A card of one's own: one_per_person, prefilled, replaced on send; no double sends; refusals are shown

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

CHANGELOG.md

@@ -6,6 +6,21 @@ content repos pin the tag they run (see the end of this file).
 
 ## Unreleased
 
+- `one_per_person: true` on an alternative: each signed-in person keeps one record there, their own. The form opens filled in with it, a file left unchosen keeps the one already there (shown beside the picker), and sending again replaces the card instead of adding one. Two sends at once settle on the newest. Trainer: `one_per_person` on a need entered from inside; Klingenberg Bygg's people each edit their own card on the front page.
+- Send is disabled from the moment it is pressed. Files upload before the form is sent, and a second press in that time used to send it twice.
+- A failed upload stops the send and says so. The form used to go without the file, which made a record that looked complete and was not.
+- A refused send says why, under its button. It used to say nothing.
+
+## 0.6.5 (2026-09-30)
+
+- Trainer: `paused: true` on a need. Its card stays on the front door with what the business does and a sentence saying it is not taking new ones right now, with no form and a button that does not press; nothing is recorded. The lint reports a paused need as a warning ("paused, not open now") and counts it on its own in the summary, as `planned` already did for needs not open yet. Klingenberg Bygg's building applications are paused for capacity.
+
+## 0.6.4 (2026-09-30)
+
+- The rate limit is a hundred at once, refilled at ten a second (it was 30, one every two seconds, which a page with a picture strip used up in one load: a few reloads and the stylesheet was refused). The files a page is made of, from portal's own disk, are not counted at all. `PORTAL_RATE_PER_SECOND` replaces `PORTAL_RATE_SECONDS`; no site set it.
+
+## 0.6.3 (2026-09-30)
+
 - Pages move the way their addresses do. Deeper in the address comes in from the right, back up comes in from the left, and a page at the same depth comes from below or above, with the index on top. The cards on screen leave as layers of their own, one after another, and the next page's cards arrive the same way. The old page stays on screen until the new one has loaded, where it used to go blank in between. Only transforms and opacity are animated, through the browser's View Transitions (`public/page-motion.js`, before the router). Browsers without them, and anyone who asks for reduced motion, navigate as before.
 - A record that carries a picture, in a list with no buttons, is shown as a card: the picture, the first field as the heading, the rest under it, with no field names, state or time. Cards are shown in the order they were put up. On a desk, the same picture is a thumbnail.
 - Trainer: `values` in a plan and `presents: true` on a need make a "who we are" card on the front door. The business's own statements are carried word for word, beside every record the need presents: the people who work there, entered from inside, each with a `picture` field (a file that only takes JPEG, PNG or WebP) that shows as their portrait. A public list keeps the form's field order, so the first field heads each row.

Cargo.lock

@@ -3357,7 +3357,7 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.6.2"
+version = "0.6.5"
 dependencies = [
  "anyhow",
  "arc-swap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.6.2"
+version = "0.6.5"
 edition = "2021"
 
 [lib]

docs/operations.md

@@ -82,22 +82,31 @@ values.
 | `GARAGE_*` | uploads |
 | `MAPBOX_TOKEN` | map tiles, proxied; unset, maps are off |
 | `GARAGE_*` (4) | attachments; see below. Unset, upload fields fail closed |
-| `PORTAL_RATE_BURST`, `PORTAL_RATE_SECONDS` | the rate limit; see below |
+| `PORTAL_RATE_BURST`, `PORTAL_RATE_PER_SECOND` | the rate limit; see below |
 
 Mail is delivered by [gdo](https://project.uhhm.no/uhhm/gdo), a
 separate unit on the same host reading the same NATS.
 
 ## Rate limiting
 
-Every request passes a per-caller-IP limit before a session is loaded
-or a handler is entered: a burst of 30, refilled one every two
-seconds. A visitor filling in a form never reaches it (a page load
-fetches several resources at once); a script does.
+Every request that makes portal do something passes a per-caller-IP
+limit before a session is loaded or a handler is entered: a burst of
+100, refilled at ten a second. More than a hundred requests in ten
+seconds is a script; someone reloading a page again and again stays
+well inside it.
+
+The files a page is made of, served from portal's own disk, are not
+counted: the stylesheet and scripts under `/pkg`, the fonts, the
+favicons, the vendored libraries. Refusing one of those is what turns
+a reloaded page into an unstyled mess, and serving one costs next to
+nothing. Anything that makes portal ask someone else is counted: a
+content picture under `/site/` is fetched from Gitea, a map tile from
+the map provider.
 
 | | |
 |---|---|
-| `PORTAL_RATE_BURST` | how many requests at once, default 30 |
-| `PORTAL_RATE_SECONDS` | seconds per refilled request, default 2 |
+| `PORTAL_RATE_BURST` | how many requests at once, default 100 |
+| `PORTAL_RATE_PER_SECOND` | requests refilled per second, default 10 |
 
 Either set to `0` turns it off, for an instance behind something that
 already does this. The caller is read from `X-Forwarded-For` or

plans/klingenbergbygg.yaml

@@ -100,7 +100,9 @@ needs:
       - { name: oppstart, type: date, optional: true }
       - { name: skisser, type: file, optional: true }
 
+  # På pause: fullt hos oss. Ta linjen ut for å åpne igjen.
   - id: soknad
+    paused: true
     who: en byggherre med et ferdig prosjektert bygg som trenger offentlig godkjenning før første spadetak
     wants: en godkjent byggesøknad, med ansvarsrett der det kreves
     lands_in: soknader
@@ -143,12 +145,13 @@ needs:
       - { name: hva }
       - { name: dokument, type: file }
 
-  # Menneskene: kontoret legger inn hver ansatt med navn, rolle,
-  # erfaring og portrett, og forsiden viser dem alle.
+  # Menneskene: hver ansatt har sitt eget kort på forsiden, med rolle,
+  # erfaring og portrett, og retter det selv. Kontoret kan ta et kort ned.
   - id: ansatt
-    who: kontoret, når noen begynner hos oss eller skal ha nytt portrett
+    who: en av oss på kontoret, som vil vise hvem hen er og hva hen kan
     wants: at den som vurderer oss ser hvem som gjør jobben
     enters_as: kontor
+    one_per_person: true
     lands_in: ansatte
     handled_by: kontor
     watched_by: [public]

plans/words/klingenbergbygg.json

@@ -109,7 +109,8 @@
           "telefon": "Telefonnummer",
           "adresse": "Adresse",
           "tiltak": "Tilbygg, ombygging, nybygg…"
-        }
+        },
+        "paused": "Akkurat nå har vi ikke kapasitet til nye søknadsoppdrag; vi åpner igjen så snart vi kan."
       }
     },
     "who": {
@@ -257,7 +258,7 @@
       },
       "ansatte": {
         "heading": "Ansatte på forsiden",
-        "description": "Menneskene slik besøkende ser dem.",
+        "description": "Menneskene slik besøkende ser dem. Hver retter sitt eget kort; herfra kan et kort tas ned.",
         "moves": {
           "open->sluttet": "Tatt av forsiden"
         },
@@ -272,8 +273,8 @@
         "button": "Ny leveranse"
       },
       "ansatt": {
-        "heading": "Legg inn en ansatt",
-        "description": "Navn, rolle, erfaring og portrett, rett ut på forsiden.",
+        "heading": "Ditt kort på forsiden",
+        "description": "Rolle, erfaring og portrett, slik besøkende ser deg.",
         "button": "Åpne"
       }
     },
@@ -470,10 +471,10 @@
     }
   },
   "questions/kontor/ansatt-sent.yaml": {
-    "question": "Lagt ut",
-    "description": "Den ansatte vises nå blant menneskene på forsiden.",
-    "next_heading": "Skal noen ned igjen?",
-    "next_description": "Trykk «Tatt av forsiden» på raden deres i listen over ansatte på kontoret. Nytt portrett: legg personen inn på nytt, og ta den gamle raden av.",
+    "question": "Kortet ditt er lagret",
+    "description": "Slik står du nå på forsiden.",
+    "next_heading": "Vil du endre noe?",
+    "next_description": "Åpne «Ditt kort på forsiden» igjen: det er fylt ut med det du har, og det du lagrer erstatter det.",
     "see_all": {
       "heading": "Se alle ansatte",
       "description": "",
@@ -481,21 +482,21 @@
     }
   },
   "questions/kontor/ansatt.yaml": {
-    "heading": "Legg inn en ansatt",
-    "description": "Navn, rolle, erfaring og portrett. Den ansatte vises på forsiden så snart du sender.",
-    "button": "Legg ut",
+    "heading": "Ditt kort på forsiden",
+    "description": "Slik står du blant menneskene på forsiden. Rett det du vil og lagre; du har ett kort, og det nye erstatter det gamle.",
+    "button": "Lagre kortet",
     "encouragement": "",
-    "icon": "user-plus",
+    "icon": "id-card",
     "requires_title": "",
     "requires_description": "",
     "requires_icon": "",
-    "road_title": "Hva skjer så",
-    "road_description": "Personen vises på forsiden til du tar dem av igjen fra kontoret.",
+    "road_title": "Når du lagrer",
+    "road_description": "Kortet ditt på forsiden endres med en gang.",
     "road_icon": "route",
     "who_title": "Hvem ser det",
-    "who_description": "Alle som besøker siden. Portrettet vises som det er, så velg et bilde du er fornøyd med.",
+    "who_description": "Alle som besøker siden. Navnet ditt er det du er logget inn med.",
     "who_icon": "users",
-    "form_title": "Den ansatte",
+    "form_title": "Kortet ditt",
     "form_description": "",
     "labels": {
       "name": "Navn",
@@ -507,10 +508,10 @@
       "name": "",
       "rolle": "For eksempel daglig leder, rådgivende ingeniør",
       "erfaring": "Utdanning, fagområder, år i faget, bygg du er stolt av",
-      "portrett": "Et stående bilde, gjerne tatt i dagslys"
+      "portrett": "Et stående bilde, gjerne tatt i dagslys. Velger du ikke noe nytt, beholder du det du har."
     },
-    "question": "Hvem skal vises på forsiden?",
-    "page_description": ""
+    "question": "Ditt kort på forsiden",
+    "page_description": "Det du skriver her, står under portrettet ditt på forsiden."
   },
   "questions/status/ansatte/index.yaml": {
     "question": "Hvem består Klingenberg Bygg av?",

src/answers.rs

@@ -114,6 +114,73 @@ pub async fn store_answer(
     Ok(())
 }
 
+/// Whose a record is, on an alternative that keeps one per person
+/// (`one_per_person`): the signed-in person's username, written by the
+/// server into the record's fields, never taken from the form.
+pub const OWNER_FIELD: &str = "by";
+
+/// Every record in `bucket` that belongs to `username`, newest first.
+#[cfg(feature = "ssr")]
+pub async fn own_records(js: &async_nats::jetstream::Context, bucket: &str, username: &str) -> Vec<Answer> {
+    use futures::TryStreamExt;
+    let Ok(store) = js.get_key_value(bucket).await else { return Vec::new() };
+    let keys: Vec<String> = match store.keys().await {
+        Ok(keys) => keys.try_collect().await.unwrap_or_default(),
+        Err(_) => return Vec::new(),
+    };
+    let mut own = Vec::new();
+    for key in keys {
+        let Ok(Some(bytes)) = store.get(&key).await else { continue };
+        let Ok(answer) = serde_json::from_slice::<Answer>(&bytes) else { continue };
+        if answer.responses.get(OWNER_FIELD).and_then(|v| v.as_str()) == Some(username) {
+            own.push(answer);
+        }
+    }
+    own.sort_by(|a, b| (b.submitted_ms, &b.id).cmp(&(a.submitted_ms, &a.id)));
+    own
+}
+
+/// A person keeps one card: of their records still in the bucket's
+/// first state, only the newest stays in the list, and the rest leave
+/// it (the event log keeps them). Run after every store, so two sends
+/// racing each other - a double click - both settle on the same one.
+#[cfg(feature = "ssr")]
+pub async fn keep_newest_own(js: &async_nats::jetstream::Context, bucket: &str, initial: &str, username: &str) {
+    let own = own_records(js, bucket, username).await;
+    let Ok(store) = js.get_key_value(bucket).await else { return };
+    for older in own.iter().filter(|a| a.state == initial).skip(1) {
+        if let Err(e) = store.delete(&older.id).await {
+            tracing::error!(bucket, id = %older.id, error = %e, "could not retire an older own record");
+        }
+    }
+}
+
+/// Fills the form of every `one_per_person` alternative with what the
+/// signed-in person's own newest record says, so sending it again is
+/// editing their card. A file field shows the file already there, at
+/// the address a list would open it from, and may be left empty to
+/// keep it.
+#[cfg(feature = "ssr")]
+pub async fn fill_own(js: &async_nats::jetstream::Context, question: &mut crate::content::Question, user: Option<&crate::auth::User>) {
+    let Some(user) = user else { return };
+    for alt in &mut question.alternatives {
+        let (true, Some(bucket)) = (alt.one_per_person, alt.record_as.clone()) else { continue };
+        let Some(mine) = own_records(js, &bucket, &user.username).await.into_iter().next() else { continue };
+        for req in alt.features.iter_mut().flat_map(|f| f.requirements.iter_mut()) {
+            if req.kind == "hidden" {
+                continue;
+            }
+            let Some(value) = mine.responses.get(&req.name).and_then(|v| v.as_str()).filter(|v| !v.trim().is_empty()) else { continue };
+            if req.kind == "file" {
+                req.value = Some(format!("/attachment/{bucket}/{}/{}", mine.id, req.name));
+                req.optional = true;
+            } else {
+                req.value = Some(value.to_string());
+            }
+        }
+    }
+}
+
 /// One selected row's pending transition. `feature_name` is per-item
 /// so a batch can span more than one resource feature on the same
 /// alternative.

src/app.rs

@@ -1198,9 +1198,11 @@ fn AlternativeCard(
             if req.kind == "file" {
                 file_refs.entry(req.name.clone()).or_default();
             } else if req.kind == "select" {
+                // Preset by a card of one's own (`answers::fill_own`).
+                let preset: Vec<String> = req.value.clone().filter(|v| !v.is_empty()).into_iter().collect();
                 select_field_map
                     .entry(req.name.clone())
-                    .or_insert_with(|| RwSignal::new(Vec::new()));
+                    .or_insert_with(|| RwSignal::new(preset));
                 select_multi.insert(req.name.clone(), req.multiple);
             } else {
                 // Widget-owned fields hold JSON objects, not strings.
@@ -1238,6 +1240,11 @@ fn AlternativeCard(
     let gesture_fields_for_submit = gesture_fields.clone();
     let question_id_for_transition = question_id.clone();
     let alt_name_for_transition = alternative.name.clone();
+    // From the moment Send is pressed until the server has answered:
+    // files upload first, and a second press in that time used to send
+    // the form twice.
+    let sending = RwSignal::new(false);
+    let send_error: RwSignal<Option<String>> = RwSignal::new(None);
     let on_submit = move |ev: leptos::ev::SubmitEvent| {
         ev.prevent_default();
 
@@ -1266,6 +1273,8 @@ fn AlternativeCard(
         let question_id_for_submit = question_id_for_submit.clone();
         let alt_name_for_submit = alt_name_for_submit.clone();
         let parent_hash_for_submit = parent_hash_for_submit.clone();
+        sending.set(true);
+        send_error.set(None);
         leptos::task::spawn_local(async move {
             let mut map = serde_json::Map::new();
             for (name, sig) in field_map_for_submit.iter() {
@@ -1305,8 +1314,14 @@ fn AlternativeCard(
                     Ok(key) => {
                         map.insert(name.clone(), serde_json::Value::String(key));
                     }
+                    // A form sent without the file it asked for is a
+                    // record that looks complete and is not: stop, and
+                    // say so.
                     Err(e) => {
                         leptos::logging::error!("upload of {name} failed: {e:?}");
+                        send_error.set(Some(t(&lang().get_untracked(), "upload_failed").to_string()));
+                        sending.set(false);
+                        return;
                     }
                 }
             }
@@ -1319,6 +1334,7 @@ fn AlternativeCard(
                 parent_hash: parent_hash_for_submit,
                 responses_json,
             });
+            sending.set(false);
         });
     };
 
@@ -1512,9 +1528,26 @@ fn AlternativeCard(
 
                                                 if req.kind == "file" {
                                                     let file_ref = file_refs.get(&req.name).copied().unwrap_or_else(NodeRef::new);
+                                                    // On a card of one's own, the file already
+                                                    // there (see `answers::fill_own`).
+                                                    let current = req.value.clone().filter(|v| v.starts_with("/attachment/")).map(|href| {
+                                                        let picture = req.accept.as_deref().is_some_and(|a| a.contains("image/"));
+                                                        view! {
+                                                            <span class="field-current">
+                                                                <span>{move || t(&lang().get(), "current_file")}</span>
+                                                                {if picture {
+                                                                    view! { <img class="answer-thumb" src=href.clone() alt="" /> }.into_any()
+                                                                } else {
+                                                                    view! { <a href=href.clone() rel="external">{href.rsplit('/').next().unwrap_or_default().to_string()}</a> }.into_any()
+                                                                }}
+                                                                <span class="field-hint">{move || t(&lang().get(), "keep_file")}</span>
+                                                            </span>
+                                                        }
+                                                    });
                                                     return view! {
                                                         <label class="field" for=label_for>
                                                             {label_text}
+                                                            {current}
                                                             <input
                                                                 id=field_id
                                                                 type="file"
@@ -1826,12 +1859,24 @@ fn AlternativeCard(
                                             class="alt-submit"
                                             disabled=move || {
                                                 (!has_requirements && pending_transitions.get().is_empty())
+                                                    || sending.get()
                                                     || submit.pending().get()
                                                     || transition_batch.pending().get()
                                             }
                                         >
                                             {button_label.clone()}
                                         </button>
+                                        // Why nothing happened, when something
+                                        // was refused: it used to say nothing.
+                                        {move || {
+                                            send_error
+                                                .get()
+                                                .or_else(|| match submit.value().get() {
+                                                    Some(Err(e)) => Some(server_message(&e)),
+                                                    _ => None,
+                                                })
+                                                .map(|m| view! { <p class="alt-error" role="alert">{m}</p> })
+                                        }}
                                     </form>
                                 }
                                 .into_any()
@@ -2238,6 +2283,13 @@ pub fn uploaded_filename(value: &str) -> Option<&str> {
     rest.strip_prefix('-').filter(|name| shaped && !name.is_empty())
 }
 
+/// What a refused server call says, without the wrapping a person
+/// has no use for.
+fn server_message(e: &ServerFnError) -> String {
+    let text = e.to_string();
+    text.rsplit_once(": ").map(|(_, m)| m.to_string()).filter(|m| !m.is_empty()).unwrap_or(text)
+}
+
 /// Whether an uploaded file is a picture a browser shows as it is.
 pub fn is_picture(filename: &str) -> bool {
     let lower = filename.to_ascii_lowercase();
@@ -2559,6 +2611,7 @@ pub async fn get_question(
     let session: tower_sessions::Session = leptos_axum::extract().await?;
     let user = session.get::<User>(SESSION_USER_KEY).await.map_err(|e| ServerFnError::new(e.to_string()))?;
     fill_from_user(&mut question, user.as_ref());
+    crate::answers::fill_own(&state.jetstream, &mut question, user.as_ref()).await;
     let mut chain_gate = None;
     if let Some(target) = &question.requires_chain {
         // The claimed lineage must verifiably end at the required
@@ -2912,6 +2965,26 @@ pub async fn submit_answer(
     let mut responses: serde_json::Value = serde_json::from_str(&responses_json)
         .map_err(|e| ServerFnError::new(format!("invalid responses: {e}")))?;
 
+    // One card each: whose it is comes from the session, and a file the
+    // person did not choose again is the one already on their card.
+    let owner = if alt.one_per_person {
+        let user = user.as_ref().ok_or_else(|| ServerFnError::new("sign in to keep a card of your own"))?;
+        let bucket = record_as.clone().ok_or_else(|| ServerFnError::new("this alternative keeps nothing"))?;
+        let previous = crate::answers::own_records(&state.jetstream, &bucket, &user.username).await.into_iter().next();
+        if let Some(map) = responses.as_object_mut() {
+            for req in alt.features.iter().flat_map(|f| &f.requirements).filter(|r| r.kind == "file") {
+                let chosen = map.get(&req.name).and_then(|v| v.as_str()).is_some_and(|v| !v.is_empty());
+                if let (false, Some(kept)) = (chosen, previous.as_ref().and_then(|p| p.responses.get(&req.name))) {
+                    map.insert(req.name.clone(), kept.clone());
+                }
+            }
+            map.insert(crate::answers::OWNER_FIELD.to_string(), serde_json::Value::String(user.username.clone()));
+        }
+        Some((bucket, user.username.clone()))
+    } else {
+        None
+    };
+
     // A record that belongs to another record: check the other one is
     // there before this one is written, so a reference in a stored
     // record is one that resolved at least once. An optional field
@@ -3027,6 +3100,15 @@ pub async fn submit_answer(
         {
             tracing::error!("failed to store answer in {bucket}: {e}");
         }
+        if let Some((own_bucket, username)) = &owner {
+            let initial = state
+                .aggregates
+                .load()
+                .get(own_bucket)
+                .map(|s| s.initial.clone())
+                .unwrap_or_else(|| crate::answers::OPEN_STATE.to_string());
+            crate::answers::keep_newest_own(&state.jetstream, own_bucket, &initial, username).await;
+        }
         // Arrival is a state too: what the schema says the first
         // state sends, it sends now.
         if let Some(initial) = state.aggregates.load().get(bucket).map(|s| s.initial.clone()) {

src/content/mod.rs

@@ -343,6 +343,14 @@ pub struct Alternative {
     /// works (lysbue had the same flag).
     #[serde(default)]
     pub disabled: bool,
+    /// Each signed-in person keeps one record here: their own, which
+    /// sending again replaces. The form opens with what their record
+    /// says, a file left empty keeps the one already there, and the
+    /// older record leaves the list. For what a person says about
+    /// themselves - a card on the front page, a profile. Needs
+    /// `record_as`, and someone signed in.
+    #[serde(default)]
+    pub one_per_person: bool,
     #[serde(default)]
     pub consequence: Vec<String>,
     #[serde(default)]

src/content/validate.rs

@@ -512,6 +512,13 @@ pub fn validate_questions(
     }
     for question in questions.values() {
         for alternative in &question.alternatives {
+            if alternative.one_per_person && alternative.record_as.is_none() {
+                anyhow::bail!(
+                    "question {:?} alternative {:?}: one_per_person keeps each person's own record, and there is no record_as to keep it in",
+                    question.id,
+                    alternative.name
+                );
+            }
             if let Some(bucket) = &alternative.record_as {
                 let attended = read_buckets.contains(bucket)
                     || aggregates

src/i18n.rs

@@ -24,6 +24,9 @@ fn lookup(lang: &str, key: &str) -> Option<&'static str> {
         ("en", "sign_in") => "Sign in",
         ("en", "sign_out") => "Sign out",
         ("en", "nothing_here_yet") => "Nothing here yet.",
+        ("en", "upload_failed") => "The file could not be sent, so nothing was. Try again, or with a smaller file.",
+        ("en", "current_file") => "Now:",
+        ("en", "keep_file") => "Choose a new one to replace it, or leave it as it is.",
         ("en", "nothing_here") => "Nothing here",
         ("en", "back_to_start") => "back to the start",
         ("en", "done") => "Done.",
@@ -54,6 +57,9 @@ fn lookup(lang: &str, key: &str) -> Option<&'static str> {
         ("no", "sign_in") => "Logg inn",
         ("no", "sign_out") => "Logg ut",
         ("no", "nothing_here_yet") => "Ingenting her ennå.",
+        ("no", "upload_failed") => "Filen kom ikke fram, så ingenting ble sendt. Prøv igjen, eller med en mindre fil.",
+        ("no", "current_file") => "Nå:",
+        ("no", "keep_file") => "Velg en ny for å bytte, eller la den være.",
         ("no", "nothing_here") => "Ingenting her",
         ("no", "back_to_start") => "tilbake til start",
         ("no", "done") => "Ferdig.",
@@ -102,6 +108,9 @@ mod tests {
             "sign_in",
             "sign_out",
             "nothing_here_yet",
+            "upload_failed",
+            "current_file",
+            "keep_file",
             "nothing_here",
             "back_to_start",
             "done",

src/lint/check.rs

@@ -180,11 +180,13 @@ fn check_needs(
         }
     }
     if failed == 0 {
-        let planned = file.needs.iter().filter(|n| n.planned).count();
+        let planned = file.needs.iter().filter(|n| n.planned && !n.paused).count();
+        let paused = file.needs.iter().filter(|n| n.paused).count();
         println!(
-            "OK: {} need(s) structurally met, {} planned, {} persona(s)",
-            file.needs.len() - planned,
+            "OK: {} need(s) structurally met, {} planned, {} paused, {} persona(s)",
+            file.needs.len() - planned - paused,
             planned,
+            paused,
             file.personas.len()
         );
     }

src/lint/needs.rs

@@ -78,6 +78,10 @@ pub struct Need {
     /// as a warning, so the gap stays visible without failing CI.
     #[serde(default)]
     pub planned: bool,
+    /// Open before and closed for now (full up, out of season): its
+    /// card is on the page with no form. Reports like `planned`.
+    #[serde(default)]
+    pub paused: bool,
     /// Each state of the bucket in plain words, in the site's
     /// language, for the scorer: state ids are ASCII, and a Norwegian
     /// `ikke_lost` reads as English to a model.
@@ -305,11 +309,11 @@ pub fn check(
         let mut report = |level: Level, message: String| {
             findings.push(Finding {
                 need: need.id.clone(),
-                level: if need.planned { Level::Warn } else { level },
-                message: if need.planned && level == Level::Fail {
-                    format!("planned, not met yet: {message}")
-                } else {
-                    message
+                level: if need.planned || need.paused { Level::Warn } else { level },
+                message: match (need.paused, need.planned, level == Level::Fail) {
+                    (true, _, true) => format!("paused, not open now: {message}"),
+                    (false, true, true) => format!("planned, not met yet: {message}"),
+                    _ => message,
                 },
             })
         };

src/main.rs

@@ -166,30 +166,32 @@ async fn serve() -> anyhow::Result<()> {
         .with_name("portal_session");
 
     // What a person does costs a little; what a script does costs a
-    // lot. A burst of 30 with one refilled every two seconds is well
-    // above anything a visitor filling in a form will reach - a page
-    // load fetches several resources at once - and well below what it
-    // takes to be a nuisance. Per caller IP, in memory, no store: this
-    // is a fence, not an accounting system, and the fence that matters
-    // for uploads is the policy check on the route itself.
+    // lot. More than a hundred requests in ten seconds is a script: a
+    // burst of 100, refilled at ten a second. Someone reloading a page
+    // again and again stays well inside it, the more so since the
+    // files a page is made of (stylesheet, scripts, fonts, pictures)
+    // are not counted at all - see `assets` below. Per caller IP, in
+    // memory, no store: this is a fence, not an accounting system, and
+    // the fence that matters for uploads is the policy check on the
+    // route itself.
     //
     // PORTAL_RATE_PER_SECOND / PORTAL_RATE_BURST retune it per site;
     // 0 for either turns it off, for an instance behind something that
     // already does this.
-    let rate_seconds: u64 = std::env::var("PORTAL_RATE_SECONDS")
+    let rate_per_second: u64 = std::env::var("PORTAL_RATE_PER_SECOND")
         .ok()
         .and_then(|v| v.parse().ok())
-        .unwrap_or(2);
+        .unwrap_or(10);
     let rate_burst: u32 = std::env::var("PORTAL_RATE_BURST")
         .ok()
         .and_then(|v| v.parse().ok())
-        .unwrap_or(30);
-    let governor = (rate_seconds > 0 && rate_burst > 0).then(|| {
+        .unwrap_or(100);
+    let governor = (rate_per_second > 0 && rate_burst > 0).then(|| {
         // SmartIpKeyExtractor reads X-Forwarded-For/X-Real-IP, which is
         // what every one of these instances is behind; it falls back to
         // the socket address when neither is set.
         let conf = tower_governor::governor::GovernorConfigBuilder::default()
-            .per_second(rate_seconds)
+            .per_millisecond((1000 / rate_per_second).max(1))
             .burst_size(rate_burst)
             .key_extractor(tower_governor::key_extractor::SmartIpKeyExtractor)
             .finish()
@@ -197,8 +199,8 @@ async fn serve() -> anyhow::Result<()> {
         std::sync::Arc::new(conf)
     });
     match &governor {
-        Some(_) => tracing::info!(rate_seconds, rate_burst, "rate limiting per caller IP"),
-        None => tracing::warn!("rate limiting is off (PORTAL_RATE_SECONDS or PORTAL_RATE_BURST is 0)"),
+        Some(_) => tracing::info!(rate_per_second, rate_burst, "rate limiting per caller IP"),
+        None => tracing::warn!("rate limiting is off (PORTAL_RATE_PER_SECOND or PORTAL_RATE_BURST is 0)"),
     }
 
     async fn server_fn_handler(
@@ -233,34 +235,13 @@ async fn serve() -> anyhow::Result<()> {
     let fonts_dir = format!("{}/fonts", leptos_options.site_root);
     let page_motion = format!("{}/page-motion.js", leptos_options.site_root);
 
-    let app = Router::new()
-        .route("/auth/login", get(oidc::login))
-        .route("/auth/callback", get(oidc::callback))
-        .route("/auth/logout", get(oidc::logout))
-        .route("/api/{*fn_name}", any(server_fn_handler))
-        // axum caps request bodies at 2 MB by default, which had made the
-        // 20 MB upload limit unreachable; raise the fence on this route only,
-        // with room for the multipart framing.
-        .route(
-            "/upload",
-            post(upload::upload).layer(axum::extract::DefaultBodyLimit::max(upload::MAX_UPLOAD_BYTES + 64 * 1024)),
-        )
-        .route(
-            "/attachment/{bucket}/{record}/{field}",
-            get(upload::attachment),
-        )
-        .route("/gitea-repo", get(content::gitea_repo_handler))
-        // What the storylines did, as counts (report.rs).
-        .route("/report", get(portal::report::handler))
-        // Content-shipped assets (hero module etc.), same-origin.
-        .route("/site/{*path}", get(content::site_asset_handler))
-        .route("/automation/kv/{bucket}", get(content::automation_kv_handler))
-        // Maps, proxied: the browser asks this origin for every tile
-        // and every still, so nothing third-party loads in a page and
-        // the token stays here (see maps.rs).
-        .route("/map/style.json", get(portal::maps::style))
-        .route("/map/tiles/{z}/{x}/{y}", get(portal::maps::tile))
-        .route("/map/still/{place}/{size}", get(portal::maps::still))
+    // The files a page is made of, from this disk: the stylesheet, the
+    // scripts, the fonts. Not counted by the rate limit - they cost
+    // next to nothing, and refusing one is what turns a reloaded page
+    // into an unstyled mess - and no session is loaded for them.
+    // Anything that makes portal ask someone else (content pictures
+    // from Gitea, map tiles) stays below, counted.
+    let assets: Router<AppState> = Router::new()
         // no-cache = "revalidate before reuse", not "don't cache":
         // pkg files keep the same names across releases (portal.js,
         // portal.wasm), and without this browsers heuristically cache
@@ -296,7 +277,36 @@ async fn serve() -> anyhow::Result<()> {
                 .service(ServeFile::new(page_motion)),
         )
         .route_service("/maplibre-gl.js", ServeFile::new(maplibre_js))
-        .route_service("/maplibre-gl.css", ServeFile::new(maplibre_css))
+        .route_service("/maplibre-gl.css", ServeFile::new(maplibre_css));
+
+    let app = Router::new()
+        .route("/auth/login", get(oidc::login))
+        .route("/auth/callback", get(oidc::callback))
+        .route("/auth/logout", get(oidc::logout))
+        .route("/api/{*fn_name}", any(server_fn_handler))
+        // axum caps request bodies at 2 MB by default, which had made the
+        // 20 MB upload limit unreachable; raise the fence on this route only,
+        // with room for the multipart framing.
+        .route(
+            "/upload",
+            post(upload::upload).layer(axum::extract::DefaultBodyLimit::max(upload::MAX_UPLOAD_BYTES + 64 * 1024)),
+        )
+        .route(
+            "/attachment/{bucket}/{record}/{field}",
+            get(upload::attachment),
+        )
+        .route("/gitea-repo", get(content::gitea_repo_handler))
+        // What the storylines did, as counts (report.rs).
+        .route("/report", get(portal::report::handler))
+        // Content-shipped assets (hero module etc.), same-origin.
+        .route("/site/{*path}", get(content::site_asset_handler))
+        .route("/automation/kv/{bucket}", get(content::automation_kv_handler))
+        // Maps, proxied: the browser asks this origin for every tile
+        // and every still, so nothing third-party loads in a page and
+        // the token stays here (see maps.rs).
+        .route("/map/style.json", get(portal::maps::style))
+        .route("/map/tiles/{z}/{x}/{y}", get(portal::maps::tile))
+        .route("/map/still/{place}/{size}", get(portal::maps::still))
         .leptos_routes_with_context(
             &state,
             routes,
@@ -318,8 +328,8 @@ async fn serve() -> anyhow::Result<()> {
     let app = match governor {
         Some(conf) => app.layer(tower_governor::GovernorLayer::new(conf)),
         None => app,
-    }
-    .with_state(state);
+    };
+    let app = assets.merge(app).with_state(state);
 
     tracing::info!("listening on http://{addr}");
     let listener = tokio::net::TcpListener::bind(&addr).await?;

src/trainer/build.rs

@@ -425,6 +425,21 @@ pub struct PlanNeed {
     /// picture.
     #[serde(default)]
     pub presents: bool,
+    /// Not taking new cases for now: full up, a season closed. The
+    /// card stays where it is, saying what the business does and that
+    /// it is paused, with no form to fill in and a button that does not
+    /// press; the server refuses a submission. Remove the line to open
+    /// again - the desk, the stages and every case under way are
+    /// untouched either way.
+    #[serde(default)]
+    pub paused: bool,
+    /// Each person in the group that enters it keeps one record: their
+    /// own card, which they open filled in and send again to change.
+    /// For what people say about themselves - who they are on the
+    /// front page. Needs `enters_as`, so there is someone signed in to
+    /// own it.
+    #[serde(default)]
+    pub one_per_person: bool,
     pub collects: Vec<Field>,
     /// How many required fields this person will tolerate: what the
     /// business said about them, not what the form happens to ask.
@@ -748,6 +763,9 @@ impl Plan {
                     bail!(at(&format!("deadline on {state:?} goes to {:?}, which is not a move the state machine has from there", d.to)));
                 }
             }
+            if need.one_per_person && need.enters_as.is_none() {
+                bail!(at("one_per_person keeps a card for each signed-in person, and the need has no enters_as to sign them in"));
+            }
             if need.presents && !need.watched_by.iter().any(|g| g == PUBLIC) {
                 bail!(at("presents shows its records to everyone, and the need has no `public` in watched_by"));
             }
@@ -1082,6 +1100,8 @@ pub fn fallback_words(plan: &Plan) -> BTreeMap<String, Value> {
             "button": "Send",
             "encouragement": "",
             "icon": "",
+            // Said after the description, on a paused need's card only.
+            "paused": if need.paused { loc(lang, "We are not taking new ones right now, and open again as soon as we can.", "Akkurat nå tar vi ikke imot nye; vi åpner igjen så snart vi kan.") } else { String::new() },
             // Three sections of context the plan already knows: what
             // the person must have for this to work, the road a case
             // travels, and who is at the other end. The fallbacks are
@@ -1957,15 +1977,32 @@ fn form_alternative(plan: &Plan, need: &PlanNeed, w: &Value, action: &str) -> Va
     if !s(&w["who_description"]).trim().is_empty() {
         features.push(strip(&w["who_title"], &w["who_description"], s(&w["who_icon"])));
     }
-    features.push(feature);
+    // A paused need asks for nothing: a form nobody can send has
+    // already wasted the time it took to fill in.
+    if !need.paused {
+        features.push(feature);
+    }
+    let description = if need.paused {
+        text_map(&w["description"], |d| format!("{} {}", d.trim(), s(&w["paused"]).trim()).trim().to_string())
+    } else {
+        text(&w["description"])
+    };
     let mut alt = json!({
         "name": text(&w["heading"]),
-        "description": text(&w["description"]),
+        "description": description,
         "action": action,
         "consequence": button(&w["button"]),
         "record_as": need.lands_in,
         "features": features,
     });
+    if need.one_per_person {
+        alt["one_per_person"] = json!(true);
+    }
+    // Paused, it records nothing and says where nothing goes.
+    if need.paused {
+        alt["disabled"] = json!(true);
+        alt.as_object_mut().map(|a| a.remove("record_as"));
+    }
     if !s(&w["encouragement"]).trim().is_empty() {
         alt["encouragements"] = button(&w["encouragement"]);
     }
@@ -2452,6 +2489,7 @@ pub fn render(plan: &Plan, words: &BTreeMap<String, Value>) -> anyhow::Result<BT
                     "stage_words": all_stages(n).iter().map(|s| (s.clone(), json!(stage_text(n, s)))).collect::<Map<_, _>>(),
                 });
                 if let Some(group) = &n.enters_as { need["enters_as"] = json!(group); }
+                if n.paused { need["paused"] = json!(true); }
                 let others: BTreeSet<&String> = n.moves_by.values().flatten().filter(|m| *m != SUBMITTER && **m != n.handled_by).collect();
                 if !others.is_empty() { need["also_moved_by"] = json!(others); }
                 need
@@ -2525,7 +2563,7 @@ fn words_prompt(plan: &Plan, path: &str, fallback: &Value, tone: Option<&str>) -
     context.extend(
         plan.needs
             .iter()
-            .map(|n| format!("- {}: {} - wants: {}. Handled by {}. Stages: {}. Lands in `{}`; its form collects: {}.", n.id, n.who, n.wants, n.handled_by, n.stages.join(" -> "), n.lands_in, n.collects.iter().map(|f| format!("{{{}}}{}{}", f.name, if f.kind == "textarea" { " (long)" } else { "" }, if f.optional { " (optional)" } else { "" })).collect::<Vec<_>>().join(", "))),
+            .map(|n| format!("- {}{}: {} - wants: {}. Handled by {}. Stages: {}. Lands in `{}`; its form collects: {}.", n.id, match (n.paused, n.one_per_person) { (true, _) => " (PAUSED: not taking new cases right now; its card shows no form and its button does not press, and `paused` is the sentence after its description that says so)", (_, true) => " (ONE EACH: every signed-in person keeps one record here, their own; the form opens filled in with it and sending saves the change, so it speaks to them about their own and its button saves)", _ => "" }, n.who, n.wants, n.handled_by, n.stages.join(" -> "), n.lands_in, n.collects.iter().map(|f| format!("{{{}}}{}{}", f.name, if f.kind == "textarea" { " (long)" } else { "" }, if f.optional { " (optional)" } else { "" })).collect::<Vec<_>>().join(", "))),
     );
     format!(
         "You write the words for one page of a website for this business.\n\nBusiness: {}\nAbout: {}\nContact: {} <{}>\nLanguage to write in: {}\n\nEveryone the site serves:\n{}\n\nThe page: {path}\nIt is {purpose}\n\nBelow is the page as JSON. Every value is a slot that says what to write there. Return the same JSON with every slot replaced by your words. Keep every key exactly as it is. A slot left as it is counts as no answer.\n\nRules for the words:\n- `question` is a question the reader could ask themselves.\n- A heading says what the reader gets, in the reader's own words, and must work without its description.\n- Lead with what a thing enables. No negations in headings. No trade jargon the reader would not use.\n- Descriptions are one or two short sentences. Labels and buttons are a few words.\n- The button says what pressing it does; the encouragement says what happens next or how little it takes; the form's guidance line says what to have ready. Placeholders are example answers in the reader's words.\n- An icon is one name from this list, chosen for what the reader is doing, or empty: {}\n- Write the way people in this trade and country actually speak.{voice}\n\n{}\n\nReply with the JSON object only.",
@@ -2682,7 +2720,7 @@ mod tests {
             stages: v(stages), done_when: v(done), success: v(success), skippable: v(skippable),
             moves_by: BTreeMap::new(), watched_by: vec![],
             events: BTreeMap::new(), attended_by: None, mails: BTreeMap::new(), stages_text: BTreeMap::new(), turned_down_from: vec![], reached_from: BTreeMap::new(), requires: String::new(), followed_by: vec![],
-            grants: BTreeMap::new(), deadlines: BTreeMap::new(), escalate: BTreeMap::new(), public_states: vec![], presents: false,
+            grants: BTreeMap::new(), deadlines: BTreeMap::new(), escalate: BTreeMap::new(), public_states: vec![], presents: false, paused: false, one_per_person: false,
             collects: vec![], max_fields: 3,
         }
     }

src/trainer/plan.rs

@@ -191,6 +191,16 @@ rest. Each is one line in the plan, and the builder does the wiring:
   of them, as cards: the people who work there, entered from inside
   (`enters_as`), each with a `picture` field that shows as their
   portrait.
+- **Let people keep their own.** `one_per_person: true` on a need
+  entered from inside gives each signed-in person one record there:
+  their own, which the form opens with and which sending again
+  replaces - a card on the front page they edit themselves. A picture
+  left unchosen stays as it was.
+- **Pause what you cannot take on.** `paused: true` on a need keeps
+  its card on the page, saying what the business does and that it is
+  not taking new ones right now, with no form and a button that does
+  not press. Take the line out to open again; the desk and every case
+  under way are untouched.
 - **Show the work.** `slideshow` on the plan is portal's own block,
   carried onto the front door as written: a strip of pictures under
   the question, each with its caption.

style/main.css

@@ -1325,6 +1325,23 @@ textarea:focus {
   object-fit: cover;
 }
 
+/* Why a send was refused, under its button. */
+.alt-error {
+  margin: 0.6em 0 0;
+  color: var(--accent);
+  font-size: 0.92em;
+}
+
+/* The file already on a card of one's own, above the picker. */
+.field-current {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 0.6em;
+  font-size: 0.9em;
+  color: var(--ink-dim);
+}
+
 /* A stored file on a record: its name, and it opens. */
 .answer-file {
   color: var(--accent);

tests/jetstream.rs

@@ -248,3 +248,32 @@ async fn a_membership_is_invited_becomes_active_at_sign_in_and_can_be_taken_back
     let groups = memberships::on_signed_in(&state, &kari).await;
     assert!(groups.contains(&styret.to_string()));
 }
+
+#[tokio::test]
+async fn a_card_of_ones_own_is_replaced_not_added_to_even_on_a_double_click() {
+    use portal::answers::{keep_newest_own, own_records, OWNER_FIELD};
+    let Ok(url) = std::env::var("PORTAL_TEST_NATS_URL") else {
+        eprintln!("skipped: PORTAL_TEST_NATS_URL is not set");
+        return;
+    };
+    let js = async_nats::jetstream::new(async_nats::connect(&url).await.expect("connect"));
+    ensure_stream(&js).await.expect("event stream");
+    let bucket = format!("own_{}", chrono::Utc::now().timestamp_millis());
+    let schemas = std::collections::HashMap::new();
+    let now = chrono::Utc::now().timestamp_millis();
+    let card = |name: &str, by: &str| json!({"name": name, OWNER_FIELD: by});
+
+    // Kari's first card, then two sends of her second pressed at once,
+    // and Ola's card beside them.
+    store_answer(&js, &schemas, &bucket, "k1".into(), "/kontor/ansatt", "a", &card("Kari", "kari"), now, 0).await.unwrap();
+    store_answer(&js, &schemas, &bucket, "o1".into(), "/kontor/ansatt", "a", &card("Ola", "ola"), now + 1, 0).await.unwrap();
+    store_answer(&js, &schemas, &bucket, "k2".into(), "/kontor/ansatt", "a", &card("Kari N.", "kari"), now + 2, 0).await.unwrap();
+    store_answer(&js, &schemas, &bucket, "k3".into(), "/kontor/ansatt", "a", &card("Kari N.", "kari"), now + 2, 0).await.unwrap();
+    // Both racing sends settle after storing; both must keep the same one.
+    let (a, b) = tokio::join!(keep_newest_own(&js, &bucket, "open", "kari"), keep_newest_own(&js, &bucket, "open", "kari"));
+    let _ = (a, b);
+
+    let kari = own_records(&js, &bucket, "kari").await;
+    assert_eq!(kari.iter().map(|a| a.id.as_str()).collect::<Vec<_>>(), vec!["k3"], "one card, the newest");
+    assert_eq!(own_records(&js, &bucket, "ola").await.len(), 1, "nobody else's card is touched");
+}