feat: reassign on-call days and weeks to another person

Assigning over a day somebody else held did nothing but flash a 409 for
three seconds. The server holds one person per date and refused any that
was taken, all-or-nothing, so pressing W on a week where a single day was
already assigned placed none of the other six either. The only way
through was d on each day first — seven delete-and-confirm cycles to move
one week.

The clash is already on screen, so it is found before the request rather
than read back out of an error: the picker hands off to a confirmation
naming who loses the days and how many there are, and accepting sends the
whole selection with replace, which terdut-server v0.8.0 added. One
question to move a week, and nobody's shift moves without somebody being
asked. A day nobody holds still assigns with no prompt at all.

Reassigning somebody to a day they already hold raises no prompt, since
it takes nothing from anyone, but it does send replace: the server
rejects any date that exists, so without it a harmless no-op would fail.

.github/workflows/ci.yml

@@ -0,0 +1,32 @@
+name: CI
+
+# The release workflow gates a tag, which is late: a broken commit sits green
+# until somebody decides to publish. This runs the same checks on the way in.
+#
+# push is scoped to main so that a branch pushed as part of a pull request is
+# not checked twice.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# A rapid series of pushes only needs the last one checked.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...

.github/workflows/release.yml

@@ -6,7 +6,26 @@ on:
       - 'v*'
 
 jobs:
+  # Gates the build, so a tag that fails here publishes no binaries. The suite
+  # covers the API client against a stub server, the Update state machine, and
+  # View rendering — all three are pure enough to test without a terminal.
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
   build:
+    needs: test
     runs-on: ubuntu-latest
     strategy:
       matrix:

CLAUDE.md

@@ -73,6 +73,7 @@ go build -ldflags="-X main.version=v0.1.0" -o terdut-tui .
 ## Sections
 
 `Incidents` (the queue, and the default) · `Alerts` (raw read-only feed) ·
+`Stats` (MTTA/MTTR and alert frequency charts) ·
 `Archived` (archived incidents) · `Schedule` · `Users`
 
 ## Development stages

README.md

@@ -8,11 +8,11 @@ Written in Go using [Bubbletea](https://github.com/charmbracelet/bubbletea).
 
 - **Incident queue** — open incidents with severity, status, assignee and age, auto-refreshing
 - **Incident actions** — acknowledge, assign, snooze, note, resolve and archive
-- **Timeline** — the full history of an incident, system events and notes together
+- **Timeline** — the full history of an incident, system events, pages and notes together
 - **Alert feed** — the raw read-only alerts underneath, each linked to its incident
 - **On-call schedule** — visual calendar of who is on duty, assign and remove entries
 - **Statistics** — MTTA and MTTR, plus alert frequency by name, hour and day
-- **User management** — add and remove users, manage API keys
+- **User management** — add and remove users, manage API keys, set each user's ntfy topic
 
 > Requires terdut-server **v0.4.0 or later**. Earlier servers have no incidents API;
 > use terdut-tui v0.3.x with those.
@@ -37,6 +37,22 @@ Two behaviours worth knowing before you press a key:
 - **Snooze is the "not now" button.** It hides an incident from the default queue
   without closing it, and expires on its own.
 
+## Push notifications
+
+When the server is configured for ntfy, an incident that opens pages whoever is
+on call. Each user has their own topic, shown as a column in the Users section
+and edited with `t`. A user with no topic falls back to the server's shared
+fallback topic, which carries **no Acknowledge button** — the topic is shared, so
+a button on it would let any subscriber acknowledge as somebody else.
+
+Every delivery lands on the incident's timeline: `Notified <user> (triggered)`
+when ntfy accepted the page, and `Notification to <user> failed` when it ran out
+of retries. That second one is the one to look for when nobody's phone rang.
+
+Editing topics needs terdut-server **v0.6.0 or later**; the timeline entries need
+**v0.7.0 or later**. Against an older server the topic column stays empty and
+editing one reports the server's 404.
+
 ## Installation
 
 Download the latest release binary for your platform from the [releases page](https://github.com/yeniklas/terdut-tui/releases), or build from source:
@@ -78,9 +94,10 @@ Global:
 | `esc` | Go back |
 | `r` | Refresh |
 | `f` | Cycle filter |
-| `S` | Statistics |
 | `q` | Quit |
 
+The sections, in `tab` order: Incidents · Alerts · Stats · Archived · Schedule · Users.
+
 Incidents section:
 
 | Key | Action |
@@ -108,6 +125,12 @@ Alerts section (read-only):
 | `f` | Cycle: firing → resolved → all → archived |
 | `i` | In detail: jump to the alert's incident |
 
+Stats section:
+
+| Key | Action |
+|-----|--------|
+| `j` / `k`, `pgup` / `pgdn` | Scroll |
+
 Schedule section:
 
 | Key | Action |
@@ -116,10 +139,18 @@ Schedule section:
 | `d` | Remove the assignment |
 | `←` / `→` | Shift the week window |
 
+One person holds a given day. Assigning over days somebody else already has
+asks first — naming them and how many days are being taken — and moves the whole
+selection at once when you accept, so reassigning a week is one confirmation
+rather than seven deletions. Taking somebody's shift needs terdut-server
+**v0.8.0 or later**; against an older server the assignment is refused with
+`date already assigned`.
+
 Users section:
 
 | Key | Action |
 |-----|--------|
 | `n` | Create a user |
+| `t` | Edit the user's ntfy topic — submit empty to clear it |
 | `d` | Delete a user |
 | `k` | API keys for the selected user |

internal/api/client.go

@@ -358,11 +358,17 @@ func (c *Client) GetCurrentOnCall() (*ScheduleEntry, error) {
 	return &entry, nil
 }
 
-func (c *Client) AssignSchedule(userID int64, dates []string) ([]ScheduleEntry, error) {
+// AssignSchedule puts one user on call for the given dates.
+//
+// The server holds one person per day and refuses a date somebody already has,
+// so replace is what takes a shift off its current holder. It is all-or-nothing
+// either way: a week of free and taken days moves as a unit, or not at all.
+func (c *Client) AssignSchedule(userID int64, dates []string, replace bool) ([]ScheduleEntry, error) {
 	body := struct {
 		UserID  int64    `json:"user_id"`
 		Dates   []string `json:"dates"`
-	}{UserID: userID, Dates: dates}
+		Replace bool     `json:"replace,omitempty"`
+	}{UserID: userID, Dates: dates, Replace: replace}
 	req, err := c.newRequestWithBody(http.MethodPost, "/api/schedule", body)
 	if err != nil {
 		return nil, err
@@ -401,6 +407,23 @@ func (c *Client) CreateUser(username, email string) (*User, error) {
 	return &user, c.do(req, &user)
 }
 
+// SetUserNotifyTarget points a user's push notifications at an ntfy topic.
+//
+// An empty topic clears it: the server stores NULL, and that user's incidents
+// page the shared fallback topic instead — which carries no Acknowledge button,
+// because anyone subscribed to it could otherwise acknowledge as somebody else.
+func (c *Client) SetUserNotifyTarget(userID int64, topic string) (*User, error) {
+	body := struct {
+		NtfyTopic string `json:"ntfy_topic"`
+	}{NtfyTopic: topic}
+	req, err := c.newRequestWithBody(http.MethodPut, fmt.Sprintf("/api/users/%d/notify", userID), body)
+	if err != nil {
+		return nil, err
+	}
+	var user User
+	return &user, c.do(req, &user)
+}
+
 func (c *Client) DeleteUser(id int64) error {
 	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/users/%d", id))
 	if err != nil {

internal/api/client_test.go

@@ -0,0 +1,365 @@
+package api
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+// call records what the client actually put on the wire. The paths and methods
+// are the contract with terdut-server, and getting one wrong is exactly how this
+// client broke when the server split alerts from incidents.
+type call struct {
+	method string
+	path   string
+	query  string
+	body   string
+	auth   string
+}
+
+// stub serves one canned response and records the request that fetched it.
+func stub(t *testing.T, status int, response string) (*Client, *call) {
+	t.Helper()
+	got := &call{}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		got.method, got.path, got.query = r.Method, r.URL.Path, r.URL.RawQuery
+		got.body, got.auth = string(body), r.Header.Get("Authorization")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(status)
+		io.WriteString(w, response)
+	}))
+	t.Cleanup(srv.Close)
+	return NewClient(srv.URL, "test-key"), got
+}
+
+func TestClient_SendsBearerToken(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[]`)
+	if _, err := c.ListIncidents("", false, false, 0); err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	if got.auth != "Bearer test-key" {
+		t.Errorf("expected bearer token, got %q", got.auth)
+	}
+}
+
+// Every incident action, with the method and path terdut-server exposes.
+func TestClient_IncidentEndpoints(t *testing.T) {
+	tests := []struct {
+		name   string
+		invoke func(*Client) error
+		method string
+		path   string
+		// resp defaults to a JSON object; endpoints returning a list need an array.
+		resp string
+	}{
+		{"get", func(c *Client) error { _, err := c.GetIncident(7); return err },
+			http.MethodGet, "/api/incidents/7", ""},
+		{"timeline", func(c *Client) error { _, err := c.GetIncidentTimeline(7); return err },
+			http.MethodGet, "/api/incidents/7/timeline", `[]`},
+		{"acknowledge", func(c *Client) error { _, err := c.AcknowledgeIncident(7); return err },
+			http.MethodPost, "/api/incidents/7/acknowledge", ""},
+		{"unacknowledge", func(c *Client) error { return c.UnacknowledgeIncident(7) },
+			http.MethodDelete, "/api/incidents/7/acknowledge", ""},
+		{"resolve", func(c *Client) error { _, err := c.ResolveIncident(7); return err },
+			http.MethodPost, "/api/incidents/7/resolve", ""},
+		{"assign", func(c *Client) error { _, err := c.AssignIncident(7, 3); return err },
+			http.MethodPost, "/api/incidents/7/assign", ""},
+		{"snooze", func(c *Client) error { _, err := c.SnoozeIncident(7, "2h"); return err },
+			http.MethodPost, "/api/incidents/7/snooze", ""},
+		{"unsnooze", func(c *Client) error { return c.UnsnoozeIncident(7) },
+			http.MethodDelete, "/api/incidents/7/snooze", ""},
+		{"archive", func(c *Client) error { _, err := c.ArchiveIncident(7); return err },
+			http.MethodPost, "/api/incidents/7/archive", ""},
+		{"unarchive", func(c *Client) error { return c.UnarchiveIncident(7) },
+			http.MethodDelete, "/api/incidents/7/archive", ""},
+		{"add note", func(c *Client) error { _, err := c.AddNote(7, "hi"); return err },
+			http.MethodPost, "/api/incidents/7/notes", ""},
+		{"delete note", func(c *Client) error { return c.DeleteNote(7, 12) },
+			http.MethodDelete, "/api/incidents/7/notes/12", ""},
+		{"stats", func(c *Client) error { _, err := c.GetIncidentStats(); return err },
+			http.MethodGet, "/api/stats/incidents", ""},
+		{"set notify target", func(c *Client) error { _, err := c.SetUserNotifyTarget(7, "t"); return err },
+			http.MethodPut, "/api/users/7/notify", ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resp := tt.resp
+			if resp == "" {
+				resp = `{}`
+			}
+			c, got := stub(t, http.StatusOK, resp)
+			if err := tt.invoke(c); err != nil {
+				t.Fatalf("%s: %v", tt.name, err)
+			}
+			if got.method != tt.method || got.path != tt.path {
+				t.Errorf("expected %s %s, got %s %s", tt.method, tt.path, got.method, got.path)
+			}
+		})
+	}
+}
+
+func TestListIncidents_Filters(t *testing.T) {
+	tests := []struct {
+		name     string
+		status   string
+		archived bool
+		snoozed  bool
+		limit    int
+		want     string
+	}{
+		{"default is the open queue", "", false, false, 0, ""},
+		{"status", "triggered", false, false, 0, "status=triggered"},
+		{"archived", "resolved", true, false, 0, "archived=true&status=resolved"},
+		{"snoozed", "", false, true, 0, "snoozed=true"},
+		{"limit", "", false, false, 500, "limit=500"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c, got := stub(t, http.StatusOK, `[]`)
+			if _, err := c.ListIncidents(tt.status, tt.archived, tt.snoozed, tt.limit); err != nil {
+				t.Fatalf("list: %v", err)
+			}
+			if got.query != tt.want {
+				t.Errorf("expected query %q, got %q", tt.want, got.query)
+			}
+		})
+	}
+}
+
+func TestClient_RequestBodies(t *testing.T) {
+	t.Run("assign", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.AssignIncident(1, 42); err != nil {
+			t.Fatalf("assign: %v", err)
+		}
+		var body struct {
+			UserID int64 `json:"user_id"`
+		}
+		if err := json.Unmarshal([]byte(got.body), &body); err != nil {
+			t.Fatalf("decode body %q: %v", got.body, err)
+		}
+		if body.UserID != 42 {
+			t.Errorf("expected user_id 42, got %d", body.UserID)
+		}
+	})
+
+	t.Run("snooze", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.SnoozeIncident(1, "90m"); err != nil {
+			t.Fatalf("snooze: %v", err)
+		}
+		var body struct {
+			Duration string `json:"duration"`
+		}
+		if err := json.Unmarshal([]byte(got.body), &body); err != nil {
+			t.Fatalf("decode body %q: %v", got.body, err)
+		}
+		if body.Duration != "90m" {
+			t.Errorf("expected duration 90m, got %q", body.Duration)
+		}
+	})
+
+	// replace is what takes a day off its current holder, so it has to reach the
+	// wire when asked for — and stay off it when not.
+	t.Run("assign schedule", func(t *testing.T) {
+		c, got := stub(t, http.StatusCreated, `[]`)
+		if _, err := c.AssignSchedule(3, []string{"2026-07-27"}, false); err != nil {
+			t.Fatalf("assign: %v", err)
+		}
+		if got.body != `{"user_id":3,"dates":["2026-07-27"]}` {
+			t.Errorf("unexpected body %q", got.body)
+		}
+	})
+
+	t.Run("assign schedule with replace", func(t *testing.T) {
+		c, got := stub(t, http.StatusCreated, `[]`)
+		if _, err := c.AssignSchedule(3, []string{"2026-07-27"}, true); err != nil {
+			t.Fatalf("assign: %v", err)
+		}
+		if got.body != `{"user_id":3,"dates":["2026-07-27"],"replace":true}` {
+			t.Errorf("unexpected body %q", got.body)
+		}
+	})
+
+	t.Run("set notify target", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.SetUserNotifyTarget(3, "terdut-niklas"); err != nil {
+			t.Fatalf("set notify target: %v", err)
+		}
+		if got.body != `{"ntfy_topic":"terdut-niklas"}` {
+			t.Errorf("unexpected body %q", got.body)
+		}
+	})
+
+	// Clearing has to put an explicit empty string on the wire: omitting the
+	// field would leave the topic untouched instead of removing it.
+	t.Run("clear notify target", func(t *testing.T) {
+		c, got := stub(t, http.StatusOK, `{}`)
+		if _, err := c.SetUserNotifyTarget(3, ""); err != nil {
+			t.Fatalf("clear notify target: %v", err)
+		}
+		if got.body != `{"ntfy_topic":""}` {
+			t.Errorf("expected an explicit empty topic, got %q", got.body)
+		}
+	})
+}
+
+func TestUser_TopicFlattensNilAndEmpty(t *testing.T) {
+	var users []User
+	if err := json.Unmarshal([]byte(
+		`[{"id":1,"username":"a"},{"id":2,"username":"b","ntfy_topic":""},
+		  {"id":3,"username":"c","ntfy_topic":"terdut-c"}]`), &users); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	want := []string{"", "", "terdut-c"}
+	for i, u := range users {
+		if got := u.Topic(); got != want[i] {
+			t.Errorf("user %d: expected topic %q, got %q", u.ID, want[i], got)
+		}
+	}
+}
+
+// The 409 on re-resolving is the server telling the user why nothing happened,
+// so the message has to survive into the error the TUI displays.
+func TestClient_SurfacesServerErrorMessage(t *testing.T) {
+	c, _ := stub(t, http.StatusConflict, `{"error":"incident is resolved"}`)
+	_, err := c.ResolveIncident(1)
+	if err == nil {
+		t.Fatal("expected an error on 409")
+	}
+	if !strings.Contains(err.Error(), "incident is resolved") || !strings.Contains(err.Error(), "409") {
+		t.Errorf("expected status and server message in %q", err.Error())
+	}
+}
+
+func TestClient_ErrorWithoutBody(t *testing.T) {
+	c, _ := stub(t, http.StatusInternalServerError, ``)
+	if _, err := c.GetIncident(1); err == nil || !strings.Contains(err.Error(), "500") {
+		t.Errorf("expected a 500 error, got %v", err)
+	}
+}
+
+// Nobody on call is a normal state, not a failure.
+func TestGetCurrentOnCall_404IsNotAnError(t *testing.T) {
+	c, _ := stub(t, http.StatusNotFound, `{"error":"no one is on call today"}`)
+	entry, err := c.GetCurrentOnCall()
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+	if entry != nil {
+		t.Errorf("expected nil entry, got %+v", entry)
+	}
+}
+
+// Optional fields are omitted by the server rather than sent null, so decoding
+// has to leave them zero instead of failing.
+func TestIncident_DecodesSparseServerShape(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{
+		"id": 1,
+		"group_key": "{}:{alertname=\"DiskFull\"}",
+		"title": "DiskFull (namespace=prod)",
+		"group_labels": {"alertname": "DiskFull", "namespace": "prod"},
+		"status": "triggered",
+		"severity": "critical",
+		"triggered_at": "2026-07-30T10:00:00Z"
+	}`)
+
+	inc, err := c.GetIncident(1)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if inc.Title != "DiskFull (namespace=prod)" || inc.Severity != "critical" {
+		t.Errorf("unexpected incident %+v", inc)
+	}
+	if inc.GroupLabels["namespace"] != "prod" {
+		t.Errorf("expected group labels decoded, got %v", inc.GroupLabels)
+	}
+	if !inc.IsOpen() {
+		t.Error("an incident with no resolved_at is open")
+	}
+	if inc.IsSnoozed() {
+		t.Error("an incident with no snoozed_until is not snoozed")
+	}
+	if inc.AcknowledgedByID != nil || inc.AssignedToID != nil {
+		t.Error("expected acknowledgement and assignment to be absent")
+	}
+}
+
+// A snooze expires by falling into the past; the server sweeps nothing, so the
+// client is what decides a stale snooze no longer counts.
+func TestIncident_IsSnoozed(t *testing.T) {
+	past := time.Now().Add(-time.Hour)
+	future := time.Now().Add(time.Hour)
+
+	tests := []struct {
+		name  string
+		until *time.Time
+		want  bool
+	}{
+		{"never snoozed", nil, false},
+		{"snooze in the past has expired", &past, false},
+		{"snooze in the future holds", &future, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := (Incident{SnoozedUntil: tt.until}).IsSnoozed(); got != tt.want {
+				t.Errorf("expected %v, got %v", tt.want, got)
+			}
+		})
+	}
+}
+
+func TestIncident_IsOpen(t *testing.T) {
+	now := time.Now()
+	if !(Incident{}).IsOpen() {
+		t.Error("no resolved_at means open")
+	}
+	if (Incident{ResolvedAt: &now}).IsOpen() {
+		t.Error("resolved_at means closed")
+	}
+}
+
+func TestAlert_DecodesIncidentLink(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{"id":3,"name":"DiskFull","status":"firing","incident_id":7}`)
+	a, err := c.GetAlert(3)
+	if err != nil {
+		t.Fatalf("get alert: %v", err)
+	}
+	if a.IncidentID == nil || *a.IncidentID != 7 {
+		t.Errorf("expected incident_id 7, got %v", a.IncidentID)
+	}
+}
+
+func TestListAlerts_ArchivedFilter(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[]`)
+	if _, err := c.ListAlerts("", true, 50); err != nil {
+		t.Fatalf("list alerts: %v", err)
+	}
+	if got.path != "/api/alerts" || got.query != "archived=true&limit=50" {
+		t.Errorf("unexpected request %s?%s", got.path, got.query)
+	}
+}
+
+// MTTA and MTTR are null until something has been acknowledged or resolved. That
+// is "no data", and it must not decode to a confident zero.
+func TestIncidentStats_NullAveragesStayNil(t *testing.T) {
+	c, _ := stub(t, http.StatusOK,
+		`{"total":2,"triggered":2,"acknowledged":0,"resolved":0,"mtta_seconds":null,"mttr_seconds":null}`)
+	stats, err := c.GetIncidentStats()
+	if err != nil {
+		t.Fatalf("stats: %v", err)
+	}
+	if stats.Total != 2 || stats.Triggered != 2 {
+		t.Errorf("unexpected counts %+v", stats)
+	}
+	if stats.MTTASeconds != nil || stats.MTTRSeconds != nil {
+		t.Errorf("expected nil averages, got %v / %v", stats.MTTASeconds, stats.MTTRSeconds)
+	}
+}

internal/api/types.go

@@ -95,6 +95,13 @@ const (
 	EventUnsnoozed      = "unsnoozed"
 	EventResolved       = "resolved"
 	EventNote           = "note"
+
+	// Written by the server's notifier from the delivery result, not at enqueue.
+	// Detail carries the notification kind ("triggered", "reminder", "resolved"),
+	// and on a failure the reason after it. An absent user means the page went to
+	// the shared fallback topic rather than to a person.
+	EventNotified     = "notified"
+	EventNotifyFailed = "notify_failed"
 )
 
 // IncidentEvent is one entry in an incident's timeline. An empty Username means
@@ -158,6 +165,21 @@ type User struct {
 	Username  string    `json:"username"`
 	Email     string    `json:"email"`
 	CreatedAt time.Time `json:"created_at"`
+
+	// NtfyTopic is where this user's push notifications go. Nil and empty mean
+	// the same thing — no topic of their own — because the server stores a blank
+	// string as NULL. Their incidents fall back to the server's shared fallback
+	// topic, which carries no Acknowledge button.
+	NtfyTopic *string `json:"ntfy_topic,omitempty"`
+}
+
+// Topic reads the user's ntfy topic, flattening the nil and empty cases the
+// server treats alike.
+func (u User) Topic() string {
+	if u.NtfyTopic == nil {
+		return ""
+	}
+	return *u.NtfyTopic
 }
 
 type APIKey struct {

internal/tui/model.go

@@ -21,11 +21,12 @@ const (
 	// Incidents lead: they are the work. Alerts is the raw feed underneath.
 	sectionIncidents section = iota
 	sectionAlerts
+	sectionStats
 	sectionArchived
 	sectionSchedule
 	sectionUsers
 
-	sectionCount = 5
+	sectionCount = 6
 )
 
 type mode int
@@ -37,9 +38,9 @@ const (
 	modeNote
 	modeSnooze
 	modeConfirm
-	modeStats
 	modeUserPicker
 	modeUserCreate
+	modeUserNotifyEdit
 	modeAPIKeyMenu
 	modeAPIKeyCreate
 	modeAPIKeyReveal
@@ -53,6 +54,7 @@ const (
 	confirmResolveIncident
 	confirmDeleteScheduleEntry
 	confirmDeleteUser
+	confirmReassignSchedule
 )
 
 // pickerTarget says what the user picker is choosing a person for.
@@ -142,6 +144,18 @@ type scheduleDay struct {
 	entry *api.ScheduleEntry
 }
 
+// pendingAssign is an on-call assignment held back by the reassignment
+// confirmation, because some of its dates belong to somebody else.
+type pendingAssign struct {
+	userID   int64
+	username string
+	dates    []string
+	// taken are the dates currently held by other people, and holders the
+	// distinct names holding them — both only for wording the prompt.
+	taken   []string
+	holders []string
+}
+
 type Model struct {
 	client          *api.Client
 	serverURL       string
@@ -193,16 +207,17 @@ type Model struct {
 	confirmTarget      confirmTarget
 	pendingDeleteID    int64 // note event ID
 	pendingDeleteEntry *api.ScheduleEntry
+	pendingAssign      *pendingAssign
 
 	// Stats
 	topAlerts []api.TopAlert
 	hourStats []api.HourStat
 	dayStats  []api.DayStat
+	// statsLoaded tracks the first fetch separately from emptiness: a server with
+	// no alerts yet legitimately returns three empty slices.
+	statsLoaded   bool
 	statsLoading  bool
 	statsViewport viewport.Model
-	// statsReturnMode is where esc goes back to, since stats opens from both
-	// the dashboard and an incident.
-	statsReturnMode mode
 
 	// Schedule
 	scheduleWindow  time.Time
@@ -224,6 +239,7 @@ type Model struct {
 	selectedUser      api.User
 	userFormInputs    [2]textinput.Model
 	userFormFocus     int
+	ntfyTopicInput    textinput.Model
 	apiKeyNameInput   textinput.Model
 	apiKeyRevokeInput textinput.Model
 	revealedAPIKey    api.APIKey
@@ -253,6 +269,10 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 	manageT := table.New(table.WithFocused(true))
 	manageT.SetStyles(ts)
 
+	// Sized by the first tea.WindowSizeMsg; built here so it carries the default
+	// scroll keymap, which the zero value lacks.
+	statsVP := viewport.New(0, 0)
+
 	noteIn := textinput.New()
 	noteIn.Placeholder = "type your note…"
 	noteIn.CharLimit = 1000
@@ -269,6 +289,10 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 	emailIn.Placeholder = "email"
 	emailIn.CharLimit = 128
 
+	topicIn := textinput.New()
+	topicIn.Placeholder = "ntfy topic — empty clears it"
+	topicIn.CharLimit = 128
+
 	keyNameIn := textinput.New()
 	keyNameIn.Placeholder = "key name (e.g. laptop)"
 	keyNameIn.CharLimit = 64
@@ -298,6 +322,7 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 		incidentTable:     incidentT,
 		alertTable:        alertT,
 		archivedTable:     archivedT,
+		statsViewport:     statsVP,
 		noteInput:         noteIn,
 		snoozeInput:       snoozeIn,
 		scheduleWindow:    window,
@@ -305,6 +330,7 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 		userPickerTable:   pickerT,
 		userManageTable:   manageT,
 		userFormInputs:    [2]textinput.Model{usernameIn, emailIn},
+		ntfyTopicInput:    topicIn,
 		apiKeyNameInput:   keyNameIn,
 		apiKeyRevokeInput: revokeIn,
 		help:              help.New(),
@@ -366,7 +392,11 @@ func (m *Model) rebuildUserManageTable() {
 	m.userManageTable.SetColumns(userManageColumns(m.width))
 	rows := make([]table.Row, len(m.users))
 	for i, u := range m.users {
-		rows[i] = table.Row{u.Username, u.Email, u.CreatedAt.UTC().Format("2006-01-02")}
+		topic := u.Topic()
+		if topic == "" {
+			topic = "—"
+		}
+		rows[i] = table.Row{u.Username, u.Email, topic, u.CreatedAt.UTC().Format("2006-01-02")}
 	}
 	m.userManageTable.SetRows(rows)
 	m.userManageTable.SetHeight(tableHeight(m.height, 10))
@@ -397,6 +427,14 @@ func (m *Model) refreshStatsContent() {
 		buildStatsContent(m.incidentStats, m.topAlerts, m.hourStats, m.dayStats, m.width))
 }
 
+func (m Model) statsViewportHeight() int {
+	h := m.height - 5
+	if h < 1 {
+		h = 1
+	}
+	return h
+}
+
 func (m Model) detailViewportHeight() int {
 	h := m.height - 5
 	if m.mode == modeNote || m.mode == modeSnooze {
@@ -489,13 +527,16 @@ func userPickerColumns(width int) []table.Column {
 func userManageColumns(width int) []table.Column {
 	createdW := 12
 	usernameW := 25
-	emailW := width - usernameW - createdW - 8
+	topicW := 22
+	// 8 = bubbles' Padding(0, 1) on each of the four cells.
+	emailW := width - usernameW - topicW - createdW - 8
 	if emailW < 15 {
 		emailW = 15
 	}
 	return []table.Column{
 		{Title: "Username", Width: usernameW},
 		{Title: "Email", Width: emailW},
+		{Title: "Ntfy Topic", Width: topicW},
 		{Title: "Created", Width: createdW},
 	}
 }
@@ -839,9 +880,9 @@ func fetchScheduleCmd(client *api.Client, from, to time.Time) tea.Cmd {
 	}
 }
 
-func assignScheduleCmd(client *api.Client, userID int64, dates []string, from, to time.Time) tea.Cmd {
+func assignScheduleCmd(client *api.Client, userID int64, dates []string, replace bool, from, to time.Time) tea.Cmd {
 	return func() tea.Msg {
-		if _, err := client.AssignSchedule(userID, dates); err != nil {
+		if _, err := client.AssignSchedule(userID, dates, replace); err != nil {
 			return scheduleActionErrMsg{err}
 		}
 		entries, err := client.GetSchedule(from.Format("2006-01-02"), to.Format("2006-01-02"))
@@ -896,6 +937,22 @@ func createUserCmd(client *api.Client, username, email string) tea.Cmd {
 	}
 }
 
+// setUserNotifyTargetCmd points a user's pages at a topic, or clears it when
+// topic is empty. It re-lists afterwards so the table shows what the server
+// stored rather than what was typed.
+func setUserNotifyTargetCmd(client *api.Client, userID int64, topic string) tea.Cmd {
+	return func() tea.Msg {
+		if _, err := client.SetUserNotifyTarget(userID, topic); err != nil {
+			return userActionErrMsg{err}
+		}
+		users, err := client.ListUsers()
+		if err != nil {
+			return userActionErrMsg{err}
+		}
+		return usersFetchedMsg{users: users}
+	}
+}
+
 func deleteUserCmd(client *api.Client, userID int64) tea.Cmd {
 	return func() tea.Msg {
 		if err := client.DeleteUser(userID); err != nil {

internal/tui/model_test.go

@@ -0,0 +1,371 @@
+package tui
+
+import (
+	"testing"
+	"time"
+
+	"github.com/charmbracelet/bubbles/table"
+	"github.com/yeniklas/terdut-tui/internal/api"
+)
+
+func TestNextFilter(t *testing.T) {
+	tests := []struct {
+		name    string
+		cycle   []string
+		current string
+		want    string
+	}{
+		{"advances", incidentFilters, "", api.StatusTriggered},
+		{"advances again", incidentFilters, api.StatusTriggered, api.StatusAcknowledged},
+		{"wraps back to the open queue", incidentFilters, "snoozed", ""},
+		{"alerts advance", alertFilters, "firing", "resolved"},
+		{"alerts wrap", alertFilters, "archived", "firing"},
+		{"unknown current restarts the cycle", incidentFilters, "bogus", ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := nextFilter(tt.cycle, tt.current); got != tt.want {
+				t.Errorf("expected %q, got %q", tt.want, got)
+			}
+		})
+	}
+}
+
+// "snoozed" is a pseudo-status in the filter cycle: the server has no such
+// status, it is a separate query axis.
+func TestIncidentQuery(t *testing.T) {
+	tests := []struct {
+		filter      string
+		wantStatus  string
+		wantSnoozed bool
+	}{
+		{"", "", false},
+		{api.StatusTriggered, api.StatusTriggered, false},
+		{api.StatusResolved, api.StatusResolved, false},
+		{"snoozed", "", true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.filter, func(t *testing.T) {
+			status, snoozed := incidentQuery(tt.filter)
+			if status != tt.wantStatus || snoozed != tt.wantSnoozed {
+				t.Errorf("expected (%q, %v), got (%q, %v)",
+					tt.wantStatus, tt.wantSnoozed, status, snoozed)
+			}
+		})
+	}
+}
+
+func TestFilterLabel(t *testing.T) {
+	if got := filterLabel(""); got != "open" {
+		t.Errorf("the empty filter is the open queue, got %q", got)
+	}
+	if got := filterLabel("resolved"); got != "resolved" {
+		t.Errorf("expected resolved, got %q", got)
+	}
+}
+
+func TestNoteEvents(t *testing.T) {
+	timeline := []api.IncidentEvent{
+		{Type: api.EventTriggered},
+		{Type: api.EventNote, Detail: "first"},
+		{Type: api.EventAcknowledged},
+		{Type: api.EventNote, Detail: "second"},
+	}
+	notes := noteEvents(timeline)
+	if len(notes) != 2 {
+		t.Fatalf("expected 2 notes, got %d", len(notes))
+	}
+	if notes[0].Detail != "first" || notes[1].Detail != "second" {
+		t.Errorf("notes out of order: %v", notes)
+	}
+	if len(noteEvents(nil)) != 0 {
+		t.Error("an empty timeline has no notes")
+	}
+}
+
+func TestHumanDuration(t *testing.T) {
+	tests := []struct {
+		d    time.Duration
+		want string
+	}{
+		{5 * time.Second, "moments"},
+		{90 * time.Second, "1m"},
+		{45 * time.Minute, "45m"},
+		{2 * time.Hour, "2h"},
+		{150 * time.Minute, "2h 30m"},
+		{48 * time.Hour, "2d"},
+		{50 * time.Hour, "2d 2h"},
+	}
+	for _, tt := range tests {
+		if got := humanDuration(tt.d); got != tt.want {
+			t.Errorf("humanDuration(%v) = %q, want %q", tt.d, got, tt.want)
+		}
+	}
+}
+
+func TestHumanAgo_ClampsFutureToNow(t *testing.T) {
+	now := time.Now()
+	// Server and client clocks disagree often enough that this must not render
+	// as a negative age.
+	if got := humanAgo(now, now.Add(time.Hour)); got != "moments ago" {
+		t.Errorf("expected a future timestamp to clamp, got %q", got)
+	}
+}
+
+func TestHumanUntil(t *testing.T) {
+	now := time.Now()
+	if got := humanUntil(now, now.Add(2*time.Hour)); got != "in 2h" {
+		t.Errorf("expected 'in 2h', got %q", got)
+	}
+	if got := humanUntil(now, now.Add(-time.Minute)); got != "expired" {
+		t.Errorf("a deadline in the past has expired, got %q", got)
+	}
+}
+
+// MTTA and MTTR are nil until something has been acknowledged or resolved, and
+// that has to read as "no data" rather than an instant response.
+func TestHumanSeconds(t *testing.T) {
+	if got := humanSeconds(nil); got != "—" {
+		t.Errorf("expected an em dash for no data, got %q", got)
+	}
+	secs := 150.0
+	if got := humanSeconds(&secs); got != "2m" {
+		t.Errorf("expected 2m, got %q", got)
+	}
+}
+
+func TestIncidentRows(t *testing.T) {
+	future := time.Now().Add(time.Hour)
+	rows := incidentRows([]api.Incident{
+		{Title: "DiskFull", Status: api.StatusTriggered, Severity: "critical",
+			AssignedTo: "admin", TriggeredAt: time.Now()},
+		{Title: "Unowned", Status: api.StatusTriggered, TriggeredAt: time.Now()},
+		{Title: "Quiet", Status: api.StatusTriggered, Severity: "info",
+			AssignedTo: "alice", SnoozedUntil: &future, TriggeredAt: time.Now()},
+	})
+	if len(rows) != 3 {
+		t.Fatalf("expected 3 rows, got %d", len(rows))
+	}
+	if rows[0][0] != "critical" || rows[0][3] != "admin" {
+		t.Errorf("unexpected first row %v", rows[0])
+	}
+	if rows[1][0] != "—" || rows[1][3] != "—" {
+		t.Errorf("missing severity and assignee should show an em dash, got %v", rows[1])
+	}
+	// bubbles' table renders plain strings, so snooze has to be marked in text.
+	if rows[2][2] != "triggered (zzz)" {
+		t.Errorf("expected a snooze marker in the status cell, got %q", rows[2][2])
+	}
+}
+
+func TestAlertRows_ShowIncidentLink(t *testing.T) {
+	id := int64(7)
+	rows := alertRows([]api.Alert{
+		{Name: "DiskFull", Status: "firing", IncidentID: &id},
+		{Name: "Orphan", Status: "resolved"},
+	})
+	if rows[0][4] != "#7" {
+		t.Errorf("expected #7, got %q", rows[0][4])
+	}
+	if rows[1][4] != "—" {
+		t.Errorf("an alert with no incident shows an em dash, got %q", rows[1][4])
+	}
+}
+
+// A user with no ntfy topic gets no pages of their own — the row has to say so
+// rather than leaving a blank that reads as "not loaded yet".
+func TestUserManageRows_ShowMissingTopic(t *testing.T) {
+	topic := "terdut-niklas"
+	empty := ""
+	m := NewModel(nil, "http://test", time.Minute)
+	m.width, m.height = 120, 40
+	m.users = []api.User{
+		{ID: 1, Username: "niklas", NtfyTopic: &topic},
+		{ID: 2, Username: "alex"},
+		// The server stores a blank topic as NULL, but a stale client or an older
+		// server can still hand one back; it means the same thing.
+		{ID: 3, Username: "sam", NtfyTopic: &empty},
+	}
+	m.rebuildUserManageTable()
+
+	rows := m.userManageTable.Rows()
+	if rows[0][2] != "terdut-niklas" {
+		t.Errorf("expected the topic in the row, got %q", rows[0][2])
+	}
+	if rows[1][2] != "—" || rows[2][2] != "—" {
+		t.Errorf("expected an em dash for nil and empty topics, got %q and %q",
+			rows[1][2], rows[2][2])
+	}
+}
+
+// A previous release overflowed the terminal by two columns because the padding
+// budget was wrong. Columns plus bubbles' per-cell padding must land exactly on
+// the window width.
+func TestColumnWidthsFitTheTerminal(t *testing.T) {
+	for _, width := range []int{100, 110, 140, 200} {
+		for name, cols := range map[string][]int{
+			"incident": widths(incidentColumns(width)),
+			"alert":    widths(alertColumns(width)),
+		} {
+			sum := 0
+			for _, w := range cols {
+				sum += w
+			}
+			const padding = 10 // bubbles applies Padding(0, 1) to each of five cells
+			if sum+padding != width {
+				t.Errorf("%s columns at width %d sum to %d+%d = %d",
+					name, width, sum, padding, sum+padding)
+			}
+		}
+
+		// The users table is four cells, so its padding budget differs.
+		sum := 0
+		for _, w := range widths(userManageColumns(width)) {
+			sum += w
+		}
+		const userPadding = 8
+		if sum+userPadding != width {
+			t.Errorf("user columns at width %d sum to %d+%d = %d",
+				width, sum, userPadding, sum+userPadding)
+		}
+	}
+}
+
+// Narrow terminals fall back to minimum widths, which legitimately overflow;
+// what must not happen is a negative or zero column.
+func TestColumnWidthsStayPositiveWhenNarrow(t *testing.T) {
+	for _, width := range []int{20, 40, 60} {
+		cols := append(widths(incidentColumns(width)), widths(alertColumns(width))...)
+		cols = append(cols, widths(userManageColumns(width))...)
+		for _, w := range cols {
+			if w < 1 {
+				t.Errorf("width %d produced a non-positive column %d", width, w)
+			}
+		}
+	}
+}
+
+func widths(cols []table.Column) []int {
+	out := make([]int, len(cols))
+	for i, c := range cols {
+		out[i] = c.Width
+	}
+	return out
+}
+
+func TestTableHeight_NeverGoesBelowOne(t *testing.T) {
+	if got := tableHeight(3, 10); got != 1 {
+		t.Errorf("expected a floor of 1, got %d", got)
+	}
+	if got := tableHeight(40, 8); got != 32 {
+		t.Errorf("expected 32, got %d", got)
+	}
+}
+
+func TestBuildScheduleDays(t *testing.T) {
+	monday := time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
+	days := buildScheduleDays(monday, []api.ScheduleEntry{
+		{Date: "2026-07-29", Username: "alice"},
+	})
+	if len(days) != 7 {
+		t.Fatalf("expected a 7-day window, got %d", len(days))
+	}
+	if days[2].entry == nil || days[2].entry.Username != "alice" {
+		t.Errorf("expected alice on the third day, got %+v", days[2].entry)
+	}
+	if days[0].entry != nil {
+		t.Error("expected unassigned days to have no entry")
+	}
+}
+
+// ── Schedule reassignment ─────────────────────────────────────────────────
+
+// scheduledWeek builds a model showing the week of 2026-07-27 with the given
+// entries already on the rota.
+func scheduledWeek(entries []api.ScheduleEntry) Model {
+	m := NewModel(nil, "http://test", time.Minute)
+	m.width, m.height = 120, 40
+	m.connected = true
+	m.activeSection = sectionSchedule
+	m.scheduleWindow = time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
+	m.scheduleEntries = entries
+	m.scheduleDays = buildScheduleDays(m.scheduleWindow, entries)
+	m.rebuildScheduleTable()
+	return m
+}
+
+func TestScheduleConflicts(t *testing.T) {
+	m := scheduledWeek([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+		{ID: 2, Date: "2026-07-28", UserID: 3, Username: "sam"},
+		{ID: 3, Date: "2026-07-29", UserID: 2, Username: "alex"},
+	})
+	week := []string{"2026-07-27", "2026-07-28", "2026-07-29", "2026-07-30"}
+
+	// Assigning alex: the days niklas and sam hold are conflicts, the day alex
+	// already holds is not, and the free day is not.
+	taken, holders := m.scheduleConflicts(week, 2)
+	if len(taken) != 2 || taken[0] != "2026-07-27" || taken[1] != "2026-07-28" {
+		t.Errorf("expected the two other people's days, got %v", taken)
+	}
+	if len(holders) != 2 || holders[0] != "niklas" || holders[1] != "sam" {
+		t.Errorf("expected both holders named once, got %v", holders)
+	}
+}
+
+// Reassigning somebody to a day they already hold takes nothing from anyone, so
+// it must not raise a prompt — but it still needs replace, because the server
+// rejects any date that already exists.
+func TestScheduleConflicts_OwnDayIsNotAConflict(t *testing.T) {
+	m := scheduledWeek([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 2, Username: "alex"},
+	})
+	dates := []string{"2026-07-27"}
+
+	if taken, _ := m.scheduleConflicts(dates, 2); len(taken) != 0 {
+		t.Errorf("expected no conflict on the user's own day, got %v", taken)
+	}
+	if !m.scheduleOccupied(dates) {
+		t.Error("expected the day to still count as occupied, so replace is sent")
+	}
+}
+
+func TestScheduleOccupied_FreeDays(t *testing.T) {
+	m := scheduledWeek(nil)
+	if m.scheduleOccupied([]string{"2026-07-27", "2026-07-28"}) {
+		t.Error("expected an empty rota to need no replace")
+	}
+}
+
+func TestDayCount(t *testing.T) {
+	tests := []struct {
+		taken, total int
+		want         string
+	}{
+		{1, 1, "This day is"},
+		{7, 7, "All 7 days are"},
+		{3, 7, "3 of 7 days are"},
+	}
+	for _, tt := range tests {
+		if got := dayCount(tt.taken, tt.total); got != tt.want {
+			t.Errorf("dayCount(%d, %d) = %q, want %q", tt.taken, tt.total, got, tt.want)
+		}
+	}
+}
+
+func TestJoinNames(t *testing.T) {
+	tests := []struct {
+		names []string
+		want  string
+	}{
+		{nil, "somebody else"},
+		{[]string{"niklas"}, "niklas"},
+		{[]string{"niklas", "alex"}, "niklas and alex"},
+		{[]string{"niklas", "alex", "sam"}, "niklas, alex and sam"},
+	}
+	for _, tt := range tests {
+		if got := joinNames(tt.names); got != tt.want {
+			t.Errorf("joinNames(%v) = %q, want %q", tt.names, got, tt.want)
+		}
+	}
+}

internal/tui/update.go

@@ -24,7 +24,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.detailViewport.Width = m.width
 		m.detailViewport.Height = m.detailViewportHeight()
 		m.statsViewport.Width = m.width
-		m.statsViewport.Height = m.height - 5
+		m.statsViewport.Height = m.statsViewportHeight()
 		m.refreshDetailContent()
 		m.refreshStatsContent()
 		return m, nil
@@ -118,13 +118,16 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.hourStats = msg.byHour
 		m.dayStats = msg.byDay
 		m.statsLoading = false
+		m.statsLoaded = true
 		m.refreshStatsContent()
 		return m, nil
 
 	case detailStatsErrMsg:
 		m.statsLoading = false
+		// Mark it loaded even on failure, so tabbing back in does not re-fire the
+		// request every time. The tick and r still retry.
+		m.statsLoaded = true
 		m.statusMsg = "stats error: " + msg.err.Error()
-		m.mode = modeDashboard
 		return m, clearStatusCmd()
 
 	// ── Schedule messages ─────────────────────────────────────────────────
@@ -205,6 +208,9 @@ func (m Model) refreshActiveSection() tea.Cmd {
 		return tea.Batch(fetchIncidentsCmd(m.client, m.incidentFilter), fetchStatsCmd(m.client))
 	case sectionAlerts:
 		return tea.Batch(fetchAlertsCmd(m.client, m.alertFilter), fetchStatsCmd(m.client))
+	case sectionStats:
+		// Both: fetchStatsCmd feeds the Incident Response block, the other the charts.
+		return tea.Batch(fetchStatsCmd(m.client), fetchDetailStatsCmd(m.client))
 	case sectionArchived:
 		return fetchArchivedIncidentsCmd(m.client)
 	case sectionSchedule:
@@ -240,12 +246,6 @@ func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m2, ourCmd := m.handleKey(msg)
 		return m2, tea.Batch(inputCmd, ourCmd)
 
-	case modeStats:
-		var vpCmd tea.Cmd
-		m.statsViewport, vpCmd = m.statsViewport.Update(msg)
-		m2, ourCmd := m.handleKey(msg)
-		return m2, tea.Batch(vpCmd, ourCmd)
-
 	case modeUserPicker:
 		var tableCmd tea.Cmd
 		m.userPickerTable, tableCmd = m.userPickerTable.Update(msg)
@@ -258,6 +258,12 @@ func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m2, ourCmd := m.handleKey(msg)
 		return m2, tea.Batch(inputCmd, ourCmd)
 
+	case modeUserNotifyEdit:
+		var inputCmd tea.Cmd
+		m.ntfyTopicInput, inputCmd = m.ntfyTopicInput.Update(msg)
+		m2, ourCmd := m.handleKey(msg)
+		return m2, tea.Batch(inputCmd, ourCmd)
+
 	case modeAPIKeyCreate:
 		var inputCmd tea.Cmd
 		m.apiKeyNameInput, inputCmd = m.apiKeyNameInput.Update(msg)
@@ -286,6 +292,11 @@ func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 				m.alertTable, tableCmd = m.alertTable.Update(msg)
 				m2, ourCmd := m.handleKey(msg)
 				return m2, tea.Batch(tableCmd, ourCmd)
+			case sectionStats:
+				var vpCmd tea.Cmd
+				m.statsViewport, vpCmd = m.statsViewport.Update(msg)
+				m2, ourCmd := m.handleKey(msg)
+				return m2, tea.Batch(vpCmd, ourCmd)
 			case sectionArchived:
 				var tableCmd tea.Cmd
 				m.archivedTable, tableCmd = m.archivedTable.Update(msg)
@@ -319,12 +330,12 @@ func (m Model) handleKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		return m.handleSnoozeKey(msg)
 	case modeConfirm:
 		return m.handleConfirmKey(msg)
-	case modeStats:
-		return m.handleStatsKey(msg)
 	case modeUserPicker:
 		return m.handleUserPickerKey(msg)
 	case modeUserCreate:
 		return m.handleUserCreateKey(msg)
+	case modeUserNotifyEdit:
+		return m.handleUserNotifyEditKey(msg)
 	case modeAPIKeyMenu:
 		return m.handleAPIKeyMenuKey(msg)
 	case modeAPIKeyCreate:
@@ -482,12 +493,6 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		}
 		return m, nil
 
-	case "S":
-		if !m.connected {
-			return m, nil
-		}
-		return m.openStats()
-
 	case "n":
 		if m.activeSection != sectionUsers || !m.connected {
 			return m, nil
@@ -500,6 +505,23 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeUserCreate
 		return m, nil
 
+	case "t":
+		if m.activeSection != sectionUsers || !m.connected || len(m.users) == 0 {
+			return m, nil
+		}
+		cursor := m.userManageTable.Cursor()
+		if cursor >= len(m.users) {
+			return m, nil
+		}
+		m.selectedUser = m.users[cursor]
+		// Prefilled with what they have, so editing a topic does not mean
+		// retyping it, and clearing one is a deliberate wipe.
+		m.ntfyTopicInput.SetValue(m.selectedUser.Topic())
+		m.ntfyTopicInput.CursorEnd()
+		m.ntfyTopicInput.Focus()
+		m.mode = modeUserNotifyEdit
+		return m, nil
+
 	case "k":
 		if m.activeSection != sectionUsers || !m.connected || len(m.users) == 0 {
 			return m, nil
@@ -524,6 +546,11 @@ func (m *Model) loadSectionIfEmpty() tea.Cmd {
 			m.loading = true
 			return fetchAlertsCmd(m.client, m.alertFilter)
 		}
+	case sectionStats:
+		if !m.statsLoaded {
+			m.statsLoading = true
+			return tea.Batch(fetchStatsCmd(m.client), fetchDetailStatsCmd(m.client))
+		}
 	case sectionArchived:
 		if len(m.archivedIncidents) == 0 {
 			m.archivedLoading = true
@@ -677,9 +704,6 @@ func (m Model) handleIncidentDetailKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeConfirm
 		return m, nil
 
-	case "S":
-		return m.openStats()
-
 	case "[":
 		return m.moveNoteCursor(-1), nil
 
@@ -733,9 +757,6 @@ func (m Model) handleAlertDetailKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			return m, clearStatusCmd()
 		}
 		return m.openIncident(api.Incident{ID: *m.selectedAlert.IncidentID})
-
-	case "S":
-		return m.openStats()
 	}
 
 	return m, nil
@@ -801,6 +822,7 @@ func (m Model) handleConfirmKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		}
 		m.pendingDeleteID = 0
 		m.pendingDeleteEntry = nil
+		m.pendingAssign = nil
 		return m, nil
 	}
 
@@ -830,30 +852,22 @@ func (m Model) handleConfirmKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeDashboard
 		m.usersLoading = true
 		return m, deleteUserCmd(m.client, userID)
+
+	case confirmReassignSchedule:
+		p := m.pendingAssign
+		m.mode = modeDashboard
+		m.pendingAssign = nil
+		if p == nil {
+			return m, nil
+		}
+		m.scheduleLoading = true
+		return m, assignScheduleCmd(m.client, p.userID, p.dates, true,
+			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 	}
 
 	return m, nil
 }
 
-// ── Stats ─────────────────────────────────────────────────────────────────
-
-func (m Model) handleStatsKey(msg tea.KeyMsg) (Model, tea.Cmd) {
-	if msg.String() == "esc" {
-		m.mode = m.statsReturnMode
-		return m, nil
-	}
-	return m, nil
-}
-
-// openStats enters the statistics view, remembering where to go back to.
-func (m Model) openStats() (Model, tea.Cmd) {
-	m.statsReturnMode = m.mode
-	m.mode = modeStats
-	m.statsLoading = true
-	m.statsViewport = viewport.New(m.width, m.height-5)
-	return m, fetchDetailStatsCmd(m.client)
-}
-
 // ── User picker ───────────────────────────────────────────────────────────
 
 func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
@@ -897,15 +911,84 @@ func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		} else {
 			dates = []string{d.Format("2006-01-02")}
 		}
+
+		// The server refuses a date somebody else holds, so ask before taking
+		// it rather than letting the request come back 409. The answer is
+		// already on screen — no round trip is needed to work out who loses
+		// their shift.
+		taken, holders := m.scheduleConflicts(dates, user.ID)
+		if len(taken) > 0 {
+			m.pendingAssign = &pendingAssign{
+				userID:   user.ID,
+				username: user.Username,
+				dates:    dates,
+				taken:    taken,
+				holders:  holders,
+			}
+			m.confirmTarget = confirmReassignSchedule
+			m.mode = modeConfirm
+			return m, nil
+		}
+
 		m.mode = modeDashboard
 		m.scheduleLoading = true
-		return m, assignScheduleCmd(m.client, user.ID, dates,
+		// Nobody else loses anything, but the server rejects any date that
+		// already exists — including days this same person already holds, which
+		// is a no-op worth letting through silently.
+		return m, assignScheduleCmd(m.client, user.ID, dates, m.scheduleOccupied(dates),
 			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 	}
 
 	return m, nil
 }
 
+// scheduleConflicts reports which of dates are already held by somebody other
+// than newUserID, and the distinct names holding them.
+//
+// Days the target already owns are not conflicts — reassigning somebody to
+// their own shift takes nothing from anyone, and prompting for it would be
+// noise. The server still needs replace for those, since it rejects any date
+// that exists.
+func (m Model) scheduleConflicts(dates []string, newUserID int64) (taken, holders []string) {
+	held := make(map[string]api.ScheduleEntry, len(m.scheduleDays))
+	for _, d := range m.scheduleDays {
+		if d.entry != nil {
+			held[d.entry.Date] = *d.entry
+		}
+	}
+	seen := make(map[string]bool)
+	for _, date := range dates {
+		e, ok := held[date]
+		if !ok || e.UserID == newUserID {
+			continue
+		}
+		taken = append(taken, date)
+		if !seen[e.Username] {
+			seen[e.Username] = true
+			holders = append(holders, e.Username)
+		}
+	}
+	return taken, holders
+}
+
+// scheduleOccupied reports whether any of dates already has an entry at all,
+// including one belonging to the incoming user. That is what decides whether
+// the request needs replace, as opposed to whether it needs confirming.
+func (m Model) scheduleOccupied(dates []string) bool {
+	held := make(map[string]bool, len(m.scheduleDays))
+	for _, d := range m.scheduleDays {
+		if d.entry != nil {
+			held[d.entry.Date] = true
+		}
+	}
+	for _, date := range dates {
+		if held[date] {
+			return true
+		}
+	}
+	return false
+}
+
 // ── User management ───────────────────────────────────────────────────────────
 
 func (m Model) handleUserCreateKey(msg tea.KeyMsg) (Model, tea.Cmd) {
@@ -939,6 +1022,28 @@ func (m Model) handleUserCreateKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	return m, nil
 }
 
+// handleUserNotifyEditKey edits one user's ntfy topic.
+//
+// Unlike the other forms here, an empty value is not a mistake to reject: it is
+// how a topic is cleared, which the server accepts and treats as NULL.
+func (m Model) handleUserNotifyEditKey(msg tea.KeyMsg) (Model, tea.Cmd) {
+	switch msg.String() {
+	case "esc":
+		m.ntfyTopicInput.Blur()
+		m.mode = modeDashboard
+		return m, nil
+
+	case "enter":
+		topic := strings.TrimSpace(m.ntfyTopicInput.Value())
+		m.ntfyTopicInput.Blur()
+		m.mode = modeDashboard
+		m.usersLoading = true
+		return m, setUserNotifyTargetCmd(m.client, m.selectedUser.ID, topic)
+	}
+
+	return m, nil
+}
+
 func (m Model) handleAPIKeyMenuKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	switch msg.String() {
 	case "esc":

internal/tui/update_test.go

@@ -0,0 +1,678 @@
+package tui
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/yeniklas/terdut-tui/internal/api"
+)
+
+// press sends one key and returns the resulting model and command. A nil command
+// means the model decided to do nothing, which is what most of these tests are
+// really asserting.
+func press(t *testing.T, m Model, key string) (Model, tea.Cmd) {
+	t.Helper()
+	var msg tea.KeyMsg
+	switch key {
+	case "esc":
+		msg = tea.KeyMsg{Type: tea.KeyEsc}
+	case "enter":
+		msg = tea.KeyMsg{Type: tea.KeyEnter}
+	case "tab":
+		msg = tea.KeyMsg{Type: tea.KeyTab}
+	default:
+		msg = tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(key)}
+	}
+	next, cmd := m.Update(msg)
+	return next.(Model), cmd
+}
+
+// sized returns a connected model with a usable window, which most handlers need.
+func sized() Model {
+	m := NewModel(nil, "http://test", time.Minute)
+	m.width, m.height = 120, 40
+	m.connected = true
+	return m
+}
+
+// onIncident opens the incident detail view directly, skipping the fetch.
+func onIncident(inc api.Incident, timeline []api.IncidentEvent) Model {
+	m := sized()
+	m.mode = modeIncidentDetail
+	m.selectedIncident = inc
+	m.timeline = timeline
+	m.noteCursor = -1
+	return m
+}
+
+func openIncidentFixture() api.Incident {
+	return api.Incident{ID: 1, Title: "DiskFull", Status: api.StatusTriggered,
+		Severity: "critical", TriggeredAt: time.Now()}
+}
+
+func resolvedIncidentFixture() api.Incident {
+	now := time.Now()
+	source := "manual"
+	inc := openIncidentFixture()
+	inc.Status = api.StatusResolved
+	inc.ResolvedAt = &now
+	inc.ResolutionSource = &source
+	return inc
+}
+
+// Resolving is terminal on the server: a later occurrence opens a new incident
+// rather than reopening this one. A stray keypress must not be able to do that.
+func TestResolve_AsksBeforeDoingIt(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+
+	m, cmd := press(t, m, "R")
+	if m.mode != modeConfirm {
+		t.Fatalf("expected a confirmation prompt, got mode %v", m.mode)
+	}
+	if m.confirmTarget != confirmResolveIncident {
+		t.Errorf("expected the resolve target, got %v", m.confirmTarget)
+	}
+	if cmd != nil {
+		t.Error("nothing should be sent to the server before confirming")
+	}
+	if !containsAll(m.confirmPrompt(), "final", "new incident") {
+		t.Errorf("the prompt should say resolving is final, got %q", m.confirmPrompt())
+	}
+}
+
+func TestResolve_CancelReturnsToDetailWithoutActing(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "R")
+
+	m, cmd := press(t, m, "n")
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to land back on the incident, got mode %v", m.mode)
+	}
+	if cmd != nil {
+		t.Error("cancelling must not act")
+	}
+}
+
+func TestResolve_ConfirmActs(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "R")
+
+	m, cmd := press(t, m, "y")
+	if cmd == nil {
+		t.Error("confirming should issue the resolve")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+// The server answers 409 on all of these; saying so up front beats a round trip.
+func TestResolvedIncident_RejectsWorkflowActions(t *testing.T) {
+	for _, key := range []string{"a", "A", "R", "s", "z", "Z"} {
+		t.Run(key, func(t *testing.T) {
+			m := onIncident(resolvedIncidentFixture(), nil)
+			m, cmd := press(t, m, key)
+			if cmd == nil {
+				t.Error("expected a status message command")
+			}
+			if m.statusMsg == "" {
+				t.Error("expected an explanation in the status line")
+			}
+			if m.mode != modeIncidentDetail {
+				t.Errorf("expected to stay on the incident, got mode %v", m.mode)
+			}
+		})
+	}
+}
+
+func TestOpenIncident_AcknowledgeTwiceIsRejected(t *testing.T) {
+	inc := openIncidentFixture()
+	id := int64(2)
+	at := time.Now()
+	inc.Status = api.StatusAcknowledged
+	inc.AcknowledgedByID = &id
+	inc.AcknowledgedBy = "alice"
+	inc.AcknowledgedAt = &at
+
+	m, _ := press(t, onIncident(inc, nil), "a")
+	if !containsAll(m.statusMsg, "already acknowledged", "alice") {
+		t.Errorf("expected to be told who holds it, got %q", m.statusMsg)
+	}
+}
+
+func TestOpenIncident_UnacknowledgeRequiresAnAcknowledgement(t *testing.T) {
+	m, _ := press(t, onIncident(openIncidentFixture(), nil), "A")
+	if m.statusMsg != "not acknowledged" {
+		t.Errorf("expected 'not acknowledged', got %q", m.statusMsg)
+	}
+}
+
+func TestOpenIncident_UnsnoozeRequiresASnooze(t *testing.T) {
+	m, _ := press(t, onIncident(openIncidentFixture(), nil), "Z")
+	if m.statusMsg != "not snoozed" {
+		t.Errorf("expected 'not snoozed', got %q", m.statusMsg)
+	}
+}
+
+// Archiving unresolved work only hides it, so the client refuses rather than
+// letting the queue be cleared by pressing x.
+func TestArchive_RefusesOpenIncident(t *testing.T) {
+	t.Run("from the detail view", func(t *testing.T) {
+		m, cmd := press(t, onIncident(openIncidentFixture(), nil), "x")
+		if cmd == nil || m.statusMsg == "" {
+			t.Error("expected a refusal message")
+		}
+		if m.mode != modeIncidentDetail {
+			t.Errorf("expected to stay put, got mode %v", m.mode)
+		}
+	})
+
+	t.Run("from the queue", func(t *testing.T) {
+		m := sized()
+		m.incidents = []api.Incident{openIncidentFixture()}
+		m.rebuildIncidentTable()
+
+		m, _ = press(t, m, "x")
+		if m.statusMsg == "" {
+			t.Error("expected a refusal message")
+		}
+	})
+}
+
+func TestArchive_AllowedOnResolvedIncident(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{resolvedIncidentFixture()}
+	m.rebuildIncidentTable()
+
+	m, cmd := press(t, m, "x")
+	if cmd == nil {
+		t.Error("archiving a resolved incident should act")
+	}
+	if m.statusMsg != "" {
+		t.Errorf("expected no refusal, got %q", m.statusMsg)
+	}
+}
+
+func TestSnooze_PromptThenSubmit(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+
+	m, _ = press(t, m, "z")
+	if m.mode != modeSnooze {
+		t.Fatalf("expected the snooze prompt, got mode %v", m.mode)
+	}
+
+	// Typing goes to the input, not the key handler.
+	for _, r := range "2h" {
+		m, _ = press(t, m, string(r))
+	}
+	if m.snoozeInput.Value() != "2h" {
+		t.Fatalf("expected the typed duration, got %q", m.snoozeInput.Value())
+	}
+
+	m, cmd := press(t, m, "enter")
+	if cmd == nil {
+		t.Error("expected the snooze to be sent")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+func TestSnooze_EmptyInputDoesNothing(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "z")
+
+	m, cmd := press(t, m, "enter")
+	if cmd != nil {
+		t.Error("an empty duration should not be sent")
+	}
+	if m.mode != modeSnooze {
+		t.Errorf("expected to stay on the prompt, got mode %v", m.mode)
+	}
+}
+
+func TestNote_EscapeAbandonsWithoutPosting(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m, _ = press(t, m, "c")
+	if m.mode != modeNote {
+		t.Fatalf("expected the note prompt, got mode %v", m.mode)
+	}
+
+	m, cmd := press(t, m, "esc")
+	if cmd != nil {
+		t.Error("escaping must not post the note")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+func TestNoteCursor_WrapsOverNotesOnly(t *testing.T) {
+	timeline := []api.IncidentEvent{
+		{ID: 1, Type: api.EventTriggered},
+		{ID: 2, Type: api.EventNote, Detail: "first"},
+		{ID: 3, Type: api.EventAcknowledged},
+		{ID: 4, Type: api.EventNote, Detail: "second"},
+	}
+	m := onIncident(openIncidentFixture(), timeline)
+
+	m, _ = press(t, m, "]")
+	if m.noteCursor != 0 {
+		t.Fatalf("expected the first note, got %d", m.noteCursor)
+	}
+	m, _ = press(t, m, "]")
+	if m.noteCursor != 1 {
+		t.Fatalf("expected the second note, got %d", m.noteCursor)
+	}
+	m, _ = press(t, m, "]")
+	if m.noteCursor != 0 {
+		t.Errorf("expected to wrap to the first note, got %d", m.noteCursor)
+	}
+	m, _ = press(t, m, "[")
+	if m.noteCursor != 1 {
+		t.Errorf("expected to wrap backwards to the last note, got %d", m.noteCursor)
+	}
+}
+
+func TestDeleteNote_RequiresASelection(t *testing.T) {
+	m := onIncident(openIncidentFixture(), []api.IncidentEvent{{Type: api.EventTriggered}})
+	m, _ = press(t, m, "d")
+	if m.mode == modeConfirm {
+		t.Error("nothing is selected, so there is nothing to confirm")
+	}
+	if !containsAll(m.statusMsg, "select a note") {
+		t.Errorf("expected guidance, got %q", m.statusMsg)
+	}
+}
+
+func TestDeleteNote_ConfirmsThenActs(t *testing.T) {
+	timeline := []api.IncidentEvent{{ID: 9, Type: api.EventNote, Detail: "hi"}}
+	m := onIncident(openIncidentFixture(), timeline)
+
+	m, _ = press(t, m, "]")
+	m, _ = press(t, m, "d")
+	if m.mode != modeConfirm || m.confirmTarget != confirmDeleteNote {
+		t.Fatalf("expected a delete confirmation, got mode %v target %v", m.mode, m.confirmTarget)
+	}
+	if m.pendingDeleteID != 9 {
+		t.Errorf("expected the selected note's id, got %d", m.pendingDeleteID)
+	}
+
+	m, cmd := press(t, m, "y")
+	if cmd == nil {
+		t.Error("confirming should issue the delete")
+	}
+	if m.mode != modeIncidentDetail {
+		t.Errorf("expected to return to the incident, got mode %v", m.mode)
+	}
+}
+
+// ── Schedule reassignment ─────────────────────────────────────────────────
+
+// pickingOnCall opens the user picker for the schedule day at dayIndex, which
+// is where a reassignment actually starts.
+func pickingOnCall(entries []api.ScheduleEntry, dayIndex int, week bool) Model {
+	m := scheduledWeek(entries)
+	m.users = []api.User{
+		{ID: 1, Username: "niklas", Email: "n@example.com"},
+		{ID: 2, Username: "alex", Email: "a@example.com"},
+	}
+	m.rebuildUserPickerTable()
+	m.scheduleTable.SetCursor(dayIndex)
+	m.pickerAssignWeek = week
+	m.pickerTarget = pickerSchedule
+	m.mode = modeUserPicker
+	m.userPickerTable.SetCursor(1) // alex
+	return m
+}
+
+// The bug: a day somebody already holds could not be handed to anybody else.
+// The server refuses it, so the TUI has to ask first and then say so.
+func TestSchedule_ReassigningATakenDayAsksFirst(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+
+	m, cmd := press(t, m, "enter")
+
+	if m.mode != modeConfirm || m.confirmTarget != confirmReassignSchedule {
+		t.Fatalf("expected a reassignment confirmation, got mode %v target %v",
+			m.mode, m.confirmTarget)
+	}
+	if cmd != nil {
+		t.Error("expected nothing sent to the server before confirming")
+	}
+	mustContain(t, m.confirmPrompt(), "This day is assigned to niklas", "Reassign to alex?")
+}
+
+func TestSchedule_ReassignConfirmedSends(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+	m, _ = press(t, m, "enter")
+
+	m, cmd := press(t, m, "y")
+	if cmd == nil {
+		t.Fatal("expected the confirmed reassignment to be sent")
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("expected a return to the dashboard, got mode %v", m.mode)
+	}
+	if m.pendingAssign != nil {
+		t.Error("expected the pending assignment cleared")
+	}
+}
+
+// Declining must leave the rota alone — that is the whole point of the guard.
+func TestSchedule_ReassignDeclinedSendsNothing(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+	m, _ = press(t, m, "enter")
+
+	m, cmd := press(t, m, "n")
+	if cmd != nil {
+		t.Error("expected nothing sent when the reassignment is declined")
+	}
+	if m.pendingAssign != nil {
+		t.Error("expected the pending assignment discarded")
+	}
+}
+
+// A free day is the path that always worked, and must not grow a prompt.
+func TestSchedule_AssigningAFreeDayDoesNotAsk(t *testing.T) {
+	m := pickingOnCall(nil, 0, false)
+
+	m, cmd := press(t, m, "enter")
+	if m.mode != modeDashboard {
+		t.Errorf("expected no prompt for a free day, got mode %v", m.mode)
+	}
+	if cmd == nil {
+		t.Error("expected the assignment to be sent straight away")
+	}
+}
+
+// The week case is the one that was worst: a single taken day rejected all
+// seven. One prompt now covers the lot, and it says how much is being taken.
+func TestSchedule_ReassigningAPartlyTakenWeekAsksOnce(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-28", UserID: 1, Username: "niklas"},
+		{ID: 2, Date: "2026-07-30", UserID: 3, Username: "sam"},
+	}, 0, true)
+
+	m, _ = press(t, m, "enter")
+	if m.confirmTarget != confirmReassignSchedule {
+		t.Fatalf("expected one confirmation for the week, got target %v", m.confirmTarget)
+	}
+	if got := len(m.pendingAssign.dates); got != 7 {
+		t.Errorf("expected all 7 days in the assignment, got %d", got)
+	}
+	mustContain(t, m.confirmPrompt(), "2 of 7 days are assigned to niklas and sam")
+}
+
+// ── Ntfy topic ────────────────────────────────────────────────────────────
+
+// onUsers puts the model in the Users section with a loaded table.
+func onUsers(users []api.User) Model {
+	m := sized()
+	m.activeSection = sectionUsers
+	m.users = users
+	m.rebuildUserManageTable()
+	return m
+}
+
+func userFixtures() []api.User {
+	topic := "terdut-niklas"
+	return []api.User{
+		{ID: 1, Username: "niklas", Email: "niklas@example.com", NtfyTopic: &topic},
+		{ID: 2, Username: "alex", Email: "alex@example.com"},
+	}
+}
+
+func TestNotifyTopic_EditPrefillsTheCurrentTopic(t *testing.T) {
+	m, _ := press(t, onUsers(userFixtures()), "t")
+
+	if m.mode != modeUserNotifyEdit {
+		t.Fatalf("expected the topic editor, got mode %v", m.mode)
+	}
+	if m.selectedUser.ID != 1 {
+		t.Errorf("expected the user under the cursor, got %d", m.selectedUser.ID)
+	}
+	// Prefilled, so editing a topic does not mean retyping it from scratch.
+	if got := m.ntfyTopicInput.Value(); got != "terdut-niklas" {
+		t.Errorf("expected the current topic prefilled, got %q", got)
+	}
+}
+
+// A user with no topic opens an empty field rather than the previous user's.
+func TestNotifyTopic_EditStartsEmptyWhenUnset(t *testing.T) {
+	m := onUsers(userFixtures())
+	m, _ = press(t, m, "t")
+	m, _ = press(t, m, "esc")
+	m.userManageTable.SetCursor(1)
+
+	m, _ = press(t, m, "t")
+	if got := m.ntfyTopicInput.Value(); got != "" {
+		t.Errorf("expected an empty field for a user with no topic, got %q", got)
+	}
+}
+
+func TestNotifyTopic_EscapeAbandonsWithoutSaving(t *testing.T) {
+	m, _ := press(t, onUsers(userFixtures()), "t")
+	m, cmd := press(t, m, "esc")
+
+	if cmd != nil {
+		t.Error("expected escape to save nothing")
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("expected a return to the dashboard, got mode %v", m.mode)
+	}
+}
+
+// Clearing a topic is a real action, not a no-op: it is how a user is taken off
+// their own topic and back onto the shared fallback. Contrast the snooze prompt,
+// where an empty value means "I changed my mind".
+func TestNotifyTopic_EmptyInputStillSubmits(t *testing.T) {
+	m, _ := press(t, onUsers(userFixtures()), "t")
+	m.ntfyTopicInput.SetValue("")
+
+	m, cmd := press(t, m, "enter")
+	if cmd == nil {
+		t.Fatal("expected clearing the topic to call the server")
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("expected a return to the dashboard, got mode %v", m.mode)
+	}
+}
+
+func TestNotifyTopic_IsUsersSectionOnly(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionIncidents
+	if next, cmd := press(t, m, "t"); cmd != nil || next.mode != modeDashboard {
+		t.Error("expected t to do nothing outside the Users section")
+	}
+}
+
+func TestTab_CyclesEverySection(t *testing.T) {
+	m := sized()
+	if m.activeSection != sectionIncidents {
+		t.Fatal("incidents is the section the client opens on")
+	}
+
+	want := []section{sectionAlerts, sectionStats, sectionArchived, sectionSchedule,
+		sectionUsers, sectionIncidents}
+	for i, expected := range want {
+		m, _ = press(t, m, "tab")
+		if m.activeSection != expected {
+			t.Fatalf("after %d tabs expected section %v, got %v", i+1, expected, m.activeSection)
+		}
+	}
+}
+
+func TestFilter_CyclesPerSection(t *testing.T) {
+	m := sized()
+	m, _ = press(t, m, "f")
+	if m.incidentFilter != api.StatusTriggered {
+		t.Errorf("expected the incident filter to advance, got %q", m.incidentFilter)
+	}
+
+	m.activeSection = sectionAlerts
+	m, _ = press(t, m, "f")
+	if m.alertFilter != "resolved" {
+		t.Errorf("expected the alert filter to advance, got %q", m.alertFilter)
+	}
+	if m.incidentFilter != api.StatusTriggered {
+		t.Error("the two filters are independent")
+	}
+}
+
+// Stats is a section like any other: no key of its own, no mode of its own, and
+// it loads once on first visit rather than on every tab-in — the three empty
+// slices a quiet server returns are a real answer, not a missing one.
+func TestStats_IsAnOrdinarySection(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionAlerts
+
+	m, cmd := press(t, m, "tab")
+	if m.activeSection != sectionStats {
+		t.Fatalf("expected the stats section, got %v", m.activeSection)
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("stats is a section, not a mode: got mode %v", m.mode)
+	}
+	if cmd == nil {
+		t.Error("the first visit should fetch")
+	}
+
+	m.statsLoaded = true
+	m.statsLoading = false
+	if cmd := m.loadSectionIfEmpty(); cmd != nil {
+		t.Error("a second visit should reuse what was already fetched")
+	}
+}
+
+// S used to open the stats overlay from anywhere. It is gone, and must not
+// disturb the view it is pressed in.
+func TestStats_KeyIsGone(t *testing.T) {
+	m, _ := press(t, sized(), "S")
+	if m.activeSection != sectionIncidents || m.mode != modeDashboard {
+		t.Errorf("S should do nothing on the queue, got section %v mode %v",
+			m.activeSection, m.mode)
+	}
+
+	m, _ = press(t, onIncident(openIncidentFixture(), nil), "S")
+	if m.mode != modeIncidentDetail {
+		t.Errorf("S should leave the incident open, got mode %v", m.mode)
+	}
+}
+
+// The overlay never auto-refreshed, because the tick skipped every non-dashboard
+// mode. As a section it rides the tick like the rest.
+func TestStats_RefreshesOnTick(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionStats
+	if m.refreshActiveSection() == nil {
+		t.Error("the stats section should refresh on the tick")
+	}
+}
+
+// Alerts carry no workflow state, so the detail view offers nothing but a way
+// through to the incident.
+func TestAlertDetail_IsReadOnly(t *testing.T) {
+	m := sized()
+	m.mode = modeAlertDetail
+	m.selectedAlert = api.Alert{ID: 3, Name: "DiskFull", Status: "firing"}
+
+	for _, key := range []string{"a", "A", "R", "c", "x", "z"} {
+		next, cmd := press(t, m, key)
+		if cmd != nil {
+			t.Errorf("key %q should do nothing on an alert", key)
+		}
+		if next.mode != modeAlertDetail {
+			t.Errorf("key %q changed mode to %v", key, next.mode)
+		}
+	}
+}
+
+func TestAlertDetail_JumpToIncident(t *testing.T) {
+	m := sized()
+	m.mode = modeAlertDetail
+
+	t.Run("without an incident", func(t *testing.T) {
+		m.selectedAlert = api.Alert{ID: 3, Name: "Orphan"}
+		next, _ := press(t, m, "i")
+		if next.mode != modeAlertDetail || next.statusMsg == "" {
+			t.Errorf("expected a refusal, got mode %v msg %q", next.mode, next.statusMsg)
+		}
+	})
+
+	t.Run("with an incident", func(t *testing.T) {
+		id := int64(7)
+		m.selectedAlert = api.Alert{ID: 3, Name: "DiskFull", IncidentID: &id}
+		next, cmd := press(t, m, "i")
+		if next.mode != modeIncidentDetail {
+			t.Fatalf("expected the incident view, got mode %v", next.mode)
+		}
+		if next.selectedIncident.ID != 7 {
+			t.Errorf("expected incident 7, got %d", next.selectedIncident.ID)
+		}
+		if cmd == nil {
+			t.Error("expected the incident to be fetched")
+		}
+	})
+}
+
+// A refresh underneath a prompt would move the ground under the user.
+func TestRefreshTick_SkipsModalStates(t *testing.T) {
+	modal := []mode{modeNote, modeSnooze, modeConfirm, modeUserPicker, modeUserCreate}
+	for _, md := range modal {
+		m := sized()
+		m.mode = md
+		if cmd := m.refreshActiveSection(); cmd != nil {
+			t.Errorf("mode %v should not auto-refresh", md)
+		}
+	}
+
+	m := sized()
+	if cmd := m.refreshActiveSection(); cmd == nil {
+		t.Error("the dashboard should auto-refresh")
+	}
+}
+
+func TestIncidentsFetched_ClearsLoading(t *testing.T) {
+	m := sized()
+	m.loading = true
+	next, _ := m.Update(incidentsFetchedMsg{incidents: []api.Incident{openIncidentFixture()}})
+	got := next.(Model)
+	if got.loading {
+		t.Error("expected loading to clear")
+	}
+	if len(got.incidents) != 1 {
+		t.Errorf("expected the incidents stored, got %d", len(got.incidents))
+	}
+}
+
+// A note deleted elsewhere must not leave the cursor pointing past the end.
+func TestIncidentDetailFetched_ClampsNoteCursor(t *testing.T) {
+	m := onIncident(openIncidentFixture(), nil)
+	m.noteCursor = 3
+
+	next, _ := m.Update(incidentDetailFetchedMsg{
+		incident: openIncidentFixture(),
+		timeline: []api.IncidentEvent{{Type: api.EventTriggered}},
+	})
+	if got := next.(Model).noteCursor; got != -1 {
+		t.Errorf("expected the cursor reset, got %d", got)
+	}
+}
+
+func containsAll(s string, subs ...string) bool {
+	for _, sub := range subs {
+		if !strings.Contains(s, sub) {
+			return false
+		}
+	}
+	return true
+}

internal/tui/view.go

@@ -10,7 +10,8 @@ import (
 	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
-var sectionNames = []string{"Incidents", "Alerts", "Archived", "Schedule", "Users"}
+// Order must match the section constants — renderTabs indexes this by ordinal.
+var sectionNames = []string{"Incidents", "Alerts", "Stats", "Archived", "Schedule", "Users"}
 
 func (m Model) View() string {
 	if m.width == 0 {
@@ -68,12 +69,12 @@ func (m Model) renderBody() string {
 		default:
 			return m.renderSchedule()
 		}
-	case modeStats:
-		return m.renderStats()
 	case modeUserPicker:
 		return m.renderUserPicker()
 	case modeUserCreate:
 		return m.renderUserCreate()
+	case modeUserNotifyEdit:
+		return m.renderUserNotifyEdit()
 	case modeAPIKeyMenu:
 		return m.renderAPIKeyMenu()
 	case modeAPIKeyCreate:
@@ -99,12 +100,12 @@ func (m Model) renderFooter() string {
 	switch m.mode {
 	case modeIncidentDetail:
 		if !m.selectedIncident.IsOpen() {
-			return withStatus("  x·archive  c·note  [/]·select  d·del  S·stats  esc·back")
+			return withStatus("  x·archive  c·note  [/]·select  d·del  esc·back")
 		}
-		return withStatus("  a·ack  A·unack  R·resolve  s·assign  z·snooze  Z·unsnooze  c·note  [/]·select  d·del  S·stats  esc·back")
+		return withStatus("  a·ack  A·unack  R·resolve  s·assign  z·snooze  Z·unsnooze  c·note  [/]·select  d·del  esc·back")
 
 	case modeAlertDetail:
-		return withStatus("  i·open incident  S·stats  esc·back")
+		return withStatus("  i·open incident  esc·back")
 
 	case modeNote:
 		return "\n" + styleFooter.Render("  enter·submit  esc·cancel")
@@ -115,9 +116,6 @@ func (m Model) renderFooter() string {
 	case modeConfirm:
 		return "\n" + styleError.Render("  "+m.confirmPrompt())
 
-	case modeStats:
-		return withStatus("  esc·back")
-
 	case modeUserPicker:
 		if m.pickerTarget == pickerIncidentAssignee {
 			return withStatus("  j/k·navigate  enter·assign incident  esc·cancel")
@@ -131,6 +129,9 @@ func (m Model) renderFooter() string {
 	case modeUserCreate:
 		return withStatus("  tab·next field  enter·create  esc·cancel")
 
+	case modeUserNotifyEdit:
+		return withStatus("  enter·save  esc·cancel   (empty clears the topic)")
+
 	case modeAPIKeyMenu:
 		return withStatus("  n·new key  r·revoke by ID  esc·back")
 
@@ -146,15 +147,17 @@ func (m Model) renderFooter() string {
 	default:
 		switch m.activeSection {
 		case sectionIncidents:
-			return withStatus("  enter·detail  x·archive  f·filter  S·stats  r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  x·archive  f·filter  r·refresh  tab·section  q·quit")
 		case sectionAlerts:
-			return withStatus("  enter·detail  f·filter  S·stats  r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  f·filter  r·refresh  tab·section  q·quit")
+		case sectionStats:
+			return withStatus("  ↑/↓·scroll  r·refresh  tab·section  q·quit")
 		case sectionArchived:
 			return withStatus("  enter·detail  x·unarchive  r·refresh  tab·section  q·quit")
 		case sectionSchedule:
 			return withStatus("  +·assign day  W·assign week  d·del  ←/→·shift week  tab·section  r·refresh  q·quit")
 		case sectionUsers:
-			return withStatus("  n·new user  d·delete  k·API keys  r·refresh  tab·section  q·quit")
+			return withStatus("  n·new user  t·topic  d·delete  k·API keys  r·refresh  tab·section  q·quit")
 		}
 		return "\n" + styleFooter.Render(m.help.ShortHelpView(m.keys.ShortHelp()))
 	}
@@ -175,10 +178,44 @@ func (m Model) confirmPrompt() string {
 		return "Delete schedule entry? [y/N]"
 	case confirmDeleteUser:
 		return fmt.Sprintf("Delete user %s (cascades all API keys)? [y/N]", m.selectedUser.Username)
+	case confirmReassignSchedule:
+		if p := m.pendingAssign; p != nil {
+			return fmt.Sprintf("%s assigned to %s. Reassign to %s? [y/N]",
+				dayCount(len(p.taken), len(p.dates)), joinNames(p.holders), p.username)
+		}
+		return "Reassign these days? [y/N]"
 	}
 	return "Are you sure? [y/N]"
 }
 
+// dayCount phrases how much of an assignment is being taken from somebody. A
+// single day says so plainly; a partial week says which part, because "3 of 7"
+// is the difference between taking a shift and taking somebody's whole week.
+func dayCount(taken, total int) string {
+	switch {
+	case total == 1:
+		return "This day is"
+	case taken == total:
+		return fmt.Sprintf("All %d days are", total)
+	default:
+		return fmt.Sprintf("%d of %d days are", taken, total)
+	}
+}
+
+// joinNames renders a list of people as prose.
+func joinNames(names []string) string {
+	switch len(names) {
+	case 0:
+		return "somebody else"
+	case 1:
+		return names[0]
+	case 2:
+		return names[0] + " and " + names[1]
+	default:
+		return strings.Join(names[:len(names)-1], ", ") + " and " + names[len(names)-1]
+	}
+}
+
 // ── Dashboard ──────────────────────────────────────────────────────────────
 
 func (m Model) renderDashboard() string {
@@ -187,6 +224,8 @@ func (m Model) renderDashboard() string {
 		return m.renderIncidents()
 	case sectionAlerts:
 		return m.renderAlerts()
+	case sectionStats:
+		return m.renderStats()
 	case sectionArchived:
 		return m.renderArchived()
 	case sectionSchedule:
@@ -359,12 +398,24 @@ func (m Model) renderPrompt(prompt string) string {
 // ── Stats ──────────────────────────────────────────────────────────────────
 
 func (m Model) renderStats() string {
-	if m.statsLoading {
+	// Only announce loading before the first result: a background refresh must not
+	// blank the page out from under whoever is reading it.
+	if m.statsLoading && !m.statsLoaded {
 		return "\n" + styleMuted.Render("  Loading statistics…")
 	}
 	return m.statsViewport.View()
 }
 
+// line renders s in a style and terminates it.
+//
+// The newline has to stay outside Render: lipgloss pads every line of a styled
+// block out to its widest line, so a trailing newline inside the block produces
+// a second line made entirely of padding, and whatever is written next starts
+// after that padding instead of at the left margin.
+func line(style lipgloss.Style, s string) string {
+	return style.Render(s) + "\n"
+}
+
 // ── Content builders ───────────────────────────────────────────────────────
 
 func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent, cursor, width int) string {
@@ -391,7 +442,7 @@ func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent,
 	if inc.AssignedTo != "" {
 		b.WriteString(fmt.Sprintf("  Assigned:   %s\n", styleBold.Render(inc.AssignedTo)))
 	} else {
-		b.WriteString(styleMuted.Render("  Assigned:   nobody\n"))
+		b.WriteString(line(styleMuted, "  Assigned:   nobody"))
 	}
 
 	if inc.AcknowledgedByID != nil {
@@ -399,14 +450,14 @@ func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent,
 		if inc.AcknowledgedAt != nil {
 			ackAt = "  at " + inc.AcknowledgedAt.UTC().Format("2006-01-02 15:04 UTC")
 		}
-		b.WriteString(styleResolved.Render(
+		b.WriteString(line(styleResolved,
-			fmt.Sprintf("  Acked:      %s%s\n", inc.AcknowledgedBy, ackAt)))
+			fmt.Sprintf("  Acked:      %s%s", inc.AcknowledgedBy, ackAt)))
 	} else {
-		b.WriteString(styleMuted.Render("  Acked:      not acknowledged\n"))
+		b.WriteString(line(styleMuted, "  Acked:      not acknowledged"))
 	}
 
 	if inc.IsSnoozed() {
-		b.WriteString(styleSnoozed.Render(fmt.Sprintf("  Snoozed:    until %s  (%s)\n",
+		b.WriteString(line(styleSnoozed, fmt.Sprintf("  Snoozed:    until %s  (%s)",
 			inc.SnoozedUntil.UTC().Format("2006-01-02 15:04 UTC"), humanUntil(now, *inc.SnoozedUntil))))
 	}
 
@@ -419,8 +470,8 @@ func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent,
 			inc.ResolvedAt.UTC().Format("2006-01-02 15:04 UTC"), humanAgo(now, *inc.ResolvedAt), source))
 	}
 	if inc.ArchivedAt != nil {
-		b.WriteString(styleMuted.Render("  Archived:   " +
+		b.WriteString(line(styleMuted, "  Archived:   "+
-			inc.ArchivedAt.UTC().Format("2006-01-02 15:04 UTC") + "\n"))
+			inc.ArchivedAt.UTC().Format("2006-01-02 15:04 UTC")))
 	}
 	b.WriteString("\n")
 
@@ -436,7 +487,7 @@ func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent,
 	// Member alerts
 	b.WriteString(divider(fmt.Sprintf("Alerts (%d)", len(inc.Alerts)), width))
 	if len(inc.Alerts) == 0 {
-		b.WriteString(styleMuted.Render("  No alerts.\n"))
+		b.WriteString(line(styleMuted, "  No alerts."))
 	} else {
 		for _, a := range inc.Alerts {
 			marker := styleFiring.Render("●")
@@ -458,7 +509,7 @@ func buildIncidentDetailContent(inc api.Incident, timeline []api.IncidentEvent,
 	notes := noteEvents(timeline)
 	b.WriteString(divider(fmt.Sprintf("Timeline (%d events, %d notes)", len(timeline), len(notes)), width))
 	if len(timeline) == 0 {
-		b.WriteString(styleMuted.Render("  Nothing recorded yet.\n"))
+		b.WriteString(line(styleMuted, "  Nothing recorded yet."))
 	} else {
 		noteIndex := 0
 		for _, e := range timeline {
@@ -538,6 +589,15 @@ func eventLabel(e api.IncidentEvent) string {
 			return "  Resolved by " + who
 		}
 		return "  Resolved (all alerts stopped firing)"
+	case api.EventNotified:
+		// An empty username here is not "the server acted": it means the page
+		// went to the shared fallback topic, so it belongs to nobody.
+		return fmt.Sprintf("  Notified %s%s", notifiedTarget(who), notifyKind(e.Detail))
+	case api.EventNotifyFailed:
+		// The detail is "<kind>: <reason>", and the reason is the point — it is
+		// the only thing that says why nobody's phone rang.
+		return truncate(fmt.Sprintf("  Notification to %s failed · %s",
+			notifiedTarget(who), e.Detail), 52)
 	default:
 		label := "  " + e.Type
 		if e.Detail != "" {
@@ -547,6 +607,25 @@ func eventLabel(e api.IncidentEvent) string {
 	}
 }
 
+// notifiedTarget names who a page reached. The server attaches no user when it
+// published to the shared fallback topic, and saying so is the difference
+// between "somebody was paged" and "the on-call rota was empty".
+func notifiedTarget(username string) string {
+	if username == "" {
+		return "the fallback topic"
+	}
+	return username
+}
+
+// notifyKind renders the notification kind the server puts in Detail. It is an
+// open set, so anything unrecognised is shown rather than dropped.
+func notifyKind(detail string) string {
+	if detail == "" {
+		return ""
+	}
+	return " (" + detail + ")"
+}
+
 func buildAlertDetailContent(alert api.Alert, width int) string {
 	now := time.Now()
 	var b strings.Builder
@@ -584,7 +663,7 @@ func buildAlertDetailContent(alert api.Alert, width int) string {
 			styleBold.Render(fmt.Sprintf("#%d", *alert.IncidentID)),
 			styleMuted.Render("press i to open it")))
 	} else {
-		b.WriteString(styleMuted.Render("  Incident:   none\n"))
+		b.WriteString(line(styleMuted, "  Incident:   none"))
 	}
 	b.WriteString("\n")
 
@@ -606,8 +685,8 @@ func buildAlertDetailContent(alert api.Alert, width int) string {
 
 	// Alerts carry no workflow state: it all lives on the incident.
 	b.WriteString(divider("", width))
-	b.WriteString(styleMuted.Render(
+	b.WriteString(line(styleMuted,
-		"  Alerts are read-only — acknowledge, assign, note and resolve on the incident.\n"))
+		"  Alerts are read-only — acknowledge, assign, note and resolve on the incident."))
 
 	return b.String()
 }
@@ -627,7 +706,7 @@ func buildStatsContent(incidents *api.IncidentStats, top []api.TopAlert, byHour
 	// Response times first: they are what a rota is actually judged on.
 	b.WriteString(divider("Incident Response", width))
 	if incidents == nil {
-		b.WriteString(styleMuted.Render("  No data.\n"))
+		b.WriteString(line(styleMuted, "  No data."))
 	} else {
 		b.WriteString(fmt.Sprintf("  %-28s %s\n", "Incidents total",
 			styleBold.Render(fmt.Sprintf("%d", incidents.Total))))
@@ -642,14 +721,14 @@ func buildStatsContent(incidents *api.IncidentStats, top []api.TopAlert, byHour
 		b.WriteString(fmt.Sprintf("  %-28s %s\n", "Mean time to resolve",
 			styleBold.Render(humanSeconds(incidents.MTTRSeconds))))
 		if incidents.MTTASeconds == nil || incidents.MTTRSeconds == nil {
-			b.WriteString(styleMuted.Render("  (— means nothing has been acknowledged or resolved yet)\n"))
+			b.WriteString(line(styleMuted, "  (— means nothing has been acknowledged or resolved yet)"))
 		}
 	}
 	b.WriteString("\n")
 
 	b.WriteString(divider("Top Alerts", width))
 	if len(top) == 0 {
-		b.WriteString(styleMuted.Render("  No data.\n"))
+		b.WriteString(line(styleMuted, "  No data."))
 	} else {
 		maxCount := top[0].Count
 		for i, a := range top {
@@ -672,7 +751,7 @@ func buildStatsContent(incidents *api.IncidentStats, top []api.TopAlert, byHour
 			b.WriteString(fmt.Sprintf("  %2dh  %-*s %d\n", h.Hour, barWidth, bar, h.Count))
 		}
 	} else {
-		b.WriteString(styleMuted.Render("  No data.\n"))
+		b.WriteString(line(styleMuted, "  No data."))
 	}
 	b.WriteString("\n")
 
@@ -689,7 +768,7 @@ func buildStatsContent(incidents *api.IncidentStats, top []api.TopAlert, byHour
 			b.WriteString(fmt.Sprintf("  %-4s  %-*s %d\n", d.DayName[:3], barWidth, bar, d.Count))
 		}
 	} else {
-		b.WriteString(styleMuted.Render("  No data.\n"))
+		b.WriteString(line(styleMuted, "  No data."))
 	}
 
 	return b.String()
@@ -721,9 +800,19 @@ func (m Model) renderUserCreate() string {
 		emailLabel + m.userFormInputs[1].View() + "\n"
 }
 
+func (m Model) renderUserNotifyEdit() string {
+	header := fmt.Sprintf("\n  Push notifications for %s\n", styleBold.Render(m.selectedUser.Username))
+	hint := line(styleMuted,
+		"  The ntfy topic this user's pages go to. Leave it empty to clear it —\n"+
+			"  their incidents then page the server's shared fallback topic, which\n"+
+			"  carries no Acknowledge button.")
+	label := styleSelected.Render("  Topic:  ")
+	return header + "\n" + hint + "\n" + label + m.ntfyTopicInput.View() + "\n"
+}
+
 func (m Model) renderAPIKeyMenu() string {
 	header := fmt.Sprintf("\n  API keys for %s\n", styleBold.Render(m.selectedUser.Username))
-	warning := styleMuted.Render("  Keys cannot be listed — only new keys can be created,\n  or existing ones revoked by their integer ID.\n")
+	warning := line(styleMuted, "  Keys cannot be listed — only new keys can be created,\n  or existing ones revoked by their integer ID.")
 	options := "\n" +
 		styleAccent.Render("  n") + "  · create a new API key\n" +
 		styleAccent.Render("  r") + "  · revoke a key by ID\n"
@@ -757,7 +846,7 @@ func (m Model) renderAPIKeyReveal() string {
 
 func (m Model) renderAPIKeyRevokeByID() string {
 	header := fmt.Sprintf("\n  Revoke API key for %s\n", styleBold.Render(m.selectedUser.Username))
-	hint := styleMuted.Render("  Enter the integer key ID (shown when the key was created).\n")
+	hint := line(styleMuted, "  Enter the integer key ID (shown when the key was created).")
 	label := styleSelected.Render("  Key ID:  ")
 	return header + "\n" + hint + "\n" + label + m.apiKeyRevokeInput.View() + "\n"
 }
@@ -796,12 +885,19 @@ func renderBarWidth(count, maxCount, maxWidth int) int {
 	return w
 }
 
+// truncate shortens s to max terminal cells, marking the cut with an ellipsis.
+//
+// Counted in runes rather than bytes: these strings are laid out against
+// fixed-width columns, and a byte cut through a multi-byte rune would both
+// mis-measure the column and emit a broken character. Server-supplied text —
+// labels, annotations, delivery errors — is not guaranteed to be ASCII.
 func truncate(s string, max int) string {
 	if max < 1 {
 		return ""
 	}
-	if len(s) <= max {
+	r := []rune(s)
+	if len(r) <= max {
 		return s
 	}
-	return s[:max-1] + "…"
+	return string(r[:max-1]) + "…"
 }

internal/tui/view_test.go

@@ -0,0 +1,346 @@
+package tui
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/yeniklas/terdut-tui/internal/api"
+)
+
+// ansi matches the escape sequences lipgloss emits when it decides the output
+// supports colour, so assertions can be made against the text alone.
+var ansi = regexp.MustCompile(`\x1b\[[0-9;]*m`)
+
+func plain(s string) string { return ansi.ReplaceAllString(s, "") }
+
+func mustContain(t *testing.T, got string, wants ...string) {
+	t.Helper()
+	got = plain(got)
+	for _, w := range wants {
+		if !strings.Contains(got, w) {
+			t.Errorf("expected output to contain %q\n--- got ---\n%s", w, got)
+		}
+	}
+}
+
+func TestIncidentDetail_RendersTheWholeStory(t *testing.T) {
+	now := time.Now()
+	ackID := int64(1)
+	alertID := int64(3)
+	inc := api.Incident{
+		ID: 1, Title: "DiskFull (namespace=prod)", Status: api.StatusAcknowledged,
+		Severity:    "critical",
+		GroupLabels: map[string]string{"alertname": "DiskFull", "namespace": "prod"},
+		TriggeredAt: now.Add(-2 * time.Hour),
+		AssignedTo:  "admin", AcknowledgedByID: &ackID, AcknowledgedBy: "admin",
+		AcknowledgedAt: &now,
+		Alerts: []api.Alert{
+			{ID: 3, Name: "DiskFull", Status: "firing",
+				Labels: map[string]string{"instance": "node-1"}, ReceivedAt: now},
+			{ID: 4, Name: "DiskFull", Status: "resolved",
+				Labels: map[string]string{"instance": "node-2"}, ReceivedAt: now},
+		},
+	}
+	timeline := []api.IncidentEvent{
+		{Type: api.EventTriggered, CreatedAt: now},
+		{Type: api.EventAssigned, Username: "admin", CreatedAt: now},
+		{Type: api.EventAlertAdded, AlertID: &alertID, CreatedAt: now},
+		{Type: api.EventAcknowledged, Username: "admin", CreatedAt: now},
+		{Type: api.EventNote, Username: "admin", Detail: "draining node-2", CreatedAt: now},
+	}
+
+	out := buildIncidentDetailContent(inc, timeline, -1, 110)
+	mustContain(t, out,
+		"DiskFull (namespace=prod)", "ACKNOWLEDGED", "CRITICAL",
+		"Assigned:", "admin",
+		"Grouped By", "namespace", "prod",
+		"Alerts (2)", "node-1", "node-2",
+		"Timeline (5 events, 1 notes)",
+		"Incident opened", "Assigned to admin", "Alert #3 joined", "Acknowledged by admin",
+		"admin wrote", "draining node-2",
+	)
+}
+
+func TestIncidentDetail_ShowsSnooze(t *testing.T) {
+	future := time.Now().Add(2 * time.Hour)
+	inc := api.Incident{
+		Title: "Noisy", Status: api.StatusTriggered,
+		TriggeredAt: time.Now(), SnoozedUntil: &future,
+	}
+	// The exact remaining time is humanUntil's business, not this test's — a few
+	// microseconds of elapsed clock turn "in 2h" into "in 1h 59m".
+	mustContain(t, buildIncidentDetailContent(inc, nil, -1, 110),
+		"TRIGGERED (snoozed)", "Snoozed:", "until", "in 1h")
+}
+
+// An expired snooze is not a snooze, so it must not be reported as one.
+func TestIncidentDetail_HidesExpiredSnooze(t *testing.T) {
+	past := time.Now().Add(-time.Hour)
+	inc := api.Incident{
+		Title: "Noisy", Status: api.StatusTriggered,
+		TriggeredAt: time.Now(), SnoozedUntil: &past,
+	}
+	if strings.Contains(plain(buildIncidentDetailContent(inc, nil, -1, 110)), "Snoozed:") {
+		t.Error("an expired snooze should not be rendered")
+	}
+}
+
+func TestIncidentDetail_ShowsResolutionSource(t *testing.T) {
+	now := time.Now()
+	source := "manual"
+	inc := api.Incident{
+		Title: "Done", Status: api.StatusResolved, TriggeredAt: now.Add(-time.Hour),
+		ResolvedAt: &now, ResolutionSource: &source,
+	}
+	mustContain(t, buildIncidentDetailContent(inc, nil, -1, 110),
+		"RESOLVED", "Resolved:", "manual")
+}
+
+func TestIncidentDetail_UnassignedAndUnacknowledged(t *testing.T) {
+	inc := api.Incident{Title: "Fresh", Status: api.StatusTriggered, TriggeredAt: time.Now()}
+	mustContain(t, buildIncidentDetailContent(inc, nil, -1, 110), "nobody", "not acknowledged")
+}
+
+func TestIncidentDetail_EmptyTimeline(t *testing.T) {
+	inc := api.Incident{Title: "Fresh", Status: api.StatusTriggered, TriggeredAt: time.Now()}
+	mustContain(t, buildIncidentDetailContent(inc, nil, -1, 110), "Nothing recorded yet")
+}
+
+func TestIncidentDetail_MarksSelectedNote(t *testing.T) {
+	now := time.Now()
+	timeline := []api.IncidentEvent{
+		{Type: api.EventNote, Username: "admin", Detail: "first", CreatedAt: now},
+		{Type: api.EventNote, Username: "alice", Detail: "second", CreatedAt: now},
+	}
+	inc := api.Incident{Title: "X", Status: api.StatusTriggered, TriggeredAt: now}
+
+	out := plain(buildIncidentDetailContent(inc, timeline, 1, 110))
+	for _, line := range strings.Split(out, "\n") {
+		if strings.Contains(line, "alice") && !strings.HasPrefix(line, "> ") {
+			t.Errorf("expected the selected note marked, got %q", line)
+		}
+		if strings.Contains(line, "admin wrote") && strings.HasPrefix(line, "> ") {
+			t.Errorf("expected the unselected note unmarked, got %q", line)
+		}
+	}
+}
+
+func TestIncidentStatusLabel(t *testing.T) {
+	future := time.Now().Add(time.Hour)
+	tests := []struct {
+		name string
+		inc  api.Incident
+		want string
+	}{
+		{"triggered", api.Incident{Status: api.StatusTriggered}, "● TRIGGERED"},
+		{"acknowledged", api.Incident{Status: api.StatusAcknowledged}, "◐ ACKNOWLEDGED"},
+		{"resolved", api.Incident{Status: api.StatusResolved}, "✓ RESOLVED"},
+		{"snoozed", api.Incident{Status: api.StatusTriggered, SnoozedUntil: &future},
+			"● TRIGGERED (snoozed)"},
+		// A status this client does not know about still has to render.
+		{"unknown", api.Incident{Status: "escalated"}, "ESCALATED"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := incidentStatusLabel(tt.inc); got != tt.want {
+				t.Errorf("expected %q, got %q", tt.want, got)
+			}
+		})
+	}
+}
+
+// The server may add event types after this client ships. An unknown one must
+// still appear on the timeline rather than silently vanishing.
+func TestEventLabel_UnknownTypeFallsBackToItsName(t *testing.T) {
+	got := eventLabel(api.IncidentEvent{Type: "escalated", Detail: "to sre-oncall"})
+	mustContain(t, got, "escalated", "to sre-oncall")
+}
+
+func TestEventLabel_KnownTypes(t *testing.T) {
+	alertID := int64(9)
+	tests := []struct {
+		event api.IncidentEvent
+		want  string
+	}{
+		{api.IncidentEvent{Type: api.EventTriggered}, "Incident opened"},
+		{api.IncidentEvent{Type: api.EventAlertAdded, AlertID: &alertID}, "Alert #9 joined"},
+		{api.IncidentEvent{Type: api.EventAlertResolved, AlertID: &alertID}, "Alert #9 resolved"},
+		{api.IncidentEvent{Type: api.EventAcknowledged, Username: "bo"}, "Acknowledged by bo"},
+		{api.IncidentEvent{Type: api.EventAssigned, Username: "bo"}, "Assigned to bo"},
+		{api.IncidentEvent{Type: api.EventSnoozed, Detail: "2026-08-01T00:00:00Z"},
+			"Snoozed until 2026-08-01T00:00:00Z"},
+		{api.IncidentEvent{Type: api.EventResolved, Username: "bo"}, "Resolved by bo"},
+		// No user means the server closed it via the alert cascade.
+		{api.IncidentEvent{Type: api.EventResolved}, "all alerts stopped firing"},
+		{api.IncidentEvent{Type: api.EventNotified, Username: "bo", Detail: "triggered"},
+			"Notified bo (triggered)"},
+		{api.IncidentEvent{Type: api.EventNotified, Username: "bo", Detail: "reminder"},
+			"Notified bo (reminder)"},
+		// On a notification, no user means the shared fallback topic — not that
+		// the server acted on its own.
+		{api.IncidentEvent{Type: api.EventNotified, Detail: "triggered"},
+			"Notified the fallback topic (triggered)"},
+		{api.IncidentEvent{Type: api.EventNotifyFailed, Username: "bo", Detail: "triggered: ntfy returned 502"},
+			"Notification to bo failed"},
+		{api.IncidentEvent{Type: api.EventNotifyFailed, Detail: "triggered: no route to host"},
+			"Notification to the fallback topic failed"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.event.Type, func(t *testing.T) {
+			mustContain(t, eventLabel(tt.event), tt.want)
+		})
+	}
+}
+
+// The timeline is where a page that never landed becomes visible, so both
+// outcomes have to survive into the rendered pane.
+func TestIncidentDetail_RendersNotifications(t *testing.T) {
+	now := time.Now()
+	inc := api.Incident{ID: 1, Title: "DiskFull", Status: api.StatusTriggered, TriggeredAt: now}
+	timeline := []api.IncidentEvent{
+		{Type: api.EventTriggered, CreatedAt: now},
+		{Type: api.EventNotified, Username: "niklas", Detail: "triggered", CreatedAt: now},
+		{Type: api.EventNotifyFailed, Username: "niklas",
+			Detail: "reminder: ntfy returned 502", CreatedAt: now},
+	}
+
+	got := buildIncidentDetailContent(inc, timeline, -1, 120)
+	mustContain(t, got, "Notified niklas (triggered)", "Notification to niklas failed")
+}
+
+func TestUserNotifyEdit_SaysWhatAnEmptyValueDoes(t *testing.T) {
+	m := sized()
+	m.mode = modeUserNotifyEdit
+	m.selectedUser = api.User{ID: 1, Username: "niklas"}
+
+	mustContain(t, m.View(), "niklas", "empty to clear it", "fallback topic")
+	// The footer has to repeat it: that is where the reader looks for what a key does.
+	mustContain(t, m.renderFooter(), "empty clears the topic")
+}
+
+func TestAlertDetail_SaysItIsReadOnlyAndLinksTheIncident(t *testing.T) {
+	now := time.Now()
+	id := int64(7)
+	alert := api.Alert{
+		ID: 3, Name: "DiskFull", Status: "firing", StartsAt: now.Add(-time.Hour),
+		ReceivedAt: now, IncidentID: &id,
+		Labels:      map[string]string{"instance": "node-1", "severity": "critical"},
+		Annotations: map[string]string{"summary": "disk 90%"},
+	}
+	mustContain(t, buildAlertDetailContent(alert, 110),
+		"DiskFull", "FIRING", "Incident:", "#7", "press i to open it",
+		"instance", "node-1", "summary", "disk 90%",
+		"Alerts are read-only")
+}
+
+func TestAlertDetail_NoIncident(t *testing.T) {
+	alert := api.Alert{ID: 3, Name: "Orphan", Status: "resolved", ReceivedAt: time.Now()}
+	mustContain(t, buildAlertDetailContent(alert, 110), "Incident:", "none")
+}
+
+func TestAlertDetail_ShowsResolutionSource(t *testing.T) {
+	source := "expiry"
+	alert := api.Alert{Name: "Gone", Status: "resolved", ReceivedAt: time.Now(),
+		ResolutionSource: &source}
+	mustContain(t, buildAlertDetailContent(alert, 110), "RESOLVED", "expiry")
+}
+
+// Null MTTA means nothing has been acknowledged, which is a different claim
+// from an instant response.
+func TestStats_RendersDashForMissingAverages(t *testing.T) {
+	stats := &api.IncidentStats{Total: 2, Triggered: 2}
+	out := buildStatsContent(stats, nil, nil, nil, 110)
+	mustContain(t, out, "Incident Response", "Mean time to acknowledge", "—",
+		"nothing has been acknowledged or resolved yet")
+}
+
+func TestStats_RendersAverages(t *testing.T) {
+	mtta, mttr := 150.0, 3600.0
+	stats := &api.IncidentStats{Total: 3, Resolved: 1, MTTASeconds: &mtta, MTTRSeconds: &mttr}
+	out := buildStatsContent(stats, []api.TopAlert{{Name: "DiskFull", Count: 4}}, nil, nil, 110)
+	mustContain(t, out, "2m", "1h", "Top Alerts", "DiskFull")
+}
+
+func TestStats_HandlesNoIncidentData(t *testing.T) {
+	mustContain(t, buildStatsContent(nil, nil, nil, nil, 110), "Incident Response", "No data")
+}
+
+func TestView_TabsAndDashboardRender(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{{
+		ID: 1, Title: "DiskFull", Status: api.StatusTriggered, Severity: "critical",
+		AssignedTo: "admin", TriggeredAt: time.Now(),
+	}}
+	m.incidentStats = &api.IncidentStats{Triggered: 1}
+	m.rebuildIncidentTable()
+
+	mustContain(t, m.View(),
+		"Incidents", "Alerts", "Stats", "Archived", "Schedule", "Users",
+		"Triggered: 1", "filter: open",
+		"DiskFull", "critical", "admin",
+		"enter·detail")
+}
+
+func TestView_EmptyStates(t *testing.T) {
+	m := sized()
+	m.loading = false
+	mustContain(t, m.View(), "No open incidents.")
+
+	m.activeSection = sectionArchived
+	mustContain(t, m.View(), "No archived incidents.")
+}
+
+// The stats page renders inside the normal section chrome now, so it has to
+// survive the real path: a window size message sizes the viewport and fills it.
+func TestView_StatsSectionRendersInPlace(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute)
+	m.connected = true
+	m.incidentStats = &api.IncidentStats{Total: 3, Triggered: 1}
+	m.topAlerts = []api.TopAlert{{Name: "DiskFull", Count: 4}}
+	m.statsLoaded = true
+
+	next, _ := m.Update(tea.WindowSizeMsg{Width: 120, Height: 40})
+	m = next.(Model)
+	m.activeSection = sectionStats
+
+	out := m.View()
+	mustContain(t, out, "Stats", "Incident Response", "Top Alerts", "DiskFull",
+		"tab·section")
+	if strings.Contains(plain(out), "Loading statistics") {
+		t.Error("loaded stats should not show the loading placeholder")
+	}
+}
+
+func TestView_ConnectionError(t *testing.T) {
+	m := sized()
+	m.connected = false
+	m.err = errFixture{}
+	mustContain(t, m.View(), "Error:", "Press r to retry")
+}
+
+// The footer is the only place the terminal states are explained, so the
+// destructive one has to be visible before it is pressed.
+func TestFooter_IncidentDetailOffersResolveOnlyWhileOpen(t *testing.T) {
+	open := onIncident(openIncidentFixture(), nil)
+	mustContain(t, open.renderFooter(), "R·resolve", "z·snooze", "a·ack")
+
+	closed := onIncident(resolvedIncidentFixture(), nil)
+	if strings.Contains(plain(closed.renderFooter()), "R·resolve") {
+		t.Error("a resolved incident should not offer resolve")
+	}
+	mustContain(t, closed.renderFooter(), "x·archive", "c·note")
+}
+
+func TestView_ZeroWidthRendersNothing(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute)
+	if m.View() != "" {
+		t.Error("expected no output before the first window size message")
+	}
+}
+
+type errFixture struct{}
+
+func (errFixture) Error() string { return "connection refused" }