Attended-bucket lint rule; app-lifetime resources fix first-nav corruption

validate_questions now rejects content where a record_as bucket is
read by nothing: every bucket must be listed by some Kv resource in
the same repo (a desk) or carry aggregates.yaml's new attended_by
annotation naming the automation that consumes it - no publicly
collected answer may land where nothing reads.

Separately, all server-fn resources (question/user/nav) move to a
PortalShell above the routes, created once and provided via context.
Per-page Resources broke on the first client-side navigation: the
remounted component's fresh Resource consumed a stale SSR hydration
buffer - the nav list [[id, name], ..] deserialized as a Page (serde
fills structs from sequences in field order), so uhhm.no's landing
question rendered chain-gated behind its own nav entry instead of
the /develop/proposal form.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/content.rs

@@ -948,6 +948,54 @@ pub fn validate_questions(
             }
         }
     }
+
+    // Attended buckets: no publicly collected answer may land somewhere
+    // nothing reads. Every `record_as` bucket must either be read back
+    // by some Kv resource in this same content repo (a desk or listing)
+    // or carry an explicit `attended_by:` annotation in aggregates.yaml
+    // naming the automation that consumes it. This is a contract, not a
+    // convention, because convention already failed once: a question
+    // was dropped and its bucket - answers included - silently fell out
+    // of every reader's view.
+    let mut read_buckets = std::collections::HashSet::new();
+    let note_resource = |spec: &ResourceSpec, set: &mut std::collections::HashSet<String>| {
+        if let ResourceSource::Kv { bucket } = &spec.source {
+            set.insert(bucket.clone());
+        }
+    };
+    for question in questions.values() {
+        for alternative in &question.alternatives {
+            for feature in &alternative.features {
+                if let Some(spec) = &feature.resource {
+                    note_resource(spec, &mut read_buckets);
+                }
+                for requirement in &feature.requirements {
+                    if let Some(spec) = &requirement.resource {
+                        note_resource(spec, &mut read_buckets);
+                    }
+                    if let Some(bind) = &requirement.bind {
+                        note_resource(&bind.resource, &mut read_buckets);
+                    }
+                }
+            }
+        }
+    }
+    for question in questions.values() {
+        for alternative in &question.alternatives {
+            if let Some(bucket) = &alternative.record_as {
+                let attended = read_buckets.contains(bucket)
+                    || aggregates
+                        .get(bucket)
+                        .is_some_and(|schema| schema.attended_by.is_some());
+                if !attended {
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: record_as {bucket:?} is unattended - no page reads that bucket back, and aggregates.yaml declares no attended_by for it. Add a desk/listing resource over it, or annotate the automation that consumes it.",
+                        question.id, alternative.name
+                    );
+                }
+            }
+        }
+    }
     Ok(())
 }
 
@@ -1501,6 +1549,40 @@ alternatives:
         assert!(validate_questions(&questions, &Default::default()).is_err());
     }
 
+    #[test]
+    fn recorded_buckets_must_be_attended() {
+        let write_only = vec![(
+            "index.yaml".to_string(),
+            "name: Home\nalternatives:\n  - name: send\n    record_as: black_hole\n".to_string(),
+        )];
+        let questions = build_questions(&write_only).unwrap();
+        let err = validate_questions(&questions, &Default::default()).unwrap_err();
+        assert!(err.to_string().contains("unattended"), "got: {err}");
+
+        // A desk (any Kv resource over the bucket, anywhere in the
+        // repo) attends it.
+        let with_desk = vec![
+            (
+                "index.yaml".to_string(),
+                "name: Home\nalternatives:\n  - name: send\n    record_as: inbox\n".to_string(),
+            ),
+            (
+                "review/index.yaml".to_string(),
+                "name: Desk\nalternatives:\n  - name: Inbox\n    features:\n      - name: \"\"\n        resource:\n          requires_group: owners\n          source:\n            kind: kv\n            bucket: inbox\n".to_string(),
+            ),
+        ];
+        let questions = build_questions(&with_desk).unwrap();
+        assert!(validate_questions(&questions, &Default::default()).is_ok());
+
+        // ..or an explicit attended_by annotation in aggregates.yaml.
+        let aggregates = crate::aggregates::parse_aggregates_yaml(
+            "aggregates:\n  - bucket: black_hole\n    initial: open\n    attended_by: n8n nightly digest\n    states:\n      open: { event: submitted }\n",
+        )
+        .unwrap();
+        let questions = build_questions(&write_only).unwrap();
+        assert!(validate_questions(&questions, &aggregates).is_ok());
+    }
+
     #[test]
     fn actions_may_not_target_dynamic_pages() {
         let files = vec![