Report question: skip a broken card and tell the server

A generated matching card arrived on a phone with three identical
definitions (the generation guards now drop those), but there was no way
to get past a bad card from inside a session. The feed chrome (deck
study, review, mistakes and exam) now has the red "!" control: one tap
records the question, skips to the next card and shows an Undo toast.

- lib/question-reports.ts: the local list (freezmo.reports.v1, zod on
  read, capped 200) is the skip state — reported cards leave every
  session type, count as "not attempted" in the results instead of
  wrong, and Undo takes a report back. A deck where everything is
  reported stays studiable so it can be regenerated.
- POST /api/reports appends one JSON line per report to
  REPORTS_DIR/reports.jsonl (shared/freezmo/reports in production, the
  dev data dir in dev). Deliberately write-only: the question text is
  readable on the server (that is the point — prompt tuning) but never
  over HTTP, since the app has no auth. Best effort: offline reports stay
  local.
- The button: a red outlined rounded square with "!", the chrome's
  control size, in both feed headers (hidden on the results slide).
- config: REPORTS_DIR + RATE_LIMIT_REPORTS (20); the deploy creates the
  shared reports dir; the dev unit and AGENTS.md note the new server
  data location.
- Suites: phase-1 (append + validation + no GET), phase-2 (button, toast,
  server POST, local copy, skip counter, hidden next session, Undo, exam
  pool). SW -> freezmo-v38.

tests/phase1-test.mjs

@@ -4,7 +4,7 @@
  * and usage-limit handling (client wiring + real server mapping against a stub
  * Ollama).
  */
-import { readFileSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync } from "node:fs";
 import http from "node:http";
 
 import {
@@ -476,5 +476,59 @@ async function openSettings(page) {
   }
 }
 
+/* 10. reports: appended as JSON lines, write-only over HTTP --------- */
+{
+  check("reports: app port free", !(await portInUse(3211)));
+  const reportsDir = new URL("./.tmp/reports-api", import.meta.url).pathname;
+  rmSync(reportsDir, { recursive: true, force: true });
+  mkdirSync(reportsDir, { recursive: true });
+  const app = spawnApp(3211, {
+    OLLAMA_BASE_URL: "http://127.0.0.1:11999",
+    OLLAMA_AUTH: "local",
+    OLLAMA_VERIFY_KEY: "false",
+    REPORTS_DIR: reportsDir,
+  });
+
+  try {
+    const up = await waitForHttp("http://127.0.0.1:3211/api/health");
+    check("reports: stub app is up", up);
+    if (up) {
+      const report = {
+        deckId: "seed_deck",
+        deckTitle: "Lidové čtení",
+        activityId: "a1",
+        type: "matching",
+        question: "Přiřaď postavy k jejich zařazení.",
+        at: Date.now(),
+      };
+      const accepted = await fetch("http://127.0.0.1:3211/api/reports", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(report),
+      });
+      check("reports: accepted", accepted.status === 200 && (await accepted.json()).ok === true, String(accepted.status));
+
+      const lines = readFileSync(`${reportsDir}/reports.jsonl`, "utf8").trim().split("\n");
+      const stored = JSON.parse(lines[lines.length - 1]);
+      check(
+        "reports: one JSON line with a server timestamp",
+        stored.activityId === "a1" && stored.question === report.question && typeof stored.receivedAt === "string",
+      );
+
+      const invalid = await fetch("http://127.0.0.1:3211/api/reports", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ deckId: "x" }),
+      });
+      check("reports: invalid body rejected", invalid.status === 400, String(invalid.status));
+
+      const readBack = await fetch("http://127.0.0.1:3211/api/reports");
+      check("reports: write-only over HTTP (no GET)", readBack.status === 405, String(readBack.status));
+    }
+  } finally {
+    app.stop();
+  }
+}
+
 await browser.close();
 finish();

tests/phase2-test.mjs

@@ -123,6 +123,58 @@ const browser = await launchBrowser();
   await context.close();
 }
 
+/* 1c. report question: skips, records, hides, undo ------------------- */
+{
+  const { context, page } = await makePage(browser);
+  const posts = [];
+  await page.route("**/api/reports", (route) => {
+    posts.push(JSON.parse(route.request().postData() ?? "{}"));
+    return route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify({ ok: true }) });
+  });
+  await seed(page, { decks: [DECK] });
+  await page.goto(`${BASE}/deck/seed_deck`, { waitUntil: "networkidle" });
+  await page.waitForTimeout(1000);
+
+  const report = page.getByRole("button", { name: "Report question" });
+  check("report: button sits in the feed chrome", await report.isVisible());
+  await report.click();
+  await page.waitForTimeout(700);
+  check("report: toast with Undo", await page.getByText("Question reported").isVisible());
+  check(
+    "report: sent to the server",
+    posts.length === 1 && posts[0].activityId === "a1" && posts[0].question.includes("What colour"),
+    JSON.stringify(posts[0] ?? {}).slice(0, 80),
+  );
+  const stored = await page.evaluate(() => JSON.parse(localStorage.getItem("freezmo.reports.v1") ?? "[]"));
+  check("report: kept locally", stored.length === 1 && stored[0].activityId === "a1");
+  check("report: skips to the next activity", await page.getByText("2/2").isVisible());
+
+  // A fresh session leaves the reported question out.
+  await page.goto(`${BASE}/deck/seed_deck`, { waitUntil: "networkidle" });
+  await page.waitForTimeout(1000);
+  check(
+    "report: hidden in the next session",
+    (await page.getByText("What colour is a clear daytime sky?").count()) === 0 &&
+      (await page.getByText("What makes the sky blue?").count()) >= 1,
+  );
+
+  // Undo takes a report back (the earlier one stays).
+  await page.goto(`${BASE}/deck/seed_deck`, { waitUntil: "networkidle" });
+  await page.waitForTimeout(900);
+  await page.getByRole("button", { name: "Report question" }).click();
+  await page.waitForTimeout(400);
+  const before = await page.evaluate(() =>
+    JSON.parse(localStorage.getItem("freezmo.reports.v1") ?? "[]").map((report) => report.activityId),
+  );
+  await page.getByRole("button", { name: "Undo" }).click();
+  await page.waitForTimeout(300);
+  const after = await page.evaluate(() =>
+    JSON.parse(localStorage.getItem("freezmo.reports.v1") ?? "[]").map((report) => report.activityId),
+  );
+  check("report: Undo takes the report back", before.includes("a2") && !after.includes("a2") && after.includes("a1"), JSON.stringify({ before, after }));
+  await context.close();
+}
+
 /* 2. SRS due → review session; stats screen -------------------------- */
 {
   const now = Date.now();
@@ -164,6 +216,32 @@ const browser = await launchBrowser();
   await context.close();
 }
 
+/* 2b. review and exam leave reported questions out ------------------- */
+{
+  const { context, page } = await makePage(browser);
+  await page.addInitScript(() => {
+    localStorage.setItem(
+      "freezmo.reports.v1",
+      JSON.stringify([
+        { deckId: "seed_deck", activityId: "a1", type: "multiple_choice", question: "What colour is a clear daytime sky?", at: Date.now() },
+      ]),
+    );
+  });
+  await seed(page, { decks: [DECK] });
+  await page.goto(`${BASE}/exam`, { waitUntil: "networkidle" });
+  await page.waitForTimeout(900);
+  await page.getByRole("button", { name: /Sky deck/ }).click();
+  await page.waitForTimeout(200);
+  await page.getByRole("button", { name: /Start exam/ }).click();
+  await page.waitForTimeout(1000);
+  check(
+    "exam: reported question is out of the pool",
+    (await page.getByText("What colour is a clear daytime sky?").count()) === 0 &&
+      (await page.getByText("What makes the sky blue?").count()) >= 1,
+  );
+  await context.close();
+}
+
 /* 3. exam mode: setup, no hints, timer, breakdown -------------------- */
 {
   const { context, page } = await makePage(browser);