DO NOT MERGE YET - fix(tracker): name the reason an untrack happened, and make the admin Untrack button mean something

.devcontainer/Dockerfile

@@ -1,30 +1,119 @@
-FROM elixir:1.17-otp-27
+FROM elixir:1.17-otp-26
 
-RUN apt install -yq curl gnupg
-# Install OS packages and Node.js (via nodesource),
-# plus inotify-tools and yarn
+ARG USERNAME=developer
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Install OS packages, Node.js (via nodesource), yarn, and gh CLI
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    sudo \
-    curl \
-    make \
-    git \
-    bash \
-    build-essential \
-    ca-certificates \
-    jq \
-    vim \
-    net-tools \
-    procps \
-    netcat-traditional \
-    # Optionally add any other tools you need, e.g. vim, wget...
+        sudo \
+        curl \
+        make \
+        git \
+        git-lfs \
+        bash \
+        zsh \
+        build-essential \
+        ca-certificates \
+        gnupg \
+        jq \
+        ripgrep \
+        tree \
+        lsof \
+        htop \
+        less \
+        vim \
+        locales \
+        net-tools \
+        netcat-openbsd \
+        procps \
+        inotify-tools \
     && curl -sL https://deb.nodesource.com/setup_18.x | bash - \
-    && apt-get install -y --no-install-recommends nodejs inotify-tools \
+    && apt-get install -y --no-install-recommends nodejs \
     && npm install -g yarn \
+    && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+        | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+        > /etc/apt/sources.list.d/github-cli.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends gh \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
-RUN apt --fix-broken install
+# Generate UTF-8 locale (some Elixir libs are encoding-sensitive)
+RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && locale-gen
+ENV LANG=en_US.UTF-8
+ENV LANGUAGE=en_US:en
+ENV LC_ALL=en_US.UTF-8
+
+# Create non-root user with passwordless sudo and zsh as login shell
+RUN groupadd --gid $USER_GID $USERNAME \
+    && useradd --uid $USER_UID --gid $USER_GID -m -s /bin/zsh $USERNAME \
+    && echo "$USERNAME ALL=(root) NOPASSWD:ALL" > /etc/sudoers.d/$USERNAME \
+    && chmod 0440 /etc/sudoers.d/$USERNAME
+
+# Persistent shell history across container rebuilds
+RUN mkdir -p /commandhistory && chown -R $USERNAME:$USERNAME /commandhistory
+
+# Allow git operations on the bind-mounted workspace
+RUN git config --system --add safe.directory /app
 
-RUN mix local.hex --force
+USER $USERNAME
+
+RUN mix local.hex --force && mix local.rebar --force
+
+# Install oh-my-zsh
+RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended
+
+# Install zsh plugins (autosuggestions + syntax highlighting)
+RUN git clone https://github.com/zsh-users/zsh-autosuggestions \
+        ${ZSH_CUSTOM:-/home/$USERNAME/.oh-my-zsh/custom}/plugins/zsh-autosuggestions \
+    && git clone https://github.com/zsh-users/zsh-syntax-highlighting \
+        ${ZSH_CUSTOM:-/home/$USERNAME/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting
+
+# .zshrc with oh-my-zsh, persistent history, project aliases, and dotfiles
+RUN printf '%s\n' \
+        'export ZSH="$HOME/.oh-my-zsh"' \
+        'ZSH_THEME="robbyrussell"' \
+        'plugins=(git mix docker docker-compose zsh-autosuggestions zsh-syntax-highlighting)' \
+        'source $ZSH/oh-my-zsh.sh' \
+        '' \
+        '# Persistent history (mounted volume)' \
+        'HISTFILE=/commandhistory/.zsh_history' \
+        'HISTSIZE=10000' \
+        'SAVEHIST=10000' \
+        'setopt appendhistory' \
+        'setopt sharehistory' \
+        'setopt hist_ignore_dups' \
+        '' \
+        '# NOTE: personal dotfiles are intentionally NOT sourced here. Doing so' \
+        '# only ever worked for a developer who separately bind-mounts ~/.dotfiles' \
+        '# via a local (gitignored) compose override, so it was dead code for' \
+        '# everyone else. That wiring now lives with the mount that enables it.' \
+        '' \
+        '# Aliases' \
+        'alias ll="ls -la"' \
+        'alias la="ls -A"' \
+        'alias gs="git status"' \
+        'alias gd="git diff"' \
+        '' \
+        '# Elixir/Phoenix aliases' \
+        'alias mt="mix test"' \
+        'alias mc="mix compile"' \
+        'alias mf="mix format"' \
+        'alias ms="iex -S mix phx.server"' \
+        'alias deps="mix deps.get"' \
+        '' \
+        '# Ensure Claude Code and local binaries are on PATH' \
+        'export PATH="$HOME/.local/bin:$PATH"' \
+        '' \
+        'export EDITOR=vim' \
+        'cd /app 2>/dev/null || true' \
+        > /home/$USERNAME/.zshrc
 
 WORKDIR /app
+
+ENV DEBIAN_FRONTEND=dialog

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,9 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "version": "2.5.9",
+      "resolved": "ghcr.io/devcontainers/features/common-utils@sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a",
+      "integrity": "sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a"
+    }
+  }
+}

.devcontainer/devcontainer.json

@@ -1,30 +1,57 @@
 {
   "name": "wanderer-dev",
-  "dockerComposeFile": ["./docker-compose.yml"],
+  "dockerComposeFile": [
+    "./docker-compose.yml",
+    "./docker-compose.override.yml"
+  ],
+  "service": "wanderer",
+  "workspaceFolder": "/app",
+  "shutdownAction": "stopCompose",
+  "remoteUser": "developer",
+  "containerUser": "developer",
+
+  "initializeCommand": "test -f .devcontainer/docker-compose.override.yml || echo 'services: {}' > .devcontainer/docker-compose.override.yml",
+  "postCreateCommand": "bash .devcontainer/setup.sh",
+  "postStartCommand": "bash .devcontainer/post-start.sh",
+
+  "remoteEnv": {
+    "PATH": "${containerEnv:HOME}/.local/bin:${containerEnv:PATH}"
+  },
   "customizations": {
     "vscode": {
       "extensions": [
-        "jakebecker.elixir-ls",
         "JakeBecker.elixir-ls",
+        "phoenixframework.phoenix",
+        "pantajoe.vscode-elixir-credo",
         "dbaeumer.vscode-eslint",
-        "esbenp.prettier-vscode"
+        "esbenp.prettier-vscode",
+        "eamodio.gitlens",
+        "mikestead.dotenv",
+        "ms-azuretools.vscode-docker"
       ],
       "settings": {
         "editor.formatOnSave": true,
         "search.exclude": {
-          "**/doc": true
+          "**/doc": true,
+          "**/_build": true,
+          "**/deps": true
         },
-        "elixirLS.dialyzerEnabled": false
+        "elixirLS.dialyzerEnabled": false,
+        "terminal.integrated.defaultProfile.linux": "zsh",
+        "terminal.integrated.profiles.linux": {
+          "zsh": {
+            "path": "/bin/zsh"
+          }
+        }
       }
     }
   },
-  "service": "wanderer",
-  "workspaceFolder": "/app",
-  "shutdownAction": "stopCompose",
-  "features": {
-    "ghcr.io/devcontainers/features/common-utils:2": {
-      "networkArgs": ["--add-host=host.docker.internal:host-gateway"]
+
+  "forwardPorts": [4444],
+  "portsAttributes": {
+    "4444": {
+      "label": "Wanderer (Phoenix)",
+      "onAutoForward": "notify"
     }
-  },
-  "forwardPorts": [4444]
+  }
 }

.devcontainer/docker-compose.override.yml.example

@@ -0,0 +1,18 @@
+# docker-compose.override.yml.example
+#
+# Copy this file to docker-compose.override.yml for host-specific mounts.
+# The override file is gitignored and will be auto-created (empty) by
+# devcontainer.json's initializeCommand if missing.
+#
+# Uncomment any sections you want.
+services:
+  wanderer:
+    volumes:
+      # Host SSH keys (Git over SSH, signing)
+      - ~/.ssh:/home/developer/.ssh:ro
+
+      # GitHub CLI auth
+      - ~/.config/gh:/home/developer/.config/gh:ro
+
+      # Claude Code config, commands, plugins, settings
+      - ~/.claude:/home/developer/.claude:cached

.devcontainer/docker-compose.yml

@@ -1,36 +1,55 @@
-version: "0.1"
-
 services:
   db:
-    image: postgres:13-alpine
+    # Matches production (postgres:16-alpine). AshPostgres declares
+    # min_pg_version 15 in lib/wanderer_app/repo.ex, so 13 was below the
+    # supported floor. The volume is renamed from db-new because a PG13 data
+    # directory is not readable by a PG16 server — reusing the old name would
+    # make the container fail to start rather than upgrade. Recreate the
+    # databases with `mix ecto.setup`, which also runs priv/repo/seeds.exs to
+    # re-download the EVE SDE reference data (solar systems, jumps, ship types).
+    image: postgres:16-alpine
     restart: always
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
     ports:
-      - "5432:5432"
+      - "5436:5432"
     volumes:
-      - db-new:/var/lib/postgresql/data
+      - db-pg16:/var/lib/postgresql/data
 
   wanderer:
+    build:
+      context: .
+      dockerfile: Dockerfile
     environment:
       PORT: 4444
       DB_HOST: db
       WEB_APP_URL: "http://localhost:4444"
       ERL_AFLAGS: "-kernel shell_history enabled"
-    build:
-      context: .
-      dockerfile: Dockerfile
     ports:
       - 4444:4444
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     volumes:
       - ..:/app:delegated
-      - ~/.gitconfig:/root/.gitconfig
-      - ~/.gitignore:/root/.gitignore
-      - ~/.ssh:/root/.ssh
-      - elixir-artifacts:/opt/elixir-artifacts
+      - command-history:/commandhistory
+      # deps/ and _build/ deliberately live in the repo via the /app bind
+      # rather than in named volumes nested at /app/deps and /app/_build.
+      #
+      # A named volume mounted inside the bind MASKS whatever the repo has at
+      # that path, and it only does so for the main working tree. Git worktrees
+      # (this repo keeps them under .claude/worktrees/) therefore came up with
+      # an empty deps/ and _build/ and had to recompile from scratch, which is
+      # what drove the ad-hoc `ln -sfn /app/deps deps` workarounds — those
+      # produce symlinks that resolve in the container but dangle on the host.
+      #
+      # Tradeoff accepted: host and container now share _build. BEAM artifacts
+      # are OTP-version-specific, so after changing the Erlang/Elixir version
+      # (including this container's OTP 27 -> 26 correction), run
+      # `rm -rf _build` once or mix will report modules compiled by a
+      # different version.
     command: sleep infinity
 
 volumes:
-  elixir-artifacts: {}
-  db-new: {}
+  db-pg16: {}
+  command-history: {}

.devcontainer/post-start.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# Post-start script - runs every time the container starts
+
+set -e
+
+echo "🔄 Running post-start tasks..."
+
+CONTAINER_HOME="$(eval echo ~)"
+
+# Display helpful information
+echo ""
+echo "📊 Environment Info:"
+echo "  Elixir version: $(elixir --version | tail -1 | awk '{print $2}' 2>/dev/null || echo 'not installed')"
+echo "  Node version:   $(node --version 2>/dev/null || echo 'not installed')"
+echo "  Claude Code:    $(claude --version 2>/dev/null || echo 'not installed')"
+echo "  Shell:          $(basename "${SHELL}")"
+echo "  Working dir:    $(pwd)"
+echo ""
+
+# Check database (Postgres)
+DB_HOST=${DB_HOST:-db}
+if command -v nc >/dev/null 2>&1; then
+    if nc -z "$DB_HOST" 5432 2>/dev/null; then
+        echo "💾 Postgres: ready (${DB_HOST}:5432)"
+    else
+        echo "⚠️  Postgres not yet ready at ${DB_HOST}:5432 — check docker compose logs db"
+    fi
+fi
+
+echo ""
+echo "🎯 Ready to code!"
+echo ""
+echo "Useful commands:"
+echo "  make server   # Start Phoenix dev server (port 4444)"
+echo "  mix test      # Run tests"
+echo "  mix format    # Format code"
+echo "  claude        # Start Claude Code CLI"
+echo ""