {
+	Extends *string `yaml:"extends"`
+
+	Primary   *string `yaml:"primary"`
+	OnPrimary *string `yaml:"on_primary"`
+	Text      *string `yaml:"text"`
+	Muted     *string `yaml:"muted"`
+	Accent    *string `yaml:"accent"`
+
+	Firing   *string `yaml:"firing"`
+	Resolved *string `yaml:"resolved"`
+	Error    *string `yaml:"error"`
+
+	SevCritical *string `yaml:"sev_critical"`
+	SevError    *string `yaml:"sev_error"`
+	SevWarning  *string `yaml:"sev_warning"`
+	SevInfo     *string `yaml:"sev_info"`
+}
+
+// binding ties a YAML key to its raw value and the field it fills, so parsing,
+// merging and the missing-token report all walk the same list.
+type binding struct {
+	key string
+	src *string
+	dst *lipgloss.Color
+}
+
+func bindings(r *rawTheme, t *Theme) []binding {
+	return []binding{
+		{"primary", r.Primary, &t.Primary},
+		{"on_primary", r.OnPrimary, &t.OnPrimary},
+		{"text", r.Text, &t.Text},
+		{"muted", r.Muted, &t.Muted},
+		{"accent", r.Accent, &t.Accent},
+		{"firing", r.Firing, &t.Firing},
+		{"resolved", r.Resolved, &t.Resolved},
+		{"error", r.Error, &t.Error},
+		{"sev_critical", r.SevCritical, &t.SevCritical},
+		{"sev_error", r.SevError, &t.SevError},
+		{"sev_warning", r.SevWarning, &t.SevWarning},
+		{"sev_info", r.SevInfo, &t.SevInfo},
+	}
+}
+
+// tokenKeys lists the colour keys a theme file may set, in the order they are
+// documented.
+func tokenKeys() []string {
+	bs := bindings(&rawTheme{}, &Theme{})
+	keys := make([]string, len(bs))
+	for i, b := range bs {
+		keys[i] = b.key
+	}
+	return keys
+}
+
+func isTokenKey(k string) bool {
+	if k == "extends" {
+		return true
+	}
+	for _, want := range tokenKeys() {
+		if k == want {
+			return true
+		}
+	}
+	return false
+}
+
+// Load resolves a theme by name. An empty name is the default; otherwise a file
+// in the user's themes directory wins over a built-in of the same name, so the
+// documented way to tweak a built-in is to shadow it rather than rename it.
+func Load(name string) (Theme, error) {
+	if name == "" {
+		return Default, nil
+	}
+
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		// Built-ins do not need the disk, so a missing config directory only
+		// matters for user themes.
+		if t, ok := builtins[name]; ok {
+			return t, nil
+		}
+		return Theme{}, fmt.Errorf("cannot determine config directory: %w", err)
+	}
+
+	return loadFrom(filepath.Join(dir, "terdut-tui", "themes"), name)
+}
+
+func loadFrom(dir, name string) (Theme, error) {
+	if strings.ContainsAny(name, `/\`) || name == "." || name == ".." {
+		return Theme{}, fmt.Errorf("invalid theme name %q: a theme is a bare name, not a path", name)
+	}
+
+	path := filepath.Join(dir, name+".yaml")
+	data, err := os.ReadFile(path)
+	switch {
+	case err == nil:
+		return parse(name, data)
+	case !os.IsNotExist(err):
+		return Theme{}, fmt.Errorf("cannot read theme file %s: %w", path, err)
+	}
+
+	if t, ok := builtins[name]; ok {
+		return t, nil
+	}
+
+	return Theme{}, fmt.Errorf("unknown theme %q\n\nBuilt-in themes: %s\nOr define your own at %s",
+		name, strings.Join(BuiltinNames(), ", "), path)
+}
+
+func parse(name string, data []byte) (Theme, error) {
+	// Check the keys before decoding, so a typo'd token reports itself by name
+	// alongside the ones that would have worked rather than surfacing yaml's
+	// message about an internal Go type.
+	var keys map[string]yaml.Node
+	if err := yaml.Unmarshal(data, &keys); err != nil {
+		return Theme{}, fmt.Errorf("invalid theme %q: %w", name, err)
+	}
+	for k := range keys {
+		if !isTokenKey(k) {
+			return Theme{}, fmt.Errorf("theme %q: unknown key %q\n\nValid keys: extends, %s",
+				name, k, strings.Join(tokenKeys(), ", "))
+		}
+	}
+
+	var raw rawTheme
+	if err := yaml.Unmarshal(data, &raw); err != nil {
+		return Theme{}, fmt.Errorf("invalid theme %q: %w", name, err)
+	}
+
+	t := Theme{Name: name}
+	if raw.Extends != nil {
+		base, ok := builtins[*raw.Extends]
+		if !ok {
+			return Theme{}, fmt.Errorf("theme %q: 'extends' names unknown theme %q (built-ins: %s)",
+				name, *raw.Extends, strings.Join(BuiltinNames(), ", "))
+		}
+		t = base
+		t.Name = name
+	}
+
+	var missing []string
+	for _, b := range bindings(&raw, &t) {
+		if b.src == nil {
+			if raw.Extends == nil {
+				missing = append(missing, b.key)
+			}
+			continue
+		}
+		c, err := parseColor(*b.src)
+		if err != nil {
+			return Theme{}, fmt.Errorf("theme %q: %s: %w", name, b.key, err)
+		}
+		*b.dst = c
+	}
+
+	if len(missing) > 0 {
+		return Theme{}, fmt.Errorf("theme %q is missing %s\n\nEither set every token or add 'extends: %s' to inherit the rest",
+			name, strings.Join(missing, ", "), Default.Name)
+	}
+
+	return t, nil
+}
+
+var hexColor = regexp.MustCompile(`^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$`)
+
+// parseColor accepts what lipgloss can actually render: a hex value, or an ANSI
+// palette index for people who would rather follow their terminal's colours.
+func parseColor(s string) (lipgloss.Color, error) {
+	if hexColor.MatchString(s) {
+		return lipgloss.Color(s), nil
+	}
+	// strconv.Itoa round-trips to reject "+7" and "007", which lipgloss would
+	// pass to the terminal verbatim.
+	if n, err := strconv.Atoi(s); err == nil && n >= 0 && n <= 255 && strconv.Itoa(n) == s {
+		return lipgloss.Color(s), nil
+	}
+	return "", fmt.Errorf("invalid colour %q, want a hex value like \"#83a598\" or an ANSI index 0-255", s)
+}

internal/theme/load_test.go

@@ -0,0 +1,180 @@
+package theme
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// write drops a theme file into dir and returns the directory, so each test
+// works against its own themes directory rather than the user's.
+func write(t *testing.T, dir, name, body string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(dir, name+".yaml"), []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestLoad_EmptyNameIsTheDefault(t *testing.T) {
+	got, err := Load("")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got.Name != Default.Name {
+		t.Errorf("got theme %q, want %q", got.Name, Default.Name)
+	}
+}
+
+func TestLoadFrom_BuiltinsResolveWithoutAFile(t *testing.T) {
+	dir := t.TempDir()
+	for _, name := range BuiltinNames() {
+		got, err := loadFrom(dir, name)
+		if err != nil {
+			t.Fatalf("%s: unexpected error: %v", name, err)
+		}
+		if got.Name != name {
+			t.Errorf("got theme %q, want %q", got.Name, name)
+		}
+		if got.Primary == "" {
+			t.Errorf("%s: primary is unset", name)
+		}
+	}
+}
+
+func TestLoadFrom_ExtendsOverridesOnlyWhatIsNamed(t *testing.T) {
+	dir := t.TempDir()
+	write(t, dir, "mine", "extends: gruvbox-dark\nprimary: \"#d3869b\"\n")
+
+	got, err := loadFrom(dir, "mine")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got.Name != "mine" {
+		t.Errorf("got name %q, want %q", got.Name, "mine")
+	}
+	if got.Primary != "#d3869b" {
+		t.Errorf("got primary %q, want the override", got.Primary)
+	}
+	if got.Muted != GruvboxDark.Muted {
+		t.Errorf("got muted %q, want inherited %q", got.Muted, GruvboxDark.Muted)
+	}
+	if got.SevInfo != GruvboxDark.SevInfo {
+		t.Errorf("got sev_info %q, want inherited %q", got.SevInfo, GruvboxDark.SevInfo)
+	}
+}
+
+func TestLoadFrom_UserFileShadowsABuiltin(t *testing.T) {
+	dir := t.TempDir()
+	write(t, dir, "gruvbox-dark", "extends: gruvbox-dark\naccent: \"#fabd2f\"\n")
+
+	got, err := loadFrom(dir, "gruvbox-dark")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got.Accent != "#fabd2f" {
+		t.Errorf("got accent %q, want the shadowing file's value", got.Accent)
+	}
+}
+
+func TestLoadFrom_WithoutExtendsEveryTokenIsRequired(t *testing.T) {
+	dir := t.TempDir()
+	write(t, dir, "partial", "primary: \"#83a598\"\n")
+
+	_, err := loadFrom(dir, "partial")
+	if err == nil {
+		t.Fatal("expected an error for a theme missing tokens")
+	}
+	for _, want := range []string{"muted", "sev_info", "extends"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("error should mention %q, got: %v", want, err)
+		}
+	}
+}
+
+func TestLoadFrom_CompleteThemeNeedsNoExtends(t *testing.T) {
+	dir := t.TempDir()
+	write(t, dir, "full", `primary: "#000001"
+on_primary: "#000002"
+text: "#000003"
+muted: "#000004"
+accent: "#000005"
+firing: "#000006"
+resolved: "#000007"
+error: "#000008"
+sev_critical: "#000009"
+sev_error: "#00000a"
+sev_warning: "#00000b"
+sev_info: "#00000c"
+`)
+
+	got, err := loadFrom(dir, "full")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got.Primary != "#000001" || got.SevInfo != "#00000c" {
+		t.Errorf("tokens not applied: %+v", got)
+	}
+}
+
+func TestLoadFrom_Errors(t *testing.T) {
+	tests := []struct {
+		name string
+		file string // empty means: write no file at all
+		body string
+		want string
+	}{
+		{"unknown name", "", "", "unknown theme"},
+		{"unknown key", "typo", "extends: gruvbox-dark\nprimry: \"#83a598\"\n", `unknown key "primry"`},
+		{"unknown key lists the valid ones", "typo2", "primry: \"#83a598\"\n", "Valid keys: extends, primary,"},
+		{"bad colour", "bad", "extends: gruvbox-dark\nprimary: notacolour\n", "invalid colour"},
+		{"bad colour names the token", "badkey", "extends: gruvbox-dark\nsev_warning: \"#gggggg\"\n", "sev_warning"},
+		{"unknown base", "orphan", "extends: solarized\nprimary: \"#83a598\"\n", "unknown theme \"solarized\""},
+		{"malformed yaml", "broken", "extends: [\n", "invalid theme"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			name := tt.file
+			if name == "" {
+				name = "missing"
+			} else {
+				write(t, dir, name, tt.body)
+			}
+
+			_, err := loadFrom(dir, name)
+			if err == nil {
+				t.Fatal("expected an error")
+			}
+			if !strings.Contains(err.Error(), tt.want) {
+				t.Errorf("error should mention %q, got: %v", tt.want, err)
+			}
+		})
+	}
+}
+
+func TestLoadFrom_RejectsPathsAsNames(t *testing.T) {
+	dir := t.TempDir()
+	for _, name := range []string{"../secrets", "sub/theme", ".."} {
+		if _, err := loadFrom(dir, name); err == nil {
+			t.Errorf("%q: expected an error", name)
+		}
+	}
+}
+
+func TestParseColor(t *testing.T) {
+	ok := []string{"#83a598", "#FFF", "#abc", "0", "15", "255"}
+	for _, s := range ok {
+		if _, err := parseColor(s); err != nil {
+			t.Errorf("parseColor(%q) = %v, want no error", s, err)
+		}
+	}
+
+	bad := []string{"", "83a598", "#ab", "#abcd", "#gggggg", "256", "-1", "+7", "007", "red"}
+	for _, s := range bad {
+		if _, err := parseColor(s); err == nil {
+			t.Errorf("parseColor(%q) = nil, want an error", s)
+		}
+	}
+}

internal/theme/theme.go

@@ -0,0 +1,32 @@
+// Package theme resolves the named colour scheme the TUI renders with. A theme
+// is a flat set of semantic tokens — roles like "muted" or "firing", never hues
+// — so a new scheme is a table of colours rather than a change to the views.
+package theme
+
+import "github.com/charmbracelet/lipgloss"
+
+// Theme is the palette the UI draws from. Every token is a foreground except
+// OnPrimary, which is the text colour for the two places that invert: the
+// active tab and the selected table row.
+//
+// Colours are truecolor hex; lipgloss downsamples them for 256- and 16-colour
+// terminals and drops them entirely under NO_COLOR, so themes do not carry
+// fallbacks of their own.
+type Theme struct {
+	Name string
+
+	Primary   lipgloss.Color // header, tab highlight, selection
+	OnPrimary lipgloss.Color // text drawn on a Primary background
+	Text      lipgloss.Color // default emphasis foreground
+	Muted     lipgloss.Color // secondary text, dividers, borders
+	Accent    lipgloss.Color // status line, acknowledged, by-day chart
+
+	Firing   lipgloss.Color
+	Resolved lipgloss.Color
+	Error    lipgloss.Color
+
+	SevCritical lipgloss.Color
+	SevError    lipgloss.Color
+	SevWarning  lipgloss.Color
+	SevInfo     lipgloss.Color
+}

internal/tui/model.go

@@ -1,16 +1,22 @@
 package tui
 
 import (
+	"errors"
 	"fmt"
+	"net/http"
+	"slices"
+	"strconv"
+	"strings"
 	"time"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
 	"github.com/charmbracelet/bubbles/help"
+	"github.com/charmbracelet/bubbles/key"
 	"github.com/charmbracelet/bubbles/table"
 	"github.com/charmbracelet/bubbles/textinput"
 	"github.com/charmbracelet/bubbles/viewport"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/charmbracelet/lipgloss"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
 // ── Enums ──────────────────────────────────────────────────────────────────
@@ -21,11 +27,12 @@ const (
 	// Incidents lead: they are the work. Alerts is the raw feed underneath.
 	sectionIncidents section = iota
 	sectionAlerts
+	sectionStats
 	sectionArchived
 	sectionSchedule
 	sectionUsers
 
-	sectionCount = 5
+	sectionCount = 6
 )
 
 type mode int
@@ -37,15 +44,28 @@ const (
 	modeNote
 	modeSnooze
 	modeConfirm
-	modeStats
 	modeUserPicker
 	modeUserCreate
+	modeUserNotifyEdit
 	modeAPIKeyMenu
 	modeAPIKeyCreate
 	modeAPIKeyReveal
 	modeAPIKeyRevokeByID
+	modePasswordSet
 )
 
+// Fields of the set-password form, in tab order.
+const (
+	pwCurrent = iota
+	pwNew
+	pwRepeat
+	pwFieldCount
+)
+
+// minPasswordLen mirrors the server's rule, so a short password is refused
+// here rather than after a round trip.
+const minPasswordLen = 10
+
 type confirmTarget int
 
 const (
@@ -53,6 +73,7 @@ const (
 	confirmResolveIncident
 	confirmDeleteScheduleEntry
 	confirmDeleteUser
+	confirmReassignSchedule
 )
 
 // pickerTarget says what the user picker is choosing a person for.
@@ -89,7 +110,10 @@ func filterLabel(filter string) string {
 // ── Messages ───────────────────────────────────────────────────────────────
 
 // dashboard
-type connectedMsg struct{}
+type connectedMsg struct {
+	teams []api.Team
+	me    api.Me
+}
 type connectErrMsg struct{ err error }
 type incidentsFetchedMsg struct{ incidents []api.Incident }
 type archivedIncidentsFetchedMsg struct{ incidents []api.Incident }
@@ -124,7 +148,11 @@ type detailStatsErrMsg struct{ err error }
 // schedule
 type scheduleFetchedMsg struct {
 	entries []api.ScheduleEntry
-	current *api.ScheduleEntry
+	current []api.ScheduleEntry
+}
+type pickerReadyMsg struct {
+	users   []api.User
+	members map[int64]bool
 }
 type scheduleFetchErrMsg struct{ err error }
 type scheduleActionErrMsg struct{ err error }
@@ -134,6 +162,8 @@ type usersFetchedMsg struct{ users []api.User }
 type apiKeyCreatedMsg struct{ key api.APIKey }
 type apiKeyRevokedMsg struct{}
 type userActionErrMsg struct{ err error }
+type meFetchedMsg struct{ me api.Me }
+type passwordSetMsg struct{ username string }
 
 // ── Model ──────────────────────────────────────────────────────────────────
 
@@ -142,6 +172,18 @@ type scheduleDay struct {
 	entry *api.ScheduleEntry
 }
 
+// pendingAssign is an on-call assignment held back by the reassignment
+// confirmation, because some of its dates belong to somebody else.
+type pendingAssign struct {
+	userID   int64
+	username string
+	dates    []string
+	// taken are the dates currently held by other people, and holders the
+	// distinct names holding them — both only for wording the prompt.
+	taken   []string
+	holders []string
+}
+
 type Model struct {
 	client          *api.Client
 	serverURL       string
@@ -152,6 +194,15 @@ type Model struct {
 	width         int
 	height        int
 
+	// Teams. The server scopes everything to the caller's teams; activeTeamID
+	// narrows the incident and alert lists to one of them, 0 meaning all. The
+	// schedule is per team and always needs a concrete one, see scheduleTeam.
+	teams        []api.Team
+	activeTeamID int64
+	defaultTeam  string // config's `team`, resolved on connect
+	meID         int64
+	isAdmin      bool
+
 	// Connection & dashboard
 	connected     bool
 	loading       bool
@@ -193,22 +244,23 @@ type Model struct {
 	confirmTarget      confirmTarget
 	pendingDeleteID    int64 // note event ID
 	pendingDeleteEntry *api.ScheduleEntry
+	pendingAssign      *pendingAssign
 
 	// Stats
-	topAlerts     []api.TopAlert
+	topAlerts []api.TopAlert
-	hourStats     []api.HourStat
+	hourStats []api.HourStat
-	dayStats      []api.DayStat
+	dayStats  []api.DayStat
+	// statsLoaded tracks the first fetch separately from emptiness: a server with
+	// no alerts yet legitimately returns three empty slices.
+	statsLoaded   bool
 	statsLoading  bool
 	statsViewport viewport.Model
-	// statsReturnMode is where esc goes back to, since stats opens from both
-	// the dashboard and an incident.
-	statsReturnMode mode
 
 	// Schedule
 	scheduleWindow  time.Time
 	scheduleEntries []api.ScheduleEntry
 	scheduleDays    []scheduleDay
-	currentOnCall   *api.ScheduleEntry
+	currentOnCall   []api.ScheduleEntry
 	scheduleLoading bool
 	scheduleTable   table.Model
 
@@ -218,41 +270,64 @@ type Model struct {
 	userPickerTable  table.Model
 	pickerTarget     pickerTarget
 	pickerAssignWeek bool
+	// pickerMembers is who belongs to the schedule's team, so the schedule picker
+	// offers only people the server will accept. Nil until fetched.
+	pickerMembers map[int64]bool
 
 	// User management section
 	userManageTable   table.Model
 	selectedUser      api.User
 	userFormInputs    [2]textinput.Model
 	userFormFocus     int
+	ntfyTopicInput    textinput.Model
 	apiKeyNameInput   textinput.Model
 	apiKeyRevokeInput textinput.Model
 	revealedAPIKey    api.APIKey
 
-	help help.Model
+	// Set-password form. The current-password field is shown only when the
-	keys keyMap
+	// target is the key's own user and already has a password, which is the
+	// one case the server asks for it; pwLoading covers the /api/me lookup
+	// that decides it.
+	pwInputs      [pwFieldCount]textinput.Model
+	pwFocus       int
+	pwNeedCurrent bool
+	pwLoading     bool
+
+	help   help.Model
+	keys   keyMap
+	styles Styles
 }
 
-func NewModel(client *api.Client, serverURL string, refreshInterval time.Duration) Model {
+func NewModel(client *api.Client, serverURL string, refreshInterval time.Duration, th theme.Theme) Model {
-	ts := defaultTableStyles()
+	st := newStyles(th)
+	ts := st.Table()
 
-	incidentT := table.New(table.WithFocused(true))
+	// Each table sees a key before the section's own handler does, so any
+	// key a section uses as an action must be taken out of that table's
+	// navigation bindings, or the cursor moves first and the action lands on
+	// a different row. See tableKeyMap.
+	incidentT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap("f")))
 	incidentT.SetStyles(ts)
 
-	alertT := table.New(table.WithFocused(true))
+	alertT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap("f")))
 	alertT.SetStyles(ts)
 
-	archivedT := table.New(table.WithFocused(true))
+	archivedT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap()))
 	archivedT.SetStyles(ts)
 
-	schedT := table.New(table.WithFocused(true))
+	schedT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap("d")))
 	schedT.SetStyles(ts)
 
-	pickerT := table.New(table.WithFocused(true))
+	pickerT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap()))
 	pickerT.SetStyles(ts)
 
-	manageT := table.New(table.WithFocused(true))
+	manageT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap("d", "k", "p")))
 	manageT.SetStyles(ts)
 
+	// Sized by the first tea.WindowSizeMsg; built here so it carries the default
+	// scroll keymap, which the zero value lacks.
+	statsVP := viewport.New(0, 0)
+
 	noteIn := textinput.New()
 	noteIn.Placeholder = "type your note…"
 	noteIn.CharLimit = 1000
@@ -269,6 +344,10 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 	emailIn.Placeholder = "email"
 	emailIn.CharLimit = 128
 
+	topicIn := textinput.New()
+	topicIn.Placeholder = "ntfy topic — empty clears it"
+	topicIn.CharLimit = 128
+
 	keyNameIn := textinput.New()
 	keyNameIn.Placeholder = "key name (e.g. laptop)"
 	keyNameIn.CharLimit = 64
@@ -277,6 +356,27 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 	revokeIn.Placeholder = "integer key ID"
 	revokeIn.CharLimit = 20
 
+	var pwIn [pwFieldCount]textinput.Model
+	for i, placeholder := range [pwFieldCount]string{"current password", "new password (min. 10 characters)", "repeat new password"} {
+		pwIn[i] = textinput.New()
+		pwIn[i].Placeholder = placeholder
+		pwIn[i].EchoMode = textinput.EchoPassword
+		pwIn[i].EchoCharacter = '•'
+		pwIn[i].CharLimit = 72 // bcrypt's limit; the server refuses longer
+	}
+
+	for _, in := range []*textinput.Model{
+		&noteIn, &snoozeIn, &usernameIn, &emailIn, &topicIn, &keyNameIn, &revokeIn,
+	} {
+		*in = st.Input(*in)
+	}
+	for i := range pwIn {
+		pwIn[i] = st.Input(pwIn[i])
+	}
+
+	helpModel := help.New()
+	helpModel.Styles = st.Help()
+
 	now := time.Now().UTC()
 	today := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, time.UTC)
 	weekday := int(today.Weekday())
@@ -298,6 +398,7 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 		incidentTable:     incidentT,
 		alertTable:        alertT,
 		archivedTable:     archivedT,
+		statsViewport:     statsVP,
 		noteInput:         noteIn,
 		snoozeInput:       snoozeIn,
 		scheduleWindow:    window,
@@ -305,60 +406,118 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 		userPickerTable:   pickerT,
 		userManageTable:   manageT,
 		userFormInputs:    [2]textinput.Model{usernameIn, emailIn},
+		ntfyTopicInput:    topicIn,
 		apiKeyNameInput:   keyNameIn,
 		apiKeyRevokeInput: revokeIn,
-		help:              help.New(),
+		pwInputs:          pwIn,
+		help:              helpModel,
 		keys:              keys,
+		styles:            st,
 	}
 }
 
+// WithDefaultTeam names the team to start on, by name or id. It is resolved
+// against the caller's teams once connected; an unknown one is reported and the
+// TUI starts on all teams.
+func (m Model) WithDefaultTeam(team string) Model {
+	m.defaultTeam = strings.TrimSpace(team)
+	return m
+}
+
 func (m Model) Init() tea.Cmd {
 	return connectCmd(m.client)
 }
 
 // ── Table rebuilders ───────────────────────────────────────────────────────
 
-func defaultTableStyles() table.Styles {
+// tableKeyMap is the bubbles table keymap without the given keys.
-	s := table.DefaultStyles()
+//
-	s.Header = s.Header.Bold(true)
+// The table's defaults claim several letters -- k up, d half a page down, f a
-	s.Selected = s.Selected.
+// page down -- and the dashboard hands every key to the table before the
-		Foreground(lipgloss.Color("0")).
+// section's own handler reads the cursor. A letter that is both, like k for
-		Background(colorPrimary).
+// API keys in Users, therefore moved the cursor and then acted on the row it
-		Bold(true)
+// had moved to. Each table gives up the letters its section acts on; the
-	return s
+// arrow keys and the rest of the defaults are untouched.
+func tableKeyMap(reserved ...string) table.KeyMap {
+	km := table.DefaultKeyMap()
+	for _, b := range []*key.Binding{
+		&km.LineUp, &km.LineDown, &km.PageUp, &km.PageDown,
+		&km.HalfPageUp, &km.HalfPageDown, &km.GotoTop, &km.GotoBottom,
+	} {
+		var keep []string
+		for _, k := range b.Keys() {
+			if !slices.Contains(reserved, k) {
+				keep = append(keep, k)
+			}
+		}
+		b.SetKeys(keep...)
+	}
+	return km
+}
+
+// setRows replaces a table's rows and keeps its cursor in a state the rest of
+// this package can rely on: valid whenever the table has any rows at all.
+//
+// bubbles does not do that on its own. SetRows only clamps the cursor *down*
+// (`if m.cursor > len(rows)-1`), so setting zero rows drives it to -1 and
+// nothing ever brings it back — filling the table later leaves -1 in place,
+// because -1 is not greater than len-1. Every table here is rebuilt from empty
+// once at startup, when the first WindowSizeMsg arrives before any fetch has
+// returned, so without this every cursor is -1 until the user happens to press
+// up or down. Indexing a slice with that panics, which is exactly what
+// assigning an on-call week did.
+func setRows(t *table.Model, rows []table.Row) {
+	t.SetRows(rows)
+	if len(rows) > 0 && t.Cursor() < 0 {
+		t.SetCursor(0)
+	}
+}
+
+// setTable replaces a table's columns and rows together, for tables whose column
+// count can change (the Team column comes and goes). bubbles re-renders the
+// existing rows as soon as SetColumns is called, and a row with a different
+// number of cells than the new columns indexes past the end and panics, so the
+// old rows have to go first. The cursor is put back afterwards, since a refresh
+// must not send it to the top.
+func setTable(t *table.Model, cols []table.Column, rows []table.Row) {
+	cursor := t.Cursor()
+	t.SetRows(nil)
+	t.SetColumns(cols)
+	setRows(t, rows)
+	if cursor > 0 && cursor < len(rows) {
+		t.SetCursor(cursor)
+	}
 }
 
 func (m *Model) rebuildIncidentTable() {
-	m.incidentTable.SetColumns(incidentColumns(m.width))
+	setTable(&m.incidentTable, incidentColumns(m.width, m.showTeamColumn()), incidentRows(m.incidents, m.showTeamColumn()))
-	m.incidentTable.SetRows(incidentRows(m.incidents))
 	m.incidentTable.SetHeight(tableHeight(m.height, 8))
 }
 
 func (m *Model) rebuildTable() {
-	m.alertTable.SetColumns(alertColumns(m.width))
+	setTable(&m.alertTable, alertColumns(m.width, m.showTeamColumn()), alertRows(m.alerts, m.showTeamColumn()))
-	m.alertTable.SetRows(alertRows(m.alerts))
 	m.alertTable.SetHeight(tableHeight(m.height, 8))
 }
 
 func (m *Model) rebuildArchivedTable() {
-	m.archivedTable.SetColumns(incidentColumns(m.width))
+	setTable(&m.archivedTable, incidentColumns(m.width, m.showTeamColumn()), incidentRows(m.archivedIncidents, m.showTeamColumn()))
-	m.archivedTable.SetRows(incidentRows(m.archivedIncidents))
 	m.archivedTable.SetHeight(tableHeight(m.height, 8))
 }
 
 func (m *Model) rebuildScheduleTable() {
 	m.scheduleTable.SetColumns(scheduleColumns(m.width))
-	m.scheduleTable.SetRows(scheduleRows(m.scheduleDays))
+	setRows(&m.scheduleTable, scheduleRows(m.scheduleDays))
 	m.scheduleTable.SetHeight(tableHeight(m.height, 10))
 }
 
 func (m *Model) rebuildUserPickerTable() {
 	m.userPickerTable.SetColumns(userPickerColumns(m.width))
-	rows := make([]table.Row, len(m.users))
+	pickable := m.pickerUsers()
-	for i, u := range m.users {
+	rows := make([]table.Row, len(pickable))
+	for i, u := range pickable {
 		rows[i] = table.Row{u.Username, u.Email}
 	}
-	m.userPickerTable.SetRows(rows)
+	setRows(&m.userPickerTable, rows)
 	m.userPickerTable.SetHeight(tableHeight(m.height, 10))
 }
 
@@ -366,9 +525,13 @@ func (m *Model) rebuildUserManageTable() {
 	m.userManageTable.SetColumns(userManageColumns(m.width))
 	rows := make([]table.Row, len(m.users))
 	for i, u := range m.users {
-		rows[i] = table.Row{u.Username, u.Email, u.CreatedAt.UTC().Format("2006-01-02")}
+		topic := u.Topic()
+		if topic == "" {
+			topic = "—"
+		}
+		rows[i] = table.Row{u.Username, u.Email, topic, userFlags(u), u.CreatedAt.UTC().Format("2006-01-02")}
 	}
-	m.userManageTable.SetRows(rows)
+	setRows(&m.userManageTable, rows)
 	m.userManageTable.SetHeight(tableHeight(m.height, 10))
 }
 
@@ -385,16 +548,24 @@ func (m *Model) refreshDetailContent() {
 		return
 	}
 	if m.mode == modeAlertDetail {
-		m.detailViewport.SetContent(buildAlertDetailContent(m.selectedAlert, m.width))
+		m.detailViewport.SetContent(buildAlertDetailContent(m.styles, m.selectedAlert, m.width))
 		return
 	}
 	m.detailViewport.SetContent(
-		buildIncidentDetailContent(m.selectedIncident, m.timeline, m.noteCursor, m.width))
+		buildIncidentDetailContent(m.styles, m.selectedIncident, m.timeline, m.noteCursor, m.width))
 }
 
 func (m *Model) refreshStatsContent() {
 	m.statsViewport.SetContent(
-		buildStatsContent(m.incidentStats, m.topAlerts, m.hourStats, m.dayStats, m.width))
+		buildStatsContent(m.styles, m.incidentStats, m.topAlerts, m.hourStats, m.dayStats, m.width))
+}
+
+func (m Model) statsViewportHeight() int {
+	h := m.height - 5
+	if h < 1 {
+		h = 1
+	}
+	return h
 }
 
 func (m Model) detailViewportHeight() int {
@@ -408,6 +579,106 @@ func (m Model) detailViewportHeight() int {
 	return h
 }
 
+// showTeamColumn is whether list rows need saying which team they belong to:
+// only when they can come from more than one.
+func (m Model) showTeamColumn() bool {
+	return m.activeTeamID == 0 && len(m.teams) > 1
+}
+
+// activeTeam returns the team the lists are narrowed to.
+func (m Model) activeTeam() (api.Team, bool) {
+	return m.teamByID(m.activeTeamID)
+}
+
+func (m Model) teamByID(id int64) (api.Team, bool) {
+	for _, t := range m.teams {
+		if t.ID == id {
+			return t, true
+		}
+	}
+	return api.Team{}, false
+}
+
+// scheduleTeam is the team whose schedule the Schedule section shows. That is
+// the active team; with all teams showing it is the first one the caller owns,
+// else their first, because a rota belongs to one team and there is no
+// meaningful union to display.
+func (m Model) scheduleTeam() (api.Team, bool) {
+	if t, ok := m.activeTeam(); ok {
+		return t, true
+	}
+	for _, t := range m.teams {
+		if t.Role == api.RoleOwner {
+			return t, true
+		}
+	}
+	if len(m.teams) > 0 {
+		return m.teams[0], true
+	}
+	return api.Team{}, false
+}
+
+// canEditSchedule mirrors the server: writes need a team owner or an
+// administrator. Saying so up front beats a 403 after picking a user.
+func (m Model) canEditSchedule(t api.Team) bool {
+	return m.isAdmin || t.Role == api.RoleOwner
+}
+
+// canManageUser mirrors the server's self-or-admin rule for a user's password,
+// ntfy topic and API keys.
+func (m Model) canManageUser(u api.User) bool {
+	return m.isAdmin || u.ID == m.meID
+}
+
+// resolveTeam finds a team by id or, failing that, by name.
+func resolveTeam(teams []api.Team, want string) (api.Team, bool) {
+	if id, err := strconv.ParseInt(want, 10, 64); err == nil {
+		for _, t := range teams {
+			if t.ID == id {
+				return t, true
+			}
+		}
+	}
+	for _, t := range teams {
+		if strings.EqualFold(t.Name, want) {
+			return t, true
+		}
+	}
+	return api.Team{}, false
+}
+
+// pickerUsers is who the user picker offers. Disabled accounts are never worth
+// assigning to. For the schedule it is also limited to the team's members: the
+// server answers 404 for anyone else, and shows nothing until they are known.
+func (m Model) pickerUsers() []api.User {
+	out := make([]api.User, 0, len(m.users))
+	for _, u := range m.users {
+		if u.IsDisabled() {
+			continue
+		}
+		if m.pickerTarget == pickerSchedule && !m.pickerMembers[u.ID] {
+			continue
+		}
+		out = append(out, u)
+	}
+	return out
+}
+
+// userFlags is the Users table's marker column.
+func userFlags(u api.User) string {
+	var flags []string
+	if u.IsAdmin {
+		flags = append(flags, "admin")
+	}
+	if u.IsDisabled() {
+		flags = append(flags, "disabled")
+	}
+	if len(flags) == 0 {
+		return "—"
+	}
+	return strings.Join(flags, ",")
+}
+
 // noteEvents filters a timeline down to the deletable entries, which is what
 // the [ and ] cursor walks.
 func noteEvents(timeline []api.IncidentEvent) []api.IncidentEvent {
@@ -422,44 +693,67 @@ func noteEvents(timeline []api.IncidentEvent) []api.IncidentEvent {
 
 // ── Column definitions ─────────────────────────────────────────────────────
 
-func incidentColumns(width int) []table.Column {
+// teamW is the width of the Team column shown when rows can span teams.
+const teamW = 14
+
+func incidentColumns(width int, showTeam bool) []table.Column {
 	const sevW, statusW, timeW = 9, 15, 12
 	titleW := width/2 - 10
+	if showTeam {
+		titleW -= teamW + 2
+	}
 	if titleW < 20 {
 		titleW = 20
 	}
 	// 10 = bubbles' Padding(0, 1) on each of the five cells.
 	assigneeW := width - sevW - titleW - statusW - timeW - 10
+	if showTeam {
+		assigneeW -= teamW + 2
+	}
 	if assigneeW < 8 {
 		assigneeW = 8
 	}
-	return []table.Column{
+	cols := []table.Column{
 		{Title: "Sev", Width: sevW},
 		{Title: "Incident", Width: titleW},
-		{Title: "Status", Width: statusW},
-		{Title: "Assignee", Width: assigneeW},
-		{Title: "Triggered", Width: timeW},
 	}
+	if showTeam {
+		cols = append(cols, table.Column{Title: "Team", Width: teamW})
+	}
+	return append(cols,
+		table.Column{Title: "Status", Width: statusW},
+		table.Column{Title: "Assignee", Width: assigneeW},
+		table.Column{Title: "Triggered", Width: timeW},
+	)
 }
 
-func alertColumns(width int) []table.Column {
+func alertColumns(width int, showTeam bool) []table.Column {
 	const statusW, timeW = 10, 12
 	nameW := width/2 - 14
+	if showTeam {
+		nameW -= teamW + 2
+	}
 	if nameW < 20 {
 		nameW = 20
 	}
 	// 10 = bubbles' Padding(0, 1) on each of the five cells.
 	incW := width - nameW - statusW - 2*timeW - 10
+	if showTeam {
+		incW -= teamW + 2
+	}
 	if incW < 8 {
 		incW = 8
 	}
-	return []table.Column{
+	cols := []table.Column{{Title: "Name", Width: nameW}}
-		{Title: "Name", Width: nameW},
+	if showTeam {
-		{Title: "Status", Width: statusW},
+		cols = append(cols, table.Column{Title: "Team", Width: teamW})
-		{Title: "Started", Width: timeW},
-		{Title: "Last Seen", Width: timeW},
-		{Title: "Incident", Width: incW},
 	}
+	return append(cols,
+		table.Column{Title: "Status", Width: statusW},
+		table.Column{Title: "Started", Width: timeW},
+		table.Column{Title: "Last Seen", Width: timeW},
+		table.Column{Title: "Incident", Width: incW},
+	)
 }
 
 func scheduleColumns(width int) []table.Column {
@@ -489,20 +783,25 @@ func userPickerColumns(width int) []table.Column {
 func userManageColumns(width int) []table.Column {
 	createdW := 12
 	usernameW := 25
-	emailW := width - usernameW - createdW - 8
+	topicW := 22
+	flagsW := 14
+	// 10 = bubbles' Padding(0, 1) on each of the five cells.
+	emailW := width - usernameW - topicW - flagsW - createdW - 10
 	if emailW < 15 {
 		emailW = 15
 	}
 	return []table.Column{
 		{Title: "Username", Width: usernameW},
 		{Title: "Email", Width: emailW},
+		{Title: "Ntfy Topic", Width: topicW},
+		{Title: "Flags", Width: flagsW},
 		{Title: "Created", Width: createdW},
 	}
 }
 
 // ── Row builders ───────────────────────────────────────────────────────────
 
-func incidentRows(incidents []api.Incident) []table.Row {
+func incidentRows(incidents []api.Incident, showTeam bool) []table.Row {
 	now := time.Now()
 	rows := make([]table.Row, len(incidents))
 	for i, inc := range incidents {
@@ -520,12 +819,16 @@ func incidentRows(incidents []api.Incident) []table.Row {
 		if assignee == "" {
 			assignee = "—"
 		}
+		if showTeam {
+			rows[i] = table.Row{severity, inc.Title, teamLabel(inc.TeamName), status, assignee, humanAgo(now, inc.TriggeredAt)}
+			continue
+		}
 		rows[i] = table.Row{severity, inc.Title, status, assignee, humanAgo(now, inc.TriggeredAt)}
 	}
 	return rows
 }
 
-func alertRows(alerts []api.Alert) []table.Row {
+func alertRows(alerts []api.Alert, showTeam bool) []table.Row {
 	now := time.Now()
 	rows := make([]table.Row, len(alerts))
 	for i, a := range alerts {
@@ -533,11 +836,23 @@ func alertRows(alerts []api.Alert) []table.Row {
 		if a.IncidentID != nil {
 			incident = fmt.Sprintf("#%d", *a.IncidentID)
 		}
+		if showTeam {
+			rows[i] = table.Row{a.Name, teamLabel(a.TeamName), a.Status, humanAgo(now, a.StartsAt), humanAgo(now, a.ReceivedAt), incident}
+			continue
+		}
 		rows[i] = table.Row{a.Name, a.Status, humanAgo(now, a.StartsAt), humanAgo(now, a.ReceivedAt), incident}
 	}
 	return rows
 }
 
+// teamLabel is a team name for a table cell, with a dash when the server sent none.
+func teamLabel(name string) string {
+	if name == "" {
+		return "—"
+	}
+	return name
+}
+
 func scheduleRows(days []scheduleDay) []table.Row {
 	today := time.Now().UTC().Format("2006-01-02")
 	rows := make([]table.Row, len(days))
@@ -632,19 +947,38 @@ func humanSeconds(secs *float64) string {
 
 // ── Commands ───────────────────────────────────────────────────────────────
 
+// errServerTooOld is what connecting to a server without teams looks like: the
+// server has no version endpoint, so its missing /api/teams is the tell.
+var errServerTooOld = errors.New("this server predates teams -- terdut-tui needs terdut-server v0.20 or later")
+
+// connectCmd checks the server is up, then loads the caller's teams and identity
+// with their key. /healthz is unauthenticated, so this is also the first thing
+// to notice a wrong key.
 func connectCmd(client *api.Client) tea.Cmd {
 	return func() tea.Msg {
 		if err := client.HealthCheck(); err != nil {
 			return connectErrMsg{err}
 		}
-		return connectedMsg{}
+		teams, err := client.ListTeams()
+		var se *api.StatusError
+		if errors.As(err, &se) && se.Code == http.StatusNotFound {
+			return connectErrMsg{errServerTooOld}
+		}
+		if err != nil {
+			return connectErrMsg{err}
+		}
+		me, err := client.Me()
+		if err != nil {
+			return connectErrMsg{err}
+		}
+		return connectedMsg{teams: teams, me: *me}
 	}
 }
 
-func fetchIncidentsCmd(client *api.Client, filter string) tea.Cmd {
+func fetchIncidentsCmd(client *api.Client, teamID int64, filter string) tea.Cmd {
 	return func() tea.Msg {
 		status, snoozed := incidentQuery(filter)
-		incidents, err := client.ListIncidents(status, false, snoozed, 500)
+		incidents, err := client.ListIncidents(teamID, status, false, snoozed, 500)
 		if err != nil {
 			return fetchDataErrMsg{err}
 		}
@@ -652,11 +986,11 @@ func fetchIncidentsCmd(client *api.Client, filter string) tea.Cmd {
 	}
 }
 
-func fetchArchivedIncidentsCmd(client *api.Client) tea.Cmd {
+func fetchArchivedIncidentsCmd(client *api.Client, teamID int64) tea.Cmd {
 	return func() tea.Msg {
 		// Archived incidents are all resolved, so the status filter has to be
 		// widened past the server's open-only default or nothing comes back.
-		incidents, err := client.ListIncidents(api.StatusResolved, true, false, 500)
+		incidents, err := client.ListIncidents(teamID, api.StatusResolved, true, false, 500)
 		if err != nil {
 			return fetchDataErrMsg{err}
 		}
@@ -664,13 +998,13 @@ func fetchArchivedIncidentsCmd(client *api.Client) tea.Cmd {
 	}
 }
 
-func fetchAlertsCmd(client *api.Client, filter string) tea.Cmd {
+func fetchAlertsCmd(client *api.Client, teamID int64, filter string) tea.Cmd {
 	return func() tea.Msg {
 		status, archived := filter, false
 		if filter == "archived" {
 			status, archived = "", true
 		}
-		alerts, err := client.ListAlerts(status, archived, 500)
+		alerts, err := client.ListAlerts(teamID, status, archived, 500)
 		if err != nil {
 			return fetchDataErrMsg{err}
 		}
@@ -770,13 +1104,13 @@ func deleteNoteCmd(client *api.Client, id, eventID int64) tea.Cmd {
 
 // archiveIncidentCmd archives from the list view, so it reloads the list rather
 // than a detail pane.
-func archiveIncidentCmd(client *api.Client, id int64, filter string) tea.Cmd {
+func archiveIncidentCmd(client *api.Client, id, teamID int64, filter string) tea.Cmd {
 	return func() tea.Msg {
 		if _, err := client.ArchiveIncident(id); err != nil {
 			return actionErrMsg{err}
 		}
 		status, snoozed := incidentQuery(filter)
-		incidents, err := client.ListIncidents(status, false, snoozed, 500)
+		incidents, err := client.ListIncidents(teamID, status, false, snoozed, 500)
 		if err != nil {
 			return actionErrMsg{err}
 		}
@@ -784,12 +1118,12 @@ func archiveIncidentCmd(client *api.Client, id int64, filter string) tea.Cmd {
 	}
 }
 
-func unarchiveIncidentCmd(client *api.Client, id int64) tea.Cmd {
+func unarchiveIncidentCmd(client *api.Client, id, teamID int64) tea.Cmd {
 	return func() tea.Msg {
 		if err := client.UnarchiveIncident(id); err != nil {
 			return actionErrMsg{err}
 		}
-		incidents, err := client.ListIncidents(api.StatusResolved, true, false, 500)
+		incidents, err := client.ListIncidents(teamID, api.StatusResolved, true, false, 500)
 		if err != nil {
 			return actionErrMsg{err}
 		}
@@ -825,51 +1159,73 @@ func fetchDetailStatsCmd(client *api.Client) tea.Cmd {
 	}
 }
 
-func fetchScheduleCmd(client *api.Client, from, to time.Time) tea.Cmd {
+// loadSchedule reads one team's window and everyone's on-call today, the way
+// every schedule command ends so the view reflects what the server now holds.
+func loadSchedule(client *api.Client, teamID int64, from, to time.Time) (scheduleFetchedMsg, error) {
+	entries, err := client.GetSchedule(teamID, from.Format("2006-01-02"), to.Format("2006-01-02"))
+	if err != nil {
+		return scheduleFetchedMsg{}, err
+	}
+	current, err := client.GetCurrentOnCall()
+	if err != nil {
+		return scheduleFetchedMsg{}, err
+	}
+	return scheduleFetchedMsg{entries: entries, current: current}, nil
+}
+
+func fetchScheduleCmd(client *api.Client, teamID int64, from, to time.Time) tea.Cmd {
 	return func() tea.Msg {
-		entries, err := client.GetSchedule(from.Format("2006-01-02"), to.Format("2006-01-02"))
+		msg, err := loadSchedule(client, teamID, from, to)
 		if err != nil {
 			return scheduleFetchErrMsg{err}
 		}
-		current, err := client.GetCurrentOnCall()
+		return msg
-		if err != nil {
-			return scheduleFetchErrMsg{err}
-		}
-		return scheduleFetchedMsg{entries: entries, current: current}
 	}
 }
 
-func assignScheduleCmd(client *api.Client, userID int64, dates []string, from, to time.Time) tea.Cmd {
+func assignScheduleCmd(client *api.Client, teamID, userID int64, dates []string, replace bool, from, to time.Time) tea.Cmd {
 	return func() tea.Msg {
-		if _, err := client.AssignSchedule(userID, dates); err != nil {
+		if _, err := client.AssignSchedule(teamID, userID, dates, replace); err != nil {
 			return scheduleActionErrMsg{err}
 		}
-		entries, err := client.GetSchedule(from.Format("2006-01-02"), to.Format("2006-01-02"))
+		msg, err := loadSchedule(client, teamID, from, to)
 		if err != nil {
 			return scheduleActionErrMsg{err}
 		}
-		current, err := client.GetCurrentOnCall()
+		return msg
-		if err != nil {
-			return scheduleActionErrMsg{err}
-		}
-		return scheduleFetchedMsg{entries: entries, current: current}
 	}
 }
 
-func deleteScheduleEntryCmd(client *api.Client, entryID int64, from, to time.Time) tea.Cmd {
+func deleteScheduleEntryCmd(client *api.Client, teamID, entryID int64, from, to time.Time) tea.Cmd {
 	return func() tea.Msg {
-		if err := client.DeleteScheduleEntry(entryID); err != nil {
+		if err := client.DeleteScheduleEntry(teamID, entryID); err != nil {
 			return scheduleActionErrMsg{err}
 		}
-		entries, err := client.GetSchedule(from.Format("2006-01-02"), to.Format("2006-01-02"))
+		msg, err := loadSchedule(client, teamID, from, to)
 		if err != nil {
 			return scheduleActionErrMsg{err}
 		}
-		current, err := client.GetCurrentOnCall()
+		return msg
+	}
+}
+
+// fetchPickerCmd loads what the schedule's user picker offers: everyone, and who
+// belongs to the team, since only members can be put on its rota.
+func fetchPickerCmd(client *api.Client, teamID int64) tea.Cmd {
+	return func() tea.Msg {
+		users, err := client.ListUsers()
 		if err != nil {
-			return scheduleActionErrMsg{err}
+			return userActionErrMsg{err}
 		}
-		return scheduleFetchedMsg{entries: entries, current: current}
+		members, err := client.ListTeamMembers(teamID)
+		if err != nil {
+			return userActionErrMsg{err}
+		}
+		ids := make(map[int64]bool, len(members))
+		for _, mem := range members {
+			ids[mem.UserID] = true
+		}
+		return pickerReadyMsg{users: users, members: ids}
 	}
 }
 
@@ -896,6 +1252,22 @@ func createUserCmd(client *api.Client, username, email string) tea.Cmd {
 	}
 }
 
+// setUserNotifyTargetCmd points a user's pages at a topic, or clears it when
+// topic is empty. It re-lists afterwards so the table shows what the server
+// stored rather than what was typed.
+func setUserNotifyTargetCmd(client *api.Client, userID int64, topic string) tea.Cmd {
+	return func() tea.Msg {
+		if _, err := client.SetUserNotifyTarget(userID, topic); err != nil {
+			return userActionErrMsg{err}
+		}
+		users, err := client.ListUsers()
+		if err != nil {
+			return userActionErrMsg{err}
+		}
+		return usersFetchedMsg{users: users}
+	}
+}
+
 func deleteUserCmd(client *api.Client, userID int64) tea.Cmd {
 	return func() tea.Msg {
 		if err := client.DeleteUser(userID); err != nil {
@@ -919,6 +1291,29 @@ func createAPIKeyCmd(client *api.Client, userID int64, name string) tea.Cmd {
 	}
 }
 
+func fetchMeCmd(client *api.Client) tea.Cmd {
+	return func() tea.Msg {
+		me, err := client.Me()
+		var se *api.StatusError
+		if errors.As(err, &se) && se.Code == http.StatusNotFound {
+			return userActionErrMsg{errors.New("this server has no passwords -- needs terdut-server v0.10.2 or later")}
+		}
+		if err != nil {
+			return userActionErrMsg{err}
+		}
+		return meFetchedMsg{me: *me}
+	}
+}
+
+func setPasswordCmd(client *api.Client, user api.User, password, current string) tea.Cmd {
+	return func() tea.Msg {
+		if err := client.SetPassword(user.ID, password, current); err != nil {
+			return userActionErrMsg{err}
+		}
+		return passwordSetMsg{username: user.Username}
+	}
+}
+
 func deleteAPIKeyCmd(client *api.Client, userID, keyID int64) tea.Cmd {
 	return func() tea.Msg {
 		if err := client.DeleteAPIKey(userID, keyID); err != nil {

internal/tui/model_test.go

@@ -0,0 +1,396 @@
+package tui
+
+import (
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	"github.com/charmbracelet/bubbles/table"
+)
+
+func TestNextFilter(t *testing.T) {
+	tests := []struct {
+		name    string
+		cycle   []string
+		current string
+		want    string
+	}{
+		{"advances", incidentFilters, "", api.StatusTriggered},
+		{"advances again", incidentFilters, api.StatusTriggered, api.StatusAcknowledged},
+		{"wraps back to the open queue", incidentFilters, "snoozed", ""},
+		{"alerts advance", alertFilters, "firing", "resolved"},
+		{"alerts wrap", alertFilters, "archived", "firing"},
+		{"unknown current restarts the cycle", incidentFilters, "bogus", ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := nextFilter(tt.cycle, tt.current); got != tt.want {
+				t.Errorf("expected %q, got %q", tt.want, got)
+			}
+		})
+	}
+}
+
+// "snoozed" is a pseudo-status in the filter cycle: the server has no such
+// status, it is a separate query axis.
+func TestIncidentQuery(t *testing.T) {
+	tests := []struct {
+		filter      string
+		wantStatus  string
+		wantSnoozed bool
+	}{
+		{"", "", false},
+		{api.StatusTriggered, api.StatusTriggered, false},
+		{api.StatusResolved, api.StatusResolved, false},
+		{"snoozed", "", true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.filter, func(t *testing.T) {
+			status, snoozed := incidentQuery(tt.filter)
+			if status != tt.wantStatus || snoozed != tt.wantSnoozed {
+				t.Errorf("expected (%q, %v), got (%q, %v)",
+					tt.wantStatus, tt.wantSnoozed, status, snoozed)
+			}
+		})
+	}
+}
+
+func TestFilterLabel(t *testing.T) {
+	if got := filterLabel(""); got != "open" {
+		t.Errorf("the empty filter is the open queue, got %q", got)
+	}
+	if got := filterLabel("resolved"); got != "resolved" {
+		t.Errorf("expected resolved, got %q", got)
+	}
+}
+
+func TestNoteEvents(t *testing.T) {
+	timeline := []api.IncidentEvent{
+		{Type: api.EventTriggered},
+		{Type: api.EventNote, Detail: "first"},
+		{Type: api.EventAcknowledged},
+		{Type: api.EventNote, Detail: "second"},
+	}
+	notes := noteEvents(timeline)
+	if len(notes) != 2 {
+		t.Fatalf("expected 2 notes, got %d", len(notes))
+	}
+	if notes[0].Detail != "first" || notes[1].Detail != "second" {
+		t.Errorf("notes out of order: %v", notes)
+	}
+	if len(noteEvents(nil)) != 0 {
+		t.Error("an empty timeline has no notes")
+	}
+}
+
+func TestHumanDuration(t *testing.T) {
+	tests := []struct {
+		d    time.Duration
+		want string
+	}{
+		{5 * time.Second, "moments"},
+		{90 * time.Second, "1m"},
+		{45 * time.Minute, "45m"},
+		{2 * time.Hour, "2h"},
+		{150 * time.Minute, "2h 30m"},
+		{48 * time.Hour, "2d"},
+		{50 * time.Hour, "2d 2h"},
+	}
+	for _, tt := range tests {
+		if got := humanDuration(tt.d); got != tt.want {
+			t.Errorf("humanDuration(%v) = %q, want %q", tt.d, got, tt.want)
+		}
+	}
+}
+
+func TestHumanAgo_ClampsFutureToNow(t *testing.T) {
+	now := time.Now()
+	// Server and client clocks disagree often enough that this must not render
+	// as a negative age.
+	if got := humanAgo(now, now.Add(time.Hour)); got != "moments ago" {
+		t.Errorf("expected a future timestamp to clamp, got %q", got)
+	}
+}
+
+func TestHumanUntil(t *testing.T) {
+	now := time.Now()
+	if got := humanUntil(now, now.Add(2*time.Hour)); got != "in 2h" {
+		t.Errorf("expected 'in 2h', got %q", got)
+	}
+	if got := humanUntil(now, now.Add(-time.Minute)); got != "expired" {
+		t.Errorf("a deadline in the past has expired, got %q", got)
+	}
+}
+
+// MTTA and MTTR are nil until something has been acknowledged or resolved, and
+// that has to read as "no data" rather than an instant response.
+func TestHumanSeconds(t *testing.T) {
+	if got := humanSeconds(nil); got != "—" {
+		t.Errorf("expected an em dash for no data, got %q", got)
+	}
+	secs := 150.0
+	if got := humanSeconds(&secs); got != "2m" {
+		t.Errorf("expected 2m, got %q", got)
+	}
+}
+
+func TestIncidentRows(t *testing.T) {
+	future := time.Now().Add(time.Hour)
+	rows := incidentRows([]api.Incident{
+		{Title: "DiskFull", Status: api.StatusTriggered, Severity: "critical",
+			AssignedTo: "admin", TriggeredAt: time.Now()},
+		{Title: "Unowned", Status: api.StatusTriggered, TriggeredAt: time.Now()},
+		{Title: "Quiet", Status: api.StatusTriggered, Severity: "info",
+			AssignedTo: "alice", SnoozedUntil: &future, TriggeredAt: time.Now()},
+	}, false)
+	if len(rows) != 3 {
+		t.Fatalf("expected 3 rows, got %d", len(rows))
+	}
+	if rows[0][0] != "critical" || rows[0][3] != "admin" {
+		t.Errorf("unexpected first row %v", rows[0])
+	}
+	if rows[1][0] != "—" || rows[1][3] != "—" {
+		t.Errorf("missing severity and assignee should show an em dash, got %v", rows[1])
+	}
+	// bubbles' table renders plain strings, so snooze has to be marked in text.
+	if rows[2][2] != "triggered (zzz)" {
+		t.Errorf("expected a snooze marker in the status cell, got %q", rows[2][2])
+	}
+}
+
+// Rows only carry a team cell when the columns have a Team header for it, or
+// every cell after it would sit under the wrong heading.
+func TestRows_TeamCellMatchesTeamColumn(t *testing.T) {
+	now := time.Now()
+	incRows := incidentRows([]api.Incident{{Title: "DiskFull", TeamName: "Ops", Status: api.StatusTriggered, TriggeredAt: now}}, true)
+	if got, want := len(incRows[0]), len(incidentColumns(120, true)); got != want {
+		t.Errorf("incident row has %d cells for %d columns", got, want)
+	}
+	if incRows[0][2] != "Ops" {
+		t.Errorf("expected the team after the title, got %v", incRows[0])
+	}
+	alRows := alertRows([]api.Alert{{Name: "DiskFull", StartsAt: now, ReceivedAt: now}}, true)
+	if got, want := len(alRows[0]), len(alertColumns(120, true)); got != want {
+		t.Errorf("alert row has %d cells for %d columns", got, want)
+	}
+	if alRows[0][1] != "—" {
+		t.Errorf("a missing team name should show an em dash, got %v", alRows[0])
+	}
+	if got, want := len(incidentRows([]api.Incident{{}}, false)[0]), len(incidentColumns(120, false)); got != want {
+		t.Errorf("incident row has %d cells for %d columns without teams", got, want)
+	}
+}
+
+func TestAlertRows_ShowIncidentLink(t *testing.T) {
+	id := int64(7)
+	rows := alertRows([]api.Alert{
+		{Name: "DiskFull", Status: "firing", IncidentID: &id},
+		{Name: "Orphan", Status: "resolved"},
+	}, false)
+	if rows[0][4] != "#7" {
+		t.Errorf("expected #7, got %q", rows[0][4])
+	}
+	if rows[1][4] != "—" {
+		t.Errorf("an alert with no incident shows an em dash, got %q", rows[1][4])
+	}
+}
+
+// A user with no ntfy topic gets no pages of their own — the row has to say so
+// rather than leaving a blank that reads as "not loaded yet".
+func TestUserManageRows_ShowMissingTopic(t *testing.T) {
+	topic := "terdut-niklas"
+	empty := ""
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	m.users = []api.User{
+		{ID: 1, Username: "niklas", NtfyTopic: &topic},
+		{ID: 2, Username: "alex"},
+		// The server stores a blank topic as NULL, but a stale client or an older
+		// server can still hand one back; it means the same thing.
+		{ID: 3, Username: "sam", NtfyTopic: &empty},
+	}
+	m.rebuildUserManageTable()
+
+	rows := m.userManageTable.Rows()
+	if rows[0][2] != "terdut-niklas" {
+		t.Errorf("expected the topic in the row, got %q", rows[0][2])
+	}
+	if rows[1][2] != "—" || rows[2][2] != "—" {
+		t.Errorf("expected an em dash for nil and empty topics, got %q and %q",
+			rows[1][2], rows[2][2])
+	}
+}
+
+// A previous release overflowed the terminal by two columns because the padding
+// budget was wrong. Columns plus bubbles' per-cell padding must land exactly on
+// the window width.
+func TestColumnWidthsFitTheTerminal(t *testing.T) {
+	for _, width := range []int{100, 110, 140, 200} {
+		// Five cells each, or six once a Team column is added. userManageColumns
+		// is five cells as well: username, email, topic, flags, created.
+		for name, tc := range map[string]struct {
+			cols  []table.Column
+			cells int
+		}{
+			"incident":           {incidentColumns(width, false), 5},
+			"incident with team": {incidentColumns(width, true), 6},
+			"alert":              {alertColumns(width, false), 5},
+			"alert with team":    {alertColumns(width, true), 6},
+			"user":               {userManageColumns(width), 5},
+		} {
+			sum := 0
+			for _, w := range widths(tc.cols) {
+				sum += w
+			}
+			padding := 2 * tc.cells // bubbles applies Padding(0, 1) to each cell
+			if len(tc.cols) != tc.cells {
+				t.Errorf("%s has %d columns, expected %d", name, len(tc.cols), tc.cells)
+			}
+			if sum+padding != width {
+				t.Errorf("%s columns at width %d sum to %d+%d = %d",
+					name, width, sum, padding, sum+padding)
+			}
+		}
+	}
+}
+
+// Narrow terminals fall back to minimum widths, which legitimately overflow;
+// what must not happen is a negative or zero column.
+func TestColumnWidthsStayPositiveWhenNarrow(t *testing.T) {
+	for _, width := range []int{20, 40, 60} {
+		cols := append(widths(incidentColumns(width, true)), widths(alertColumns(width, true))...)
+		cols = append(cols, widths(userManageColumns(width))...)
+		for _, w := range cols {
+			if w < 1 {
+				t.Errorf("width %d produced a non-positive column %d", width, w)
+			}
+		}
+	}
+}
+
+func widths(cols []table.Column) []int {
+	out := make([]int, len(cols))
+	for i, c := range cols {
+		out[i] = c.Width
+	}
+	return out
+}
+
+func TestTableHeight_NeverGoesBelowOne(t *testing.T) {
+	if got := tableHeight(3, 10); got != 1 {
+		t.Errorf("expected a floor of 1, got %d", got)
+	}
+	if got := tableHeight(40, 8); got != 32 {
+		t.Errorf("expected 32, got %d", got)
+	}
+}
+
+func TestBuildScheduleDays(t *testing.T) {
+	monday := time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
+	days := buildScheduleDays(monday, []api.ScheduleEntry{
+		{Date: "2026-07-29", Username: "alice"},
+	})
+	if len(days) != 7 {
+		t.Fatalf("expected a 7-day window, got %d", len(days))
+	}
+	if days[2].entry == nil || days[2].entry.Username != "alice" {
+		t.Errorf("expected alice on the third day, got %+v", days[2].entry)
+	}
+	if days[0].entry != nil {
+		t.Error("expected unassigned days to have no entry")
+	}
+}
+
+// ── Schedule reassignment ─────────────────────────────────────────────────
+
+// scheduledWeek builds a model showing the week of 2026-07-27 with the given
+// entries already on the rota.
+func scheduledWeek(entries []api.ScheduleEntry) Model {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	m.connected = true
+	m.teams = []api.Team{{ID: 1, Name: "Ops", Role: api.RoleOwner}}
+	m.activeSection = sectionSchedule
+	m.scheduleWindow = time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
+	m.scheduleEntries = entries
+	m.scheduleDays = buildScheduleDays(m.scheduleWindow, entries)
+	m.rebuildScheduleTable()
+	return m
+}
+
+func TestScheduleConflicts(t *testing.T) {
+	m := scheduledWeek([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+		{ID: 2, Date: "2026-07-28", UserID: 3, Username: "sam"},
+		{ID: 3, Date: "2026-07-29", UserID: 2, Username: "alex"},
+	})
+	week := []string{"2026-07-27", "2026-07-28", "2026-07-29", "2026-07-30"}
+
+	// Assigning alex: the days niklas and sam hold are conflicts, the day alex
+	// already holds is not, and the free day is not.
+	taken, holders := m.scheduleConflicts(week, 2)
+	if len(taken) != 2 || taken[0] != "2026-07-27" || taken[1] != "2026-07-28" {
+		t.Errorf("expected the two other people's days, got %v", taken)
+	}
+	if len(holders) != 2 || holders[0] != "niklas" || holders[1] != "sam" {
+		t.Errorf("expected both holders named once, got %v", holders)
+	}
+}
+
+// Reassigning somebody to a day they already hold takes nothing from anyone, so
+// it must not raise a prompt — but it still needs replace, because the server
+// rejects any date that already exists.
+func TestScheduleConflicts_OwnDayIsNotAConflict(t *testing.T) {
+	m := scheduledWeek([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 2, Username: "alex"},
+	})
+	dates := []string{"2026-07-27"}
+
+	if taken, _ := m.scheduleConflicts(dates, 2); len(taken) != 0 {
+		t.Errorf("expected no conflict on the user's own day, got %v", taken)
+	}
+	if !m.scheduleOccupied(dates) {
+		t.Error("expected the day to still count as occupied, so replace is sent")
+	}
+}
+
+func TestScheduleOccupied_FreeDays(t *testing.T) {
+	m := scheduledWeek(nil)
+	if m.scheduleOccupied([]string{"2026-07-27", "2026-07-28"}) {
+		t.Error("expected an empty rota to need no replace")
+	}
+}
+
+func TestDayCount(t *testing.T) {
+	tests := []struct {
+		taken, total int
+		want         string
+	}{
+		{1, 1, "This day is"},
+		{7, 7, "All 7 days are"},
+		{3, 7, "3 of 7 days are"},
+	}
+	for _, tt := range tests {
+		if got := dayCount(tt.taken, tt.total); got != tt.want {
+			t.Errorf("dayCount(%d, %d) = %q, want %q", tt.taken, tt.total, got, tt.want)
+		}
+	}
+}
+
+func TestJoinNames(t *testing.T) {
+	tests := []struct {
+		names []string
+		want  string
+	}{
+		{nil, "somebody else"},
+		{[]string{"niklas"}, "niklas"},
+		{[]string{"niklas", "alex"}, "niklas and alex"},
+		{[]string{"niklas", "alex", "sam"}, "niklas, alex and sam"},
+	}
+	for _, tt := range tests {
+		if got := joinNames(tt.names); got != tt.want {
+			t.Errorf("joinNames(%v) = %q, want %q", tt.names, got, tt.want)
+		}
+	}
+}

internal/tui/styles.go

@@ -3,97 +3,173 @@ package tui
 import (
 	"strings"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	"github.com/charmbracelet/bubbles/help"
+	"github.com/charmbracelet/bubbles/table"
+	"github.com/charmbracelet/bubbles/textinput"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
-var (
+// Styles is every style the views draw with, built once from a theme and held
-	colorPrimary  = lipgloss.Color("69")  // blue
+// on the Model. Nothing here reads a colour literal: the theme is the only
-	colorMuted    = lipgloss.Color("240") // gray
+// place a colour is named.
-	colorFiring   = lipgloss.Color("196") // red
+type Styles struct {
-	colorResolved = lipgloss.Color("70")  // green
+	Header      lipgloss.Style
-	colorAccent   = lipgloss.Color("214") // orange
+	TabActive   lipgloss.Style
+	TabInactive lipgloss.Style
+	Footer      lipgloss.Style
+	Status      lipgloss.Style
 
-	colorSevCritical = lipgloss.Color("196") // red
+	Error     lipgloss.Style
-	colorSevError    = lipgloss.Color("202") // dark orange
+	Firing    lipgloss.Style
-	colorSevWarning  = lipgloss.Color("214") // orange
+	Resolved  lipgloss.Style
-	colorSevInfo     = lipgloss.Color("39")  // cyan
+	Muted     lipgloss.Style
-
+	Accent    lipgloss.Style
-	styleHeader = lipgloss.NewStyle().
+	AlertName lipgloss.Style
-			Bold(true).
+	Bold      lipgloss.Style
-			Foreground(colorPrimary).
+	Selected  lipgloss.Style
-			Padding(0, 1)
-
-	styleTabActive = lipgloss.NewStyle().
-			Bold(true).
-			Foreground(lipgloss.Color("0")).
-			Background(colorPrimary).
-			Padding(0, 2)
-
-	styleTabInactive = lipgloss.NewStyle().
-				Foreground(colorMuted).
-				Padding(0, 2)
-
-	styleFooter = lipgloss.NewStyle().
-			Foreground(colorMuted)
-
-	styleStatus = lipgloss.NewStyle().
-			Foreground(colorAccent).
-			Bold(true)
-
-	styleError = lipgloss.NewStyle().
-			Foreground(colorFiring).
-			Bold(true)
-
-	styleFiring    = lipgloss.NewStyle().Foreground(colorFiring).Bold(true)
-	styleResolved  = lipgloss.NewStyle().Foreground(colorResolved)
-	styleMuted     = lipgloss.NewStyle().Foreground(colorMuted)
-	styleAlertName = lipgloss.NewStyle().Bold(true)
-	styleBold      = lipgloss.NewStyle().Bold(true)
-	styleSelected  = lipgloss.NewStyle().Foreground(colorPrimary).Bold(true)
-	styleAccent    = lipgloss.NewStyle().Foreground(colorAccent)
 
 	// Incident status. Triggered is unclaimed work and reads as loudly as a
 	// firing alert; acknowledged means somebody has it.
-	styleTriggered    = lipgloss.NewStyle().Foreground(colorFiring).Bold(true)
+	Triggered    lipgloss.Style
-	styleAcknowledged = lipgloss.NewStyle().Foreground(colorAccent).Bold(true)
+	Acknowledged lipgloss.Style
-	styleSnoozed      = lipgloss.NewStyle().Foreground(colorMuted).Italic(true)
+	Snoozed      lipgloss.Style
 
 	// Severity, over the conventional Alertmanager label values.
-	styleSevCritical = lipgloss.NewStyle().Foreground(colorSevCritical).Bold(true)
+	SevCritical lipgloss.Style
-	styleSevError    = lipgloss.NewStyle().Foreground(colorSevError).Bold(true)
+	SevError    lipgloss.Style
-	styleSevWarning  = lipgloss.NewStyle().Foreground(colorSevWarning)
+	SevWarning  lipgloss.Style
-	styleSevInfo     = lipgloss.NewStyle().Foreground(colorSevInfo)
+	SevInfo     lipgloss.Style
-)
 
-// severityStyle picks the style for a severity label, falling back to muted for
+	theme theme.Theme
+}
+
+func newStyles(t theme.Theme) Styles {
+	return Styles{
+		Header: lipgloss.NewStyle().
+			Bold(true).
+			Foreground(t.Primary).
+			Padding(0, 1),
+
+		TabActive: lipgloss.NewStyle().
+			Bold(true).
+			Foreground(t.OnPrimary).
+			Background(t.Primary).
+			Padding(0, 2),
+
+		TabInactive: lipgloss.NewStyle().
+			Foreground(t.Muted).
+			Padding(0, 2),
+
+		Footer: lipgloss.NewStyle().Foreground(t.Muted),
+
+		Status: lipgloss.NewStyle().
+			Foreground(t.Accent).
+			Bold(true),
+
+		Error: lipgloss.NewStyle().
+			Foreground(t.Error).
+			Bold(true),
+
+		Firing:    lipgloss.NewStyle().Foreground(t.Firing).Bold(true),
+		Resolved:  lipgloss.NewStyle().Foreground(t.Resolved),
+		Muted:     lipgloss.NewStyle().Foreground(t.Muted),
+		Accent:    lipgloss.NewStyle().Foreground(t.Accent),
+		AlertName: lipgloss.NewStyle().Foreground(t.Text).Bold(true),
+		Bold:      lipgloss.NewStyle().Foreground(t.Text).Bold(true),
+		Selected:  lipgloss.NewStyle().Foreground(t.Primary).Bold(true),
+
+		Triggered:    lipgloss.NewStyle().Foreground(t.Firing).Bold(true),
+		Acknowledged: lipgloss.NewStyle().Foreground(t.Accent).Bold(true),
+		Snoozed:      lipgloss.NewStyle().Foreground(t.Muted).Italic(true),
+
+		SevCritical: lipgloss.NewStyle().Foreground(t.SevCritical).Bold(true),
+		SevError:    lipgloss.NewStyle().Foreground(t.SevError).Bold(true),
+		SevWarning:  lipgloss.NewStyle().Foreground(t.SevWarning),
+		SevInfo:     lipgloss.NewStyle().Foreground(t.SevInfo),
+
+		theme: t,
+	}
+}
+
+// Severity picks the style for a severity label, falling back to muted for
 // values this client does not recognise rather than dropping them.
-func severityStyle(severity string) lipgloss.Style {
+func (s Styles) Severity(severity string) lipgloss.Style {
 	switch strings.ToLower(severity) {
 	case "critical":
-		return styleSevCritical
+		return s.SevCritical
 	case "error":
-		return styleSevError
+		return s.SevError
 	case "warning":
-		return styleSevWarning
+		return s.SevWarning
 	case "info":
-		return styleSevInfo
+		return s.SevInfo
 	default:
-		return styleMuted
+		return s.Muted
 	}
 }
 
-// incidentStatusStyle picks the style for an incident status, falling back to
+// IncidentStatus picks the style for an incident status, falling back to muted
-// muted for statuses added after this client was built.
+// for statuses added after this client was built.
-func incidentStatusStyle(status string) lipgloss.Style {
+func (s Styles) IncidentStatus(status string) lipgloss.Style {
 	switch status {
 	case api.StatusTriggered:
-		return styleTriggered
+		return s.Triggered
 	case api.StatusAcknowledged:
-		return styleAcknowledged
+		return s.Acknowledged
 	case api.StatusResolved:
-		return styleResolved
+		return s.Resolved
 	default:
-		return styleMuted
+		return s.Muted
 	}
 }
+
+// ── Embedded bubbles components ────────────────────────────────────────────
+//
+// Each ships its own hardcoded palette, so a theme that stopped at this
+// package's own styles would leave a pink selected row and grey help text
+// behind. These three restyle them from the same tokens.
+
+// Table styles the six tables. Padding comes from the bubbles defaults; only
+// the colours are ours.
+func (s Styles) Table() table.Styles {
+	ts := table.DefaultStyles()
+	ts.Header = ts.Header.Foreground(s.theme.Muted).Bold(true)
+	// Cell deliberately keeps no foreground: bubbles renders each cell before
+	// wrapping the whole row in Selected, so a colour here would emit a reset
+	// mid-row and cut the selection highlight short.
+	ts.Selected = ts.Selected.
+		Foreground(s.theme.OnPrimary).
+		Background(s.theme.Primary).
+		Bold(true)
+	return ts
+}
+
+// Help styles the key hints in the footer.
+func (s Styles) Help() help.Styles {
+	key := lipgloss.NewStyle().Foreground(s.theme.Text)
+	desc := lipgloss.NewStyle().Foreground(s.theme.Muted)
+	sep := lipgloss.NewStyle().Foreground(s.theme.Muted)
+
+	return help.Styles{
+		Ellipsis:       sep,
+		ShortKey:       key,
+		ShortDesc:      desc,
+		ShortSeparator: sep,
+		FullKey:        key,
+		FullDesc:       desc,
+		FullSeparator:  sep,
+	}
+}
+
+// Input styles a text input and returns it, so NewModel can wrap each one as
+// it is built.
+func (s Styles) Input(ti textinput.Model) textinput.Model {
+	ti.PromptStyle = lipgloss.NewStyle().Foreground(s.theme.Primary)
+	ti.TextStyle = lipgloss.NewStyle().Foreground(s.theme.Text)
+	ti.PlaceholderStyle = lipgloss.NewStyle().Foreground(s.theme.Muted)
+	ti.CompletionStyle = lipgloss.NewStyle().Foreground(s.theme.Muted)
+	ti.Cursor.Style = lipgloss.NewStyle().Foreground(s.theme.Primary)
+	return ti
+}

internal/tui/styles_test.go

@@ -0,0 +1,131 @@
+package tui
+
+import (
+	"testing"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	"github.com/charmbracelet/bubbles/textinput"
+	"github.com/charmbracelet/lipgloss"
+)
+
+// Assertions here read the colours off the styles rather than off rendered
+// output: under `go test` stdout is not a TTY, so lipgloss strips every escape
+// sequence and rendered strings would all compare equal.
+
+func wantFg(t *testing.T, s lipgloss.Style, want lipgloss.Color, what string) {
+	t.Helper()
+	if got := s.GetForeground(); got != want {
+		t.Errorf("%s foreground = %v, want %v", what, got, want)
+	}
+}
+
+func TestStyles_TokensReachTheStyles(t *testing.T) {
+	th := theme.GruvboxDark
+	s := newStyles(th)
+
+	wantFg(t, s.Header, th.Primary, "header")
+	wantFg(t, s.Firing, th.Firing, "firing")
+	wantFg(t, s.Resolved, th.Resolved, "resolved")
+	wantFg(t, s.Muted, th.Muted, "muted")
+	wantFg(t, s.Status, th.Accent, "status")
+	wantFg(t, s.Error, th.Error, "error")
+	wantFg(t, s.SevWarning, th.SevWarning, "sev warning")
+
+	// The two inverted spots need the pair, not just a foreground.
+	wantFg(t, s.TabActive, th.OnPrimary, "active tab")
+	if got := s.TabActive.GetBackground(); got != th.Primary {
+		t.Errorf("active tab background = %v, want %v", got, th.Primary)
+	}
+
+	// Attributes the old package-level styles carried must survive.
+	if !s.Firing.GetBold() {
+		t.Error("firing lost its bold")
+	}
+	if !s.Snoozed.GetItalic() {
+		t.Error("snoozed lost its italic")
+	}
+	if top, right, bottom, left := s.TabActive.GetPadding(); top != 0 || right != 2 || bottom != 0 || left != 2 {
+		t.Errorf("active tab padding = %d %d %d %d, want 0 2 0 2", top, right, bottom, left)
+	}
+}
+
+func TestStyles_EachBuiltinIsFullyPopulated(t *testing.T) {
+	for _, th := range []theme.Theme{theme.GruvboxDark, theme.GruvboxLight} {
+		s := newStyles(th)
+		for what, style := range map[string]lipgloss.Style{
+			"header": s.Header, "tab inactive": s.TabInactive, "footer": s.Footer,
+			"status": s.Status, "error": s.Error, "firing": s.Firing,
+			"resolved": s.Resolved, "muted": s.Muted, "accent": s.Accent,
+			"alert name": s.AlertName, "bold": s.Bold, "selected": s.Selected,
+			"triggered": s.Triggered, "acknowledged": s.Acknowledged, "snoozed": s.Snoozed,
+			"sev critical": s.SevCritical, "sev error": s.SevError,
+			"sev warning": s.SevWarning, "sev info": s.SevInfo,
+		} {
+			if style.GetForeground() == (lipgloss.NoColor{}) {
+				t.Errorf("%s: %s has no foreground", th.Name, what)
+			}
+		}
+	}
+}
+
+func TestStyles_SeverityFallsBackToMuted(t *testing.T) {
+	s := newStyles(theme.GruvboxDark)
+
+	for _, sev := range []string{"critical", "CRITICAL", "error", "warning", "info"} {
+		if s.Severity(sev).GetForeground() == s.Muted.GetForeground() {
+			t.Errorf("severity %q should have its own colour", sev)
+		}
+	}
+	for _, sev := range []string{"", "page", "unknown"} {
+		if s.Severity(sev).GetForeground() != s.Muted.GetForeground() {
+			t.Errorf("severity %q should fall back to muted", sev)
+		}
+	}
+}
+
+func TestStyles_IncidentStatusFallsBackToMuted(t *testing.T) {
+	s := newStyles(theme.GruvboxDark)
+
+	for _, status := range []string{api.StatusTriggered, api.StatusAcknowledged, api.StatusResolved} {
+		if s.IncidentStatus(status).GetForeground() == s.Muted.GetForeground() {
+			t.Errorf("status %q should have its own colour", status)
+		}
+	}
+	if s.IncidentStatus("invented-later").GetForeground() != s.Muted.GetForeground() {
+		t.Error("an unknown status should fall back to muted")
+	}
+}
+
+// The bubbles components ship their own palettes — a pink selected row, grey
+// help text, a 240 placeholder. These check we replaced them.
+func TestStyles_BubblesComponentsFollowTheTheme(t *testing.T) {
+	th := theme.GruvboxDark
+	s := newStyles(th)
+
+	ts := s.Table()
+	wantFg(t, ts.Selected, th.OnPrimary, "table selection")
+	if got := ts.Selected.GetBackground(); got != th.Primary {
+		t.Errorf("table selection background = %v, want %v", got, th.Primary)
+	}
+	wantFg(t, ts.Header, th.Muted, "table header")
+	if _, right, _, left := ts.Cell.GetPadding(); right != 1 || left != 1 {
+		t.Error("table cell padding was lost")
+	}
+	// A foreground on Cell would emit a reset mid-row and truncate the
+	// selection highlight, so it must stay unset.
+	if ts.Cell.GetForeground() != (lipgloss.NoColor{}) {
+		t.Error("table cells must not carry a foreground")
+	}
+
+	h := s.Help()
+	wantFg(t, h.ShortKey, th.Text, "help key")
+	wantFg(t, h.ShortDesc, th.Muted, "help description")
+	wantFg(t, h.FullSeparator, th.Muted, "help separator")
+
+	in := s.Input(textinput.New())
+	wantFg(t, in.PlaceholderStyle, th.Muted, "input placeholder")
+	wantFg(t, in.TextStyle, th.Text, "input text")
+	wantFg(t, in.PromptStyle, th.Primary, "input prompt")
+	wantFg(t, in.Cursor.Style, th.Primary, "input cursor")
+}

internal/tui/update.go

@@ -1,13 +1,15 @@
 package tui
 
 import (
+	"fmt"
+	"slices"
 	"strconv"
 	"strings"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"github.com/atotto/clipboard"
 	"github.com/charmbracelet/bubbles/viewport"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
@@ -24,7 +26,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.detailViewport.Width = m.width
 		m.detailViewport.Height = m.detailViewportHeight()
 		m.statsViewport.Width = m.width
-		m.statsViewport.Height = m.height - 5
+		m.statsViewport.Height = m.statsViewportHeight()
 		m.refreshDetailContent()
 		m.refreshStatsContent()
 		return m, nil
@@ -32,12 +34,29 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	// ── Dashboard messages ────────────────────────────────────────────────
 
 	case connectedMsg:
+		firstConnect := len(m.teams) == 0
 		m.connected = true
 		m.err = nil
+		m.teams = msg.teams
+		m.meID = msg.me.User.ID
+		m.isAdmin = msg.me.User.IsAdmin
+		var statusCmd tea.Cmd
+		if firstConnect && m.activeTeamID == 0 && m.defaultTeam != "" {
+			if t, ok := resolveTeam(m.teams, m.defaultTeam); ok {
+				m.activeTeamID = t.ID
+			} else {
+				m.statusMsg = fmt.Sprintf("team %q not found -- showing all teams", m.defaultTeam)
+				statusCmd = clearStatusCmd()
+			}
+		}
+		m.rebuildIncidentTable()
+		m.rebuildTable()
+		m.rebuildArchivedTable()
 		return m, tea.Batch(
 			tickCmd(m.refreshInterval),
-			fetchIncidentsCmd(m.client, m.incidentFilter),
+			fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter),
 			fetchStatsCmd(m.client),
+			statusCmd,
 		)
 
 	case connectErrMsg:
@@ -118,13 +137,16 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.hourStats = msg.byHour
 		m.dayStats = msg.byDay
 		m.statsLoading = false
+		m.statsLoaded = true
 		m.refreshStatsContent()
 		return m, nil
 
 	case detailStatsErrMsg:
 		m.statsLoading = false
+		// Mark it loaded even on failure, so tabbing back in does not re-fire the
+		// request every time. The tick and r still retry.
+		m.statsLoaded = true
 		m.statusMsg = "stats error: " + msg.err.Error()
-		m.mode = modeDashboard
 		return m, clearStatusCmd()
 
 	// ── Schedule messages ─────────────────────────────────────────────────
@@ -154,6 +176,17 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.rebuildUserManageTable()
 		return m, nil
 
+	case pickerReadyMsg:
+		if m.mode != modeUserPicker {
+			return m, nil // the picker was closed before the lookup came back
+		}
+		m.users = msg.users
+		m.pickerMembers = msg.members
+		m.usersLoading = false
+		m.rebuildUserPickerTable()
+		m.rebuildUserManageTable()
+		return m, nil
+
 	case apiKeyCreatedMsg:
 		m.revealedAPIKey = msg.key
 		m.mode = modeAPIKeyReveal
@@ -164,8 +197,27 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.mode = modeDashboard
 		return m, clearStatusCmd()
 
+	case meFetchedMsg:
+		if m.mode != modePasswordSet {
+			return m, nil // the form was closed before the lookup came back
+		}
+		m.pwLoading = false
+		m.pwNeedCurrent = msg.me.User.ID == m.selectedUser.ID && msg.me.HasPassword
+		m.pwFocus = pwNew
+		if m.pwNeedCurrent {
+			m.pwFocus = pwCurrent
+		}
+		m.pwInputs[m.pwFocus].Focus()
+		return m, nil
+
+	case passwordSetMsg:
+		m.statusMsg = "password set for " + msg.username + " -- their other web sessions were signed out"
+		return m, clearStatusCmd()
+
 	case userActionErrMsg:
 		m.usersLoading = false
+		m.pwLoading = false
+		m.blurPasswordForm()
 		m.statusMsg = "error: " + msg.err.Error()
 		m.mode = modeDashboard
 		return m, clearStatusCmd()
@@ -202,19 +254,32 @@ func (m Model) refreshActiveSection() tea.Cmd {
 
 	switch m.activeSection {
 	case sectionIncidents:
-		return tea.Batch(fetchIncidentsCmd(m.client, m.incidentFilter), fetchStatsCmd(m.client))
+		return tea.Batch(fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter), fetchStatsCmd(m.client))
 	case sectionAlerts:
-		return tea.Batch(fetchAlertsCmd(m.client, m.alertFilter), fetchStatsCmd(m.client))
+		return tea.Batch(fetchAlertsCmd(m.client, m.activeTeamID, m.alertFilter), fetchStatsCmd(m.client))
+	case sectionStats:
+		// Both: fetchStatsCmd feeds the Incident Response block, the other the charts.
+		return tea.Batch(fetchStatsCmd(m.client), fetchDetailStatsCmd(m.client))
 	case sectionArchived:
-		return fetchArchivedIncidentsCmd(m.client)
+		return fetchArchivedIncidentsCmd(m.client, m.activeTeamID)
 	case sectionSchedule:
-		return fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+		return m.fetchScheduleWindowCmd()
 	case sectionUsers:
 		return fetchUsersCmd(m.client)
 	}
 	return nil
 }
 
+// fetchScheduleWindowCmd reloads the schedule window for the schedule's team, or
+// does nothing when the caller belongs to none.
+func (m Model) fetchScheduleWindowCmd() tea.Cmd {
+	team, ok := m.scheduleTeam()
+	if !ok {
+		return nil
+	}
+	return fetchScheduleCmd(m.client, team.ID, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+}
+
 // routeKey passes the key to the active component then to our handler.
 func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	switch m.mode {
@@ -240,12 +305,6 @@ func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m2, ourCmd := m.handleKey(msg)
 		return m2, tea.Batch(inputCmd, ourCmd)
 
-	case modeStats:
-		var vpCmd tea.Cmd
-		m.statsViewport, vpCmd = m.statsViewport.Update(msg)
-		m2, ourCmd := m.handleKey(msg)
-		return m2, tea.Batch(vpCmd, ourCmd)
-
 	case modeUserPicker:
 		var tableCmd tea.Cmd
 		m.userPickerTable, tableCmd = m.userPickerTable.Update(msg)
@@ -258,6 +317,12 @@ func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m2, ourCmd := m.handleKey(msg)
 		return m2, tea.Batch(inputCmd, ourCmd)
 
+	case modeUserNotifyEdit:
+		var inputCmd tea.Cmd
+		m.ntfyTopicInput, inputCmd = m.ntfyTopicInput.Update(msg)
+		m2, ourCmd := m.handleKey(msg)
+		return m2, tea.Batch(inputCmd, ourCmd)
+
 	case modeAPIKeyCreate:
 		var inputCmd tea.Cmd
 		m.apiKeyNameInput, inputCmd = m.apiKeyNameInput.Update(msg)
@@ -273,6 +338,14 @@ func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	case modeAPIKeyMenu, modeAPIKeyReveal:
 		return m.handleKey(msg)
 
+	case modePasswordSet:
+		var inputCmd tea.Cmd
+		if !m.pwLoading {
+			m.pwInputs[m.pwFocus], inputCmd = m.pwInputs[m.pwFocus].Update(msg)
+		}
+		m2, ourCmd := m.handleKey(msg)
+		return m2, tea.Batch(inputCmd, ourCmd)
+
 	default: // modeDashboard
 		if m.connected {
 			switch m.activeSection {
@@ -286,6 +359,11 @@ func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 				m.alertTable, tableCmd = m.alertTable.Update(msg)
 				m2, ourCmd := m.handleKey(msg)
 				return m2, tea.Batch(tableCmd, ourCmd)
+			case sectionStats:
+				var vpCmd tea.Cmd
+				m.statsViewport, vpCmd = m.statsViewport.Update(msg)
+				m2, ourCmd := m.handleKey(msg)
+				return m2, tea.Batch(vpCmd, ourCmd)
 			case sectionArchived:
 				var tableCmd tea.Cmd
 				m.archivedTable, tableCmd = m.archivedTable.Update(msg)
@@ -319,14 +397,16 @@ func (m Model) handleKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		return m.handleSnoozeKey(msg)
 	case modeConfirm:
 		return m.handleConfirmKey(msg)
-	case modeStats:
-		return m.handleStatsKey(msg)
 	case modeUserPicker:
 		return m.handleUserPickerKey(msg)
 	case modeUserCreate:
 		return m.handleUserCreateKey(msg)
+	case modeUserNotifyEdit:
+		return m.handleUserNotifyEditKey(msg)
 	case modeAPIKeyMenu:
 		return m.handleAPIKeyMenuKey(msg)
+	case modePasswordSet:
+		return m.handlePasswordKey(msg)
 	case modeAPIKeyCreate:
 		return m.handleAPIKeyCreateKey(msg)
 	case modeAPIKeyReveal:
@@ -368,14 +448,20 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		case sectionIncidents:
 			m.incidentFilter = nextFilter(incidentFilters, m.incidentFilter)
 			m.loading = true
-			return m, fetchIncidentsCmd(m.client, m.incidentFilter)
+			return m, fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter)
 		case sectionAlerts:
 			m.alertFilter = nextFilter(alertFilters, m.alertFilter)
 			m.loading = true
-			return m, fetchAlertsCmd(m.client, m.alertFilter)
+			return m, fetchAlertsCmd(m.client, m.activeTeamID, m.alertFilter)
 		}
 		return m, nil
 
+	case "T":
+		if !m.connected || len(m.teams) == 0 {
+			return m, nil
+		}
+		return m.switchTeam()
+
 	case "enter":
 		switch m.activeSection {
 		case sectionIncidents:
@@ -408,14 +494,14 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 				m.statusMsg = "resolve the incident before archiving it"
 				return m, clearStatusCmd()
 			}
-			return m, archiveIncidentCmd(m.client, inc.ID, m.incidentFilter)
+			return m, archiveIncidentCmd(m.client, inc.ID, m.activeTeamID, m.incidentFilter)
 		case sectionArchived:
 			i := m.archivedTable.Cursor()
 			if i < 0 || i >= len(m.archivedIncidents) {
 				return m, nil
 			}
 			m.archivedLoading = true
-			return m, unarchiveIncidentCmd(m.client, m.archivedIncidents[i].ID)
+			return m, unarchiveIncidentCmd(m.client, m.archivedIncidents[i].ID, m.activeTeamID)
 		}
 		return m, nil
 
@@ -423,16 +509,18 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	case "left", "h":
 		if m.activeSection == sectionSchedule {
 			m.scheduleWindow = m.scheduleWindow.AddDate(0, 0, -7)
-			m.scheduleLoading = true
+			cmd := m.fetchScheduleWindowCmd()
-			return m, fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+			m.scheduleLoading = cmd != nil
+			return m, cmd
 		}
 		return m, nil
 
 	case "right", "l":
 		if m.activeSection == sectionSchedule {
 			m.scheduleWindow = m.scheduleWindow.AddDate(0, 0, 7)
-			m.scheduleLoading = true
+			cmd := m.fetchScheduleWindowCmd()
-			return m, fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+			m.scheduleLoading = cmd != nil
+			return m, cmd
 		}
 		return m, nil
 
@@ -440,6 +528,9 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		if m.activeSection != sectionSchedule || !m.connected {
 			return m, nil
 		}
+		if !m.checkScheduleEditable() {
+			return m, clearStatusCmd()
+		}
 		m.pickerAssignWeek = false
 		return m.openUserPicker(pickerSchedule)
 
@@ -447,6 +538,9 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		if m.activeSection != sectionSchedule || !m.connected {
 			return m, nil
 		}
+		if !m.checkScheduleEditable() {
+			return m, clearStatusCmd()
+		}
 		m.pickerAssignWeek = true
 		return m.openUserPicker(pickerSchedule)
 
@@ -457,7 +551,7 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 				return m, nil
 			}
 			cursor := m.scheduleTable.Cursor()
-			if cursor >= len(m.scheduleDays) {
+			if cursor < 0 || cursor >= len(m.scheduleDays) {
 				return m, nil
 			}
 			day := m.scheduleDays[cursor]
@@ -473,25 +567,27 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 				return m, nil
 			}
 			cursor := m.userManageTable.Cursor()
-			if cursor >= len(m.users) {
+			if cursor < 0 || cursor >= len(m.users) {
 				return m, nil
 			}
+			if !m.isAdmin {
+				m.statusMsg = "only administrators can delete users"
+				return m, clearStatusCmd()
+			}
 			m.selectedUser = m.users[cursor]
 			m.confirmTarget = confirmDeleteUser
 			m.mode = modeConfirm
 		}
 		return m, nil
 
-	case "S":
-		if !m.connected {
-			return m, nil
-		}
-		return m.openStats()
-
 	case "n":
 		if m.activeSection != sectionUsers || !m.connected {
 			return m, nil
 		}
+		if !m.isAdmin {
+			m.statusMsg = "only administrators can create users"
+			return m, clearStatusCmd()
+		}
 		m.userFormInputs[0].Reset()
 		m.userFormInputs[1].Reset()
 		m.userFormFocus = 0
@@ -500,7 +596,44 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeUserCreate
 		return m, nil
 
+	case "t":
+		if m.activeSection != sectionUsers || !m.connected || len(m.users) == 0 {
+			return m, nil
+		}
+		cursor := m.userManageTable.Cursor()
+		if cursor < 0 || cursor >= len(m.users) {
+			return m, nil
+		}
+		m.selectedUser = m.users[cursor]
+		if !m.canManageUser(m.selectedUser) {
+			cmd := m.refuseUserAction("notification topic")
+			return m, cmd
+		}
+		// Prefilled with what they have, so editing a topic does not mean
+		// retyping it, and clearing one is a deliberate wipe.
+		m.ntfyTopicInput.SetValue(m.selectedUser.Topic())
+		m.ntfyTopicInput.CursorEnd()
+		m.ntfyTopicInput.Focus()
+		m.mode = modeUserNotifyEdit
+		return m, nil
+
 	case "k":
+		if m.activeSection != sectionUsers || !m.connected || len(m.users) == 0 {
+			return m, nil
+		}
+		cursor := m.userManageTable.Cursor()
+		if cursor < 0 || cursor >= len(m.users) {
+			return m, nil
+		}
+		m.selectedUser = m.users[cursor]
+		if !m.canManageUser(m.selectedUser) {
+			cmd := m.refuseUserAction("API keys")
+			return m, cmd
+		}
+		m.mode = modeAPIKeyMenu
+		return m, nil
+
+	case "p":
 		if m.activeSection != sectionUsers || !m.connected || len(m.users) == 0 {
 			return m, nil
 		}
@@ -509,30 +642,55 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			return m, nil
 		}
 		m.selectedUser = m.users[cursor]
-		m.mode = modeAPIKeyMenu
+		if !m.canManageUser(m.selectedUser) {
-		return m, nil
+			cmd := m.refuseUserAction("password")
+			return m, cmd
+		}
+		for i := range m.pwInputs {
+			m.pwInputs[i].Reset()
+			m.pwInputs[i].Blur()
+		}
+		m.pwNeedCurrent = false
+		m.pwLoading = true
+		m.mode = modePasswordSet
+		// Whether the form needs the current password depends on who the key
+		// belongs to, which the client does not otherwise know.
+		return m, fetchMeCmd(m.client)
 	}
 
 	return m, nil
 }
 
+// refuseUserAction explains a self-or-admin action declined up front, and is what
+// the status bar clears afterwards. The server refuses these with a 403 anyway.
+func (m *Model) refuseUserAction(what string) tea.Cmd {
+	m.statusMsg = "only administrators can change another user's " + what
+	return clearStatusCmd()
+}
+
 // loadSectionIfEmpty fetches a section's data the first time it is opened.
 func (m *Model) loadSectionIfEmpty() tea.Cmd {
 	switch m.activeSection {
 	case sectionAlerts:
 		if len(m.alerts) == 0 {
 			m.loading = true
-			return fetchAlertsCmd(m.client, m.alertFilter)
+			return fetchAlertsCmd(m.client, m.activeTeamID, m.alertFilter)
+		}
+	case sectionStats:
+		if !m.statsLoaded {
+			m.statsLoading = true
+			return tea.Batch(fetchStatsCmd(m.client), fetchDetailStatsCmd(m.client))
 		}
 	case sectionArchived:
 		if len(m.archivedIncidents) == 0 {
 			m.archivedLoading = true
-			return fetchArchivedIncidentsCmd(m.client)
+			return fetchArchivedIncidentsCmd(m.client, m.activeTeamID)
 		}
 	case sectionSchedule:
 		if len(m.scheduleDays) == 0 {
-			m.scheduleLoading = true
+			cmd := m.fetchScheduleWindowCmd()
-			return fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+			m.scheduleLoading = cmd != nil
+			return cmd
 		}
 	case sectionUsers:
 		if len(m.users) == 0 {
@@ -563,6 +721,18 @@ func (m Model) openIncident(inc api.Incident) (Model, tea.Cmd) {
 func (m Model) openUserPicker(target pickerTarget) (Model, tea.Cmd) {
 	m.pickerTarget = target
 	m.mode = modeUserPicker
+	if target == pickerSchedule {
+		// Only the team's own members can go on its rota, so who they are has to
+		// be known before anybody is offered.
+		team, ok := m.scheduleTeam()
+		if !ok {
+			m.mode = modeDashboard
+			return m, nil
+		}
+		m.pickerMembers = nil
+		m.usersLoading = true
+		return m, fetchPickerCmd(m.client, team.ID)
+	}
 	if len(m.users) == 0 {
 		m.usersLoading = true
 		return m, fetchUsersCmd(m.client)
@@ -571,6 +741,63 @@ func (m Model) openUserPicker(target pickerTarget) (Model, tea.Cmd) {
 	return m, nil
 }
 
+// switchTeam steps the active team through all teams, then each of the caller's
+// teams in turn, and reloads what depends on it. Sections that are not on screen
+// are emptied rather than fetched, so they load when next opened; the incident
+// queue is the exception because it is what the caller returns to.
+func (m Model) switchTeam() (Model, tea.Cmd) {
+	next := int64(0)
+	if m.activeTeamID == 0 {
+		next = m.teams[0].ID
+	} else {
+		for i, t := range m.teams {
+			if t.ID == m.activeTeamID && i+1 < len(m.teams) {
+				next = m.teams[i+1].ID
+			}
+		}
+	}
+	m.activeTeamID = next
+
+	m.incidents, m.alerts, m.archivedIncidents = nil, nil, nil
+	m.scheduleEntries, m.scheduleDays, m.currentOnCall = nil, nil, nil
+	m.loading = true
+	m.rebuildIncidentTable()
+	m.rebuildTable()
+	m.rebuildArchivedTable()
+	m.rebuildScheduleTable()
+
+	label := "all teams"
+	if t, ok := m.activeTeam(); ok {
+		label = t.Name
+	}
+	m.statusMsg = "Team: " + label
+
+	cmds := []tea.Cmd{clearStatusCmd()}
+	if m.activeSection != sectionIncidents {
+		cmds = append(cmds, fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter))
+	}
+	cmds = append(cmds, m.refreshActiveSection())
+	if m.activeSection == sectionSchedule {
+		m.scheduleLoading = true
+	}
+	return m, tea.Batch(cmds...)
+}
+
+// checkScheduleEditable says why a schedule change is refused, in the status
+// bar, and reports whether it may go ahead. The server enforces the same rule.
+func (m *Model) checkScheduleEditable() bool {
+	team, ok := m.scheduleTeam()
+	switch {
+	case !ok:
+		m.statusMsg = "you are not in any team"
+	case !m.canEditSchedule(team):
+		m.statusMsg = "only owners of " + team.Name + " can change its schedule"
+	default:
+		return true
+	}
+	return false
+}
+
 // nextFilter advances a filter cycle, wrapping at the end.
 func nextFilter(cycle []string, current string) string {
 	for i, f := range cycle {
@@ -654,10 +881,10 @@ func (m Model) handleIncidentDetailKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		if inc.ArchivedAt != nil {
 			m.archivedLoading = true
 			m.mode = modeDashboard
-			return m, unarchiveIncidentCmd(m.client, inc.ID)
+			return m, unarchiveIncidentCmd(m.client, inc.ID, m.activeTeamID)
 		}
 		m.mode = modeDashboard
-		return m, archiveIncidentCmd(m.client, inc.ID, m.incidentFilter)
+		return m, archiveIncidentCmd(m.client, inc.ID, m.activeTeamID, m.incidentFilter)
 
 	case "c":
 		m.mode = modeNote
@@ -677,9 +904,6 @@ func (m Model) handleIncidentDetailKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeConfirm
 		return m, nil
 
-	case "S":
-		return m.openStats()
-
 	case "[":
 		return m.moveNoteCursor(-1), nil
 
@@ -733,9 +957,6 @@ func (m Model) handleAlertDetailKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			return m, clearStatusCmd()
 		}
 		return m.openIncident(api.Incident{ID: *m.selectedAlert.IncidentID})
-
-	case "S":
-		return m.openStats()
 	}
 
 	return m, nil
@@ -801,6 +1022,7 @@ func (m Model) handleConfirmKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		}
 		m.pendingDeleteID = 0
 		m.pendingDeleteEntry = nil
+		m.pendingAssign = nil
 		return m, nil
 	}
 
@@ -822,7 +1044,8 @@ func (m Model) handleConfirmKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeDashboard
 		m.pendingDeleteEntry = nil
 		m.scheduleLoading = true
-		return m, deleteScheduleEntryCmd(m.client, entry.ID,
+		team, _ := m.scheduleTeam()
+		return m, deleteScheduleEntryCmd(m.client, team.ID, entry.ID,
 			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 
 	case confirmDeleteUser:
@@ -830,30 +1053,23 @@ func (m Model) handleConfirmKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeDashboard
 		m.usersLoading = true
 		return m, deleteUserCmd(m.client, userID)
+
+	case confirmReassignSchedule:
+		p := m.pendingAssign
+		m.mode = modeDashboard
+		m.pendingAssign = nil
+		if p == nil {
+			return m, nil
+		}
+		m.scheduleLoading = true
+		team, _ := m.scheduleTeam()
+		return m, assignScheduleCmd(m.client, team.ID, p.userID, p.dates, true,
+			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 	}
 
 	return m, nil
 }
 
-// ── Stats ─────────────────────────────────────────────────────────────────
-
-func (m Model) handleStatsKey(msg tea.KeyMsg) (Model, tea.Cmd) {
-	if msg.String() == "esc" {
-		m.mode = m.statsReturnMode
-		return m, nil
-	}
-	return m, nil
-}
-
-// openStats enters the statistics view, remembering where to go back to.
-func (m Model) openStats() (Model, tea.Cmd) {
-	m.statsReturnMode = m.mode
-	m.mode = modeStats
-	m.statsLoading = true
-	m.statsViewport = viewport.New(m.width, m.height-5)
-	return m, fetchDetailStatsCmd(m.client)
-}
-
 // ── User picker ───────────────────────────────────────────────────────────
 
 func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
@@ -868,10 +1084,11 @@ func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 
 	case "enter":
 		cursor := m.userPickerTable.Cursor()
-		if cursor < 0 || cursor >= len(m.users) {
+		pickable := m.pickerUsers()
+		if cursor < 0 || cursor >= len(pickable) {
 			return m, nil
 		}
-		user := m.users[cursor]
+		user := pickable[cursor]
 
 		if m.pickerTarget == pickerIncidentAssignee {
 			m.mode = modeIncidentDetail
@@ -879,7 +1096,7 @@ func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		}
 
 		scheduleCursor := m.scheduleTable.Cursor()
-		if scheduleCursor >= len(m.scheduleDays) {
+		if scheduleCursor < 0 || scheduleCursor >= len(m.scheduleDays) {
 			m.mode = modeDashboard
 			return m, nil
 		}
@@ -897,15 +1114,85 @@ func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		} else {
 			dates = []string{d.Format("2006-01-02")}
 		}
+
+		// The server refuses a date somebody else holds, so ask before taking
+		// it rather than letting the request come back 409. The answer is
+		// already on screen — no round trip is needed to work out who loses
+		// their shift.
+		taken, holders := m.scheduleConflicts(dates, user.ID)
+		if len(taken) > 0 {
+			m.pendingAssign = &pendingAssign{
+				userID:   user.ID,
+				username: user.Username,
+				dates:    dates,
+				taken:    taken,
+				holders:  holders,
+			}
+			m.confirmTarget = confirmReassignSchedule
+			m.mode = modeConfirm
+			return m, nil
+		}
+
 		m.mode = modeDashboard
 		m.scheduleLoading = true
-		return m, assignScheduleCmd(m.client, user.ID, dates,
+		// Nobody else loses anything, but the server rejects any date that
+		// already exists — including days this same person already holds, which
+		// is a no-op worth letting through silently.
+		team, _ := m.scheduleTeam()
+		return m, assignScheduleCmd(m.client, team.ID, user.ID, dates, m.scheduleOccupied(dates),
 			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 	}
 
 	return m, nil
 }
 
+// scheduleConflicts reports which of dates are already held by somebody other
+// than newUserID, and the distinct names holding them.
+//
+// Days the target already owns are not conflicts — reassigning somebody to
+// their own shift takes nothing from anyone, and prompting for it would be
+// noise. The server still needs replace for those, since it rejects any date
+// that exists.
+func (m Model) scheduleConflicts(dates []string, newUserID int64) (taken, holders []string) {
+	held := make(map[string]api.ScheduleEntry, len(m.scheduleDays))
+	for _, d := range m.scheduleDays {
+		if d.entry != nil {
+			held[d.entry.Date] = *d.entry
+		}
+	}
+	seen := make(map[string]bool)
+	for _, date := range dates {
+		e, ok := held[date]
+		if !ok || e.UserID == newUserID {
+			continue
+		}
+		taken = append(taken, date)
+		if !seen[e.Username] {
+			seen[e.Username] = true
+			holders = append(holders, e.Username)
+		}
+	}
+	return taken, holders
+}
+
+// scheduleOccupied reports whether any of dates already has an entry at all,
+// including one belonging to the incoming user. That is what decides whether
+// the request needs replace, as opposed to whether it needs confirming.
+func (m Model) scheduleOccupied(dates []string) bool {
+	held := make(map[string]bool, len(m.scheduleDays))
+	for _, d := range m.scheduleDays {
+		if d.entry != nil {
+			held[d.entry.Date] = true
+		}
+	}
+	for _, date := range dates {
+		if held[date] {
+			return true
+		}
+	}
+	return false
+}
+
 // ── User management ───────────────────────────────────────────────────────────
 
 func (m Model) handleUserCreateKey(msg tea.KeyMsg) (Model, tea.Cmd) {
@@ -939,6 +1226,28 @@ func (m Model) handleUserCreateKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	return m, nil
 }
 
+// handleUserNotifyEditKey edits one user's ntfy topic.
+//
+// Unlike the other forms here, an empty value is not a mistake to reject: it is
+// how a topic is cleared, which the server accepts and treats as NULL.
+func (m Model) handleUserNotifyEditKey(msg tea.KeyMsg) (Model, tea.Cmd) {
+	switch msg.String() {
+	case "esc":
+		m.ntfyTopicInput.Blur()
+		m.mode = modeDashboard
+		return m, nil
+
+	case "enter":
+		topic := strings.TrimSpace(m.ntfyTopicInput.Value())
+		m.ntfyTopicInput.Blur()
+		m.mode = modeDashboard
+		m.usersLoading = true
+		return m, setUserNotifyTargetCmd(m.client, m.selectedUser.ID, topic)
+	}
+
+	return m, nil
+}
+
 func (m Model) handleAPIKeyMenuKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	switch msg.String() {
 	case "esc":
@@ -1022,3 +1331,69 @@ func (m Model) handleAPIKeyRevokeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 
 	return m, nil
 }
+
+// ── Set password ──────────────────────────────────────────────────────────────
+
+// pwFields is the set-password form's fields in tab order.
+func (m Model) pwFields() []int {
+	if m.pwNeedCurrent {
+		return []int{pwCurrent, pwNew, pwRepeat}
+	}
+	return []int{pwNew, pwRepeat}
+}
+
+func (m *Model) blurPasswordForm() {
+	for i := range m.pwInputs {
+		m.pwInputs[i].Blur()
+	}
+}
+
+func (m Model) handlePasswordKey(msg tea.KeyMsg) (Model, tea.Cmd) {
+	switch msg.String() {
+	case "esc":
+		m.blurPasswordForm()
+		m.pwLoading = false
+		m.mode = modeDashboard
+		return m, nil
+	}
+	if m.pwLoading {
+		return m, nil
+	}
+
+	switch msg.String() {
+	case "tab", "shift+tab":
+		fields := m.pwFields()
+		i := slices.Index(fields, m.pwFocus)
+		step := 1
+		if msg.String() == "shift+tab" {
+			step = len(fields) - 1
+		}
+		m.pwInputs[m.pwFocus].Blur()
+		m.pwFocus = fields[(i+step)%len(fields)]
+		m.pwInputs[m.pwFocus].Focus()
+		return m, nil
+
+	case "enter":
+		password := m.pwInputs[pwNew].Value()
+		switch {
+		case m.pwNeedCurrent && m.pwInputs[pwCurrent].Value() == "":
+			m.statusMsg = "enter your current password"
+			return m, clearStatusCmd()
+		case len(password) < minPasswordLen:
+			m.statusMsg = fmt.Sprintf("the password must be at least %d characters", minPasswordLen)
+			return m, clearStatusCmd()
+		case password != m.pwInputs[pwRepeat].Value():
+			m.statusMsg = "the two new passwords do not match"
+			return m, clearStatusCmd()
+		}
+		current := ""
+		if m.pwNeedCurrent {
+			current = m.pwInputs[pwCurrent].Value()
+		}
+		m.blurPasswordForm()
+		m.mode = modeDashboard
+		m.statusMsg = "Setting password…"
+		return m, setPasswordCmd(m.client, m.selectedUser, password, current)
+	}
+	return m, nil
+}

internal/tui/update_test.go

@@ -0,0 +1,975 @@
+package tui
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// press sends one key and returns the resulting model and command. A nil command
+// means the model decided to do nothing, which is what most of these tests are
+// really asserting.
+func press(t *testing.T, m Model, key string) (Model, tea.Cmd) {
+	t.Helper()
+	var msg tea.KeyMsg
+	switch key {
+	case "esc":
+		msg = tea.KeyMsg{Type: tea.KeyEsc}
+	case "enter":
+		msg = tea.KeyMsg{Type: tea.KeyEnter}
+	case "tab":
+		msg = tea.KeyMsg{Type: tea.KeyTab}
+	default:
+		msg = tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(key)}
+	}
+	next, cmd := m.Update(msg)
+	return next.(Model), cmd
+}
+
+// sized returns a connected model with a usable window, which most handlers need.
+func sized() Model {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	m.connected = true
+	m.isAdmin = true // most handlers are being tested for what they do, not who may
+	return m
+}
+
+// onIncident opens the incident detail view directly, skipping the fetch.
+func onIncident(inc api.Incident, timeline []api.IncidentEvent) Model {
+	m := sized()
+	m.mode = modeIncidentDetail
+	m.selectedIncident = inc
+	m.timeline = timeline
+	m.noteCursor = -1
+	return m
+}
+
+func openIncidentFixture() api.Incident {
+	return api.Incident{ID: 1, Title: "DiskFull", Status: api.StatusTriggered,
+		Severity: "critical", TriggeredAt: time.Now()}
+}
+
+func resolvedIncidentFixture() api.Incident {
+	now := time.Now()
+	source := "manual"
+	inc := openIncidentFixture()
+	inc.Status = api.StatusResolved
+	inc.ResolvedAt = &now
+	inc.ResolutionSource = &source
+	return inc
+}
+
+// Resolving is terminal on the server: a later occurrence opens a new incident
+// rather than reopening this one. A stray keypress must not be able to do that.
+func TestResolve_AsksBeforeDoingIt(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+
+	m, cmd := press(t, m, "R")
+	if m.mode != modeConfirm {
+		t.Fatalf("expected a confirmation prompt, got mode %v", m.mode)
+	}
+	if m.confirmTarget != confirmResolveIncident {
+		t.Errorf("expected the resolve target, got %v", m.confirmTarget)
+	}
+	if cmd != nil {
+		t.Error("nothing should be sent to the server before confirming")
+	}
+	if !containsAll(m.confirmPrompt(), "final", "new incident") {
+		t.Errorf("the prompt should say resolving is final, got %q", m.confirmPrompt())
+	}
+}
+
+func TestResolve_CancelReturnsToDetailWithoutActing(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "R")
+
+	m, cmd := press(t, m, "n")
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to land back on the incident, got mode %v", m.mode)
+	}
+	if cmd != nil {
+		t.Error("cancelling must not act")
+	}
+}
+
+func TestResolve_ConfirmActs(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "R")
+
+	m, cmd := press(t, m, "y")
+	if cmd == nil {
+		t.Error("confirming should issue the resolve")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+// The server answers 409 on all of these; saying so up front beats a round trip.
+func TestResolvedIncident_RejectsWorkflowActions(t *testing.T) {
+	for _, key := range []string{"a", "A", "R", "s", "z", "Z"} {
+		t.Run(key, func(t *testing.T) {
+			m := onIncident(resolvedIncidentFixture(), nil)
+			m, cmd := press(t, m, key)
+			if cmd == nil {
+				t.Error("expected a status message command")
+			}
+			if m.statusMsg == "" {
+				t.Error("expected an explanation in the status line")
+			}
+			if m.mode != modeIncidentDetail {
+				t.Errorf("expected to stay on the incident, got mode %v", m.mode)
+			}
+		})
+	}
+}
+
+func TestOpenIncident_AcknowledgeTwiceIsRejected(t *testing.T) {
+	inc := openIncidentFixture()
+	id := int64(2)
+	at := time.Now()
+	inc.Status = api.StatusAcknowledged
+	inc.AcknowledgedByID = &id
+	inc.AcknowledgedBy = "alice"
+	inc.AcknowledgedAt = &at
+
+	m, _ := press(t, onIncident(inc, nil), "a")
+	if !containsAll(m.statusMsg, "already acknowledged", "alice") {
+		t.Errorf("expected to be told who holds it, got %q", m.statusMsg)
+	}
+}
+
+func TestOpenIncident_UnacknowledgeRequiresAnAcknowledgement(t *testing.T) {
+	m, _ := press(t, onIncident(openIncidentFixture(), nil), "A")
+	if m.statusMsg != "not acknowledged" {
+		t.Errorf("expected 'not acknowledged', got %q", m.statusMsg)
+	}
+}
+
+func TestOpenIncident_UnsnoozeRequiresASnooze(t *testing.T) {
+	m, _ := press(t, onIncident(openIncidentFixture(), nil), "Z")
+	if m.statusMsg != "not snoozed" {
+		t.Errorf("expected 'not snoozed', got %q", m.statusMsg)
+	}
+}
+
+// Archiving unresolved work only hides it, so the client refuses rather than
+// letting the queue be cleared by pressing x.
+func TestArchive_RefusesOpenIncident(t *testing.T) {
+	t.Run("from the detail view", func(t *testing.T) {
+		m, cmd := press(t, onIncident(openIncidentFixture(), nil), "x")
+		if cmd == nil || m.statusMsg == "" {
+			t.Error("expected a refusal message")
+		}
+		if m.mode != modeIncidentDetail {
+			t.Errorf("expected to stay put, got mode %v", m.mode)
+		}
+	})
+
+	t.Run("from the queue", func(t *testing.T) {
+		m := sized()
+		m.incidents = []api.Incident{openIncidentFixture()}
+		m.rebuildIncidentTable()
+
+		m, _ = press(t, m, "x")
+		if m.statusMsg == "" {
+			t.Error("expected a refusal message")
+		}
+	})
+}
+
+func TestArchive_AllowedOnResolvedIncident(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{resolvedIncidentFixture()}
+	m.rebuildIncidentTable()
+
+	m, cmd := press(t, m, "x")
+	if cmd == nil {
+		t.Error("archiving a resolved incident should act")
+	}
+	if m.statusMsg != "" {
+		t.Errorf("expected no refusal, got %q", m.statusMsg)
+	}
+}
+
+func TestSnooze_PromptThenSubmit(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+
+	m, _ = press(t, m, "z")
+	if m.mode != modeSnooze {
+		t.Fatalf("expected the snooze prompt, got mode %v", m.mode)
+	}
+
+	// Typing goes to the input, not the key handler.
+	for _, r := range "2h" {
+		m, _ = press(t, m, string(r))
+	}
+	if m.snoozeInput.Value() != "2h" {
+		t.Fatalf("expected the typed duration, got %q", m.snoozeInput.Value())
+	}
+
+	m, cmd := press(t, m, "enter")
+	if cmd == nil {
+		t.Error("expected the snooze to be sent")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+func TestSnooze_EmptyInputDoesNothing(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "z")
+
+	m, cmd := press(t, m, "enter")
+	if cmd != nil {
+		t.Error("an empty duration should not be sent")
+	}
+	if m.mode != modeSnooze {
+		t.Errorf("expected to stay on the prompt, got mode %v", m.mode)
+	}
+}
+
+func TestNote_EscapeAbandonsWithoutPosting(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "c")
+	if m.mode != modeNote {
+		t.Fatalf("expected the note prompt, got mode %v", m.mode)
+	}
+
+	m, cmd := press(t, m, "esc")
+	if cmd != nil {
+		t.Error("escaping must not post the note")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+func TestNoteCursor_WrapsOverNotesOnly(t *testing.T) {
+	timeline := []api.IncidentEvent{
+		{ID: 1, Type: api.EventTriggered},
+		{ID: 2, Type: api.EventNote, Detail: "first"},
+		{ID: 3, Type: api.EventAcknowledged},
+		{ID: 4, Type: api.EventNote, Detail: "second"},
+	}
+	m := onIncident(openIncidentFixture(), timeline)
+
+	m, _ = press(t, m, "]")
+	if m.noteCursor != 0 {
+		t.Fatalf("expected the first note, got %d", m.noteCursor)
+	}
+	m, _ = press(t, m, "]")
+	if m.noteCursor != 1 {
+		t.Fatalf("expected the second note, got %d", m.noteCursor)
+	}
+	m, _ = press(t, m, "]")
+	if m.noteCursor != 0 {
+		t.Errorf("expected to wrap to the first note, got %d", m.noteCursor)
+	}
+	m, _ = press(t, m, "[")
+	if m.noteCursor != 1 {
+		t.Errorf("expected to wrap backwards to the last note, got %d", m.noteCursor)
+	}
+}
+
+func TestDeleteNote_RequiresASelection(t *testing.T) {
+	m := onIncident(openIncidentFixture(), []api.IncidentEvent{{Type: api.EventTriggered}})
+	m, _ = press(t, m, "d")
+	if m.mode == modeConfirm {
+		t.Error("nothing is selected, so there is nothing to confirm")
+	}
+	if !containsAll(m.statusMsg, "select a note") {
+		t.Errorf("expected guidance, got %q", m.statusMsg)
+	}
+}
+
+func TestDeleteNote_ConfirmsThenActs(t *testing.T) {
+	timeline := []api.IncidentEvent{{ID: 9, Type: api.EventNote, Detail: "hi"}}
+	m := onIncident(openIncidentFixture(), timeline)
+
+	m, _ = press(t, m, "]")
+	m, _ = press(t, m, "d")
+	if m.mode != modeConfirm || m.confirmTarget != confirmDeleteNote {
+		t.Fatalf("expected a delete confirmation, got mode %v target %v", m.mode, m.confirmTarget)
+	}
+	if m.pendingDeleteID != 9 {
+		t.Errorf("expected the selected note's id, got %d", m.pendingDeleteID)
+	}
+
+	m, cmd := press(t, m, "y")
+	if cmd == nil {
+		t.Error("confirming should issue the delete")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+// ── Schedule reassignment ─────────────────────────────────────────────────
+
+// pickingOnCall opens the user picker for the schedule day at dayIndex, which
+// is where a reassignment actually starts.
+func pickingOnCall(entries []api.ScheduleEntry, dayIndex int, week bool) Model {
+	m := scheduledWeek(entries)
+	m.users = []api.User{
+		{ID: 1, Username: "niklas", Email: "n@example.com"},
+		{ID: 2, Username: "alex", Email: "a@example.com"},
+	}
+	m.pickerTarget = pickerSchedule
+	m.pickerMembers = map[int64]bool{1: true, 2: true}
+	m.rebuildUserPickerTable()
+	m.scheduleTable.SetCursor(dayIndex)
+	m.pickerAssignWeek = week
+	m.pickerTarget = pickerSchedule
+	m.mode = modeUserPicker
+	m.userPickerTable.SetCursor(1) // alex
+	return m
+}
+
+// The bug: a day somebody already holds could not be handed to anybody else.
+// The server refuses it, so the TUI has to ask first and then say so.
+func TestSchedule_ReassigningATakenDayAsksFirst(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+
+	m, cmd := press(t, m, "enter")
+
+	if m.mode != modeConfirm || m.confirmTarget != confirmReassignSchedule {
+		t.Fatalf("expected a reassignment confirmation, got mode %v target %v",
+			m.mode, m.confirmTarget)
+	}
+	if cmd != nil {
+		t.Error("expected nothing sent to the server before confirming")
+	}
+	mustContain(t, m.confirmPrompt(), "This day is assigned to niklas", "Reassign to alex?")
+}
+
+func TestSchedule_ReassignConfirmedSends(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+	m, _ = press(t, m, "enter")
+
+	m, cmd := press(t, m, "y")
+	if cmd == nil {
+		t.Fatal("expected the confirmed reassignment to be sent")
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("expected a return to the dashboard, got mode %v", m.mode)
+	}
+	if m.pendingAssign != nil {
+		t.Error("expected the pending assignment cleared")
+	}
+}
+
+// Declining must leave the rota alone — that is the whole point of the guard.
+func TestSchedule_ReassignDeclinedSendsNothing(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+	m, _ = press(t, m, "enter")
+
+	m, cmd := press(t, m, "n")
+	if cmd != nil {
+		t.Error("expected nothing sent when the reassignment is declined")
+	}
+	if m.pendingAssign != nil {
+		t.Error("expected the pending assignment discarded")
+	}
+}
+
+// A free day is the path that always worked, and must not grow a prompt.
+func TestSchedule_AssigningAFreeDayDoesNotAsk(t *testing.T) {
+	m := pickingOnCall(nil, 0, false)
+
+	m, cmd := press(t, m, "enter")
+	if m.mode != modeDashboard {
+		t.Errorf("expected no prompt for a free day, got mode %v", m.mode)
+	}
+	if cmd == nil {
+		t.Error("expected the assignment to be sent straight away")
+	}
+}
+
+// The week case is the one that was worst: a single taken day rejected all
+// seven. One prompt now covers the lot, and it says how much is being taken.
+func TestSchedule_ReassigningAPartlyTakenWeekAsksOnce(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-28", UserID: 1, Username: "niklas"},
+		{ID: 2, Date: "2026-07-30", UserID: 3, Username: "sam"},
+	}, 0, true)
+
+	m, _ = press(t, m, "enter")
+	if m.confirmTarget != confirmReassignSchedule {
+		t.Fatalf("expected one confirmation for the week, got target %v", m.confirmTarget)
+	}
+	if got := len(m.pendingAssign.dates); got != 7 {
+		t.Errorf("expected all 7 days in the assignment, got %d", got)
+	}
+	mustContain(t, m.confirmPrompt(), "2 of 7 days are assigned to niklas and sam")
+}
+
+// ── Ntfy topic ────────────────────────────────────────────────────────────
+
+// onUsers puts the model in the Users section with a loaded table.
+func onUsers(users []api.User) Model {
+	m := sized()
+	m.activeSection = sectionUsers
+	m.users = users
+	m.rebuildUserManageTable()
+	return m
+}
+
+func userFixtures() []api.User {
+	topic := "terdut-niklas"
+	return []api.User{
+		{ID: 1, Username: "niklas", Email: "niklas@example.com", NtfyTopic: &topic},
+		{ID: 2, Username: "alex", Email: "alex@example.com"},
+	}
+}
+
+func TestNotifyTopic_EditPrefillsTheCurrentTopic(t *testing.T) {
+	m, _ := press(t, onUsers(userFixtures()), "t")
+
+	if m.mode != modeUserNotifyEdit {
+		t.Fatalf("expected the topic editor, got mode %v", m.mode)
+	}
+	if m.selectedUser.ID != 1 {
+		t.Errorf("expected the user under the cursor, got %d", m.selectedUser.ID)
+	}
+	// Prefilled, so editing a topic does not mean retyping it from scratch.
+	if got := m.ntfyTopicInput.Value(); got != "terdut-niklas" {
+		t.Errorf("expected the current topic prefilled, got %q", got)
+	}
+}
+
+// A user with no topic opens an empty field rather than the previous user's.
+func TestNotifyTopic_EditStartsEmptyWhenUnset(t *testing.T) {
+	m := onUsers(userFixtures())
+	m, _ = press(t, m, "t")
+	m, _ = press(t, m, "esc")
+	m.userManageTable.SetCursor(1)
+
+	m, _ = press(t, m, "t")
+	if got := m.ntfyTopicInput.Value(); got != "" {
+		t.Errorf("expected an empty field for a user with no topic, got %q", got)
+	}
+}
+
+func TestNotifyTopic_EscapeAbandonsWithoutSaving(t *testing.T) {
+	m, _ := press(t, onUsers(userFixtures()), "t")
+	m, cmd := press(t, m, "esc")
+
+	if cmd != nil {
+		t.Error("expected escape to save nothing")
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("expected a return to the dashboard, got mode %v", m.mode)
+	}
+}
+
+// Clearing a topic is a real action, not a no-op: it is how a user is taken off
+// their own topic and back onto the shared fallback. Contrast the snooze prompt,
+// where an empty value means "I changed my mind".
+func TestNotifyTopic_EmptyInputStillSubmits(t *testing.T) {
+	m, _ := press(t, onUsers(userFixtures()), "t")
+	m.ntfyTopicInput.SetValue("")
+
+	m, cmd := press(t, m, "enter")
+	if cmd == nil {
+		t.Fatal("expected clearing the topic to call the server")
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("expected a return to the dashboard, got mode %v", m.mode)
+	}
+}
+
+func TestNotifyTopic_IsUsersSectionOnly(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionIncidents
+	if next, cmd := press(t, m, "t"); cmd != nil || next.mode != modeDashboard {
+		t.Error("expected t to do nothing outside the Users section")
+	}
+}
+
+func TestTab_CyclesEverySection(t *testing.T) {
+	m := sized()
+	if m.activeSection != sectionIncidents {
+		t.Fatal("incidents is the section the client opens on")
+	}
+
+	want := []section{sectionAlerts, sectionStats, sectionArchived, sectionSchedule,
+		sectionUsers, sectionIncidents}
+	for i, expected := range want {
+		m, _ = press(t, m, "tab")
+		if m.activeSection != expected {
+			t.Fatalf("after %d tabs expected section %v, got %v", i+1, expected, m.activeSection)
+		}
+	}
+}
+
+func TestFilter_CyclesPerSection(t *testing.T) {
+	m := sized()
+	m, _ = press(t, m, "f")
+	if m.incidentFilter != api.StatusTriggered {
+		t.Errorf("expected the incident filter to advance, got %q", m.incidentFilter)
+	}
+
+	m.activeSection = sectionAlerts
+	m, _ = press(t, m, "f")
+	if m.alertFilter != "resolved" {
+		t.Errorf("expected the alert filter to advance, got %q", m.alertFilter)
+	}
+	if m.incidentFilter != api.StatusTriggered {
+		t.Error("the two filters are independent")
+	}
+}
+
+// Stats is a section like any other: no key of its own, no mode of its own, and
+// it loads once on first visit rather than on every tab-in — the three empty
+// slices a quiet server returns are a real answer, not a missing one.
+func TestStats_IsAnOrdinarySection(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionAlerts
+
+	m, cmd := press(t, m, "tab")
+	if m.activeSection != sectionStats {
+		t.Fatalf("expected the stats section, got %v", m.activeSection)
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("stats is a section, not a mode: got mode %v", m.mode)
+	}
+	if cmd == nil {
+		t.Error("the first visit should fetch")
+	}
+
+	m.statsLoaded = true
+	m.statsLoading = false
+	if cmd := m.loadSectionIfEmpty(); cmd != nil {
+		t.Error("a second visit should reuse what was already fetched")
+	}
+}
+
+// S used to open the stats overlay from anywhere. It is gone, and must not
+// disturb the view it is pressed in.
+func TestStats_KeyIsGone(t *testing.T) {
+	m, _ := press(t, sized(), "S")
+	if m.activeSection != sectionIncidents || m.mode != modeDashboard {
+		t.Errorf("S should do nothing on the queue, got section %v mode %v",
+			m.activeSection, m.mode)
+	}
+
+	m, _ = press(t, onIncident(openIncidentFixture(), nil), "S")
+	if m.mode != modeIncidentDetail {
+		t.Errorf("S should leave the incident open, got mode %v", m.mode)
+	}
+}
+
+// The overlay never auto-refreshed, because the tick skipped every non-dashboard
+// mode. As a section it rides the tick like the rest.
+func TestStats_RefreshesOnTick(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionStats
+	if m.refreshActiveSection() == nil {
+		t.Error("the stats section should refresh on the tick")
+	}
+}
+
+// Alerts carry no workflow state, so the detail view offers nothing but a way
+// through to the incident.
+func TestAlertDetail_IsReadOnly(t *testing.T) {
+	m := sized()
+	m.mode = modeAlertDetail
+	m.selectedAlert = api.Alert{ID: 3, Name: "DiskFull", Status: "firing"}
+
+	for _, key := range []string{"a", "A", "R", "c", "x", "z"} {
+		next, cmd := press(t, m, key)
+		if cmd != nil {
+			t.Errorf("key %q should do nothing on an alert", key)
+		}
+		if next.mode != modeAlertDetail {
+			t.Errorf("key %q changed mode to %v", key, next.mode)
+		}
+	}
+}
+
+func TestAlertDetail_JumpToIncident(t *testing.T) {
+	m := sized()
+	m.mode = modeAlertDetail
+
+	t.Run("without an incident", func(t *testing.T) {
+		m.selectedAlert = api.Alert{ID: 3, Name: "Orphan"}
+		next, _ := press(t, m, "i")
+		if next.mode != modeAlertDetail || next.statusMsg == "" {
+			t.Errorf("expected a refusal, got mode %v msg %q", next.mode, next.statusMsg)
+		}
+	})
+
+	t.Run("with an incident", func(t *testing.T) {
+		id := int64(7)
+		m.selectedAlert = api.Alert{ID: 3, Name: "DiskFull", IncidentID: &id}
+		next, cmd := press(t, m, "i")
+		if next.mode != modeIncidentDetail {
+			t.Fatalf("expected the incident view, got mode %v", next.mode)
+		}
+		if next.selectedIncident.ID != 7 {
+			t.Errorf("expected incident 7, got %d", next.selectedIncident.ID)
+		}
+		if cmd == nil {
+			t.Error("expected the incident to be fetched")
+		}
+	})
+}
+
+// A refresh underneath a prompt would move the ground under the user.
+func TestRefreshTick_SkipsModalStates(t *testing.T) {
+	modal := []mode{modeNote, modeSnooze, modeConfirm, modeUserPicker, modeUserCreate}
+	for _, md := range modal {
+		m := sized()
+		m.mode = md
+		if cmd := m.refreshActiveSection(); cmd != nil {
+			t.Errorf("mode %v should not auto-refresh", md)
+		}
+	}
+
+	m := sized()
+	if cmd := m.refreshActiveSection(); cmd == nil {
+		t.Error("the dashboard should auto-refresh")
+	}
+}
+
+func TestIncidentsFetched_ClearsLoading(t *testing.T) {
+	m := sized()
+	m.loading = true
+	next, _ := m.Update(incidentsFetchedMsg{incidents: []api.Incident{openIncidentFixture()}})
+	got := next.(Model)
+	if got.loading {
+		t.Error("expected loading to clear")
+	}
+	if len(got.incidents) != 1 {
+		t.Errorf("expected the incidents stored, got %d", len(got.incidents))
+	}
+}
+
+// A note deleted elsewhere must not leave the cursor pointing past the end.
+func TestIncidentDetailFetched_ClampsNoteCursor(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m.noteCursor = 3
+
+	next, _ := m.Update(incidentDetailFetchedMsg{
+		incident: openIncidentFixture(),
+		timeline: []api.IncidentEvent{{Type: api.EventTriggered}},
+	})
+	if got := next.(Model).noteCursor; got != -1 {
+		t.Errorf("expected the cursor reset, got %d", got)
+	}
+}
+
+func containsAll(s string, subs ...string) bool {
+	for _, sub := range subs {
+		if !strings.Contains(s, sub) {
+			return false
+		}
+	}
+	return true
+}
+
+// The bug: assigning an on-call week panicked with "index out of range [-1]"
+// on a perfectly normal schedule, as long as nobody had moved the cursor first.
+//
+// The cause is not in this package. bubbles' SetRows clamps the cursor down but
+// never up, so the empty rebuild every table gets from the first WindowSizeMsg
+// -- which arrives before any fetch returns -- pins the cursor at -1, and
+// loading real rows afterwards leaves it there. Pressing up or down hid it,
+// which is why every existing test missed it: they all call SetCursor, and
+// SetCursor clamps.
+//
+// So this test must NOT touch the cursor. It reproduces the real order of
+// events: size first, data second, keys third.
+func TestSchedule_AssignWeekAfterStartupSizingDoesNotPanic(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.connected = true
+	m.isAdmin = true
+	m.teams = []api.Team{{ID: 1, Name: "Ops", Role: api.RoleOwner}}
+	m.activeSection = sectionSchedule
+	m.scheduleWindow = time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
+
+	// 1. Terminal size arrives while every table is still empty.
+	next, _ := m.Update(tea.WindowSizeMsg{Width: 120, Height: 40})
+	m = next.(Model)
+
+	// 2. The schedule and the user list land.
+	next, _ = m.Update(scheduleFetchedMsg{entries: []api.ScheduleEntry{}})
+	m = next.(Model)
+	next, _ = m.Update(usersFetchedMsg{users: []api.User{
+		{ID: 1, Username: "niklas", Email: "n@example.com"},
+	}})
+	m = next.(Model)
+
+	if got := m.scheduleTable.Cursor(); got < 0 {
+		t.Fatalf("schedule cursor is %d after loading %d days; a populated table must have a usable cursor",
+			got, len(m.scheduleDays))
+	}
+
+	// 3. Assign the week to the first user, without ever moving a cursor.
+	m, _ = press(t, m, "W")
+	if m.mode != modeUserPicker {
+		t.Fatalf("W did not open the user picker, got mode %v", m.mode)
+	}
+	// The picker waits for the team's members before offering anybody.
+	next, _ = m.Update(pickerReadyMsg{
+		users:   []api.User{{ID: 1, Username: "niklas", Email: "n@example.com"}},
+		members: map[int64]bool{1: true},
+	})
+	m = next.(Model)
+	m, _ = press(t, m, "enter") // panicked here
+
+	if m.mode == modeUserPicker {
+		t.Fatal("enter left the picker open; the assignment never went anywhere")
+	}
+}
+
+// ── Teams ─────────────────────────────────────────────────────────────────
+
+func twoTeams() []api.Team {
+	return []api.Team{
+		{ID: 1, Name: "Ops", Role: api.RoleOwner},
+		{ID: 2, Name: "Dev", Role: api.RoleMember},
+	}
+}
+
+func TestConnected_LoadsTeamsAndWhoIAm(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	next, _ := m.Update(connectedMsg{
+		teams: twoTeams(),
+		me:    api.Me{User: api.User{ID: 7, IsAdmin: true}},
+	})
+	m = next.(Model)
+	if len(m.teams) != 2 || m.meID != 7 || !m.isAdmin {
+		t.Errorf("expected teams, id and admin flag to be kept, got %+v %d %v", m.teams, m.meID, m.isAdmin)
+	}
+	if m.activeTeamID != 0 {
+		t.Errorf("with no default team every team shows, got active %d", m.activeTeamID)
+	}
+}
+
+func TestConnected_DefaultTeamFromConfig(t *testing.T) {
+	for _, want := range []string{"dev", "2"} { // by name, any case, or by id
+		m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark).WithDefaultTeam(want)
+		next, _ := m.Update(connectedMsg{teams: twoTeams()})
+		if got := next.(Model).activeTeamID; got != 2 {
+			t.Errorf("default team %q: expected team 2, got %d", want, got)
+		}
+	}
+
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark).WithDefaultTeam("nope")
+	next, cmd := m.Update(connectedMsg{teams: twoTeams()})
+	m = next.(Model)
+	if m.activeTeamID != 0 || !strings.Contains(m.statusMsg, "nope") {
+		t.Errorf("an unknown default should fall back to all teams and say so, got %d %q",
+			m.activeTeamID, m.statusMsg)
+	}
+	if cmd == nil {
+		t.Error("expected the initial fetches to still be issued")
+	}
+}
+
+func TestSwitchTeam_CyclesAllThenEachTeam(t *testing.T) {
+	m := sized()
+	m.teams = twoTeams()
+	var seen []int64
+	for i := 0; i < 4; i++ {
+		var cmd tea.Cmd
+		m, cmd = press(t, m, "T")
+		if cmd == nil {
+			t.Fatal("switching team should reload")
+		}
+		seen = append(seen, m.activeTeamID)
+	}
+	want := []int64{1, 2, 0, 1}
+	for i := range want {
+		if seen[i] != want[i] {
+			t.Fatalf("expected the cycle %v, got %v", want, seen)
+		}
+	}
+}
+
+func TestSwitchTeam_ClearsRowsFromTheOtherTeam(t *testing.T) {
+	m := sized()
+	m.teams = twoTeams()
+	m.incidents = []api.Incident{{ID: 1, Title: "old", TeamName: "Ops"}}
+	m.rebuildIncidentTable()
+	m, _ = press(t, m, "T")
+	if len(m.incidents) != 0 {
+		t.Errorf("the previous team's incidents must not linger, got %d", len(m.incidents))
+	}
+	if !strings.Contains(m.statusMsg, "Ops") {
+		t.Errorf("expected the status bar to name the team, got %q", m.statusMsg)
+	}
+}
+
+func TestSwitchTeam_NoTeamsDoesNothing(t *testing.T) {
+	m, cmd := press(t, sized(), "T")
+	if cmd != nil || m.activeTeamID != 0 {
+		t.Errorf("without teams T has nothing to switch to")
+	}
+}
+
+func TestScheduleTeam(t *testing.T) {
+	m := sized()
+	if _, ok := m.scheduleTeam(); ok {
+		t.Error("no teams means no schedule")
+	}
+	m.teams = []api.Team{{ID: 2, Name: "Dev", Role: api.RoleMember}, {ID: 1, Name: "Ops", Role: api.RoleOwner}}
+	if tm, _ := m.scheduleTeam(); tm.ID != 1 {
+		t.Errorf("with all teams showing the one the caller owns is used, got %d", tm.ID)
+	}
+	m.activeTeamID = 2
+	if tm, _ := m.scheduleTeam(); tm.ID != 2 {
+		t.Errorf("the active team wins, got %d", tm.ID)
+	}
+}
+
+func TestSchedule_OnlyOwnersAndAdminsEdit(t *testing.T) {
+	m := scheduledWeek(nil)
+	m.isAdmin = false
+	m.teams = []api.Team{{ID: 1, Name: "Ops", Role: api.RoleMember}}
+	m, cmd := press(t, m, "+")
+	if m.mode == modeUserPicker {
+		t.Fatal("a plain member must not get as far as the picker")
+	}
+	if !strings.Contains(m.statusMsg, "owners of Ops") {
+		t.Errorf("expected the reason in the status bar, got %q", m.statusMsg)
+	}
+	if cmd == nil {
+		t.Error("the message should clear itself")
+	}
+
+	m.isAdmin = true // administrators may edit any team's rota
+	m.statusMsg = ""
+	m, _ = press(t, m, "+")
+	if m.mode != modeUserPicker {
+		t.Errorf("an administrator should reach the picker, got mode %v", m.mode)
+	}
+}
+
+// The picker fetches the team's members, and offers nobody until they arrive:
+// the server answers 404 for anyone else.
+func TestSchedulePicker_OffersOnlyTeamMembers(t *testing.T) {
+	m := scheduledWeek(nil)
+	m, cmd := press(t, m, "+")
+	if cmd == nil || !m.usersLoading {
+		t.Fatal("opening the picker should start loading the members")
+	}
+	if got := len(m.pickerUsers()); got != 0 {
+		t.Errorf("nobody should be offered before the members are known, got %d", got)
+	}
+
+	disabled := time.Now()
+	next, _ := m.Update(pickerReadyMsg{
+		users: []api.User{
+			{ID: 1, Username: "niklas"},
+			{ID: 2, Username: "outsider"},
+			{ID: 3, Username: "gone", DisabledAt: &disabled},
+		},
+		members: map[int64]bool{1: true, 3: true},
+	})
+	m = next.(Model)
+	got := m.pickerUsers()
+	if len(got) != 1 || got[0].Username != "niklas" {
+		t.Errorf("expected only the enabled member, got %+v", got)
+	}
+	if rows := m.userPickerTable.Rows(); len(rows) != 1 {
+		t.Errorf("the table should match, got %d rows", len(rows))
+	}
+}
+
+func TestUsers_NonAdminsCannotCreateOrDelete(t *testing.T) {
+	m := threeUsers()
+	m.isAdmin = false
+	m.meID = 1
+	m, _ = press(t, m, "n")
+	if m.mode != modeDashboard || !strings.Contains(m.statusMsg, "administrators") {
+		t.Errorf("n should be refused with a reason, got mode %v %q", m.mode, m.statusMsg)
+	}
+	m, _ = press(t, m, "d")
+	if m.mode != modeDashboard {
+		t.Errorf("d should not ask to delete for a non-admin, got mode %v", m.mode)
+	}
+}
+
+func TestUsers_NonAdminManagesOnlyThemselves(t *testing.T) {
+	m := threeUsers() // cursor on erik, id 3
+	m.isAdmin = false
+	m.meID = 1
+	for _, key := range []string{"t", "k", "p"} {
+		next, _ := press(t, m, key)
+		if next.mode != modeDashboard {
+			t.Errorf("%s on somebody else's row should be refused, got mode %v", key, next.mode)
+		}
+		if !strings.Contains(next.statusMsg, "another user's") {
+			t.Errorf("%s: expected the reason, got %q", key, next.statusMsg)
+		}
+	}
+
+	m.userManageTable.SetCursor(0) // niklas, id 1: themselves
+	if next, _ := press(t, m, "k"); next.mode != modeAPIKeyMenu {
+		t.Errorf("a user may manage their own keys, got mode %v", next.mode)
+	}
+}
+
+func TestUserFlags(t *testing.T) {
+	now := time.Now()
+	cases := []struct {
+		u    api.User
+		want string
+	}{
+		{api.User{}, "—"},
+		{api.User{IsAdmin: true}, "admin"},
+		{api.User{DisabledAt: &now}, "disabled"},
+		{api.User{IsAdmin: true, DisabledAt: &now}, "admin,disabled"},
+	}
+	for _, c := range cases {
+		if got := userFlags(c.u); got != c.want {
+			t.Errorf("userFlags(%+v) = %q, want %q", c.u, got, c.want)
+		}
+	}
+}
+
+// Rebuilding a list on every refresh must not send the cursor back to the top.
+func TestRefresh_KeepsTheCursor(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{{ID: 1}, {ID: 2}, {ID: 3}}
+	m.rebuildIncidentTable()
+	m.incidentTable.SetCursor(2)
+	next, _ := m.Update(incidentsFetchedMsg{incidents: m.incidents})
+	if got := next.(Model).incidentTable.Cursor(); got != 2 {
+		t.Errorf("expected the cursor to stay on row 2, got %d", got)
+	}
+}
+
+// The Team column comes and goes as the team switches, and the table must
+// survive its column count changing under rows that are already loaded.
+func TestTeamColumn_AppearsWithoutPanicking(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{{ID: 1, Title: "a", TeamName: "Ops"}}
+	m.rebuildIncidentTable()
+	m.teams = twoTeams()
+	m.rebuildIncidentTable() // five columns become six over a five-cell row
+	if got := len(m.incidentTable.Columns()); got != 6 {
+		t.Errorf("expected a Team column across two teams, got %d columns", got)
+	}
+	m.activeTeamID = 1
+	m.rebuildIncidentTable()
+	if got := len(m.incidentTable.Columns()); got != 5 {
+		t.Errorf("expected the Team column to go when one team is chosen, got %d", got)
+	}
+}

internal/tui/users_test.go

@@ -0,0 +1,204 @@
+package tui
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// threeUsers is the Users section with the cursor on the last of three users.
+func threeUsers() Model {
+	m := onUsers([]api.User{
+		{ID: 1, Username: "niklas"},
+		{ID: 2, Username: "anna"},
+		{ID: 3, Username: "erik"},
+	})
+	m.userManageTable.SetCursor(2)
+	return m
+}
+
+// The table used to see k before the section did, take it as "up", and the
+// handler then opened API keys for the user above the one selected.
+func TestUsers_APIKeysOpenForTheSelectedUser(t *testing.T) {
+	m, _ := press(t, threeUsers(), "k")
+	if m.mode != modeAPIKeyMenu {
+		t.Fatalf("expected the API key menu, got mode %v", m.mode)
+	}
+	if m.selectedUser.Username != "erik" {
+		t.Errorf("API keys opened for %s, want erik", m.selectedUser.Username)
+	}
+}
+
+// Same collision with d, which the table read as half a page down: the delete
+// confirmation named a different user than the one under the cursor.
+func TestUsers_DeleteTargetsTheSelectedUser(t *testing.T) {
+	m := threeUsers()
+	m.userManageTable.SetCursor(0)
+	m, _ = press(t, m, "d")
+	if m.mode != modeConfirm || m.selectedUser.Username != "niklas" {
+		t.Errorf("delete asked about %q in mode %v, want niklas", m.selectedUser.Username, m.mode)
+	}
+}
+
+func TestSchedule_DeleteTargetsTheSelectedDay(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionSchedule
+	m.scheduleEntries = []api.ScheduleEntry{
+		{ID: 10, UserID: 1, Username: "niklas", Date: m.scheduleWindow.Format("2006-01-02")},
+		{ID: 11, UserID: 2, Username: "anna", Date: m.scheduleWindow.AddDate(0, 0, 1).Format("2006-01-02")},
+	}
+	m.scheduleDays = buildScheduleDays(m.scheduleWindow, m.scheduleEntries)
+	m.rebuildScheduleTable()
+	m.scheduleTable.SetCursor(0)
+	m, _ = press(t, m, "d")
+	if m.pendingDeleteEntry == nil || m.pendingDeleteEntry.ID != 10 {
+		t.Errorf("schedule delete targeted %+v, want entry 10", m.pendingDeleteEntry)
+	}
+}
+
+// f cycles the filter; it must not also page the cursor down.
+func TestFilter_DoesNotMoveTheCursor(t *testing.T) {
+	m := sized()
+	m.incidents = make([]api.Incident, 40)
+	for i := range m.incidents {
+		m.incidents[i] = api.Incident{ID: int64(i + 1), Title: "x", Status: api.StatusTriggered, TriggeredAt: time.Now()}
+	}
+	m.rebuildIncidentTable()
+	m, _ = press(t, m, "f")
+	if c := m.incidentTable.Cursor(); c != 0 {
+		t.Errorf("f moved the cursor to %d", c)
+	}
+}
+
+// The arrow keys still move the users table, now that k is an action there.
+func TestUsers_ArrowKeysStillNavigate(t *testing.T) {
+	m := threeUsers()
+	next, _ := m.Update(keyUp())
+	if c := next.(Model).userManageTable.Cursor(); c != 1 {
+		t.Errorf("up arrow left the cursor on %d, want 1", c)
+	}
+}
+
+func TestPassword_OpensForTheSelectedUserAndLooksUpWhoIAm(t *testing.T) {
+	m, cmd := press(t, threeUsers(), "p")
+	if m.mode != modePasswordSet || m.selectedUser.Username != "erik" {
+		t.Fatalf("expected the password form for erik, got mode %v for %q", m.mode, m.selectedUser.Username)
+	}
+	if !m.pwLoading || cmd == nil {
+		t.Error("the form should look up /api/me before it is usable")
+	}
+	if !strings.Contains(m.View(), "Checking who this key belongs to") {
+		t.Error("the form should say it is waiting")
+	}
+}
+
+func TestPassword_SomeoneElseNeedsNoCurrentPassword(t *testing.T) {
+	m, _ := press(t, threeUsers(), "p")
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}, HasPassword: true}})
+	m = next.(Model)
+	if m.pwNeedCurrent || m.pwFocus != pwNew {
+		t.Errorf("setting erik's password as niklas should not ask for a current one")
+	}
+	if strings.Contains(m.View(), "Current password") {
+		t.Error("the current-password field should be hidden")
+	}
+}
+
+func TestPassword_OwnExistingPasswordNeedsCurrent(t *testing.T) {
+	m := threeUsers()
+	m.userManageTable.SetCursor(0)
+	m, _ = press(t, m, "p")
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}, HasPassword: true}})
+	m = next.(Model)
+	if !m.pwNeedCurrent || m.pwFocus != pwCurrent {
+		t.Fatal("changing your own existing password should ask for the current one first")
+	}
+	m = typeInto(t, m, "correct horse")
+	m, _ = press(t, m, "tab")
+	m = typeInto(t, m, "a brand new secret")
+	m, _ = press(t, m, "tab")
+	m = typeInto(t, m, "a brand new secret")
+	m, cmd := press(t, m, "enter")
+	if cmd == nil || m.mode != modeDashboard {
+		t.Errorf("a complete form should submit (mode %v)", m.mode)
+	}
+}
+
+func TestPassword_OwnFirstPasswordNeedsNoCurrent(t *testing.T) {
+	m := threeUsers()
+	m.userManageTable.SetCursor(0)
+	m, _ = press(t, m, "p")
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}, HasPassword: false}})
+	if next.(Model).pwNeedCurrent {
+		t.Error("there is no current password to ask for yet")
+	}
+}
+
+func TestPassword_RejectsBeforeSending(t *testing.T) {
+	cases := []struct{ name, pw, repeat, want string }{
+		{"too short", "short", "short", "at least 10"},
+		{"mismatch", "a brand new secret", "a different secret", "do not match"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			m, _ := press(t, threeUsers(), "p")
+			next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}}})
+			m = typeInto(t, next.(Model), tc.pw)
+			m, _ = press(t, m, "tab")
+			m = typeInto(t, m, tc.repeat)
+			m, cmd := press(t, m, "enter")
+			if m.mode != modePasswordSet {
+				t.Error("the form should stay open")
+			}
+			if !strings.Contains(m.statusMsg, tc.want) {
+				t.Errorf("status %q should mention %q", m.statusMsg, tc.want)
+			}
+			if cmd == nil {
+				return
+			}
+			// Only the clear-status timer may be scheduled, never a request.
+			if _, ok := cmd().(clearStatusMsg); !ok {
+				t.Error("nothing should be sent to the server")
+			}
+		})
+	}
+}
+
+func TestPassword_EscapeCancels(t *testing.T) {
+	m, _ := press(t, threeUsers(), "p")
+	m, _ = press(t, m, "esc")
+	if m.mode != modeDashboard {
+		t.Errorf("esc should close the form, got mode %v", m.mode)
+	}
+	// A lookup arriving after the form closed must not reopen anything.
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 3}, HasPassword: true}})
+	if next.(Model).mode != modeDashboard {
+		t.Error("a late /api/me answer reopened the form")
+	}
+}
+
+func TestPassword_ErrorClosesTheFormWithAMessage(t *testing.T) {
+	m, _ := press(t, threeUsers(), "p")
+	next, _ := m.Update(userActionErrMsg{errTest("server returned 403: current password is incorrect")})
+	m = next.(Model)
+	if m.mode != modeDashboard || !strings.Contains(m.statusMsg, "current password is incorrect") {
+		t.Errorf("expected the server's message on the dashboard, got %q in mode %v", m.statusMsg, m.mode)
+	}
+}
+
+func typeInto(t *testing.T, m Model, s string) Model {
+	t.Helper()
+	next, _ := m.Update(runes(s))
+	return next.(Model)
+}
+
+func runes(s string) tea.KeyMsg { return tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(s)} }
+
+func keyUp() tea.KeyMsg { return tea.KeyMsg{Type: tea.KeyUp} }
+
+type errTest string
+
+func (e errTest) Error() string { return string(e) }

internal/tui/view.go

@@ -6,11 +6,12 @@ import (
 	"strings"
 	"time"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
-var sectionNames = []string{"Incidents", "Alerts", "Archived", "Schedule", "Users"}
+// Order must match the section constants — renderTabs indexes this by ordinal.
+var sectionNames = []string{"Incidents", "Alerts", "Stats", "Archived", "Schedule", "Users"}
 
 func (m Model) View() string {
 	if m.width == 0 {
@@ -25,40 +26,51 @@ func (m Model) View() string {
 }
 
 func (m Model) renderHeader() string {
-	title := styleHeader.Render("terdut-tui")
+	title := m.styles.Header.Render("terdut-tui")
-	right := styleMuted.Render(m.serverURL)
+	if len(m.teams) > 0 {
+		title += m.styles.Muted.Render("  team: " + m.activeTeamLabel())
+	}
+	right := m.styles.Muted.Render(m.serverURL)
 	return spread(title, right, m.width)
 }
 
+// activeTeamLabel names what the lists are narrowed to.
+func (m Model) activeTeamLabel() string {
+	if t, ok := m.activeTeam(); ok {
+		return t.Name
+	}
+	return "all"
+}
+
 func (m Model) renderTabs() string {
 	var tabs []string
 	for i, name := range sectionNames {
 		if section(i) == m.activeSection {
-			tabs = append(tabs, styleTabActive.Render(name))
+			tabs = append(tabs, m.styles.TabActive.Render(name))
 		} else {
-			tabs = append(tabs, styleTabInactive.Render(name))
+			tabs = append(tabs, m.styles.TabInactive.Render(name))
 		}
 	}
-	sep := styleMuted.Render(strings.Repeat("─", m.width))
+	sep := m.styles.Muted.Render(strings.Repeat("─", m.width))
 	return strings.Join(tabs, "") + "\n" + sep
 }
 
 func (m Model) renderBody() string {
 	if m.err != nil {
-		return "\n" + styleError.Render(fmt.Sprintf("  Error: %v", m.err)) +
+		return "\n" + m.styles.Error.Render(fmt.Sprintf("  Error: %v", m.err)) +
-			"\n" + styleMuted.Render("  Press r to retry.")
+			"\n" + m.styles.Muted.Render("  Press r to retry.")
 	}
 	if !m.connected {
-		return "\n" + styleMuted.Render("  Connecting…")
+		return "\n" + m.styles.Muted.Render("  Connecting…")
 	}
 
 	switch m.mode {
 	case modeIncidentDetail, modeAlertDetail:
 		return m.renderDetail()
 	case modeNote:
-		return m.renderPrompt(styleHeader.Render("Note: ") + m.noteInput.View())
+		return m.renderPrompt(m.styles.Header.Render("Note: ") + m.noteInput.View())
 	case modeSnooze:
-		return m.renderPrompt(styleHeader.Render("Snooze for: ") + m.snoozeInput.View())
+		return m.renderPrompt(m.styles.Header.Render("Snooze for: ") + m.snoozeInput.View())
 	case modeConfirm:
 		switch m.confirmTarget {
 		case confirmDeleteNote, confirmResolveIncident:
@@ -68,12 +80,12 @@ func (m Model) renderBody() string {
 		default:
 			return m.renderSchedule()
 		}
-	case modeStats:
-		return m.renderStats()
 	case modeUserPicker:
 		return m.renderUserPicker()
 	case modeUserCreate:
 		return m.renderUserCreate()
+	case modeUserNotifyEdit:
+		return m.renderUserNotifyEdit()
 	case modeAPIKeyMenu:
 		return m.renderAPIKeyMenu()
 	case modeAPIKeyCreate:
@@ -82,6 +94,8 @@ func (m Model) renderBody() string {
 		return m.renderAPIKeyReveal()
 	case modeAPIKeyRevokeByID:
 		return m.renderAPIKeyRevokeByID()
+	case modePasswordSet:
+		return m.renderPasswordSet()
 	default:
 		return m.renderDashboard()
 	}
@@ -89,9 +103,9 @@ func (m Model) renderBody() string {
 
 func (m Model) renderFooter() string {
 	withStatus := func(actions string) string {
-		rendered := styleFooter.Render(actions)
+		rendered := m.styles.Footer.Render(actions)
 		if m.statusMsg != "" {
-			return styleStatus.Render("  "+m.statusMsg) + "\n" + rendered
+			return m.styles.Status.Render("  "+m.statusMsg) + "\n" + rendered
 		}
 		return "\n" + rendered
 	}
@@ -99,24 +113,21 @@ func (m Model) renderFooter() string {
 	switch m.mode {
 	case modeIncidentDetail:
 		if !m.selectedIncident.IsOpen() {
-			return withStatus("  x·archive  c·note  [/]·select  d·del  S·stats  esc·back")
+			return withStatus("  x·archive  c·note  [/]·select  d·del  esc·back")
 		}
-		return withStatus("  a·ack  A·unack  R·resolve  s·assign  z·snooze  Z·unsnooze  c·note  [/]·select  d·del  S·stats  esc·back")
+		return withStatus("  a·ack  A·unack  R·resolve  s·assign  z·snooze  Z·unsnooze  c·note  [/]·select  d·del  esc·back")
 
 	case modeAlertDetail:
-		return withStatus("  i·open incident  S·stats  esc·back")
+		return withStatus("  i·open incident  esc·back")
 
 	case modeNote:
-		return "\n" + styleFooter.Render("  enter·submit  esc·cancel")
+		return "\n" + m.styles.Footer.Render("  enter·submit  esc·cancel")
 
 	case modeSnooze:
-		return "\n" + styleFooter.Render("  enter·snooze  esc·cancel   (e.g. 30m, 2h, 24h)")
+		return "\n" + m.styles.Footer.Render("  enter·snooze  esc·cancel   (e.g. 30m, 2h, 24h)")
 
 	case modeConfirm:
-		return "\n" + styleError.Render("  "+m.confirmPrompt())
+		return "\n" + m.styles.Error.Render("  "+m.confirmPrompt())
-
-	case modeStats:
-		return withStatus("  esc·back")
 
 	case modeUserPicker:
 		if m.pickerTarget == pickerIncidentAssignee {
@@ -131,6 +142,9 @@ func (m Model) renderFooter() string {
 	case modeUserCreate:
 		return withStatus("  tab·next field  enter·create  esc·cancel")
 
+	case modeUserNotifyEdit:
+		return withStatus("  enter·save  esc·cancel   (empty clears the topic)")
+
 	case modeAPIKeyMenu:
 		return withStatus("  n·new key  r·revoke by ID  esc·back")
 
@@ -143,23 +157,36 @@ func (m Model) renderFooter() string {
 	case modeAPIKeyRevokeByID:
 		return withStatus("  enter·revoke  esc·back")
 
+	case modePasswordSet:
+		return withStatus("  tab·next field  enter·set password  esc·cancel")
+
 	default:
 		switch m.activeSection {
 		case sectionIncidents:
-			return withStatus("  enter·detail  x·archive  f·filter  S·stats  r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  x·archive  f·filter  " + m.teamHint() + "r·refresh  tab·section  q·quit")
 		case sectionAlerts:
-			return withStatus("  enter·detail  f·filter  S·stats  r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  f·filter  " + m.teamHint() + "r·refresh  tab·section  q·quit")
+		case sectionStats:
+			return withStatus("  ↑/↓·scroll  r·refresh  tab·section  q·quit")
 		case sectionArchived:
-			return withStatus("  enter·detail  x·unarchive  r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  x·unarchive  " + m.teamHint() + "r·refresh  tab·section  q·quit")
 		case sectionSchedule:
-			return withStatus("  +·assign day  W·assign week  d·del  ←/→·shift week  tab·section  r·refresh  q·quit")
+			return withStatus("  +·assign day  W·assign week  d·del  ←/→·shift week  " + m.teamHint() + "tab·section  r·refresh  q·quit")
 		case sectionUsers:
-			return withStatus("  n·new user  d·delete  k·API keys  r·refresh  tab·section  q·quit")
+			return withStatus("  n·new user  t·topic  d·delete  k·API keys  p·password  r·refresh  tab·section  q·quit")
 		}
-		return "\n" + styleFooter.Render(m.help.ShortHelpView(m.keys.ShortHelp()))
+		return "\n" + m.styles.Footer.Render(m.help.ShortHelpView(m.keys.ShortHelp()))
 	}
 }
 
+// teamHint is the footer's team-switch key, shown only when there is a choice.
+func (m Model) teamHint() string {
+	if len(m.teams) > 1 {
+		return "T·team  "
+	}
+	return ""
+}
+
 func (m Model) confirmPrompt() string {
 	switch m.confirmTarget {
 	case confirmDeleteNote:
@@ -175,10 +202,44 @@ func (m Model) confirmPrompt() string {
 		return "Delete schedule entry? [y/N]"
 	case confirmDeleteUser:
 		return fmt.Sprintf("Delete user %s (cascades all API keys)? [y/N]", m.selectedUser.Username)
+	case confirmReassignSchedule:
+		if p := m.pendingAssign; p != nil {
+			return fmt.Sprintf("%s assigned to %s. Reassign to %s? [y/N]",
+				dayCount(len(p.taken), len(p.dates)), joinNames(p.holders), p.username)
+		}
+		return "Reassign these days? [y/N]"
 	}
 	return "Are you sure? [y/N]"
 }
 
+// dayCount phrases how much of an assignment is being taken from somebody. A
+// single day says so plainly; a partial week says which part, because "3 of 7"
+// is the difference between taking a shift and taking somebody's whole week.
+func dayCount(taken, total int) string {
+	switch {
+	case total == 1:
+		return "This day is"
+	case taken == total:
+		return fmt.Sprintf("All %d days are", total)
+	default:
+		return fmt.Sprintf("%d of %d days are", taken, total)
+	}
+}
+
+// joinNames renders a list of people as prose.
+func joinNames(names []string) string {
+	switch len(names) {
+	case 0:
+		return "somebody else"
+	case 1:
+		return names[0]
+	case 2:
+		return names[0] + " and " + names[1]
+	default:
+		return strings.Join(names[:len(names)-1], ", ") + " and " + names[len(names)-1]
+	}
+}
+
 // ── Dashboard ──────────────────────────────────────────────────────────────
 
 func (m Model) renderDashboard() string {
@@ -187,6 +248,8 @@ func (m Model) renderDashboard() string {
 		return m.renderIncidents()
 	case sectionAlerts:
 		return m.renderAlerts()
+	case sectionStats:
+		return m.renderStats()
 	case sectionArchived:
 		return m.renderArchived()
 	case sectionSchedule:
@@ -202,9 +265,9 @@ func (m Model) renderIncidents() string {
 	var content string
 	switch {
 	case m.loading && len(m.incidents) == 0:
-		content = styleMuted.Render("  Loading incidents…")
+		content = m.styles.Muted.Render("  Loading incidents…")
 	case len(m.incidents) == 0:
-		content = styleMuted.Render(
+		content = m.styles.Muted.Render(
 			fmt.Sprintf("  No %s incidents.", filterLabel(m.incidentFilter)))
 	default:
 		content = m.incidentTable.View()
@@ -217,9 +280,9 @@ func (m Model) renderAlerts() string {
 	var content string
 	switch {
 	case m.loading && len(m.alerts) == 0:
-		content = styleMuted.Render("  Loading alerts…")
+		content = m.styles.Muted.Render("  Loading alerts…")
 	case len(m.alerts) == 0:
-		content = styleMuted.Render(fmt.Sprintf("  No %s alerts.", filterLabel(m.alertFilter)))
+		content = m.styles.Muted.Render(fmt.Sprintf("  No %s alerts.", filterLabel(m.alertFilter)))
 	default:
 		content = m.alertTable.View()
 	}
@@ -228,10 +291,10 @@ func (m Model) renderAlerts() string {
 
 func (m Model) renderArchived() string {
 	if m.archivedLoading {
-		return "\n" + styleMuted.Render("  Loading archived incidents…")
+		return "\n" + m.styles.Muted.Render("  Loading archived incidents…")
 	}
 	if len(m.archivedIncidents) == 0 {
-		return "\n" + styleMuted.Render("  No archived incidents.")
+		return "\n" + m.styles.Muted.Render("  No archived incidents.")
 	}
 	return "\n" + m.archivedTable.View()
 }
@@ -247,12 +310,12 @@ func (m Model) renderIncidentStatsBar() string {
 		mttr = humanSeconds(m.incidentStats.MTTRSeconds)
 	}
 	left := fmt.Sprintf("  %s  %s  %s   %s",
-		styleTriggered.Render(fmt.Sprintf("Triggered: %d", triggered)),
+		m.styles.Triggered.Render(fmt.Sprintf("Triggered: %d", triggered)),
-		styleAcknowledged.Render(fmt.Sprintf("Acked: %d", acked)),
+		m.styles.Acknowledged.Render(fmt.Sprintf("Acked: %d", acked)),
-		styleResolved.Render(fmt.Sprintf("Resolved: %d", resolved)),
+		m.styles.Resolved.Render(fmt.Sprintf("Resolved: %d", resolved)),
-		styleMuted.Render(fmt.Sprintf("MTTA %s · MTTR %s", mtta, mttr)),
+		m.styles.Muted.Render(fmt.Sprintf("MTTA %s · MTTR %s", mtta, mttr)),
 	)
-	right := styleMuted.Render(fmt.Sprintf("filter: %s  [f]  ", filterLabel(m.incidentFilter)))
+	right := m.styles.Muted.Render(fmt.Sprintf("filter: %s  [f]  ", filterLabel(m.incidentFilter)))
 	return spread(left, right, m.width)
 }
 
@@ -265,10 +328,10 @@ func (m Model) renderAlertStatsBar() string {
 	}
 	left := fmt.Sprintf("  Total: %d  %s  %s",
 		total,
-		styleFiring.Render(fmt.Sprintf("Firing: %d", firing)),
+		m.styles.Firing.Render(fmt.Sprintf("Firing: %d", firing)),
-		styleResolved.Render(fmt.Sprintf("Resolved: %d", resolved)),
+		m.styles.Resolved.Render(fmt.Sprintf("Resolved: %d", resolved)),
 	)
-	right := styleMuted.Render(fmt.Sprintf("filter: %s  [f]  ", filterLabel(m.alertFilter)))
+	right := m.styles.Muted.Render(fmt.Sprintf("filter: %s  [f]  ", filterLabel(m.alertFilter)))
 	return spread(left, right, m.width)
 }
 
@@ -285,34 +348,52 @@ func spread(left, right string, width int) string {
 
 func (m Model) renderSchedule() string {
 	if m.scheduleLoading {
-		return "\n" + styleMuted.Render("  Loading schedule…")
+		return "\n" + m.styles.Muted.Render("  Loading schedule…")
+	}
+
+	team, ok := m.scheduleTeam()
+	if !ok {
+		return "\n" + m.styles.Muted.Render("  You are not in any team, so there is no schedule to show.")
 	}
 
 	var onCallLine string
-	if m.currentOnCall != nil {
+	if len(m.currentOnCall) > 0 {
-		onCallLine = fmt.Sprintf("  On-call today: %s",
+		onCallLine = "  On-call today: " + m.styles.AlertName.Render(m.onCallNames())
-			styleAlertName.Render(m.currentOnCall.Username))
 	} else {
-		onCallLine = styleMuted.Render("  On-call today: nobody scheduled")
+		onCallLine = m.styles.Muted.Render("  On-call today: nobody scheduled")
 	}
 
 	from := m.scheduleWindow
 	to := m.scheduleWindow.AddDate(0, 0, 6)
-	windowLabel := styleMuted.Render(fmt.Sprintf("  %s — %s",
+	windowLabel := m.styles.Muted.Render(fmt.Sprintf("  %s: %s — %s",
-		from.Format("Jan 02"), to.Format("Jan 02, 2006")))
+		team.Name, from.Format("Jan 02"), to.Format("Jan 02, 2006")))
 
 	header := "\n" + spread(onCallLine, windowLabel, m.width) + "\n"
 	return header + m.scheduleTable.View()
 }
 
+// onCallNames lists who is on call today. With several teams each name carries
+// its team, since one person per team is on call and "alice, bob" alone would
+// not say whose.
+func (m Model) onCallNames() string {
+	parts := make([]string, len(m.currentOnCall))
+	for i, e := range m.currentOnCall {
+		parts[i] = e.Username
+		if len(m.teams) > 1 && e.TeamName != "" {
+			parts[i] += " (" + e.TeamName + ")"
+		}
+	}
+	return strings.Join(parts, ", ")
+}
+
 func (m Model) renderUserPicker() string {
 	if m.usersLoading {
-		return "\n" + styleMuted.Render("  Loading users…")
+		return "\n" + m.styles.Muted.Render("  Loading users…")
 	}
 
 	if m.pickerTarget == pickerIncidentAssignee {
 		header := fmt.Sprintf("\n  Assign %s to:\n\n",
-			styleBold.Render(m.selectedIncident.Title))
+			m.styles.Bold.Render(m.selectedIncident.Title))
 		return header + m.userPickerTable.View()
 	}
 
@@ -337,7 +418,7 @@ func (m Model) renderUserPicker() string {
 		}
 	}
 
-	header := fmt.Sprintf("\n  Assign on-call for %s — select a user:\n\n", styleBold.Render(scope))
+	header := fmt.Sprintf("\n  Assign on-call for %s — select a user:\n\n", m.styles.Bold.Render(scope))
 	return header + m.userPickerTable.View()
 }
 
@@ -345,38 +426,50 @@ func (m Model) renderUserPicker() string {
 
 func (m Model) renderDetail() string {
 	if m.detailLoading {
-		return "\n" + styleMuted.Render("  Loading…")
+		return "\n" + m.styles.Muted.Render("  Loading…")
 	}
 	return m.detailViewport.View()
 }
 
 // renderPrompt puts an input line under the detail pane.
 func (m Model) renderPrompt(prompt string) string {
-	sep := styleMuted.Render(strings.Repeat("─", m.width))
+	sep := m.styles.Muted.Render(strings.Repeat("─", m.width))
 	return m.detailViewport.View() + "\n" + sep + "\n" + prompt
 }
 
 // ── Stats ──────────────────────────────────────────────────────────────────
 
 func (m Model) renderStats() string {
-	if m.statsLoading {
+	// Only announce loading before the first result: a background refresh must not
-		return "\n" + styleMuted.Render("  Loading statistics…")
+	// blank the page out from under whoever is reading it.
+	if m.statsLoading && !m.statsLoaded {
+		return "\n" + m.styles.Muted.Render("  Loading statistics…")
 	}
 	return m.statsViewport.View()
 }
 
+// line renders s in a style and terminates it.
+//
+// The newline has to stay outside Render: lipgloss pads every line of a styled
+// block out to its widest line, so a trailing newline inside the block produces
+// a second line made entirely of padding, and whatever is written next starts
+// after that padding instead of at the left margin.
+func line(style lipgloss.Style, s string) string {
+	return style.Render(s) + "\n"
+}
+
 // ── Content builders ───────────────────────────────────────────────────────
 
-func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent, cursor, width int) string {
+func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.IncidentEvent, cursor, width int) string {
 	now := time.Now()
 	var b strings.Builder
 	contentW := width - 4
 
 	// Title + status header
-	title := styleAlertName.Render(inc.Title)
+	title := s.AlertName.Render(inc.Title)
-	status := incidentStatusStyle(inc.Status).Render(incidentStatusLabel(inc))
+	status := s.IncidentStatus(inc.Status).Render(incidentStatusLabel(inc))
 	if inc.Severity != "" {
-		status += "  " + severityStyle(inc.Severity).Render(strings.ToUpper(inc.Severity))
+		status += "  " + s.Severity(inc.Severity).Render(strings.ToUpper(inc.Severity))
 	}
 	gap := contentW - lipgloss.Width(title) - lipgloss.Width(status)
 	if gap < 1 {
@@ -385,13 +478,16 @@ func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent,
 	b.WriteString("\n  " + title + strings.Repeat(" ", gap) + status + "\n\n")
 
 	// Timing and ownership
+	if inc.TeamName != "" {
+		b.WriteString(fmt.Sprintf("  Team:       %s\n", inc.TeamName))
+	}
 	b.WriteString(fmt.Sprintf("  Triggered:  %s  (%s)\n",
 		inc.TriggeredAt.UTC().Format("2006-01-02 15:04 UTC"), humanAgo(now, inc.TriggeredAt)))
 
 	if inc.AssignedTo != "" {
-		b.WriteString(fmt.Sprintf("  Assigned:   %s\n", styleBold.Render(inc.AssignedTo)))
+		b.WriteString(fmt.Sprintf("  Assigned:   %s\n", s.Bold.Render(inc.AssignedTo)))
 	} else {
-		b.WriteString(styleMuted.Render("  Assigned:   nobody\n"))
+		b.WriteString(line(s.Muted, "  Assigned:   nobody"))
 	}
 
 	if inc.AcknowledgedByID != nil {
@@ -399,14 +495,18 @@ func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent,
 		if inc.AcknowledgedAt != nil {
 			ackAt = "  at " + inc.AcknowledgedAt.UTC().Format("2006-01-02 15:04 UTC")
 		}
-		b.WriteString(styleResolved.Render(
+		b.WriteString(line(s.Resolved,
-			fmt.Sprintf("  Acked:      %s%s\n", inc.AcknowledgedBy, ackAt)))
+			fmt.Sprintf("  Acked:      %s%s", inc.AcknowledgedBy, ackAt)))
 	} else {
-		b.WriteString(styleMuted.Render("  Acked:      not acknowledged\n"))
+		b.WriteString(line(s.Muted, "  Acked:      not acknowledged"))
+	}
+
+	if inc.EscalationLevel > 0 {
+		b.WriteString(line(s.Snoozed, fmt.Sprintf("  Escalation: level %d", inc.EscalationLevel)))
 	}
 
 	if inc.IsSnoozed() {
-		b.WriteString(styleSnoozed.Render(fmt.Sprintf("  Snoozed:    until %s  (%s)\n",
+		b.WriteString(line(s.Snoozed, fmt.Sprintf("  Snoozed:    until %s  (%s)",
 			inc.SnoozedUntil.UTC().Format("2006-01-02 15:04 UTC"), humanUntil(now, *inc.SnoozedUntil))))
 	}
 
@@ -419,14 +519,14 @@ func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent,
 			inc.ResolvedAt.UTC().Format("2006-01-02 15:04 UTC"), humanAgo(now, *inc.ResolvedAt), source))
 	}
 	if inc.ArchivedAt != nil {
-		b.WriteString(styleMuted.Render("  Archived:   " +
+		b.WriteString(line(s.Muted, "  Archived:   "+
-			inc.ArchivedAt.UTC().Format("2006-01-02 15:04 UTC") + "\n"))
+			inc.ArchivedAt.UTC().Format("2006-01-02 15:04 UTC")))
 	}
 	b.WriteString("\n")
 
 	// Group labels — the correlation Alertmanager applied.
 	if len(inc.GroupLabels) > 0 {
-		b.WriteString(divider("Grouped By", width))
+		b.WriteString(divider(s, "Grouped By", width))
 		for _, k := range sortedKeys(inc.GroupLabels) {
 			b.WriteString(fmt.Sprintf("  %-22s %s\n", k, truncate(inc.GroupLabels[k], contentW-24)))
 		}
@@ -434,14 +534,14 @@ func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent,
 	}
 
 	// Member alerts
-	b.WriteString(divider(fmt.Sprintf("Alerts (%d)", len(inc.Alerts)), width))
+	b.WriteString(divider(s, fmt.Sprintf("Alerts (%d)", len(inc.Alerts)), width))
 	if len(inc.Alerts) == 0 {
-		b.WriteString(styleMuted.Render("  No alerts.\n"))
+		b.WriteString(line(s.Muted, "  No alerts."))
 	} else {
 		for _, a := range inc.Alerts {
-			marker := styleFiring.Render("●")
+			marker := s.Firing.Render("●")
 			if a.Status != "firing" {
-				marker = styleResolved.Render("✓")
+				marker = s.Resolved.Render("✓")
 			}
 			instance := a.Labels["instance"]
 			if instance == "" {
@@ -449,29 +549,29 @@ func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent,
 			}
 			b.WriteString(fmt.Sprintf("  %s %-28s %-26s %s\n",
 				marker, truncate(a.Name, 28), truncate(instance, 26),
-				styleMuted.Render("last seen "+humanAgo(now, a.ReceivedAt))))
+				s.Muted.Render("last seen "+humanAgo(now, a.ReceivedAt))))
 		}
 	}
 	b.WriteString("\n")
 
 	// Timeline — the only history the server keeps.
 	notes := noteEvents(timeline)
-	b.WriteString(divider(fmt.Sprintf("Timeline (%d events, %d notes)", len(timeline), len(notes)), width))
+	b.WriteString(divider(s, fmt.Sprintf("Timeline (%d events, %d notes)", len(timeline), len(notes)), width))
 	if len(timeline) == 0 {
-		b.WriteString(styleMuted.Render("  Nothing recorded yet.\n"))
+		b.WriteString(line(s.Muted, "  Nothing recorded yet."))
 	} else {
 		noteIndex := 0
 		for _, e := range timeline {
-			when := styleMuted.Render(humanAgo(now, e.CreatedAt))
+			when := s.Muted.Render(humanAgo(now, e.CreatedAt))
 			if e.Type != api.EventNote {
 				b.WriteString(fmt.Sprintf("  %-52s %s\n", eventLabel(e), when))
 				continue
 			}
 			marker := "  "
-			author := styleBold.Render(e.Username)
+			author := s.Bold.Render(e.Username)
 			if noteIndex == cursor {
-				marker = styleSelected.Render("> ")
+				marker = s.Selected.Render("> ")
-				author = styleSelected.Render(e.Username)
+				author = s.Selected.Render(e.Username)
 			}
 			b.WriteString(fmt.Sprintf("%s%-50s %s\n", marker, author+" wrote", when))
 			b.WriteString("    " + e.Detail + "\n")
@@ -538,6 +638,17 @@ func eventLabel(e api.IncidentEvent) string {
 			return "  Resolved by " + who
 		}
 		return "  Resolved (all alerts stopped firing)"
+	case api.EventNotified:
+		// An empty username here is not "the server acted": it means the page
+		// went to the shared fallback topic, so it belongs to nobody.
+		return fmt.Sprintf("  Notified %s%s", notifiedTarget(who), notifyKind(e.Detail))
+	case api.EventNotifyFailed:
+		// The detail is "<kind>: <reason>", and the reason is the point — it is
+		// the only thing that says why nobody's phone rang.
+		return truncate(fmt.Sprintf("  Notification to %s failed · %s",
+			notifiedTarget(who), e.Detail), 52)
+	case api.EventDeadmanSilent:
+		return "  Dead man's switch went silent"
 	default:
 		label := "  " + e.Type
 		if e.Detail != "" {
@@ -547,21 +658,40 @@ func eventLabel(e api.IncidentEvent) string {
 	}
 }
 
-func buildAlertDetailContent(alert api.Alert, width int) string {
+// notifiedTarget names who a page reached. The server attaches no user when it
+// published to the shared fallback topic, and saying so is the difference
+// between "somebody was paged" and "the on-call rota was empty".
+func notifiedTarget(username string) string {
+	if username == "" {
+		return "the fallback topic"
+	}
+	return username
+}
+
+// notifyKind renders the notification kind the server puts in Detail. It is an
+// open set, so anything unrecognised is shown rather than dropped.
+func notifyKind(detail string) string {
+	if detail == "" {
+		return ""
+	}
+	return " (" + detail + ")"
+}
+
+func buildAlertDetailContent(s Styles, alert api.Alert, width int) string {
 	now := time.Now()
 	var b strings.Builder
 	contentW := width - 4
 
-	name := styleAlertName.Render(alert.Name)
+	name := s.AlertName.Render(alert.Name)
 	var statusStr string
 	if alert.Status == "firing" {
-		statusStr = styleFiring.Render("● FIRING")
+		statusStr = s.Firing.Render("● FIRING")
 	} else {
 		label := "✓ RESOLVED"
 		if alert.ResolutionSource != nil {
 			label += " · " + *alert.ResolutionSource
 		}
-		statusStr = styleResolved.Render(label)
+		statusStr = s.Resolved.Render(label)
 	}
 	gap := contentW - lipgloss.Width(name) - lipgloss.Width(statusStr)
 	if gap < 1 {
@@ -581,15 +711,15 @@ func buildAlertDetailContent(alert api.Alert, width int) string {
 	}
 	if alert.IncidentID != nil {
 		b.WriteString(fmt.Sprintf("  Incident:   %s   %s\n",
-			styleBold.Render(fmt.Sprintf("#%d", *alert.IncidentID)),
+			s.Bold.Render(fmt.Sprintf("#%d", *alert.IncidentID)),
-			styleMuted.Render("press i to open it")))
+			s.Muted.Render("press i to open it")))
 	} else {
-		b.WriteString(styleMuted.Render("  Incident:   none\n"))
+		b.WriteString(line(s.Muted, "  Incident:   none"))
 	}
 	b.WriteString("\n")
 
 	if len(alert.Labels) > 0 {
-		b.WriteString(divider("Labels", width))
+		b.WriteString(divider(s, "Labels", width))
 		for _, k := range sortedKeys(alert.Labels) {
 			b.WriteString(fmt.Sprintf("  %-22s %s\n", k, truncate(alert.Labels[k], contentW-24)))
 		}
@@ -597,7 +727,7 @@ func buildAlertDetailContent(alert api.Alert, width int) string {
 	}
 
 	if len(alert.Annotations) > 0 {
-		b.WriteString(divider("Annotations", width))
+		b.WriteString(divider(s, "Annotations", width))
 		for _, k := range sortedKeys(alert.Annotations) {
 			b.WriteString(fmt.Sprintf("  %-22s %s\n", k, truncate(alert.Annotations[k], contentW-24)))
 		}
@@ -605,14 +735,14 @@ func buildAlertDetailContent(alert api.Alert, width int) string {
 	}
 
 	// Alerts carry no workflow state: it all lives on the incident.
-	b.WriteString(divider("", width))
+	b.WriteString(divider(s, "", width))
-	b.WriteString(styleMuted.Render(
+	b.WriteString(line(s.Muted,
-		"  Alerts are read-only — acknowledge, assign, note and resolve on the incident.\n"))
+		"  Alerts are read-only — acknowledge, assign, note and resolve on the incident."))
 
 	return b.String()
 }
 
-func buildStatsContent(incidents *api.IncidentStats, top []api.TopAlert, byHour []api.HourStat, byDay []api.DayStat, width int) string {
+func buildStatsContent(s Styles, incidents *api.IncidentStats, top []api.TopAlert, byHour []api.HourStat, byDay []api.DayStat, width int) string {
 	barWidth := width/2 - 10
 	if barWidth < 8 {
 		barWidth = 8
@@ -625,41 +755,41 @@ func buildStatsContent(incidents *api.IncidentStats, top []api.TopAlert, byHour
 	b.WriteString("\n")
 
 	// Response times first: they are what a rota is actually judged on.
-	b.WriteString(divider("Incident Response", width))
+	b.WriteString(divider(s, "Incident Response", width))
 	if incidents == nil {
-		b.WriteString(styleMuted.Render("  No data.\n"))
+		b.WriteString(line(s.Muted, "  No data."))
 	} else {
 		b.WriteString(fmt.Sprintf("  %-28s %s\n", "Incidents total",
-			styleBold.Render(fmt.Sprintf("%d", incidents.Total))))
+			s.Bold.Render(fmt.Sprintf("%d", incidents.Total))))
 		b.WriteString(fmt.Sprintf("  %-28s %s\n", "Triggered",
-			styleTriggered.Render(fmt.Sprintf("%d", incidents.Triggered))))
+			s.Triggered.Render(fmt.Sprintf("%d", incidents.Triggered))))
 		b.WriteString(fmt.Sprintf("  %-28s %s\n", "Acknowledged",
-			styleAcknowledged.Render(fmt.Sprintf("%d", incidents.Acknowledged))))
+			s.Acknowledged.Render(fmt.Sprintf("%d", incidents.Acknowledged))))
 		b.WriteString(fmt.Sprintf("  %-28s %s\n", "Resolved",
-			styleResolved.Render(fmt.Sprintf("%d", incidents.Resolved))))
+			s.Resolved.Render(fmt.Sprintf("%d", incidents.Resolved))))
 		b.WriteString(fmt.Sprintf("  %-28s %s\n", "Mean time to acknowledge",
-			styleBold.Render(humanSeconds(incidents.MTTASeconds))))
+			s.Bold.Render(humanSeconds(incidents.MTTASeconds))))
 		b.WriteString(fmt.Sprintf("  %-28s %s\n", "Mean time to resolve",
-			styleBold.Render(humanSeconds(incidents.MTTRSeconds))))
+			s.Bold.Render(humanSeconds(incidents.MTTRSeconds))))
 		if incidents.MTTASeconds == nil || incidents.MTTRSeconds == nil {
-			b.WriteString(styleMuted.Render("  (— means nothing has been acknowledged or resolved yet)\n"))
+			b.WriteString(line(s.Muted, "  (— means nothing has been acknowledged or resolved yet)"))
 		}
 	}
 	b.WriteString("\n")
 
-	b.WriteString(divider("Top Alerts", width))
+	b.WriteString(divider(s, "Top Alerts", width))
 	if len(top) == 0 {
-		b.WriteString(styleMuted.Render("  No data.\n"))
+		b.WriteString(line(s.Muted, "  No data."))
 	} else {
 		maxCount := top[0].Count
 		for i, a := range top {
-			bar := styleResolved.Render(strings.Repeat("█", renderBarWidth(a.Count, maxCount, barWidth)))
+			bar := s.Resolved.Render(strings.Repeat("█", renderBarWidth(a.Count, maxCount, barWidth)))
 			b.WriteString(fmt.Sprintf("  %2d. %-30s %s %d\n", i+1, truncate(a.Name, 30), bar, a.Count))
 		}
 	}
 	b.WriteString("\n")
 
-	b.WriteString(divider("Alerts by Hour (UTC)", width))
+	b.WriteString(divider(s, "Alerts by Hour (UTC)", width))
 	if len(byHour) > 0 {
 		maxCount := 0
 		for _, h := range byHour {
@@ -668,15 +798,15 @@ func buildStatsContent(incidents *api.IncidentStats, top []api.TopAlert, byHour
 			}
 		}
 		for _, h := range byHour {
-			bar := styleFiring.Render(strings.Repeat("█", renderBarWidth(h.Count, maxCount, barWidth)))
+			bar := s.Firing.Render(strings.Repeat("█", renderBarWidth(h.Count, maxCount, barWidth)))
 			b.WriteString(fmt.Sprintf("  %2dh  %-*s %d\n", h.Hour, barWidth, bar, h.Count))
 		}
 	} else {
-		b.WriteString(styleMuted.Render("  No data.\n"))
+		b.WriteString(line(s.Muted, "  No data."))
 	}
 	b.WriteString("\n")
 
-	b.WriteString(divider("Alerts by Day", width))
+	b.WriteString(divider(s, "Alerts by Day", width))
 	if len(byDay) > 0 {
 		maxCount := 0
 		for _, d := range byDay {
@@ -685,11 +815,11 @@ func buildStatsContent(incidents *api.IncidentStats, top []api.TopAlert, byHour
 			}
 		}
 		for _, d := range byDay {
-			bar := styleAccent.Render(strings.Repeat("█", renderBarWidth(d.Count, maxCount, barWidth)))
+			bar := s.Accent.Render(strings.Repeat("█", renderBarWidth(d.Count, maxCount, barWidth)))
 			b.WriteString(fmt.Sprintf("  %-4s  %-*s %d\n", d.DayName[:3], barWidth, bar, d.Count))
 		}
 	} else {
-		b.WriteString(styleMuted.Render("  No data.\n"))
+		b.WriteString(line(s.Muted, "  No data."))
 	}
 
 	return b.String()
@@ -699,72 +829,104 @@ func buildStatsContent(incidents *api.IncidentStats, top []api.TopAlert, byHour
 
 func (m Model) renderUsers() string {
 	if m.usersLoading {
-		return "\n" + styleMuted.Render("  Loading users…")
+		return "\n" + m.styles.Muted.Render("  Loading users…")
 	}
 	if len(m.users) == 0 {
-		return "\n" + styleMuted.Render("  No users found. Press n to create one.")
+		return "\n" + m.styles.Muted.Render("  No users found. Press n to create one.")
 	}
 	return "\n" + m.userManageTable.View()
 }
 
 func (m Model) renderUserCreate() string {
-	header := "\n  " + styleBold.Render("Create new user") + "\n\n"
+	header := "\n  " + m.styles.Bold.Render("Create new user") + "\n\n"
 	usernameLabel := "  Username:  "
 	emailLabel := "  Email:     "
 	if m.userFormFocus == 0 {
-		usernameLabel = styleSelected.Render("  Username:  ")
+		usernameLabel = m.styles.Selected.Render("  Username:  ")
 	} else {
-		emailLabel = styleSelected.Render("  Email:     ")
+		emailLabel = m.styles.Selected.Render("  Email:     ")
 	}
 	return header +
 		usernameLabel + m.userFormInputs[0].View() + "\n" +
 		emailLabel + m.userFormInputs[1].View() + "\n"
 }
 
+func (m Model) renderUserNotifyEdit() string {
+	header := fmt.Sprintf("\n  Push notifications for %s\n", m.styles.Bold.Render(m.selectedUser.Username))
+	hint := line(m.styles.Muted,
+		"  The ntfy topic this user's pages go to. Leave it empty to clear it —\n"+
+			"  their incidents then page the server's shared fallback topic, which\n"+
+			"  carries no Acknowledge button.")
+	label := m.styles.Selected.Render("  Topic:  ")
+	return header + "\n" + hint + "\n" + label + m.ntfyTopicInput.View() + "\n"
+}
+
+func (m Model) renderPasswordSet() string {
+	header := fmt.Sprintf("\n  Web UI password for %s\n\n", m.styles.Bold.Render(m.selectedUser.Username))
+	if m.pwLoading {
+		return header + line(m.styles.Muted, "  Checking who this key belongs to…")
+	}
+	labels := [pwFieldCount]string{
+		pwCurrent: "  Current password:  ",
+		pwNew:     "  New password:      ",
+		pwRepeat:  "  Repeat:            ",
+	}
+	var form string
+	for _, f := range m.pwFields() {
+		label := labels[f]
+		if f == m.pwFocus {
+			label = m.styles.Selected.Render(label)
+		}
+		form += label + m.pwInputs[f].View() + "\n"
+	}
+	hint := fmt.Sprintf("  At least %d characters. Setting it signs %s out of every other\n  web UI session. API keys are not affected.", minPasswordLen, m.selectedUser.Username)
+	return header + form + "\n" + line(m.styles.Muted, hint)
+}
+
 func (m Model) renderAPIKeyMenu() string {
-	header := fmt.Sprintf("\n  API keys for %s\n", styleBold.Render(m.selectedUser.Username))
+	header := fmt.Sprintf("\n  API keys for %s\n", m.styles.Bold.Render(m.selectedUser.Username))
-	warning := styleMuted.Render("  Keys cannot be listed — only new keys can be created,\n  or existing ones revoked by their integer ID.\n")
+	warning := line(m.styles.Muted, "  Keys cannot be listed — only new keys can be created,\n  or existing ones revoked by their integer ID.")
 	options := "\n" +
-		styleAccent.Render("  n") + "  · create a new API key\n" +
+		m.styles.Accent.Render("  n") + "  · create a new API key\n" +
-		styleAccent.Render("  r") + "  · revoke a key by ID\n"
+		m.styles.Accent.Render("  r") + "  · revoke a key by ID\n"
 	return header + "\n" + warning + options
 }
 
 func (m Model) renderAPIKeyCreate() string {
-	header := fmt.Sprintf("\n  New API key for %s\n\n", styleBold.Render(m.selectedUser.Username))
+	header := fmt.Sprintf("\n  New API key for %s\n\n", m.styles.Bold.Render(m.selectedUser.Username))
-	label := styleSelected.Render("  Key name:  ")
+	label := m.styles.Selected.Render("  Key name:  ")
 	return header + label + m.apiKeyNameInput.View() + "\n"
 }
 
 func (m Model) renderAPIKeyReveal() string {
-	sep := styleMuted.Render(strings.Repeat("─", m.width))
+	sep := m.styles.Muted.Render(strings.Repeat("─", m.width))
-	warn := styleError.Render("  !! COPY NOW — this key will NEVER be shown again !!")
+	warn := m.styles.Error.Render("  !! COPY NOW — this key will NEVER be shown again !!")
-	nameLine := fmt.Sprintf("  Key name:  %s", styleBold.Render(m.revealedAPIKey.Name))
+	nameLine := fmt.Sprintf("  Key name:  %s", m.styles.Bold.Render(m.revealedAPIKey.Name))
 	idLine := fmt.Sprintf("  Key ID:    %s   %s",
-		styleBold.Render(fmt.Sprintf("%d", m.revealedAPIKey.ID)),
+		m.styles.Bold.Render(fmt.Sprintf("%d", m.revealedAPIKey.ID)),
-		styleMuted.Render("(save this — needed for future revocation)"))
+		m.styles.Muted.Render("(save this — needed for future revocation)"))
 
-	keyLine := styleResolved.Render("  " + m.revealedAPIKey.Key)
+	keyLine := m.styles.Resolved.Render("  " + m.revealedAPIKey.Key)
 
 	return "\n" + sep + "\n\n" +
 		warn + "\n\n" +
 		nameLine + "\n" +
 		idLine + "\n\n" +
-		styleMuted.Render("  Key value:") + "\n" +
+		m.styles.Muted.Render("  Key value:") + "\n" +
 		keyLine + "\n\n" +
 		sep + "\n"
 }
 
 func (m Model) renderAPIKeyRevokeByID() string {
-	header := fmt.Sprintf("\n  Revoke API key for %s\n", styleBold.Render(m.selectedUser.Username))
+	header := fmt.Sprintf("\n  Revoke API key for %s\n", m.styles.Bold.Render(m.selectedUser.Username))
-	hint := styleMuted.Render("  Enter the integer key ID (shown when the key was created).\n")
+	hint := line(m.styles.Muted, "  Enter the integer key ID (shown when the key was created).")
-	label := styleSelected.Render("  Key ID:  ")
+	label := m.styles.Selected.Render("  Key ID:  ")
 	return header + "\n" + hint + "\n" + label + m.apiKeyRevokeInput.View() + "\n"
 }
 
 // ── Helpers ────────────────────────────────────────────────────────────────
 
-func divider(title string, width int) string {
+func divider(s Styles, title string, width int) string {
 	prefix := "── "
 	if title != "" {
 		prefix += title + " "
@@ -773,7 +935,7 @@ func divider(title string, width int) string {
 	if remaining > 0 {
 		prefix += strings.Repeat("─", remaining)
 	}
-	return styleMuted.Render(prefix) + "\n"
+	return s.Muted.Render(prefix) + "\n"
 }
 
 func sortedKeys(m map[string]string) []string {
@@ -796,12 +958,19 @@ func renderBarWidth(count, maxCount, maxWidth int) int {
 	return w
 }
 
+// truncate shortens s to max terminal cells, marking the cut with an ellipsis.
+//
+// Counted in runes rather than bytes: these strings are laid out against
+// fixed-width columns, and a byte cut through a multi-byte rune would both
+// mis-measure the column and emit a broken character. Server-supplied text —
+// labels, annotations, delivery errors — is not guaranteed to be ASCII.
 func truncate(s string, max int) string {
 	if max < 1 {
 		return ""
 	}
-	if len(s) <= max {
+	r := []rune(s)
+	if len(r) <= max {
 		return s
 	}
-	return s[:max-1] + "…"
+	return string(r[:max-1]) + "…"
 }

internal/tui/view_test.go

@@ -0,0 +1,351 @@
+package tui
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// ansi matches the escape sequences lipgloss emits when it decides the output
+// supports colour, so assertions can be made against the text alone.
+var ansi = regexp.MustCompile(`\x1b\[[0-9;]*m`)
+
+func plain(s string) string { return ansi.ReplaceAllString(s, "") }
+
+// testStyles is the default theme, so assertions here run against what a user
+// with no 'theme:' key actually sees.
+func testStyles() Styles { return newStyles(theme.GruvboxDark) }
+
+func mustContain(t *testing.T, got string, wants ...string) {
+	t.Helper()
+	got = plain(got)
+	for _, w := range wants {
+		if !strings.Contains(got, w) {
+			t.Errorf("expected output to contain %q\n--- got ---\n%s", w, got)
+		}
+	}
+}
+
+func TestIncidentDetail_RendersTheWholeStory(t *testing.T) {
+	now := time.Now()
+	ackID := int64(1)
+	alertID := int64(3)
+	inc := api.Incident{
+		ID: 1, Title: "DiskFull (namespace=prod)", Status: api.StatusAcknowledged,
+		Severity:    "critical",
+		GroupLabels: map[string]string{"alertname": "DiskFull", "namespace": "prod"},
+		TriggeredAt: now.Add(-2 * time.Hour),
+		AssignedTo:  "admin", AcknowledgedByID: &ackID, AcknowledgedBy: "admin",
+		AcknowledgedAt: &now,
+		Alerts: []api.Alert{
+			{ID: 3, Name: "DiskFull", Status: "firing",
+				Labels: map[string]string{"instance": "node-1"}, ReceivedAt: now},
+			{ID: 4, Name: "DiskFull", Status: "resolved",
+				Labels: map[string]string{"instance": "node-2"}, ReceivedAt: now},
+		},
+	}
+	timeline := []api.IncidentEvent{
+		{Type: api.EventTriggered, CreatedAt: now},
+		{Type: api.EventAssigned, Username: "admin", CreatedAt: now},
+		{Type: api.EventAlertAdded, AlertID: &alertID, CreatedAt: now},
+		{Type: api.EventAcknowledged, Username: "admin", CreatedAt: now},
+		{Type: api.EventNote, Username: "admin", Detail: "draining node-2", CreatedAt: now},
+	}
+
+	out := buildIncidentDetailContent(testStyles(), inc, timeline, -1, 110)
+	mustContain(t, out,
+		"DiskFull (namespace=prod)", "ACKNOWLEDGED", "CRITICAL",
+		"Assigned:", "admin",
+		"Grouped By", "namespace", "prod",
+		"Alerts (2)", "node-1", "node-2",
+		"Timeline (5 events, 1 notes)",
+		"Incident opened", "Assigned to admin", "Alert #3 joined", "Acknowledged by admin",
+		"admin wrote", "draining node-2",
+	)
+}
+
+func TestIncidentDetail_ShowsSnooze(t *testing.T) {
+	future := time.Now().Add(2 * time.Hour)
+	inc := api.Incident{
+		Title: "Noisy", Status: api.StatusTriggered,
+		TriggeredAt: time.Now(), SnoozedUntil: &future,
+	}
+	// The exact remaining time is humanUntil's business, not this test's — a few
+	// microseconds of elapsed clock turn "in 2h" into "in 1h 59m".
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110),
+		"TRIGGERED (snoozed)", "Snoozed:", "until", "in 1h")
+}
+
+// An expired snooze is not a snooze, so it must not be reported as one.
+func TestIncidentDetail_HidesExpiredSnooze(t *testing.T) {
+	past := time.Now().Add(-time.Hour)
+	inc := api.Incident{
+		Title: "Noisy", Status: api.StatusTriggered,
+		TriggeredAt: time.Now(), SnoozedUntil: &past,
+	}
+	if strings.Contains(plain(buildIncidentDetailContent(testStyles(), inc, nil, -1, 110)), "Snoozed:") {
+		t.Error("an expired snooze should not be rendered")
+	}
+}
+
+func TestIncidentDetail_ShowsResolutionSource(t *testing.T) {
+	now := time.Now()
+	source := "manual"
+	inc := api.Incident{
+		Title: "Done", Status: api.StatusResolved, TriggeredAt: now.Add(-time.Hour),
+		ResolvedAt: &now, ResolutionSource: &source,
+	}
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110),
+		"RESOLVED", "Resolved:", "manual")
+}
+
+func TestIncidentDetail_UnassignedAndUnacknowledged(t *testing.T) {
+	inc := api.Incident{Title: "Fresh", Status: api.StatusTriggered, TriggeredAt: time.Now()}
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110), "nobody", "not acknowledged")
+}
+
+func TestIncidentDetail_EmptyTimeline(t *testing.T) {
+	inc := api.Incident{Title: "Fresh", Status: api.StatusTriggered, TriggeredAt: time.Now()}
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110), "Nothing recorded yet")
+}
+
+func TestIncidentDetail_MarksSelectedNote(t *testing.T) {
+	now := time.Now()
+	timeline := []api.IncidentEvent{
+		{Type: api.EventNote, Username: "admin", Detail: "first", CreatedAt: now},
+		{Type: api.EventNote, Username: "alice", Detail: "second", CreatedAt: now},
+	}
+	inc := api.Incident{Title: "X", Status: api.StatusTriggered, TriggeredAt: now}
+
+	out := plain(buildIncidentDetailContent(testStyles(), inc, timeline, 1, 110))
+	for _, line := range strings.Split(out, "\n") {
+		if strings.Contains(line, "alice") && !strings.HasPrefix(line, "> ") {
+			t.Errorf("expected the selected note marked, got %q", line)
+		}
+		if strings.Contains(line, "admin wrote") && strings.HasPrefix(line, "> ") {
+			t.Errorf("expected the unselected note unmarked, got %q", line)
+		}
+	}
+}
+
+func TestIncidentStatusLabel(t *testing.T) {
+	future := time.Now().Add(time.Hour)
+	tests := []struct {
+		name string
+		inc  api.Incident
+		want string
+	}{
+		{"triggered", api.Incident{Status: api.StatusTriggered}, "● TRIGGERED"},
+		{"acknowledged", api.Incident{Status: api.StatusAcknowledged}, "◐ ACKNOWLEDGED"},
+		{"resolved", api.Incident{Status: api.StatusResolved}, "✓ RESOLVED"},
+		{"snoozed", api.Incident{Status: api.StatusTriggered, SnoozedUntil: &future},
+			"● TRIGGERED (snoozed)"},
+		// A status this client does not know about still has to render.
+		{"unknown", api.Incident{Status: "escalated"}, "ESCALATED"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := incidentStatusLabel(tt.inc); got != tt.want {
+				t.Errorf("expected %q, got %q", tt.want, got)
+			}
+		})
+	}
+}
+
+// The server may add event types after this client ships. An unknown one must
+// still appear on the timeline rather than silently vanishing.
+func TestEventLabel_UnknownTypeFallsBackToItsName(t *testing.T) {
+	got := eventLabel(api.IncidentEvent{Type: "escalated", Detail: "to sre-oncall"})
+	mustContain(t, got, "escalated", "to sre-oncall")
+}
+
+func TestEventLabel_KnownTypes(t *testing.T) {
+	alertID := int64(9)
+	tests := []struct {
+		event api.IncidentEvent
+		want  string
+	}{
+		{api.IncidentEvent{Type: api.EventTriggered}, "Incident opened"},
+		{api.IncidentEvent{Type: api.EventAlertAdded, AlertID: &alertID}, "Alert #9 joined"},
+		{api.IncidentEvent{Type: api.EventAlertResolved, AlertID: &alertID}, "Alert #9 resolved"},
+		{api.IncidentEvent{Type: api.EventAcknowledged, Username: "bo"}, "Acknowledged by bo"},
+		{api.IncidentEvent{Type: api.EventAssigned, Username: "bo"}, "Assigned to bo"},
+		{api.IncidentEvent{Type: api.EventSnoozed, Detail: "2026-08-01T00:00:00Z"},
+			"Snoozed until 2026-08-01T00:00:00Z"},
+		{api.IncidentEvent{Type: api.EventResolved, Username: "bo"}, "Resolved by bo"},
+		// No user means the server closed it via the alert cascade.
+		{api.IncidentEvent{Type: api.EventResolved}, "all alerts stopped firing"},
+		{api.IncidentEvent{Type: api.EventNotified, Username: "bo", Detail: "triggered"},
+			"Notified bo (triggered)"},
+		{api.IncidentEvent{Type: api.EventNotified, Username: "bo", Detail: "reminder"},
+			"Notified bo (reminder)"},
+		// On a notification, no user means the shared fallback topic — not that
+		// the server acted on its own.
+		{api.IncidentEvent{Type: api.EventNotified, Detail: "triggered"},
+			"Notified the fallback topic (triggered)"},
+		{api.IncidentEvent{Type: api.EventNotifyFailed, Username: "bo", Detail: "triggered: ntfy returned 502"},
+			"Notification to bo failed"},
+		{api.IncidentEvent{Type: api.EventNotifyFailed, Detail: "triggered: no route to host"},
+			"Notification to the fallback topic failed"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.event.Type, func(t *testing.T) {
+			mustContain(t, eventLabel(tt.event), tt.want)
+		})
+	}
+}
+
+// The timeline is where a page that never landed becomes visible, so both
+// outcomes have to survive into the rendered pane.
+func TestIncidentDetail_RendersNotifications(t *testing.T) {
+	now := time.Now()
+	inc := api.Incident{ID: 1, Title: "DiskFull", Status: api.StatusTriggered, TriggeredAt: now}
+	timeline := []api.IncidentEvent{
+		{Type: api.EventTriggered, CreatedAt: now},
+		{Type: api.EventNotified, Username: "niklas", Detail: "triggered", CreatedAt: now},
+		{Type: api.EventNotifyFailed, Username: "niklas",
+			Detail: "reminder: ntfy returned 502", CreatedAt: now},
+	}
+
+	got := buildIncidentDetailContent(testStyles(), inc, timeline, -1, 120)
+	mustContain(t, got, "Notified niklas (triggered)", "Notification to niklas failed")
+}
+
+func TestUserNotifyEdit_SaysWhatAnEmptyValueDoes(t *testing.T) {
+	m := sized()
+	m.mode = modeUserNotifyEdit
+	m.selectedUser = api.User{ID: 1, Username: "niklas"}
+
+	mustContain(t, m.View(), "niklas", "empty to clear it", "fallback topic")
+	// The footer has to repeat it: that is where the reader looks for what a key does.
+	mustContain(t, m.renderFooter(), "empty clears the topic")
+}
+
+func TestAlertDetail_SaysItIsReadOnlyAndLinksTheIncident(t *testing.T) {
+	now := time.Now()
+	id := int64(7)
+	alert := api.Alert{
+		ID: 3, Name: "DiskFull", Status: "firing", StartsAt: now.Add(-time.Hour),
+		ReceivedAt: now, IncidentID: &id,
+		Labels:      map[string]string{"instance": "node-1", "severity": "critical"},
+		Annotations: map[string]string{"summary": "disk 90%"},
+	}
+	mustContain(t, buildAlertDetailContent(testStyles(), alert, 110),
+		"DiskFull", "FIRING", "Incident:", "#7", "press i to open it",
+		"instance", "node-1", "summary", "disk 90%",
+		"Alerts are read-only")
+}
+
+func TestAlertDetail_NoIncident(t *testing.T) {
+	alert := api.Alert{ID: 3, Name: "Orphan", Status: "resolved", ReceivedAt: time.Now()}
+	mustContain(t, buildAlertDetailContent(testStyles(), alert, 110), "Incident:", "none")
+}
+
+func TestAlertDetail_ShowsResolutionSource(t *testing.T) {
+	source := "expiry"
+	alert := api.Alert{Name: "Gone", Status: "resolved", ReceivedAt: time.Now(),
+		ResolutionSource: &source}
+	mustContain(t, buildAlertDetailContent(testStyles(), alert, 110), "RESOLVED", "expiry")
+}
+
+// Null MTTA means nothing has been acknowledged, which is a different claim
+// from an instant response.
+func TestStats_RendersDashForMissingAverages(t *testing.T) {
+	stats := &api.IncidentStats{Total: 2, Triggered: 2}
+	out := buildStatsContent(testStyles(), stats, nil, nil, nil, 110)
+	mustContain(t, out, "Incident Response", "Mean time to acknowledge", "—",
+		"nothing has been acknowledged or resolved yet")
+}
+
+func TestStats_RendersAverages(t *testing.T) {
+	mtta, mttr := 150.0, 3600.0
+	stats := &api.IncidentStats{Total: 3, Resolved: 1, MTTASeconds: &mtta, MTTRSeconds: &mttr}
+	out := buildStatsContent(testStyles(), stats, []api.TopAlert{{Name: "DiskFull", Count: 4}}, nil, nil, 110)
+	mustContain(t, out, "2m", "1h", "Top Alerts", "DiskFull")
+}
+
+func TestStats_HandlesNoIncidentData(t *testing.T) {
+	mustContain(t, buildStatsContent(testStyles(), nil, nil, nil, nil, 110), "Incident Response", "No data")
+}
+
+func TestView_TabsAndDashboardRender(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{{
+		ID: 1, Title: "DiskFull", Status: api.StatusTriggered, Severity: "critical",
+		AssignedTo: "admin", TriggeredAt: time.Now(),
+	}}
+	m.incidentStats = &api.IncidentStats{Triggered: 1}
+	m.rebuildIncidentTable()
+
+	mustContain(t, m.View(),
+		"Incidents", "Alerts", "Stats", "Archived", "Schedule", "Users",
+		"Triggered: 1", "filter: open",
+		"DiskFull", "critical", "admin",
+		"enter·detail")
+}
+
+func TestView_EmptyStates(t *testing.T) {
+	m := sized()
+	m.loading = false
+	mustContain(t, m.View(), "No open incidents.")
+
+	m.activeSection = sectionArchived
+	mustContain(t, m.View(), "No archived incidents.")
+}
+
+// The stats page renders inside the normal section chrome now, so it has to
+// survive the real path: a window size message sizes the viewport and fills it.
+func TestView_StatsSectionRendersInPlace(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.connected = true
+	m.incidentStats = &api.IncidentStats{Total: 3, Triggered: 1}
+	m.topAlerts = []api.TopAlert{{Name: "DiskFull", Count: 4}}
+	m.statsLoaded = true
+
+	next, _ := m.Update(tea.WindowSizeMsg{Width: 120, Height: 40})
+	m = next.(Model)
+	m.activeSection = sectionStats
+
+	out := m.View()
+	mustContain(t, out, "Stats", "Incident Response", "Top Alerts", "DiskFull",
+		"tab·section")
+	if strings.Contains(plain(out), "Loading statistics") {
+		t.Error("loaded stats should not show the loading placeholder")
+	}
+}
+
+func TestView_ConnectionError(t *testing.T) {
+	m := sized()
+	m.connected = false
+	m.err = errFixture{}
+	mustContain(t, m.View(), "Error:", "Press r to retry")
+}
+
+// The footer is the only place the terminal states are explained, so the
+// destructive one has to be visible before it is pressed.
+func TestFooter_IncidentDetailOffersResolveOnlyWhileOpen(t *testing.T) {
+	open := onIncident(openIncidentFixture(), nil)
+	mustContain(t, open.renderFooter(), "R·resolve", "z·snooze", "a·ack")
+
+	closed := onIncident(resolvedIncidentFixture(), nil)
+	if strings.Contains(plain(closed.renderFooter()), "R·resolve") {
+		t.Error("a resolved incident should not offer resolve")
+	}
+	mustContain(t, closed.renderFooter(), "x·archive", "c·note")
+}
+
+func TestView_ZeroWidthRendersNothing(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	if m.View() != "" {
+		t.Error("expected no output before the first window size message")
+	}
+}
+
+type errFixture struct{}
+
+func (errFixture) Error() string { return "connection refused" }

internal/updater/updater.go

@@ -12,7 +12,14 @@ import (
 	"strings"
 )
 
-const releaseAPI = "https://api.github.com/repos/yeniklas/terdut-tui/releases/latest"
+// Gitea's release payload carries the same tag_name, and its attachments the same name
+// and browser_download_url, so the types below are unchanged from the GitHub original.
+//
+// A binary installed before the move still polls api.github.com and will never see a
+// release published here. That GitHub repository is still in place, so such a build
+// reports itself up to date rather than erroring -- its last GitHub release is the
+// bridge, and crossing it is a one-time manual download.
+const releaseAPI = "https://git.ryuvia.com/api/v1/repos/niklas/terdut-tui/releases/latest"
 
 type release struct {
 	TagName string  `json:"tag_name"`
@@ -125,7 +132,7 @@ func fetchLatest() (*release, error) {
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("Accept", "application/json")
 
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
@@ -134,7 +141,7 @@ func fetchLatest() (*release, error) {
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("GitHub API returned %s", resp.Status)
+		return nil, fmt.Errorf("Gitea API returned %s", resp.Status)
 	}
 
 	var rel release

main.go

@@ -5,11 +5,12 @@ import (
 	"fmt"
 	"os"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/config"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	"git.ryuvia.com/niklas/terdut-tui/internal/tui"
+	"git.ryuvia.com/niklas/terdut-tui/internal/updater"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/yeniklas/terdut-tui/internal/api"
-	"github.com/yeniklas/terdut-tui/internal/config"
-	"github.com/yeniklas/terdut-tui/internal/tui"
-	"github.com/yeniklas/terdut-tui/internal/updater"
 )
 
 var version = "dev"
@@ -38,8 +39,14 @@ func main() {
 		os.Exit(1)
 	}
 
+	th, err := theme.Load(cfg.Theme)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+
 	client := api.NewClient(cfg.ServerURL, cfg.APIKey)
-	model := tui.NewModel(client, cfg.ServerURL, cfg.RefreshInterval)
+	model := tui.NewModel(client, cfg.ServerURL, cfg.RefreshInterval, th).WithDefaultTeam(cfg.Team)
 
 	p := tea.NewProgram(model, tea.WithAltScreen())
 	if _, err := p.Run(); err != nil {