diff --git a/CHANGELOG.md b/CHANGELOG.md
index c3034dc..bfafa17 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,15 @@
 
 All notable changes to Workout Lens are documented here.
 
+## [1.5.16] — 2026-05-19
+
+### Accessibility
+- **Fix WCAG AA contrast violations across codebase (issue #262)** — systematic audit identified four categories of failures:
+  - **Filled accent backgrounds**: `--accent` (#ee2c80, 3.95:1 vs white — FAIL) was used as `background` with white text on the Home CTA button, MuscleMapConfirm Today/Other-day pills and Save CTA, Settings save button, and Report add-to-library button. Replaced with `--accent-active` (#b5116a, ~6.45:1 vs white — PASS) in all five locations.
+  - **`--accent-soft` text in light mode**: `--accent-soft: #ff7eb6` used as text colour on `--accent-bg-14` backgrounds produces ~1.77:1 in light mode (FAIL). Added `--accent-soft: #b5116a` override to the `[data-theme="g10"]` block in `carbon-tokens.css`; dark mode keeps the existing `#ff7eb6` (~7.7:1 on dark bg — PASS).
+  - **`--exercise` label text on `--exercise-soft` background**: 10px mono label in `OvelsePicker` used `--exercise` (#1a8c4e in light mode) on a pale `--exercise-soft` background (~3.79:1 — FAIL). Changed to `--cds-text-primary` for that label; green identity preserved via border and icon.
+  - **Focus rings suppressed on raw inputs**: inline `outline: none` on custom-styled `<input>` elements in `ExFlyt`, `GruppetimePicker`, `OvelsePicker`, and `Planlegger` overrode the app-level CSS rule. Removed all four inline suppressions and broadened `app.css` to cover `input:not(.cds--text-input):not(.cds--search-input):focus-visible`.
+
 ## [1.5.15] — 2026-05-19
 
 ### Accessibility
diff --git a/CLAUDE.md b/CLAUDE.md
index e5d0c29..fbdf86c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,459 +1,183 @@
 # BodyMapTraining — CLAUDE.md
 
-## Remember this if you are an AI
-**Verification before closing issue**
-All issues must be verified by the developer before you can close them on github. Either on dev, qa or prod (user decides). Regardless of method, AI must wait until user has verified fix to close issues.
-
-**Update docs before every push or PR**
-Before pushing to master or opening a PR, update all three of:
-1. **`CLAUDE.md`** — architecture decisions, component descriptions, utility exports, known pitfalls
-2. **`README.md`** — user-facing feature summary and deployment notes
-3. **`CHANGELOG.md`** — add an entry under the current version (or create one) describing what changed and why
-
-**Issue format**
-All GitHub issues follow this structure:
-- **Title:** `As a [user/developer] I want to [action] so I can [benefit]`
-- **`## Summary`** — one paragraph describing the problem and goal
-- **`## Priority`** — High / Medium / Low (include for developer/infra issues)
-- **`## UI spec (Carbon g100)`** — bullet-point spec for any UI changes (Carbon rules apply)
-- **`## Data model`** — SQL schema snippet for any new or changed tables
-- **`## Acceptance criteria`** — GitHub task-list checkboxes (`- [ ]`) covering all done conditions
-- **`## Out of scope`** — explicit exclusions to prevent scope creep (optional but recommended for larger issues)
+## AI rules
+- **Never close a GitHub issue** without developer verification on dev, QA, or prod.
+- **Before every push or PR**, update `CLAUDE.md`, `README.md`, and `CHANGELOG.md`.
+- **Issue format:** Title: `As a [user] I want to [action] so I can [benefit]`. Sections: Summary, Priority, UI spec (Carbon g100), Data model, Acceptance criteria, Out of scope.
 
+## Project
+**Workout Lens** — gym instructors photograph a whiteboard workout, Claude Vision identifies muscles trained, app shows a body map + recommendations. Live at [workout.umulig.org](https://workout.umulig.org).
 
-## Glossary
-
-Canonical definitions for domain terms. When a term is ambiguous in an issue or conversation, refer here — or ask for clarification before implementing.
-
-### People & roles
-
-| Term | Definition |
-|---|---|
-| **User** | The person logged into Workout Lens. A gym instructor employed at a sporty.no gym. Maps to `auth.uid()`, `sessions.trainer_id`, `user_id` across all tables. |
-| **Trainer** | Avoid this term. It is ambiguous — could mean the app user or the gym class instructor. If someone says "trainer" in an issue or conversation, ask: do you mean the app user, or the instructor who led the class? In code, `trainer_id` is a legacy DB column name that refers to the app user. |
-| **Instructor** | The person who *leads* a gym class, sourced from sporty.no. Stored in `gym_calendar.instructor`. Has no account in the app. Example: "Linda Hatlevik." When unqualified, "instructor" always means this — the class leader, not the app user. |
-| **Co-instructor** | Another app user registered at the same gym (`sporty_business_unit_id`). Their sessions are cross-readable via RLS. |
-| **Display name** | A user's visible name in the app. Stored in `profiles.display_name`. Auto-set to email prefix on first login. |
+**Stack:** React 19 + Vite · IBM Carbon Design System · Supabase (magic-link auth + PostgreSQL) · Anthropic Claude API (proxied via Azure Function) · Azure Static Web Apps · GitHub Actions CI/CD · `react-i18next` (nb default, en, fa/RTL)
 
-### Training concepts
+## Muscle IDs (17)
+```
+chest, shoulders_front, shoulders_side, biceps, forearms, abs, obliques, quads, calves
+traps, rear_delts, lats, triceps, lower_back, glutes, hamstrings, calves_back
+```
+Defined in `MUSCLES` in `app/src/lib/bodymap.js`. Primary = solid green, secondary = blue diagonal hatch.
 
+## Glossary
 | Term | Definition |
 |---|---|
-| **Session** | One logged workout. One row in `sessions`. Logged by a user (`trainer_id`). Optionally linked to a gym class (`gym_calendar_id`). |
-| **Gym class** | A scheduled class from sporty.no. Stored in `gym_calendar`. Has a name, instructor, start/end time. Synced by `sportySync.js`. |
-| **Session exercise** | One exercise performed within a session. Stored in `session_exercises`. Has name, sets, reps, and muscle activations. |
-| **Library exercise** | A saved, reusable exercise with a standardised name and default muscle map. Stored in `exercise_library`. Can be referenced by templates. |
-| **Template** | A named, reusable workout skeleton owned by a user. Stored in `session_templates`. Contains ordered template exercises. |
-| **Template exercise** | An exercise slot inside a template. Stored in `session_template_exercises`. Name and muscles are a denormalised snapshot — renaming the library source doesn't affect it. |
-| **Week plan** | An assignment of templates to days of a specific ISO week. Stored in `week_plans` + `week_plan_days`. |
-
-### Muscle concepts
+| **User** | Logged-in gym instructor. Maps to `auth.uid()`, `sessions.trainer_id`. |
+| **Trainer** | Avoid — ambiguous. `trainer_id` in DB = the app user (legacy column name). |
+| **Instructor** | Person who *leads* a gym class (from sporty.no). No app account. |
+| **Co-instructor** | Another app user at the same gym. Can read each other's sessions via RLS. |
+| **Session** | One logged workout row in `sessions`. |
+| **Gym class** | Sporty.no scheduled class in `gym_calendar`, synced by `sportySync.js`. |
+| **Template** | Named reusable workout skeleton in `session_templates`. |
+| **Week plan** | Templates assigned to days of an ISO week (`week_plans` + `week_plan_days`). |
+| **Business unit** | Gym location — `sporty_business_unit_id = 8` (hardcoded). |
+| **Period** | Report filter duration — 7, 30, or 90 days. |
+
+## Carbon design system — hard rules
+- **Sentence case** for all labels
+- **0px border-radius** on buttons/inputs/cards — exceptions: pills `var(--r-pill)`, cards `var(--r-card)`, tiles `var(--r-tile)`
+- **No emoji** — use `@carbon/icons-react` exclusively
+- **IBM Plex everywhere** — no system-font fallbacks
+- **Semantic tokens only** (`var(--cds-*)` or `var(--wl-*)`) — raw hex breaks the theme toggle
+- **No gradients** — solid colors only
+- **Filter chips** — always `flexWrap: wrap`; never `overflowX: auto` without a constrained parent
 
-| Term | Definition |
-|---|---|
-| **Muscle ID** | One of 17 fixed string keys (e.g. `chest`, `lats`, `quads`). The canonical identifier used in the DB, prompts, and bodymap. Full list in `MUSCLES` in `bodymap.js`. |
-| **Primary muscle** | A muscle directly targeted by an exercise. `muscle_activations.activation_type = 'primary'`. Shown as solid green on the body map. |
-| **Secondary muscle** | A muscle engaged in a supporting/stabilising role. `activation_type = 'secondary'`. Shown as blue diagonal hatch on the body map. |
-| **Muscle activation** | A DB record linking a session exercise to a muscle ID with a type. Stored in `muscle_activations`. |
+### Key custom tokens
+`--accent` (#ee2c80 magenta, decorative only) · `--accent-active` (#b5116a, WCAG AA ~6.45:1 vs white — **use this for filled backgrounds with white text**) · `--accent-soft` (#ff7eb6 dark / #b5116a light, text on tinted bg) · `--exercise` (#7af2a4 dark / #1a8c4e light green) · `--heat-1..5` (green scale) · `--r-card` (16px) · `--r-pill` (999px) · `--r-tile` (10px) · `--cond` (IBM Plex Condensed)
 
-### System concepts
+**WCAG rule:** Never use `--accent` (#ee2c80) as a `background` with white/light text — it fails AA (3.95:1). Use `--accent-active` instead for any filled interactive element (buttons, active pills, CTAs).
 
-| Term | Definition |
-|---|---|
-| **Business unit** | A gym location in sporty.no. Identified by `sporty_business_unit_id` (hardcoded as `8`). Used to scope RLS policies and the sporty sync. |
-| **Gym calendar** | The sporty.no schedule mirrored in the `gym_calendar` table. Populated by `sportySync.js` three times daily. |
-| **Recommendation** | A Claude-generated exercise suggestion based on untrained muscle gap analysis for a period. Cached in `recommendation_cache` keyed by prompt version + period + muscle coverage. |
-| **Period** | A filter duration on the Report page — 7, 30, or 90 days back from today. |
-| **View** | Front or back side of the body SVG. Not to be confused with React "views" (the full-page components). |
-
-## Project overview
-**Workout Lens** — a workout-logging app. User photographs a handwritten training program from a gym whiteboard (sporty.no format), the app analyses the image via Claude Vision, displays which muscles were trained on a body figure, and gives next-session recommendations.
-
-## Tech stack
-- **Frontend:** React 19 + Vite (in `app/`)
-- **Design system:** IBM Carbon Design System (`@carbon/react`, `@carbon/icons-react`) — see [Carbon design system](#carbon-design-system) section
-- **Auth + DB:** Supabase (magic-link login, Supabase Auth + PostgreSQL)
-- **AI:** Anthropic Claude API — proxied via Azure Function (server-side); model IDs managed in `app/src/lib/prompts.js`
-- **Hosting:** Azure Static Web Apps — **live at [workout.umulig.org](https://workout.umulig.org)**
-- **CI/CD:** GitHub Actions — push to `master` → auto-deploy to Azure SWA
-- **i18n:** `react-i18next` — three locales: `nb` (Norwegian, default), `en` (English), `fa` (Persian/RTL); locale files in `app/public/locales/`; singleton in `app/src/lib/i18n.js`; all date/time formatting via `Intl.DateTimeFormat`; use `toIsoDate()` and `isoWeekMonday()` from `utils.js` for date-string / ISO-week needs (no `date-fns`)
-
-## Muscle ID system (17 total)
-```
-chest, shoulders_front, shoulders_side, biceps, forearms, abs, obliques, quads, calves
-traps, rear_delts, lats, triceps, lower_back, glutes, hamstrings, calves_back
-```
-Each has a `view` (front/back) and Norwegian `label` in the `MUSCLES` object in `app/src/lib/bodymap.js`.
-
-## Carbon design system
-
-Uses `@carbon/react` and `@carbon/icons-react`. IBM Plex fonts (Sans, Mono, Serif, Condensed) bundled locally in `app/public/fonts/` — no Google Fonts, no CDN.
-
-- `app/src/styles/carbon-tokens.css` — all Carbon CSS variables for g10 (light) and g100 (dark) themes, plus `@font-face` declarations; font URLs use `/fonts/...` (Vite public-dir absolute paths)
-- `app/src/theme.jsx` — exports only `ThemeProvider`, which sets `data-theme="g10"` or `data-theme="g100"` on `<html>`, persists to `localStorage`. Default (no saved preference): respects OS `prefers-color-scheme` — dark OS → g100, light OS → g10. `ThemeCtx` lives in `hooks.js`; `useTheme` is imported from there, not from `theme.jsx`.
-- `Login.jsx` → Carbon `TextInput`, `Button`, `InlineNotification`, `Email` icon; `getDailyQuote()` renders a date-aware motivational quote below the subtitle — English only (hardcoded; language preference is unknown before login); keyed by `MM-DD` for special dates (`01-01`, `12-24`), falls back to a per-weekday quote; 13px italic `var(--cds-text-secondary)`
-- `MuscleMap.jsx` → orchestrator (352 lines): `useReducer` + all 4 `useEffect` hooks + `addImage`/`handleFiles`/`analyze`/`confirm`/`recommend` callbacks + step-indicator strip; delegates rendering to `MuscleMapUpload`, `MuscleMapConfirm`, `MuscleMapResult`; exports `initialState`, `reducer`, `localDateStr`. Sub-components: `MuscleMapUpload.jsx` (dropzone, image grid, ghost shortcuts, analyze CTA); `MuscleMapConfirm.jsx` (layer-02 wrapper, today/other-day pill, date picker, gym-class selector, exercise list, confidence dots, save CTA; includes `getConfidenceColor`); `MuscleMapResult.jsx` (KPI strip, save status, body map, muscle chips, exercise list, recommendations).
-- `History.jsx` → orchestrator (525 lines): all state (sessions, selectedDate, muscleFilter, sessionEdits Map, classHistory Map), all callbacks, session-row header rendering; delegates expanded panel to `SessionEditPanel` and calendar to `MonthGrid`. `MonthGrid.jsx` (103 lines): 7-column CSS grid heatmap, today/selected outlines, interactive day buttons; includes `calHeatColor`. `SessionEditPanel.jsx` (218 lines): gym-class selector, `BodyPanel`, hover-detail card, exercise list via `ExerciseRowWithAutocomplete`, re-upload button, class-history panel, dirty-state save/discard bar; imports `checkGymCalendarConflict` directly. Per-session edit state is `Map<sessionId, editState>` (no global `editMode` boolean); `PageHeading` has `minHeight: 72` to prevent layout shift; all date formatting via `Intl.DateTimeFormat`.
-- `SetSammen.jsx` → landing page for the «Sett sammen»-tab. Two-column grid of `ActionCard` components. Two-color system: magenta (`--accent`) = gruppetimer, green (`--exercise`) = øvelser. Props: `onShowGruppetimePicker`, `onShowOvelsePicker`.
-- `GruppetimePicker.jsx` → lists all templates with live search, mini front-view `BodySVG` thumbnail per row, and a featured magenta «Ny gruppetime» card that expands to a `TextInput` + create form inline. On row click → `onEditTemplate(tpl)`.
-- `OvelsePicker.jsx` → lists all library exercises with region filter chips (Alle / Overkropp / Kjerne / Underkropp / Kondisjon; chips with count=0 are hidden except «Alle»), debounced search, and a featured green «Ny øvelse» card. Exercise rows show up to 3 primary muscle names + «BRUKT I N GT» count (colored `--accent-soft` to visually separate it from the muscle names). Clicking a row opens `ExerciseForm` directly for editing (no intermediate detail screen). Uses `fetchExerciseTemplateCounts()` to batch-load template usage counts on mount.
-- `GruppetimeEditor.jsx` → dedicated editor for group-class templates (issue #174, sprint 4). **Separate from `TemplateSessionEditor` — do not merge.** Features: live `BodyPanel` coverage, gap-hint chips for untrained muscles, up/down reorder handles per exercise row, «Velg øvelse» (opens `ExFlyt`) + «Ny øvelse» (manual) add controls as green bar-buttons, inline template name rename via `TextInput`, creator + last-used metadata footer. Saves via `replaceTemplateExercises` + `updateTemplateDetails`. `template_type` column exists on `session_templates` but has no UI consumer yet.
-- `ExFlyt.jsx` → slide-up overlay modal for adding exercises to a GruppetimeEditor template. Search existing library exercises or quick-create a new entry with AI muscle inference. Closes via `onClose`; adds via `onAdd(exercise)`.
-- `TemplatePicker.jsx` → Carbon `Button`, `InlineLoading`, `InlineNotification`
-- `TemplateSessionEditor.jsx` → `layer-02` + 2px accent top border container; `SectionLabel renderIcon={Edit}` header; Carbon `TextInput` for template name (inline rename); step indicator in use mode ("Steg 2 av 3"); no "Lagre mal" in use mode; body map via `BodyPanel`; exercise rows via `ExerciseRowWithAutocomplete`; library search via `LibraryPicker`
-- `MuscleMapConfirm.jsx` → wrapped in `layer-02` + 2px accent top border container; `SectionLabel renderIcon={Edit}` header; Carbon `DatePicker`/`DatePickerInput` for session date (defaults to today, max = today)
-- `BodySVG` / `HeatmapBodySVG` muscle highlights: primary → `var(--heat-4)` solid green, secondary → diagonal blue hatch (`#001d6c` base + `#4589ff` lines). `HeatmapBodySVG` accepts `onHover(id|null)` and `hovered` props — when `onHover` is provided the internal floating tooltip is suppressed and the caller manages the detail card.
-- `Home.jsx` → `SectionLabel` + `PageHeading` headings; last session card with gym-class identity hero; 7-day weekly strip with heat colors — clicking a day that has a session navigates to History pre-selected on that date; `fetchThisWeekSessions` in `db.js`
-- `Report.jsx` → `SectionLabel` eyebrow with period + active day filters on two separate `display:block` spans; three separate `flexWrap: wrap` filter rows (period / weekdays / session types) with `1px solid var(--border-subtle-wl)` top borders between groups; "Nullstill filter" always rendered (opacity-toggled); KPI tiles → heatmap body → hover detail → heat legend → frequency table → gap callout card (with `AccentChip` per untrained muscle) → recommendation button → recs list; when all primary muscles trained shows positive fallback message; when some muscles secondary-only shows those as blue tags; recommendation rows have 3px accent left strip + round `+` button that saves the exercise inline via `saveLibraryExercise`; "Oppdater anbefalinger" ghost button (`Renew` icon) below the recs list — re-runs Claude call and overwrites the cache entry; no `StickyCta`; recs are persisted in the shared `recommendation_cache` Supabase table (see data model) and restored on mount/filter-change via `fetchRecsCache`; prefill prop applied on mount via `useRef` — supports `periodDays`, `selectedDays`, `selectedTypes`, `weekday`, `sessionType`; `KpiTile` (42px Plex Light value); `muscleLastDate` in useMemo
-- `PageShell.jsx` → exports: `SectionLabel` (mono 12px, 0.16em tracking, 3px `var(--accent)` left border; accepts optional `renderIcon` prop — renders the Carbon icon at 14px before the label text), `PageHeading` (Cond 700 28px), `PageTitle` (alias for SectionLabel), `AccentChip` (magenta pill: `var(--accent-bg-14)` bg, `var(--accent-soft)` text), `StickyCta` (sticky bottom bar with top border), `BackButton`; `NavBtn` is a `forwardRef` component accepting `l1` and `l2` props — renders a 2-line Plex Condensed (8px) label below the icon; nav bar height is 56px; nav icons in order: Camera → RecentlyViewed → Analytics → EventSchedule (Planlegger) → Notebook (Sett-sammen) → Settings — 6 icons each 48px wide; theme toggle and logout removed from header (now in Settings view); `ChangelogModal` no longer rendered here. `useNavHints` moved to `app/src/lib/hooks.js` (issue #253)
-- `carbon-tokens.css` → added `--heat-1..5` green scale (#044317 → #42be65); WL custom tokens: `--accent` (#ee2c80 magenta), `--accent-hover` (#d9246f), `--accent-active` (#b5116a — WCAG AA safe with white text ~6:1; use for filled active/selected states), `--surface-card`, `--border-subtle-wl`, `--text-muted-wl`, `--accent-bg-08/14/30`, `--accent-soft`, `--r-card` (16px), `--r-pill` (999px), `--r-tile` (10px), `--cond` (IBM Plex Sans Condensed), `--exercise` (#7af2a4 green, g10 override #1a8c4e), `--exercise-soft` (rgba 12%), `--exercise-mid` (rgba 35%); g10 light-mode overrides for all WL tokens
-- `app.css` → global `html, body { overflow-x: hidden }` to prevent horizontal viewport bleed from chip rows; do not use `overflow: hidden` on direct parents of `flexWrap: wrap` chip containers — it clips instead of scrolling
-### Hard rules (must not regress)
-- **Sentence case** for all labels — `Add exercise`, not `Add Exercise`
-- **0px border-radius** on buttons, inputs, cards — exceptions: Tags/pill chips use `var(--r-pill)` (999px), cards use `var(--r-card)` (16px), tiles use `var(--r-tile)` (10px)
-- **No emoji** — use `@carbon/icons-react` exclusively
-- **IBM Plex everywhere** — no system-font fallbacks visible in the rendered page
-- **Semantic tokens** (`var(--cds-*)` or `var(--wl-*)`) not raw hex — otherwise the theme toggle breaks
-- **No gradients** in product UI — solid colors only
-- **Focus ring** = 2px solid `#0f62fe` outline (Carbon handles this via its component styles)
-- **Filter chips** — always use `flexWrap: wrap`; never `overflowX: auto` on a flex chip container without a constrained parent (it silently fails on mobile Chromium and clips instead of scrolling)
+Skeleton dark-mode tokens must be added to `[data-theme="g100"]` in `carbon-tokens.css` — Carbon emits them under `.cds--g100` class only (see pitfall #164).
 
 ### Token cheat sheet
 | Concept | Token |
 |---|---|
-| Page background | `var(--cds-background)` |
-| Card/tile surface | `var(--cds-layer-01)` |
+| Page bg | `var(--cds-background)` |
+| Card | `var(--cds-layer-01)` |
 | Nested card | `var(--cds-layer-02)` |
 | Border | `var(--cds-border-subtle-01)` |
-| Strong border / input border | `var(--cds-border-strong-01)` |
+| Input border | `var(--cds-border-strong-01)` |
 | Primary text | `var(--cds-text-primary)` |
-| Secondary/muted text | `var(--cds-text-secondary)` |
-| Interactive (blue) | `var(--cds-interactive)` |
+| Muted text | `var(--cds-text-secondary)` |
+| Interactive | `var(--cds-interactive)` |
 | Error | `var(--cds-support-error)` |
-| Body font | `var(--cds-font-sans)` |
-| Mono font | `var(--cds-font-mono)` |
-
-### Adding more Carbon components
-Refer to the official IBM Carbon documentation and `app/src/styles/carbon-tokens.css` for available tokens. The `@carbon/react` package ships full TypeScript types — use them as the component API reference.
-
-## Backlog
-
-Tracked in [GitHub Issues](https://github.com/ChristopherRotnes/BodyMapTraining/issues). Run `gh issue list` for current open work.
-
-## Session data model — edit flow (issue #19)
-
-`updateSession(sessionId, exercises, gymCalendarId)` in `db.js`:
-1. Deletes all `session_exercises` for the session (cascades to `muscle_activations`)
-2. Re-inserts enabled exercises + their `muscle_activations`
-3. Updates `gym_calendar_id` on the `sessions` row
-
-The sessions table has `UNIQUE (gym_calendar_id)` — updating to a gym class that already has a different session raises a Postgres 23505 error, shown to the user as a friendly message.
 
-`saveSession` accepts an optional `sessionDate` param (ISO `yyyy-MM-dd`); defaults to today for backwards compat.
-
-`fetchGymSessionsByDate(dateStr)` generalises `fetchTodayGymSessions` — same query but parameterised. `fetchTodayGymSessions` now delegates to it.
+## Key architecture decisions
 
-## Exercise data model
-```typescript
-{
-  id: number | string,   // number from Claude parse; string (Date.now()) for manually added rows
-  name: string,          // exact name from whiteboard / user-edited
-  standardName: string,  // normalised name
-  primary: string[],     // muscle IDs returned by Claude (or from library)
-  secondary: string[],   // muscle IDs returned by Claude (or from library)
-  enabled: boolean       // toggled in confirm/template step
-}
-```
-Sets and reps are not tracked — group class instructors log *what exercises were in the program*, not volume. DB columns (`sets`, `reps`, `default_sets`, `default_reps`) exist and are nullable.
+**Shared modules** (import from these, never redefine locally):
+- `app/src/lib/bodymap.js` — constants/utils: `MUSCLES`, `SHAPES`, `EX_DB`, `calcMuscles`, `useIsMobile`
+- `app/src/lib/bodymap.jsx` — only `BodySVG` and `HeatmapBodySVG` (use explicit `.jsx` extension)
+- `app/src/lib/hooks.js` — `useDebouncedSearch`, `useFetch`, `useTheme`, `useNavHints`
+- `app/src/lib/utils.js` — `callClaude`, `inferMusclesFromName`, `buildMuscleMapFromExercises`, `buildMuscleMapFromSession`, `buildRecMuscleMap`, `extractMuscles`, `toIsoDate`, `toWeekIso`, `isoWeekMonday`, `weekIsoToMonday`, `getIntlLocale`
+- `app/src/lib/prompts.js` — `CLAUDE_MODEL_VISION`, `CLAUDE_MODEL_TEXT`, `RECS_PROMPT_VERSION`, all prompt builders
 
-## Exercise library + session templates data model (issue #38)
+**Never** add new debounce `useEffect`s — use `useDebouncedSearch`.  
+**Never** write inline `session_exercises(... muscle_activations(...))` SELECT strings in `db.js` — use `SESSION_EXERCISES_SELECT` / `SESSION_EXERCISES_FULL_SELECT`.
 
-Three new Supabase tables:
+**i18n:** All date/time via `Intl.DateTimeFormat` + `getIntlLocale()`. Never hardcode `"no-NO"` or use `date-fns` locale objects.
 
-```sql
-exercise_library          -- named exercises with muscle maps
-  id, user_id, name, primary_muscles text[], secondary_muscles text[],
-  default_sets text, default_reps text, created_at
+**API security:** All Claude calls must go through `callClaude()` in `utils.js`. The proxy (`app/api/claude.js`) requires `X-Supabase-Token` header — NOT `Authorization: Bearer` (Azure SWA intercepts that — see pitfall #57).
 
-session_templates         -- named session skeletons
-  id, user_id, name, sort_order int, used_at timestamptz, created_at
+**Azure Functions entry:** `app/api/index.js` must import every new function file — Azure v4 only loads what `main` references. API files must use raw `fetch` to Supabase REST — never `import { createClient } from '@supabase/supabase-js'`.
 
-session_template_exercises -- ordered exercises within a template
-  id, template_id → session_templates, library_exercise_id → exercise_library (nullable),
-  name text (denormalised snapshot), primary_muscles text[], secondary_muscles text[],
-  sets text, reps text, sort_order int
-```
+**Sporty sync:** `sportySync.js` timer triggers 04:00, 11:00, 14:00 UTC. Timer guarded by `AZURE_FUNCTIONS_ENVIRONMENT === 'Production'` — skipped in local dev.
 
-Name + muscles are denormalised into `session_template_exercises` so renaming a library exercise doesn't silently change existing templates.
+**Recs cache:** Bump `RECS_PROMPT_VERSION` in both `prompts.js` AND `recsCacheCleanup.js` whenever the recommendation prompt or model changes. A CI test (`recsVersion.test.js`) fails if they drift.
 
-`replaceTemplateExercises(templateId, exercises)` in `db.js` does a full delete-and-reinsert — the canonical update path for template exercise lists.
+**CI/CD:** Frontend pre-built in GitHub Actions runner with `VITE_*` env vars, uploaded as `app/dist/`. Do NOT let Oryx build the frontend — it strips `VITE_*` vars.
 
-`touchTemplate(id)` updates `used_at` to now — called on "Bruk økt" so templates sort by recency in TemplatePicker.
+**Supabase client:** `createClient` must pass `global: { headers: { apikey: supabaseKey } }` — the v2 fetch interceptor doesn't reliably add it in browser (see pitfall #9).
 
-## Week plan data model (issue #59)
+**FK constraint:** `session_templates.user_id` and `exercise_library.user_id` reference `profiles(id)`, not `auth.users(id)`. Do not change these FKs.
 
-Two new Supabase tables:
+## Data models
 
-```sql
-week_plans
-  id, user_id, week_iso text (e.g. "2026-W19"), created_at
-  UNIQUE (user_id, week_iso)
+### Session edit flow
+`updateSession(sessionId, exercises, gymCalendarId)` in `db.js`: deletes all `session_exercises` (cascades to `muscle_activations`), re-inserts enabled exercises + activations, updates `gym_calendar_id`. `sessions` has `UNIQUE (gym_calendar_id)` → 23505 error shown as friendly message on conflict.
 
-week_plan_days
-  id, plan_id → week_plans (on delete cascade), day_of_week int (1=Mon…7=Sun),
-  template_id → session_templates (on delete set null, nullable), sort_order int
+### Exercise (in-memory shape)
+```typescript
+{ id: number|string, name: string, standardName: string, primary: string[], secondary: string[], enabled: boolean }
 ```
+Sets/reps not tracked — app logs *what* exercises were in the program, not volume.
 
-`week_plan_days.template_id` nullable — an empty slot is a valid row with `template_id = null`. RLS on both tables restricts all operations to the owning user (`auth.uid() = user_id` / exists check via join).
-
-## Gym-wide shared templates and exercise library
-
-`session_templates` and `exercise_library` are **gym-wide**: any co-instructor at the same gym (via `user_gyms` join) can SELECT, INSERT, UPDATE, and DELETE. `user_id` is retained on both tables as "created by" for attribution display only — it is not an ownership gate.
-
-**FK constraint:** `session_templates.user_id` and `exercise_library.user_id` reference `profiles(id)`, not `auth.users(id)`. PostgREST cannot traverse `auth.users → profiles`, so the `profiles!user_id(display_name)` join would fail at runtime if pointed at `auth.users`. Do not change these FKs back to `auth.users`.
-
-**Editing an exercise does NOT rewrite historical sessions.** `muscle_activations` rows are permanent snapshots written at log time with no FK to `exercise_library`. Correcting a muscle mapping in the library only affects future sessions.
-
-`db.js` functions:
-| Function | Description |
-|---|---|
-| `fetchWeekPlan(weekIso)` | Fetches `week_plans` + `week_plan_days` with joined template data. Returns `{ plan, days }`. |
-| `saveWeekPlan(weekIso, assignments)` | Upserts `week_plans`, deletes + reinserts all `week_plan_days`. `assignments: [{ day_of_week, template_id }]`. |
-| `deleteWeekPlan(weekIso)` | Deletes the `week_plans` row (cascade removes days automatically). |
-| `fetchSessionsForWeek(weekIso)` | Fetches all `sessions` (with `session_exercises` + `muscle_activations.activation_type`) whose `session_date` falls within the ISO week (Mon–Sun). `fetchThisWeekSessions()` now delegates to this with `toWeekIso(new Date())`. Powers Planlegger's "Trent denne uken" body map (#143). |
-| `fetchExerciseTemplateCounts()` | Returns `{ [exercise_id]: number }` — distinct template count per library exercise, using Set deduplication on `template_id`. Used by OvelsePicker to show «BRUKT I N GT». |
-
-## Recommendation cache data model (issue #150)
-
-Shared lookup table — no `user_id` column. Any authenticated user whose filters resolve to the same muscle coverage pattern reuses the cached Claude response without an extra API call.
-
+### DB tables (abbreviated)
 ```sql
-recommendation_cache
-  cache_key   text PRIMARY KEY,   -- v{RECS_PROMPT_VERSION}_{periodDays}_{sessionCount}_{trainedIds}_{untrainedIds}
-  recs        jsonb NOT NULL,      -- array of { name, primary[], secondary[], tip }
-  fetched_at  timestamptz NOT NULL DEFAULT now(),
-  written_by  uuid NOT NULL DEFAULT auth.uid() REFERENCES profiles(id)  -- owner (issue #235)
+exercise_library           -- id, user_id, name, primary_muscles[], secondary_muscles[], created_at
+session_templates          -- id, user_id, name, sort_order, used_at, created_at
+session_template_exercises -- id, template_id, library_exercise_id(nullable), name(snapshot), primary_muscles[], secondary_muscles[], sort_order
+week_plans                 -- id, user_id, week_iso, created_at; UNIQUE(user_id, week_iso)
+week_plan_days             -- id, plan_id, day_of_week(1-7), template_id(nullable), sort_order
+recommendation_cache       -- cache_key(PK), recs jsonb, fetched_at, written_by
 ```
 
-`cache_key` encodes everything Claude sees: prompt version, period, session count, and sorted trained/untrained muscle ID lists. Changing any of these produces a different key → natural cache miss → fresh fetch.
-
-`db.js` functions:
-| Function | Description |
-|---|---|
-| `fetchRecsCache(cacheKey)` | SELECT by `cache_key`, returns `recs` array or `null`. Silent on error. |
-| `saveRecsCache(cacheKey, recs)` | UPSERT on conflict. Fire-and-forget (errors are silent). |
-
-**Cache invalidation:** No explicit invalidation on session changes — if trained/untrained muscles change, the key changes naturally. The weekly `recsCacheCleanup` Azure Function deletes entries older than 7 days (TTL) and entries from a stale `RECS_PROMPT_VERSION`. **Bump `RECS_PROMPT_VERSION` in both `prompts.js` and `recsCacheCleanup.js` whenever the recommendation prompt or model changes.**
-
-## Key architecture decisions
-- **i18n:** `app/src/lib/i18n.js` initialises `i18next` with `fallbackLng: "nb"` and three resource bundles (`nb`, `en`, `fa`). All components use `useTranslation()` for strings. All locale-aware date/time rendering uses `Intl.DateTimeFormat` with a `getIntlLocale()` helper that maps `"nb" → "no"` (the IETF tag `Intl` expects). Never use hardcoded locale strings like `"no-NO"` or `date-fns` locale objects — they break when the user switches language. The `i18n` singleton can be imported directly (`import i18n from "../lib/i18n"`) for `i18n.language` access outside hooks. RTL (`dir="rtl"`) is applied to `<html>` automatically on language change.
-- **Shared muscle/SVG module — split into two files (issue #253):**
-  - `app/src/lib/bodymap.js` — all non-component exports: `MUSCLES`, `SHAPES`, `EX_DB`, `BODY_PATH`, `BODY_POLY`, color constants (`PRIMARY_FILL`, `PRIMARY_HOVER`, `PRIMARY_STROKE`), `calcMuscles`, `useIsMobile`. Import from here for constants and utilities.
-  - `app/src/lib/bodymap.jsx` — only `BodySVG` and `HeatmapBodySVG` components (imports from `bodymap.js`). Import using the explicit `.jsx` extension when importing these components. Do not re-add non-component exports here.
-- **Shared hooks:** `app/src/lib/hooks.js` — exports `useDebouncedSearch(delayMs?)` (returns `{ search, setSearch, debouncedSearch }`; debounced value is raw — trim/lowercase at use-site), `useFetch(fn, deps?)` (returns `{ data, loading, error, setData }`; `setData` allows optimistic updates; use only for data fetched once per mount without mutation-driven refetches), `ThemeCtx` (the React context used by `ThemeProvider`), `useTheme()` (returns `{ theme, setTheme }` from `ThemeCtx`), and `useNavHints()` (returns `[hints: boolean, toggle(val): void]`; reads/writes `localStorage` key `wl-nav-hints`). Import from here; do not copy these patterns locally.
-- **Shared utilities:** `app/src/lib/utils.js` — exports `toBase64`, `getMediaType`, `buildMuscleMapFromExercises` (with EX_DB fallback, for confirm/edit steps), `buildMuscleMapFromSession` (reads saved DB session for History read mode), `buildRecMuscleMap` (for recommendation body maps), `isInvalidNum` (validates sets/reps as integers 1–99), `callClaude(body)` (authenticated fetch to `/api/claude` — returns raw `Response`; always call `await res.json()` to read the body), `inferMusclesFromName(name)` (calls Claude Sonnet text API to infer muscle IDs for a single exercise name — returns `{ primary, secondary }` or `null`; handles markdown code fences defensively), `extractMuscles(session)` (splits `muscle_activations` into primary/secondary Sets, removes primary from secondary), `toWeekIso(date)` (Date → `"2026-W19"` ISO week string), `weekIsoToMonday(weekIso)` (`"2026-W19"` → Monday `Date`), `isoWeekMonday(date)` (Date → Monday `Date` of that ISO week, local time), `toIsoDate(date)` (Date → `"yyyy-MM-dd"` string using local time getters — replaces `date-fns` `format`), `getIntlLocale()` (maps `i18n.language` to the IETF tag `Intl` expects, e.g. `"nb" → "no"`). Do not redefine these locally in component files.
-- **Shared Claude config:** `app/src/lib/prompts.js` — exports `CLAUDE_MODEL_VISION` (sonnet-4-6, for image analysis), `CLAUDE_MODEL_TEXT` (sonnet-4-6, for recommendations), `RECS_PROMPT_VERSION` (integer — bump whenever `buildPeriodRecommendPrompt` or the model changes; old cache entries are swept by the weekly cleanup job; **must also be bumped in `app/api/recsCacheCleanup.js`** — a CI test in `app/api/__tests__/recsVersion.test.js` fails if the two values drift), `ANALYZE_PROMPT`, `buildRecommendPrompt(trained, untrained)`, `buildPeriodRecommendPrompt(periodDays, sessionCount, trainedLabels, untrainedLabels)`, `buildMuscleInferencePrompt(name)` (cheap text-only call for single-exercise muscle inference — strips `<>` from the name and wraps it in `<exercise>…</exercise>` XML tags per Anthropic's prompt injection boundary pattern; 3 regression tests in `prompts.test.js`). All model IDs and prompt text live here; update in one place.
-- Claude returns muscle IDs directly in JSON — local keyword matching (EX_DB) was abandoned because Norwegian abbreviations and whiteboard variants didn't match reliably. EX_DB is kept only as fallback for manually added exercises.
-- SVG body uses `BODY_PATH` (bezier curves, viewBox `0 0 160 360`) — improved silhouette with curved shoulders, arms, waist and hips. Still simplified, not anatomically precise. `SHAPES` entries are either ellipses (`{ cx, cy, rx, ry }`) or SVG paths (`{ d }`); the render loop handles both. Key muscles with path shapes: `traps` (trapezoid with neck notch), `lats` (wing paths). `BodySVG` renders primary muscles as solid green glow, secondary as diagonal blue stripes (`<pattern id="sec-stripe-{view}">`).
-- `useIsMobile(breakpoint=500)` — exported hook from `bodymap.js`. Below breakpoint: single body view with Front/Bak toggle. Above: side-by-side. Consumed via `BodyPanel` — do not use directly in page components.
-- **Shared exercise row:** `app/src/components/ExerciseRow.jsx` — renders one editable exercise row (checkbox, inline name edit, delete). Props: `exercise`, `onChange(updates)`, `onDelete()`, `layer` ("layer-01"/"layer-02"), `validateNumbers`, `autoFocusName`, `onNameBlur` (optional callback fired when the name input blurs — used by `ExerciseRowWithAutocomplete` to trigger muscle inference). The outer row div has no click handler — only the Checkbox toggles `enabled` (prevents accidental untick when editing fields). Used by `MuscleMap.jsx`, `History.jsx`, and `TemplateSessionEditor.jsx`.
-- **Planlegger:** `app/src/components/Planlegger.jsx` — weekly training planner view (issue #59). State: `weekOffset` (±week navigation), `assignments` (`{ [dow 1-7]: template | null }`), `templates`, `weekSessions` (logged sessions for the visible ISO week — issue #143), `pickerDow`, `saving`, `saveError`, `hoveredMuscle`. Computed via `useMemo`: `monday`, `weekIso`, `weekLabel` (built inline with `Intl.DateTimeFormat` for the locale-aware month abbreviation + `t("planlegger.weekLabel", ...)`), `untrainedThisWeekIds` (muscle IDs not trained in any logged session for the visible ISO week — derived from `weekSessions` via `extractMuscles`; issue #143), `projectedExerciseMap` (union of all assigned templates' exercises via `buildMuscleMapFromExercises`), `sessionCount`, `muscleGroupCount`, `untrainedMuscleIds`, `showForslag` (≥2 untrained muscles), `forslagTemplates` (up to 3 templates from library covering untrained muscles). Layout: week nav chevrons → `PageHeading` → `SectionLabel "IKKE TRENT DENNE UKEN"` → wrap row of mono pill chips (History-style: `var(--r-pill)`, `var(--border-subtle-wl)`, `var(--text-muted-wl)`, `var(--cds-font-mono)` 11px) listing muscles not yet trained that week (or a single mono message when all 17 are trained) → `SectionLabel "PROJISERT DEKNING"` → projected `HeatmapBodySVG` (side-by-side/toggle) → fixed-height 48px hover-detail container (always rendered, prevents layout shift) → optional Forslag card → `SectionLabel "UKESPLAN"` → 7 × DayRow → inline `TemplatePicker` bottom-sheet overlay. No sticky save/delete bar — plan auto-saves on every add/remove; `deleteWeekPlan` is called automatically when all slots are cleared. Persists via `fetchWeekPlan` / `saveWeekPlan` / `deleteWeekPlan` in `db.js`; loads logged sessions via `fetchSessionsForWeek` in parallel with the plan fetch. Duration (`N MIN`) omitted — `session_templates` has no duration column.
-- **IntroModal:** `app/src/components/IntroModal.jsx` — one-time 5-slide onboarding modal (issue #162). Controlled by `open`/`onClose` props from `App.jsx`. Resets `step` to 0 via `useEffect` whenever `open` becomes true. `dismiss()` sets `localStorage` key `wl-intro-seen=1` then calls `onClose()`; the ×-close button and "Hopp over" also call `dismiss()`. Slide data is a static constant array of `{ Icon, titleKey, bodyKey }`. Step indicator and replay hint rendered in body below slide content. Responsive via an inline `<style>` block: max-width 560px on desktop, full-viewport on ≤500px. Wrapped in `<Theme>` matching the current app theme.
-- **Settings:** `app/src/components/Settings.jsx` — settings view reachable via the gear icon in the header (issue #123). Accepts optional `onShowIntro` prop from `App.jsx`. Sections in order: (1) Språk — `RadioButtonGroup` for nb/en/fa; calls `i18n.changeLanguage()` + persists to `localStorage`; (2) Utseende — Carbon `Toggle` for dark/light theme + Carbon `Toggle` for nav hints (`useNavHints()`) with a live `BodyPanel` preview (fixed sample: primary `chest, quads, lats`; secondary `shoulders_front, hamstrings, triceps`); (3) Kontakt — feedback text + GitHub link; (4) Om appen — version number + ghost "Vis introduksjonsguide" button (calls `onShowIntro`) + changelog accordion; (5) Konto — logged-in email (read-only) + danger logout button. `ChangelogModal` is no longer rendered in `PageShell` — it lives here exclusively.
-- **BodyPanel:** `app/src/components/BodyPanel.jsx` — shared front/back body map. Manages its own `mobileView` toggle state internally. Props: `primary[]`, `secondary[]`, `muscleMap`, `marginBottom`. Replaces the duplicated mobile/desktop render pattern that previously existed in `MuscleMap`, `History`, and `TemplateSessionEditor`.
-- **MusclePicker:** `app/src/components/MusclePicker.jsx` — interactive body map where clicking a muscle cycles off → primary → secondary → off. Props: `primary[]`, `secondary[]`, `onChange({ primary, secondary })`, `instanceId` (unique suffix to avoid SVG filter ID collisions). On mobile (≤500px) renders a front/back toggle (one view at a time) instead of side-by-side. Used inside `ExerciseForm.jsx`.
-- **ExerciseForm:** `app/src/components/ExerciseForm.jsx` — form for creating/editing a library exercise (name, default sets/reps, MusclePicker). Props: `initial`, `onSave(fields)`, `onCancel()`, `saving`. On name field blur, fires `inferMusclesFromName` if no muscles are set yet — shows `InlineLoading` spinner → finished flourish → static «AI» pill label + «NULLSTILL» button to clear the inference and start over. Shows a red warning when name is filled but muscles are still empty.
-- **LibraryPicker:** `app/src/components/LibraryPicker.jsx` — searchable list of library exercises for adding to a template. Props: `libraryExercises[]`, `onAdd(exercise)`, `onClose()`. Extracted from inline definition in `TemplateSessionEditor.jsx`.
-- **ExerciseRowWithAutocomplete:** `app/src/components/ExerciseRowWithAutocomplete.jsx` — wrapper around `ExerciseRow` that adds an inline autocomplete dropdown and AI muscle inference when a new exercise name is typed. Only activates when `isNew` prop is true (IDs added during the current edit session, tracked via `newExerciseIds` Set in History). Props: all `ExerciseRow` props + `libraryExercises[]` + `isNew`. On name field blur (including tab-to-sets/reps), fires `inferMusclesFromName` if no muscles are set — shows spinner → finished flourish → static AI label; library autocomplete selection clears any AI inference. Library is fetched once when edit mode opens; failure degrades silently to manual entry. Uses `onMouseDown + e.preventDefault()` on suggestions to prevent input blur from closing the dropdown before the click fires. Used in `History.jsx` edit mode only — `ExerciseRow` is unchanged for `MuscleMap` and `TemplateSessionEditor`.
-- **API security:** `app/api/claude.js` requires a valid Supabase JWT in the `X-Supabase-Token` header on every request (Azure SWA intercepts `Authorization` — see known pitfall #57). Verifies via `GET /auth/v1/user`. Also enforces a model allowlist (`claude-sonnet-4-6`) and caps `max_tokens` at 2000. The `callClaude(body)` helper in `utils.js` injects the token automatically — all Claude calls must go through it.
-- **Template navigation:** `App.jsx` manages views `"sett-sammen"`, `"gruppetime-picker"`, `"gruppetime-editor"`, `"ovelse-picker"`, `"template-picker"`, `"template-editor"`, `"settings"`, `"planlegger"` alongside existing views. The nav callback is `onShowSetSammen`. Key state: `gruppetimerEditorTemplate` holds the template being edited in `GruppetimeEditor`; `pendingTemplateExercises` carries exercises from `TemplateSessionEditor` into `MuscleMap`. **`TemplateSessionEditor` is kept unchanged** — it handles the MuscleMap «Bruk mal» flow (mode="use") and is separate from `GruppetimeEditor` which handles the Sett-sammen edit flow. When "Bruk økt" is pressed in `TemplateSessionEditor`, exercises pass to `MuscleMap` via `templatePreload` prop, triggering a `useEffect` that pre-fills the list and jumps to the confirm step.
-- Supabase Auth uses magic links (`emailRedirectTo: window.location.origin`)
-- Anthropic API calls go through `app/api/claude.js` — Azure Function v4 model, browser hits `/api/claude`
-- **Azure Functions entry point:** `app/api/index.js` imports all function files (`claude.js`, `sportySync.js`, `recsCacheCleanup.js`). `package.json#main` points to `index.js`. Azure Functions v4 only loads the single file referenced in `main` — add new function files here or they will never be registered. **The API `package.json` only has `@azure/functions` as a dependency — use raw `fetch` to the Supabase REST API (as `sportySync.js` does), never `import { createClient } from '@supabase/supabase-js'` in API files.**
-- **Sporty.no sync:** `app/api/sportySync.js` — timer trigger at 04:00, 11:00, and 14:00 UTC upserts today's sessions from `https://sporty.no/api/v1/businessunits/8/groupactivities` into `gym_calendar` by `sporty_id`. Class names are passed through `normalizeName()` (imported from `sportyUtils.js`) before storage, which strips any quoted annotation (e.g. `"SVART TRØYE"`) — handles both straight and curly double quotes generically.
-- **`app/api/sportyUtils.js`** — pure utility with no Azure SDK dependency. Exports `normalizeName(name)`. Kept separate from `sportySync.js` so it can be unit-tested without mocking the Azure Functions runtime. Business unit `8` is hardcoded — intentional for now (single-gym product); if extended to multiple gyms, this must become an env var or DB config. HTTP trigger `POST /api/sporty-sync` requires a valid Supabase JWT in `X-Supabase-Token` header (verified via `verifySupabaseJwt`); accepts optional JSON body `{ "shiftDays": -7 }` to offset all timestamps by N days (useful for backfilling historical gym calendar data). `GET /api/sporty-health` returns DB row counts (total rows, earliest/latest row timestamps, today's session count — no session list) — still requires `x-api-key: <SPORTY_SYNC_API_KEY>` header (external monitoring tool, not a frontend call). Requires `SUPABASE_URL`, `SUPABASE_SERVICE_ROLE_KEY`, `SUPABASE_ANON_KEY`, and `SPORTY_SYNC_API_KEY` as Azure app settings (service role needed because the timer has no auth user; anon key used by `verifySupabaseJwt`). **The timer registration is guarded by `process.env.AZURE_FUNCTIONS_ENVIRONMENT === 'Production'`** — it is skipped entirely in local dev because the SWA CLI emulator only supports HTTP triggers.
-- **Rec cache cleanup:** `app/api/recsCacheCleanup.js` — timer trigger every Sunday at 03:00 UTC. Two DELETE passes: (1) entries older than 7 days (TTL — forces fresh recommendations; also catches version-orphaned entries that were never refreshed); (2) entries whose `cache_key` does not start with `v${RECS_PROMPT_VERSION}_` (sweeps orphans immediately after a prompt/model version bump). Uses raw `fetch` to Supabase REST API (no SDK). Requires `SUPABASE_URL` and `SUPABASE_SERVICE_ROLE_KEY`.
-- **Claude API proxy:** `app/api/claude.js` verifies incoming Supabase JWTs via `GET /auth/v1/user`. Requires `ANTHROPIC_API_KEY`, `SUPABASE_URL`, and `SUPABASE_ANON_KEY` as Azure app settings. Use `SUPABASE_ANON_KEY` (no `VITE_` prefix) — the `VITE_` prefix is Vite build-time only and is invisible to the Azure Functions runtime.
-- **CI/CD build split:** the frontend is pre-built in the GitHub Actions runner (`npm ci && npm run build` with `VITE_*` in `env:`), then the Azure SWA action uploads `app/dist/` directly (`app_location: "app/dist"`). This bypasses Oryx for the frontend — Oryx strips `VITE_*` env vars before spawning Vite and they never reach the bundle. Oryx still handles the API (`app/api`). `vite.config.js` has a build-time assertion that fails immediately if the required vars are missing.
-- **Supabase client explicit apikey header:** `createClient` is called with `global: { headers: { apikey: supabaseKey } }` in `app/src/lib/supabase.js`. The Supabase JS v2 fetch interceptor should add this automatically, but it was not reaching browser requests — passing it in `global.headers` puts it directly on `PostgrestClient`'s base headers, bypassing the interceptor. Do not remove this option.
-- **Multi-instruktør gym membership:** `user_gyms` table links each user to a Sporty business unit (`sporty_business_unit_id`). Primary users are instruktører; sharing default is opt-out scoped to the same gym. `ensureGymMembership(buId, user?)` in `db.js` does an idempotent upsert on sign-in (called in `App.jsx`). Accepts an optional `user` param — if provided, skips the `supabase.auth.getUser()` network call. `DEFAULT_SPORTY_BUSINESS_UNIT_ID = 8` mirrors the hardcoded BU in `sportySync.js`; both must move to a DB config when multi-gym support lands. Backfilled rows exist for both current users.
-- **Roles (temporal):** `roles` table stores instruktør tenure — `user_id`, `sporty_business_unit_id`, `name` (default `'instruktor'`), `title`, `valid_from` (date), `valid_to` (nullable date). Active roles = `valid_from <= today AND (valid_to IS NULL OR valid_to >= today)`. `fetchActiveRoles(buId)` in `db.js` returns all active roles for the current user at the given gym. Existing placeholder rows were migrated from `user_gyms.role` (issue #140). RLS: users can only read/write their own rows.
-- **Display name:** `profiles` has `display_name text CHECK (char_length(display_name) <= 50)`. RLS: existing "Brukere ser sin egen profil" / "Brukere oppdaterer sin egen profil" policies cover self-reads and writes; new "Same-gym users can read profiles" SELECT policy exposes `display_name` to co-instructors at the same gym. `fetchDisplayName()` / `updateDisplayName(name)` in `db.js`. Settings → Konto exposes a TextInput. `ensureDisplayName(user?)` runs on every login alongside `ensureGymMembership()` — if `display_name` is null it sets it to the email prefix (`user.email.split('@')[0]`); fire-and-forget, errors are silent. Accepts an optional `user` param to skip the `getUser()` network call. Both ensure functions are called in parallel via `Promise.all` in `App.jsx`, passing `session.user` so neither makes its own `getUser()` request.
-- **Session visibility (removed):** The `sessions.visibility` column exists in the DB but is no longer used. The "Same-gym users can read sessions" RLS policy was updated to remove the `visibility = 'shared'` filter — all sessions are cross-readable by co-instructors at the same gym. `updateSessionVisibility` is removed from `db.js`; the History visibility Toggle is gone. Settings → Konto shows an informational GDPR paragraph.
-- **Report instructor filter:** `fetchSessionsForReport` joins `trainer_id, profiles(display_name)` on every call. `Report.jsx` derives `availableInstructors` (unique `{ id, label }` pairs, sorted alphabetically, label falls back to `"Unnamed"`) from the fetched sessions and renders a fourth filter chip row only when `availableInstructors.length > 1`. `selectedInstructors` is a `Set<trainer_id>` — empty means all instructors shown (same pattern as `selectedDays`/`selectedTypes`). Reset button clears all three Sets. Recs cache key is unaffected — `sessionCount` already encodes the filtered result naturally.
-- **Joint class history:** `fetchClassHistory(gymCalendarId)` in `db.js` returns co-instructor sessions for a given gym class instance (excludes own), with joined `profiles(display_name)` and `session_exercises`. History lazy-fetches on first expand of a gym-linked session; cached in `classHistory` Map state (key: `gym_calendar_id`). Panel always renders in the expanded session view, showing display name + exercise list per colleague.
-
-## Known limitations
-- SVG body is improved but still geometrically simplified — not anatomically precise; key muscles (traps, lats) use path shapes, rest are ellipses
-- `shoulders_front` and `shoulders_side` shapes were previously nearly identical in position (3px apart), causing wrong hover hit targets and incorrect tooltip data in the heatmap. Fixed by moving `shoulders_front` inward (cx:42, cy:60) and `shoulders_side` outward to the arm edge (cx:23, cy:68) — see issue #18. Pending live verification.
-- Sets and reps are not collected or stored (removed in issue #200) — the app tracks which exercises were in the program, not individual volume
-- Recommendations are contextual per session, not based on accumulated history (will improve with data)
-- No error handling for API rate limits
-- History edit mode re-analyse uses a single image only (the new photo replaces the full exercise list); multi-image re-analysis is not supported in edit mode
-- Carbon `DatePicker` uses US date format (`MM/DD/YYYY`) in the confirm step — no Norwegian locale override applied yet
-
-## Email templates
-
-Supabase auth email templates are version-controlled in `supabase/templates/`. Three templates are defined:
-
-| File | Email type | Subject |
-|---|---|---|
-| `magic_link.html` | Magic link login | Sign in to Workout Lens |
-| `invite.html` | User invite | You have been invited to Workout Lens |
-| `confirmation.html` | Email confirmation | Confirm your Workout Lens account |
-
-Templates are referenced in `supabase/config.toml`. To apply them to the remote Supabase project:
-
-```powershell
-supabase link --project-ref <your-project-ref>
-supabase config push
-```
-
-All templates use inline CSS only (no external stylesheets — email clients strip them). Colours match the app: `#161616` background, `#ee2c80` accent, `#262626` header. The `{{ .ConfirmationURL }}` and `{{ .SiteURL }}` variables are Supabase Go template syntax — do not change them.
+`session_templates` and `exercise_library` are **gym-wide** (any co-instructor can CRUD). `user_id` = "created by" only.  
+`replaceTemplateExercises(templateId, exercises)` = canonical full delete+reinsert for template exercises.  
+Recs `cache_key` format: `v{RECS_PROMPT_VERSION}_{periodDays}_{sessionCount}_{trainedIds}_{untrainedIds}` — no `user_id`, shared across users.
 
 ## Supabase migration hygiene
-
-From **October 30, 2026**, Supabase enforces explicit GRANTs on all new `public` schema tables — PostgREST returns `42501` without them. All 14 existing tables already have grants and are unaffected. Any future migration that creates a new table **must** include the following grant block:
-
+New tables require explicit grants (enforced Oct 30, 2026):
 ```sql
 grant select on public.your_table to anon;
 grant select, insert, update, delete on public.your_table to authenticated;
 grant select, insert, update, delete on public.your_table to service_role;
-
 alter table public.your_table enable row level security;
 ```
-
-Adjust `anon` privileges to the minimum required (often no access at all — `anon` can typically be omitted for app tables that require login). Always enable RLS and add policies immediately after the grants.
+Always use `IF NOT EXISTS` / `CREATE OR REPLACE` for idempotency. Always `DROP POLICY IF EXISTS` before recreating. New tables must also be added to the baseline migration `20260101000000_baseline_schema.sql`.
 
 ## Local development
-
 ```powershell
-.\dev.ps1
+.\dev.ps1   # runs fnm use 22, starts Vite + swa start
 ```
+Open **http://localhost:4280** (not 5173). `dev.ps1` is gitignored.
 
-`dev.ps1` is gitignored. It:
-1. Calls `fnm use 22` — pins to Node 22 LTS (Node 20 reached EOL April 2026)
-2. Spawns `npm run dev` (Vite on port 5173) in a separate PowerShell window
-3. Waits 3 s for Vite to start, then calls `swa start`
-
-Open **http://localhost:4280** (not 5173). The SWA emulator proxies `/api/*` to the local Azure Functions process; `npm run dev` alone skips the API layer.
-
-### One-time setup
-```bash
+One-time setup:
+```powershell
 npm install -g @azure/static-web-apps-cli
-cp app/.env.local.example app/.env.local                             # fill in VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY
-cp app/api/local.settings.json.example app/api/local.settings.json  # fill in ANTHROPIC_API_KEY, SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY, VITE_SUPABASE_ANON_KEY, SUPABASE_ANON_KEY
+cp app/.env.local.example app/.env.local                            # VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY
+cp app/api/local.settings.json.example app/api/local.settings.json  # ANTHROPIC_API_KEY, SUPABASE_*
 cd app && npm install
 ```
 
-`app/.env.test` is committed with placeholder values and requires no setup — it exists solely so the Vitest test runner can import `supabase.js` without crashing in CI (no real Supabase calls are made during unit tests).
-
-## Test suite
-
-`npm test` (in `app/`) runs Vitest. The suite is deliberately scoped to **pure logic** — no DOM, no live Supabase, no React rendering — so the whole run finishes in <2 s.
-
-Files and what they cover:
-
-| File | Subject | Notes |
-|---|---|---|
-| `app/api/__tests__/claudeUtils.test.js` | model allowlist, `MAX_TOKENS_LIMIT`, `checkRateLimit` (incl. window expiry via `vi.useFakeTimers()`), `verifySupabaseJwt` | Covers all branches of the API guards. |
-| `app/api/__tests__/sportySync.test.js` | `normalizeName` | Straight quotes, curly quotes, plain names, fully-annotated names, whitespace trimming. Imports from `sportyUtils.js` (no Azure SDK dep). |
-| `app/src/lib/__tests__/bodymap.test.js` | `calcMuscles` | Explicit muscles, EX_DB fallback, dedup, miss path. |
-| `app/src/lib/__tests__/muscleMapReducer.test.js` | `MuscleMap` reducer | One test per action type; reducer is the spine of the upload→confirm→muscles flow. |
-| `app/src/lib/__tests__/prompts.test.js` | `ANALYZE_PROMPT`, `buildRecommendPrompt`, `buildPeriodRecommendPrompt`, `buildMuscleInferencePrompt` | Guards that every `MUSCLES` ID appears in every prompt — the prompt-vs-runtime mismatch is the easiest way to silently break Claude responses. |
-| `app/src/lib/__tests__/utils.test.js` | `buildMuscleMapFromExercises`, `buildMuscleMapFromSession`, `buildRecMuscleMap`, `extractMuscles`, `isInvalidNum`, `toIsoDate`, `toWeekIso` / `weekIsoToMonday` / `isoWeekMonday`, `getIntlLocale`, `inferMusclesFromName` | Date helpers exercise ISO-week edges (year boundaries, Sunday); `inferMusclesFromName` mocks `fetch` and covers clean JSON, markdown-fenced JSON, malformed JSON, empty arrays, and rejected promises. |
-
-Rules of thumb when adding tests:
-1. Every export from `utils.js`, `bodymap.js`, `prompts.js`, `claudeUtils.js` should have at least one branch-covering test. Don't write a test that only re-asserts a constant — assert the **behaviour** that constant drives.
-2. Avoid component-rendering tests until there's a concrete regression they would have caught. The reducer + helper layer is where logic bugs land in this codebase.
-3. When testing `inferMusclesFromName` or anything touching `callClaude`, stub `globalThis.fetch` with `vi.stubGlobal` and `vi.unstubAllGlobals` in `afterEach` — `supabase.auth.getSession()` runs entirely in-memory with the placeholder env vars, so no other mocks are needed.
-
-Coverage (`npm run test:ci`) is configured in `vite.config.js` to scope to `src/lib/**` and `api/claudeUtils.js`. Current line coverage: `utils.js` ~80%, `prompts.js` 100%, reducer & `calcMuscles` ~100% within tested files; `db.js` and `bodymap.jsx` SVG render code are intentionally untested. `bodymap.js` (constants/utils) is covered via the bodymap test.
-
-## Azure deploy notes
-- **Supabase Auth redirect URLs** — add the following in Supabase → Authentication → URL Configuration → Additional redirect URLs: `http://localhost:4280` (local dev), your production URL + `<prod-url>/**` (prod), and `<your-swa-subdomain>-*.westeurope.7.azurestaticapps.net` (PR preview wildcard). The app uses `emailRedirectTo: window.location.origin` so no per-PR config is needed (#135)
-- **GitHub Environments** — two environments must exist in GitHub repository Settings → Environments: `production` (used by master-branch deploys) and `preview` (used by PR and dev-branch deploys). Both use the same repository-level secrets — do NOT move secrets into environment-level secrets unless you introduce separate credentials per environment, because the Azure SWA token is shared between production and preview deploys.
-- For secrets/settings/live URL, see README → Deployment section
-
-## Code quality backlog (issue #213)
+## Tests
+`npm test` in `app/` — Vitest, pure logic only, <2s. Coverage scoped to `src/lib/**` + `api/claudeUtils.js`.
 
-Audit findings that are deferred to a future sprint:
+Key files: `claudeUtils.test.js` (API guards), `sportySync.test.js` (`normalizeName`), `bodymap.test.js` (`calcMuscles`), `muscleMapReducer.test.js` (reducer), `prompts.test.js` (all 17 muscle IDs in every prompt), `utils.test.js` (all util exports).
 
-- **`useFetch` adoption** — `TemplatePicker` and `GruppetimePicker` now use `useFetch`. 8+ components still manage their own `loading/error/data` useState triplet; replace them incrementally, prioritising read-only single-fetch cases next.
-- **Shared library-exercise cache** — `MuscleMap`, `GruppetimeEditor`, `History`, and `TemplatePicker` each fetch `fetchLibraryExercises()` independently on mount. Consider a React Context or a module-level cache to share the result.
+When testing `inferMusclesFromName`/`callClaude`: stub `globalThis.fetch` with `vi.stubGlobal`, unstub in `afterEach`.
 
-**Never add new debounce timer useEffects** — always import `useDebouncedSearch` from `app/src/lib/hooks.js` instead.
+## Azure deploy
+- Supabase redirect URLs: `http://localhost:4280`, prod URL + `/**`, `<swa-subdomain>-*.westeurope.7.azurestaticapps.net`
+- GitHub Environments: `production` (master) and `preview` (PRs) — both use repo-level secrets (do not move to environment-level)
 
-**Never add new inline `session_exercises(... muscle_activations(...))` SELECT strings to `db.js`** — use `SESSION_EXERCISES_SELECT` or `SESSION_EXERCISES_FULL_SELECT` constants defined at the top of that file.
-
-## Known pitfalls (previously hit, fixed, must not regress)
-
-### Issue #9 — Session save failing (resolved 2026-04-28)
-Two bugs combined to break `POST /rest/v1/sessions`:
-
-**Bug 1 — `VITE_SUPABASE_ANON_KEY` not in bundle:**
-Azure SWA's Oryx Docker build engine strips `VITE_*` env vars before spawning the Vite subprocess. The key was set as a GitHub Actions secret but never reached the bundle. Fix: pre-build the frontend in the GitHub Actions runner (`npm ci && npm run build` with `VITE_*` in the `env:` block), point `app_location: "app/dist"` so the SWA action uploads the pre-built dist directly without re-building.
-
-**Bug 2 — Supabase JS fetch interceptor not adding `apikey` header in browser:**
-Even after the key was correctly baked into the bundle, browser REST requests arrived at Supabase without the `apikey` header. The v2 fetch interceptor (`Ui`) should add it, but did not. Fix: pass `global: { headers: { apikey: supabaseKey } }` to `createClient` — this puts the key directly on `PostgrestClient`'s base headers, bypassing the interceptor entirely. See `app/src/lib/supabase.js`.
-
-**Bug 3 — RLS infinite recursion on `profiles` (Postgres error 42P17):**
-Once the apikey was in requests, saves still failed with `42P17: infinite recursion detected in policy for relation "profiles"`. Root cause: `INSERT INTO sessions` with `Prefer: return=representation` triggers a RETURNING select, which evaluated the `"Admin ser alle økter"` SELECT policy on `sessions` — that policy queried `profiles`, which in turn triggered the `"Admin ser alle profiler"` SELECT policy on `profiles` — and that policy queried `profiles` again, looping forever. Fix: dropped both admin policies (`"Admin ser alle profiler"` on `profiles` and `"Admin ser alle økter"` on `sessions`) via Supabase MCP migration. Neither is needed for a single-user workout logger.
-
-### Issue #57 — `/api/claude` returning 401 despite valid session (resolved 2026-05-03)
-Symptoms: every upload failed with 401. The browser was sending a valid Supabase JWT in `Authorization: Bearer <token>`, but `claude.js` kept rejecting it with Supabase's `bad_jwt / signature is invalid`.
-
-**Root cause — Azure SWA replaces the `Authorization` header:**
-Azure Static Web Apps' proxy layer silently replaces any incoming `Authorization: Bearer` header with its own managed identity token (issued by `*.scm.azurewebsites.net`) before the request reaches the function handler. The Supabase JWT never arrived; Azure's Kudu identity token did instead. Supabase correctly rejected it. This happens even with `authLevel: 'anonymous'` on the function.
-
-**How we diagnosed it:** the Supabase token uses ES256 (asymmetric) and has a `kid` in the JWT header, making it ~900 chars. The server only saw 365 chars — a completely different token with `iss: https://31315134-...scm.azurewebsites.net`.
-
-**Fix:** send the Supabase JWT in a custom header `X-Supabase-Token` that Azure's proxy ignores. See `callClaude` in `app/src/lib/utils.js` and `verifySupabaseJwt` in `app/api/claude.js`.
-
-**Never revert to `Authorization: Bearer` for the Supabase token** — Azure will always intercept it.
-
-### Issue #164 — White flash on History calendar in dark mode (resolved 2026-05-12)
-Symptom: a brief white flash appeared on the MonthGrid calendar area every time a user navigated to History in g100 (dark) mode.
-
-**Root cause — Carbon skeleton dark tokens not applied via `data-theme` attribute:**
-Carbon's compiled CSS from `@carbon/styles` emits dark skeleton token overrides under the `.cds--g100` CSS class selector (e.g. `.cds--g100 { --cds-skeleton-background: #393939 }`). The app's `ThemeProvider` only sets `data-theme="g100"` on `<html>` — it never adds the `.cds--g100` class. Therefore `SkeletonPlaceholder` and `AccordionSkeleton` always resolved `--cds-skeleton-background` to the `:root` default (`#e8e8e8` — light gray), producing a bright/white flash while loading.
-
-**Fix:** Added `--cds-skeleton-background: #393939` and `--cds-skeleton-element: #525252` to the `.cds--g100, [data-theme="g100"]` block in `carbon-tokens.css`. These are Carbon's official g100 skeleton token values (gray-80 and gray-70 respectively). The existing block already overrides all other Carbon semantic tokens for the same reason.
-
-**Pattern to watch:** Any new Carbon token that Carbon's SCSS emits only under `.cds--g100` (not `:root`) must be explicitly added to the `[data-theme="g100"]` block in `carbon-tokens.css`. Run a visual check in dark mode whenever a new Carbon component is introduced.
-
-### Issue #173 — HEIF photo exceeds Anthropic 5 MB limit (resolved 2026-05-14)
-Symptom: uploading an iPhone 17 Pro photo failed with `Serverfeil (400): image exceeds 5 MB maximum: 5246896 bytes > 5242880 bytes`.
-
-**Root cause 1 — Wrong comparison unit in `compressImage`:** Anthropic enforces the 5 MB limit on the **base64 string character count**, not the decoded byte size. `compressImage` was checking `b64.length * 0.75 <= 5 MB` (decoded bytes ≤ 5 MB), which allows base64 strings up to ~6.67 M chars. A 3.75 MB decoded image produces ~5.25 M base64 chars — passes our check, fails Anthropic's. Fixed by changing all checks to `b64.length <= MAX_B64_CHARS` (5,242,880) and setting the canvas compression target to 90% of that limit.
-
-**Root cause 2 — iOS silently ignores large data URLs as `img.src`:** The original canvas fallback path set `img.src = dataUrl` (the ~9 MB base64 string from FileReader). iOS Safari silently fails to decode a data URL this large: `img.naturalWidth` and `img.naturalHeight` both become 0. The canvas is created as 0×0, `toDataURL` returns a near-empty result that passes the size check, and the original un-compressed data stays in state. No error is thrown. Fixed by using `URL.createObjectURL(file)` as the image source instead.
-
-**Root cause 3 — iOS Safari ignores `canvas.toDataURL` quality parameter:** iOS Safari on some versions silently ignores the `quality` argument and always outputs at default quality (~0.92). Dimension reduction (canvas pixel dimensions) is the only reliable lever on iOS — not quality stepping.
-
-**Never revert to `img.src = dataUrl` for large images** — iOS will silently zero out naturalWidth/Height. Do not use `b64.length * 0.75` to compare against Anthropic's limit — compare `b64.length` directly.
-
-### Issue #247 — Supabase preview branches fail with "relation does not exist" (resolved 2026-05-15)
-Symptom: every PR showed a failing "Supabase Preview" check with `ERROR: relation 'session_templates' does not exist (SQLSTATE 42P01)` at the first delta migration (`20260514_add_template_type_to_session_templates.sql`).
-
-**Root cause — no baseline migration:** Supabase preview branches create a fresh, empty database and then apply every file in `supabase/migrations/` in filename order. The repo only had delta migrations (ALTER TABLE, REVOKE, etc.) — no initial CREATE TABLE statements. On a fresh DB, `ALTER TABLE session_templates ADD COLUMN template_type` fails immediately because the table doesn't exist.
+## Backlog
+Tracked in [GitHub Issues](https://github.com/ChristopherRotnes/BodyMapTraining/issues). Run `gh issue list` for current open work.
 
-**Fix:** Added `supabase/migrations/20260101000000_baseline_schema.sql` — a comprehensive snapshot of all 15 tables, 3 stored functions, the `on_auth_user_created` trigger, all grants, and all RLS policies. Every statement uses `IF NOT EXISTS` / `CREATE OR REPLACE` so the file is safe to apply to the live production database as a no-op. Updated the two existing delta migrations to use `ADD COLUMN IF NOT EXISTS` and `DROP POLICY IF EXISTS` for the same idempotency guarantee.
+## Known pitfalls
 
-**Pattern:** Every future migration that adds a table or policy must have a corresponding entry in the baseline (or be added via a new delta migration with `IF NOT EXISTS`). Delta migrations that run after the baseline must not assume a specific prior state — they must be idempotent. When adding a new table in a migration, also add `CREATE TABLE IF NOT EXISTS` for it to the baseline, and reference the delta in the baseline's comment block at the top.
+### #9 — VITE_* vars missing from bundle
+Oryx strips `VITE_*` env vars. **Fix: pre-build in GitHub Actions runner, upload `app/dist/`.** Never let Oryx build the frontend.
 
-### Issue #173 — fetchLastSession returning null (resolved 2026-05-14)
-Symptom: Home → "Siste økt" showed "Ingen økter logget ennå" even though sessions existed in the DB and the weekly strip showed the correct session count.
+### #9 — Supabase apikey not in browser requests
+Supabase JS v2 fetch interceptor doesn't reliably add `apikey` header. **Fix: `global: { headers: { apikey: supabaseKey } }` in `createClient`. Do not remove this.**
 
-**Root cause — `.maybeSingle()` with multiple rows in the sessions table:** `fetchLastSession` used `.limit(1).maybeSingle()`. `.maybeSingle()` sends PostgREST `Accept: application/vnd.pgrst.object+json`. PostgREST evaluates the "single row" constraint and returns 406 when the base query (before LIMIT) would produce multiple rows — the LIMIT is not applied before this check. `.maybeSingle()` in Supabase JS v2 silently converts a 406 (PGRST116) to `{ data: null, error: null }`, so `fetchLastSession` returned null without any error. Works fine with 1 session in the DB; silently breaks once there are 2+ sessions.
+### #9 — RLS infinite recursion (42P17)
+Admin policies that queried `profiles` from within a `sessions` INSERT RETURNING caused infinite recursion. Fix: dropped both admin policies. Don't create cross-table RLS policies that can loop.
 
-**Fix:** Removed `.maybeSingle()`. Changed to a plain array query (`.limit(1)` without `.maybeSingle()`) and returned `data?.[0] ?? null`. The simpler approach avoids the `Accept: application/vnd.pgrst.object+json` header entirely.
+### #57 — Azure SWA intercepts Authorization header
+Azure SWA proxy replaces `Authorization: Bearer` with its own managed identity token. **Never send the Supabase JWT in `Authorization`. Use `X-Supabase-Token` instead.**
 
-**Pattern to watch:** Do not combine `.limit(1)` with `.maybeSingle()` in Supabase JS v2 when the table can have multiple rows. Use `.limit(1)` with an array query and take `data?.[0]` instead. `.maybeSingle()` is only safe on queries where the base set is already guaranteed to be 0 or 1 rows (e.g. `.eq("id", id)` on a primary key).
+### #164 — Carbon skeleton flash in dark mode
+Carbon emits skeleton token overrides under `.cds--g100` class, but `ThemeProvider` only sets `data-theme="g100"`. **Fix: add `--cds-skeleton-background: #393939` and `--cds-skeleton-element: #525252` to `[data-theme="g100"]` in `carbon-tokens.css`.** Repeat for any new Carbon token only emitted under `.cds--g100`.
 
-### Issue #237 — Excess anon grants + duplicate RLS policies (resolved 2026-05-15)
+### #173 — Image compression (iOS)
+- Compare `b64.length <= 5,242,880` — not `b64.length * 0.75`. **Never compare decoded byte size against Anthropic's limit.**
+- **Never use `img.src = dataUrl` for large images** — iOS Safari silently zeros `naturalWidth`/`naturalHeight`. Use `URL.createObjectURL(file)` instead.
+- iOS Safari ignores `canvas.toDataURL` quality param — use dimension reduction, not quality stepping.
 
-**Excess grants:** Supabase's default `GRANT ALL` on new tables gives `anon` TRUNCATE, TRIGGER, and REFERENCES — none of which PostgREST exposes. TRUNCATE bypasses RLS at the PostgreSQL level, so it is a latent risk even though PostgREST doesn't route it. Revoked via `REVOKE TRUNCATE, TRIGGER, REFERENCES ON ... FROM anon` in migration `20260516_db_permissions_cleanup.sql`. When creating a new table, only grant the privileges PostgREST actually needs — see the migration hygiene template above.
+### #173 — `.maybeSingle()` with multi-row tables
+`.limit(1).maybeSingle()` silently returns null when the table has >1 rows (PostgREST 406 → JS v2 converts to null). **Use `.limit(1)` + `data?.[0] ?? null` instead.**
 
-**Duplicate policies:** `{public}` role in a PostgreSQL RLS policy means the policy applies to *all* roles including `anon`. Several tables accumulated pairs of `{public}` ALL and `{authenticated}` ALL policies with identical USING clauses (the `{public}` one was the original; the `{authenticated}` one replaced it later but the old one was never cleaned up). PostgreSQL ORs multiple permissive policies — the duplicates were harmless (every USING checked `auth.uid()`, which is null for anon, so anon access was always blocked) but added noise. When replacing a policy, always `DROP POLICY IF EXISTS` the old one in the same migration.
+### #247 — Supabase preview branches missing baseline
+Preview branches apply all migrations on a fresh empty DB. Delta migrations fail without CREATE TABLE first. **New tables must be added to `20260101000000_baseline_schema.sql` with `IF NOT EXISTS`.**
 
+### #237 — Excess anon grants + duplicate RLS policies
+Default `GRANT ALL` gives anon TRUNCATE (bypasses RLS). **Only grant what PostgREST needs.** Always `DROP POLICY IF EXISTS` old policies when replacing them.
diff --git a/app/package.json b/app/package.json
index 0dea83c..cc727d3 100644
--- a/app/package.json
+++ b/app/package.json
@@ -1,7 +1,7 @@
 {
   "name": "workout-lens",
   "private": true,
-  "version": "1.5.15",
+  "version": "1.5.16",
   "author": "Christopher Rotnes",
   "license": "MIT",
   "repository": {
diff --git a/app/src/components/ExFlyt.jsx b/app/src/components/ExFlyt.jsx
index cf001f8..2688224 100644
--- a/app/src/components/ExFlyt.jsx
+++ b/app/src/components/ExFlyt.jsx
@@ -70,7 +70,6 @@ export default function ExFlyt({ libraryExercises, onAdd, onClose }) {
                 borderRadius: 8,
                 color: "var(--cds-text-primary)",
                 fontFamily: "var(--cds-font-sans)", fontSize: 14,
-                outline: "none",
               }}
             />
           </div>
@@ -163,7 +162,6 @@ export default function ExFlyt({ libraryExercises, onAdd, onClose }) {
               borderRadius: 8,
               color: "var(--cds-text-primary)",
               fontFamily: "var(--cds-font-sans)", fontSize: 14,
-              outline: "none",
             }}
           />
           <Button kind="primary" size="sm" renderIcon={Add} onClick={handleQuickAdd} disabled={!quickName.trim()}>
diff --git a/app/src/components/GruppetimePicker.jsx b/app/src/components/GruppetimePicker.jsx
index f06b6ee..fe52484 100644
--- a/app/src/components/GruppetimePicker.jsx
+++ b/app/src/components/GruppetimePicker.jsx
@@ -139,7 +139,6 @@ export default function GruppetimePicker({ onBack, onEditTemplate }) {
                   borderRadius: 8,
                   color: "var(--cds-text-primary)",
                   fontFamily: "var(--cds-font-sans)", fontSize: 14,
-                  outline: "none",
                 }}
               />
             </div>
diff --git a/app/src/components/Home.jsx b/app/src/components/Home.jsx
index 85c5b06..56c4371 100644
--- a/app/src/components/Home.jsx
+++ b/app/src/components/Home.jsx
@@ -112,7 +112,7 @@ export default function Home({ onShowHistoryWithDate }) {
             onClick={onShowLogger}
             style={{
               width: "100%", padding: "16px 20px",
-              background: "var(--accent)", color: "#fff",
+              background: "var(--accent-active)", color: "#fff",
               border: "none", borderRadius: "var(--r-pill)",
               fontFamily: "var(--cds-font-sans)", fontWeight: 600, fontSize: 15,
               cursor: "pointer", display: "flex", alignItems: "center", justifyContent: "space-between",
diff --git a/app/src/components/MuscleMapConfirm.jsx b/app/src/components/MuscleMapConfirm.jsx
index 877f9f7..b80bfc4 100644
--- a/app/src/components/MuscleMapConfirm.jsx
+++ b/app/src/components/MuscleMapConfirm.jsx
@@ -56,7 +56,7 @@ export default function MuscleMapConfirm({
             onClick={() => { setUseTodayDate(true); dispatch({ type: "SET_SESSION_DATE", date: todayStr }); }}
             style={{
               flex: 1, padding: "10px 0",
-              background: useTodayDate ? "var(--accent)" : "transparent",
+              background: useTodayDate ? "var(--accent-active)" : "transparent",
               color: useTodayDate ? "#fff" : "var(--cds-text-primary)",
               border: "none", cursor: "pointer",
               fontFamily: "var(--cds-font-sans)", fontSize: 13, fontWeight: useTodayDate ? 600 : 400,
@@ -69,7 +69,7 @@ export default function MuscleMapConfirm({
             onClick={() => setUseTodayDate(false)}
             style={{
               flex: 1, padding: "10px 0",
-              background: !useTodayDate ? "var(--accent)" : "transparent",
+              background: !useTodayDate ? "var(--accent-active)" : "transparent",
               color: !useTodayDate ? "#fff" : "var(--cds-text-primary)",
               border: "none", borderLeft: "1px solid var(--border-subtle-wl)", cursor: "pointer",
               fontFamily: "var(--cds-font-sans)", fontSize: 13, fontWeight: !useTodayDate ? 600 : 400,
@@ -182,7 +182,7 @@ export default function MuscleMapConfirm({
             disabled={!hasEnabled}
             style={{
               width: "100%", padding: "14px 20px",
-              background: hasEnabled ? "var(--accent)" : "var(--cds-layer-01)",
+              background: hasEnabled ? "var(--accent-active)" : "var(--cds-layer-01)",
               border: "none",
               borderRadius: "var(--r-pill)",
               color: hasEnabled ? "#fff" : "var(--text-muted-wl)",
diff --git a/app/src/components/OvelsePicker.jsx b/app/src/components/OvelsePicker.jsx
index 62b4d47..21f3436 100644
--- a/app/src/components/OvelsePicker.jsx
+++ b/app/src/components/OvelsePicker.jsx
@@ -137,7 +137,7 @@ export default function OvelsePicker({ onBack }) {
                 <p style={{ fontFamily: "var(--cond)", fontSize: 15, fontWeight: 700, color: "var(--cds-text-primary)", margin: "0 0 2px" }}>
                   {t("settSammen.nyOvelse")}
                 </p>
-                <p style={{ fontFamily: "var(--cds-font-mono)", fontSize: 10, letterSpacing: "0.1em", color: "var(--exercise)", margin: 0 }}>
+                <p style={{ fontFamily: "var(--cds-font-mono)", fontSize: 10, letterSpacing: "0.1em", color: "var(--cds-text-primary)", margin: 0 }}>
                   {t("ovelsePicker.nyOvelseSubtitle")}
                 </p>
               </div>
@@ -195,7 +195,6 @@ export default function OvelsePicker({ onBack }) {
                   borderRadius: 8,
                   color: "var(--cds-text-primary)",
                   fontFamily: "var(--cds-font-sans)", fontSize: 14,
-                  outline: "none",
                 }}
               />
             </div>
diff --git a/app/src/components/Planlegger.jsx b/app/src/components/Planlegger.jsx
index 13f145e..1f6443c 100644
--- a/app/src/components/Planlegger.jsx
+++ b/app/src/components/Planlegger.jsx
@@ -80,7 +80,6 @@ function TemplatePickerSheet({ templates, onSelect, onClose }) {
                 color: "var(--cds-text-primary)",
                 fontFamily: "var(--cds-font-sans)",
                 fontSize: 14,
-                outline: "none",
                 boxSizing: "border-box",
               }}
             />
diff --git a/app/src/components/Report.jsx b/app/src/components/Report.jsx
index 8363cd0..df3907d 100644
--- a/app/src/components/Report.jsx
+++ b/app/src/components/Report.jsx
@@ -608,7 +608,7 @@ export default function Report({ prefill, onPrefillConsumed }) {
                                 disabled={savingRec === r.name}
                                 style={{
                                   width: 28, height: 28, borderRadius: "50%",
-                                  background: savingRec === r.name ? "var(--cds-layer-02)" : "var(--accent)",
+                                  background: savingRec === r.name ? "var(--cds-layer-02)" : "var(--accent-active)",
                                   border: "none",
                                   cursor: savingRec === r.name ? "default" : "pointer",
                                   color: savingRec === r.name ? "var(--cds-text-secondary)" : "#fff",
diff --git a/app/src/components/Settings.jsx b/app/src/components/Settings.jsx
index f6b5e80..3f072d5 100644
--- a/app/src/components/Settings.jsx
+++ b/app/src/components/Settings.jsx
@@ -240,7 +240,7 @@ export default function Settings({ onShowIntro }) {
             onClick={handleDisplayNameSave}
             disabled={displayNameSaving || !isDirty || !displayNameDraft.trim()}
             style={{
-              padding: "10px 20px", background: "var(--accent)", color: "#fff",
+              padding: "10px 20px", background: "var(--accent-active)", color: "#fff",
               border: 0, cursor: "pointer", fontFamily: "var(--cds-font-sans)",
               fontSize: 13, fontWeight: 500,
               opacity: (displayNameSaving || !isDirty || !displayNameDraft.trim()) ? 0.45 : 1,
diff --git a/app/src/styles/app.css b/app/src/styles/app.css
index fe5cfa4..79c039d 100644
--- a/app/src/styles/app.css
+++ b/app/src/styles/app.css
@@ -23,8 +23,8 @@ button:not(.cds--btn):focus-visible,
   outline-offset: 2px;
 }
 
-/* Custom number inputs suppress outline inline; restore it here */
-input[type=number]:focus-visible {
+/* Restore focus ring on all raw (non-Carbon) inputs */
+input:not(.cds--text-input):not(.cds--search-input):focus-visible {
   outline: 2px solid #0f62fe;
   outline-offset: 0;
 }
diff --git a/app/src/styles/carbon-tokens.css b/app/src/styles/carbon-tokens.css
index 175be4f..2258c41 100644
--- a/app/src/styles/carbon-tokens.css
+++ b/app/src/styles/carbon-tokens.css
@@ -434,6 +434,7 @@
   --text-subdued-wl:  #6f6f6f;
   --text-disabled-wl: rgba(22,22,22,.25);
   --exercise:         #1a8c4e;
+  --accent-soft:      #b5116a;
 }
 
 /* Element defaults — semantic tags, productive sizing */