A person stays in dialogue with their case

Five things a building authority needed and portal could not say,
found by building one and replaying its cases through the engine.

The one that mattered: a submitter could only ever act on a record
nobody had touched. `access.rs` pinned a self_transition's from-state
to `open`, though the runtime had always passed the real state and
asked. So the applicant written to for a missing drawing could not
send it, and nobody could withdraw once anything had happened.
`self_transition` now takes `from: [state, ...]` and compiles one rule
per state; omitted it still means the initial state alone, which is
what every unsubscribe link already meant.

Then the four beside it. A record can belong to another record
(`type: record`, `of:`), with `where: { field, equals }` on a listing
as the other half, so an application's page lists the objections that
name it. A public view can be narrowed to the states worth showing,
so a register that is public by law is public about what was decided
and not about what was withdrawn. A state can grant a group, so an
approval that means membership needs no second step. And a state can
be moved by a clock (`after: { days, to }`, src/deadlines.rs) - held
to the same declared edge as a desk button, firing the same mail,
publishing the same event.

Also: the README is a README again, and everything that was crowding
it is in docs/ - architecture, content reference, state machines,
access, operations.

95 tests, up from 82.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/resource.rs

@@ -188,6 +188,50 @@ async fn authorize_resource(
     }
 }
 
+/// Whether a stored record passes the resource's `states` filter. No
+/// filter shows everything, which is what every resource written
+/// before this existed means. A record with no `state` at all is not
+/// an aggregate and is left alone.
+#[cfg(feature = "ssr")]
+fn shows_state(resource: &crate::content::ResourceSpec, value: &serde_json::Value) -> bool {
+    if resource.states.is_empty() {
+        return true;
+    }
+    match value.get("state").and_then(|s| s.as_str()) {
+        Some(state) => resource.states.iter().any(|s| s == state),
+        None => true,
+    }
+}
+
+/// Whether a stored record passes the resource's `where` filter. The
+/// field is looked for in the record's `responses`, which is where a
+/// form's answers live, and then on the record itself, so a listing
+/// can be narrowed by what was submitted or by what the runtime
+/// stamped on it. A missing field never matches: "everything that did
+/// not say" is not something a page should be able to ask for by
+/// accident.
+#[cfg(feature = "ssr")]
+fn matches_filter(
+    resource: &crate::content::ResourceSpec,
+    value: &serde_json::Value,
+    params: &std::collections::HashMap<String, String>,
+) -> bool {
+    let Some(filter) = &resource.filter else {
+        return true;
+    };
+    let wanted = crate::content::template_action(&filter.equals, &serde_json::json!(params))
+        .unwrap_or_else(|| filter.equals.clone());
+    let found = value
+        .get("responses")
+        .and_then(|r| r.get(&filter.field))
+        .or_else(|| value.get(&filter.field));
+    match found {
+        Some(serde_json::Value::String(s)) => s == &wanted,
+        Some(other) => other.to_string() == wanted,
+        None => false,
+    }
+}
+
 #[cfg(feature = "ssr")]
 async fn fetch_resource_value(
     state: &crate::server::AppState,
@@ -216,7 +260,14 @@ async fn fetch_resource_value(
                         .await
                         .map_err(|e| ServerFnError::new(e.to_string()))?
                         .ok_or_else(|| ServerFnError::new("resource key not found"))?;
-                    serde_json::from_slice(&bytes).map_err(|e| ServerFnError::new(e.to_string()))?
+                    let value: serde_json::Value =
+                        serde_json::from_slice(&bytes).map_err(|e| ServerFnError::new(e.to_string()))?;
+                    // A state filter holds for one record as well as a
+                    // listing, or naming the key would walk around it.
+                    if !shows_state(resource, &value) || !matches_filter(resource, &value, params) {
+                        return Err(ServerFnError::new("resource key not found"));
+                    }
+                    value
                 }
                 (None, Some(store)) => {
                     use futures::TryStreamExt;
@@ -231,7 +282,9 @@ async fn fetch_resource_value(
                     for key in keys {
                         if let Ok(Some(bytes)) = store.get(&key).await {
                             if let Ok(value) = serde_json::from_slice::<serde_json::Value>(&bytes) {
-                                items.push(value);
+                                if shows_state(resource, &value) && matches_filter(resource, &value, params) {
+                                    items.push(value);
+                                }
                             }
                         }
                     }
@@ -470,6 +523,58 @@ pub fn apply_jq(
 mod tests {
     use super::*;
 
+    fn spec(yaml: &str) -> crate::content::ResourceSpec {
+        serde_yaml::from_str(yaml).unwrap()
+    }
+
+    fn record(state: &str, responses: serde_json::Value) -> serde_json::Value {
+        serde_json::json!({ "id": "r", "state": state, "responses": responses })
+    }
+
+    // A register that is public by law is public about what was
+    // decided, not about what was withdrawn.
+    #[test]
+    fn a_listing_can_be_narrowed_to_the_states_worth_showing() {
+        let all = spec("source: { kind: kv, bucket: cases }\npublic: true\n");
+        let decided = spec("source: { kind: kv, bucket: cases }\npublic: true\nstates: [approved, refused]\n");
+        for state in ["approved", "refused", "withdrawn", "open"] {
+            assert!(shows_state(&all, &record(state, serde_json::json!({}))));
+        }
+        assert!(shows_state(&decided, &record("approved", serde_json::json!({}))));
+        assert!(shows_state(&decided, &record("refused", serde_json::json!({}))));
+        assert!(!shows_state(&decided, &record("withdrawn", serde_json::json!({}))));
+        // Something that is not an aggregate has no state to filter on
+        // and is left alone.
+        assert!(shows_state(&decided, &serde_json::json!({ "name": "a file" })));
+    }
+
+    // The other half of a record belonging to a record: the
+    // application's page asking for the objections that name it.
+    #[test]
+    fn a_listing_can_be_narrowed_to_the_children_of_one_record() {
+        let children = spec("source: { kind: kv, bucket: objections }\nrequires_group: case_officers\nwhere: { field: case, equals: \"{key}\" }\n");
+        let params = std::collections::HashMap::from([("key".to_string(), "abc123".to_string())]);
+        let mine = record("open", serde_json::json!({ "case": "abc123", "your_objection": "the sun" }));
+        let theirs = record("open", serde_json::json!({ "case": "def456" }));
+        let neither = record("open", serde_json::json!({ "your_objection": "no case named" }));
+        assert!(matches_filter(&children, &mine, &params));
+        assert!(!matches_filter(&children, &theirs, &params));
+        // A record that did not say is not everyone's child.
+        assert!(!matches_filter(&children, &neither, &params));
+        // No filter, no narrowing: every resource written before this
+        // existed still lists its whole bucket.
+        let plain = spec("source: { kind: kv, bucket: objections }\npublic: true\n");
+        assert!(matches_filter(&plain, &theirs, &params));
+    }
+
+    #[test]
+    fn a_filter_can_name_a_value_outright() {
+        let fixed = spec("source: { kind: kv, bucket: cases }\npublic: true\nwhere: { field: which_authority, equals: The county }\n");
+        let params = std::collections::HashMap::new();
+        assert!(matches_filter(&fixed, &record("open", serde_json::json!({ "which_authority": "The county" })), &params));
+        assert!(!matches_filter(&fixed, &record("open", serde_json::json!({ "which_authority": "Fire service" })), &params));
+    }
+
     /// A canned, Gitea-API-shaped fixture - the same fields the real
     /// `/users/{username}/starred` endpoint returns (Gitea 1.27:
     /// `stars_count`, not GitHub's `stargazers_count`; `website` is ""