Release 0.3.6

A question may carry event: {starts, duration, place}. While the
window is open the page is announced in a strip at the top of every
header (name, when, 'in 3 days'), soonest first, and kept out of the
footer nav; when it closes the page becomes a followup - only a
visitor carrying an answer chain still sees it.

announce.rs keeps one record per event page in the runtime-owned
portal_events bucket (built-in state graph: announced ->
awaiting_summary -> summarized, content may override) and, on a
one-minute idempotent sweep, moves ended windows to awaiting_summary,
publishing the transition on portal.answers.submitted as 'Summary
due' - the post-what-happened task a review desk picks up. Lint
warns when event pages exist but nothing reads portal_events.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/publish.yml

@@ -68,11 +68,14 @@ jobs:
           stage=$(mktemp -d)
           cp "$CARGO_TARGET_DIR/release/portal" "$stage/portal"
           cp "$CARGO_TARGET_DIR/release/question_lint" "$stage/question_lint"
+          # hash-files = true: leptos resolves hash.txt next to the running
+          # binary, so it ships beside portal in the release dir.
+          cp "$CARGO_TARGET_DIR/release/hash.txt" "$stage/hash.txt"
           # site-root ("target/site" in Cargo.toml) is project-relative,
           # not affected by CARGO_TARGET_DIR - only the plain `cargo build`
           # outputs (release/, front/) move with that override.
           cp -r target/site "$stage/site"
-          tar -C "$stage" -czf "portal-$tag.tar.gz" portal question_lint site
+          tar -C "$stage" -czf "portal-$tag.tar.gz" portal question_lint hash.txt site
           rm -rf "$stage"
 
       # The run's own ephemeral token has write access to this repo -

Cargo.lock

@@ -2948,7 +2948,7 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.2.3"
+version = "0.3.6"
 dependencies = [
  "anyhow",
  "arc-swap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.2.3"
+version = "0.3.6"
 edition = "2021"
 
 [lib]
@@ -131,6 +131,12 @@ bin-default-features = false
 lib-features = ["hydrate"]
 lib-default-features = false
 lib-profile-release = "wasm-release"
+# Content-hashed pkg names (portal.<hash>.js/wasm/css) + hash.txt: a
+# freshly served page can never reference a stale cached bundle - an
+# iPhone kept a heuristically-cached portal.js across three releases
+# and paired it with new wasm, silently killing hydration. Runtime
+# needs LEPTOS_HASH_FILES=true (set in each content repo's deploy env).
+hash-files = true
 
 # cargo release <level> is how a portal version is cut: bump, commit,
 # tag v{{version}}, push. CI (publish.yml) reacts to the tag and

README.md

@@ -8,9 +8,12 @@ serves is declared in its content repo, and the same build serves any
 number of sites.
 
 Point an instance at a content repo and that repo *is* the site:
-pages, copy, state graphs, and branding (`site.yaml`: title,
-wordmark, and which hero the landing page opens on — the YES canvas,
-a gesture-drawing canvas wired to a relay, or plain copy). Content
+pages, copy, state graphs, branding, and even the landing hero
+(`site.yaml`: title, wordmark, and `hero: {kind: module, module:
+hero.js}` — a JavaScript module the content repo ships, served
+same-origin at `/site/<path>`, that portal mounts at parse time and
+stops on navigation; the YES canvas and redoal's sine swings are both
+content, not engine). Content
 pushes hot-reload every running instance; instances differ only by
 env vars. [uhhm.no](https://uhhm.no)
 ([uhhm/questions](https://project.uhhm.no/uhhm/questions)) and
@@ -36,6 +39,13 @@ stream.
   `requires_chain` gates a page on verifiable answer provenance next
   to `qualifies`' Kanidm-group identity gate (see
   `docs/design/filesystem-routes.md`).
+- **Announced pages** (`src/announce.rs`): a question with an
+  `event: {starts, duration, place}` window is announced in the
+  header (not the footer nav) while the window is open, becomes a
+  followup when it closes, and its record in the runtime-owned
+  `portal_events` bucket moves to `awaiting_summary` - a "post what
+  happened" task any review desk can read, published on NATS like a
+  decision. A one-minute sweeper keeps it all idempotent.
 - **State machines as content** (`src/aggregates/`): `aggregates.yaml`
   declares each bucket's states and legal transitions; the engine
   replays a record's event history and refuses undeclared moves, with
@@ -102,7 +112,10 @@ cargo release patch        # or minor / major
 That bumps `Cargo.toml`, tags `v<version>`, and pushes; CI
 (`.gitea/workflows/publish.yml`) reacts to the tag, builds once, and
 attaches `portal-v<version>.tar.gz` (`portal` + `question_lint` +
-`site/`) to the Gitea release. Plain pushes to `main` only run the
+`hash.txt` + `site/`) to the Gitea release. Pkg files are
+content-hashed (`hash-files = true`; instances run with
+`LEPTOS_HASH_FILES=true`), so a freshly served page can never pair a
+stale cached bundle with new wasm. Plain pushes to `main` only run the
 tests (`test.yml`) — nothing reaches production from this repo.
 
 **Roll it out** (in a content repo): edit one line in that repo's

gesture.js

@@ -12,8 +12,10 @@
 //
 // When a relay URL is given, the widget also speaks the redoal-relay
 // protocol (ADR-0013 in the redoal repo): announce the stroke, receive
-// an ack carrying the stroke's gesture key + the key's own decoded
-// path ("what the network heard", drawn as a ghost), and receive
+// an ack carrying the stroke's gesture key plus the key's own decoded
+// path - "what the network heard", drawn as a ghost under the stroke
+// when the key is v2 or later (ADR-0014's ordered turning chain; a v1
+// key's histogram decode is a blob and stays hidden) - and receive
 // echoes of similar strokes other visitors drew, shown as thumbnails.
 // Everything network is best-effort: no relay, refused connection, or
 // a dropped socket all degrade to a plain offline drawing input.
@@ -26,13 +28,13 @@
 const THEMES = {
     dark: {
         stroke: '#8ec2c0',
-        ghost: 'rgba(255, 255, 255, 0.28)',
         echo: '#8ec2c0',
+        ghost: 'rgba(255, 255, 255, 0.28)',
     },
     light: {
         stroke: '#47807e',
-        ghost: 'rgba(29, 29, 27, 0.30)',
         echo: '#47807e',
+        ghost: 'rgba(29, 29, 27, 0.30)',
     },
 };
 
@@ -42,14 +44,12 @@ const RECONNECT_BASE_MS = 1000;
 const RECONNECT_MAX_MS = 30000;
 
 class GestureWidget {
-    constructor(container, hidden, relayUrl, hero) {
+    constructor(container, hidden, relayUrl) {
         this.container = container;
         this.hidden = hidden || null;
         this.relayUrl = relayUrl || '';
-        this.hero = !!hero;
-        this.points = [];
         this.ghost = null;
-        this.ambient = []; // hero mode: echoed strokes drawn in place
+        this.points = [];
         this.drawing = false;
         this.stopped = false;
         this.ws = null;
@@ -60,11 +60,9 @@ class GestureWidget {
         this.canvas = document.createElement('canvas');
         this.canvas.className = 'gesture-canvas';
         container.appendChild(this.canvas);
-        if (!this.hero) {
         this.echoes = document.createElement('div');
         this.echoes.className = 'gesture-echoes';
         container.appendChild(this.echoes);
-        }
         if (this.relayUrl) {
             this.status = document.createElement('span');
             this.status.className = 'gesture-status offline';
@@ -115,11 +113,10 @@ class GestureWidget {
         e.preventDefault();
         this.canvas.setPointerCapture(e.pointerId);
         // One stroke only - a new pointerdown replaces the old drawing
-        // (and any ghost/ambient trails from the previous round).
+        // (and any ghost from the previous round).
         this.drawing = true;
-        this.points = [this.pos(e)];
         this.ghost = null;
-        this.ambient = [];
+        this.points = [this.pos(e)];
         this.render();
     }
 
@@ -220,17 +217,13 @@ class GestureWidget {
             if (this.points.length >= 2) {
                 this.setValue({ points: this.normalized(), key: msg.key });
             }
-            this.ghost = msg.path;
+            // Version nibble is the key's first hex digit.
+            const version = parseInt((msg.key || '0')[0], 16);
+            this.ghost = version >= 2 && Array.isArray(msg.path) ? msg.path : null;
             this.render();
         } else if (msg.type === 'echo') {
-            if (this.hero) {
-                this.ambient.push(msg.path);
-                if (this.ambient.length > MAX_ECHOES) this.ambient.shift();
-                this.render();
-            } else {
             this.addEchoThumbnail(msg);
         }
-        }
         // 'error' frames are intentionally silent: the widget is a
         // form field first, and a rate-limited announce shouldn't
         // alarm anyone mid-form.
@@ -284,11 +277,6 @@ class GestureWidget {
         if (!this.ctx) return;
         const t = this.theme();
         this.ctx.clearRect(0, 0, this.cssWidth, this.cssHeight);
-        for (const path of this.ambient) {
-            this.ctx.globalAlpha = 0.25;
-            this.drawPath(this.ctx, path, this.cssWidth, this.cssHeight, t.echo, 1.5, 0.2);
-        }
-        this.ctx.globalAlpha = 1;
         if (this.ghost) {
             this.drawPath(this.ctx, this.ghost, this.cssWidth, this.cssHeight, t.ghost, 2, 0.2);
         }
@@ -325,11 +313,5 @@ class GestureWidget {
 }
 
 export function mountGesture(container, hidden, relayUrl) {
-    return new GestureWidget(container, hidden, relayUrl, false);
-}
-
-// Hero variant: no form field to mirror into, and echoes render as
-// ambient strokes on the drawing canvas itself instead of thumbnails.
-export function mountGestureHero(container, relayUrl) {
-    return new GestureWidget(container, null, relayUrl, true);
+    return new GestureWidget(container, hidden, relayUrl);
 }

public/yes.js

@@ -1,578 +0,0 @@
-// Ported from ~/repos/webpage/content/visualize/ah.html ("YES - Rasterized
-// Lines"), the piece currently live at uhhm.no - kept as the actual asset,
-// not reinvented. Two changes from the original: exported as a class (no
-// auto-init on `window load`, since Leptos controls when this mounts) and
-// a `stop()` method that actually breaks the requestAnimationFrame loop -
-// the original ran forever once started, fine for a static page that's
-// the whole document, not fine in an SPA where this hero mounts/unmounts
-// as you navigate.
-
-export class RasterizedYES {
-    constructor() {
-        this.rasterCanvas = document.getElementById('rasterCanvas');
-        this.lineCanvas = document.getElementById('lineCanvas');
-
-        // The Rust side only constructs this once it's confirmed (via a
-        // NodeRef) that the canvas is mounted, but that guard has shown
-        // a real gap on fast client-side re-navigation back to `/` -
-        // this is the actual failure point, so it gets its own defense
-        // rather than depending on getting that timing exactly right
-        // from the other side of the wasm boundary. Leaving the
-        // instance otherwise-inert (no crash, no animation) rather than
-        // throwing mid-render - `stop()` already tolerates a partially
-        // (non-)initialized instance.
-        if (!this.rasterCanvas || !this.lineCanvas) {
-            console.warn('RasterizedYES: canvas not in DOM yet, skipping');
-            this.destroyed = true;
-            return;
-        }
-
-        this.rasterCtx = this.rasterCanvas.getContext('2d');
-        this.lineCtx = this.lineCanvas.getContext('2d');
-
-        this.lines = [];
-        this.rasterData = null;
-        this.isActive = true;
-        this.destroyed = false;
-        this.time = 0;
-
-        this.containmentStrength = 0.5;
-        this.wiggleAmount = 0.5;
-
-        // .hero-canvas is inset:0 inside this - freezing an inline
-        // height here (below) is what actually locks the box, not
-        // just reading its rect.
-        this.heroEl = this.rasterCanvas.closest('.hero');
-
-        this.setupCanvas();
-        this.setupResizeHandler();
-        this.setupDrift();
-        this.setupTheme();
-        this.setupScrollFade();
-        this.setupClickHandler();
-        this.rasterizeText();
-        this.initializeLines();
-        this.animate();
-    }
-
-    stop() {
-        this.destroyed = true;
-        if (this._resizeHandler) {
-            window.removeEventListener('resize', this._resizeHandler);
-        }
-        if (this._themeQuery) {
-            this._themeQuery.removeEventListener('change', this._themeHandler);
-        }
-        if (this._scrollHandler) {
-            window.removeEventListener('scroll', this._scrollHandler);
-        }
-    }
-
-    // The hero is position: sticky (main.css), so without this the
-    // title/wordmark stay pinned at the viewport bottom for the whole
-    // page and ghost through the translucent cards scrolling over
-    // them. Fade the copy out across the first half-screen of scroll;
-    // visibility: hidden at the end so the wordmark link can't be
-    // clicked while invisible.
-    setupScrollFade() {
-        this.heroCopy = this.heroEl ? this.heroEl.querySelector('.hero-copy') : null;
-        if (!this.heroCopy) return;
-        this._scrollHandler = () => {
-            const opacity = Math.max(0, 1 - window.scrollY / (this.displayHeight * 0.5));
-            this.heroCopy.style.opacity = opacity;
-            this.heroCopy.style.visibility = opacity <= 0.01 ? 'hidden' : '';
-        };
-        window.addEventListener('scroll', this._scrollHandler, { passive: true });
-        this._scrollHandler();
-    }
-
-    // Canvas paint can't read CSS custom properties, so the piece
-    // carries its own copy of both palettes and follows
-    // prefers-color-scheme itself - values must track main.css's :root
-    // (--paper especially: the fade fill IS the page background where
-    // the canvas shows through translucent cards). Dark keeps the
-    // original neon-on-black inks; light restates them as CMYK process
-    // inks dark enough to carry on paper, since 80%-lightness pastels
-    // vanish on white.
-    setupTheme() {
-        this._themeQuery = window.matchMedia('(prefers-color-scheme: light)');
-        this._themeHandler = () => {
-            this.applyTheme();
-            // Repaint the raster ghost in the new theme's ink and
-            // hard-clear the trails - a slow 3%-alpha fade from the
-            // old paper color would smear across the flip otherwise.
-            this.rasterizeText();
-            this.lineCtx.fillStyle = this.theme.paper;
-            this.lineCtx.fillRect(0, 0, this.displayWidth, this.displayHeight);
-        };
-        this._themeQuery.addEventListener('change', this._themeHandler);
-        this.applyTheme();
-    }
-
-    applyTheme() {
-        this.theme = this._themeQuery.matches
-            ? {
-                paper: '#f6f5f1',
-                fade: 'rgba(246, 245, 241, 0.03)',
-                // White ground so multiply (the light theme's CSS
-                // blend mode for #rasterCanvas) leaves the paper
-                // untouched; gray ink becomes the faint YES ghost.
-                rasterBg: '#ffffff',
-                rasterInk: '#6b6b6b',
-                strokes: [
-                    'hsla(185, 70%, 32%, 0.85)',
-                    'hsla(315, 60%, 38%, 0.85)',
-                    'hsla(50, 90%, 40%, 0.85)'
-                ]
-            }
-            : {
-                paper: '#0a0a0a',
-                fade: 'rgba(10, 10, 10, 0.03)',
-                rasterBg: '#111111',
-                rasterInk: '#ffffff',
-                strokes: [
-                    'hsla(180, 90%, 80%, 0.8)',
-                    'hsla(300, 90%, 80%, 0.8)',
-                    'hsla(60, 90%, 80%, 0.8)'
-                ]
-            };
-    }
-
-    // Reading .hero-canvas's rendered rect (a prior attempt at this)
-    // only helps if that rect actually stays put - and on real mobile
-    // Safari it didn't: .hero-copy (bottom-aligned via flexbox inside
-    // .hero-yes) kept sliding down as the address bar collapsed, even
-    // with a spec'd-stable viewport unit (svh, then lvh) driving the
-    // box's height. Either the browser isn't holding up its end, or
-    // something in the cascade is still landing on a live value - not
-    // provable from here without the device. Rather than keep
-    // guessing at which CSS viewport unit actually holds still, yes.js
-    // becomes the source of truth instead: it freezes .hero-yes's
-    // rendered height to a literal inline px value once, up front. An
-    // inline style always wins the cascade over the stylesheet's
-    // `height: 100svh`, so once this runs, nothing the browser does
-    // with that unit afterward can move the box - the number is fixed
-    // in the DOM, not recomputed from a unit at all.
-    setupCanvas() {
-        const pixelRatio = window.devicePixelRatio || 1;
-        const width = window.innerWidth;
-        const height = window.innerHeight;
-
-        if (this.heroEl) {
-            this.heroEl.style.height = height + 'px';
-        }
-
-        this.rasterCanvas.style.width = width + 'px';
-        this.rasterCanvas.style.height = height + 'px';
-        this.lineCanvas.style.width = width + 'px';
-        this.lineCanvas.style.height = height + 'px';
-
-        this.rasterCanvas.width = width * pixelRatio;
-        this.rasterCanvas.height = height * pixelRatio;
-        this.lineCanvas.width = width * pixelRatio;
-        this.lineCanvas.height = height * pixelRatio;
-
-        this.rasterCtx.scale(pixelRatio, pixelRatio);
-        this.lineCtx.scale(pixelRatio, pixelRatio);
-
-        this.displayWidth = width;
-        this.displayHeight = height;
-        this.pixelRatio = pixelRatio;
-    }
-
-    setupResizeHandler() {
-        // Gate on width, not height: mobile Safari's address-bar
-        // animation changes window.innerHeight continuously with no
-        // real layout change to react to (that's the live value this
-        // whole method exists to stop trusting). A genuine resize -
-        // orientation change, desktop window drag - always changes
-        // width too, so that's the real signal to re-freeze on.
-        this._resizeHandler = () => {
-            if (window.innerWidth === this.displayWidth) return;
-            this.setupCanvas();
-            this.rasterizeText();
-        };
-        window.addEventListener('resize', this._resizeHandler);
-    }
-
-    // The two behavior dials (containmentStrength from x, wiggleAmount
-    // from y) used to follow the pointer. Now a smooth noise field
-    // wanders them instead - the same 0..1 inputs a mouse would give,
-    // but drifting at cloud pace, so the piece breathes on its own and
-    // behaves identically with nobody touching it (which on a landing
-    // hero is most of the time, and on touch devices was always the
-    // case between taps). Value noise with two octaves: smooth
-    // (C1-continuous via smoothstep), never repeats visibly, no jumps.
-    setupDrift() {
-        const channel = (seed) => {
-            const rand = (i) => {
-                let h = Math.imul(i ^ seed, 2654435761) >>> 0;
-                h ^= h >>> 13;
-                h = Math.imul(h, 0x5bd1e995) >>> 0;
-                // The >>> 0 here is load-bearing: ^ yields a SIGNED
-                // 32-bit value, and without the reinterpret a set top
-                // bit made this "0..1" noise go as low as -0.5,
-                // pushing both dials below their intended floors.
-                h = (h ^ (h >>> 15)) >>> 0;
-                return h / 4294967296;
-            };
-            const noise = (t) => {
-                const i = Math.floor(t);
-                const f = t - i;
-                const s = f * f * (3 - 2 * f);
-                return rand(i) * (1 - s) + rand(i + 1) * s;
-            };
-            // Two octaves, renormalized to 0..1: the slow octave sets
-            // the overall weather, the faster one keeps it from
-            // feeling like a pendulum.
-            return (t) => (noise(t) * 2 / 3 + noise(t * 2.7 + 913) * 1 / 3);
-        };
-
-        // One full "weather change" roughly every DRIFT_PERIOD
-        // seconds per octave - the pace of watching clouds, not of a
-        // hand on a mouse.
-        this.driftPeriod = 25;
-        this.driftX = channel(0x9e3779b9);
-        this.driftY = channel(0x85ebca6b);
-
-        this.containmentStrength = 0.55;
-        this.wiggleAmount = 1.05;
-    }
-
-    updateDrift() {
-        const t = this.time / this.driftPeriod;
-        const x = this.driftX(t);
-        const y = this.driftY(t);
-        // Same mapping the mouse position used to feed.
-        this.containmentStrength = 0.1 + (x * 0.9);
-        this.wiggleAmount = 0.1 + (y * 1.9);
-    }
-
-    setupClickHandler() {
-        this.lineCanvas.addEventListener('click', () => {
-            this.restartAnimation();
-        });
-    }
-
-    restartAnimation() {
-        this.time = 0;
-        this.lineCtx.fillStyle = this.theme.paper;
-        this.lineCtx.fillRect(0, 0, this.displayWidth, this.displayHeight);
-        this.initializeLines();
-        this.isActive = true;
-    }
-
-    rasterizeText() {
-        const width = this.displayWidth;
-        const height = this.displayHeight;
-
-        const aspectRatio = width / height;
-        let fontSize;
-        if (aspectRatio < 1) {
-            fontSize = width * 0.4;
-        } else {
-            fontSize = height * 0.5;
-        }
-
-        this.fontSize = fontSize;
-
-        this.rasterCtx.font = `bold ${fontSize}px Arial, sans-serif`;
-        this.rasterCtx.textAlign = 'left';
-        this.rasterCtx.textBaseline = 'middle';
-
-        const fullTextMetrics = this.rasterCtx.measureText('YES');
-        const textWidth = fullTextMetrics.width;
-        const textStartX = (width - textWidth) / 2;
-        const textY = height / 2;
-
-        const letters = ['Y', 'E', 'S'];
-        this.letterPositions = [];
-        let currentX = textStartX;
-
-        for (let i = 0; i < letters.length; i++) {
-            const letterMetrics = this.rasterCtx.measureText(letters[i]);
-            this.letterPositions[i] = {
-                x: currentX,
-                y: textY,
-                width: letterMetrics.width,
-                centerX: currentX + letterMetrics.width / 2
-            };
-            currentX += letterMetrics.width;
-        }
-
-        this.letterRasters = [];
-
-        for (let i = 0; i < 3; i++) {
-            this.rasterCtx.fillStyle = '#111';
-            this.rasterCtx.fillRect(0, 0, width, height);
-
-            this.rasterCtx.fillStyle = '#ffffff';
-            this.rasterCtx.fillText(letters[i], this.letterPositions[i].x, this.letterPositions[i].y);
-
-            this.letterRasters[i] = this.rasterCtx.getImageData(0, 0, this.rasterCanvas.width, this.rasterCanvas.height);
-        }
-
-        // The visible layer, distinct from the letterRasters sampled
-        // above (those stay #111/#fff - isInSpecificLetter's red>128
-        // test depends on it): painted in theme ink so the ghost works
-        // under the theme's blend mode (overlay on dark, multiply on
-        // light - see #rasterCanvas in main.css).
-        this.rasterCtx.fillStyle = this.theme.rasterBg;
-        this.rasterCtx.fillRect(0, 0, width, height);
-        this.rasterCtx.fillStyle = this.theme.rasterInk;
-        this.rasterCtx.fillText('YES', textStartX, textY);
-
-        this.rasterData = this.rasterCtx.getImageData(0, 0, this.rasterCanvas.width, this.rasterCanvas.height);
-    }
-
-    isInSpecificLetter(x, y, letterIndex) {
-        const canvasX = x * this.pixelRatio;
-        const canvasY = y * this.pixelRatio;
-
-        if (!this.letterRasters || !this.letterRasters[letterIndex] ||
-            canvasX < 0 || canvasY < 0 ||
-            canvasX >= this.rasterCanvas.width || canvasY >= this.rasterCanvas.height) {
-            return false;
-        }
-
-        const index = (Math.floor(canvasY) * this.rasterCanvas.width + Math.floor(canvasX)) * 4;
-        const red = this.letterRasters[letterIndex].data[index];
-        return red > 128;
-    }
-
-    initializeLines() {
-        this.lines = [];
-        const numLines = 60;
-
-        const letterCentroids = this.calculateLetterCentroids();
-
-        for (let i = 0; i < numLines; i++) {
-            const letterIndex = Math.floor(i / (numLines / 3));
-            let startX, startY, centerX, centerY;
-
-            if (letterCentroids[letterIndex]) {
-                centerX = letterCentroids[letterIndex].x;
-                centerY = letterCentroids[letterIndex].y;
-
-                const startVariation = this.fontSize * 0.1;
-                startX = centerX + (Math.random() - 0.5) * startVariation;
-                startY = centerY + (Math.random() - 0.5) * startVariation;
-
-                if (!this.isInSpecificLetter(startX, startY, letterIndex)) {
-                    const nearestPoint = this.findNearestSpecificLetterPixel(startX, startY, letterIndex);
-                    if (nearestPoint) {
-                        startX = nearestPoint.x;
-                        startY = nearestPoint.y;
-                    } else {
-                        startX = centerX;
-                        startY = centerY;
-                    }
-                }
-            } else {
-                const letterPos = this.letterPositions[letterIndex];
-                startX = letterPos.centerX;
-                startY = letterPos.y;
-                centerX = startX;
-                centerY = startY;
-            }
-
-            // Stroke color lives on the theme, looked up per frame by
-            // letterIndex (see draw()) - not frozen per line - so a
-            // theme flip recolors live lines instead of leaving
-            // dark-theme neon smearing across light paper.
-            this.lines.push({
-                relativeX: (startX - centerX) / this.fontSize,
-                relativeY: (startY - centerY) / this.fontSize,
-                prevRelativeX: (startX - centerX) / this.fontSize,
-                prevRelativeY: (startY - centerY) / this.fontSize,
-                angle: Math.random() * Math.PI * 2,
-                letterIndex: letterIndex,
-                lastSeenInside: { x: (startX - centerX) / this.fontSize, y: (startY - centerY) / this.fontSize },
-                outsideDuration: 0
-            });
-        }
-    }
-
-    calculateLetterCentroids() {
-        const centroids = [];
-
-        for (let letterIndex = 0; letterIndex < 3; letterIndex++) {
-            let sumX = 0, sumY = 0, count = 0;
-
-            const letterPos = this.letterPositions[letterIndex];
-            const searchStartX = Math.max(0, letterPos.x - this.fontSize * 0.1);
-            const searchEndX = Math.min(this.displayWidth, letterPos.x + letterPos.width + this.fontSize * 0.1);
-            const searchStartY = Math.max(0, letterPos.y - this.fontSize * 0.6);
-            const searchEndY = Math.min(this.displayHeight, letterPos.y + this.fontSize * 0.6);
-
-            const step = Math.max(1, Math.floor(this.fontSize * 0.02));
-            for (let y = searchStartY; y <= searchEndY; y += step) {
-                for (let x = searchStartX; x <= searchEndX; x += step) {
-                    if (this.isInSpecificLetter(x, y, letterIndex)) {
-                        sumX += x;
-                        sumY += y;
-                        count++;
-                    }
-                }
-            }
-
-            if (count > 0) {
-                centroids[letterIndex] = {
-                    x: sumX / count,
-                    y: sumY / count
-                };
-            } else {
-                centroids[letterIndex] = {
-                    x: letterPos.centerX,
-                    y: letterPos.y
-                };
-            }
-        }
-
-        return centroids;
-    }
-
-    updateLines() {
-        this.time += 0.016;
-        this.updateDrift();
-        if (!this.isActive) return;
-
-        const letterCentroids = this.calculateLetterCentroids();
-
-        this.lines.forEach(line => {
-            line.prevRelativeX = line.relativeX;
-            line.prevRelativeY = line.relativeY;
-
-            const centroid = letterCentroids[line.letterIndex];
-            if (!centroid) return;
-
-            const currentX = centroid.x + line.relativeX * this.fontSize;
-            const currentY = centroid.y + line.relativeY * this.fontSize;
-
-            const currentlyInside = this.isInSpecificLetter(currentX, currentY, line.letterIndex);
-
-            if (currentlyInside) {
-                line.outsideDuration = 0;
-                line.lastSeenInside = { x: line.relativeX, y: line.relativeY };
-            } else {
-                line.outsideDuration++;
-            }
-
-            const visionDistance = 0.08 * this.fontSize;
-            const centerX = currentX + Math.cos(line.angle) * visionDistance;
-            const centerY = currentY + Math.sin(line.angle) * visionDistance;
-            const leftX = currentX + Math.cos(line.angle - 0.4) * visionDistance;
-            const leftY = currentY + Math.sin(line.angle - 0.4) * visionDistance;
-            const rightX = currentX + Math.cos(line.angle + 0.4) * visionDistance;
-            const rightY = currentY + Math.sin(line.angle + 0.4) * visionDistance;
-
-            const centerSees = this.isInSpecificLetter(centerX, centerY, line.letterIndex);
-            const leftSees = this.isInSpecificLetter(leftX, leftY, line.letterIndex);
-            const rightSees = this.isInSpecificLetter(rightX, rightY, line.letterIndex);
-
-            let speed = 0.02;
-
-            const attractionThreshold = Math.floor(15 + (1 - this.containmentStrength) * 45);
-
-            if (line.outsideDuration > attractionThreshold) {
-                const targetX = line.lastSeenInside.x;
-                const targetY = line.lastSeenInside.y;
-                const deltaX = targetX - line.relativeX;
-                const deltaY = targetY - line.relativeY;
-                const angleToTarget = Math.atan2(deltaY, deltaX);
-
-                let angleDiff = angleToTarget - line.angle;
-                while (angleDiff > Math.PI) angleDiff -= 2 * Math.PI;
-                while (angleDiff < -Math.PI) angleDiff += 2 * Math.PI;
-
-                const baseAttraction = Math.min(0.4, line.outsideDuration / 80);
-                const attractionStrength = baseAttraction * this.containmentStrength;
-                line.angle += angleDiff * attractionStrength;
-            }
-
-            if (centerSees) {
-                const baseWiggle = 0.15;
-                line.angle += (Math.random() - 0.5) * baseWiggle * this.wiggleAmount;
-            } else {
-                speed *= (0.3 + this.containmentStrength * 0.4);
-
-                const baseTurnStrength = 0.3 + (this.containmentStrength * 0.4);
-                const randomTurnAmount = 0.2 * this.wiggleAmount;
-
-                if (leftSees && !rightSees) {
-                    line.angle -= baseTurnStrength + Math.random() * randomTurnAmount;
-                } else if (rightSees && !leftSees) {
-                    line.angle += baseTurnStrength + Math.random() * randomTurnAmount;
-                } else {
-                    const randomTurn = (Math.random() - 0.5) * (0.8 + this.wiggleAmount * 0.7);
-                    line.angle += randomTurn;
-                }
-            }
-
-            line.relativeX += Math.cos(line.angle) * speed;
-            line.relativeY += Math.sin(line.angle) * speed;
-
-            line.relativeX = Math.max(-1.7, Math.min(1.7, line.relativeX));
-            line.relativeY = Math.max(-1.7, Math.min(1.7, line.relativeY));
-        });
-    }
-
-    findNearestSpecificLetterPixel(x, y, letterIndex) {
-        const searchRadius = this.fontSize * 0.08;
-        const step = Math.max(1, Math.floor(this.fontSize * 0.01));
-        let nearestPoint = null;
-        let nearestDistance = Infinity;
-
-        for (let dy = -searchRadius; dy <= searchRadius; dy += step) {
-            for (let dx = -searchRadius; dx <= searchRadius; dx += step) {
-                const testX = x + dx;
-                const testY = y + dy;
-
-                if (this.isInSpecificLetter(testX, testY, letterIndex)) {
-                    const distance = Math.sqrt(dx * dx + dy * dy);
-                    if (distance < nearestDistance) {
-                        nearestDistance = distance;
-                        nearestPoint = { x: testX, y: testY };
-                    }
-                }
-            }
-        }
-
-        return nearestPoint;
-    }
-
-    draw() {
-        this.lineCtx.fillStyle = this.theme.fade;
-        this.lineCtx.fillRect(0, 0, this.displayWidth, this.displayHeight);
-
-        const letterCentroids = this.calculateLetterCentroids();
-
-        this.lines.forEach(line => {
-            const centroid = letterCentroids[line.letterIndex];
-            if (!centroid) return;
-
-            const currentX = centroid.x + line.relativeX * this.fontSize;
-            const currentY = centroid.y + line.relativeY * this.fontSize;
-            const prevX = centroid.x + line.prevRelativeX * this.fontSize;
-            const prevY = centroid.y + line.prevRelativeY * this.fontSize;
-
-            if (prevX === currentX && prevY === currentY) return;
-
-            this.lineCtx.strokeStyle = this.theme.strokes[line.letterIndex];
-            this.lineCtx.lineWidth = this.fontSize * 0.003;
-            this.lineCtx.lineCap = 'round';
-
-            this.lineCtx.beginPath();
-            this.lineCtx.moveTo(prevX, prevY);
-            this.lineCtx.lineTo(currentX, currentY);
-            this.lineCtx.stroke();
-        });
-    }
-
-    animate() {
-        if (this.destroyed) return;
-        this.updateLines();
-        this.draw();
-        requestAnimationFrame(() => this.animate());
-    }
-}

src/announce.rs

@@ -0,0 +1,147 @@
+//! Announced pages (`Question.event`): keeps one `portal_events` record
+//! per event question and, once a window closes, moves it to
+//! `awaiting_summary` - the "post what happened" task - publishing the
+//! transition on `portal.answers.submitted` like any desk decision, so
+//! the desktop notifier and n8n hear it. Runs on a one-minute tick;
+//! every step is idempotent, so a restart or a content reload in the
+//! middle changes nothing.
+
+use crate::answers::{store_answer, Answer};
+use crate::content::EVENTS_BUCKET;
+use crate::events::{emit_answer_submitted, AnswerSubmitted};
+use crate::server::AppState;
+
+/// Alternative name stamped on the auto-created record and on the
+/// transition event - what an n8n workflow gates on.
+pub const EVENT_ALTERNATIVE: &str = "Announced";
+pub const SUMMARY_DUE_LABEL: &str = "Summary due";
+
+/// Record id for an event question: its id with `/` folded to `-`
+/// (`/events/opening` -> `events-opening`), so one page is one record
+/// however many times the sweeper runs.
+pub fn record_id(question_id: &str) -> String {
+    question_id.trim_matches('/').replace('/', "-")
+}
+
+pub async fn run(state: AppState) {
+    let mut tick = tokio::time::interval(std::time::Duration::from_secs(60));
+    loop {
+        tick.tick().await;
+        if let Err(e) = sweep(&state).await {
+            tracing::warn!(error = %e, "event sweep failed");
+        }
+    }
+}
+
+/// One pass: create missing records, close ended windows.
+pub async fn sweep(state: &AppState) -> anyhow::Result<()> {
+    let now_ms = chrono::Utc::now().timestamp_millis();
+    let questions = state.questions.load();
+    let events: Vec<_> = questions.values().filter(|q| q.event.is_some()).cloned().collect();
+    if events.is_empty() {
+        return Ok(());
+    }
+    let aggregates = state.aggregates.load();
+    let schema = aggregates
+        .get(EVENTS_BUCKET)
+        .ok_or_else(|| anyhow::anyhow!("no {EVENTS_BUCKET} schema"))?;
+    let store = match state.jetstream.get_key_value(EVENTS_BUCKET).await {
+        Ok(store) => Some(store),
+        Err(_) => None,
+    };
+
+    for q in events {
+        let event = q.event.as_ref().expect("filtered");
+        let (starts, ends) = match event.window_ms() {
+            Ok(w) => w,
+            Err(_) => continue, // validated on load; belt and braces
+        };
+        let id = record_id(&q.id);
+        let existing: Option<Answer> = match &store {
+            Some(store) => store
+                .get(&id)
+                .await?
+                .and_then(|bytes| serde_json::from_slice(&bytes).ok()),
+            None => None,
+        };
+        let responses = serde_json::json!({
+            "name": q.name,
+            "starts": event.starts,
+            "starts_ms": starts,
+            "ends_ms": ends,
+            "place": event.place,
+            "page": q.id,
+        });
+
+        let answer = match existing {
+            None => {
+                store_answer(
+                    &state.jetstream,
+                    &aggregates,
+                    EVENTS_BUCKET,
+                    id.clone(),
+                    &q.id,
+                    EVENT_ALTERNATIVE,
+                    &responses,
+                    now_ms,
+                )
+                .await?;
+                tracing::info!(question = %q.id, "event record created");
+                continue;
+            }
+            Some(a) => a,
+        };
+
+        if answer.state == schema.initial && now_ms >= ends {
+            let target = "awaiting_summary";
+            let payload = serde_json::json!({ "to": target, "item": id, "by": "portal" });
+            match crate::aggregates::transition(&state.jetstream, schema, &id, target, payload.clone(), now_ms).await {
+                Ok(_) => {}
+                Err(crate::aggregates::TransitionError::UnknownAggregate) => {
+                    crate::aggregates::reseed(&state.jetstream, schema, &id, &answer.state, now_ms)
+                        .await
+                        .map_err(|e| anyhow::anyhow!("{e}"))?;
+                    crate::aggregates::transition(&state.jetstream, schema, &id, target, payload.clone(), now_ms)
+                        .await
+                        .map_err(|e| anyhow::anyhow!("{e}"))?;
+                }
+                Err(e) => return Err(anyhow::anyhow!("{e}")),
+            }
+            let mut answer = answer;
+            answer.state = target.to_string();
+            answer.decided_ms = Some(now_ms);
+            answer.decided_by = Some("portal".to_string());
+            let store = state.jetstream.get_key_value(EVENTS_BUCKET).await?;
+            store.put(&id, serde_json::to_vec(&answer)?.into()).await?;
+
+            let parent_hashes = vec![id.clone()];
+            let chain_hash = crate::chain::hash_node(&q.id, &parent_hashes, &payload, now_ms);
+            emit_answer_submitted(
+                &state.nats,
+                &AnswerSubmitted {
+                    chain_hash,
+                    parent_hashes,
+                    question_id: q.id.clone(),
+                    alternative: SUMMARY_DUE_LABEL.to_string(),
+                    responses: payload,
+                    timestamp_ms: now_ms,
+                },
+            )
+            .await?;
+            tracing::info!(question = %q.id, "event ended - summary due");
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::record_id;
+
+    #[test]
+    fn record_id_is_stable_and_flat() {
+        assert_eq!(record_id("/events/opening"), "events-opening");
+        assert_eq!(record_id("/"), "");
+        assert_eq!(record_id("/opening"), "opening");
+    }
+}

src/app.rs

@@ -1,5 +1,5 @@
 use leptos::prelude::*;
-use leptos_meta::{provide_meta_context, MetaTags, Stylesheet, Title};
+use leptos_meta::{provide_meta_context, HashedStylesheet, MetaTags, Title};
 use leptos_router::{
     components::{Route, Router, Routes},
     hooks::{use_location, use_navigate, use_query_map},
@@ -39,6 +39,9 @@ pub fn shell(options: LeptosOptions) -> impl IntoView {
                 // once loaded via <link>/<img> on Safari/iOS.
                 <link rel="icon" media="(prefers-color-scheme: light)" href="/favicon-light.svg" type="image/svg+xml"/>
                 <link rel="icon" media="(prefers-color-scheme: dark)" href="/favicon-dark.svg" type="image/svg+xml"/>
+                // Server-side, so it can read hash.txt and link the
+                // content-hashed stylesheet (hash-files = true).
+                <HashedStylesheet id="leptos" options=options.clone()/>
                 <AutoReload options=options.clone()/>
                 <HydrationScripts options/>
                 <MetaTags/>
@@ -67,7 +70,6 @@ pub fn App() -> impl IntoView {
     provide_context(site);
 
     view! {
-        <Stylesheet id="leptos" href="/pkg/portal.css"/>
         <Suspense fallback=|| ()>
             {move || {
                 site.get()
@@ -96,6 +98,21 @@ struct QuestionRes(Resource<Result<Option<Page>, ServerFnError>>);
 struct UserRes(Resource<Result<Option<User>, ServerFnError>>);
 #[derive(Clone, Copy)]
 struct NavRes(Resource<Result<Vec<(String, String)>, ServerFnError>>);
+#[derive(Clone, Copy)]
+struct AnnounceRes(Resource<Result<Vec<Announcement>, ServerFnError>>);
+
+/// One live announced page (`Question.event`), pre-formatted on the
+/// server so both renders agree and no client clock is involved.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Announcement {
+    pub id: String,
+    pub name: String,
+    /// "Sat 12 Sep, 18:00"
+    pub when: String,
+    /// "in 3 days" / "in 4 h" / "now"
+    pub relative: String,
+    pub place: Option<String>,
+}
 
 /// Owns the app's data resources, above the routes and reactive on the
 /// location instead of recreated per page. Route components creating
@@ -127,9 +144,11 @@ fn PortalShell() -> impl IntoView {
     );
     let user = Resource::new(|| (), |_| current_user());
     let nav = Resource::new(move || chain.get().is_some(), list_qualifying_questions);
+    let announcements = Resource::new(|| (), |_| list_announcements());
     provide_context(QuestionRes(question));
     provide_context(UserRes(user));
     provide_context(NavRes(nav));
+    provide_context(AnnounceRes(announcements));
 
     view! {
         <Routes fallback=|| view! { <NotFound/> }>
@@ -200,6 +219,7 @@ fn QuestionView(
     site: SiteConfig,
 ) -> impl IntoView {
     let question_id = question.id.clone();
+    let has_chain = parent_hash.is_some();
 
     // The provenance counterpart to the qualifies gate below: a
     // requires_chain page whose visitor holds no verifiable lineage to
@@ -216,6 +236,7 @@ fn QuestionView(
                 title=question.name.clone()
                 description=question.description.clone()
                 landing=question_id == "/"
+                current_id=question_id.clone()
                 site=site.clone()
             />
             <div class="alternatives">
@@ -226,6 +247,8 @@ fn QuestionView(
                     </a>
                 </section>
             </div>
+            // A gate is never a dead end: the same nav as every page.
+            <QuestionNav current_id=question_id has_chain=has_chain/>
         }
         .into_any();
     }
@@ -240,6 +263,7 @@ fn QuestionView(
                 title=question.name.clone()
                 description=question.description.clone()
                 landing=question_id == "/"
+                current_id=question_id.clone()
                 site=site.clone()
             />
             <div class="alternatives">
@@ -261,6 +285,7 @@ fn QuestionView(
                     }}
                 </section>
             </div>
+            <QuestionNav current_id=question_id has_chain=has_chain/>
         }
         .into_any();
     }
@@ -270,7 +295,6 @@ fn QuestionView(
     // on pages where some alternative actually declares a deck.
     let needs_swiper = question.alternatives.iter().any(|a| a.images.len() > 1);
 
-    let has_chain = parent_hash.is_some();
 
     view! {
         {needs_swiper.then(|| view! { <leptos_meta::Script src="/swiper-element-bundle.min.js"/> })}
@@ -279,6 +303,7 @@ fn QuestionView(
             description=question.description.clone()
             landing=question_id == "/"
             site=site.clone()
+            current_id=question_id.clone()
         />
         <div class="alternatives">
             <For
@@ -362,6 +387,45 @@ fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
     }
 }
 
+/// Live announced pages, as a strip at the top of the header - the one
+/// place a page gets to claim attention before the question. Empty
+/// (and unrendered) when nothing is announced.
+#[component]
+fn Announcements(current_id: String) -> impl IntoView {
+    let AnnounceRes(announcements) = expect_context();
+    view! {
+        <Suspense fallback=|| ()>
+            {move || {
+                let current_id = current_id.clone();
+                announcements.get().and_then(|res| res.ok()).map(|items| {
+                    (!items.is_empty()).then(|| view! {
+                        <nav class="announce" aria-label="Announcements">
+                            <For
+                                each=move || items.clone()
+                                key=|a| a.id.clone()
+                                children=move |a: Announcement| {
+                                    let current = a.id == current_id;
+                                    view! {
+                                        <a href=a.id.clone() class="announce-item" aria-current=current.then_some("page")>
+                                            <span class="announce-name">{a.name}</span>
+                                            <span class="announce-when">
+                                                {a.when}
+                                                {a.place.map(|p| format!(" · {p}"))}
+                                            </span>
+                                            <span class="announce-relative">{a.relative}</span>
+                                        </a>
+                                    }
+                                    .into_any()
+                                }
+                            />
+                        </nav>
+                    })
+                })
+            }}
+        </Suspense>
+    }
+}
+
 /// "Asked by X — contact them if you get stuck."
 /// The mailto address is assembled from `data-user`/`data-domain` on a
 /// real mouse event, never baked into the server-rendered `href` -
@@ -404,32 +468,6 @@ fn ResponsibleNote(responsible: Responsible) -> impl IntoView {
     }
 }
 
-// Binds the actual "YES - Rasterized Lines" piece live at uhhm.no
-// (ported to `public/yes.js`, an ES module now instead of a page-owning
-// script) as a typed JS class - the idiomatic wasm-bindgen way to drive
-// an existing JS module from Rust, rather than re-implementing canvas
-// animation logic here.
-#[cfg(feature = "hydrate")]
-mod yes {
-    use wasm_bindgen::prelude::*;
-
-    // raw_module (a runtime URL, not a bundled snippet) on purpose:
-    // the file lives in public/ so it's served at the stable /yes.js
-    // - the same URL the hero's inline early-mount script imports.
-    // A bundled snippet would sit under a per-build hashed
-    // /pkg/snippets/ path the inline script couldn't know.
-    #[wasm_bindgen(raw_module = "/yes.js")]
-    extern "C" {
-        #[wasm_bindgen(js_name = RasterizedYES)]
-        pub type RasterizedYes;
-
-        #[wasm_bindgen(constructor, js_class = "RasterizedYES")]
-        pub fn new() -> RasterizedYes;
-
-        #[wasm_bindgen(method)]
-        pub fn stop(this: &RasterizedYes);
-    }
-}
 
 // Same idiomatic-typed-module approach as `yes` above, for the
 // prosekit-backed rich-text requirement kind (`prosekit-editor.js`,
@@ -475,144 +513,111 @@ mod gesture {
             relay_url: &str,
         ) -> GestureWidget;
 
-        #[wasm_bindgen(js_name = mountGestureHero)]
-        pub fn mount_gesture_hero(
-            container: &web_sys::HtmlDivElement,
-            relay_url: &str,
-        ) -> GestureWidget;
-
         #[wasm_bindgen(method)]
         pub fn stop(this: &GestureWidget);
     }
 }
 
 #[component]
-fn Hero(title: String, description: String, landing: bool, site: SiteConfig) -> impl IntoView {
-    // Only the landing page gets a full interactive piece - it's the
-    // one page a hero is actually "the" hero for; other pages
-    // (thank-you pages, /review) get the plain dark header below.
-    // WHICH piece is the content repo's call (`site.yaml`'s
-    // hero.kind): the YES canvas (default - uhhm's look), a redoal
-    // gesture canvas, or nothing.
-    let hero_kind = if landing { site.hero.kind.clone() } else { "plain".to_string() };
-    let show_yes = hero_kind == "yes";
-    let show_gesture = hero_kind == "gesture";
+fn Hero(title: String, description: String, landing: bool, site: SiteConfig, current_id: String) -> impl IntoView {
+    // Only the landing page gets a piece - it's the one page a hero is
+    // actually "the" hero for; every other page gets the plain header.
+    // WHAT the piece is belongs to the content repo: site.yaml's
+    // `hero: {kind: module, module: hero.js}` names a JavaScript module
+    // (served same-origin at /site/<path>) exporting
+    // `mount(container) -> handle` with `handle.stop()`. Portal knows
+    // nothing about what it draws.
+    let module = if landing && site.hero.kind == "module" {
+        site.hero.module.clone()
+    } else {
+        None
+    };
+    let has_module = module.is_some();
     let wordmark = site.wordmark.clone().unwrap_or_else(|| "/wordmark.svg".to_string());
     let site_title = site.title.clone().unwrap_or_else(|| SITE_NAME.to_string());
 
-    // Starts the YES animation once the canvas elements exist, and
-    // explicitly stops the requestAnimationFrame loop on unmount - the
-    // original page-owning script never needed this since navigating
-    // away meant a full document unload, which doesn't happen in an
-    // SPA.
-    let raster_ref: NodeRef<leptos::html::Canvas> = NodeRef::new();
-    let gesture_ref: NodeRef<leptos::html::Div> = NodeRef::new();
+    let piece_ref: NodeRef<leptos::html::Div> = NodeRef::new();
     #[cfg(feature = "hydrate")]
-    if show_yes {
-        // `on_cleanup` requires Send + Sync (even single-threaded, wasm),
-        // which a JS-backed value never is - `StoredValue`'s `LocalStorage`
-        // variant is the established way around this (same pattern
-        // cnats' WebRTC call state uses for its own non-Send peer map).
-        let instance: StoredValue<Option<yes::RasterizedYes>, LocalStorage> =
-            StoredValue::new_local(None);
-        // Gated on the canvas NodeRef resolving, not just "the Effect
-        // ran" - on a fresh page load the DOM is already there by the
-        // time this fires, but navigating back to `/` client-side hit a
-        // real race: the Effect ran before the new view's <canvas> was
-        // actually inserted, RasterizedYES::new() (yes.js) did an
-        // unchecked `document.getElementById(...).getContext(...)` on
-        // null and threw mid-reactive-update - which then corrupted
-        // wasm_bindgen_futures' single-threaded executor state badly
-        // enough to panic ("RefCell already borrowed") on the next
-        // tick. Waiting for the NodeRef itself guarantees DOM presence
-        // the same way the prosekit editor's own mount Effect does.
-        Effect::new(move |_| {
-            if raster_ref.get().is_none() {
-                return;
-            }
-            if instance.with_value(|i| i.is_some()) {
-                return;
-            }
-            // Adopt the hero's inline early-mount instance (started at
-            // HTML parse time, long before this wasm was even fetched)
-            // instead of starting a second animation. The flag covers
-            // the opposite ordering too: an inline script that runs
-            // after this sees it and stays inert.
+    if has_module {
         use wasm_bindgen::JsCast;
+        // Handle = whatever the module's mount() returned; kept as a
+        // raw JsValue so the contract stays "has a stop()", nothing
+        // typed on the Rust side.
+        let handle: StoredValue<Option<wasm_bindgen::JsValue>, LocalStorage> =
+            StoredValue::new_local(None);
+        Effect::new(move |_| {
+            let Some(container) = piece_ref.get() else {
+                return;
+            };
+            if handle.with_value(|h| h.is_some()) {
+                return;
+            }
+            // Adopt the inline early-mount's instance (started at HTML
+            // parse time) if it's there; otherwise (client-side
+            // navigation back to /) mount fresh through the helper the
+            // inline script left on window. Either order is safe.
             let global = js_sys::global();
-            let _ = js_sys::Reflect::set(&global, &"__yesAdopted".into(), &true.into());
-            let early = js_sys::Reflect::get(&global, &"__yesEarly".into())
+            let _ = js_sys::Reflect::set(&global, &"__heroAdopted".into(), &true.into());
+            let early = js_sys::Reflect::get(&global, &"__heroEarly".into())
                 .ok()
                 .filter(|v| !v.is_undefined() && !v.is_null());
-            let inst = match early {
+            match early {
                 Some(v) => {
-                    let _ = js_sys::Reflect::delete_property(&global, &"__yesEarly".into());
-                    v.unchecked_into::<yes::RasterizedYes>()
+                    let _ = js_sys::Reflect::delete_property(&global, &"__heroEarly".into());
+                    handle.set_value(Some(v));
+                }
+                None => {
+                    if let Ok(mounter) = js_sys::Reflect::get(&global, &"__mountHero".into()) {
+                        if let Some(f) = mounter.dyn_ref::<js_sys::Function>() {
+                            if let Ok(promise) = f.call1(&global, &container) {
+                                let promise: js_sys::Promise = promise.unchecked_into();
+                                leptos::task::spawn_local(async move {
+                                    if let Ok(h) =
+                                        wasm_bindgen_futures::JsFuture::from(promise).await
+                                    {
+                                        handle.set_value(Some(h));
+                                    }
+                                });
+                            }
+                        }
+                    }
+                }
             }
-                None => yes::RasterizedYes::new(),
-            };
-            instance.set_value(Some(inst));
         });
         on_cleanup(move || {
-            instance.update_value(|opt| {
-                if let Some(inst) = opt.take() {
-                    inst.stop();
+            handle.update_value(|opt| {
+                if let Some(h) = opt.take() {
+                    if let Ok(stop) = js_sys::Reflect::get(&h, &"stop".into()) {
+                        if let Some(f) = stop.dyn_ref::<js_sys::Function>() {
+                            let _ = f.call0(&h);
+                        }
+                    }
                 }
             });
         });
     }
 
-    // The gesture hero mounts the same widget the `type: gesture`
-    // requirement uses, in hero mode (no form field; echoes render as
-    // ambient strokes on the canvas itself). Same StoredValue +
-    // on_cleanup shape as the YES piece - it may own a live WebSocket.
-    #[cfg(feature = "hydrate")]
-    if show_gesture {
-        let relay = site.hero.relay.clone().unwrap_or_default();
-        let widget: StoredValue<Option<gesture::GestureWidget>, LocalStorage> =
-            StoredValue::new_local(None);
-        Effect::new(move |_| {
-            let Some(container) = gesture_ref.get() else {
-                return;
-            };
-            if widget.with_value(|w| w.is_some()) {
-                return;
-            }
-            widget.set_value(Some(gesture::mount_gesture_hero(&container, &relay)));
+    // The inline script starts the piece at HTML parse time instead of
+    // waiting out the wasm bundle; it also leaves __mountHero for the
+    // hydrate side's client-side-navigation case. Module path is
+    // validated to plain segments by SiteConfig::validate, so it can't
+    // break out of the string here.
+    let early_script = module.as_ref().map(|m| {
+        format!(
+            "const url = '/site/{m}'; window.__mountHero = (el) => import(url).then((mod) => mod.mount(el)); if (!window.__heroAdopted && !window.__heroEarly) window.__mountHero(document.querySelector('.hero-piece')).then((h) => {{ if (!window.__heroAdopted) window.__heroEarly = h; else if (h && h.stop) h.stop(); }});"
+        )
     });
-        on_cleanup(move || {
-            widget.update_value(|opt| {
-                if let Some(w) = opt.take() {
-                    w.stop();
-                }
-            });
-        });
-    }
 
     view! {
-        <header class="hero" class:hero-yes=show_yes class:hero-gesture=show_gesture>
-            {show_yes
+        <header class="hero" class:hero-module=has_module>
+            <Announcements current_id=current_id/>
+            {has_module
                 .then(|| {
                     view! {
-                        <div class="hero-canvas" aria-hidden="true">
-                            <canvas id="lineCanvas"></canvas>
-                            <canvas id="rasterCanvas" node_ref=raster_ref></canvas>
-                        </div>
-                        // Starts the animation at HTML parse time
-                        // instead of waiting out the wasm bundle's
-                        // fetch + hydration; the hydrate Effect above
-                        // adopts (never duplicates) the instance, and
-                        // the guards make either execution order safe.
-                        <script
-                            type="module"
-                            inner_html="import('/yes.js').then((m) => { if (!window.__yesAdopted && !window.__yesEarly) window.__yesEarly = new m.RasterizedYES(); });"
-                        ></script>
+                        <div class="hero-piece" aria-hidden="true" node_ref=piece_ref></div>
+                        <script type="module" inner_html=early_script.unwrap_or_default()></script>
                     }
                 })}
-            {show_gesture
-                .then(|| {
-                    view! { <div class="hero-draw" node_ref=gesture_ref></div> }
-                })}
             <div class="hero-copy">
                 <a class="wordmark" href="/">
                     <img src=wordmark alt=site_title/>
@@ -955,6 +960,7 @@ fn AlternativeCard(
                                                 alternative=alt_name.clone()
                                                 feature_name=feature_name.clone()
                                                 transitions=spec.transitions.clone()
+                                                empty=spec.empty.clone()
                                                 pending_transitions=pending_transitions
                                                 transition_batch=transition_batch
                                             />
@@ -1231,7 +1237,17 @@ fn AlternativeCard(
                                     children=move |e| view! { <p class="alt-encouragement">{e}</p> }
                                 />
                             </div>
-                            {if is_gateway {
+                            {if alternative.disabled {
+                                // Advertised, not yet takeable: the label
+                                // stays (it says what will be possible),
+                                // the button doesn't act.
+                                view! {
+                                    <button type="button" class="alt-submit soon" disabled=true title="Not yet">
+                                        {button_label.clone()}
+                                    </button>
+                                }
+                                .into_any()
+                            } else if is_gateway {
                                 let href = alternative.action.clone().unwrap_or_default();
                                 view! {
                                     <a class="alt-submit" href=href>{button_label.clone()}</a>
@@ -1274,6 +1290,7 @@ fn ResourceFeature(
     alternative: String,
     feature_name: String,
     transitions: Vec<Transition>,
+    empty: Option<String>,
     pending_transitions: RwSignal<std::collections::HashMap<(String, String), String>>,
     transition_batch: ServerAction<TransitionAnswers>,
 ) -> impl IntoView {
@@ -1307,6 +1324,7 @@ fn ResourceFeature(
                 {move || {
                     let feature_name = feature_name.clone();
                     let transitions = transitions.clone();
+                    let empty = empty.clone().unwrap_or_else(|| "Nothing here yet.".to_string());
                     data.get()
                         .map(|res| match res {
                             Ok(value) => {
@@ -1314,6 +1332,7 @@ fn ResourceFeature(
                                     <ResourceValue
                                         feature_name=feature_name
                                         transitions=transitions
+                                        empty=empty
                                         value=value
                                         pending_transitions=pending_transitions
                                         transition_batch=transition_batch
@@ -1340,11 +1359,23 @@ fn ResourceFeature(
 fn ResourceValue(
     feature_name: String,
     transitions: Vec<Transition>,
+    empty: String,
     value: serde_json::Value,
     pending_transitions: RwSignal<std::collections::HashMap<(String, String), String>>,
     transition_batch: ServerAction<TransitionAnswers>,
 ) -> impl IntoView {
+    // A jq like `.[] | {...}` over an empty list yields no output at
+    // all - that arrives as null, and it's the same silence as [].
+    if value.is_null() {
+        return view! { <p class="resource-empty">{empty}</p> }.into_any();
+    }
     if let serde_json::Value::Array(items) = &value {
+        // Before the Answer parse below: an empty list deserializes as
+        // an (empty) Vec<Answer> too, and rendered as a blank
+        // answer-list instead of saying anything.
+        if items.is_empty() {
+            return view! { <p class="resource-empty">{empty}</p> }.into_any();
+        }
         if let Ok(answers) = serde_json::from_value::<Vec<Answer>>(value.clone()) {
             let mut answers = answers;
             answers.sort_by(|a, b| {
@@ -1377,9 +1408,6 @@ fn ResourceValue(
             }
             .into_any();
         }
-        if items.is_empty() {
-            return view! { <p class="resource-empty">"Nothing here yet."</p> }.into_any();
-        }
         // A list of plain objects (e.g. a jq-shaped GiteaStarred/Url
         // resource) - render as cards rather than dumping raw JSON.
         // Generic on purpose, no content-declared "kind": `name`/`title`
@@ -1847,12 +1875,17 @@ pub async fn list_qualifying_questions(
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
 
+    let now_ms = chrono::Utc::now().timestamp_millis();
     let mut out: Vec<(String, String)> = state
         .questions
         .load()
         .values()
         .filter(|q| is_qualified(user.as_ref(), q))
-        .filter(|q| !q.is_followup() || has_chain)
+        // An ended event page is a followup from then on - only a
+        // visitor carrying a chain (they answered it) still sees it.
+        .filter(|q| !(q.is_followup() || q.event_ended_at(now_ms)) || has_chain)
+        // A live event is announced in the header instead.
+        .filter(|q| !q.event_live_at(now_ms))
         // A dynamic page has no URL of its own to link to.
         .filter(|q| !q.is_dynamic())
         .map(|q| (q.id.clone(), q.name.clone()))
@@ -1861,6 +1894,67 @@ pub async fn list_qualifying_questions(
     Ok(out)
 }
 
+/// Every announced page whose window is still open and that the
+/// visitor qualifies for, soonest first.
+#[server(endpoint = "list_announcements")]
+pub async fn list_announcements() -> Result<Vec<Announcement>, ServerFnError> {
+    use crate::auth::{User, SESSION_USER_KEY};
+    use crate::content::is_qualified;
+    use crate::server::AppState;
+
+    let state = expect_context::<AppState>();
+    let session: tower_sessions::Session = leptos_axum::extract().await?;
+    let user = session
+        .get::<User>(SESSION_USER_KEY)
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let now_ms = chrono::Utc::now().timestamp_millis();
+
+    let mut live: Vec<(i64, Announcement)> = state
+        .questions
+        .load()
+        .values()
+        .filter(|q| is_qualified(user.as_ref(), q) && q.event_live_at(now_ms))
+        .filter_map(|q| {
+            let event = q.event.as_ref()?;
+            let starts = chrono::DateTime::parse_from_rfc3339(&event.starts).ok()?;
+            let starts_ms = starts.timestamp_millis();
+            let relative = relative_until(starts_ms - now_ms);
+            Some((
+                starts_ms,
+                Announcement {
+                    id: q.id.clone(),
+                    name: q.name.clone(),
+                    when: starts.format("%a %-d %b, %H:%M").to_string(),
+                    relative,
+                    place: event.place.clone(),
+                },
+            ))
+        })
+        .collect();
+    live.sort_by_key(|(starts, _)| *starts);
+    Ok(live.into_iter().map(|(_, a)| a).collect())
+}
+
+/// "in 3 days" / "in 4 h" / "in 20 min" / "now" (already started).
+#[cfg(feature = "ssr")]
+fn relative_until(delta_ms: i64) -> String {
+    const MIN: i64 = 60_000;
+    const HOUR: i64 = 60 * MIN;
+    const DAY: i64 = 24 * HOUR;
+    if delta_ms <= 0 {
+        "now".to_string()
+    } else if delta_ms >= 2 * DAY {
+        format!("in {} days", delta_ms / DAY)
+    } else if delta_ms >= DAY {
+        "tomorrow".to_string()
+    } else if delta_ms >= HOUR {
+        format!("in {} h", delta_ms / HOUR)
+    } else {
+        format!("in {} min", (delta_ms / MIN).max(1))
+    }
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct SubmitResult {
     pub next: Option<String>,
@@ -1902,6 +1996,9 @@ pub async fn submit_answer(
         .iter()
         .find(|a| a.name == alternative)
         .ok_or_else(|| ServerFnError::new("unknown alternative"))?;
+    if alt.disabled {
+        return Err(ServerFnError::new("this alternative isn't open yet"));
+    }
     let next = alt.action.clone();
     let record_as = alt.record_as.clone();
 

src/bin/question_lint.rs

@@ -52,8 +52,21 @@ async fn main() -> anyhow::Result<()> {
         eprintln!("FAIL: {e}");
         std::process::exit(1);
     }
+    let aggregates_map = content::with_builtin_aggregates(aggregates_map);
     match content::validate_questions(&questions, &aggregates_map) {
         Ok(()) => {
+            // The runtime's own event desk: a repo announcing pages
+            // (Question.event) should read portal_events somewhere, or
+            // "post what happened" tasks pile up unseen. Warn, don't
+            // fail - the runtime creates the records either way.
+            if questions.values().any(|q| q.event.is_some())
+                && !content::bucket_is_read(&questions, content::EVENTS_BUCKET)
+            {
+                eprintln!(
+                    "WARN: pages carry `event:` but no kv resource reads bucket {:?} - add a desk so summaries get posted",
+                    content::EVENTS_BUCKET
+                );
+            }
             println!(
                 "OK: {} question(s), {} aggregate(s) valid",
                 questions.len(),

src/content.rs

@@ -50,6 +50,59 @@ pub struct Question {
     /// (not a followup).
     #[serde(default)]
     pub followup: Option<bool>,
+    /// This page announces something with a time window. While the
+    /// window is open the page is announced in the header (see
+    /// `app::Announcements`) instead of listed in the footer nav; once
+    /// it closes the page behaves like a `followup` (visible only to
+    /// visitors carrying an answer chain) and a "post what happened"
+    /// task lands in the `portal_events` desk (see `announce.rs`).
+    #[serde(default)]
+    pub event: Option<EventConfig>,
+}
+
+/// A page's announcement window. `starts` is RFC 3339 with an offset
+/// (`2026-09-12T18:00:00+02:00`); `duration` is a plain span like
+/// `3h`, `90m`, `2d`, `1d 6h`. Optional `place` is shown verbatim.
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct EventConfig {
+    pub starts: String,
+    pub duration: String,
+    #[serde(default)]
+    pub place: Option<String>,
+}
+
+/// `3h`, `90m`, `2d`, `1d 6h 30m` -> milliseconds. Whole units only;
+/// the smallest is a minute.
+pub fn parse_duration_ms(text: &str) -> Result<i64, String> {
+    let mut total: i64 = 0;
+    let mut seen = false;
+    for token in text.split_whitespace() {
+        let (num, unit) = token.split_at(token.trim_end_matches(|c: char| c.is_ascii_alphabetic()).len());
+        let n: i64 = num.parse().map_err(|_| format!("bad duration {text:?}: {token:?}"))?;
+        let per = match unit {
+            "m" => 60_000,
+            "h" => 3_600_000,
+            "d" => 86_400_000,
+            _ => return Err(format!("bad duration {text:?}: unit {unit:?} (use m, h, d)")),
+        };
+        total += n * per;
+        seen = true;
+    }
+    if !seen || total <= 0 {
+        return Err(format!("bad duration {text:?}: must be positive"));
+    }
+    Ok(total)
+}
+
+#[cfg(feature = "ssr")]
+impl EventConfig {
+    /// `(starts_ms, ends_ms)` as Unix milliseconds.
+    pub fn window_ms(&self) -> Result<(i64, i64), String> {
+        let starts = chrono::DateTime::parse_from_rfc3339(&self.starts)
+            .map_err(|e| format!("bad starts {:?}: {e} (RFC 3339 with offset)", self.starts))?
+            .timestamp_millis();
+        Ok((starts, starts + parse_duration_ms(&self.duration)?))
+    }
 }
 
 impl Question {
@@ -57,6 +110,24 @@ impl Question {
         self.followup.unwrap_or(false)
     }
 
+    /// The announcement window is still open at `now_ms` (Unix ms).
+    #[cfg(feature = "ssr")]
+    pub fn event_live_at(&self, now_ms: i64) -> bool {
+        self.event
+            .as_ref()
+            .and_then(|e| e.window_ms().ok())
+            .is_some_and(|(_, ends)| now_ms < ends)
+    }
+
+    /// The announcement window has closed at `now_ms`.
+    #[cfg(feature = "ssr")]
+    pub fn event_ended_at(&self, now_ms: i64) -> bool {
+        self.event
+            .as_ref()
+            .and_then(|e| e.window_ms().ok())
+            .is_some_and(|(_, ends)| now_ms >= ends)
+    }
+
     /// A dynamic page - one whose id still contains a `[name]`
     /// segment. Served per-value via `resolve_question`, never listed
     /// in nav, never a valid `action` target.
@@ -111,6 +182,11 @@ pub struct Alternative {
     pub description: String,
     #[serde(default)]
     pub action: Option<String>,
+    /// Shown but not takeable yet - the button renders disabled and the
+    /// server refuses the submission. For advertising a path before it
+    /// works (lysbue had the same flag).
+    #[serde(default)]
+    pub disabled: bool,
     #[serde(default)]
     pub consequence: Vec<String>,
     #[serde(default)]
@@ -202,6 +278,12 @@ pub struct ResourceSpec {
     /// `.[] | {name, url: .html_url}`. `None` returns it as-is.
     #[serde(default)]
     pub jq: Option<String>,
+    /// What to say when the resource yields nothing - an empty list,
+    /// or `null` (a `.[] | ...` jq over an empty list produces no
+    /// output at all). Defaults to "Nothing here yet."; content sets
+    /// it where the silence needs a voice ("Nothing released yet").
+    #[serde(default)]
+    pub empty: Option<String>,
 }
 
 /// Where a resource's live data comes from. `Kv` (a NATS KV bucket
@@ -347,51 +429,76 @@ pub struct SiteConfig {
     pub hero: HeroConfig,
 }
 
-/// What the landing page's hero is: the YES canvas piece (`yes`, the
-/// default), a redoal gesture-drawing canvas (`gesture`), or copy
-/// only (`plain`).
+/// What the landing page's hero is. `plain` is just the copy; `module`
+/// hands the hero to a JavaScript module the content repo itself
+/// ships (`module: hero.js`, a repo-relative path portal serves
+/// same-origin at `/site/<path>`, since Gitea's raw endpoint sends no
+/// CORS headers). The module exports `mount(container) -> handle` and
+/// the handle has `stop()`; portal starts it at HTML parse time and
+/// adopts it on hydration. The piece's look - canvases, SVG, CSS - is
+/// entirely the module's: portal only reserves the box.
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct HeroConfig {
     #[serde(default = "default_hero_kind")]
     pub kind: String,
-    /// `kind: gesture` only - ws(s):// URL of a redoal-relay for
-    /// ambient echoes. Absent means the hero draws offline.
     #[serde(default)]
-    pub relay: Option<String>,
+    pub module: Option<String>,
 }
 
 impl Default for HeroConfig {
     fn default() -> Self {
-        Self { kind: default_hero_kind(), relay: None }
+        Self { kind: default_hero_kind(), module: None }
     }
 }
 
 fn default_hero_kind() -> String {
-    "yes".to_string()
+    "plain".to_string()
 }
 
 #[cfg(feature = "ssr")]
 impl SiteConfig {
-    /// Shared by `load_site_from_gitea` and the `question-lint` binary
-    /// so a typo'd hero kind is a caught rejection, not a silently
-    /// plain hero.
+    /// Same policy as `validate_questions`: content declares, the
+    /// runtime refuses what it doesn't understand at load time, so a
+    /// typo'd hero kind is a caught rejection, not a silently plain
+    /// hero.
     pub fn validate(&self) -> anyhow::Result<()> {
-        if !matches!(self.hero.kind.as_str(), "yes" | "gesture" | "plain") {
+        match self.hero.kind.as_str() {
+            "plain" => {
+                if self.hero.module.is_some() {
+                    anyhow::bail!("site.yaml: hero.module only makes sense with hero.kind: module");
+                }
+            }
+            "module" => {
+                let Some(module) = &self.hero.module else {
+                    anyhow::bail!("site.yaml: hero.kind: module needs hero.module (a repo-relative path like hero.js)");
+                };
+                if !is_safe_site_path(module) {
                     anyhow::bail!(
-                "site.yaml: hero.kind {:?} is not one of yes | gesture | plain",
-                self.hero.kind
+                        "site.yaml: hero.module {module:?} must be a plain repo-relative path (no scheme, no .., no leading /)"
                     );
                 }
-        if let Some(relay) = &self.hero.relay {
-            if self.hero.kind != "gesture" {
-                anyhow::bail!("site.yaml: hero.relay only makes sense with hero.kind: gesture");
             }
-            validate_relay_url(relay).map_err(|e| anyhow::anyhow!("site.yaml: {e}"))?;
+            other => anyhow::bail!("site.yaml: hero.kind {other:?} is not one of plain | module"),
         }
         Ok(())
     }
 }
 
+/// A repo-relative asset path portal is willing to proxy from the
+/// content repo: plain segments only - no traversal, no leading slash,
+/// no scheme - so `/site/<path>` can only ever reach the content repo.
+pub fn is_safe_site_path(path: &str) -> bool {
+    !path.is_empty()
+        && !path.starts_with('/')
+        && path.split('/').all(|seg| {
+            !seg.is_empty()
+                && seg != ".."
+                && seg
+                    .chars()
+                    .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
+        })
+}
+
 /// A relay must be a ws:// or wss:// URL - shared between site.yaml's
 /// hero and `Requirement.relay` validation.
 #[cfg(feature = "ssr")]
@@ -428,6 +535,15 @@ pub async fn load_site_from_gitea(repo_url: &str, branch: &str) -> anyhow::Resul
 
 /// Extracts `scheme://host` from a repo's normal browser URL - the
 /// Gitea API base every helper in this module builds requests against.
+#[cfg(feature = "ssr")]
+/// `{gitea}/api/v1/repos/{owner}/{repo}/raw` - the base
+/// `site_asset_handler` proxies content-shipped files from.
+#[cfg(feature = "ssr")]
+pub fn gitea_raw_base(repo_url: &str) -> anyhow::Result<String> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    Ok(format!("{}/api/v1/repos/{owner}/{repo}/raw", gitea_api_base(repo_url)?))
+}
+
 #[cfg(feature = "ssr")]
 pub fn gitea_api_base(repo_url: &str) -> anyhow::Result<String> {
     let parsed = url::Url::parse(repo_url)
@@ -826,12 +942,71 @@ pub async fn load_questions_from_gitea(
 /// standalone `question-lint` binary, so a YAML typo becomes a caught,
 /// logged rejection instead of a silently-accepted, later-broken
 /// string.
+/// Bucket the runtime keeps for announced pages (`Question.event`):
+/// one record per event question, `announced` while the window is
+/// open, `awaiting_summary` once it closes - the "post what happened"
+/// task a desk reading this bucket picks up - and `summarized` when an
+/// owner marks it done. Declared here, not in content, because the
+/// runtime's sweeper (`announce.rs`) is what moves the records.
+pub const EVENTS_BUCKET: &str = "portal_events";
+
+#[cfg(feature = "ssr")]
+const BUILTIN_AGGREGATES_YAML: &str = "\
+aggregates:
+  - bucket: portal_events
+    initial: announced
+    states:
+      announced: { event: announced }
+      awaiting_summary: { event: ended }
+      summarized: { event: summarized }
+    transitions:
+      announced: [awaiting_summary, summarized]
+      awaiting_summary: [summarized]
+";
+
+/// Adds the runtime's own state graphs to a content repo's. Content
+/// wins if it declares the same bucket (say, to add states).
+#[cfg(feature = "ssr")]
+pub fn with_builtin_aggregates(
+    mut aggregates: std::collections::HashMap<String, crate::aggregates::AggregateSchema>,
+) -> std::collections::HashMap<String, crate::aggregates::AggregateSchema> {
+    let builtin = crate::aggregates::parse_aggregates_yaml(BUILTIN_AGGREGATES_YAML)
+        .expect("builtin aggregates yaml is valid");
+    for (bucket, schema) in builtin {
+        aggregates.entry(bucket).or_insert(schema);
+    }
+    aggregates
+}
+
+/// True when some kv resource in the content reads `bucket` - the
+/// attended-bucket check, exposed so the lint can warn about the
+/// runtime's own `portal_events` (a warning, not a failure: a repo
+/// with no event pages has nothing to attend).
+#[cfg(feature = "ssr")]
+pub fn bucket_is_read(questions: &std::collections::HashMap<String, Question>, bucket: &str) -> bool {
+    questions.values().any(|q| {
+        q.alternatives.iter().any(|a| {
+            a.features
+                .iter()
+                .any(|f| f.resource.as_ref().and_then(|r| r.bucket()).is_some_and(|b| b == bucket))
+        })
+    })
+}
+
 #[cfg(feature = "ssr")]
 pub fn validate_questions(
     questions: &std::collections::HashMap<String, Question>,
     aggregates: &std::collections::HashMap<String, crate::aggregates::AggregateSchema>,
 ) -> anyhow::Result<()> {
     for question in questions.values() {
+        if let Some(event) = &question.event {
+            if question.is_dynamic() {
+                anyhow::bail!("question {:?}: a dynamic page can't carry an event", question.id);
+            }
+            if let Err(e) = event.window_ms() {
+                anyhow::bail!("question {:?}: event: {e}", question.id);
+            }
+        }
         if let Some(target) = &question.requires_chain {
             if !questions.contains_key(target) {
                 anyhow::bail!(
@@ -1036,7 +1211,7 @@ pub async fn watch_for_reload(
     use futures::StreamExt;
     while sub.next().await.is_some() {
         let loaded_aggregates = match load_aggregates_from_gitea(&repo_url, &branch).await {
-            Ok(loaded) => loaded,
+            Ok(loaded) => with_builtin_aggregates(loaded),
             Err(e) => {
                 tracing::error!(error = %e, "aggregates.yaml reload failed, keeping last-good content");
                 continue;
@@ -1091,6 +1266,54 @@ pub struct GiteaRepoQuery {
     pub repo: String,
 }
 
+/// `GET /site/{*path}` - serves a file from the content repo's default
+/// branch same-origin, so content-shipped assets (the hero module,
+/// its stylesheet) are importable by the page: Gitea's raw endpoint
+/// sends no CORS headers, and an ES module import across origins is
+/// refused without them. Path is validated to plain segments
+/// (`is_safe_site_path`), the response revalidates like /pkg
+/// (Cache-Control: no-cache) so a content push shows up on reload.
+#[cfg(feature = "ssr")]
+pub async fn site_asset_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Path(path): axum::extract::Path<String>,
+) -> axum::response::Response {
+    use axum::http::{header, StatusCode};
+    use axum::response::IntoResponse;
+
+    if !is_safe_site_path(&path) {
+        return (StatusCode::BAD_REQUEST, "invalid asset path").into_response();
+    }
+    let url = format!("{}/{path}?ref={}", state.content_raw_base, state.content_branch);
+    let client = openidconnect::reqwest::Client::new();
+    let resp = match client.get(&url).send().await.and_then(|r| r.error_for_status()) {
+        Ok(r) => r,
+        Err(e) => {
+            tracing::warn!("site asset {path}: {e}");
+            return (StatusCode::NOT_FOUND, "no such site asset").into_response();
+        }
+    };
+    let bytes = match resp.bytes().await {
+        Ok(b) => b,
+        Err(e) => return (StatusCode::BAD_GATEWAY, e.to_string()).into_response(),
+    };
+    let mime = match path.rsplit('.').next() {
+        Some("js") | Some("mjs") => "text/javascript; charset=utf-8",
+        Some("css") => "text/css; charset=utf-8",
+        Some("svg") => "image/svg+xml",
+        Some("json") => "application/json",
+        Some("png") => "image/png",
+        Some("webp") => "image/webp",
+        Some("woff2") => "font/woff2",
+        _ => "application/octet-stream",
+    };
+    (
+        [(header::CONTENT_TYPE, mime), (header::CACHE_CONTROL, "no-cache")],
+        bytes,
+    )
+        .into_response()
+}
+
 /// Looks up `owner/repo` on the same Gitea instance content is loaded
 /// from (`AppState.gitea_base`) - a raw Axum handler (mounted at
 /// `/gitea-repo` in `main.rs`), not a Leptos server fn, since the
@@ -1386,9 +1609,9 @@ alternatives:
     }
 
     #[test]
-    fn site_config_defaults_to_the_yes_hero() {
+    fn site_config_defaults_to_the_plain_hero() {
         let site = SiteConfig::default();
-        assert_eq!(site.hero.kind, "yes");
+        assert_eq!(site.hero.kind, "plain");
         assert!(site.validate().is_ok());
         // And an empty file parses to the same thing.
         let parsed: SiteConfig = serde_yaml::from_str("{}").unwrap();
@@ -1403,21 +1626,28 @@ alternatives:
     }
 
     #[test]
-    fn site_config_rejects_relay_without_gesture_hero() {
-        let site: SiteConfig =
-            serde_yaml::from_str("hero: { kind: yes, relay: \"wss://relay.redoal.com\" }").unwrap();
-        assert!(site.validate().is_err());
+    fn site_config_module_hero_needs_a_safe_path() {
+        let missing: SiteConfig = serde_yaml::from_str("hero: { kind: module }").unwrap();
+        assert!(missing.validate().is_err());
+        let traversal: SiteConfig =
+            serde_yaml::from_str("hero: { kind: module, module: ../etc/passwd }").unwrap();
+        assert!(traversal.validate().is_err());
+        let absolute: SiteConfig =
+            serde_yaml::from_str("hero: { kind: module, module: https://x/y.js }").unwrap();
+        assert!(absolute.validate().is_err());
+        let ok: SiteConfig = serde_yaml::from_str("hero: { kind: module, module: hero.js }").unwrap();
+        assert!(ok.validate().is_ok());
     }
 
     #[test]
     fn redoal_site_yaml_shape_parses() {
         let site: SiteConfig = serde_yaml::from_str(
-            "title: redoal\nwordmark: https://project.uhhm.no/redoal/questions/raw/branch/main/wordmark.svg\nhero:\n  kind: gesture\n  relay: wss://relay.redoal.com\n",
+            "title: redoal\nwordmark: https://project.uhhm.no/redoal/questions/raw/branch/main/wordmark.svg\nhero:\n  kind: module\n  module: hero.js\n",
         )
         .unwrap();
         assert!(site.validate().is_ok());
         assert_eq!(site.title.as_deref(), Some("redoal"));
-        assert_eq!(site.hero.kind, "gesture");
+        assert_eq!(site.hero.module.as_deref(), Some("hero.js"));
     }
 
     #[test]
@@ -1595,4 +1825,76 @@ alternatives:
         let questions = build_questions(&files).unwrap();
         assert!(validate_questions(&questions, &Default::default()).is_err());
     }
+
+    // ── events (announced pages) ─────────────────────────────────────────
+
+    #[test]
+    fn duration_parses_whole_units() {
+        assert_eq!(parse_duration_ms("3h").unwrap(), 3 * 3_600_000);
+        assert_eq!(parse_duration_ms("90m").unwrap(), 90 * 60_000);
+        assert_eq!(parse_duration_ms("1d 6h").unwrap(), 30 * 3_600_000);
+        assert!(parse_duration_ms("0h").is_err());
+        assert!(parse_duration_ms("3 hours").is_err());
+        assert!(parse_duration_ms("").is_err());
+    }
+
+    #[test]
+    fn event_window_and_liveness() {
+        let q: Question = serde_yaml::from_str(
+            "id: /opening\nname: Will you be there?\nevent:\n  starts: 2026-09-12T18:00:00+02:00\n  duration: 3h\n",
+        )
+        .unwrap();
+        let (starts, ends) = q.event.as_ref().unwrap().window_ms().unwrap();
+        assert_eq!(ends - starts, 3 * 3_600_000);
+        assert!(q.event_live_at(starts - 1));
+        assert!(q.event_live_at(ends - 1));
+        assert!(!q.event_live_at(ends));
+        assert!(q.event_ended_at(ends));
+        assert!(!q.event_ended_at(starts));
+        let plain: Question = serde_yaml::from_str("id: /x\nname: X\n").unwrap();
+        assert!(!plain.event_live_at(0) && !plain.event_ended_at(i64::MAX));
+    }
+
+    #[test]
+    fn event_validation() {
+        let bad: Question = serde_yaml::from_str(
+            "id: /e\nname: E\nevent:\n  starts: next friday\n  duration: 3h\n",
+        )
+        .unwrap();
+        let mut qs = std::collections::HashMap::new();
+        qs.insert(bad.id.clone(), bad);
+        let err = validate_questions(&qs, &Default::default()).unwrap_err().to_string();
+        assert!(err.contains("bad starts"), "{err}");
+
+        let dynamic: Question = serde_yaml::from_str(
+            "id: /e/[slot]\nname: E\nevent:\n  starts: 2026-09-12T18:00:00Z\n  duration: 3h\n",
+        )
+        .unwrap();
+        let mut qs = std::collections::HashMap::new();
+        qs.insert(dynamic.id.clone(), dynamic);
+        let err = validate_questions(&qs, &Default::default()).unwrap_err().to_string();
+        assert!(err.contains("dynamic page can't carry an event"), "{err}");
+    }
+
+    #[test]
+    fn builtin_events_schema_yields_to_content() {
+        let merged = with_builtin_aggregates(Default::default());
+        let schema = &merged[EVENTS_BUCKET];
+        assert_eq!(schema.initial, "announced");
+        assert_eq!(schema.allowed("announced"), ["awaiting_summary", "summarized"]);
+        assert_eq!(schema.allowed("awaiting_summary"), ["summarized"]);
+
+        let content = crate::aggregates::parse_aggregates_yaml(
+            "aggregates:\n  - bucket: portal_events\n    initial: mine\n    states:\n      mine: { event: mine }\n",
+        )
+        .unwrap();
+        assert_eq!(with_builtin_aggregates(content)[EVENTS_BUCKET].initial, "mine");
+    }
+
+    #[test]
+    fn bucket_is_read_sees_kv_resources() {
+        let qs = question_with_transitions("            - { to: middle, label: Go }");
+        assert!(bucket_is_read(&qs, "things"));
+        assert!(!bucket_is_read(&qs, EVENTS_BUCKET));
+    }
 }

src/lib.rs

@@ -9,6 +9,9 @@ pub mod resource;
 #[cfg(feature = "ssr")]
 pub mod aggregates;
 
+#[cfg(feature = "ssr")]
+pub mod announce;
+
 #[cfg(feature = "ssr")]
 pub mod server;
 

src/main.rs

@@ -29,7 +29,10 @@ async fn main() -> anyhow::Result<()> {
         .unwrap_or_else(|_| "https://project.uhhm.no/uhhm/questions".to_string());
     let content_branch = std::env::var("CONTENT_BRANCH").unwrap_or_else(|_| "main".to_string());
     let gitea_base = content::gitea_api_base(&content_repo)?;
-    let aggregates = content::load_aggregates_from_gitea(&content_repo, &content_branch).await?;
+    let content_raw_base = content::gitea_raw_base(&content_repo)?;
+    let aggregates = content::with_builtin_aggregates(
+        content::load_aggregates_from_gitea(&content_repo, &content_branch).await?,
+    );
     let questions = content::load_questions_from_gitea(&content_repo, &content_branch, "questions").await?;
     content::validate_questions(&questions, &aggregates)?;
     let site = content::load_site_from_gitea(&content_repo, &content_branch).await?;
@@ -67,7 +70,7 @@ async fn main() -> anyhow::Result<()> {
     tokio::spawn(content::watch_for_reload(
         nats.clone(),
         content_repo,
-        content_branch,
+        content_branch.clone(),
         "questions".to_string(),
         questions.clone(),
         aggregates.clone(),
@@ -82,10 +85,16 @@ async fn main() -> anyhow::Result<()> {
         aggregates,
         site,
         gitea_base,
+        content_raw_base,
+        content_branch: content_branch.clone(),
         oidc: oidc_state,
         garage,
     };
 
+    // Announced pages: keep their desk records current, close ended
+    // windows (see announce.rs).
+    tokio::spawn(portal::announce::run(state.clone()));
+
     // Dev-friendly defaults: in-memory sessions, secure cookies only when
     // COOKIE_SECURE=true (set it behind TLS in production) - same
     // defaults cnats uses. SameSite=Lax (tower-sessions defaults to
@@ -129,10 +138,6 @@ async fn main() -> anyhow::Result<()> {
     let favicon_dark_path = format!("{}/favicon-dark.svg", leptos_options.site_root);
     let wordmark_path = format!("{}/wordmark.svg", leptos_options.site_root);
     let swiper_path = format!("{}/swiper-element-bundle.min.js", leptos_options.site_root);
-    // yes.js sits in public/ (not a wasm-bindgen snippet) so the
-    // hero's inline early-mount script and the wasm binding can share
-    // one stable URL - see `mod yes` in app.rs.
-    let yes_path = format!("{}/yes.js", leptos_options.site_root);
     let fonts_dir = format!("{}/fonts", leptos_options.site_root);
 
     let app = Router::new()
@@ -142,6 +147,8 @@ async fn main() -> anyhow::Result<()> {
         .route("/api/{*fn_name}", any(server_fn_handler))
         .route("/upload", post(upload::upload))
         .route("/gitea-repo", get(content::gitea_repo_handler))
+        // Content-shipped assets (hero module etc.), same-origin.
+        .route("/site/{*path}", get(content::site_asset_handler))
         .route("/automation/kv/{bucket}", get(content::automation_kv_handler))
         // no-cache = "revalidate before reuse", not "don't cache":
         // pkg files keep the same names across releases (portal.js,
@@ -167,17 +174,6 @@ async fn main() -> anyhow::Result<()> {
             "/swiper-element-bundle.min.js",
             ServeFile::new(swiper_path),
         )
-        // Same skew concern as /pkg: the wasm's raw_module import and
-        // the hero's inline script both load this by fixed name.
-        .route_service(
-            "/yes.js",
-            tower::ServiceBuilder::new()
-                .layer(tower_http::set_header::SetResponseHeaderLayer::overriding(
-                    axum::http::header::CACHE_CONTROL,
-                    axum::http::HeaderValue::from_static("no-cache"),
-                ))
-                .service(ServeFile::new(yes_path)),
-        )
         .leptos_routes_with_context(
             &state,
             routes,

src/server/mod.rs

@@ -38,6 +38,10 @@ pub struct AppState {
     /// rather than re-derived per call, since `resolve_gitea_repo` needs
     /// it too and has no other reason to see `CONTENT_REPO` itself.
     pub gitea_base: String,
+    /// `{gitea}/api/v1/repos/{owner}/{repo}/raw` and the branch - what
+    /// `content::site_asset_handler` proxies content-shipped assets from.
+    pub content_raw_base: String,
+    pub content_branch: String,
     pub oidc: Arc<oidc::Oidc>,
     /// `None` when `GARAGE_*` env vars aren't set - uploads are the one
     /// optional feature, everything else works without Garage.

style/main.css

@@ -51,7 +51,7 @@
   --ink-dim: #9a9a9a;
   --line: #2a2a2a;
 
-  /* Cards float over the sticky YES canvas - translucent so the piece
+  /* Cards float over a sticky hero piece - translucent so the piece
      reads faintly through them (paired with backdrop-filter on
      .alt-card), shadowed so their edge against the animated backdrop
      is a soft lift rather than a hard contrast line. */
@@ -78,8 +78,9 @@
 /* Light theme: the same muted-press idea on white stock - warm paper,
    near-black ink, and the accent deepened from dusty cyan to a teal
    ink that actually carries as text on light paper (the dark theme's
-   #8ec2c0 washes out there). yes.js mirrors this palette on its own
-   (matchMedia in setupTheme) since canvas paint can't read CSS vars. */
+   #8ec2c0 washes out there). Canvas-drawing modules (gesture.js, and
+   content-shipped hero modules) mirror this palette on their own,
+   since canvas paint can't read CSS vars. */
 @media (prefers-color-scheme: light) {
   :root {
     --accent: #47807e;
@@ -105,12 +106,6 @@
     filter: invert(0.92);
   }
 
-  /* overlay against near-white paper resolves to ~white and the
-     raster ghost vanishes; multiply lets the light theme's gray YES
-     (see rasterizeText's themed repaint in yes.js) show as ink. */
-  .hero-canvas #rasterCanvas {
-    mix-blend-mode: multiply;
-  }
 }
 
 * {
@@ -200,96 +195,65 @@ main.not-found {
   max-width: 46ch;
 }
 
-/* the actual "YES - Rasterized Lines" piece live at uhhm.no (see
-   public/yes.js) - landing page only. Full-viewport so it's a real
-   moment, not a thumbnail; hero-copy overlays near the bottom rather
-   than interrupting the canvas. */
-
-.hero-yes {
-  /* Sticky at the viewport top for the whole scroll (its containing
-     block is the page itself), so the piece stays animating behind
-     everything that follows - the translucent cards scroll over it
-     and it shows through them and in the gaps around them. z-index 0
-     so positioned content below can stack above with z-index 1. */
-  position: sticky;
-  top: 0;
-  z-index: 0;
-  max-width: none;
-  width: 100%;
-  /* svh here is only the pre-JS/no-JS fallback (and first paint before
-     yes.js's constructor runs). Once yes.js mounts, it overwrites this
-     with an inline `height: <px>` frozen from a single measurement -
-     see setupCanvas()'s comment in yes.js for why: on real mobile
-     Safari, content bottom-aligned inside this box kept sliding down
-     as the address bar collapsed even with a spec'd-stable viewport
-     unit here, so the box's actual height can't be trusted to stay
-     put on that unit alone. An inline style set from JS always wins
-     the cascade over this rule, so that frozen number is what
-     actually governs once the page is interactive.
-     Plain-vh fallback declared first - an engine without svh support
-     ignores the invalid second line rather than falling through to
-     auto height, which would collapse this to the height of its
-     in-flow content and clip the canvas via overflow:hidden below. */
-  height: 100vh;
-  height: 100svh;
-  padding: 0;
-  justify-content: flex-end;
-  overflow: hidden;
-}
-
-.hero-canvas {
-  position: absolute;
-  inset: 0;
-}
-
-.hero-canvas canvas {
-  position: absolute;
-  top: 0;
-  left: 0;
-  cursor: pointer;
-}
-
-.hero-canvas #rasterCanvas {
-  mix-blend-mode: overlay;
-  opacity: 0.5;
-}
-
-.hero-yes .hero-copy {
-  position: relative;
-  z-index: 1;
-  padding: 0 1.5rem 3.5rem;
-  gap: 0.6rem;
-  text-shadow: 0 0.12em 1.4em var(--hero-glow);
-}
-
-/* The gesture hero (site.yaml hero.kind: gesture - redoal.com's
-   landing): a tall drawing surface where the visitor's stroke and
-   ambient echoes from the relay share the stage. Not sticky like the
-   YES piece - drawing and scrolling fight over the same finger. */
-.hero-gesture .hero-draw {
+/* A content-shipped hero module (site.yaml hero.kind: module) draws
+   into .hero-piece; the module owns its look (it may restyle .hero
+   itself). Portal only reserves the box so the copy doesn't jump when
+   the module mounts - plain-vh fallback first, as everywhere. */
+.hero-module .hero-piece {
   position: relative;
   width: 100%;
-  max-width: 46rem;
-  /* Same jump-avoidance as .gesture-wrap: the canvas (55svh tall)
-     only exists after hydration, so hold its height open from the
-     first paint. Plain-vh fallback first, like the canvas itself. */
   min-height: 55vh;
   min-height: 55svh;
 }
 
-.hero-gesture .gesture-canvas {
-  aspect-ratio: auto;
-  /* Plain-vh fallback first, same reasoning as .hero-yes's height. */
-  height: 55vh;
-  height: 55svh;
-  border: none;
-  background: transparent;
+/* announcements - live event pages, a strip above the hero copy.
+   Header, not footer: the one place a page claims attention before
+   the question is asked. */
+.announce {
+  width: 100%;
+  display: flex;
+  flex-wrap: wrap;
+  justify-content: center;
+  gap: 0.6rem 1.2rem;
+  margin: -2rem 0 0.5rem;
+  font-size: 0.88rem;
+  position: relative;
+  z-index: 1;
 }
 
-.hero-gesture .gesture-status {
-  top: auto;
-  bottom: 0.55rem;
-  right: 0.55rem;
+.announce-item {
+  display: inline-flex;
+  flex-wrap: wrap;
+  align-items: baseline;
+  gap: 0.35rem 0.7rem;
+  padding: 0.45rem 0.9rem;
+  border: 0.06rem solid var(--line);
+  border-left: 0.2rem solid var(--accent);
+  border-radius: 0.3rem;
+  color: var(--ink);
+  text-decoration: none;
+  background: var(--paper);
+  transition: border-color 120ms;
+}
+
+.announce-item:hover,
+.announce-item[aria-current="page"] {
+  border-color: var(--accent);
+}
+
+.announce-name {
+  font-weight: 600;
+}
+
+.announce-when {
+  color: var(--ink-dim);
+}
+
+.announce-relative {
+  color: var(--accent);
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  font-size: 0.72rem;
 }
 
 /* alternatives */
@@ -564,10 +528,16 @@ textarea:focus {
    custom properties - so palette changes go there AND here. */
 .gesture-wrap {
   position: relative;
-  /* The canvas is created by JS only after wasm hydration - reserve
-     its 3/2 box now so content below doesn't jump when it appears.
-     aspect-ratio is a preferred size, so the box still grows when the
-     echo thumbnail strip shows up under the canvas. */
+  width: 100%;
+}
+
+/* The canvas is created by JS only after wasm hydration - reserve its
+   3/2 box until then so content below doesn't jump. Scoped to :empty
+   on purpose: on the mounted wrap (a stretched item inside the flex
+   .field) the same aspect-ratio turned the echo strip's extra height
+   into extra WIDTH and the whole card ballooned past the viewport
+   after the first stroke. */
+.gesture-wrap:empty {
   aspect-ratio: 3 / 2;
 }
 
@@ -755,6 +725,13 @@ textarea:focus {
   cursor: wait;
 }
 
+/* A content-disabled alternative (`disabled: true`): announced, not
+   yet takeable - reads as a promise, not as a stuck form. */
+.alt-submit.soon:disabled {
+  cursor: not-allowed;
+  opacity: 0.6;
+}
+
 .gate-card {
   text-align: center;
 }