Make the phone work: touch reordering, reachable menus, and nothing lost offline

Four things that were built for a mouse on a desk and quietly did nothing
useful on a phone. The last one is the serious one.

**A note made offline lost everything written into it.** Its create
reached the server, the server named it something else, and every edit
still queued behind it went on addressing the name only that device ever
knew — 404, five retries, thrown away. The note arrived empty and
untitled, with nothing to say that anything had been lost. The database
was repointed at the new id all along; the queue was not. It is now, by
replacing the id across the whole queued payload rather than in a list of
named fields, because a list of fields is a list to forget to add to. The
same held for a notebook made offline and everything filed into it.

**The order of notes could not be changed on a phone**, because the list
went through the HTML5 drag API, which mobile browsers never fire from
touch. Pointer events instead, which mouse, pen and finger all produce. A
mouse still drags a row from anywhere; a finger drags from a grip,
because pressing the row has to go on scrolling and holding it has to go
on opening the menu. The row under the finger is found with
elementFromPoint — a finger raises no pointerover on anything it did not
press.

**"Move to..." opened off the side of the screen**, and could not be
opened at all without a hover. It is a tap now, unfolding in place where
there is no room beside the menu and flipping sides where there is. The
menu itself is placed by measuring rather than by assuming it is 220px
wide, its rows are tall enough to hit with a thumb, and Escape closes it.

**Installing said nothing when it could not be done.** The entry appeared
only when the browser had offered a prompt, so where installing was
impossible there was no button and no reason. It is always there now and
names the cause — most usefully that a browser will only install a site
served over HTTPS, which is also why the service worker would not have
registered, so one cause was showing up as two mysteries.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -8,6 +8,36 @@ not from the output of `docker push`.
 
 ---
 
+## Unreleased
+
+**Fixed**
+- **A note made offline lost everything written into it.** Its create reached
+  the server, the server named it something else, and every edit still queued
+  behind it went on addressing the name only that device knew — a 404, five
+  retries, then thrown away. The note arrived empty and untitled with no sign
+  anything had been lost. The queue is now repointed along with the database.
+  The same held for a notebook made offline.
+- **The order of notes could not be changed on a phone.** The list used the
+  HTML5 drag API, which mobile browsers never fire from touch. It uses pointer
+  events now, and every row has a grip: pressing the row itself still scrolls,
+  and holding it still opens the menu.
+- **"Move to…" opened off the side of the screen** and could not be opened at
+  all with a finger. It was pinned to the right of the menu and reacted only to
+  hover. It now opens on a tap, unfolds in place on a narrow screen, and flips
+  to the other side on a wide one when there is no room.
+- The menu itself is placed by measuring rather than by assuming it is 220px
+  wide, so it can no longer hang off an edge; rows are tall enough to hit with a
+  thumb, and Escape closes it.
+
+**Changed**
+- **The install entry is always there.** It used to appear only when the browser
+  offered a prompt, so where installing was impossible there was nothing on
+  screen at all — no button, no reason. It now says which of the fixable causes
+  applies: served over plain HTTP, or a browser that wants to be asked through
+  its own menu.
+
+---
+
 ## 2026-08-12 — Covers, the search box, and room to write in the margin
 
 **Images** — web `sha256:c1222665…`, server `sha256:06f94f43…`