Stop a table cursor from getting stuck at -1

Assigning an on-call week panicked with "index out of range [-1]" on an
ordinary schedule. The index came from scheduleTable.Cursor().

The cursor is not ours. bubbles' SetRows clamps it down when rows shrink
(`if m.cursor > len(rows)-1`) but never back up, so setting zero rows drives it
to -1 and filling the table afterwards leaves it there -- -1 is not greater
than len-1, so nothing corrects it. Every table in this package is rebuilt from
empty exactly once, when the first WindowSizeMsg arrives before any fetch has
returned, so every cursor started at -1 and stayed there until the user pressed
up or down. Pressing a direction key first is why this was survivable at all.

setRows restores the invariant the rest of the package already assumes: a table
with rows has a usable cursor. Every rebuild goes through it.

Five call sites also bounds-checked only the top of the range, and are now
consistent with their siblings, which already had `i < 0 ||`. They were the
same latent panic: deleting a schedule entry, deleting a user, editing a topic,
opening the API key menu, and the week assignment that actually fired.

The regression test deliberately never calls SetCursor. That is what the
existing schedule tests do, and SetCursor clamps, which is exactly how this got
past them. It drives the real order instead: size, then data, then keys.

Also carries a gofmt pass, which is why untouched files appear in the diff.
The move to git.ryuvia.com rewrote import paths without re-sorting them, and
the new path sorts before github.com/charmbracelet/..., where the old one
sorted after. go vet does not look at import order, so CI had nothing to say.

.gitea/workflows/ci.yaml

@@ -0,0 +1,65 @@
+name: CI
+
+# The release workflow gates a tag, which is late: a broken commit sits green until
+# somebody decides to publish. This runs the same checks on the way in.
+#
+# push is scoped to main so that a branch pushed as part of a pull request is not checked
+# twice.
+#
+# No actions/checkout, deliberately -- same as the terdut-server, letsvisit and charts
+# workflows. The runner image is ubuntu:22.04 whose `nodejs` package is Node 12, and
+# actions/checkout@v4 is built with ES2022 static initialiser blocks, so it dies with
+# `SyntaxError: Unexpected token '{'` before running. Cloning with git directly avoids JS
+# actions entirely. This repo is public, so the clone needs no credential at all.
+#
+# `${{ }}` values are passed through `env:` and referenced as quoted shell variables: a
+# ref name is attacker-influenced by anyone who can push a branch or open a PR, and
+# expanding one straight into `run:` is a shell-injection vector.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# A rapid series of pushes only needs the last one checked.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REPO_URL: https://git.ryuvia.com/niklas/terdut-tui.git
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      # act_runner destroys a job's own volumes when it finishes, so without these every
+      # run re-downloads the whole module graph. The names must appear in the runner's
+      # container.valid_volumes allowlist (charts/act-runner in the k8s repo); unlisted
+      # volumes are dropped silently, so a workflow that looks correct can still be
+      # running uncached.
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ -n "$HEAD_SHA" ]; then
+            # A pull_request ref_name is "<n>/merge", which is not a fetchable branch.
+            git clone "$REPO_URL" .
+            git checkout -q "$HEAD_SHA"
+          else
+            git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+          fi
+
+      - name: Vet
+        run: go vet ./...
+
+      # Covers the API client against a stub server, the Update state machine, and View
+      # rendering -- all three are pure enough to test without a terminal.
+      - name: Test
+        run: go test ./...

.gitea/workflows/release.yaml

@@ -0,0 +1,118 @@
+name: Release
+
+# Checkout, interpolation and caching conventions match ci.yaml -- see the header there
+# for why there are no JS actions and why every `${{ }}` goes through `env:`.
+#
+# There is no upload-artifact/download-artifact equivalent here (both are JS actions, and
+# this Gitea has no artifact store wired up), so the job that builds the binaries is also
+# the job that publishes them. Nothing is handed between jobs.
+#
+# The asset names matter beyond being tidy: internal/updater looks for exactly
+# terdut-tui-<tag>-<goos>-<goarch> in the latest release and reports every available name
+# when it cannot find one. Renaming the pattern here breaks self-update for every
+# installed binary.
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REPO_URL: https://git.ryuvia.com/niklas/terdut-tui.git
+  API: https://git.ryuvia.com/api/v1/repos/niklas/terdut-tui
+
+jobs:
+  # Gates the build, so a tag that fails here publishes no binaries.
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
+  binaries:
+    needs: test
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+
+      - name: Build every target
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -eu
+          mkdir -p dist
+          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
+            GOOS="${target%/*}"
+            GOARCH="${target#*/}"
+            out="dist/terdut-tui-${REF_NAME}-${GOOS}-${GOARCH}"
+            echo "building $out"
+            GOOS="$GOOS" GOARCH="$GOARCH" go build \
+              -ldflags "-X main.version=${REF_NAME}" \
+              -o "$out" .
+          done
+
+      # Creating the release is made idempotent rather than assumed-new: a re-run of a
+      # failed release must not die on the release that already exists. Assets are
+      # replaced the same way, so a re-run repairs a partial upload.
+      - name: Publish the release
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          auth="Authorization: token $TOKEN"
+
+          body=$(curl -sf -H "$auth" "$API/releases/tags/$REF_NAME" || true)
+          if [ -z "$body" ]; then
+            body=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
+              -d "{\"tag_name\":\"$REF_NAME\",\"name\":\"$REF_NAME\"}" \
+              "$API/releases")
+          fi
+
+          # The release object serialises `id` first, so the first match is the release's
+          # own id and not one of the nested author/asset ids.
+          release_id=$(printf '%s' "$body" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+          [ -n "$release_id" ] || { echo "::error::could not determine release id"; exit 1; }
+          echo "release id $release_id"
+
+          for f in dist/*; do
+            name=$(basename "$f")
+            # Drop an existing asset of the same name first: Gitea happily stores two
+            # attachments with one name, and the updater matches by name.
+            old=$(curl -sf -H "$auth" "$API/releases/$release_id/assets" \
+                  | tr '}' '\n' | grep "\"name\":\"$name\"" \
+                  | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2 || true)
+            if [ -n "$old" ]; then
+              curl -sf -X DELETE -H "$auth" "$API/releases/$release_id/assets/$old" || true
+            fi
+            echo "uploading $name"
+            curl -sf -X POST -H "$auth" -F "attachment=@$f" \
+              "$API/releases/$release_id/assets?name=$name" > /dev/null
+          done

.github/workflows/ci.yml

@@ -1,32 +0,0 @@
-name: CI
-
-# The release workflow gates a tag, which is late: a broken commit sits green
-# until somebody decides to publish. This runs the same checks on the way in.
-#
-# push is scoped to main so that a branch pushed as part of a pull request is
-# not checked twice.
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-# A rapid series of pushes only needs the last one checked.
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Vet
-        run: go vet ./...
-
-      - name: Test
-        run: go test ./...

.github/workflows/release.yml

@@ -1,76 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-jobs:
-  # Gates the build, so a tag that fails here publishes no binaries. The suite
-  # covers the API client against a stub server, the Update state machine, and
-  # View rendering — all three are pure enough to test without a terminal.
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Vet
-        run: go vet ./...
-
-      - name: Test
-        run: go test ./...
-
-  build:
-    needs: test
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        include:
-          - goos: linux
-            goarch: amd64
-          - goos: linux
-            goarch: arm64
-          - goos: darwin
-            goarch: amd64
-          - goos: darwin
-            goarch: arm64
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Build
-        env:
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
-        run: |
-          go build \
-            -ldflags "-X main.version=${{ github.ref_name }}" \
-            -o terdut-tui-${{ github.ref_name }}-${{ matrix.goos }}-${{ matrix.goarch }} \
-            .
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: terdut-tui-${{ github.ref_name }}-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: terdut-tui-${{ github.ref_name }}-${{ matrix.goos }}-${{ matrix.goarch }}
-
-  release:
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          merge-multiple: true
-
-      - uses: softprops/action-gh-release@v2
-        with:
-          files: 'terdut-tui-*'

CLAUDE.md

@@ -1,6 +1,6 @@
 # terdut-tui
 
-TUI client for [terdut-server](https://github.com/terdut-server), a Prometheus Alertmanager receiver and incident manager. Requires server **v0.4.0+**.
+TUI client for [terdut-server](https://git.ryuvia.com/niklas/terdut-server), a Prometheus Alertmanager receiver and incident manager. Requires server **v0.4.0+**.
 
 ## Domain model
 

README.md

@@ -1,6 +1,6 @@
 # terdut-tui
 
-A terminal user interface for [terdut-server](https://github.com/terdut-server). Communicates with the server over its REST API.
+A terminal user interface for [terdut-server](https://git.ryuvia.com/niklas/terdut-server). Communicates with the server over its REST API.
 
 Written in Go using [Bubbletea](https://github.com/charmbracelet/bubbletea).
 
@@ -55,10 +55,10 @@ editing one reports the server's 404.
 
 ## Installation
 
-Download the latest release binary for your platform from the [releases page](https://github.com/yeniklas/terdut-tui/releases), or build from source:
+Download the latest release binary for your platform from the [releases page](https://git.ryuvia.com/niklas/terdut-tui/releases), or build from source:
 
 ```bash
-go install github.com/yeniklas/terdut-tui@latest
+go install git.ryuvia.com/niklas/terdut-tui@latest
 ```
 
 ## Configuration
@@ -139,6 +139,13 @@ Schedule section:
 | `d` | Remove the assignment |
 | `←` / `→` | Shift the week window |
 
+One person holds a given day. Assigning over days somebody else already has
+asks first — naming them and how many days are being taken — and moves the whole
+selection at once when you accept, so reassigning a week is one confirmation
+rather than seven deletions. Taking somebody's shift needs terdut-server
+**v0.8.0 or later**; against an older server the assignment is refused with
+`date already assigned`.
+
 Users section:
 
 | Key | Action |

go.mod

@@ -1,4 +1,4 @@
-module github.com/yeniklas/terdut-tui
+module git.ryuvia.com/niklas/terdut-tui
 
 go 1.25.9
 

internal/api/client.go

@@ -358,11 +358,17 @@ func (c *Client) GetCurrentOnCall() (*ScheduleEntry, error) {
 	return &entry, nil
 }
 
-func (c *Client) AssignSchedule(userID int64, dates []string) ([]ScheduleEntry, error) {
+// AssignSchedule puts one user on call for the given dates.
+//
+// The server holds one person per day and refuses a date somebody already has,
+// so replace is what takes a shift off its current holder. It is all-or-nothing
+// either way: a week of free and taken days moves as a unit, or not at all.
+func (c *Client) AssignSchedule(userID int64, dates []string, replace bool) ([]ScheduleEntry, error) {
 	body := struct {
 		UserID  int64    `json:"user_id"`
 		Dates   []string `json:"dates"`
-	}{UserID: userID, Dates: dates}
+		Replace bool     `json:"replace,omitempty"`
+	}{UserID: userID, Dates: dates, Replace: replace}
 	req, err := c.newRequestWithBody(http.MethodPost, "/api/schedule", body)
 	if err != nil {
 		return nil, err

internal/api/client_test.go

@@ -166,6 +166,28 @@ func TestClient_RequestBodies(t *testing.T) {
 		}
 	})
 
+	// replace is what takes a day off its current holder, so it has to reach the
+	// wire when asked for — and stay off it when not.
+	t.Run("assign schedule", func(t *testing.T) {
+		c, got := stub(t, http.StatusCreated, `[]`)
+		if _, err := c.AssignSchedule(3, []string{"2026-07-27"}, false); err != nil {
+			t.Fatalf("assign: %v", err)
+		}
+		if got.body != `{"user_id":3,"dates":["2026-07-27"]}` {
+			t.Errorf("unexpected body %q", got.body)
+		}
+	})
+
+	t.Run("assign schedule with replace", func(t *testing.T) {
+		c, got := stub(t, http.StatusCreated, `[]`)
+		if _, err := c.AssignSchedule(3, []string{"2026-07-27"}, true); err != nil {
+			t.Fatalf("assign: %v", err)
+		}
+		if got.body != `{"user_id":3,"dates":["2026-07-27"],"replace":true}` {
+			t.Errorf("unexpected body %q", got.body)
+		}
+	})
+
 	t.Run("set notify target", func(t *testing.T) {
 		c, got := stub(t, http.StatusOK, `{}`)
 		if _, err := c.SetUserNotifyTarget(3, "terdut-niklas"); err != nil {

internal/tui/model.go

@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"time"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"github.com/charmbracelet/bubbles/help"
 	"github.com/charmbracelet/bubbles/table"
 	"github.com/charmbracelet/bubbles/textinput"
 	"github.com/charmbracelet/bubbles/viewport"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
 // ── Enums ──────────────────────────────────────────────────────────────────
@@ -54,6 +54,7 @@ const (
 	confirmResolveIncident
 	confirmDeleteScheduleEntry
 	confirmDeleteUser
+	confirmReassignSchedule
 )
 
 // pickerTarget says what the user picker is choosing a person for.
@@ -143,6 +144,18 @@ type scheduleDay struct {
 	entry *api.ScheduleEntry
 }
 
+// pendingAssign is an on-call assignment held back by the reassignment
+// confirmation, because some of its dates belong to somebody else.
+type pendingAssign struct {
+	userID   int64
+	username string
+	dates    []string
+	// taken are the dates currently held by other people, and holders the
+	// distinct names holding them — both only for wording the prompt.
+	taken   []string
+	holders []string
+}
+
 type Model struct {
 	client          *api.Client
 	serverURL       string
@@ -194,6 +207,7 @@ type Model struct {
 	confirmTarget      confirmTarget
 	pendingDeleteID    int64 // note event ID
 	pendingDeleteEntry *api.ScheduleEntry
+	pendingAssign      *pendingAssign
 
 	// Stats
 	topAlerts []api.TopAlert
@@ -340,27 +354,45 @@ func defaultTableStyles() table.Styles {
 	return s
 }
 
+// setRows replaces a table's rows and keeps its cursor in a state the rest of
+// this package can rely on: valid whenever the table has any rows at all.
+//
+// bubbles does not do that on its own. SetRows only clamps the cursor *down*
+// (`if m.cursor > len(rows)-1`), so setting zero rows drives it to -1 and
+// nothing ever brings it back — filling the table later leaves -1 in place,
+// because -1 is not greater than len-1. Every table here is rebuilt from empty
+// once at startup, when the first WindowSizeMsg arrives before any fetch has
+// returned, so without this every cursor is -1 until the user happens to press
+// up or down. Indexing a slice with that panics, which is exactly what
+// assigning an on-call week did.
+func setRows(t *table.Model, rows []table.Row) {
+	t.SetRows(rows)
+	if len(rows) > 0 && t.Cursor() < 0 {
+		t.SetCursor(0)
+	}
+}
+
 func (m *Model) rebuildIncidentTable() {
 	m.incidentTable.SetColumns(incidentColumns(m.width))
-	m.incidentTable.SetRows(incidentRows(m.incidents))
+	setRows(&m.incidentTable, incidentRows(m.incidents))
 	m.incidentTable.SetHeight(tableHeight(m.height, 8))
 }
 
 func (m *Model) rebuildTable() {
 	m.alertTable.SetColumns(alertColumns(m.width))
-	m.alertTable.SetRows(alertRows(m.alerts))
+	setRows(&m.alertTable, alertRows(m.alerts))
 	m.alertTable.SetHeight(tableHeight(m.height, 8))
 }
 
 func (m *Model) rebuildArchivedTable() {
 	m.archivedTable.SetColumns(incidentColumns(m.width))
-	m.archivedTable.SetRows(incidentRows(m.archivedIncidents))
+	setRows(&m.archivedTable, incidentRows(m.archivedIncidents))
 	m.archivedTable.SetHeight(tableHeight(m.height, 8))
 }
 
 func (m *Model) rebuildScheduleTable() {
 	m.scheduleTable.SetColumns(scheduleColumns(m.width))
-	m.scheduleTable.SetRows(scheduleRows(m.scheduleDays))
+	setRows(&m.scheduleTable, scheduleRows(m.scheduleDays))
 	m.scheduleTable.SetHeight(tableHeight(m.height, 10))
 }
 
@@ -370,7 +402,7 @@ func (m *Model) rebuildUserPickerTable() {
 	for i, u := range m.users {
 		rows[i] = table.Row{u.Username, u.Email}
 	}
-	m.userPickerTable.SetRows(rows)
+	setRows(&m.userPickerTable, rows)
 	m.userPickerTable.SetHeight(tableHeight(m.height, 10))
 }
 
@@ -384,7 +416,7 @@ func (m *Model) rebuildUserManageTable() {
 		}
 		rows[i] = table.Row{u.Username, u.Email, topic, u.CreatedAt.UTC().Format("2006-01-02")}
 	}
-	m.userManageTable.SetRows(rows)
+	setRows(&m.userManageTable, rows)
 	m.userManageTable.SetHeight(tableHeight(m.height, 10))
 }
 
@@ -866,9 +898,9 @@ func fetchScheduleCmd(client *api.Client, from, to time.Time) tea.Cmd {
 	}
 }
 
-func assignScheduleCmd(client *api.Client, userID int64, dates []string, from, to time.Time) tea.Cmd {
+func assignScheduleCmd(client *api.Client, userID int64, dates []string, replace bool, from, to time.Time) tea.Cmd {
 	return func() tea.Msg {
-		if _, err := client.AssignSchedule(userID, dates); err != nil {
+		if _, err := client.AssignSchedule(userID, dates, replace); err != nil {
 			return scheduleActionErrMsg{err}
 		}
 		entries, err := client.GetSchedule(from.Format("2006-01-02"), to.Format("2006-01-02"))

internal/tui/model_test.go

@@ -4,8 +4,8 @@ import (
 	"testing"
 	"time"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"github.com/charmbracelet/bubbles/table"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
 func TestNextFilter(t *testing.T) {
@@ -277,3 +277,95 @@ func TestBuildScheduleDays(t *testing.T) {
 		t.Error("expected unassigned days to have no entry")
 	}
 }
+
+// ── Schedule reassignment ─────────────────────────────────────────────────
+
+// scheduledWeek builds a model showing the week of 2026-07-27 with the given
+// entries already on the rota.
+func scheduledWeek(entries []api.ScheduleEntry) Model {
+	m := NewModel(nil, "http://test", time.Minute)
+	m.width, m.height = 120, 40
+	m.connected = true
+	m.activeSection = sectionSchedule
+	m.scheduleWindow = time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
+	m.scheduleEntries = entries
+	m.scheduleDays = buildScheduleDays(m.scheduleWindow, entries)
+	m.rebuildScheduleTable()
+	return m
+}
+
+func TestScheduleConflicts(t *testing.T) {
+	m := scheduledWeek([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+		{ID: 2, Date: "2026-07-28", UserID: 3, Username: "sam"},
+		{ID: 3, Date: "2026-07-29", UserID: 2, Username: "alex"},
+	})
+	week := []string{"2026-07-27", "2026-07-28", "2026-07-29", "2026-07-30"}
+
+	// Assigning alex: the days niklas and sam hold are conflicts, the day alex
+	// already holds is not, and the free day is not.
+	taken, holders := m.scheduleConflicts(week, 2)
+	if len(taken) != 2 || taken[0] != "2026-07-27" || taken[1] != "2026-07-28" {
+		t.Errorf("expected the two other people's days, got %v", taken)
+	}
+	if len(holders) != 2 || holders[0] != "niklas" || holders[1] != "sam" {
+		t.Errorf("expected both holders named once, got %v", holders)
+	}
+}
+
+// Reassigning somebody to a day they already hold takes nothing from anyone, so
+// it must not raise a prompt — but it still needs replace, because the server
+// rejects any date that already exists.
+func TestScheduleConflicts_OwnDayIsNotAConflict(t *testing.T) {
+	m := scheduledWeek([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 2, Username: "alex"},
+	})
+	dates := []string{"2026-07-27"}
+
+	if taken, _ := m.scheduleConflicts(dates, 2); len(taken) != 0 {
+		t.Errorf("expected no conflict on the user's own day, got %v", taken)
+	}
+	if !m.scheduleOccupied(dates) {
+		t.Error("expected the day to still count as occupied, so replace is sent")
+	}
+}
+
+func TestScheduleOccupied_FreeDays(t *testing.T) {
+	m := scheduledWeek(nil)
+	if m.scheduleOccupied([]string{"2026-07-27", "2026-07-28"}) {
+		t.Error("expected an empty rota to need no replace")
+	}
+}
+
+func TestDayCount(t *testing.T) {
+	tests := []struct {
+		taken, total int
+		want         string
+	}{
+		{1, 1, "This day is"},
+		{7, 7, "All 7 days are"},
+		{3, 7, "3 of 7 days are"},
+	}
+	for _, tt := range tests {
+		if got := dayCount(tt.taken, tt.total); got != tt.want {
+			t.Errorf("dayCount(%d, %d) = %q, want %q", tt.taken, tt.total, got, tt.want)
+		}
+	}
+}
+
+func TestJoinNames(t *testing.T) {
+	tests := []struct {
+		names []string
+		want  string
+	}{
+		{nil, "somebody else"},
+		{[]string{"niklas"}, "niklas"},
+		{[]string{"niklas", "alex"}, "niklas and alex"},
+		{[]string{"niklas", "alex", "sam"}, "niklas, alex and sam"},
+	}
+	for _, tt := range tests {
+		if got := joinNames(tt.names); got != tt.want {
+			t.Errorf("joinNames(%v) = %q, want %q", tt.names, got, tt.want)
+		}
+	}
+}

internal/tui/styles.go

@@ -3,8 +3,8 @@ package tui
 import (
 	"strings"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
 var (

internal/tui/update.go

@@ -4,10 +4,10 @@ import (
 	"strconv"
 	"strings"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"github.com/atotto/clipboard"
 	"github.com/charmbracelet/bubbles/viewport"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
@@ -468,7 +468,7 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 				return m, nil
 			}
 			cursor := m.scheduleTable.Cursor()
-			if cursor >= len(m.scheduleDays) {
+			if cursor < 0 || cursor >= len(m.scheduleDays) {
 				return m, nil
 			}
 			day := m.scheduleDays[cursor]
@@ -484,7 +484,7 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 				return m, nil
 			}
 			cursor := m.userManageTable.Cursor()
-			if cursor >= len(m.users) {
+			if cursor < 0 || cursor >= len(m.users) {
 				return m, nil
 			}
 			m.selectedUser = m.users[cursor]
@@ -510,7 +510,7 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			return m, nil
 		}
 		cursor := m.userManageTable.Cursor()
-		if cursor >= len(m.users) {
+		if cursor < 0 || cursor >= len(m.users) {
 			return m, nil
 		}
 		m.selectedUser = m.users[cursor]
@@ -527,7 +527,7 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			return m, nil
 		}
 		cursor := m.userManageTable.Cursor()
-		if cursor >= len(m.users) {
+		if cursor < 0 || cursor >= len(m.users) {
 			return m, nil
 		}
 		m.selectedUser = m.users[cursor]
@@ -822,6 +822,7 @@ func (m Model) handleConfirmKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		}
 		m.pendingDeleteID = 0
 		m.pendingDeleteEntry = nil
+		m.pendingAssign = nil
 		return m, nil
 	}
 
@@ -851,6 +852,17 @@ func (m Model) handleConfirmKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeDashboard
 		m.usersLoading = true
 		return m, deleteUserCmd(m.client, userID)
+
+	case confirmReassignSchedule:
+		p := m.pendingAssign
+		m.mode = modeDashboard
+		m.pendingAssign = nil
+		if p == nil {
+			return m, nil
+		}
+		m.scheduleLoading = true
+		return m, assignScheduleCmd(m.client, p.userID, p.dates, true,
+			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 	}
 
 	return m, nil
@@ -881,7 +893,7 @@ func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		}
 
 		scheduleCursor := m.scheduleTable.Cursor()
-		if scheduleCursor >= len(m.scheduleDays) {
+		if scheduleCursor < 0 || scheduleCursor >= len(m.scheduleDays) {
 			m.mode = modeDashboard
 			return m, nil
 		}
@@ -899,15 +911,84 @@ func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		} else {
 			dates = []string{d.Format("2006-01-02")}
 		}
+
+		// The server refuses a date somebody else holds, so ask before taking
+		// it rather than letting the request come back 409. The answer is
+		// already on screen — no round trip is needed to work out who loses
+		// their shift.
+		taken, holders := m.scheduleConflicts(dates, user.ID)
+		if len(taken) > 0 {
+			m.pendingAssign = &pendingAssign{
+				userID:   user.ID,
+				username: user.Username,
+				dates:    dates,
+				taken:    taken,
+				holders:  holders,
+			}
+			m.confirmTarget = confirmReassignSchedule
+			m.mode = modeConfirm
+			return m, nil
+		}
+
 		m.mode = modeDashboard
 		m.scheduleLoading = true
-		return m, assignScheduleCmd(m.client, user.ID, dates,
+		// Nobody else loses anything, but the server rejects any date that
+		// already exists — including days this same person already holds, which
+		// is a no-op worth letting through silently.
+		return m, assignScheduleCmd(m.client, user.ID, dates, m.scheduleOccupied(dates),
 			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 	}
 
 	return m, nil
 }
 
+// scheduleConflicts reports which of dates are already held by somebody other
+// than newUserID, and the distinct names holding them.
+//
+// Days the target already owns are not conflicts — reassigning somebody to
+// their own shift takes nothing from anyone, and prompting for it would be
+// noise. The server still needs replace for those, since it rejects any date
+// that exists.
+func (m Model) scheduleConflicts(dates []string, newUserID int64) (taken, holders []string) {
+	held := make(map[string]api.ScheduleEntry, len(m.scheduleDays))
+	for _, d := range m.scheduleDays {
+		if d.entry != nil {
+			held[d.entry.Date] = *d.entry
+		}
+	}
+	seen := make(map[string]bool)
+	for _, date := range dates {
+		e, ok := held[date]
+		if !ok || e.UserID == newUserID {
+			continue
+		}
+		taken = append(taken, date)
+		if !seen[e.Username] {
+			seen[e.Username] = true
+			holders = append(holders, e.Username)
+		}
+	}
+	return taken, holders
+}
+
+// scheduleOccupied reports whether any of dates already has an entry at all,
+// including one belonging to the incoming user. That is what decides whether
+// the request needs replace, as opposed to whether it needs confirming.
+func (m Model) scheduleOccupied(dates []string) bool {
+	held := make(map[string]bool, len(m.scheduleDays))
+	for _, d := range m.scheduleDays {
+		if d.entry != nil {
+			held[d.entry.Date] = true
+		}
+	}
+	for _, date := range dates {
+		if held[date] {
+			return true
+		}
+	}
+	return false
+}
+
 // ── User management ───────────────────────────────────────────────────────────
 
 func (m Model) handleUserCreateKey(msg tea.KeyMsg) (Model, tea.Cmd) {

internal/tui/update_test.go

@@ -5,8 +5,8 @@ import (
 	"testing"
 	"time"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
 // press sends one key and returns the resulting model and command. A nil command
@@ -309,6 +309,109 @@ func TestDeleteNote_ConfirmsThenActs(t *testing.T) {
 	}
 }
 
+// ── Schedule reassignment ─────────────────────────────────────────────────
+
+// pickingOnCall opens the user picker for the schedule day at dayIndex, which
+// is where a reassignment actually starts.
+func pickingOnCall(entries []api.ScheduleEntry, dayIndex int, week bool) Model {
+	m := scheduledWeek(entries)
+	m.users = []api.User{
+		{ID: 1, Username: "niklas", Email: "n@example.com"},
+		{ID: 2, Username: "alex", Email: "a@example.com"},
+	}
+	m.rebuildUserPickerTable()
+	m.scheduleTable.SetCursor(dayIndex)
+	m.pickerAssignWeek = week
+	m.pickerTarget = pickerSchedule
+	m.mode = modeUserPicker
+	m.userPickerTable.SetCursor(1) // alex
+	return m
+}
+
+// The bug: a day somebody already holds could not be handed to anybody else.
+// The server refuses it, so the TUI has to ask first and then say so.
+func TestSchedule_ReassigningATakenDayAsksFirst(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+
+	m, cmd := press(t, m, "enter")
+
+	if m.mode != modeConfirm || m.confirmTarget != confirmReassignSchedule {
+		t.Fatalf("expected a reassignment confirmation, got mode %v target %v",
+			m.mode, m.confirmTarget)
+	}
+	if cmd != nil {
+		t.Error("expected nothing sent to the server before confirming")
+	}
+	mustContain(t, m.confirmPrompt(), "This day is assigned to niklas", "Reassign to alex?")
+}
+
+func TestSchedule_ReassignConfirmedSends(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+	m, _ = press(t, m, "enter")
+
+	m, cmd := press(t, m, "y")
+	if cmd == nil {
+		t.Fatal("expected the confirmed reassignment to be sent")
+	}
+	if m.mode != modeDashboard {
+		t.Errorf("expected a return to the dashboard, got mode %v", m.mode)
+	}
+	if m.pendingAssign != nil {
+		t.Error("expected the pending assignment cleared")
+	}
+}
+
+// Declining must leave the rota alone — that is the whole point of the guard.
+func TestSchedule_ReassignDeclinedSendsNothing(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-27", UserID: 1, Username: "niklas"},
+	}, 0, false)
+	m, _ = press(t, m, "enter")
+
+	m, cmd := press(t, m, "n")
+	if cmd != nil {
+		t.Error("expected nothing sent when the reassignment is declined")
+	}
+	if m.pendingAssign != nil {
+		t.Error("expected the pending assignment discarded")
+	}
+}
+
+// A free day is the path that always worked, and must not grow a prompt.
+func TestSchedule_AssigningAFreeDayDoesNotAsk(t *testing.T) {
+	m := pickingOnCall(nil, 0, false)
+
+	m, cmd := press(t, m, "enter")
+	if m.mode != modeDashboard {
+		t.Errorf("expected no prompt for a free day, got mode %v", m.mode)
+	}
+	if cmd == nil {
+		t.Error("expected the assignment to be sent straight away")
+	}
+}
+
+// The week case is the one that was worst: a single taken day rejected all
+// seven. One prompt now covers the lot, and it says how much is being taken.
+func TestSchedule_ReassigningAPartlyTakenWeekAsksOnce(t *testing.T) {
+	m := pickingOnCall([]api.ScheduleEntry{
+		{ID: 1, Date: "2026-07-28", UserID: 1, Username: "niklas"},
+		{ID: 2, Date: "2026-07-30", UserID: 3, Username: "sam"},
+	}, 0, true)
+
+	m, _ = press(t, m, "enter")
+	if m.confirmTarget != confirmReassignSchedule {
+		t.Fatalf("expected one confirmation for the week, got target %v", m.confirmTarget)
+	}
+	if got := len(m.pendingAssign.dates); got != 7 {
+		t.Errorf("expected all 7 days in the assignment, got %d", got)
+	}
+	mustContain(t, m.confirmPrompt(), "2 of 7 days are assigned to niklas and sam")
+}
+
 // ── Ntfy topic ────────────────────────────────────────────────────────────
 
 // onUsers puts the model in the Users section with a loaded table.
@@ -573,3 +676,50 @@ func containsAll(s string, subs ...string) bool {
 	}
 	return true
 }
+
+// The bug: assigning an on-call week panicked with "index out of range [-1]"
+// on a perfectly normal schedule, as long as nobody had moved the cursor first.
+//
+// The cause is not in this package. bubbles' SetRows clamps the cursor down but
+// never up, so the empty rebuild every table gets from the first WindowSizeMsg
+// -- which arrives before any fetch returns -- pins the cursor at -1, and
+// loading real rows afterwards leaves it there. Pressing up or down hid it,
+// which is why every existing test missed it: they all call SetCursor, and
+// SetCursor clamps.
+//
+// So this test must NOT touch the cursor. It reproduces the real order of
+// events: size first, data second, keys third.
+func TestSchedule_AssignWeekAfterStartupSizingDoesNotPanic(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute)
+	m.connected = true
+	m.activeSection = sectionSchedule
+	m.scheduleWindow = time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
+
+	// 1. Terminal size arrives while every table is still empty.
+	next, _ := m.Update(tea.WindowSizeMsg{Width: 120, Height: 40})
+	m = next.(Model)
+
+	// 2. The schedule and the user list land.
+	next, _ = m.Update(scheduleFetchedMsg{entries: []api.ScheduleEntry{}})
+	m = next.(Model)
+	next, _ = m.Update(usersFetchedMsg{users: []api.User{
+		{ID: 1, Username: "niklas", Email: "n@example.com"},
+	}})
+	m = next.(Model)
+
+	if got := m.scheduleTable.Cursor(); got < 0 {
+		t.Fatalf("schedule cursor is %d after loading %d days; a populated table must have a usable cursor",
+			got, len(m.scheduleDays))
+	}
+
+	// 3. Assign the week to the first user, without ever moving a cursor.
+	m, _ = press(t, m, "W")
+	if m.mode != modeUserPicker {
+		t.Fatalf("W did not open the user picker, got mode %v", m.mode)
+	}
+	m, _ = press(t, m, "enter") // panicked here
+
+	if m.mode == modeUserPicker {
+		t.Fatal("enter left the picker open; the assignment never went anywhere")
+	}
+}

internal/tui/view.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"time"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
 // Order must match the section constants — renderTabs indexes this by ordinal.
@@ -178,10 +178,44 @@ func (m Model) confirmPrompt() string {
 		return "Delete schedule entry? [y/N]"
 	case confirmDeleteUser:
 		return fmt.Sprintf("Delete user %s (cascades all API keys)? [y/N]", m.selectedUser.Username)
+	case confirmReassignSchedule:
+		if p := m.pendingAssign; p != nil {
+			return fmt.Sprintf("%s assigned to %s. Reassign to %s? [y/N]",
+				dayCount(len(p.taken), len(p.dates)), joinNames(p.holders), p.username)
+		}
+		return "Reassign these days? [y/N]"
 	}
 	return "Are you sure? [y/N]"
 }
 
+// dayCount phrases how much of an assignment is being taken from somebody. A
+// single day says so plainly; a partial week says which part, because "3 of 7"
+// is the difference between taking a shift and taking somebody's whole week.
+func dayCount(taken, total int) string {
+	switch {
+	case total == 1:
+		return "This day is"
+	case taken == total:
+		return fmt.Sprintf("All %d days are", total)
+	default:
+		return fmt.Sprintf("%d of %d days are", taken, total)
+	}
+}
+
+// joinNames renders a list of people as prose.
+func joinNames(names []string) string {
+	switch len(names) {
+	case 0:
+		return "somebody else"
+	case 1:
+		return names[0]
+	case 2:
+		return names[0] + " and " + names[1]
+	default:
+		return strings.Join(names[:len(names)-1], ", ") + " and " + names[len(names)-1]
+	}
+}
+
 // ── Dashboard ──────────────────────────────────────────────────────────────
 
 func (m Model) renderDashboard() string {

internal/tui/view_test.go

@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/yeniklas/terdut-tui/internal/api"
 )
 
 // ansi matches the escape sequences lipgloss emits when it decides the output

internal/updater/updater.go

@@ -12,7 +12,14 @@ import (
 	"strings"
 )
 
-const releaseAPI = "https://api.github.com/repos/yeniklas/terdut-tui/releases/latest"
+// Gitea's release payload carries the same tag_name, and its attachments the same name
+// and browser_download_url, so the types below are unchanged from the GitHub original.
+//
+// A binary installed before the move still polls api.github.com and will never see a
+// release published here. That GitHub repository is still in place, so such a build
+// reports itself up to date rather than erroring -- its last GitHub release is the
+// bridge, and crossing it is a one-time manual download.
+const releaseAPI = "https://git.ryuvia.com/api/v1/repos/niklas/terdut-tui/releases/latest"
 
 type release struct {
 	TagName string  `json:"tag_name"`
@@ -125,7 +132,7 @@ func fetchLatest() (*release, error) {
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("Accept", "application/json")
 
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
@@ -134,7 +141,7 @@ func fetchLatest() (*release, error) {
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("GitHub API returned %s", resp.Status)
+		return nil, fmt.Errorf("Gitea API returned %s", resp.Status)
 	}
 
 	var rel release

main.go

@@ -5,11 +5,11 @@ import (
 	"fmt"
 	"os"
 
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/config"
+	"git.ryuvia.com/niklas/terdut-tui/internal/tui"
+	"git.ryuvia.com/niklas/terdut-tui/internal/updater"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/yeniklas/terdut-tui/internal/api"
-	"github.com/yeniklas/terdut-tui/internal/config"
-	"github.com/yeniklas/terdut-tui/internal/tui"
-	"github.com/yeniklas/terdut-tui/internal/updater"
 )
 
 var version = "dev"