Release 0.2.3

validate_questions now rejects content where a record_as bucket is
read by nothing: every bucket must be listed by some Kv resource in
the same repo (a desk) or carry aggregates.yaml's new attended_by
annotation naming the automation that consumes it - no publicly
collected answer may land where nothing reads.

Separately, all server-fn resources (question/user/nav) move to a
PortalShell above the routes, created once and provided via context.
Per-page Resources broke on the first client-side navigation: the
remounted component's fresh Resource consumed a stale SSR hydration
buffer - the nav list [[id, name], ..] deserialized as a Page (serde
fills structs from sequences in field order), so uhhm.no's landing
question rendered chain-gated behind its own nav entry instead of
the /develop/proposal form.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -1,133 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches: [main]
-
-jobs:
-  deploy:
-    runs-on: bare
-    env:
-      # The bare runner's own systemd service intentionally has a minimal
-      # PATH/HOME (no rustup default toolchain in reach) - point it at the
-      # shared toolchain install directly rather than assuming an ambient
-      # dev shell environment.
-      CARGO_HOME: /var/local/cargo
-      RUSTUP_HOME: /var/local/rustup
-      PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
-      # Shared with interactive dev builds (see ~/.config/fish/config.fish)
-      # so a crate compiled once, by either a manual build or CI, is
-      # cached for the other - real cache hits, not just a warm toolchain.
-      # SCCACHE_SERVER_PORT deliberately differs from the interactive
-      # dev shell's (4227): sccache's server is discovered by a fixed
-      # TCP port shared by every local user, so if both contexts used
-      # the same port, whichever one's server happened to be running
-      # would silently "win" and serve build requests it doesn't have
-      # filesystem permission for. Separate ports keep each context's
-      # own server answering its own requests; the cache directory
-      # (not the server process) is what's actually shared.
-      SCCACHE_DIR: /var/local/sccache
-      SCCACHE_SERVER_PORT: "4228"
-      CARGO_TARGET_DIR: /var/local/cargo-target
-      # cargo-leptos's own downloaded tools (wasm-bindgen, wasm-opt) cache
-      # under $XDG_CACHE_HOME - left at its default that resolves inside
-      # this unit's systemd StateDirectory, files it creates there end up
-      # owned by the kernel's overflow "nobody" uid instead of the
-      # runner's own dynamic uid (a StateDirectory quirk, not something
-      # in our control), so a later run can't execute what an earlier run
-      # downloaded. Redirecting it to our own known-good shared dir avoids
-      # that entirely.
-      XDG_CACHE_HOME: /var/local/leptos-cache
-    steps:
-      - uses: actions/checkout@v4
-
-      # SITE_NAME is read via option_env! (src/app.rs) - compile-time,
-      # not a runtime env var - so it has to be set here, not just in
-      # the "Write service env" step below.
-      - name: Build
-        run: SITE_NAME=${{ vars.PORTAL_SITE_NAME }} cargo leptos build --release
-
-      # cargo-leptos only builds the leptos bin-target ("portal") - the
-      # question-lint utility binary needs its own plain cargo build.
-      - name: Build question-lint
-        run: cargo build --release --bin question_lint --features ssr
-
-      - name: Ship release
-        run: |
-          set -euo pipefail
-          rel="/srv/app/uhhm-portal/releases/${{ github.sha }}"
-          mkdir -p "$rel"
-          cp "$CARGO_TARGET_DIR/release/portal" "$rel/uhhm-portal"
-          # questions' own CI execs this directly by path (same bare-metal
-          # runner/host as this job, no artifact download needed) instead
-          # of running its own hand-maintained yq/jq subset of these rules.
-          cp "$CARGO_TARGET_DIR/release/question_lint" "$rel/question_lint"
-          # site-root ("target/site" in Cargo.toml) is project-relative,
-          # not affected by CARGO_TARGET_DIR - only the plain `cargo build`
-          # outputs (release/, front/) move with that override.
-          cp -r target/site "$rel/site"
-          ln -sfn "$rel" /srv/app/uhhm-portal/current
-
-      # Sourced from this repo's own Settings -> Actions Variables/Secrets,
-      # not typed onto the host by hand - see the infrastructure repo's
-      # deploy-runner plan for the exact names/values to configure once.
-      - name: Write service env
-        run: |
-          cat > /etc/app/uhhm-portal.env <<EOF
-          NATS_URL=${{ secrets.PORTAL_NATS_URL }}
-          KANIDM_URL=${{ vars.PORTAL_KANIDM_URL }}
-          OAUTH2_CLIENT_ID=${{ vars.PORTAL_OAUTH2_CLIENT_ID }}
-          OAUTH2_CLIENT_SECRET=${{ secrets.PORTAL_OAUTH2_CLIENT_SECRET }}
-          PUBLIC_URL=${{ vars.PORTAL_PUBLIC_URL }}
-          COOKIE_SECURE=true
-          CONTENT_REPO=https://project.uhhm.no/uhhm/questions
-          CONTENT_BRANCH=main
-          SITE_NAME=${{ vars.PORTAL_SITE_NAME }}
-          LEPTOS_SITE_ADDR=0.0.0.0:3010
-          # Cargo.toml's site-root ("target/site") is a build-time path;
-          # the deploy layout copies the bundle to releases/<sha>/site
-          # (no target/ prefix) - override so the running binary looks
-          # in the right place for /pkg/*.
-          LEPTOS_SITE_ROOT=site
-          AUTOMATION_READ_TOKEN=${{ secrets.PORTAL_AUTOMATION_READ_TOKEN }}
-          # Read-only (read:user,read:repository,read:organization),
-          # used only by the GiteaStarred/GiteaOrgRepos resource sources
-          # (src/resource.rs) - the repo-contents/repo-info calls
-          # content loading already makes stay anonymous.
-          GITEA_API_TOKEN=${{ secrets.PORTAL_GITEA_API_TOKEN }}
-          EOF
-
-      # No sudo: the runner's own unit sets NoNewPrivileges=yes, which
-      # blocks setuid escalation outright (sudo can't work at all under
-      # it, regardless of sudoers config) - systemctl talks to PID1 over
-      # D-Bus instead, authorized by a polkit rule scoped to deploy-runner
-      # + this unit pattern (see /etc/polkit-1/rules.d/10-deploy-runner.rules
-      # on the host).
-      - name: Restart service
-        run: systemctl restart app@uhhm-portal.service
-
-      # No sudo here either - the runner is already in the `docker` group,
-      # so it can talk to the Docker socket directly.
-      # Apex and www are separate cookie scopes (no shared Domain
-      # attribute on the session cookie), but Kanidm's redirect_uri is
-      # fixed to PUBLIC_URL - a login started on the other host set its
-      # session cookie there, then landed on PUBLIC_URL's callback with
-      # an empty session ("no login in progress"). Redirecting www to
-      # the naked domain keeps every visit on one canonical host
-      # instead - PUBLIC_URL (repo variable) is set to https://{$DOMAIN}
-      # to match.
-      - name: Update Caddy routing
-        run: |
-          cat > /etc/caddy/services.d/uhhm-portal.caddy <<'EOF'
-          www.{$DOMAIN} {
-          	redir https://{$DOMAIN}{uri} permanent
-          }
-
-          {$DOMAIN} {
-          	reverse_proxy host.docker.internal:3010
-          	log {
-          		output file /var/log/caddy/www.log
-          	}
-          }
-          EOF
-          docker exec caddy caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile

.gitea/workflows/publish.yml

@@ -0,0 +1,101 @@
+name: Publish release
+
+# Portal does not deploy itself. Cutting a version is deliberate:
+# `cargo release <level>` bumps Cargo.toml, commits, tags v<semver>,
+# and pushes; this workflow reacts to the tag and publishes the
+# artifact as a Gitea release. Each content repo (uhhm/questions,
+# redoal/questions) pins PORTAL_RELEASE to one of these tags in its
+# own deploy workflow - bumping the pin there is what rolls a version
+# out to a site. Plain main pushes only run test.yml.
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    runs-on: bare
+    env:
+      # The bare runner's own systemd service intentionally has a minimal
+      # PATH/HOME (no rustup default toolchain in reach) - point it at the
+      # shared toolchain install directly rather than assuming an ambient
+      # dev shell environment.
+      CARGO_HOME: /var/local/cargo
+      RUSTUP_HOME: /var/local/rustup
+      PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
+      # Shared with interactive dev builds (see ~/.config/fish/config.fish)
+      # so a crate compiled once, by either a manual build or CI, is
+      # cached for the other - real cache hits, not just a warm toolchain.
+      # SCCACHE_SERVER_PORT deliberately differs from the interactive
+      # dev shell's (4227): sccache's server is discovered by a fixed
+      # TCP port shared by every local user, so if both contexts used
+      # the same port, whichever one's server happened to be running
+      # would silently "win" and serve build requests it doesn't have
+      # filesystem permission for. Separate ports keep each context's
+      # own server answering its own requests; the cache directory
+      # (not the server process) is what's actually shared.
+      SCCACHE_DIR: /var/local/sccache
+      SCCACHE_SERVER_PORT: "4228"
+      CARGO_TARGET_DIR: /var/local/cargo-target
+      # cargo-leptos's own downloaded tools (wasm-bindgen, wasm-opt) cache
+      # under $XDG_CACHE_HOME - left at its default that resolves inside
+      # this unit's systemd StateDirectory, files it creates there end up
+      # owned by the kernel's overflow "nobody" uid instead of the
+      # runner's own dynamic uid (a StateDirectory quirk, not something
+      # in our control), so a later run can't execute what an earlier run
+      # downloaded. Redirecting it to our own known-good shared dir avoids
+      # that entirely.
+      XDG_CACHE_HOME: /var/local/leptos-cache
+    steps:
+      - uses: actions/checkout@v4
+
+      # SITE_NAME is read via option_env! (src/app.rs) - compile-time,
+      # not a runtime env var. It is only the last-resort fallback name:
+      # each instance's site.yaml (content-driven branding) overrides it,
+      # so one artifact serves every site.
+      - name: Build
+        run: SITE_NAME=${{ vars.PORTAL_SITE_NAME }} cargo leptos build --release
+
+      # cargo-leptos only builds the leptos bin-target ("portal") - the
+      # question-lint utility binary needs its own plain cargo build.
+      - name: Build question-lint
+        run: cargo build --release --bin question_lint --features ssr
+
+      - name: Package
+        run: |
+          set -euo pipefail
+          tag="${{ github.ref_name }}"
+          stage=$(mktemp -d)
+          cp "$CARGO_TARGET_DIR/release/portal" "$stage/portal"
+          cp "$CARGO_TARGET_DIR/release/question_lint" "$stage/question_lint"
+          # site-root ("target/site" in Cargo.toml) is project-relative,
+          # not affected by CARGO_TARGET_DIR - only the plain `cargo build`
+          # outputs (release/, front/) move with that override.
+          cp -r target/site "$stage/site"
+          tar -C "$stage" -czf "portal-$tag.tar.gz" portal question_lint site
+          rm -rf "$stage"
+
+      # The run's own ephemeral token has write access to this repo -
+      # no long-lived PAT to manage. The tag already exists (cargo
+      # release pushed it), so the release attaches to it; a re-run
+      # finds the existing release instead of failing.
+      - name: Publish release
+        run: |
+          set -euo pipefail
+          tag="${{ github.ref_name }}"
+          api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+          auth="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
+          subject=$(git log -1 --format=%s)
+          body=$(printf '{"tag_name":"%s","name":"%s"}' \
+            "$tag" "$tag: $(echo "$subject" | sed 's/"/\\"/g')")
+          id=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
+            -d "$body" "$api/releases" | jq .id) \
+            || id=$(curl -sf -H "$auth" "$api/releases/tags/$tag" | jq .id)
+          # Replace the asset if a re-run already uploaded one.
+          for aid in $(curl -sf -H "$auth" "$api/releases/$id/assets" | jq '.[].id'); do
+            curl -sf -X DELETE -H "$auth" "$api/releases/$id/assets/$aid"
+          done
+          curl -sf -X POST -H "$auth" \
+            -F "attachment=@portal-$tag.tar.gz" \
+            "$api/releases/$id/assets?name=portal-$tag.tar.gz" > /dev/null
+          echo "published $tag"

.gitea/workflows/test.yml

@@ -0,0 +1,26 @@
+name: Test
+
+# Publishing only happens on v* tags (publish.yml), so this is what
+# keeps plain main pushes honest between releases.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: bare
+    env:
+      # Same shared-toolchain/cache story as publish.yml.
+      CARGO_HOME: /var/local/cargo
+      RUSTUP_HOME: /var/local/rustup
+      PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
+      SCCACHE_DIR: /var/local/sccache
+      SCCACHE_SERVER_PORT: "4228"
+      CARGO_TARGET_DIR: /var/local/cargo-target
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Test
+        run: cargo test --features ssr

Cargo.lock

@@ -2948,7 +2948,7 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.1.0"
+version = "0.2.3"
 dependencies = [
  "anyhow",
  "arc-swap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.1.0"
+version = "0.2.3"
 edition = "2021"
 
 [lib]
@@ -19,7 +19,7 @@ axum = { version = "0.8", features = ["multipart"], optional = true }
 aws-sdk-s3 = { version = "1", optional = true }
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal"], optional = true }
 tower = { version = "0.5", optional = true }
-tower-http = { version = "0.6", features = ["fs"], optional = true }
+tower-http = { version = "0.6", features = ["fs", "set-header"], optional = true }
 tower-sessions = { version = "0.14", optional = true }
 async-nats = { version = "0.38", optional = true }
 arc-swap = { version = "1", optional = true }
@@ -131,3 +131,12 @@ bin-default-features = false
 lib-features = ["hydrate"]
 lib-default-features = false
 lib-profile-release = "wasm-release"
+
+# cargo release <level> is how a portal version is cut: bump, commit,
+# tag v{{version}}, push. CI (publish.yml) reacts to the tag and
+# publishes the release artifact; nothing on crates.io.
+[package.metadata.release]
+publish = false
+push = true
+tag-name = "v{{version}}"
+pre-release-commit-message = "Release {{version}}"

README.md

@@ -1,17 +1,41 @@
 # portal
 
-The question runtime behind [uhhm.no](https://uhhm.no). Every page,
-form, review desk, and state machine it serves is declared in the
-[`questions`](https://project.uhhm.no/uhhm/questions) content repo —
-this codebase is the engine that renders, enforces, and records, and
-it special-cases none of it.
+A content-driven question engine: one Rust binary that turns a Git
+repo of YAML into a live site — pages, forms, review desks, and state
+machines, with a durable event-sourced record of every answer
+underneath. The engine special-cases nothing: everything a site
+serves is declared in its content repo, and the same build serves any
+number of sites.
+
+Point an instance at a content repo and that repo *is* the site:
+pages, copy, state graphs, and branding (`site.yaml`: title,
+wordmark, and which hero the landing page opens on — the YES canvas,
+a gesture-drawing canvas wired to a relay, or plain copy). Content
+pushes hot-reload every running instance; instances differ only by
+env vars. [uhhm.no](https://uhhm.no)
+([uhhm/questions](https://project.uhhm.no/uhhm/questions)) and
+[redoal.com](https://redoal.com)
+([redoal/questions](https://project.uhhm.no/redoal/questions)) are
+two faces of the same binary, deployed from the same release
+artifact.
+
+It composes with the surrounding stack rather than bundling it: Gitea
+hosts and serves the content, NATS JetStream stores events and
+projections, Kanidm provides identity, and anything downstream
+(automations, newsletters, onboarding) subscribes to the answer
+stream.
 
 ## What the engine provides
 
 - **Content-driven pages** (`src/content.rs`, `src/app.rs`): YAML
   loaded from Gitea at boot and hot-swapped on a NATS reload signal;
-  a bad push keeps the last-good content serving. A page's `id` is
-  its URL; `qualifies` gates it to a Kanidm group.
+  a bad push keeps the last-good content serving. The `questions/`
+  tree IS the router — file paths become URLs, `_section.yaml`
+  applies criteria to a whole directory, `[name].yaml` pages serve
+  any `/dir/<value>` with the segment fed into resource keys, and
+  `requires_chain` gates a page on verifiable answer provenance next
+  to `qualifies`' Kanidm-group identity gate (see
+  `docs/design/filesystem-routes.md`).
 - **State machines as content** (`src/aggregates/`): `aggregates.yaml`
   declares each bucket's states and legal transitions; the engine
   replays a record's event history and refuses undeclared moves, with
@@ -28,8 +52,13 @@ it special-cases none of it.
   lineage; `?chain=` links carry it, and self-service transitions
   (unsubscribe) authorize by holding one.
 - **Live resources** (`src/resource.rs`): content can pull a KV
-  bucket, Gitea starred/org repos, or any public JSON URL (SSRF
-  fail-closed), reshaped by a content-declared `jq` filter.
+  bucket, Gitea starred/org repos/releases, or any public JSON URL
+  (SSRF fail-closed), reshaped by a content-declared `jq` filter.
+- **Input kinds as content**: a requirement's `type:` picks the
+  widget — plain fields, a rich-text editor, or a `gesture` drawing
+  canvas that can connect to a redoal relay so similar strokes echo
+  between visitors live. Submitted values are arbitrary JSON; the
+  engine records what the widget produced.
 - **Review desks**: any Kv resource with `transitions` renders rows
   with per-state action buttons and one shared confirm per
   alternative — owners walk records through their graphs without
@@ -38,9 +67,10 @@ it special-cases none of it.
 ## Binaries
 
 - `portal` — the server (Leptos SSR + hydrate, Axum underneath).
-- `question_lint` — headless content validation, run by the
-  `questions` repo's CI against a prebuilt copy this repo's deploy
-  publishes; also works offline: `question_lint --path <dir>`.
+- `question_lint` — headless content validation, shipped inside every
+  release artifact so each content repo's CI lints with the exact
+  portal version its instance runs; also works offline:
+  `question_lint --path <dir>`.
 
 ## Development
 
@@ -50,17 +80,55 @@ cargo test --features ssr     # engine tests
 cargo build --features ssr --bin question_lint
 ```
 
-Runtime configuration is env vars (see `src/main.rs` and
-`.gitea/workflows/deploy.yml`): `NATS_URL`, `CONTENT_REPO`/
-`CONTENT_BRANCH`, Kanidm OIDC (`KANIDM_URL`, `OAUTH2_CLIENT_*`),
-optional `GARAGE_*` for uploads, `GITEA_API_TOKEN` for authenticated
-resource pulls, `AUTOMATION_READ_TOKEN` for the automation KV read
-endpoint.
+Runtime configuration is env vars (see `src/main.rs`, and each
+content repo's `.gitea/workflows/deploy.yml` for the values in
+production): `NATS_URL`, `CONTENT_REPO`/`CONTENT_BRANCH`, Kanidm OIDC
+(`KANIDM_URL`, `OAUTH2_CLIENT_*`), optional `GARAGE_*` for uploads,
+`GITEA_API_TOKEN` for authenticated resource pulls,
+`AUTOMATION_READ_TOKEN` for the automation KV read endpoint.
 
-## Deploy
+## Release and deploy
 
-Pushing `main` triggers `.gitea/workflows/deploy.yml` on the
-bare-metal runner: release build, ship to
-`/srv/app/uhhm-portal/releases/<sha>`, flip the `current` symlink,
-restart `app@uhhm-portal`, reload Caddy. Content changes never come
-through here — they hot-reload live from the `questions` repo.
+Portal doesn't deploy itself — it publishes versions, and each site
+decides when to take one. The whole day-to-day surface is two
+commands:
+
+**Cut a release** (here):
+
+```sh
+cargo release patch        # or minor / major
+```
+
+That bumps `Cargo.toml`, tags `v<version>`, and pushes; CI
+(`.gitea/workflows/publish.yml`) reacts to the tag, builds once, and
+attaches `portal-v<version>.tar.gz` (`portal` + `question_lint` +
+`site/`) to the Gitea release. Plain pushes to `main` only run the
+tests (`test.yml`) — nothing reaches production from this repo.
+
+**Roll it out** (in a content repo): edit one line in that repo's
+`.gitea/workflows/deploy.yml` —
+
+```yaml
+env:
+  PORTAL_RELEASE: v0.1.1   # <- bump, commit, push
+```
+
+Its CI downloads the pinned artifact, ships
+`/srv/app/<instance>/releases/<tag>`, flips `current`, rewrites the
+instance env from that repo's own Actions variables/secrets, restarts
+`app@<instance>`, and refreshes the Caddy route. Every rollout is a
+commit, so reverting a bad version is `git revert` + push. Sites
+upgrade independently: uhhm.no (uhhm/questions → `app@uhhm-portal`,
+:3010) and redoal.com (redoal/questions → `app@redoal-portal`,
+:3020) can pin different versions.
+
+Content changes never come through any of this — they hot-reload
+live from the content repos over NATS.
+
+**Add a site**: new content repo with a copy of an existing
+`deploy.yml` (change `INSTANCE`, port, domains), Actions variables
+(`KANIDM_URL`, `OAUTH2_CLIENT_ID`, `PUBLIC_URL`, `SITE_NAME`) and
+secrets (`NATS_URL`, `OAUTH2_CLIENT_SECRET`,
+`PORTAL_GITEA_API_TOKEN` — Gitea reserves the `GITEA_` prefix for
+secret names), a Kanidm OAuth2 client, and DNS. `site.yaml` in the
+content repo handles all branding; no portal changes needed.

docs/design/filesystem-routes.md

@@ -0,0 +1,133 @@
+# Filesystem routes, sections, and where chains fit
+
+Status: implemented in v0.2.0 (2026-08-24) — all three phases, with
+one deviation: dynamic-page params substitute into resource keys via
+server-side `resolve_question` at lookup time (get_question,
+find_feature, submit_answer all resolve concrete paths), so no param
+threading exists client-side. The user-facing routing contract is
+documented in uhhm/questions' README ("Routing: the tree is the
+router"); this file stays as the design rationale.
+
+## What exists today, precisely
+
+- A question's `id` doubles as its URL. Filenames are meaningless:
+  `questions/` is loaded as a **flat** directory (both the Gitea
+  loader and `question_lint --path`), every `*.yaml` becomes a
+  `Question` keyed by its own declared `id`.
+- Hierarchy exists only as strings: `action: /proposed` edges, plus a
+  manual `followup: true` flag that hides post-submission pages from
+  the nav. The graph is invisible in a repo listing — you open every
+  file to learn the flow. (uhhm's actual graph: `/` fans out to three
+  followups; `/develop` → `/develop-proposal` → `/proposed` is a
+  two-step flow flattened into three top-level files.)
+- Criteria are per-file: `qualifies: <kanidm-group>` on a question,
+  `requires_group` on a resource. Gating a whole area means
+  repeating the flag in every file of that area.
+- Chains are query-string lineage: submitting hashes
+  `(question, parents, responses, ts)` into `chain_hash`, the next
+  page is `action + ?chain=<hash>`, and holding a chain is itself a
+  capability (`self_transition` + email second factor). `chain.rs`
+  reserves DAG shape (multiple parents) but nothing produces it yet.
+- `Question.route` is a declared-but-never-read field — a fossil of
+  this exact idea.
+
+## The proposal, in three phases
+
+### Phase 1 — the tree is the router
+
+Directory structure becomes the URL structure, next-js style:
+
+```
+questions/
+  index.yaml              → /
+  applied.yaml            → /applied
+  develop/
+    index.yaml            → /develop
+    proposal.yaml         → /develop/proposal
+    proposed.yaml         → /develop/proposed
+  review/
+    index.yaml            → /review
+```
+
+- `id:` becomes optional and **derived from the path** (`index.yaml`
+  names its directory). An explicit `id:` still wins so both content
+  repos keep working unchanged; lint warns when it disagrees with the
+  path, and the field can retire later along with `route`.
+- `action:` accepts **relative references**: `action: proposed`
+  resolves against the file's directory, `action: /subscribed` stays
+  absolute. Resolution happens at load time, so validation and the
+  runtime see absolute ids exactly as today. A flow directory becomes
+  self-contained: rename `develop/` and every internal edge moves
+  with it.
+- **`followup:` is inferred**: `index.yaml` files are nav pages,
+  non-index files are followups unless they say `nav: true`. This
+  matches the real content exactly (uhhm's four `followup: true`
+  files are precisely its non-index leaf pages) and deletes a flag
+  people must remember.
+- Loader: switch from the per-directory contents API to Gitea's git
+  trees API (`/git/trees/{branch}?recursive=true`) — one request for
+  the whole tree instead of one per directory, which the flat loader
+  should be using anyway.
+
+### Phase 2 — sections: criteria scoped by URL prefix
+
+A `_section.yaml` in any directory applies to everything beneath it
+(underscore = not a page, like next's private folders):
+
+```
+questions/review/_section.yaml:
+  qualifies: portal_owners
+  responsible: { name: Bendik, contact: … }
+```
+
+This is the URL/criteria interplay actually worth having: **a URL
+prefix becomes a trust boundary**. "Everything under /review is
+owner-only" is one line in one place, instead of a flag per file that
+drifts. Per-question `qualifies` still overrides (tighter or looser —
+lint should warn on looser). Sections are also the natural home for
+shared `responsible` contacts and, later, per-section branding
+accents.
+
+### Phase 3 — dynamic segments, and chains stay out of the path
+
+Two criteria axes exist: **who you are** (Kanidm group) and **what
+you've done** (holding a chain). Phase 2 scopes the first by prefix;
+phase 3 does the same for the second, plus gives records addresses:
+
+- `[record].yaml` — a dynamic segment, one YAML file rendered per
+  record: `questions/review/[record].yaml` serves `/review/<key>`,
+  with the param available to the page's `ResourceSpec.key`. Today a
+  single record is only reachable through a desk row or a
+  `?chain=` link; this gives every record a real, gated URL —
+  linkable from review desks, automations, and n8n notifications.
+- `requires_chain: <question-ref>` (page- or section-level): the page
+  only renders for a visitor whose chain tip answers the referenced
+  question. Today's followup pages are soft-hidden (out of nav) but
+  fully reachable; this makes "you must have come from X" an actual
+  criterion, declared with a relative ref like actions are.
+
+**Deliberately not proposed: encoding the chain in the path.** The
+page tree is static structure; the chain is runtime lineage and a
+bearer capability. Putting it in the path makes it look canonical and
+shareable — exactly what a capability URL shouldn't invite — and a
+DAG (the reserved multi-parent shape) doesn't linearize into a path
+anyway. `?chain=` stays a query parameter: pages keep one canonical
+URL, lineage rides along only when it's actually held.
+
+## Migration
+
+Phase 1 is fully backward compatible (explicit `id` wins, flat repos
+are just trees of depth one). The content repos migrate by `git mv`:
+uhhm's develop flow nests under `develop/`, its followups either stay
+top-level (`/applied` keeps its URL) or move with their flows if URL
+churn is acceptable; redoal's three files are already the tree. Lint
+learns the same resolution rules in the same commit, so a bad
+reference stays a caught push, never a 404.
+
+## Order of value
+
+Phase 1 is cheap and pays immediately (the repo listing becomes the
+sitemap). Phase 2 is small and unlocks gated areas properly. Phase 3
+is the real feature work — `[record]` pages change what desks and
+automations can link to — and can wait until something concrete needs
+it.

gesture.js

@@ -0,0 +1,335 @@
+// The `type: gesture` requirement widget: draw one stroke on a canvas,
+// and the stroke becomes the field's value. Mirrors the two house
+// patterns at once:
+//
+// - prosekit-editor.js's hidden-input bridge: the widget writes JSON
+//   into a paired hidden <input> and fires a real bubbling `input`
+//   event, so the Rust side reuses the exact same RwSignal/on:input
+//   wiring every other field kind uses - no bespoke value channel.
+// - yes.js's lifecycle: mountGesture returns a handle whose stop()
+//   tears everything down (socket, listeners, rAF), because SPA
+//   navigation never unloads the document.
+//
+// When a relay URL is given, the widget also speaks the redoal-relay
+// protocol (ADR-0013 in the redoal repo): announce the stroke, receive
+// an ack carrying the stroke's gesture key + the key's own decoded
+// path ("what the network heard", drawn as a ghost), and receive
+// echoes of similar strokes other visitors drew, shown as thumbnails.
+// Everything network is best-effort: no relay, refused connection, or
+// a dropped socket all degrade to a plain offline drawing input.
+//
+// Canvas colors can't come from CSS custom properties (same
+// constraint yes.js documents), so the widget carries its own copy of
+// the palette for both themes - any palette change must land here AND
+// in style/main.css.
+
+const THEMES = {
+    dark: {
+        stroke: '#8ec2c0',
+        ghost: 'rgba(255, 255, 255, 0.28)',
+        echo: '#8ec2c0',
+    },
+    light: {
+        stroke: '#47807e',
+        ghost: 'rgba(29, 29, 27, 0.30)',
+        echo: '#47807e',
+    },
+};
+
+const MIN_POINT_DISTANCE = 3; // css px between recorded points
+const MAX_ECHOES = 8;
+const RECONNECT_BASE_MS = 1000;
+const RECONNECT_MAX_MS = 30000;
+
+class GestureWidget {
+    constructor(container, hidden, relayUrl, hero) {
+        this.container = container;
+        this.hidden = hidden || null;
+        this.relayUrl = relayUrl || '';
+        this.hero = !!hero;
+        this.points = [];
+        this.ghost = null;
+        this.ambient = []; // hero mode: echoed strokes drawn in place
+        this.drawing = false;
+        this.stopped = false;
+        this.ws = null;
+        this.reconnectDelay = RECONNECT_BASE_MS;
+        this.reconnectTimer = null;
+        this.pendingAnnounce = null;
+
+        this.canvas = document.createElement('canvas');
+        this.canvas.className = 'gesture-canvas';
+        container.appendChild(this.canvas);
+        if (!this.hero) {
+            this.echoes = document.createElement('div');
+            this.echoes.className = 'gesture-echoes';
+            container.appendChild(this.echoes);
+        }
+        if (this.relayUrl) {
+            this.status = document.createElement('span');
+            this.status.className = 'gesture-status offline';
+            this.status.setAttribute('aria-label', 'relay connection');
+            container.appendChild(this.status);
+        }
+
+        this._themeQuery = window.matchMedia('(prefers-color-scheme: light)');
+        this._onTheme = () => this.render();
+        this._themeQuery.addEventListener('change', this._onTheme);
+
+        this._onResize = () => { this.sizeCanvas(); this.render(); };
+        window.addEventListener('resize', this._onResize);
+        this.sizeCanvas();
+
+        this._onDown = (e) => this.beginStroke(e);
+        this._onMove = (e) => this.extendStroke(e);
+        this._onUp = (e) => this.endStroke(e);
+        this.canvas.addEventListener('pointerdown', this._onDown);
+        this.canvas.addEventListener('pointermove', this._onMove);
+        this.canvas.addEventListener('pointerup', this._onUp);
+        this.canvas.addEventListener('pointercancel', this._onUp);
+
+        if (this.relayUrl) this.connect();
+    }
+
+    theme() {
+        return this._themeQuery.matches ? THEMES.light : THEMES.dark;
+    }
+
+    sizeCanvas() {
+        const rect = this.canvas.getBoundingClientRect();
+        const dpr = window.devicePixelRatio || 1;
+        this.canvas.width = Math.max(1, Math.round(rect.width * dpr));
+        this.canvas.height = Math.max(1, Math.round(rect.height * dpr));
+        this.ctx = this.canvas.getContext('2d');
+        this.ctx.scale(dpr, dpr);
+        this.cssWidth = rect.width;
+        this.cssHeight = rect.height;
+    }
+
+    pos(e) {
+        const rect = this.canvas.getBoundingClientRect();
+        return { x: e.clientX - rect.left, y: e.clientY - rect.top };
+    }
+
+    beginStroke(e) {
+        e.preventDefault();
+        this.canvas.setPointerCapture(e.pointerId);
+        // One stroke only - a new pointerdown replaces the old drawing
+        // (and any ghost/ambient trails from the previous round).
+        this.drawing = true;
+        this.points = [this.pos(e)];
+        this.ghost = null;
+        this.ambient = [];
+        this.render();
+    }
+
+    extendStroke(e) {
+        if (!this.drawing) return;
+        const p = this.pos(e);
+        const last = this.points[this.points.length - 1];
+        const dx = p.x - last.x, dy = p.y - last.y;
+        if (Math.sqrt(dx * dx + dy * dy) < MIN_POINT_DISTANCE) return;
+        this.points.push(p);
+        this.render();
+    }
+
+    endStroke() {
+        if (!this.drawing) return;
+        this.drawing = false;
+        if (this.points.length < 2) return;
+        const normalized = this.normalized();
+        this.setValue({ points: normalized, key: null });
+        this.announce(normalized);
+    }
+
+    // Canvas-frame normalization into the -1..1 square (the relay
+    // re-normalizes around the stroke itself before keying - this
+    // just bounds the payload and keeps the stored value
+    // resolution-independent).
+    normalized() {
+        const half = Math.max(this.cssWidth, this.cssHeight) / 2;
+        const cx = this.cssWidth / 2, cy = this.cssHeight / 2;
+        return this.points.map((p) => [
+            Math.round(((p.x - cx) / half) * 10000) / 10000,
+            Math.round(((p.y - cy) / half) * 10000) / 10000,
+        ]);
+    }
+
+    setValue(value) {
+        if (!this.hidden) return;
+        this.hidden.value = JSON.stringify(value);
+        this.hidden.dispatchEvent(new Event('input', { bubbles: true }));
+    }
+
+    // ── Relay ──────────────────────────────────────────────────────
+
+    connect() {
+        if (this.stopped) return;
+        let ws;
+        try {
+            ws = new WebSocket(this.relayUrl);
+        } catch {
+            this.scheduleReconnect();
+            return;
+        }
+        this.ws = ws;
+        ws.addEventListener('open', () => {
+            if (this.stopped) return;
+            this.reconnectDelay = RECONNECT_BASE_MS;
+            this.status?.classList.replace('offline', 'live');
+            if (this.pendingAnnounce) {
+                ws.send(JSON.stringify({ type: 'announce', points: this.pendingAnnounce }));
+                this.pendingAnnounce = null;
+            }
+        });
+        ws.addEventListener('message', (e) => this.onMessage(e));
+        ws.addEventListener('close', () => {
+            this.status?.classList.replace('live', 'offline');
+            this.ws = null;
+            this.scheduleReconnect();
+        });
+        // 'error' is always followed by 'close'; nothing to do here.
+    }
+
+    scheduleReconnect() {
+        if (this.stopped || this.reconnectTimer) return;
+        this.reconnectTimer = setTimeout(() => {
+            this.reconnectTimer = null;
+            this.connect();
+        }, this.reconnectDelay);
+        this.reconnectDelay = Math.min(this.reconnectDelay * 2, RECONNECT_MAX_MS);
+    }
+
+    announce(points) {
+        if (!this.relayUrl) return;
+        if (this.ws && this.ws.readyState === WebSocket.OPEN) {
+            this.ws.send(JSON.stringify({ type: 'announce', points }));
+        } else {
+            this.pendingAnnounce = points;
+        }
+    }
+
+    onMessage(e) {
+        let msg;
+        try {
+            msg = JSON.parse(e.data);
+        } catch {
+            return;
+        }
+        if (msg.type === 'ack') {
+            if (this.points.length >= 2) {
+                this.setValue({ points: this.normalized(), key: msg.key });
+            }
+            this.ghost = msg.path;
+            this.render();
+        } else if (msg.type === 'echo') {
+            if (this.hero) {
+                this.ambient.push(msg.path);
+                if (this.ambient.length > MAX_ECHOES) this.ambient.shift();
+                this.render();
+            } else {
+                this.addEchoThumbnail(msg);
+            }
+        }
+        // 'error' frames are intentionally silent: the widget is a
+        // form field first, and a rate-limited announce shouldn't
+        // alarm anyone mid-form.
+    }
+
+    addEchoThumbnail(msg) {
+        const thumb = document.createElement('canvas');
+        thumb.className = 'gesture-echo';
+        // Closer strokes render stronger; 500 is comfortably past the
+        // relay's default threshold, so everything stays visible.
+        const strength = Math.max(0.35, Math.min(1, 1 - msg.distance / 500));
+        thumb.style.setProperty('--echo-strength', String(strength));
+        this.echoes.prepend(thumb);
+        while (this.echoes.children.length > MAX_ECHOES) {
+            this.echoes.lastChild.remove();
+        }
+        const dpr = window.devicePixelRatio || 1;
+        const rect = thumb.getBoundingClientRect();
+        thumb.width = Math.max(1, Math.round(rect.width * dpr));
+        thumb.height = Math.max(1, Math.round(rect.height * dpr));
+        const ctx = thumb.getContext('2d');
+        ctx.scale(dpr, dpr);
+        this.drawPath(ctx, msg.path, rect.width, rect.height, this.theme().echo, 1.5, 0.15);
+        // A timeout, not requestAnimationFrame: the class must land on
+        // a later tick for the opacity transition to run, and rAF
+        // doesn't tick at all in headless engines.
+        setTimeout(() => thumb.classList.add('shown'), 30);
+    }
+
+    // ── Rendering ──────────────────────────────────────────────────
+
+    // Draw a normalized (-1..1) path fitted into w×h with padding.
+    drawPath(ctx, path, w, h, color, width, pad) {
+        if (!path || path.length < 2) return;
+        const scale = (Math.min(w, h) / 2) * (1 - pad);
+        const cx = w / 2, cy = h / 2;
+        ctx.strokeStyle = color;
+        ctx.lineWidth = width;
+        ctx.lineCap = 'round';
+        ctx.lineJoin = 'round';
+        ctx.beginPath();
+        path.forEach(([x, y], i) => {
+            const px = cx + x * scale, py = cy + y * scale;
+            if (i === 0) ctx.moveTo(px, py);
+            else ctx.lineTo(px, py);
+        });
+        ctx.stroke();
+    }
+
+    render() {
+        if (!this.ctx) return;
+        const t = this.theme();
+        this.ctx.clearRect(0, 0, this.cssWidth, this.cssHeight);
+        for (const path of this.ambient) {
+            this.ctx.globalAlpha = 0.25;
+            this.drawPath(this.ctx, path, this.cssWidth, this.cssHeight, t.echo, 1.5, 0.2);
+        }
+        this.ctx.globalAlpha = 1;
+        if (this.ghost) {
+            this.drawPath(this.ctx, this.ghost, this.cssWidth, this.cssHeight, t.ghost, 2, 0.2);
+        }
+        if (this.points.length >= 1) {
+            this.ctx.strokeStyle = t.stroke;
+            this.ctx.lineWidth = 2;
+            this.ctx.lineCap = 'round';
+            this.ctx.lineJoin = 'round';
+            this.ctx.beginPath();
+            this.points.forEach((p, i) => {
+                if (i === 0) this.ctx.moveTo(p.x, p.y);
+                else this.ctx.lineTo(p.x, p.y);
+            });
+            this.ctx.stroke();
+        }
+    }
+
+    stop() {
+        this.stopped = true;
+        if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+        if (this.ws) {
+            // The close event still fires, but scheduleReconnect
+            // no-ops once stopped is set.
+            try { this.ws.close(); } catch { /* already dead */ }
+            this.ws = null;
+        }
+        window.removeEventListener('resize', this._onResize);
+        this._themeQuery.removeEventListener('change', this._onTheme);
+        this.canvas.removeEventListener('pointerdown', this._onDown);
+        this.canvas.removeEventListener('pointermove', this._onMove);
+        this.canvas.removeEventListener('pointerup', this._onUp);
+        this.canvas.removeEventListener('pointercancel', this._onUp);
+    }
+}
+
+export function mountGesture(container, hidden, relayUrl) {
+    return new GestureWidget(container, hidden, relayUrl, false);
+}
+
+// Hero variant: no form field to mirror into, and echoes render as
+// ambient strokes on the drawing canvas itself instead of thumbnails.
+export function mountGestureHero(container, relayUrl) {
+    return new GestureWidget(container, null, relayUrl, true);
+}

src/aggregates/mod.rs

@@ -30,6 +30,12 @@ pub struct AggregateSchema {
     pub event_for_state: HashMap<String, String>,
     pub state_for_event: HashMap<String, String>,
     pub transitions: HashMap<String, Vec<String>>,
+    /// Names what consumes this bucket's answers when no page in the
+    /// content repo reads it (e.g. "n8n newsletter compose").
+    /// Free-text - it exists so `validate_questions`' attended-bucket
+    /// rule has an explicit, auditable opt-out instead of a silent
+    /// one, and so the next reader knows where the answers go.
+    pub attended_by: Option<String>,
 }
 
 impl AggregateSchema {
@@ -57,6 +63,8 @@ struct RawAggregateSchema {
     states: HashMap<String, RawState>,
     #[serde(default)]
     transitions: HashMap<String, Vec<String>>,
+    #[serde(default)]
+    attended_by: Option<String>,
 }
 
 #[derive(Debug, serde::Deserialize)]
@@ -123,6 +131,7 @@ pub fn parse_aggregates_yaml(raw: &str) -> anyhow::Result<HashMap<String, Aggreg
                 event_for_state,
                 state_for_event,
                 transitions: raw_schema.transitions,
+                attended_by: raw_schema.attended_by,
             },
         );
     }

src/app.rs

@@ -9,7 +9,7 @@ use serde::{Deserialize, Serialize};
 
 use crate::answers::{Answer, SelfTransitionAnswer, TransitionAnswers, TransitionItem};
 use crate::auth::{current_user, User};
-use crate::content::{is_qualified, Alternative, Question, Responsible, Transition};
+use crate::content::{is_qualified, Alternative, Question, Responsible, SiteConfig, Transition};
 use crate::resource::{get_requirement_binding, get_requirement_options, get_resource};
 
 /// The visible site name/wordmark - "portal" is just this codebase's
@@ -54,20 +54,61 @@ pub fn shell(options: LeptosOptions) -> impl IntoView {
 pub fn App() -> impl IntoView {
     provide_meta_context();
 
+    // ONE site resource and ONE <Title> for the whole app, both living
+    // outside the router. Two dueling Title components (a static
+    // SITE_NAME fallback here + a per-page override) turned every SPA
+    // navigation into a remount race that the compile-time fallback
+    // kept winning - redoal.com's tab flipped to "uhhm" on the first
+    // client-side nav. App never remounts, so this Title never
+    // unmounts; the Suspense makes SSR await the resolved title so the
+    // served <head> is right too. Pages read the same resource via
+    // context instead of fetching their own copy.
+    let site = Resource::new(|| (), |_| get_site());
+    provide_context(site);
+
     view! {
         <Stylesheet id="leptos" href="/pkg/portal.css"/>
-        <Title text=SITE_NAME/>
+        <Suspense fallback=|| ()>
+            {move || {
+                site.get()
+                    .map(|res| {
+                        let title = res
+                            .ok()
+                            .and_then(|s| s.title)
+                            .unwrap_or_else(|| SITE_NAME.to_string());
+                        view! { <Title text=title/> }
+                    })
+            }}
+        </Suspense>
         <Router>
-            <Routes fallback=|| view! { <NotFound/> }>
-                <Route path=path!("") view=QuestionPage/>
-                <Route path=path!("/*any") view=QuestionPage/>
-            </Routes>
+            <PortalShell/>
         </Router>
     }
 }
 
+/// Every server-fn resource the pages read, created exactly once for
+/// the app's lifetime and handed down via context. Wrapper structs
+/// because a bare `Resource<T>` context is claimed by whoever provides
+/// that T last.
+#[derive(Clone, Copy)]
+struct QuestionRes(Resource<Result<Option<Page>, ServerFnError>>);
+#[derive(Clone, Copy)]
+struct UserRes(Resource<Result<Option<User>, ServerFnError>>);
+#[derive(Clone, Copy)]
+struct NavRes(Resource<Result<Vec<(String, String)>, ServerFnError>>);
+
+/// Owns the app's data resources, above the routes and reactive on the
+/// location instead of recreated per page. Route components creating
+/// their own resources broke on the first client-side navigation: the
+/// remounted component's fresh Resource consumed a stale SSR hydration
+/// buffer instead of fetching - concretely, the nav list
+/// `[[id, name], ..]` deserialized as a `Page` (serde fills a struct
+/// from a sequence in field order), rendering the landing question
+/// gated behind its own nav entry. Stable resources + context makes
+/// that class of misalignment impossible: navigation only changes a
+/// key, and a key change always refetches.
 #[component]
-fn QuestionPage() -> impl IntoView {
+fn PortalShell() -> impl IntoView {
     let location = use_location();
     let query = use_query_map();
     let path = Memo::new(move |_| {
@@ -78,11 +119,37 @@ fn QuestionPage() -> impl IntoView {
             p
         }
     });
+    let chain = Memo::new(move |_| query.with(|q| q.get("chain")));
+
+    let question = Resource::new(
+        move || (path.get(), chain.get()),
+        |(path, chain)| get_question(path, chain),
+    );
+    let user = Resource::new(|| (), |_| current_user());
+    let nav = Resource::new(move || chain.get().is_some(), list_qualifying_questions);
+    provide_context(QuestionRes(question));
+    provide_context(UserRes(user));
+    provide_context(NavRes(nav));
+
+    view! {
+        <Routes fallback=|| view! { <NotFound/> }>
+            <Route path=path!("") view=QuestionPage/>
+            <Route path=path!("/*any") view=QuestionPage/>
+        </Routes>
+    }
+}
+
+#[component]
+fn QuestionPage() -> impl IntoView {
+    let query = use_query_map();
     let parent_hash = Memo::new(move |_| query.with(|q| q.get("chain")));
     let query_email = Memo::new(move |_| query.with(|q| q.get("email")));
 
-    let question = Resource::new(move || path.get(), get_question);
-    let user = Resource::new(|| (), |_| current_user());
+    // All shared, app-lifetime resources (see PortalShell / App) -
+    // never created per navigation.
+    let QuestionRes(question) = expect_context();
+    let UserRes(user) = expect_context();
+    let site = expect_context::<Resource<Result<SiteConfig, ServerFnError>>>();
 
     view! {
         <Suspense fallback=|| {
@@ -99,16 +166,19 @@ fn QuestionPage() -> impl IntoView {
                 // has already resolved.
                 let user_res = user.get();
                 let question_res = question.get();
+                let site_cfg = site.get().and_then(|r| r.ok()).unwrap_or_default();
                 question_res
                     .map(|res| match res {
-                        Ok(Some(q)) => {
+                        Ok(Some(page)) => {
                             let current = user_res.and_then(|r| r.ok()).flatten();
                             view! {
                                 <QuestionView
-                                    question=q
+                                    question=page.question
+                                    chain_gate=page.chain_gate
                                     parent_hash=parent_hash.get()
                                     query_email=query_email.get()
                                     user=current
+                                    site=site_cfg
                                 />
                             }
                                 .into_any()
@@ -123,12 +193,43 @@ fn QuestionPage() -> impl IntoView {
 #[component]
 fn QuestionView(
     question: Question,
+    chain_gate: Option<(String, String)>,
     parent_hash: Option<String>,
     query_email: Option<String>,
     user: Option<User>,
+    site: SiteConfig,
 ) -> impl IntoView {
     let question_id = question.id.clone();
 
+    // The provenance counterpart to the qualifies gate below: a
+    // requires_chain page whose visitor holds no verifiable lineage to
+    // the required question renders a pointer there instead of its
+    // alternatives.
+    if let Some((target, target_name)) = chain_gate {
+        let label = if target_name.is_empty() {
+            target.clone()
+        } else {
+            target_name
+        };
+        return view! {
+            <Hero
+                title=question.name.clone()
+                description=question.description.clone()
+                landing=question_id == "/"
+                site=site.clone()
+            />
+            <div class="alternatives">
+                <section class="alt-card gate-card">
+                    <p>"This page follows from an answer you don't seem to carry yet."</p>
+                    <a class="alt-submit" href=target>
+                        {label}
+                    </a>
+                </section>
+            </div>
+        }
+        .into_any();
+    }
+
     // Generic: any question with `qualifies` set renders this same gate
     // instead of its alternatives - "/review" isn't a special case, it's
     // just a question that happens to have `qualifies` set.
@@ -138,7 +239,8 @@ fn QuestionView(
             <Hero
                 title=question.name.clone()
                 description=question.description.clone()
-                show_yes=question_id == "/"
+                landing=question_id == "/"
+                site=site.clone()
             />
             <div class="alternatives">
                 <section class="alt-card gate-card">
@@ -175,7 +277,8 @@ fn QuestionView(
         <Hero
             title=question.name.clone()
             description=question.description.clone()
-            show_yes=question_id == "/"
+            landing=question_id == "/"
+            site=site.clone()
         />
         <div class="alternatives">
             <For
@@ -230,7 +333,8 @@ fn QuestionView(
 /// claiming front-page space (an owner also sees the gated desks here).
 #[component]
 fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
-    let nav = Resource::new(move || has_chain, list_qualifying_questions);
+    let _ = has_chain; // keyed into the shared resource by PortalShell
+    let NavRes(nav) = expect_context();
     view! {
         <Suspense fallback=|| ()>
             {move || {
@@ -309,7 +413,12 @@ fn ResponsibleNote(responsible: Responsible) -> impl IntoView {
 mod yes {
     use wasm_bindgen::prelude::*;
 
-    #[wasm_bindgen(module = "/yes.js")]
+    // raw_module (a runtime URL, not a bundled snippet) on purpose:
+    // the file lives in public/ so it's served at the stable /yes.js
+    // - the same URL the hero's inline early-mount script imports.
+    // A bundled snippet would sit under a per-build hashed
+    // /pkg/snippets/ path the inline script couldn't know.
+    #[wasm_bindgen(raw_module = "/yes.js")]
     extern "C" {
         #[wasm_bindgen(js_name = RasterizedYES)]
         pub type RasterizedYes;
@@ -347,16 +456,57 @@ mod prosekit {
     }
 }
 
+// The `type: gesture` drawing widget (`gesture.js`, crate root):
+// prosekit's hidden-input bridge for the value, yes.js's typed-handle
+// lifecycle for cleanup - it may own a live WebSocket to a
+// redoal-relay, which SPA navigation must close (`stop()`).
+#[cfg(feature = "hydrate")]
+mod gesture {
+    use wasm_bindgen::prelude::*;
+
+    #[wasm_bindgen(module = "/gesture.js")]
+    extern "C" {
+        pub type GestureWidget;
+
+        #[wasm_bindgen(js_name = mountGesture)]
+        pub fn mount_gesture(
+            container: &web_sys::HtmlDivElement,
+            hidden: &web_sys::HtmlInputElement,
+            relay_url: &str,
+        ) -> GestureWidget;
+
+        #[wasm_bindgen(js_name = mountGestureHero)]
+        pub fn mount_gesture_hero(
+            container: &web_sys::HtmlDivElement,
+            relay_url: &str,
+        ) -> GestureWidget;
+
+        #[wasm_bindgen(method)]
+        pub fn stop(this: &GestureWidget);
+    }
+}
+
 #[component]
-fn Hero(title: String, description: String, show_yes: bool) -> impl IntoView {
-    // Only the landing page gets the full interactive piece - it's the
-    // one page this is actually "the" hero for; other pages (thank-you
-    // pages, /review) get the plain dark header below. Starts the
-    // animation once the canvas elements exist, and explicitly stops
-    // the requestAnimationFrame loop on unmount - the original
-    // page-owning script never needed this since navigating away meant
-    // a full document unload, which doesn't happen in an SPA.
+fn Hero(title: String, description: String, landing: bool, site: SiteConfig) -> impl IntoView {
+    // Only the landing page gets a full interactive piece - it's the
+    // one page a hero is actually "the" hero for; other pages
+    // (thank-you pages, /review) get the plain dark header below.
+    // WHICH piece is the content repo's call (`site.yaml`'s
+    // hero.kind): the YES canvas (default - uhhm's look), a redoal
+    // gesture canvas, or nothing.
+    let hero_kind = if landing { site.hero.kind.clone() } else { "plain".to_string() };
+    let show_yes = hero_kind == "yes";
+    let show_gesture = hero_kind == "gesture";
+    let wordmark = site.wordmark.clone().unwrap_or_else(|| "/wordmark.svg".to_string());
+    let site_title = site.title.clone().unwrap_or_else(|| SITE_NAME.to_string());
+
+    // Starts the YES animation once the canvas elements exist, and
+    // explicitly stops the requestAnimationFrame loop on unmount - the
+    // original page-owning script never needed this since navigating
+    // away meant a full document unload, which doesn't happen in an
+    // SPA.
     let raster_ref: NodeRef<leptos::html::Canvas> = NodeRef::new();
+    let gesture_ref: NodeRef<leptos::html::Div> = NodeRef::new();
     #[cfg(feature = "hydrate")]
     if show_yes {
         // `on_cleanup` requires Send + Sync (even single-threaded, wasm),
@@ -380,7 +530,28 @@ fn Hero(title: String, description: String, show_yes: bool) -> impl IntoView {
             if raster_ref.get().is_none() {
                 return;
             }
-            instance.set_value(Some(yes::RasterizedYes::new()));
+            if instance.with_value(|i| i.is_some()) {
+                return;
+            }
+            // Adopt the hero's inline early-mount instance (started at
+            // HTML parse time, long before this wasm was even fetched)
+            // instead of starting a second animation. The flag covers
+            // the opposite ordering too: an inline script that runs
+            // after this sees it and stays inert.
+            use wasm_bindgen::JsCast;
+            let global = js_sys::global();
+            let _ = js_sys::Reflect::set(&global, &"__yesAdopted".into(), &true.into());
+            let early = js_sys::Reflect::get(&global, &"__yesEarly".into())
+                .ok()
+                .filter(|v| !v.is_undefined() && !v.is_null());
+            let inst = match early {
+                Some(v) => {
+                    let _ = js_sys::Reflect::delete_property(&global, &"__yesEarly".into());
+                    v.unchecked_into::<yes::RasterizedYes>()
+                }
+                None => yes::RasterizedYes::new(),
+            };
+            instance.set_value(Some(inst));
         });
         on_cleanup(move || {
             instance.update_value(|opt| {
@@ -391,8 +562,35 @@ fn Hero(title: String, description: String, show_yes: bool) -> impl IntoView {
         });
     }
 
+    // The gesture hero mounts the same widget the `type: gesture`
+    // requirement uses, in hero mode (no form field; echoes render as
+    // ambient strokes on the canvas itself). Same StoredValue +
+    // on_cleanup shape as the YES piece - it may own a live WebSocket.
+    #[cfg(feature = "hydrate")]
+    if show_gesture {
+        let relay = site.hero.relay.clone().unwrap_or_default();
+        let widget: StoredValue<Option<gesture::GestureWidget>, LocalStorage> =
+            StoredValue::new_local(None);
+        Effect::new(move |_| {
+            let Some(container) = gesture_ref.get() else {
+                return;
+            };
+            if widget.with_value(|w| w.is_some()) {
+                return;
+            }
+            widget.set_value(Some(gesture::mount_gesture_hero(&container, &relay)));
+        });
+        on_cleanup(move || {
+            widget.update_value(|opt| {
+                if let Some(w) = opt.take() {
+                    w.stop();
+                }
+            });
+        });
+    }
+
     view! {
-        <header class="hero" class:hero-yes=show_yes>
+        <header class="hero" class:hero-yes=show_yes class:hero-gesture=show_gesture>
             {show_yes
                 .then(|| {
                     view! {
@@ -400,11 +598,24 @@ fn Hero(title: String, description: String, show_yes: bool) -> impl IntoView {
                             <canvas id="lineCanvas"></canvas>
                             <canvas id="rasterCanvas" node_ref=raster_ref></canvas>
                         </div>
+                        // Starts the animation at HTML parse time
+                        // instead of waiting out the wasm bundle's
+                        // fetch + hydration; the hydrate Effect above
+                        // adopts (never duplicates) the instance, and
+                        // the guards make either execution order safe.
+                        <script
+                            type="module"
+                            inner_html="import('/yes.js').then((m) => { if (!window.__yesAdopted && !window.__yesEarly) window.__yesEarly = new m.RasterizedYES(); });"
+                        ></script>
                     }
                 })}
+            {show_gesture
+                .then(|| {
+                    view! { <div class="hero-draw" node_ref=gesture_ref></div> }
+                })}
             <div class="hero-copy">
                 <a class="wordmark" href="/">
-                    <img src="/wordmark.svg" alt=SITE_NAME/>
+                    <img src=wordmark alt=site_title/>
                 </a>
                 <h1>{title}</h1>
                 <p>{description}</p>
@@ -536,6 +747,10 @@ fn AlternativeCard(
     let mut select_field_map: std::collections::HashMap<String, RwSignal<Vec<String>>> =
         std::collections::HashMap::new();
     let mut select_multi: std::collections::HashMap<String, bool> = std::collections::HashMap::new();
+    // Gesture fields share field_map (their hidden input carries a
+    // JSON string), but submit re-parses them so the stored answer
+    // holds a real {points, key} object, not a double-encoded string.
+    let mut gesture_fields: std::collections::HashSet<String> = std::collections::HashSet::new();
     for feature in &alternative.features {
         for req in &feature.requirements {
             if req.kind == "file" {
@@ -546,6 +761,9 @@ fn AlternativeCard(
                     .or_insert_with(|| RwSignal::new(Vec::new()));
                 select_multi.insert(req.name.clone(), req.multiple);
             } else {
+                if req.kind == "gesture" {
+                    gesture_fields.insert(req.name.clone());
+                }
                 field_map
                     .entry(req.name.clone())
                     .or_insert_with(|| RwSignal::new(String::new()));
@@ -571,6 +789,7 @@ fn AlternativeCard(
     let file_refs_for_submit = file_refs.clone();
     let select_field_map_for_submit = select_field_map.clone();
     let select_multi_for_submit = select_multi.clone();
+    let gesture_fields_for_submit = gesture_fields.clone();
     let question_id_for_transition = question_id.clone();
     let alt_name_for_transition = alternative.name.clone();
     let on_submit = move |ev: leptos::ev::SubmitEvent| {
@@ -597,13 +816,22 @@ fn AlternativeCard(
         let file_refs_for_submit = file_refs_for_submit.clone();
         let select_field_map_for_submit = select_field_map_for_submit.clone();
         let select_multi_for_submit = select_multi_for_submit.clone();
+        let gesture_fields_for_submit = gesture_fields_for_submit.clone();
         let question_id_for_submit = question_id_for_submit.clone();
         let alt_name_for_submit = alt_name_for_submit.clone();
         let parent_hash_for_submit = parent_hash_for_submit.clone();
         leptos::task::spawn_local(async move {
             let mut map = serde_json::Map::new();
             for (name, sig) in field_map_for_submit.iter() {
-                map.insert(name.clone(), serde_json::Value::String(sig.get()));
+                let value = if gesture_fields_for_submit.contains(name) {
+                    // The widget's hidden input holds {points, key} as
+                    // JSON; store the object itself (empty/never-drawn
+                    // becomes null, not "").
+                    serde_json::from_str(&sig.get()).unwrap_or(serde_json::Value::Null)
+                } else {
+                    serde_json::Value::String(sig.get())
+                };
+                map.insert(name.clone(), value);
             }
             for (name, sig) in select_field_map_for_submit.iter() {
                 let ids = sig.get();
@@ -850,6 +1078,60 @@ fn AlternativeCard(
                                                     .into_any();
                                                 }
 
+                                                if req.kind == "gesture" {
+                                                    let container_ref: NodeRef<leptos::html::Div> = NodeRef::new();
+                                                    let hidden_ref: NodeRef<leptos::html::Input> = NodeRef::new();
+
+                                                    // A div, not a label: a label would forward
+                                                    // every click to the hidden input, and this
+                                                    // field is drawn on, not clicked into.
+                                                    #[cfg(feature = "hydrate")]
+                                                    {
+                                                        let relay = req.relay.clone().unwrap_or_default();
+                                                        // Unlike prosekit's fire-and-forget mount,
+                                                        // the widget may own a live WebSocket -
+                                                        // yes.js's StoredValue + on_cleanup pattern
+                                                        // closes it on SPA navigation.
+                                                        let widget: StoredValue<Option<gesture::GestureWidget>, LocalStorage> =
+                                                            StoredValue::new_local(None);
+                                                        Effect::new(move |_| {
+                                                            let (Some(container), Some(hidden)) =
+                                                                (container_ref.get(), hidden_ref.get())
+                                                            else {
+                                                                return;
+                                                            };
+                                                            if widget.with_value(|w| w.is_some()) {
+                                                                return;
+                                                            }
+                                                            widget.set_value(Some(gesture::mount_gesture(
+                                                                &container, &hidden, &relay,
+                                                            )));
+                                                        });
+                                                        on_cleanup(move || {
+                                                            widget.update_value(|opt| {
+                                                                if let Some(w) = opt.take() {
+                                                                    w.stop();
+                                                                }
+                                                            });
+                                                        });
+                                                    }
+
+                                                    return view! {
+                                                        <div class="field">
+                                                            {label_text}
+                                                            <input
+                                                                id=field_id
+                                                                type="hidden"
+                                                                node_ref=hidden_ref
+                                                                prop:value=move || sig.get()
+                                                                on:input=move |ev| sig.set(event_target_value(&ev))
+                                                            />
+                                                            <div class="gesture-wrap" node_ref=container_ref></div>
+                                                        </div>
+                                                    }
+                                                    .into_any();
+                                                }
+
                                                 if req.kind == "prosekit" {
                                                     let container_ref: NodeRef<leptos::html::Div> = NodeRef::new();
                                                     let hidden_ref: NodeRef<leptos::html::Input> = NodeRef::new();
@@ -1484,11 +1766,66 @@ fn NotFound() -> impl IntoView {
     }
 }
 
+/// What a URL resolves to: the question (dynamic pages arrive with
+/// their segment value already substituted, see
+/// `content::resolve_question`) plus whether a `requires_chain` gate
+/// blocked it - `(target id, target name)` so the gate can point the
+/// visitor at where the required answer comes from.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct Page {
+    pub question: Question,
+    pub chain_gate: Option<(String, String)>,
+}
+
 #[server(endpoint = "get_question")]
-pub async fn get_question(path: String) -> Result<Option<Question>, ServerFnError> {
+pub async fn get_question(
+    path: String,
+    chain: Option<String>,
+) -> Result<Option<Page>, ServerFnError> {
+    use crate::content::{path_matches, resolve_question};
     use crate::server::AppState;
     let state = expect_context::<AppState>();
-    Ok(state.questions.load().get(&path).cloned())
+    let questions = state.questions.load();
+    let Some(question) = resolve_question(&questions, &path) else {
+        return Ok(None);
+    };
+    let mut chain_gate = None;
+    if let Some(target) = &question.requires_chain {
+        // The claimed lineage must verifiably end at the required
+        // question - an unindexed or absent hash reads as unverified,
+        // and the gate stays shut. Dynamic targets match any concrete
+        // answer of theirs.
+        let verified = match &chain {
+            Some(hash) => crate::chain::lookup_node(&state.jetstream, hash)
+                .await
+                .is_some_and(|node| {
+                    node.question_id == *target
+                        || path_matches(target, &node.question_id).is_some()
+                }),
+            None => false,
+        };
+        if !verified {
+            let name = questions
+                .get(target)
+                .map(|q| q.name.clone())
+                .unwrap_or_default();
+            chain_gate = Some((target.clone(), name));
+        }
+    }
+    Ok(Some(Page {
+        question,
+        chain_gate,
+    }))
+}
+
+/// The content repo's branding (`site.yaml`) - title, wordmark, hero
+/// kind. Defaults (= the historical uhhm look) when the repo declares
+/// nothing.
+#[server(endpoint = "get_site")]
+pub async fn get_site() -> Result<SiteConfig, ServerFnError> {
+    use crate::server::AppState;
+    let state = expect_context::<AppState>();
+    Ok(state.site.load().as_ref().clone())
 }
 
 /// Every question the current visitor qualifies for, as (id, name) -
@@ -1515,7 +1852,9 @@ pub async fn list_qualifying_questions(
         .load()
         .values()
         .filter(|q| is_qualified(user.as_ref(), q))
-        .filter(|q| !q.followup || has_chain)
+        .filter(|q| !q.is_followup() || has_chain)
+        // A dynamic page has no URL of its own to link to.
+        .filter(|q| !q.is_dynamic())
         .map(|q| (q.id.clone(), q.name.clone()))
         .collect();
     out.sort();
@@ -1543,11 +1882,10 @@ pub async fn submit_answer(
     use crate::server::AppState;
 
     let state = expect_context::<AppState>();
-    let question = state
-        .questions
-        .load()
-        .get(&question_id)
-        .cloned()
+    // resolve_question, not a plain map get: a dynamic page's concrete
+    // path (what the client holds as its question id) resolves to the
+    // pattern page it came from.
+    let question = crate::content::resolve_question(&state.questions.load(), &question_id)
         .ok_or_else(|| ServerFnError::new("unknown question"))?;
 
     let session: tower_sessions::Session = leptos_axum::extract().await?;
@@ -1588,6 +1926,14 @@ pub async fn submit_answer(
     .await
     .map_err(|e| ServerFnError::new(format!("nats publish failed: {e}")))?;
 
+    // Index the node so requires_chain pages can verify lineage.
+    // Best-effort: the NATS event above is the durable record.
+    if let Err(e) =
+        crate::chain::record_node(&state.jetstream, &chain_hash, &question_id, timestamp_ms).await
+    {
+        tracing::error!("failed to index chain node: {e}");
+    }
+
     // Best-effort: a bucket-write hiccup shouldn't fail a submission the
     // NATS event has already recorded.
     if let Some(bucket) = &record_as {

src/bin/question_lint.rs

@@ -32,12 +32,15 @@ async fn main() -> anyhow::Result<()> {
         }
     }
 
-    let (questions, aggregates_map) = if let Some(dir) = path {
-        (load_from_dir(&dir)?, load_aggregates_from_dir(&dir)?)
+    let (questions, aggregates_map, site) = if let Some(dir) = path {
+        (load_from_dir(&dir)?, load_aggregates_from_dir(&dir)?, load_site_from_dir(&dir)?)
     } else if let Some(repo_url) = repo {
         let questions = content::load_questions_from_gitea(&repo_url, &branch, &subdir).await?;
         let aggregates_map = content::load_aggregates_from_gitea(&repo_url, &branch).await?;
-        (questions, aggregates_map)
+        // load_site_from_gitea already validates; a missing file is
+        // the default config, same as at portal boot.
+        let site = content::load_site_from_gitea(&repo_url, &branch).await?;
+        (questions, aggregates_map, site)
     } else {
         eprintln!(
             "usage: question-lint --repo <gitea-url> [--branch main] [--subdir questions] | --path <local-dir>"
@@ -45,6 +48,10 @@ async fn main() -> anyhow::Result<()> {
         std::process::exit(2);
     };
 
+    if let Err(e) = site.validate() {
+        eprintln!("FAIL: {e}");
+        std::process::exit(1);
+    }
     match content::validate_questions(&questions, &aggregates_map) {
         Ok(()) => {
             println!(
@@ -61,6 +68,22 @@ async fn main() -> anyhow::Result<()> {
     }
 }
 
+/// The offline counterpart to `content::load_site_from_gitea` -
+/// `site.yaml` lives at the repo root like `aggregates.yaml`, and is
+/// just as optional locally: missing means default branding.
+fn load_site_from_dir(dir: &str) -> anyhow::Result<content::SiteConfig> {
+    let site_path = std::path::Path::new(dir)
+        .parent()
+        .unwrap_or_else(|| std::path::Path::new("."))
+        .join("site.yaml");
+    if !site_path.exists() {
+        return Ok(content::SiteConfig::default());
+    }
+    let raw = std::fs::read_to_string(&site_path)
+        .map_err(|e| anyhow::anyhow!("reading {}: {e}", site_path.display()))?;
+    serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing {}: {e}", site_path.display()))
+}
+
 /// The offline counterpart to `content::load_aggregates_from_gitea` -
 /// `aggregates.yaml` lives at the repo root, one level up from the
 /// pages directory `--path` names, so `dir`'s parent is where it's
@@ -85,23 +108,38 @@ fn load_aggregates_from_dir(
 }
 
 /// The offline counterpart to `content::load_questions_from_gitea` -
-/// same "every `*.yaml` file becomes a `Question` keyed by its own
-/// `id`" shape, just reading a local checkout instead of Gitea's API,
+/// the same recursive tree walk and `content::build_questions`
+/// pipeline (derived ids, relative refs, sections, followup
+/// inference), just reading a local checkout instead of Gitea's API,
 /// for linting a branch that hasn't been pushed yet.
 fn load_from_dir(
     dir: &str,
 ) -> anyhow::Result<std::collections::HashMap<String, content::Question>> {
-    let mut out = std::collections::HashMap::new();
+    let base = std::path::Path::new(dir);
+    let mut files = Vec::new();
+    collect_yaml(base, base, &mut files)?;
+    content::build_questions(&files)
+}
+
+fn collect_yaml(
+    base: &std::path::Path,
+    dir: &std::path::Path,
+    out: &mut Vec<(String, String)>,
+) -> anyhow::Result<()> {
     for entry in std::fs::read_dir(dir)? {
-        let entry = entry?;
-        let path = entry.path();
-        if path.extension().and_then(|e| e.to_str()) != Some("yaml") {
-            continue;
+        let path = entry?.path();
+        if path.is_dir() {
+            collect_yaml(base, &path, out)?;
+        } else if path.extension().and_then(|e| e.to_str()) == Some("yaml") {
+            let rel = path
+                .strip_prefix(base)
+                .expect("walked paths sit under their base")
+                .to_string_lossy()
+                .replace('\\', "/");
+            let raw = std::fs::read_to_string(&path)
+                .map_err(|e| anyhow::anyhow!("reading {}: {e}", path.display()))?;
+            out.push((rel, raw));
         }
-        let raw = std::fs::read_to_string(&path)?;
-        let question: content::Question = serde_yaml::from_str(&raw)
-            .map_err(|e| anyhow::anyhow!("parsing {}: {e}", path.display()))?;
-        out.insert(question.id.clone(), question);
     }
-    Ok(out)
+    Ok(())
 }

src/chain.rs

@@ -9,6 +9,60 @@ use sha2::{Digest, Sha256};
 /// submitted responses, and a timestamp. Parents are sorted first so the
 /// hash doesn't depend on the order multiple parents happened to arrive
 /// in.
+/// Where submitted chain nodes are indexed - hash → which question was
+/// answered. Small on purpose (no responses), and shared by every
+/// portal instance on the JetStream (hashes are globally unique, so
+/// cross-site collisions can't happen). This is what lets
+/// `requires_chain` pages verify a visitor's `?chain=` actually ends
+/// at the question they claim to have answered.
+pub const CHAIN_BUCKET: &str = "portal_chains";
+
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct ChainNode {
+    pub question_id: String,
+    pub timestamp_ms: i64,
+}
+
+/// Indexes one submitted node. Best-effort by design (the caller logs
+/// and continues): the NATS event is the durable record, this is a
+/// lookup convenience.
+pub async fn record_node(
+    js: &async_nats::jetstream::Context,
+    chain_hash: &str,
+    question_id: &str,
+    timestamp_ms: i64,
+) -> anyhow::Result<()> {
+    let store = match js.get_key_value(CHAIN_BUCKET).await {
+        Ok(store) => store,
+        Err(_) => {
+            js.create_key_value(async_nats::jetstream::kv::Config {
+                bucket: CHAIN_BUCKET.to_string(),
+                ..Default::default()
+            })
+            .await?
+        }
+    };
+    let node = ChainNode {
+        question_id: question_id.to_string(),
+        timestamp_ms,
+    };
+    store.put(chain_hash, serde_json::to_vec(&node)?.into()).await?;
+    Ok(())
+}
+
+/// Looks a chain hash up - `None` covers both "no such node" and
+/// "bucket not created yet" (no submissions anywhere), which read the
+/// same to a `requires_chain` check: the claimed lineage can't be
+/// verified, so the gate stays shut.
+pub async fn lookup_node(
+    js: &async_nats::jetstream::Context,
+    chain_hash: &str,
+) -> Option<ChainNode> {
+    let store = js.get_key_value(CHAIN_BUCKET).await.ok()?;
+    let bytes = store.get(chain_hash).await.ok()??;
+    serde_json::from_slice(&bytes).ok()
+}
+
 pub fn hash_node(
     question_id: &str,
     parent_hashes: &[String],

src/content.rs

@@ -1,35 +1,85 @@
 use serde::{Deserialize, Serialize};
 
-/// One page: a prompt plus the paths on from it. `id` doubles as the URL
-/// path it's served at ("/" is the landing page). Loaded from a plain
-/// YAML file per question in a content directory kept in its own git
-/// repo (see ../portal-content) - editing content is a content-repo
-/// commit, not a Rust rebuild.
+/// One page: a prompt plus the paths on from it. The `questions/`
+/// directory tree IS the URL tree (`index.yaml` names its directory,
+/// `develop/proposal.yaml` serves `/develop/proposal`), so `id` is
+/// derived from the file's path - declaring it explicitly still works
+/// (and wins, with a logged warning when it disagrees) but is only
+/// needed by legacy content. Loaded from plain YAML files in a content
+/// directory kept in its own git repo - editing content is a
+/// content-repo commit, not a Rust rebuild.
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct Question {
-    pub id: String,
+    /// The URL path this page is served at. Derived from the file path
+    /// when absent. A `[name]` segment (from a `[name].yaml` file)
+    /// makes this a dynamic page: `/review/[record]` serves any
+    /// `/review/<value>`, with the value substituted into `{record}`
+    /// placeholders in the page's resource keys (see
+    /// `resolve_question`).
     #[serde(default)]
-    pub route: Option<String>,
+    pub id: String,
     pub name: String,
     #[serde(default)]
     pub description: String,
     /// Kanidm group required to view/submit this question - `None` means
-    /// open to anyone, matching every question today. Content-driven
-    /// on purpose: a gated page like "/review" is just a Question with
-    /// this set, not a bespoke Rust route.
+    /// open to anyone. Content-driven on purpose: a gated page like
+    /// "/review" is just a Question with this set, not a bespoke Rust
+    /// route. Inherited from the nearest ancestor `_section.yaml` when
+    /// not set on the question itself.
     #[serde(default)]
     pub qualifies: Option<String>,
+    /// Question id (relative refs resolve against this file's
+    /// directory) the visitor must have answered - their `?chain=`
+    /// lineage's tip - to see this page. The provenance counterpart to
+    /// `qualifies`' identity check. Inherited from `_section.yaml`
+    /// like `qualifies`.
+    #[serde(default)]
+    pub requires_chain: Option<String>,
     #[serde(default)]
     pub alternatives: Vec<Alternative>,
     /// Who to contact if a visitor gets stuck - rendered as a small line
-    /// on the page.
+    /// on the page. Inherited from `_section.yaml` when not set.
     #[serde(default)]
     pub responsible: Option<Responsible>,
     /// A page that only makes sense after answering something (the
     /// post-submission pages) - kept out of the question nav unless the
-    /// visitor's context carries an answer chain.
+    /// visitor's context carries an answer chain. Unset means inferred
+    /// from the file's place in the tree: files nested in a
+    /// subdirectory are followups unless they're the directory's
+    /// `index.yaml`; top-level files keep the historical default
+    /// (not a followup).
     #[serde(default)]
-    pub followup: bool,
+    pub followup: Option<bool>,
+}
+
+impl Question {
+    pub fn is_followup(&self) -> bool {
+        self.followup.unwrap_or(false)
+    }
+
+    /// A dynamic page - one whose id still contains a `[name]`
+    /// segment. Served per-value via `resolve_question`, never listed
+    /// in nav, never a valid `action` target.
+    pub fn is_dynamic(&self) -> bool {
+        self.id.contains('[')
+    }
+}
+
+/// Directory-scoped defaults: a `_section.yaml` file applies to every
+/// question at or below its directory (nearest ancestor wins per
+/// field, and a question's own declaration always overrides). This is
+/// what makes a URL prefix a trust boundary - "everything under
+/// /review is owner-only" is one line in `review/_section.yaml`
+/// instead of a flag per file. Underscore-prefixed files that aren't
+/// `_section.yaml` are skipped entirely (drafts).
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct SectionConfig {
+    #[serde(default)]
+    pub qualifies: Option<String>,
+    #[serde(default)]
+    pub requires_chain: Option<String>,
+    #[serde(default)]
+    pub responsible: Option<Responsible>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -163,6 +213,11 @@ pub enum ResourceSource {
     Kv { bucket: String },
     GiteaStarred { username: String },
     GiteaOrgRepos { org: String },
+    /// A repo's releases - fetched with `GITEA_API_TOKEN`, so it works
+    /// for private repos too (shape the link with jq: a private
+    /// release's html_url 404s for anonymous visitors, so map it to
+    /// null unless the repo is public).
+    GiteaReleases { owner: String, repo: String },
     /// Any other HTTPS JSON endpoint. Scheme-restricted and checked
     /// against loopback/private/link-local addresses at fetch time
     /// (`resource::fetch_url_resource`) - a server-side fetch of a
@@ -178,6 +233,7 @@ impl ResourceSpec {
             ResourceSource::Kv { bucket } => Some(bucket),
             ResourceSource::GiteaStarred { .. }
             | ResourceSource::GiteaOrgRepos { .. }
+            | ResourceSource::GiteaReleases { .. }
             | ResourceSource::Url { .. } => None,
         }
     }
@@ -231,6 +287,13 @@ pub struct Requirement {
     /// the selected file's current content.
     #[serde(default)]
     pub bind: Option<Bind>,
+    /// `type: gesture` only - ws(s):// URL of a redoal-relay instance
+    /// the drawing widget connects to for live echoes of similar
+    /// strokes. Absent means the widget works offline: the drawn path
+    /// still submits, it just never gets a network-computed key or
+    /// echoes.
+    #[serde(default)]
+    pub relay: Option<String>,
 }
 
 /// A field's live data source, parameterized by a sibling field's
@@ -265,6 +328,104 @@ impl Requirement {
     }
 }
 
+/// Site-wide branding declared by the content repo - `site.yaml` at
+/// the repo root, sibling of `aggregates.yaml`. An absent file means
+/// all defaults, which is exactly the historical uhhm look: existing
+/// deployments change nothing without a content edit. Everything the
+/// browser needs, so it travels through a server fn (`get_site`).
+#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq)]
+pub struct SiteConfig {
+    /// Browser-tab title and wordmark alt text. `None` falls back to
+    /// the compile-time `SITE_NAME`.
+    #[serde(default)]
+    pub title: Option<String>,
+    /// Wordmark image URL (absolute or a path this instance serves).
+    /// `None` falls back to `/wordmark.svg`.
+    #[serde(default)]
+    pub wordmark: Option<String>,
+    #[serde(default)]
+    pub hero: HeroConfig,
+}
+
+/// What the landing page's hero is: the YES canvas piece (`yes`, the
+/// default), a redoal gesture-drawing canvas (`gesture`), or copy
+/// only (`plain`).
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct HeroConfig {
+    #[serde(default = "default_hero_kind")]
+    pub kind: String,
+    /// `kind: gesture` only - ws(s):// URL of a redoal-relay for
+    /// ambient echoes. Absent means the hero draws offline.
+    #[serde(default)]
+    pub relay: Option<String>,
+}
+
+impl Default for HeroConfig {
+    fn default() -> Self {
+        Self { kind: default_hero_kind(), relay: None }
+    }
+}
+
+fn default_hero_kind() -> String {
+    "yes".to_string()
+}
+
+#[cfg(feature = "ssr")]
+impl SiteConfig {
+    /// Shared by `load_site_from_gitea` and the `question-lint` binary
+    /// so a typo'd hero kind is a caught rejection, not a silently
+    /// plain hero.
+    pub fn validate(&self) -> anyhow::Result<()> {
+        if !matches!(self.hero.kind.as_str(), "yes" | "gesture" | "plain") {
+            anyhow::bail!(
+                "site.yaml: hero.kind {:?} is not one of yes | gesture | plain",
+                self.hero.kind
+            );
+        }
+        if let Some(relay) = &self.hero.relay {
+            if self.hero.kind != "gesture" {
+                anyhow::bail!("site.yaml: hero.relay only makes sense with hero.kind: gesture");
+            }
+            validate_relay_url(relay).map_err(|e| anyhow::anyhow!("site.yaml: {e}"))?;
+        }
+        Ok(())
+    }
+}
+
+/// A relay must be a ws:// or wss:// URL - shared between site.yaml's
+/// hero and `Requirement.relay` validation.
+#[cfg(feature = "ssr")]
+pub fn validate_relay_url(relay: &str) -> anyhow::Result<()> {
+    let parsed = url::Url::parse(relay)
+        .map_err(|e| anyhow::anyhow!("relay {relay:?} is not a valid URL: {e}"))?;
+    if !matches!(parsed.scheme(), "ws" | "wss") {
+        anyhow::bail!("relay {relay:?} must use the ws:// or wss:// scheme");
+    }
+    Ok(())
+}
+
+/// Fetches and parses `site.yaml` from the content repo root. A fetch
+/// failure (typically 404 - the file is optional) yields the default
+/// config; a file that exists but doesn't parse or validate is a real
+/// error, surfaced at boot rather than papered over.
+#[cfg(feature = "ssr")]
+pub async fn load_site_from_gitea(repo_url: &str, branch: &str) -> anyhow::Result<SiteConfig> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+    let client = openidconnect::reqwest::Client::new();
+    let raw = match fetch_gitea_file(&client, &api_base, &owner, &repo, branch, "site.yaml").await {
+        Ok(raw) => raw,
+        Err(e) => {
+            tracing::info!("no site.yaml in content repo ({e}), using default branding");
+            return Ok(SiteConfig::default());
+        }
+    };
+    let site: SiteConfig =
+        serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing site.yaml: {e}"))?;
+    site.validate()?;
+    Ok(site)
+}
+
 /// Extracts `scheme://host` from a repo's normal browser URL - the
 /// Gitea API base every helper in this module builds requests against.
 #[cfg(feature = "ssr")]
@@ -368,6 +529,228 @@ pub async fn load_aggregates_from_gitea(
 /// startup, and again on every `CONTENT_RELOAD_SUBJECT` message (see
 /// `watch_for_reload`), over Gitea's public contents API (no auth - the
 /// content repo is public).
+/// The URL a file at `rel` (path relative to the questions dir, forward
+/// slashes) serves: `index.yaml` names its directory, everything else
+/// appends its stem.
+pub fn route_from_path(rel: &str) -> String {
+    let stem = rel.strip_suffix(".yaml").unwrap_or(rel);
+    let mut segments: Vec<&str> = stem.split('/').collect();
+    if segments.last() == Some(&"index") {
+        segments.pop();
+    }
+    if segments.is_empty() {
+        "/".to_string()
+    } else {
+        format!("/{}", segments.join("/"))
+    }
+}
+
+/// The directory (as a URL prefix) of the file at `rel` - the base
+/// relative references resolve against.
+pub fn dir_from_path(rel: &str) -> String {
+    match rel.rsplit_once('/') {
+        Some((dir, _)) => format!("/{dir}"),
+        None => "/".to_string(),
+    }
+}
+
+/// Resolves a possibly-relative question reference (`action:`,
+/// `requires_chain:`) against the referencing file's directory:
+/// `/x` is absolute, `proposed` names a sibling, `../x` climbs.
+pub fn resolve_ref(base_dir: &str, reference: &str) -> String {
+    if reference.starts_with('/') {
+        return reference.to_string();
+    }
+    let mut segments: Vec<&str> = base_dir.split('/').filter(|s| !s.is_empty()).collect();
+    for part in reference.split('/') {
+        match part {
+            "" | "." => {}
+            ".." => {
+                segments.pop();
+            }
+            s => segments.push(s),
+        }
+    }
+    if segments.is_empty() {
+        "/".to_string()
+    } else {
+        format!("/{}", segments.join("/"))
+    }
+}
+
+/// Whether `path` matches `pattern`, capturing `[name]` segments.
+/// Returns the captured (name, value) pairs on a match - empty for an
+/// exact literal match.
+pub fn path_matches(pattern: &str, path: &str) -> Option<Vec<(String, String)>> {
+    let pat: Vec<&str> = pattern.split('/').filter(|s| !s.is_empty()).collect();
+    let got: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
+    if pat.len() != got.len() {
+        return None;
+    }
+    let mut captures = Vec::new();
+    for (p, g) in pat.iter().zip(got.iter()) {
+        if let Some(name) = p.strip_prefix('[').and_then(|s| s.strip_suffix(']')) {
+            if g.is_empty() {
+                return None;
+            }
+            captures.push((name.to_string(), (*g).to_string()));
+        } else if p != g {
+            return None;
+        }
+    }
+    Some(captures)
+}
+
+/// Resolves a URL path to its question: an exact id first, else the
+/// one dynamic page whose pattern matches, with each captured segment
+/// substituted into `{name}` placeholders in the clone's resource keys
+/// and its id set to the concrete path (so every follow-up server call
+/// - resources, submissions - re-resolves the same way). The
+/// substituted key is still looked up in the content-declared bucket,
+/// so a visitor varies the key, never the bucket - the same trust
+/// shape as a `?chain=` link, where knowing a record's key is holding
+/// it.
+pub fn resolve_question(
+    questions: &std::collections::HashMap<String, Question>,
+    path: &str,
+) -> Option<Question> {
+    if let Some(q) = questions.get(path) {
+        return Some(q.clone());
+    }
+    for q in questions.values() {
+        if !q.is_dynamic() {
+            continue;
+        }
+        if let Some(captures) = path_matches(&q.id, path) {
+            let mut resolved = q.clone();
+            resolved.id = path.to_string();
+            let substitute = |key: &mut Option<String>| {
+                if let Some(k) = key {
+                    for (name, value) in &captures {
+                        *k = k.replace(&format!("{{{name}}}"), value);
+                    }
+                }
+            };
+            for alt in &mut resolved.alternatives {
+                for feature in &mut alt.features {
+                    if let Some(res) = &mut feature.resource {
+                        substitute(&mut res.key);
+                    }
+                    for req in &mut feature.requirements {
+                        if let Some(res) = &mut req.resource {
+                            substitute(&mut res.key);
+                        }
+                    }
+                }
+            }
+            return Some(resolved);
+        }
+    }
+    None
+}
+
+/// Builds the question map from raw (path, yaml) files - the shared
+/// back half of both loaders (Gitea tree and `question_lint --path`).
+/// Applies the whole filesystem-routing contract: derived ids,
+/// relative-reference resolution, followup inference, `_section.yaml`
+/// inheritance, and the tree-shape rules (no id collisions, at most
+/// one dynamic page per directory).
+#[cfg(feature = "ssr")]
+pub fn build_questions(
+    files: &[(String, String)],
+) -> anyhow::Result<std::collections::HashMap<String, Question>> {
+    // Sections first: (directory prefix, config), shallowest first so a
+    // later (deeper) section overrides an outer one field-by-field.
+    let mut sections: Vec<(String, SectionConfig)> = Vec::new();
+    for (rel, raw) in files {
+        let name = rel.rsplit('/').next().unwrap_or(rel);
+        if name != "_section.yaml" {
+            continue;
+        }
+        let mut section: SectionConfig = serde_yaml::from_str(raw)
+            .map_err(|e| anyhow::anyhow!("parsing {rel}: {e}"))?;
+        let dir = dir_from_path(rel);
+        if let Some(rc) = &section.requires_chain {
+            section.requires_chain = Some(resolve_ref(&dir, rc));
+        }
+        sections.push((dir, section));
+    }
+    sections.sort_by_key(|(dir, _)| dir.len());
+
+    let mut out = std::collections::HashMap::new();
+    let mut dynamic_dirs = std::collections::HashSet::new();
+    for (rel, raw) in files {
+        let name = rel.rsplit('/').next().unwrap_or(rel);
+        // Underscore files are sections or drafts, never pages.
+        if name.starts_with('_') {
+            continue;
+        }
+        let mut question: Question =
+            serde_yaml::from_str(raw).map_err(|e| anyhow::anyhow!("parsing {rel}: {e}"))?;
+        let derived = route_from_path(rel);
+        let dir = dir_from_path(rel);
+
+        if question.id.is_empty() {
+            question.id = derived.clone();
+        } else if question.id != derived {
+            tracing::warn!(
+                "{rel}: declared id {:?} disagrees with its path ({derived}) - the declared id wins, but consider moving the file",
+                question.id
+            );
+        }
+
+        for alt in &mut question.alternatives {
+            if let Some(action) = &alt.action {
+                alt.action = Some(resolve_ref(&dir, action));
+            }
+        }
+        if let Some(rc) = &question.requires_chain {
+            question.requires_chain = Some(resolve_ref(&dir, rc));
+        }
+
+        if question.followup.is_none() {
+            // Nested non-index files are flow steps and outcomes -
+            // followups by construction. Top-level files keep the
+            // historical flat-repo default.
+            let nested = rel.contains('/');
+            let is_index = name == "index.yaml";
+            question.followup = Some(nested && !is_index);
+        }
+
+        // Nearest-ancestor section fills whatever the question left
+        // unset (walk deepest-last, so later matches override earlier
+        // section values but never the question's own).
+        for (sdir, section) in &sections {
+            let applies = *sdir == "/" || dir == *sdir || dir.starts_with(&format!("{sdir}/"));
+            if !applies {
+                continue;
+            }
+            if question.qualifies.is_none() {
+                question.qualifies = section.qualifies.clone();
+            }
+            if question.requires_chain.is_none() {
+                question.requires_chain = section.requires_chain.clone();
+            }
+            if question.responsible.is_none() {
+                question.responsible = section.responsible.clone();
+            }
+        }
+
+        if question.is_dynamic() && !dynamic_dirs.insert(dir.clone()) {
+            anyhow::bail!(
+                "{rel}: more than one dynamic ([name].yaml) page in {dir} - matching would be ambiguous"
+            );
+        }
+        if let Some(previous) = out.insert(question.id.clone(), question) {
+            anyhow::bail!(
+                "{rel}: id {:?} is already declared by another file",
+                previous.id
+            );
+        }
+    }
+    Ok(out)
+}
+
 #[cfg(feature = "ssr")]
 pub async fn load_questions_from_gitea(
     repo_url: &str,
@@ -378,45 +761,59 @@ pub async fn load_questions_from_gitea(
     let api_base = gitea_api_base(repo_url)?;
 
     let client = openidconnect::reqwest::Client::new();
-    let list_url = format!("{api_base}/api/v1/repos/{owner}/{repo}/contents/{subdir}?ref={branch}");
+    // One recursive git-trees call for the whole repo instead of a
+    // contents listing per directory - the tree IS the router now, so
+    // nested files matter.
+    let tree_url =
+        format!("{api_base}/api/v1/repos/{owner}/{repo}/git/trees/{branch}?recursive=true");
     let listing = client
-        .get(&list_url)
+        .get(&tree_url)
         .send()
         .await
-        .map_err(|e| anyhow::anyhow!("listing {list_url}: {e}"))?
+        .map_err(|e| anyhow::anyhow!("listing {tree_url}: {e}"))?
         .error_for_status()
-        .map_err(|e| anyhow::anyhow!("listing {list_url}: {e}"))?
+        .map_err(|e| anyhow::anyhow!("listing {tree_url}: {e}"))?
         .text()
         .await
-        .map_err(|e| anyhow::anyhow!("reading directory listing from {list_url}: {e}"))?;
-    let entries: Vec<serde_json::Value> = serde_json::from_str(&listing)
-        .map_err(|e| anyhow::anyhow!("parsing directory listing from {list_url}: {e}"))?;
+        .map_err(|e| anyhow::anyhow!("reading tree from {tree_url}: {e}"))?;
+    let tree: serde_json::Value = serde_json::from_str(&listing)
+        .map_err(|e| anyhow::anyhow!("parsing tree from {tree_url}: {e}"))?;
+    if tree.get("truncated").and_then(|v| v.as_bool()) == Some(true) {
+        anyhow::bail!("git tree listing for {owner}/{repo} was truncated - repo too large");
+    }
+    let prefix = format!("{subdir}/");
 
-    let mut out = std::collections::HashMap::new();
-    for entry in entries {
-        let name = entry.get("name").and_then(|v| v.as_str()).unwrap_or("");
-        if !name.ends_with(".yaml") {
+    let mut files = Vec::new();
+    for entry in tree
+        .get("tree")
+        .and_then(|v| v.as_array())
+        .map(|v| v.as_slice())
+        .unwrap_or_default()
+    {
+        let path = entry.get("path").and_then(|v| v.as_str()).unwrap_or("");
+        if entry.get("type").and_then(|v| v.as_str()) != Some("blob")
+            || !path.starts_with(&prefix)
+            || !path.ends_with(".yaml")
+        {
             continue;
         }
-        let download_url = entry
-            .get("download_url")
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| anyhow::anyhow!("no download_url for {name}"))?;
+        // Brackets (dynamic pages like `[record].yaml`) must be
+        // percent-encoded in the raw URL's path.
+        let encoded = path.replace('[', "%5B").replace(']', "%5D");
+        let raw_url = format!("{api_base}/api/v1/repos/{owner}/{repo}/raw/{encoded}?ref={branch}");
         let raw = client
-            .get(download_url)
+            .get(&raw_url)
             .send()
             .await
-            .map_err(|e| anyhow::anyhow!("fetching {name}: {e}"))?
+            .map_err(|e| anyhow::anyhow!("fetching {path}: {e}"))?
             .error_for_status()
-            .map_err(|e| anyhow::anyhow!("fetching {name}: {e}"))?
+            .map_err(|e| anyhow::anyhow!("fetching {path}: {e}"))?
             .text()
             .await
-            .map_err(|e| anyhow::anyhow!("reading {name}: {e}"))?;
-        let question: Question =
-            serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing {name}: {e}"))?;
-        out.insert(question.id.clone(), question);
+            .map_err(|e| anyhow::anyhow!("reading {path}: {e}"))?;
+        files.push((path[prefix.len()..].to_string(), raw));
     }
-    Ok(out)
+    build_questions(&files)
 }
 
 /// Validates every declared transition target (`SelfTransition.to`,
@@ -435,15 +832,31 @@ pub fn validate_questions(
     aggregates: &std::collections::HashMap<String, crate::aggregates::AggregateSchema>,
 ) -> anyhow::Result<()> {
     for question in questions.values() {
+        if let Some(target) = &question.requires_chain {
+            if !questions.contains_key(target) {
+                anyhow::bail!(
+                    "question {:?}: requires_chain {:?} does not match any declared question id",
+                    question.id,
+                    target
+                );
+            }
+        }
         for alternative in &question.alternatives {
             // A dangling action is a literal dead end: the submit
             // button navigates to "Nothing here".
             if let Some(action) = &alternative.action {
-                if !questions.contains_key(action) {
-                    anyhow::bail!(
+                match questions.get(action) {
+                    None => anyhow::bail!(
                         "question {:?} alternative {:?}: action {:?} does not match any declared question id",
                         question.id, alternative.name, action
-                    );
+                    ),
+                    // A dynamic page needs a concrete segment value to
+                    // be a URL - a submit button can't supply one.
+                    Some(target) if target.is_dynamic() => anyhow::bail!(
+                        "question {:?} alternative {:?}: action {:?} targets a dynamic page - actions must name a concrete question",
+                        question.id, alternative.name, action
+                    ),
+                    Some(_) => {}
                 }
             }
             if let Some(st) = &alternative.self_transition {
@@ -472,6 +885,26 @@ pub fn validate_questions(
                             question.id, alternative.name, feature.name, requirement.name
                         );
                     }
+                    if let Some(relay) = &requirement.relay {
+                        if requirement.kind != "gesture" {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} declares relay but is type {:?} - relay only makes sense on type: gesture",
+                                question.id, alternative.name, feature.name, requirement.name, requirement.kind
+                            );
+                        }
+                        validate_relay_url(relay).map_err(|e| anyhow::anyhow!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?}: {e}",
+                            question.id, alternative.name, feature.name, requirement.name
+                        ))?;
+                    }
+                    if requirement.kind == "gesture"
+                        && (requirement.resource.is_some() || requirement.bind.is_some())
+                    {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: gesture - it draws its value, it can't also load one from a resource or bind",
+                            question.id, alternative.name, feature.name, requirement.name
+                        );
+                    }
                     if let Some(bind) = &requirement.bind {
                         if bind.field == requirement.name
                             || !sibling_names.contains(bind.field.as_str())
@@ -515,6 +948,54 @@ pub fn validate_questions(
             }
         }
     }
+
+    // Attended buckets: no publicly collected answer may land somewhere
+    // nothing reads. Every `record_as` bucket must either be read back
+    // by some Kv resource in this same content repo (a desk or listing)
+    // or carry an explicit `attended_by:` annotation in aggregates.yaml
+    // naming the automation that consumes it. This is a contract, not a
+    // convention, because convention already failed once: a question
+    // was dropped and its bucket - answers included - silently fell out
+    // of every reader's view.
+    let mut read_buckets = std::collections::HashSet::new();
+    let note_resource = |spec: &ResourceSpec, set: &mut std::collections::HashSet<String>| {
+        if let ResourceSource::Kv { bucket } = &spec.source {
+            set.insert(bucket.clone());
+        }
+    };
+    for question in questions.values() {
+        for alternative in &question.alternatives {
+            for feature in &alternative.features {
+                if let Some(spec) = &feature.resource {
+                    note_resource(spec, &mut read_buckets);
+                }
+                for requirement in &feature.requirements {
+                    if let Some(spec) = &requirement.resource {
+                        note_resource(spec, &mut read_buckets);
+                    }
+                    if let Some(bind) = &requirement.bind {
+                        note_resource(&bind.resource, &mut read_buckets);
+                    }
+                }
+            }
+        }
+    }
+    for question in questions.values() {
+        for alternative in &question.alternatives {
+            if let Some(bucket) = &alternative.record_as {
+                let attended = read_buckets.contains(bucket)
+                    || aggregates
+                        .get(bucket)
+                        .is_some_and(|schema| schema.attended_by.is_some());
+                if !attended {
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: record_as {bucket:?} is unattended - no page reads that bucket back, and aggregates.yaml declares no attended_by for it. Add a desk/listing resource over it, or annotate the automation that consumes it.",
+                        question.id, alternative.name
+                    );
+                }
+            }
+        }
+    }
     Ok(())
 }
 
@@ -543,6 +1024,7 @@ pub async fn watch_for_reload(
     aggregates: std::sync::Arc<
         arc_swap::ArcSwap<std::collections::HashMap<String, crate::aggregates::AggregateSchema>>,
     >,
+    site: std::sync::Arc<arc_swap::ArcSwap<SiteConfig>>,
 ) {
     let mut sub = match nats.subscribe(CONTENT_RELOAD_SUBJECT).await {
         Ok(sub) => sub,
@@ -560,6 +1042,17 @@ pub async fn watch_for_reload(
                 continue;
             }
         };
+        // Branding swaps with the same all-or-nothing rule: a
+        // present-but-broken site.yaml keeps last-good everything
+        // (load_site distinguishes "absent" - a normal default - from
+        // "present but invalid").
+        let loaded_site = match load_site_from_gitea(&repo_url, &branch).await {
+            Ok(loaded) => loaded,
+            Err(e) => {
+                tracing::error!(error = %e, "site.yaml reload failed, keeping last-good content");
+                continue;
+            }
+        };
         match load_questions_from_gitea(&repo_url, &branch, &subdir).await {
             Ok(loaded) => {
                 if let Err(e) = validate_questions(&loaded, &loaded_aggregates) {
@@ -569,6 +1062,7 @@ pub async fn watch_for_reload(
                 let count = loaded.len();
                 questions.store(std::sync::Arc::new(loaded));
                 aggregates.store(std::sync::Arc::new(loaded_aggregates));
+                site.store(std::sync::Arc::new(loaded_site));
                 tracing::info!(count, "reloaded content");
             }
             Err(e) => {
@@ -849,4 +1343,256 @@ alternatives:
         let err = validate_questions(&question_with_bind("body"), &Default::default()).unwrap_err();
         assert!(err.to_string().contains("not another requirement"));
     }
+
+    fn question_with_requirement(req_yaml: &str) -> std::collections::HashMap<String, Question> {
+        let question: Question = serde_yaml::from_str(&format!(
+            "id: /g\nname: G\nalternatives:\n  - name: A\n    features:\n      - name: \"\"\n        requirements:\n{req_yaml}\n"
+        ))
+        .unwrap();
+        std::collections::HashMap::from([(question.id.clone(), question)])
+    }
+
+    #[test]
+    fn gesture_with_wss_relay_passes() {
+        let questions = question_with_requirement(
+            "          - { name: curve, type: gesture, relay: \"wss://relay.redoal.com\", optional: true }",
+        );
+        assert!(validate_questions(&questions, &Default::default()).is_ok());
+    }
+
+    #[test]
+    fn gesture_without_relay_passes_offline() {
+        let questions =
+            question_with_requirement("          - { name: curve, type: gesture, optional: true }");
+        assert!(validate_questions(&questions, &Default::default()).is_ok());
+    }
+
+    #[test]
+    fn relay_on_non_gesture_kind_is_rejected() {
+        let questions = question_with_requirement(
+            "          - { name: email, type: email, relay: \"wss://relay.redoal.com\" }",
+        );
+        let err = validate_questions(&questions, &Default::default()).unwrap_err();
+        assert!(err.to_string().contains("relay only makes sense on type: gesture"));
+    }
+
+    #[test]
+    fn https_relay_is_rejected() {
+        let questions = question_with_requirement(
+            "          - { name: curve, type: gesture, relay: \"https://relay.redoal.com\" }",
+        );
+        let err = validate_questions(&questions, &Default::default()).unwrap_err();
+        assert!(err.to_string().contains("ws:// or wss://"));
+    }
+
+    #[test]
+    fn site_config_defaults_to_the_yes_hero() {
+        let site = SiteConfig::default();
+        assert_eq!(site.hero.kind, "yes");
+        assert!(site.validate().is_ok());
+        // And an empty file parses to the same thing.
+        let parsed: SiteConfig = serde_yaml::from_str("{}").unwrap();
+        assert_eq!(parsed, site);
+    }
+
+    #[test]
+    fn site_config_rejects_unknown_hero_kind() {
+        let site: SiteConfig = serde_yaml::from_str("hero: { kind: fireworks }").unwrap();
+        let err = site.validate().unwrap_err();
+        assert!(err.to_string().contains("fireworks"));
+    }
+
+    #[test]
+    fn site_config_rejects_relay_without_gesture_hero() {
+        let site: SiteConfig =
+            serde_yaml::from_str("hero: { kind: yes, relay: \"wss://relay.redoal.com\" }").unwrap();
+        assert!(site.validate().is_err());
+    }
+
+    #[test]
+    fn redoal_site_yaml_shape_parses() {
+        let site: SiteConfig = serde_yaml::from_str(
+            "title: redoal\nwordmark: https://project.uhhm.no/redoal/questions/raw/branch/main/wordmark.svg\nhero:\n  kind: gesture\n  relay: wss://relay.redoal.com\n",
+        )
+        .unwrap();
+        assert!(site.validate().is_ok());
+        assert_eq!(site.title.as_deref(), Some("redoal"));
+        assert_eq!(site.hero.kind, "gesture");
+    }
+
+    #[test]
+    fn routes_derive_from_paths() {
+        assert_eq!(route_from_path("index.yaml"), "/");
+        assert_eq!(route_from_path("applied.yaml"), "/applied");
+        assert_eq!(route_from_path("develop/index.yaml"), "/develop");
+        assert_eq!(route_from_path("develop/proposal.yaml"), "/develop/proposal");
+        assert_eq!(route_from_path("review/[record].yaml"), "/review/[record]");
+    }
+
+    #[test]
+    fn relative_refs_resolve_against_the_file_dir() {
+        assert_eq!(resolve_ref("/develop", "proposed"), "/develop/proposed");
+        assert_eq!(resolve_ref("/develop", "/subscribed"), "/subscribed");
+        assert_eq!(resolve_ref("/develop", "../applied"), "/applied");
+        assert_eq!(resolve_ref("/", "applied"), "/applied");
+        assert_eq!(resolve_ref("/", ".."), "/");
+    }
+
+    #[test]
+    fn dynamic_patterns_capture_segments() {
+        assert_eq!(path_matches("/review/[record]", "/review/abc"),
+            Some(vec![("record".into(), "abc".into())]));
+        assert_eq!(path_matches("/review/[record]", "/review"), None);
+        assert_eq!(path_matches("/review/[record]", "/other/abc"), None);
+        assert_eq!(path_matches("/review", "/review"), Some(vec![]));
+    }
+
+    #[test]
+    fn tree_becomes_router_with_inference_and_sections() {
+        let files = vec![
+            ("index.yaml".to_string(), "name: Home\nalternatives:\n  - name: go\n    action: applied\n".to_string()),
+            ("applied.yaml".to_string(), "name: Applied\nfollowup: true\n".to_string()),
+            ("develop/index.yaml".to_string(), "name: Develop\nalternatives:\n  - name: propose\n    action: proposal\n".to_string()),
+            ("develop/proposal.yaml".to_string(), "name: Proposal\nalternatives:\n  - name: send\n    action: proposed\n".to_string()),
+            ("develop/proposed.yaml".to_string(), "name: Proposed\n".to_string()),
+            ("review/_section.yaml".to_string(), "qualifies: portal_owners\n".to_string()),
+            ("review/index.yaml".to_string(), "name: Review\n".to_string()),
+            ("review/_draft.yaml".to_string(), "not even valid yaml: [\n".to_string()),
+        ];
+        let questions = build_questions(&files).unwrap();
+
+        // Derived ids and resolved relative actions.
+        assert_eq!(questions["/"].alternatives[0].action.as_deref(), Some("/applied"));
+        assert_eq!(
+            questions["/develop"].alternatives[0].action.as_deref(),
+            Some("/develop/proposal")
+        );
+        assert_eq!(
+            questions["/develop/proposal"].alternatives[0].action.as_deref(),
+            Some("/develop/proposed")
+        );
+
+        // Followup inference: nested non-index files are followups,
+        // index files and top-level files are not (explicit wins).
+        assert!(!questions["/"].is_followup());
+        assert!(questions["/applied"].is_followup());
+        assert!(!questions["/develop"].is_followup());
+        assert!(questions["/develop/proposal"].is_followup());
+
+        // Section inheritance gates the directory; drafts are skipped.
+        assert_eq!(questions["/review"].qualifies.as_deref(), Some("portal_owners"));
+        assert_eq!(questions["/"].qualifies, None);
+        assert!(!questions.contains_key("/review/_draft"));
+    }
+
+    #[test]
+    fn declared_id_wins_over_path() {
+        let files = vec![(
+            "legacy.yaml".to_string(),
+            "id: /somewhere-else\nname: Legacy\n".to_string(),
+        )];
+        let questions = build_questions(&files).unwrap();
+        assert!(questions.contains_key("/somewhere-else"));
+    }
+
+    #[test]
+    fn colliding_ids_and_ambiguous_dynamics_are_rejected() {
+        let collision = vec![
+            ("a.yaml".to_string(), "name: A\n".to_string()),
+            ("b.yaml".to_string(), "id: /a\nname: B\n".to_string()),
+        ];
+        assert!(build_questions(&collision).is_err());
+
+        let ambiguous = vec![
+            ("review/[a].yaml".to_string(), "name: A\n".to_string()),
+            ("review/[b].yaml".to_string(), "name: B\n".to_string()),
+        ];
+        assert!(build_questions(&ambiguous).is_err());
+    }
+
+    #[test]
+    fn dynamic_pages_resolve_with_key_substitution() {
+        let files = vec![(
+            "review/[record].yaml".to_string(),
+            "name: Record\nalternatives:\n  - name: view\n    features:\n      - name: detail\n        resource:\n          public: true\n          key: \"{record}\"\n          source:\n            kind: kv\n            bucket: applicants\n".to_string(),
+        )];
+        let questions = build_questions(&files).unwrap();
+        let page = resolve_question(&questions, "/review/abc123").unwrap();
+        assert_eq!(page.id, "/review/abc123");
+        assert_eq!(
+            page.alternatives[0].features[0].resource.as_ref().unwrap().key.as_deref(),
+            Some("abc123")
+        );
+        assert!(resolve_question(&questions, "/review").is_none());
+        // The pattern itself still resolves exactly (it IS an id).
+        assert!(resolve_question(&questions, "/review/[record]").is_some());
+    }
+
+    #[test]
+    fn requires_chain_resolves_and_validates() {
+        let files = vec![
+            ("shape.yaml".to_string(), "name: Shape\n".to_string()),
+            (
+                "shaped.yaml".to_string(),
+                "name: Shaped\nrequires_chain: shape\n".to_string(),
+            ),
+        ];
+        let questions = build_questions(&files).unwrap();
+        assert_eq!(questions["/shaped"].requires_chain.as_deref(), Some("/shape"));
+        assert!(validate_questions(&questions, &Default::default()).is_ok());
+
+        let dangling = vec![(
+            "shaped.yaml".to_string(),
+            "name: Shaped\nrequires_chain: /nowhere\n".to_string(),
+        )];
+        let questions = build_questions(&dangling).unwrap();
+        assert!(validate_questions(&questions, &Default::default()).is_err());
+    }
+
+    #[test]
+    fn recorded_buckets_must_be_attended() {
+        let write_only = vec![(
+            "index.yaml".to_string(),
+            "name: Home\nalternatives:\n  - name: send\n    record_as: black_hole\n".to_string(),
+        )];
+        let questions = build_questions(&write_only).unwrap();
+        let err = validate_questions(&questions, &Default::default()).unwrap_err();
+        assert!(err.to_string().contains("unattended"), "got: {err}");
+
+        // A desk (any Kv resource over the bucket, anywhere in the
+        // repo) attends it.
+        let with_desk = vec![
+            (
+                "index.yaml".to_string(),
+                "name: Home\nalternatives:\n  - name: send\n    record_as: inbox\n".to_string(),
+            ),
+            (
+                "review/index.yaml".to_string(),
+                "name: Desk\nalternatives:\n  - name: Inbox\n    features:\n      - name: \"\"\n        resource:\n          requires_group: owners\n          source:\n            kind: kv\n            bucket: inbox\n".to_string(),
+            ),
+        ];
+        let questions = build_questions(&with_desk).unwrap();
+        assert!(validate_questions(&questions, &Default::default()).is_ok());
+
+        // ..or an explicit attended_by annotation in aggregates.yaml.
+        let aggregates = crate::aggregates::parse_aggregates_yaml(
+            "aggregates:\n  - bucket: black_hole\n    initial: open\n    attended_by: n8n nightly digest\n    states:\n      open: { event: submitted }\n",
+        )
+        .unwrap();
+        let questions = build_questions(&write_only).unwrap();
+        assert!(validate_questions(&questions, &aggregates).is_ok());
+    }
+
+    #[test]
+    fn actions_may_not_target_dynamic_pages() {
+        let files = vec![
+            (
+                "index.yaml".to_string(),
+                "name: Home\nalternatives:\n  - name: go\n    action: /review/[record]\n".to_string(),
+            ),
+            ("review/[record].yaml".to_string(), "name: Record\n".to_string()),
+        ];
+        let questions = build_questions(&files).unwrap();
+        assert!(validate_questions(&questions, &Default::default()).is_err());
+    }
 }

src/main.rs

@@ -32,9 +32,11 @@ async fn main() -> anyhow::Result<()> {
     let aggregates = content::load_aggregates_from_gitea(&content_repo, &content_branch).await?;
     let questions = content::load_questions_from_gitea(&content_repo, &content_branch, "questions").await?;
     content::validate_questions(&questions, &aggregates)?;
+    let site = content::load_site_from_gitea(&content_repo, &content_branch).await?;
     tracing::info!(count = questions.len(), repo = %content_repo, branch = %content_branch, "loaded content");
     let questions = Arc::new(arc_swap::ArcSwap::from_pointee(questions));
     let aggregates = Arc::new(arc_swap::ArcSwap::from_pointee(aggregates));
+    let site = Arc::new(arc_swap::ArcSwap::from_pointee(site));
 
     let nats_url =
         std::env::var("NATS_URL").unwrap_or_else(|_| "nats://127.0.0.1:4222".to_string());
@@ -69,6 +71,7 @@ async fn main() -> anyhow::Result<()> {
         "questions".to_string(),
         questions.clone(),
         aggregates.clone(),
+        site.clone(),
     ));
 
     let state = AppState {
@@ -77,6 +80,7 @@ async fn main() -> anyhow::Result<()> {
         jetstream,
         questions,
         aggregates,
+        site,
         gitea_base,
         oidc: oidc_state,
         garage,
@@ -125,6 +129,10 @@ async fn main() -> anyhow::Result<()> {
     let favicon_dark_path = format!("{}/favicon-dark.svg", leptos_options.site_root);
     let wordmark_path = format!("{}/wordmark.svg", leptos_options.site_root);
     let swiper_path = format!("{}/swiper-element-bundle.min.js", leptos_options.site_root);
+    // yes.js sits in public/ (not a wasm-bindgen snippet) so the
+    // hero's inline early-mount script and the wasm binding can share
+    // one stable URL - see `mod yes` in app.rs.
+    let yes_path = format!("{}/yes.js", leptos_options.site_root);
     let fonts_dir = format!("{}/fonts", leptos_options.site_root);
 
     let app = Router::new()
@@ -135,7 +143,22 @@ async fn main() -> anyhow::Result<()> {
         .route("/upload", post(upload::upload))
         .route("/gitea-repo", get(content::gitea_repo_handler))
         .route("/automation/kv/{bucket}", get(content::automation_kv_handler))
-        .nest_service("/pkg", ServeDir::new(pkg_dir))
+        // no-cache = "revalidate before reuse", not "don't cache":
+        // pkg files keep the same names across releases (portal.js,
+        // portal.wasm), and without this browsers heuristically cache
+        // them - a stale wasm from the previous release then talks to
+        // a server whose server-fn wire format has moved on and every
+        // page renders as its error branch. A 304 per load is the
+        // price of never shipping that skew again.
+        .nest_service(
+            "/pkg",
+            tower::ServiceBuilder::new()
+                .layer(tower_http::set_header::SetResponseHeaderLayer::overriding(
+                    axum::http::header::CACHE_CONTROL,
+                    axum::http::HeaderValue::from_static("no-cache"),
+                ))
+                .service(ServeDir::new(pkg_dir)),
+        )
         .nest_service("/fonts", ServeDir::new(fonts_dir))
         .route_service("/favicon-light.svg", ServeFile::new(favicon_light_path))
         .route_service("/favicon-dark.svg", ServeFile::new(favicon_dark_path))
@@ -144,6 +167,17 @@ async fn main() -> anyhow::Result<()> {
             "/swiper-element-bundle.min.js",
             ServeFile::new(swiper_path),
         )
+        // Same skew concern as /pkg: the wasm's raw_module import and
+        // the hero's inline script both load this by fixed name.
+        .route_service(
+            "/yes.js",
+            tower::ServiceBuilder::new()
+                .layer(tower_http::set_header::SetResponseHeaderLayer::overriding(
+                    axum::http::header::CACHE_CONTROL,
+                    axum::http::HeaderValue::from_static("no-cache"),
+                ))
+                .service(ServeFile::new(yes_path)),
+        )
         .leptos_routes_with_context(
             &state,
             routes,

src/resource.rs

@@ -122,11 +122,12 @@ fn find_feature(
     alternative: &str,
     feature_name: &str,
 ) -> Result<crate::content::Feature, ServerFnError> {
-    let question = state
-        .questions
-        .load()
-        .get(question_id)
-        .cloned()
+    // resolve_question, not a plain map get: a dynamic page's client
+    // holds its concrete path as the question id, and resolution is
+    // also what substitutes the URL segment into the page's resource
+    // keys - so this lookup is where a `/review/<record>` page's
+    // feature acquires its record-specific key.
+    let question = crate::content::resolve_question(&state.questions.load(), question_id)
         .ok_or_else(|| ServerFnError::new("unknown question"))?;
     question
         .alternatives
@@ -220,6 +221,10 @@ async fn fetch_resource_value(
         ResourceSource::GiteaOrgRepos { org } => {
             fetch_gitea_json(state, &format!("/api/v1/orgs/{org}/repos"), params).await?
         }
+        ResourceSource::GiteaReleases { owner, repo } => {
+            fetch_gitea_json(state, &format!("/api/v1/repos/{owner}/{repo}/releases"), params)
+                .await?
+        }
         ResourceSource::Url { url } => fetch_url_json(url, params).await?,
     };
 
@@ -500,6 +505,45 @@ mod tests {
         assert!(items[0].get("private").is_none());
     }
 
+    /// Gitea-1.27-shaped release fixtures through the filter
+    /// redoal/questions' "Our Composition" feature declares. While the
+    /// repo is private the filter pins `url: null` - a private
+    /// release's html_url 404s for anonymous visitors, so the card
+    /// must render an unlinked heading instead.
+    #[test]
+    fn jq_shapes_gitea_release_list_for_redoal() {
+        let input = serde_json::json!([
+            {
+                "name": "varde bring-up",
+                "tag_name": "v0.3.0",
+                "body": "Embedded varde-core on iOS.",
+                "published_at": "2026-08-16T09:00:00Z",
+                "html_url": "https://project.uhhm.no/redoal/redoal/releases/tag/v0.3.0",
+                "draft": false,
+                "prerelease": true
+            },
+            {
+                "name": "first echo",
+                "tag_name": "v0.1.0",
+                "body": "Gesture keys round-trip.",
+                "published_at": "2026-05-01T09:00:00Z",
+                "html_url": "https://project.uhhm.no/redoal/redoal/releases/tag/v0.1.0",
+                "draft": false,
+                "prerelease": false
+            }
+        ]);
+        let filter = ".[] | {name: .name, description: .body, tag: .tag_name, published: .published_at, url: null}";
+
+        let shaped = apply_jq(filter, &input).expect("filter runs");
+        let items = shaped.as_array().expect("array output");
+        assert_eq!(items.len(), 2);
+        assert_eq!(items[0]["name"], "varde bring-up");
+        assert_eq!(items[0]["tag"], "v0.3.0");
+        assert_eq!(items[0]["description"], "Embedded varde-core on iOS.");
+        assert_eq!(items[0]["url"], serde_json::Value::Null, "no public link while private");
+        assert!(items[0].get("html_url").is_none());
+    }
+
     #[test]
     fn is_public_ip_rejects_loopback_and_private() {
         let loopback: std::net::IpAddr = "127.0.0.1".parse().unwrap();

src/server/mod.rs

@@ -28,6 +28,11 @@ pub struct AppState {
     /// with no entry here isn't event-sourced - plain KV mutate-in-place
     /// still works (see `answers.rs`).
     pub aggregates: Arc<ArcSwap<HashMap<String, crate::aggregates::AggregateSchema>>>,
+    /// Site branding from the content repo's optional `site.yaml`
+    /// (title, wordmark, hero kind) - hot-swapped with `questions`/
+    /// `aggregates` on the same reload. Default = the historical uhhm
+    /// look.
+    pub site: Arc<ArcSwap<crate::content::SiteConfig>>,
     /// `scheme://host` of the Gitea instance content is loaded from
     /// (see `content::gitea_api_base`) - kept alongside `questions`
     /// rather than re-derived per call, since `resolve_gitea_repo` needs

style/main.css

@@ -262,6 +262,36 @@ main.not-found {
   text-shadow: 0 0.12em 1.4em var(--hero-glow);
 }
 
+/* The gesture hero (site.yaml hero.kind: gesture - redoal.com's
+   landing): a tall drawing surface where the visitor's stroke and
+   ambient echoes from the relay share the stage. Not sticky like the
+   YES piece - drawing and scrolling fight over the same finger. */
+.hero-gesture .hero-draw {
+  position: relative;
+  width: 100%;
+  max-width: 46rem;
+  /* Same jump-avoidance as .gesture-wrap: the canvas (55svh tall)
+     only exists after hydration, so hold its height open from the
+     first paint. Plain-vh fallback first, like the canvas itself. */
+  min-height: 55vh;
+  min-height: 55svh;
+}
+
+.hero-gesture .gesture-canvas {
+  aspect-ratio: auto;
+  /* Plain-vh fallback first, same reasoning as .hero-yes's height. */
+  height: 55vh;
+  height: 55svh;
+  border: none;
+  background: transparent;
+}
+
+.hero-gesture .gesture-status {
+  top: auto;
+  bottom: 0.55rem;
+  right: 0.55rem;
+}
+
 /* alternatives */
 
 /* position + z-index on these three: everything that scrolls over the
@@ -529,6 +559,73 @@ textarea:focus {
   overflow: hidden;
 }
 
+/* The gesture drawing field (gesture.js). Stroke/ghost/echo colors
+   live in the JS module's own palette table - canvas can't read these
+   custom properties - so palette changes go there AND here. */
+.gesture-wrap {
+  position: relative;
+  /* The canvas is created by JS only after wasm hydration - reserve
+     its 3/2 box now so content below doesn't jump when it appears.
+     aspect-ratio is a preferred size, so the box still grows when the
+     echo thumbnail strip shows up under the canvas. */
+  aspect-ratio: 3 / 2;
+}
+
+.gesture-canvas {
+  display: block;
+  width: 100%;
+  aspect-ratio: 3 / 2;
+  background: var(--paper);
+  border: 0.06rem solid var(--line);
+  border-radius: 0.6rem;
+  cursor: crosshair;
+  /* Load-bearing on touch: without it the browser pans instead of
+     letting the stroke happen. */
+  touch-action: none;
+}
+
+.gesture-echoes {
+  display: flex;
+  gap: 0.5rem;
+  margin-top: 0.5rem;
+  min-height: 3rem;
+}
+
+.gesture-echoes:empty {
+  display: none;
+}
+
+.gesture-echo {
+  width: 3rem;
+  height: 3rem;
+  background: var(--paper);
+  border: 0.06rem solid var(--line);
+  border-radius: 0.4rem;
+  opacity: 0;
+  transition: opacity 0.5s ease;
+}
+
+.gesture-echo.shown {
+  opacity: var(--echo-strength, 1);
+}
+
+.gesture-status {
+  position: absolute;
+  top: 0.55rem;
+  right: 0.55rem;
+  width: 0.45rem;
+  height: 0.45rem;
+  border-radius: 50%;
+  background: var(--ink-dim);
+  opacity: 0.35;
+  transition: opacity 0.3s ease, background 0.3s ease;
+}
+
+.gesture-status.live {
+  background: var(--accent);
+  opacity: 0.9;
+}
+
 .prosekit-toolbar {
   display: flex;
   gap: 0.2rem;