A bio is markdown, on stricter rules than the site's own

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

CHANGELOG.md

@@ -6,6 +6,18 @@ content repos pin the tag they run (see the end of this file).
 
 ## Unreleased
 
+- What a person wrote on a card (a bio) is shown as markdown: paragraphs, line breaks as typed, lists, emphasis, and links to https, mailto or tel marked `rel="nofollow ugc"`. No images and no raw HTML, which is stricter than the site's own descriptions. The desk still shows the text as written.
+
+## 0.6.8 (2026-09-30)
+
+- An upload that did not arrive says why: larger than 20 MB (checked in the browser before anything is sent), a site that takes no files (no Garage configured), not allowed from here, or anything else. It used to say "try again, or with a smaller file" whatever the reason, which sent people looking for a smaller file when the site had no storage at all.
+
+## 0.6.7 (2026-09-30)
+
+- `leaves_after: { minutes: 10 }` on a state: a record that has been there that long leaves its bucket's lists (days, hours and minutes add up; swept every minute; the event log keeps it). Trainer: `leaves_after` per stage on a need. A Klingenberg Bygg card taken off the front page leaves the office's list ten minutes later instead of standing there greyed out.
+
+## 0.6.6 (2026-09-30)
+
 - `one_per_person: true` on an alternative: each signed-in person keeps one record there, their own. The form opens filled in with it, a file left unchosen keeps the one already there (shown beside the picker), and sending again replaces the card instead of adding one. Two sends at once settle on the newest. Trainer: `one_per_person` on a need entered from inside; Klingenberg Bygg's people each edit their own card on the front page.
 - Send is disabled from the moment it is pressed. Files upload before the form is sent, and a second press in that time used to send it twice.
 - A failed upload stops the send and says so. The form used to go without the file, which made a record that looked complete and was not.

Cargo.lock

@@ -3357,7 +3357,7 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.6.5"
+version = "0.6.8"
 dependencies = [
  "anyhow",
  "arc-swap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.6.5"
+version = "0.6.8"
 edition = "2021"
 
 [lib]

docs/content-reference.md

@@ -275,7 +275,10 @@ time. The cards appear in the order the records were put up. That is
 how a site shows the people who work there, or a gallery of what it
 has built. On a desk, the same picture is a thumbnail that opens.
 `accept: image/jpeg,image/png,image/webp` on the field makes a phone
-send a JPEG whatever it keeps its photos as.
+send a JPEG whatever it keeps its photos as. What the person wrote is shown as
+markdown on stricter rules than the site's own: paragraphs, line
+breaks as typed, lists, emphasis and links to https, mailto or tel
+(marked `nofollow ugc`); no images, no raw HTML.
 
 `states` and `where` narrow a listing. They matter most for a register
 that is public by law — public about what was decided, not about what

docs/state-machines.md

@@ -116,6 +116,22 @@ the same transition path, fires the same mail, and lands on
 The unit is days and the sweep is hourly. This is a deadline, not a
 job queue.
 
+### leaves_after
+
+```yaml
+      taken_down:
+        event: taken_down
+        leaves_after: { minutes: 10 }
+```
+
+How long a record stays in its bucket's lists once it has entered the
+state, when that is not for ever. A card taken off the front page
+leaves the desk's list ten minutes later instead of standing there
+greyed out, and the ten minutes are the time to see what was just
+done. Days, hours and minutes add up, and a sweep takes records out
+once a minute. Nothing is decided and no mail goes. The record leaves
+the lists, and the event log keeps it.
+
 ## attended_by
 
 ```yaml

plans/klingenbergbygg.yaml

@@ -152,6 +152,8 @@ needs:
     wants: at den som vurderer oss ser hvem som gjør jobben
     enters_as: kontor
     one_per_person: true
+    # Et kort som er tatt ned, forsvinner fra kontorets liste etter ti minutter.
+    leaves_after: { sluttet: { minutes: 10 } }
     lands_in: ansatte
     handled_by: kontor
     watched_by: [public]

plans/words/klingenbergbygg.json

@@ -507,7 +507,7 @@
     "hints": {
       "name": "",
       "rolle": "For eksempel daglig leder, rådgivende ingeniør",
-      "erfaring": "Utdanning, fagområder, år i faget, bygg du er stolt av",
+      "erfaring": "Utdanning, fagområder, bygg du er stolt av. Du kan skrive **fet**, *kursiv*, lister med - og [lenker](https://…).",
       "portrett": "Et stående bilde, gjerne tatt i dagslys. Velger du ikke noe nytt, beholder du det du har."
     },
     "question": "Ditt kort på forsiden",

src/aggregates/mod.rs

@@ -51,6 +51,35 @@ pub struct AggregateSchema {
     /// no answer in six weeks has to go on without one, and nothing in
     /// a building is going to press that button.
     pub after_for_state: HashMap<String, AfterSpec>,
+    /// How long a record stays in the list once it has entered a
+    /// state, when that is not for ever: a card taken off the front
+    /// page leaves the desk's list a little later, instead of standing
+    /// there greyed out. The event log keeps it.
+    pub leaves_for_state: HashMap<String, LeavesSpec>,
+}
+
+/// `leaves_after: { minutes: 10 }` on a state: how long a record that
+/// has entered it stays in its bucket's list. Days, hours and minutes
+/// add up; the sweep that takes it out runs every minute.
+#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct LeavesSpec {
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub days: u32,
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub hours: u32,
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub minutes: u32,
+}
+
+fn is_zero(n: &u32) -> bool {
+    *n == 0
+}
+
+impl LeavesSpec {
+    pub fn millis(&self) -> i64 {
+        ((i64::from(self.days) * 24 + i64::from(self.hours)) * 60 + i64::from(self.minutes)) * 60 * 1000
+    }
 }
 
 /// A mail to send when a record enters a state. `to` is `submitter`
@@ -125,6 +154,8 @@ struct RawState {
     grants: Option<String>,
     #[serde(default)]
     after: Option<AfterSpec>,
+    #[serde(default)]
+    leaves_after: Option<LeavesSpec>,
 }
 
 #[derive(Debug, serde::Deserialize)]
@@ -197,7 +228,14 @@ pub fn parse_aggregates_yaml(raw: &str) -> anyhow::Result<HashMap<String, Aggreg
         let mut mail_for_state = HashMap::new();
         let mut grants_for_state = HashMap::new();
         let mut after_for_state = HashMap::new();
+        let mut leaves_for_state = HashMap::new();
         for (state, raw_state) in raw_schema.states {
+            if let Some(leaves) = raw_state.leaves_after {
+                if leaves.millis() == 0 {
+                    anyhow::bail!("aggregates.yaml: bucket {bucket:?}: state {state:?}: leaves_after needs some days, hours or minutes");
+                }
+                leaves_for_state.insert(state.clone(), leaves);
+            }
             if let Some(group) = raw_state.grants {
                 if group.trim().is_empty() {
                     anyhow::bail!("aggregates.yaml: bucket {bucket:?}: state {state:?}: grants needs a group");
@@ -245,6 +283,7 @@ pub fn parse_aggregates_yaml(raw: &str) -> anyhow::Result<HashMap<String, Aggreg
                 mail_for_state,
                 grants_for_state,
                 after_for_state,
+                leaves_for_state,
             },
         );
     }

src/app.rs

@@ -1310,6 +1310,12 @@ fn AlternativeCard(
                 };
                 let Some(files) = input.files() else { continue };
                 let Some(file) = files.get(0) else { continue };
+                // Too big is known before a byte is sent.
+                if file.size() > MAX_UPLOAD_BYTES as f64 {
+                    send_error.set(Some(t(&lang().get_untracked(), "upload_too_large").to_string()));
+                    sending.set(false);
+                    return;
+                }
                 match upload_file(&file, &question_id_for_submit, &alt_name_for_submit).await {
                     Ok(key) => {
                         map.insert(name.clone(), serde_json::Value::String(key));
@@ -1319,7 +1325,8 @@ fn AlternativeCard(
                     // say so.
                     Err(e) => {
                         leptos::logging::error!("upload of {name} failed: {e:?}");
-                        send_error.set(Some(t(&lang().get_untracked(), "upload_failed").to_string()));
+                        let status = e.as_string().and_then(|m| m.rsplit(' ').next().and_then(|n| n.parse().ok()));
+                        send_error.set(Some(t(&lang().get_untracked(), upload_refusal(status)).to_string()));
                         sending.set(false);
                         return;
                     }
@@ -2283,6 +2290,24 @@ pub fn uploaded_filename(value: &str) -> Option<&str> {
     rest.strip_prefix('-').filter(|name| shaped && !name.is_empty())
 }
 
+/// The largest file one upload may carry. Here, not in `upload.rs`,
+/// so the browser checks the same number before it sends anything.
+pub const MAX_UPLOAD_BYTES: usize = 20 * 1024 * 1024;
+
+/// Why an upload did not arrive, in words a person can act on, from
+/// the status `POST /upload` answered with (see `upload.rs`): too big,
+/// a site that takes no files, a page they may not send from, or
+/// anything else.
+#[cfg_attr(not(feature = "hydrate"), allow(dead_code))]
+fn upload_refusal(status: Option<u16>) -> &'static str {
+    match status {
+        Some(413) => "upload_too_large",
+        Some(503) => "upload_unavailable",
+        Some(403) => "upload_forbidden",
+        _ => "upload_failed",
+    }
+}
+
 /// What a refused server call says, without the wrapping a person
 /// has no use for.
 fn server_message(e: &ServerFnError) -> String {
@@ -2528,7 +2553,12 @@ fn AnswerCard(answer: Answer, picture: String, link: Option<RowLink>) -> impl In
             <img class="answer-picture" src=picture alt=heading.clone() loading="lazy" />
             <div class="answer-card-text">
                 <h4 class="answer-card-heading">{heading}</h4>
-                {rest.into_iter().map(|t| view! { <p>{t}</p> }).collect_view()}
+                // What the person wrote, as they wrote it: markdown, on
+                // the stricter rules for text that is not the site's.
+                {rest
+                    .into_iter()
+                    .map(|t| view! { <div class="card-field" inner_html=crate::content::render_written_markdown(&t)></div> })
+                    .collect_view()}
             </div>
             {link.map(|(href, label)| view! { <a class="answer-link" href=href>{label}</a> })}
         </article>
@@ -3241,6 +3271,21 @@ mod responsible_tests {
 mod picture_tests {
     use super::*;
 
+    #[test]
+    fn an_upload_refusal_says_which_it_was() {
+        assert_eq!(upload_refusal(Some(413)), "upload_too_large");
+        assert_eq!(upload_refusal(Some(503)), "upload_unavailable");
+        assert_eq!(upload_refusal(Some(403)), "upload_forbidden");
+        assert_eq!(upload_refusal(Some(502)), "upload_failed");
+        assert_eq!(upload_refusal(None), "upload_failed");
+        for lang in ["en", "no"] {
+            for status in [Some(413), Some(503), Some(403), None] {
+                let key = upload_refusal(status);
+                assert_ne!(crate::i18n::t(lang, key), key, "{lang} has words for {key}");
+            }
+        }
+    }
+
     #[test]
     fn a_record_with_a_picture_is_shown_by_it() {
         assert!(is_picture("Portrett.JPG") && is_picture("a.webp") && !is_picture("rapport.pdf"));

src/content/markdown.rs

@@ -118,3 +118,67 @@ pub(crate) fn rewrite_img_tag(tag: &str) -> String {
     cleaned.replacen("<img", &format!("<img{attrs}"), 1)
 }
 
+
+/// Markdown that a person wrote into a record - a bio on a card - as
+/// opposed to the site's own content. Paragraphs, line breaks as they
+/// were typed, lists, emphasis and links; no images (a picture has its
+/// own field, and an image in text is a way to load something from
+/// elsewhere into every visitor's page), no raw HTML, headings as plain
+/// paragraphs. Links go to https, mailto or tel only, and say they are
+/// the writer's, not the site's (`rel="nofollow ugc"`).
+pub fn render_written_markdown(text: &str) -> String {
+    use pulldown_cmark::{html, Event, Options, Parser, Tag, TagEnd};
+    let parser = Parser::new_ext(text, Options::ENABLE_STRIKETHROUGH);
+    let mut in_dropped_link = 0usize;
+    let mut in_image = 0usize;
+    let filtered = parser.filter_map(|event| match event {
+        Event::Html(_) | Event::InlineHtml(_) => None,
+        Event::Start(Tag::Image { .. }) => {
+            in_image += 1;
+            None
+        }
+        Event::End(TagEnd::Image) => {
+            in_image = in_image.saturating_sub(1);
+            None
+        }
+        _ if in_image > 0 => None,
+        Event::Start(Tag::Heading { .. }) => Some(Event::Start(Tag::Paragraph)),
+        Event::End(TagEnd::Heading(_)) => Some(Event::End(TagEnd::Paragraph)),
+        // What someone typed on a new line is on a new line.
+        Event::SoftBreak => Some(Event::HardBreak),
+        Event::Start(Tag::Link { dest_url, .. })
+            if !(dest_url.starts_with("https://") || dest_url.starts_with("mailto:") || dest_url.starts_with("tel:")) =>
+        {
+            in_dropped_link += 1;
+            None
+        }
+        Event::End(TagEnd::Link) if in_dropped_link > 0 => {
+            in_dropped_link -= 1;
+            None
+        }
+        other => Some(other),
+    });
+    let mut out = String::new();
+    html::push_html(&mut out, filtered);
+    out.trim().replace("<a href=", "<a rel=\"nofollow ugc\" href=")
+}
+
+#[cfg(test)]
+mod written_tests {
+    use super::render_written_markdown as md;
+
+    #[test]
+    fn a_bio_keeps_what_a_person_would_write_and_nothing_that_reaches_out() {
+        assert_eq!(md("Line one\nline two"), "<p>Line one<br />\nline two</p>");
+        assert!(md("- NS 3424\n- NS 3423").contains("<ul>\n<li>NS 3424</li>"));
+        assert!(md("**Sivilingeniør**, *NTNU*").contains("<strong>Sivilingeniør</strong>, <em>NTNU</em>"));
+        assert_eq!(md("[Westra](https://westra.no)"), "<p><a rel=\"nofollow ugc\" href=\"https://westra.no\">Westra</a></p>");
+        // Everything that would put something else in the page is gone.
+        assert_eq!(md("<script>alert(1)</script>"), "");
+        assert_eq!(md("hi <img src=x onerror=alert(1)>"), "<p>hi </p>");
+        assert_eq!(md("[click](javascript:alert(1))"), "<p>click</p>");
+        assert_eq!(md("[home](/kontor)"), "<p>home</p>", "a site path is the site's to link, not a bio's");
+        assert_eq!(md("before ![pixel](https://tracker.example/p.gif) after"), "<p>before  after</p>");
+        assert_eq!(md("# Shouting"), "<p>Shouting</p>");
+    }
+}

src/deadlines.rs

@@ -37,6 +37,55 @@ pub async fn run(state: AppState) {
     }
 }
 
+/// Records leaving their list: once a record has been in a state with
+/// `leaves_after` for that long, it is taken out of the bucket. Not a
+/// move - nothing is decided, no mail goes - and the event log keeps
+/// the record. Every minute, over the buckets that use it and no
+/// others.
+pub async fn run_leaving(state: AppState) {
+    let mut tick = tokio::time::interval(std::time::Duration::from_secs(60));
+    loop {
+        tick.tick().await;
+        if let Err(e) = sweep_leaving(&state).await {
+            tracing::warn!(error = %e, "leaving sweep failed");
+        }
+    }
+}
+
+/// Whether a record has stayed out its time in the state it is in.
+pub fn has_left(schema: &crate::aggregates::AggregateSchema, answer: &Answer, now_ms: i64) -> bool {
+    schema
+        .leaves_for_state
+        .get(&answer.state)
+        .is_some_and(|leaves| now_ms >= waiting_since(answer) + leaves.millis())
+}
+
+pub async fn sweep_leaving(state: &AppState) -> anyhow::Result<()> {
+    let now_ms = chrono::Utc::now().timestamp_millis();
+    let aggregates = state.aggregates.load();
+    for schema in aggregates.values().filter(|s| !s.leaves_for_state.is_empty()) {
+        let Ok(store) = state.jetstream.get_key_value(&schema.bucket).await else { continue };
+        let keys: Vec<String> = {
+            use futures::TryStreamExt;
+            match store.keys().await {
+                Ok(keys) => keys.try_collect().await.unwrap_or_default(),
+                Err(_) => continue,
+            }
+        };
+        for id in keys {
+            let Ok(Some(bytes)) = store.get(&id).await else { continue };
+            let Ok(answer) = serde_json::from_slice::<Answer>(&bytes) else { continue };
+            if has_left(schema, &answer, now_ms) {
+                match store.delete(&id).await {
+                    Ok(()) => tracing::info!(bucket = %schema.bucket, id, state = %answer.state, "a record left its list"),
+                    Err(e) => tracing::warn!(bucket = %schema.bucket, id, "a record could not leave its list: {e}"),
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
 /// When a record entered the state it is in now. A record nobody has
 /// moved has been waiting since it was sent.
 fn waiting_since(answer: &Answer) -> i64 {
@@ -150,6 +199,21 @@ aggregates:
         }
     }
 
+    #[test]
+    fn a_record_leaves_its_list_when_its_time_in_the_state_is_up() {
+        let s = schema(
+            "aggregates:\n  - bucket: people\n    initial: open\n    states:\n      open: { event: shown }\n      gone: { event: gone, leaves_after: { minutes: 10 } }\n    transitions:\n      open: [gone]\n",
+        );
+        let t = 1_000_000_000_000;
+        let mut answer = waiting("gone", t - 60 * 60 * 1000);
+        answer.decided_ms = Some(t);
+        assert!(!has_left(&s, &answer, t + 9 * 60 * 1000), "measured from entering the state, not from sending");
+        assert!(has_left(&s, &answer, t + 10 * 60 * 1000));
+        // A state without it keeps its records.
+        assert!(!has_left(&s, &waiting("open", 0), t));
+        assert!(crate::aggregates::parse_aggregates_yaml("aggregates:\n  - bucket: p\n    initial: open\n    states:\n      open: { event: o, leaves_after: {} }\n    transitions: {}\n").is_err());
+    }
+
     #[test]
     fn a_deadline_comes_due_the_day_it_says_and_not_before() {
         let s = schema(HEARINGS);

src/i18n.rs

@@ -24,7 +24,10 @@ fn lookup(lang: &str, key: &str) -> Option<&'static str> {
         ("en", "sign_in") => "Sign in",
         ("en", "sign_out") => "Sign out",
         ("en", "nothing_here_yet") => "Nothing here yet.",
-        ("en", "upload_failed") => "The file could not be sent, so nothing was. Try again, or with a smaller file.",
+        ("en", "upload_failed") => "The file did not arrive, so nothing was sent. Try again.",
+        ("en", "upload_too_large") => "The file is larger than 20 MB, so nothing was sent. Choose a smaller one, or a picture taken at a lower resolution.",
+        ("en", "upload_unavailable") => "This site cannot take files at the moment, so nothing was sent. Let whoever runs the site know.",
+        ("en", "upload_forbidden") => "Files cannot be sent from here by you, so nothing was sent. Are you signed in?",
         ("en", "current_file") => "Now:",
         ("en", "keep_file") => "Choose a new one to replace it, or leave it as it is.",
         ("en", "nothing_here") => "Nothing here",
@@ -57,7 +60,10 @@ fn lookup(lang: &str, key: &str) -> Option<&'static str> {
         ("no", "sign_in") => "Logg inn",
         ("no", "sign_out") => "Logg ut",
         ("no", "nothing_here_yet") => "Ingenting her ennå.",
-        ("no", "upload_failed") => "Filen kom ikke fram, så ingenting ble sendt. Prøv igjen, eller med en mindre fil.",
+        ("no", "upload_failed") => "Filen kom ikke fram, så ingenting ble sendt. Prøv igjen.",
+        ("no", "upload_too_large") => "Filen er større enn 20 MB, så ingenting ble sendt. Velg en mindre fil, eller et bilde med lavere oppløsning.",
+        ("no", "upload_unavailable") => "Siden kan ikke ta imot filer akkurat nå, så ingenting ble sendt. Si fra til den som har siden.",
+        ("no", "upload_forbidden") => "Du kan ikke sende filer herfra, så ingenting ble sendt. Er du logget inn?",
         ("no", "current_file") => "Nå:",
         ("no", "keep_file") => "Velg en ny for å bytte, eller la den være.",
         ("no", "nothing_here") => "Ingenting her",
@@ -109,6 +115,9 @@ mod tests {
             "sign_out",
             "nothing_here_yet",
             "upload_failed",
+            "upload_too_large",
+            "upload_unavailable",
+            "upload_forbidden",
             "current_file",
             "keep_file",
             "nothing_here",

src/main.rs

@@ -132,6 +132,7 @@ async fn serve() -> anyhow::Result<()> {
     // windows (see announce.rs).
     tokio::spawn(portal::announce::run(state.clone()));
     tokio::spawn(portal::deadlines::run(state.clone()));
+    tokio::spawn(portal::deadlines::run_leaving(state.clone()));
     // The accounts the content mandates: the first person in, and
     // everyone a page names as responsible, at start and whenever the
     // content changes (seed.rs).

src/trainer/build.rs

@@ -440,6 +440,12 @@ pub struct PlanNeed {
     /// own it.
     #[serde(default)]
     pub one_per_person: bool,
+    /// How long a record stays in the lists once it reaches a stage,
+    /// when not for ever: `{ sluttet: { minutes: 10 } }` takes a card
+    /// off the desk's list ten minutes after it came off the front
+    /// page, instead of leaving it there greyed out.
+    #[serde(default)]
+    pub leaves_after: BTreeMap<String, crate::aggregates::LeavesSpec>,
     pub collects: Vec<Field>,
     /// How many required fields this person will tolerate: what the
     /// business said about them, not what the form happens to ask.
@@ -763,6 +769,12 @@ impl Plan {
                     bail!(at(&format!("deadline on {state:?} goes to {:?}, which is not a move the state machine has from there", d.to)));
                 }
             }
+            if let Some(bad) = need.leaves_after.keys().find(|st| !need.stages.contains(st)) {
+                bail!(at(&format!("leaves_after names {bad:?}, which is not one of its stages")));
+            }
+            if need.leaves_after.values().any(|l| l.millis() == 0) {
+                bail!(at("leaves_after needs some days, hours or minutes"));
+            }
             if need.one_per_person && need.enters_as.is_none() {
                 bail!(at("one_per_person keeps a card for each signed-in person, and the need has no enters_as to sign them in"));
             }
@@ -2059,6 +2071,9 @@ pub fn render(plan: &Plan, words: &BTreeMap<String, Value>) -> anyhow::Result<BT
                     if let Some(d) = need.deadlines.get(st) {
                         state["after"] = json!({ "days": d.days, "to": d.to });
                     }
+                    if let Some(leaves) = need.leaves_after.get(st) {
+                        state["leaves_after"] = json!(leaves);
+                    }
                     (st.clone(), state)
                 }).collect::<Map<_, _>>(),
                 "transitions": machine(need),
@@ -2720,7 +2735,7 @@ mod tests {
             stages: v(stages), done_when: v(done), success: v(success), skippable: v(skippable),
             moves_by: BTreeMap::new(), watched_by: vec![],
             events: BTreeMap::new(), attended_by: None, mails: BTreeMap::new(), stages_text: BTreeMap::new(), turned_down_from: vec![], reached_from: BTreeMap::new(), requires: String::new(), followed_by: vec![],
-            grants: BTreeMap::new(), deadlines: BTreeMap::new(), escalate: BTreeMap::new(), public_states: vec![], presents: false, paused: false, one_per_person: false,
+            grants: BTreeMap::new(), deadlines: BTreeMap::new(), escalate: BTreeMap::new(), public_states: vec![], presents: false, paused: false, one_per_person: false, leaves_after: BTreeMap::new(),
             collects: vec![], max_fields: 3,
         }
     }

src/trainer/plan.rs

@@ -196,6 +196,11 @@ rest. Each is one line in the plan, and the builder does the wiring:
   their own, which the form opens with and which sending again
   replaces - a card on the front page they edit themselves. A picture
   left unchosen stays as it was.
+- **Let finished things go.** `leaves_after: { <stage>: { minutes: 10 } }`
+  takes a record out of every list that long after it reaches that
+  stage (days, hours and minutes add up). A card taken off the front
+  page need not stand greyed out on the desk for ever; the history
+  keeps it.
 - **Pause what you cannot take on.** `paused: true` on a need keeps
   its card on the page, saying what the business does and that it is
   not taking new ones right now, with no form and a button that does

src/upload.rs

@@ -15,7 +15,7 @@ use serde::Serialize;
 
 use crate::server::AppState;
 
-pub const MAX_UPLOAD_BYTES: usize = 20 * 1024 * 1024;
+pub const MAX_UPLOAD_BYTES: usize = crate::app::MAX_UPLOAD_BYTES;
 
 #[derive(Clone)]
 pub struct Garage {

style/main.css

@@ -1300,14 +1300,36 @@ textarea:focus {
   font-size: 1.05rem;
 }
 
-.answer-card-text p {
-  margin: 0;
+.card-field {
   font-size: 0.92rem;
   color: var(--ink-dim);
-  white-space: pre-line;
 }
 
-.answer-card-text p:first-of-type {
+.card-field > :first-child {
+  margin-top: 0;
+}
+
+.card-field > :last-child {
+  margin-bottom: 0;
+}
+
+.card-field p,
+.card-field ul,
+.card-field ol {
+  margin: 0 0 0.5em;
+}
+
+.card-field ul,
+.card-field ol {
+  padding-left: 1.2em;
+}
+
+.card-field a {
+  color: var(--accent);
+}
+
+/* The field right under the name - a role - reads as part of the name. */
+.answer-card-text .card-field:first-of-type {
   color: var(--ink);
   font-weight: 600;
 }