Release 0.3.36

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

.gitea/workflows/publish.yml

@@ -68,11 +68,14 @@ jobs:
           stage=$(mktemp -d)
           cp "$CARGO_TARGET_DIR/release/portal" "$stage/portal"
           cp "$CARGO_TARGET_DIR/release/question_lint" "$stage/question_lint"
+          # hash-files = true: leptos resolves hash.txt next to the running
+          # binary, so it ships beside portal in the release dir.
+          cp "$CARGO_TARGET_DIR/release/hash.txt" "$stage/hash.txt"
           # site-root ("target/site" in Cargo.toml) is project-relative,
           # not affected by CARGO_TARGET_DIR - only the plain `cargo build`
           # outputs (release/, front/) move with that override.
           cp -r target/site "$stage/site"
-          tar -C "$stage" -czf "portal-$tag.tar.gz" portal question_lint site
+          tar -C "$stage" -czf "portal-$tag.tar.gz" portal question_lint hash.txt site
           rm -rf "$stage"
 
       # The run's own ephemeral token has write access to this repo -
@@ -85,9 +88,9 @@ jobs:
           tag="${{ github.ref_name }}"
           api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
           auth="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
-          subject=$(git log -1 --format=%s)
+          # The release notes are this version's section of CHANGELOG.md.
-          body=$(printf '{"tag_name":"%s","name":"%s"}' \
+          notes=$(awk -v v="${tag#v}" '/^## /{p = ($2 == v)} p' CHANGELOG.md | tail -n +2)
-            "$tag" "$tag: $(echo "$subject" | sed 's/"/\\"/g')")
+          body=$(jq -n --arg tag "$tag" --arg notes "$notes" '{tag_name: $tag, name: $tag, body: $notes}')
           id=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
             -d "$body" "$api/releases" | jq .id) \
             || id=$(curl -sf -H "$auth" "$api/releases/tags/$tag" | jq .id)

.gitea/workflows/test.yml

@@ -22,5 +22,22 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # A throwaway JetStream for tests/jetstream.rs. Best effort: if the
+      # runner cannot use docker the variable stays unset and that one
+      # test reports itself skipped rather than failing the build.
+      - name: Start a throwaway JetStream
+        run: |
+          docker rm -f portal-test-nats >/dev/null 2>&1 || true
+          if docker run -d --rm --name portal-test-nats -p 127.0.0.1:14223:4222 nats:2.14.6-alpine -js >/dev/null 2>&1; then
+            sleep 2
+            echo "PORTAL_TEST_NATS_URL=nats://127.0.0.1:14223" >> "$GITHUB_ENV"
+          else
+            echo "::warning::no docker on this runner - the JetStream integration test will be skipped"
+          fi
+
       - name: Test
         run: cargo test --features ssr
+
+      - name: Stop the throwaway JetStream
+        if: always()
+        run: docker rm -f portal-test-nats >/dev/null 2>&1 || true

CHANGELOG.md

@@ -0,0 +1,283 @@
+# Changelog
+
+One line per change, grouped by the release that shipped it. Newest
+first. A release is a Cargo.toml bump plus a `v<version>` tag; the
+content repos pin the tag they run (see the end of this file).
+
+## 0.3.36 (2026-09-22)
+
+- Question nav: a followup is offered only once earned - the verified chain answered the alternative leading there, or a link that records nothing leads on from an earned page. Standing on a page no longer unlocks the pages behind its forms; the chain index now records which alternative was answered
+- One bounded HTTP client for every server-side fetch: 20 s budget, size caps per kind of fetch (`src/http.rs`)
+- Uploads are refused past 20 MB while streaming, and the route body limit that had capped them at axum's 2 MB default is raised to match
+- `tests/jetstream.rs`: the store, the event log and the projection tested against a real JetStream (CI starts a throwaway one)
+- `content` split into `gitea`, `validate`, `markdown`, `handlers`; every path still `content::x`
+- This changelog, and the table of what each site runs
+- Business needs as a checkable spec: needs.yaml + question_lint pass
+- needs: `success` states and a resolved simulation model
+- needs: `stages` - every stage the business named must be a state
+- needs_replay: make simulated cases real aggregates, report buckets by state
+- needs: also_moved_by - a need carried by more than one group's desk
+
+## 0.3.35 (2026-09-12)
+
+- Item cards: no paragraph margin under the description
+
+## 0.3.34 (2026-09-11)
+
+- Question nav: offer followups by reach, not by carrying any chain
+
+## 0.3.33 (2026-09-02)
+
+- Head preloads: latin font, wordmark, content-host preconnect
+
+## 0.3.32 (2026-09-01)
+
+- Per-site favicon via site.yaml
+
+## 0.3.31 (2026-09-01)
+
+- Markdown links allow tel:
+
+## 0.3.30 (2026-09-01)
+
+- Single alt-image shows natural height
+
+## 0.3.29 (2026-09-01)
+
+- Markdown image layout hints + AVIF assets
+
+## 0.3.28 (2026-09-01)
+
+- Hero description renders inline markdown
+
+## 0.3.27 (2026-09-01)
+
+- wordmark_invert: explicit, not inferred from .svg
+
+## 0.3.26 (2026-09-01)
+
+- Select fields: inline static options
+
+## 0.3.25 (2026-09-01)
+
+- Content-shipped stylesheet override (site.yaml stylesheet)
+
+## 0.3.24 (2026-09-01)
+
+- Gateway submit-as-link loses the underline
+
+## 0.3.23 (2026-09-01)
+
+- Chrome speaks the site's language: site.yaml lang + i18n table
+
+## 0.3.22 (2026-09-01)
+
+- site.yaml wordmark_height; raster logos keep their colors
+
+## 0.3.21 (2026-09-01)
+
+- Hero paragraph centers its measure box
+
+## 0.3.20 (2026-09-01)
+
+- Sign-in becomes optional: KANIDM_URL unset disables auth cleanly
+
+## 0.3.19 (2026-09-01)
+
+- Markdown images in descriptions, gated and framed
+
+## 0.3.18 (2026-09-01)
+
+- Item cards render inline markdown descriptions
+- Convergence: ink converges onto the decoded key (WebGL glow)
+- Gesture results overlay the canvas - the page never jumps
+
+## 0.3.16 (2026-08-30)
+
+- Announce sweeper: refresh open records from content
+
+## 0.3.15 (2026-08-30)
+
+- Hidden fields: carrier value without a label row
+
+## 0.3.14 (2026-08-30)
+
+- Feature cards: icon column, one text edge
+
+## 0.3.13 (2026-08-30)
+
+- Voice field: nothing leaves the browser until Keep it here
+
+## 0.3.12 (2026-08-30)
+
+- Voice preview stays hidden until there is something to play
+
+## 0.3.11 (2026-08-30)
+
+- README: gesture and voice fields
+- Validate templated actions against the page pattern
+
+## 0.3.10 (2026-08-30)
+
+- type: voice, Requirement.value, playable resource cards
+
+## 0.3.9 (2026-08-30)
+
+- Templated actions; places are pickable in the gesture input
+
+## 0.3.8 (2026-08-30)
+
+- Descriptions are inline markdown; Feature.link withdrawn
+
+## 0.3.7 (2026-08-30)
+
+- Feature.link: a card's name may point elsewhere
+
+## 0.3.6 (2026-08-30)
+
+- Announced pages: event windows, header announcements, summary tasks
+
+## 0.3.5 (2026-08-30)
+
+- Gesture widget: stop drawing the decoded ghost path
+- Gesture widget: ghost path back, for v2 keys only
+
+## 0.3.4 (2026-08-25)
+
+- Alternative.disabled: announced but not yet takeable
+
+## 0.3.3 (2026-08-25)
+
+- Empty list says so before it can parse as zero answers
+
+## 0.3.2 (2026-08-25)
+
+- README: hashed pkg assets in the release flow
+- Resource empty text: content-declared, and null counts as empty
+
+## 0.3.1 (2026-08-25)
+
+- Content-hashed pkg assets (hash-files) so stale bundles can't pair with new wasm
+
+## 0.3.0 (2026-08-25)
+
+- Hero becomes a content-owned module; site asset proxy; gesture growth fix
+
+## 0.2.4 (2026-08-25)
+
+- Gates keep the question nav
+
+## 0.2.3 (2026-08-25)
+
+- Attended-bucket lint rule; app-lifetime resources fix first-nav corruption
+
+## 0.2.2 (2026-08-24)
+
+- One app-level Title fed by a shared site resource
+
+## 0.2.1 (2026-08-24)
+
+- Docs: routing bullet + design doc marked implemented
+- Revalidating cache on app assets; site title survives SPA navigation
+
+## 0.2.0 (2026-08-24)
+
+- Initial commit: content-driven onboarding portal
+- Load content from Gitea directly, drop the local clone; add deploy workflow
+- Share sccache between manual dev builds and CI
+- Give CI its own SCCACHE_SERVER_PORT
+- Erase view types at every list/component boundary, not just leaves
+- Redirect cargo-leptos's tool cache out of act-runner-bare's StateDirectory
+- Fix Ship release: site-root is project-relative, not CARGO_TARGET_DIR
+- Drop sudo from the deploy workflow - NoNewPrivileges blocks it outright
+- Caddy snippet: use multi-line log block
+- Fix static asset 404s and build-time SITE_NAME
+- Hot-reload content on a NATS trigger instead of requiring a restart
+- Add prosekit rich-text field, Gitea repo embeds, automation KV read endpoint; fix apex/www session-cookie mismatch on /auth/callback
+- Fix prosekit-editor.js: remove bare CSS imports that aborted the whole module
+- Redirect back to the originating page after sign-in, not always /
+- Fix hero-canvas navigation race; style the prosekit editor and add a toolbar
+- yes.js: guard against the canvas not being in the DOM yet
+- Fix get_resource/transition_answer: scope feature lookup to its own alternative
+- Add self-service transitions, authorized by item possession not group membership
+- Event-sourced applicant/subscriber/project aggregates, generalized resources
+- deploy.yml: write GITEA_API_TOKEN for the new GiteaStarred/OrgRepos resource sources
+- Cargo.toml: disambiguate bin-target for cargo-leptos
+- Add manually-triggered backfill workflow, no terminal/sudo needed
+- Trigger redeploy to pick up PORTAL_GITEA_API_TOKEN secret
+- Render generic resource lists as cards, not raw JSON dump
+- Fix recursion-limit build failure in the new item-card renderer
+- Resource-backed multi/single-select requirement
+- Add Organization aggregate (client-as-status), wired but inert
+- Fix favicon (real icon, not an unrelated orange circle) + stack encouragements with the submit button
+- Fix bucket-404 on empty resources, redesign review actions as select-then-confirm, CSS polish
+- Inline encouragements with the submit button, vertically centered
+- Use the real institutional logo for the header wordmark, not plain text
+- Use the actual UHHM-letters wordmark, not the institutional mark
+- Responsive base font size via svmin, not fixed 17px
+- Add plain-unit fallbacks for svmin/svh in case of unsupported engines
+- Size the YES canvas from its container, not window.innerHeight
+- Debounce the YES canvas resize handler and skip no-op resizes
+- Revert canvas sizing to window.innerWidth/innerHeight, gate resize on width change
+- Stop blocking native scroll on the YES canvas's touch handlers
+- Quicksand: font-display optional, not swap, to stop the text-jump on scroll
+- Use lvh/lvmin, not svh/svmin - svh was the wrong end of the viewport
+- Update style/main.css
+- Update style/main.css
+- YES canvas: size off its own container rect, not window.innerHeight
+- yes.js: freeze .hero-yes's height via inline style, don't trust svh alone
+- add responsive container width
+- deploy.yml: build and publish question_lint alongside the app binary
+- Make aggregate state graphs content-driven, not compiled Rust
+- One shared, content-labeled Confirm button per alternative instead of one per row
+- get_resource/get_requirement_options: #[server(default)] on params
+- Add optional Alternative.image and Feature.color/icon for richer layouts
+- Drop the feature list's left-padding
+- Drop question-report entirely, obfuscate the mailto link instead
+- Transition.from: state graphs deeper than one decision
+- Alternative.images: array of urls, rendered as a Swiper card deck
+- Reseed lost event history from the KV projection on transition
+- Lighten the comment load
+- Validate action targets; format timestamps client-side; clippy cleanup
+- Question nav + gateway alternatives
+- Responsible note under the title; followup pages out of the nav until a chain exists
+- README: what the engine provides
+- Feature icons: masked span painted by currentColor, not <img>
+- Responsible note: one line, same hue and size as the hero description
+- Responsible note as <small>: meta information, dimmer than the description
+- Responsible note back to the footer, above the question nav
+- Bound inputs: a field that loads its value from a sibling-parameterized resource
+- add some more width to our alternatives
+- Accent to a dusty press-cyan, a muted echo of the canvas's cyan ink
+- Editor type in rem: prosekit's px typography ignored the responsive root
+- Ban px from stylesheets: every length rem/em off the responsive root
+- No translucent input chrome: solid ink-dim placeholders and embed meta
+- Editor type scales for real: drop prosekit typography.css, fix selectors
+- Stable server fn endpoints: open tabs survive deploys
+- Drop stray local tool temp file, ignore .claude/
+- Noise-driven YES, sticky hero with frosted cards, full light theme
+- increase translucency of laternative cards
+- Showcase jq test tracks Gitea repo shape and website-first links
+- Gesture input type, redoal-relay client, gitea_releases, content-driven branding
+- Echo thumbnails fade in via timeout, not rAF
+- Trigger deploy: redoal OAuth2 credentials now configured
+- Deploy becomes publish: portal ships as a versioned release artifact
+- Semver releases cut with cargo-release; publish on v* tags only
+- Docs: release/rollout flow after the instance-ownership refactor
+- README: frame portal as a generic multi-site question engine
+- Design doc: filesystem routes, sections, dynamic segments
+- Filesystem routes, sections, dynamic segments; instant YES hero
+
+
+## What each site runs
+
+Read from the hosts on 2026-09-22; a rollout is a pin bump in the
+site's content repo (`PORTAL_RELEASE` in its `deploy.yml`), or a manual
+tarball deploy on kasse.
+
+| Site | Host | Instance | Version |
+|---|---|---|---|
+| uhhm.no | ergo | `app@uhhm-portal` | v0.3.35 |
+| redoal.com | ergo | `app@redoal-portal` | v0.3.35 |
+| westra.klingenbergbygg.no | kasse | `app@westra-portal` | v0.3.35 |
+| portal.klingenbergbygg.no | kasse | `app@klingenberg-portal` | v0.3.35 |

Cargo.lock

@@ -2948,7 +2948,7 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.2.3"
+version = "0.3.36"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -2970,6 +2970,7 @@ dependencies = [
  "leptos_router",
  "openidconnect",
  "proptest",
+ "pulldown-cmark",
  "serde",
  "serde_json",
  "serde_yaml",
@@ -3104,6 +3105,24 @@ dependencies = [
  "unarray",
 ]
 
+[[package]]
+name = "pulldown-cmark"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
+dependencies = [
+ "bitflags 2.13.1",
+ "memchr",
+ "pulldown-cmark-escape",
+ "unicase",
+]
+
+[[package]]
+name = "pulldown-cmark-escape"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "007d8adb5ddab6f8e3f491ac63566a7d5002cc7ed73901f72057943fa71ae1ae"
+
 [[package]]
 name = "quick-error"
 version = "1.2.3"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.2.3"
+version = "0.3.36"
 edition = "2021"
 
 [lib]
@@ -12,6 +12,9 @@ leptos_meta = { version = "0.8" }
 leptos_router = { version = "0.8" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+# Inline markdown for content descriptions (links, emphasis, code) -
+# runs on both server and client renders, so not feature-gated.
+pulldown-cmark = { version = "0.13", default-features = false, features = ["html"] }
 
 # --- server only ---
 leptos_axum = { version = "0.8", optional = true }
@@ -103,11 +106,20 @@ ssr = [
 [dev-dependencies]
 proptest = "1"
 
+[[test]]
+name = "jetstream"
+required-features = ["ssr"]
+
 [[bin]]
 name = "question_lint"
 path = "src/bin/question_lint.rs"
 required-features = ["ssr"]
 
+[[bin]]
+name = "needs_replay"
+path = "src/bin/needs_replay.rs"
+required-features = ["ssr"]
+
 [profile.wasm-release]
 inherits = "release"
 opt-level = 'z'
@@ -131,6 +143,12 @@ bin-default-features = false
 lib-features = ["hydrate"]
 lib-default-features = false
 lib-profile-release = "wasm-release"
+# Content-hashed pkg names (portal.<hash>.js/wasm/css) + hash.txt: a
+# freshly served page can never reference a stale cached bundle - an
+# iPhone kept a heuristically-cached portal.js across three releases
+# and paired it with new wasm, silently killing hydration. Runtime
+# needs LEPTOS_HASH_FILES=true (set in each content repo's deploy env).
+hash-files = true
 
 # cargo release <level> is how a portal version is cut: bump, commit,
 # tag v{{version}}, push. CI (publish.yml) reacts to the tag and

README.md

@@ -8,9 +8,12 @@ serves is declared in its content repo, and the same build serves any
 number of sites.
 
 Point an instance at a content repo and that repo *is* the site:
-pages, copy, state graphs, and branding (`site.yaml`: title,
+pages, copy, state graphs, branding, and even the landing hero
-wordmark, and which hero the landing page opens on — the YES canvas,
+(`site.yaml`: title, wordmark, and `hero: {kind: module, module:
-a gesture-drawing canvas wired to a relay, or plain copy). Content
+hero.js}` — a JavaScript module the content repo ships, served
+same-origin at `/site/<path>`, that portal mounts at parse time and
+stops on navigation; the YES canvas and redoal's sine swings are both
+content, not engine). Content
 pushes hot-reload every running instance; instances differ only by
 env vars. [uhhm.no](https://uhhm.no)
 ([uhhm/questions](https://project.uhhm.no/uhhm/questions)) and
@@ -36,6 +39,23 @@ stream.
   `requires_chain` gates a page on verifiable answer provenance next
   to `qualifies`' Kanidm-group identity gate (see
   `docs/design/filesystem-routes.md`).
+- **Gesture and voice fields** (`gesture.js`, `voice.js`): a stroke
+  becomes a redoal gesture key through a relay (ADR-0013/0015 in the
+  redoal repo) - the input shows the key's own decode under the
+  stroke, who is at a similar shape now, and *places* with recordings
+  the visitor can pick to make that key theirs; a voice field records
+  in the browser and leaves the audio at a key. Actions may be
+  templated from the answer (`/shape/{curve.key}`) onto dynamic
+  pages, whose URL segment also fills `value: "{key}"` presets and
+  `url` resource sources; resource items with an https `audio` field
+  render a player.
+- **Announced pages** (`src/announce.rs`): a question with an
+  `event: {starts, duration, place}` window is announced in the
+  header (not the footer nav) while the window is open, becomes a
+  followup when it closes, and its record in the runtime-owned
+  `portal_events` bucket moves to `awaiting_summary` - a "post what
+  happened" task any review desk can read, published on NATS like a
+  decision. A one-minute sweeper keeps it all idempotent.
 - **State machines as content** (`src/aggregates/`): `aggregates.yaml`
   declares each bucket's states and legal transitions; the engine
   replays a record's event history and refuses undeclared moves, with
@@ -50,7 +70,22 @@ stream.
 - **Answer chains** (`src/chain.rs`): each submission hashes its
   parent(s), so a visitor's path through the questions is a verifiable
   lineage; `?chain=` links carry it, and self-service transitions
-  (unsubscribe) authorize by holding one.
+  (unsubscribe) authorize by holding one. The question nav reads it
+  too: a `followup` page is offered only once the visitor has earned
+  it - the chain verifiably answered the alternative that leads there,
+  or it hangs off an earned page by a link that records nothing. A
+  page behind an answer they have not given is never offered.
+- **Business needs as a checkable spec** (`src/needs.rs`,
+  `question_lint`): a content repo may ship a `needs.yaml` saying who
+  wants what, which bucket the answer must land in, and which group
+  has to carry it to a finished state. The lint proves the structure
+  (a path of submissions within an effort budget, a desk held by that
+  group, every finished state reachable, no record stranding; a
+  `planned` need warns instead of failing). Its personas - visitors in
+  their own words - become typed `choice` tasks for any external
+  answering engine (`--needs-tasks`, `--skim` for headings only) whose
+  picks are graded with `--needs-score`: a misroute is a wording
+  defect. The runtime never reads the file.
 - **Live resources** (`src/resource.rs`): content can pull a KV
   bucket, Gitea starred/org repos/releases, or any public JSON URL
   (SSRF fail-closed), reshaped by a content-declared `jq` filter.
@@ -102,9 +137,17 @@ cargo release patch        # or minor / major
 That bumps `Cargo.toml`, tags `v<version>`, and pushes; CI
 (`.gitea/workflows/publish.yml`) reacts to the tag, builds once, and
 attaches `portal-v<version>.tar.gz` (`portal` + `question_lint` +
-`site/`) to the Gitea release. Plain pushes to `main` only run the
+`hash.txt` + `site/`) to the Gitea release. Pkg files are
+content-hashed (`hash-files = true`; instances run with
+`LEPTOS_HASH_FILES=true`), so a freshly served page can never pair a
+stale cached bundle with new wasm. Plain pushes to `main` only run the
 tests (`test.yml`) — nothing reaches production from this repo.
 
+Before cutting, move the `Unreleased` lines in `CHANGELOG.md` under a
+heading for the new version. That section becomes the Gitea release
+notes, and the table at the end of the file records which version each
+site runs; update it when a pin moves.
+
 **Roll it out** (in a content repo): edit one line in that repo's
 `.gitea/workflows/deploy.yml` —
 

gesture.js

@@ -12,8 +12,10 @@
 //
 // When a relay URL is given, the widget also speaks the redoal-relay
 // protocol (ADR-0013 in the redoal repo): announce the stroke, receive
-// an ack carrying the stroke's gesture key + the key's own decoded
+// an ack carrying the stroke's gesture key plus the key's own decoded
-// path ("what the network heard", drawn as a ghost), and receive
+// path - "what the network heard", drawn as a ghost under the stroke
+// when the key is v2 or later (ADR-0014's ordered turning chain; a v1
+// key's histogram decode is a blob and stays hidden) - and receive
 // echoes of similar strokes other visitors drew, shown as thumbnails.
 // Everything network is best-effort: no relay, refused connection, or
 // a dropped socket all degrade to a plain offline drawing input.
@@ -26,13 +28,13 @@
 const THEMES = {
     dark: {
         stroke: '#8ec2c0',
-        ghost: 'rgba(255, 255, 255, 0.28)',
         echo: '#8ec2c0',
+        ghost: 'rgba(255, 255, 255, 0.28)',
     },
     light: {
         stroke: '#47807e',
-        ghost: 'rgba(29, 29, 27, 0.30)',
         echo: '#47807e',
+        ghost: 'rgba(29, 29, 27, 0.30)',
     },
 };
 
@@ -41,15 +43,87 @@ const MAX_ECHOES = 8;
 const RECONNECT_BASE_MS = 1000;
 const RECONNECT_MAX_MS = 30000;
 
+// ── Convergence animation (ink → what the network heard) ──────────
+//
+// When the ack lands, a glowing copy of the stroke peels off and
+// converges point-by-point onto the key's decoded path: a wave of
+// "being understood" travels from the stroke's start to its end,
+// and the ghost materializes where the light settles. WebGL point
+// sprites with additive glow on a dedicated overlay canvas; the 2d
+// layer underneath never changes its final render, so losing WebGL
+// (or prefers-reduced-motion) degrades to exactly today's behavior.
+const CONVERGE_MS = 1500;
+const CONVERGE_FADE_MS = 450;
+const CONVERGE_POINTS = 128;
+const CONVERGE_STAGGER = 0.6; // fraction of the timeline spent on the travelling wave
+
+const GLOW_VERT = `
+attribute vec2 aFrom;
+attribute vec2 aTo;
+attribute float aIndex;
+uniform float uT;
+uniform vec2 uResolution;
+uniform float uDpr;
+varying float vLife;
+void main() {
+    float lead = aIndex * ${CONVERGE_STAGGER};
+    float p = clamp((uT * ${1.0 + CONVERGE_STAGGER} - lead), 0.0, 1.0);
+    float e = p < 0.5 ? 4.0 * p * p * p : 1.0 - pow(-2.0 * p + 2.0, 3.0) / 2.0;
+    vec2 pos = mix(aFrom, aTo, e);
+    vec2 clip = (pos / uResolution) * 2.0 - 1.0;
+    gl_Position = vec4(clip.x, -clip.y, 0.0, 1.0);
+    float pulse = 1.0 + 1.4 * sin(3.14159 * p);
+    gl_PointSize = 9.0 * uDpr * pulse;
+    vLife = p;
+}`;
+
+const GLOW_FRAG = `
+precision mediump float;
+uniform vec3 uColor;
+uniform float uAlpha;
+varying float vLife;
+void main() {
+    vec2 d = gl_PointCoord - 0.5;
+    float fall = exp(-dot(d, d) * 18.0);
+    float breathe = 0.55 + 0.45 * sin(3.14159 * vLife);
+    gl_FragColor = vec4(uColor, 1.0) * (fall * uAlpha * breathe);
+}`;
+
+// Uniform arc-length resample of a pixel-space polyline to n points.
+function resamplePx(points, n) {
+    if (points.length === 1) return Array(n).fill(points[0]);
+    const dists = [0];
+    for (let i = 1; i < points.length; i++) {
+        const dx = points[i][0] - points[i - 1][0];
+        const dy = points[i][1] - points[i - 1][1];
+        dists.push(dists[i - 1] + Math.hypot(dx, dy));
+    }
+    const total = dists[dists.length - 1] || 1;
+    const out = [];
+    let seg = 0;
+    for (let i = 0; i < n; i++) {
+        const target = (i / (n - 1)) * total;
+        while (seg < points.length - 2 && dists[seg + 1] < target) seg++;
+        const span = dists[seg + 1] - dists[seg] || 1;
+        const t = (target - dists[seg]) / span;
+        out.push([
+            points[seg][0] + (points[seg + 1][0] - points[seg][0]) * t,
+            points[seg][1] + (points[seg + 1][1] - points[seg][1]) * t,
+        ]);
+    }
+    return out;
+}
+
 class GestureWidget {
-    constructor(container, hidden, relayUrl, hero) {
+    constructor(container, hidden, relayUrl) {
         this.container = container;
         this.hidden = hidden || null;
         this.relayUrl = relayUrl || '';
-        this.hero = !!hero;
-        this.points = [];
         this.ghost = null;
-        this.ambient = []; // hero mode: echoed strokes drawn in place
+        this.ownKey = null;
+        this.selected = null; // {key, path, distance} - a place the visitor picked
+        this.seenKeys = new Set();
+        this.points = [];
         this.drawing = false;
         this.stopped = false;
         this.ws = null;
@@ -60,11 +134,25 @@ class GestureWidget {
         this.canvas = document.createElement('canvas');
         this.canvas.className = 'gesture-canvas';
         container.appendChild(this.canvas);
-        if (!this.hero) {
+        // Overlay for the convergence glow; sized with the main canvas,
-            this.echoes = document.createElement('div');
+        // inert to pointers, empty until an ack arrives.
-            this.echoes.className = 'gesture-echoes';
+        this.glow = document.createElement('canvas');
-            container.appendChild(this.echoes);
+        this.glow.className = 'gesture-glow';
-        }
+        this.glow.style.position = 'absolute';
+        this.glow.style.pointerEvents = 'none';
+        if (!container.style.position) container.style.position = 'relative';
+        container.appendChild(this.glow);
+        this.gl = null;
+        this.animFrame = null;
+        this.converging = false;
+        this.echoes = document.createElement('div');
+        this.echoes.className = 'gesture-echoes';
+        this.echoes.setAttribute('role', 'listbox');
+        this.echoes.setAttribute('aria-label', 'places near your shape');
+        container.appendChild(this.echoes);
+        this.empty = document.createElement('p');
+        this.empty.className = 'gesture-empty';
+        container.appendChild(this.empty);
         if (this.relayUrl) {
             this.status = document.createElement('span');
             this.status.className = 'gesture-status offline';
@@ -104,6 +192,13 @@ class GestureWidget {
         this.ctx.scale(dpr, dpr);
         this.cssWidth = rect.width;
         this.cssHeight = rect.height;
+        this.glow.style.left = `${this.canvas.offsetLeft}px`;
+        this.glow.style.top = `${this.canvas.offsetTop}px`;
+        this.glow.style.width = `${rect.width}px`;
+        this.glow.style.height = `${rect.height}px`;
+        this.glow.width = this.canvas.width;
+        this.glow.height = this.canvas.height;
+        this.cancelConvergence(); // buffers are in old pixels
     }
 
     pos(e) {
@@ -115,11 +210,16 @@ class GestureWidget {
         e.preventDefault();
         this.canvas.setPointerCapture(e.pointerId);
         // One stroke only - a new pointerdown replaces the old drawing
-        // (and any ghost/ambient trails from the previous round).
+        // (and any ghost from the previous round).
         this.drawing = true;
-        this.points = [this.pos(e)];
+        this.cancelConvergence();
         this.ghost = null;
-        this.ambient = [];
+        this.ownKey = null;
+        this.selected = null;
+        this.seenKeys.clear();
+        this.echoes.replaceChildren();
+        this.empty.textContent = '';
+        this.points = [this.pos(e)];
         this.render();
     }
 
@@ -217,28 +317,77 @@ class GestureWidget {
             return;
         }
         if (msg.type === 'ack') {
-            if (this.points.length >= 2) {
+            this.ownKey = msg.key;
-                this.setValue({ points: this.normalized(), key: msg.key });
+            // Version nibble is the key's first hex digit.
-            }
+            const version = parseInt((msg.key || '0')[0], 16);
-            this.ghost = msg.path;
+            this.ownGhost = version >= 2 && Array.isArray(msg.path) ? msg.path : null;
-            this.render();
+            this.applySelection();
-        } else if (msg.type === 'echo') {
+            // Places arrive right after the ack; say so if none do.
-            if (this.hero) {
+            clearTimeout(this.emptyTimer);
-                this.ambient.push(msg.path);
+            this.emptyTimer = setTimeout(() => {
-                if (this.ambient.length > MAX_ECHOES) this.ambient.shift();
+                if (!this.echoes.children.length) this.empty.textContent = msg.empty || 'Nothing kept at this shape yet.';
-                this.render();
+            }, 1500);
-            } else {
+        } else if (msg.type === 'echo' || msg.type === 'place') {
-                this.addEchoThumbnail(msg);
+            if (!msg.key || this.seenKeys.has(msg.key)) return;
-            }
+            this.seenKeys.add(msg.key);
+            this.empty.textContent = '';
+            this.addEchoThumbnail(msg);
         }
         // 'error' frames are intentionally silent: the widget is a
         // form field first, and a rate-limited announce shouldn't
         // alarm anyone mid-form.
     }
 
+    // The key the input carries: the visitor's own, or the place they
+    // picked (selection re-derives the key - the ghost under the
+    // stroke becomes that place's decode, and the answer records both).
+    applySelection() {
+        if (this.points.length < 2) return;
+        const points = this.normalized();
+        const before = this.ghost;
+        if (this.selected) {
+            this.ghost = this.selected.path;
+            this.setValue({ points, key: this.selected.key, own_key: this.ownKey, selected_from: this.ownKey, selected_distance: this.selected.distance });
+        } else {
+            this.ghost = this.ownGhost || null;
+            this.setValue({ points, key: this.ownKey });
+        }
+        if (this.ghost && this.ghost !== before) this.startConvergence(this.ghost);
+        for (const el of this.echoes.children) {
+            el.classList.toggle('selected', !!this.selected && el.dataset.key === this.selected.key);
+            el.setAttribute('aria-selected', String(!!this.selected && el.dataset.key === this.selected.key));
+        }
+        this.render();
+    }
+
+    select(thumb) {
+        const key = thumb.dataset.key;
+        if (this.selected && this.selected.key === key) {
+            this.selected = null;
+        } else {
+            this.selected = { key, path: JSON.parse(thumb.dataset.path), distance: Number(thumb.dataset.distance) };
+            // The relay counts picks per place for ranking.
+            if (this.ws && this.ws.readyState === WebSocket.OPEN && this.ownKey) {
+                this.ws.send(JSON.stringify({ type: 'select', key, from: this.ownKey, distance: this.selected.distance }));
+            }
+        }
+        this.applySelection();
+    }
+
     addEchoThumbnail(msg) {
         const thumb = document.createElement('canvas');
-        thumb.className = 'gesture-echo';
+        thumb.className = 'gesture-echo' + (msg.type === 'place' ? ' place' : '');
+        thumb.dataset.key = msg.key;
+        thumb.dataset.path = JSON.stringify(msg.path || []);
+        thumb.dataset.distance = String(msg.distance || 0);
+        thumb.setAttribute('role', 'option');
+        thumb.setAttribute('tabindex', '0');
+        thumb.setAttribute('aria-selected', 'false');
+        thumb.title = msg.type === 'place'
+            ? `A place with ${msg.recordings || 0} recording${msg.recordings === 1 ? '' : 's'} - tap to make it your address`
+            : 'Someone at this shape right now';
+        thumb.addEventListener('click', () => this.select(thumb));
+        thumb.addEventListener('keydown', (e) => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); this.select(thumb); } });
         // Closer strokes render stronger; 500 is comfortably past the
         // relay's default threshold, so everything stays visible.
         const strength = Math.max(0.35, Math.min(1, 1 - msg.distance / 500));
@@ -260,6 +409,140 @@ class GestureWidget {
         setTimeout(() => thumb.classList.add('shown'), 30);
     }
 
+    // ── Convergence ────────────────────────────────────────────────
+
+    initGlow() {
+        if (this.gl) return this.gl;
+        const gl = this.glow.getContext('webgl', { alpha: true, premultipliedAlpha: true });
+        if (!gl) return null;
+        const compile = (type, src) => {
+            const s = gl.createShader(type);
+            gl.shaderSource(s, src);
+            gl.compileShader(s);
+            return s;
+        };
+        const prog = gl.createProgram();
+        gl.attachShader(prog, compile(gl.VERTEX_SHADER, GLOW_VERT));
+        gl.attachShader(prog, compile(gl.FRAGMENT_SHADER, GLOW_FRAG));
+        gl.linkProgram(prog);
+        if (!gl.getProgramParameter(prog, gl.LINK_STATUS)) return null;
+        gl.useProgram(prog);
+        this.gl = gl;
+        this.glProg = prog;
+        this.glLoc = {
+            aFrom: gl.getAttribLocation(prog, 'aFrom'),
+            aTo: gl.getAttribLocation(prog, 'aTo'),
+            aIndex: gl.getAttribLocation(prog, 'aIndex'),
+            uT: gl.getUniformLocation(prog, 'uT'),
+            uResolution: gl.getUniformLocation(prog, 'uResolution'),
+            uDpr: gl.getUniformLocation(prog, 'uDpr'),
+            uColor: gl.getUniformLocation(prog, 'uColor'),
+            uAlpha: gl.getUniformLocation(prog, 'uAlpha'),
+        };
+        this.glBufFrom = gl.createBuffer();
+        this.glBufTo = gl.createBuffer();
+        this.glBufIndex = gl.createBuffer();
+        return gl;
+    }
+
+    // The ghost's pixel frame - same fit drawPath uses.
+    ghostToPx(path) {
+        const scale = (Math.min(this.cssWidth, this.cssHeight) / 2) * 0.8;
+        const cx = this.cssWidth / 2, cy = this.cssHeight / 2;
+        return path.map(([x, y]) => [cx + x * scale, cy + y * scale]);
+    }
+
+    startConvergence(targetPath) {
+        this.cancelConvergence();
+        if (!targetPath || this.points.length < 2) return;
+        if (window.matchMedia('(prefers-reduced-motion: reduce)').matches) return;
+        const gl = this.initGlow();
+        if (!gl) return;
+
+        const dpr = window.devicePixelRatio || 1;
+        const from = resamplePx(this.points.map((p) => [p.x, p.y]), CONVERGE_POINTS);
+        const to = resamplePx(this.ghostToPx(targetPath), CONVERGE_POINTS);
+        const f = new Float32Array(CONVERGE_POINTS * 2);
+        const t = new Float32Array(CONVERGE_POINTS * 2);
+        const idx = new Float32Array(CONVERGE_POINTS);
+        for (let i = 0; i < CONVERGE_POINTS; i++) {
+            f[i * 2] = from[i][0] * dpr;
+            f[i * 2 + 1] = from[i][1] * dpr;
+            t[i * 2] = to[i][0] * dpr;
+            t[i * 2 + 1] = to[i][1] * dpr;
+            idx[i] = i / (CONVERGE_POINTS - 1);
+        }
+        const bind = (buf, data, loc, size) => {
+            gl.bindBuffer(gl.ARRAY_BUFFER, buf);
+            gl.bufferData(gl.ARRAY_BUFFER, data, gl.STATIC_DRAW);
+            gl.enableVertexAttribArray(loc);
+            gl.vertexAttribPointer(loc, size, gl.FLOAT, false, 0, 0);
+        };
+        gl.useProgram(this.glProg);
+        bind(this.glBufFrom, f, this.glLoc.aFrom, 2);
+        bind(this.glBufTo, t, this.glLoc.aTo, 2);
+        bind(this.glBufIndex, idx, this.glLoc.aIndex, 1);
+        gl.viewport(0, 0, this.glow.width, this.glow.height);
+        gl.uniform2f(this.glLoc.uResolution, this.glow.width, this.glow.height);
+        gl.uniform1f(this.glLoc.uDpr, dpr);
+
+        const light = this._themeQuery.matches;
+        const color = light ? [0x47 / 255, 0x80 / 255, 0x7e / 255] : [0x8e / 255, 0xc2 / 255, 0xc0 / 255];
+        gl.uniform3f(this.glLoc.uColor, color[0], color[1], color[2]);
+        // Additive light on the dark ground; normal ink on the light one.
+        gl.enable(gl.BLEND);
+        if (light) gl.blendFunc(gl.SRC_ALPHA, gl.ONE_MINUS_SRC_ALPHA);
+        else gl.blendFunc(gl.ONE, gl.ONE);
+
+        this.converging = true;
+        this.render();
+        const started = performance.now();
+        const step = (now) => {
+            const raw = (now - started) / CONVERGE_MS;
+            if (raw >= 1) {
+                // Deposit the ghost, then let the glow breathe out.
+                if (this.converging) {
+                    this.converging = false;
+                    this.render();
+                }
+                const fade = (now - started - CONVERGE_MS) / CONVERGE_FADE_MS;
+                if (fade >= 1) {
+                    this.cancelConvergence();
+                    return;
+                }
+                gl.clearColor(0, 0, 0, 0);
+                gl.clear(gl.COLOR_BUFFER_BIT);
+                gl.uniform1f(this.glLoc.uT, 1);
+                gl.uniform1f(this.glLoc.uAlpha, 0.32 * (1 - fade));
+                gl.drawArrays(gl.POINTS, 0, CONVERGE_POINTS);
+            } else {
+                gl.clearColor(0, 0, 0, 0);
+                gl.clear(gl.COLOR_BUFFER_BIT);
+                // Trailing passes give the wave a comet tail.
+                for (const [lag, alpha] of [[0, 0.32], [0.035, 0.16], [0.07, 0.08], [0.105, 0.04]]) {
+                    gl.uniform1f(this.glLoc.uT, Math.max(0, raw - lag));
+                    gl.uniform1f(this.glLoc.uAlpha, alpha);
+                    gl.drawArrays(gl.POINTS, 0, CONVERGE_POINTS);
+                }
+            }
+            this.animFrame = requestAnimationFrame(step);
+        };
+        this.animFrame = requestAnimationFrame(step);
+    }
+
+    cancelConvergence() {
+        if (this.animFrame) cancelAnimationFrame(this.animFrame);
+        this.animFrame = null;
+        if (this.converging) {
+            this.converging = false;
+            this.render();
+        }
+        if (this.gl) {
+            this.gl.clearColor(0, 0, 0, 0);
+            this.gl.clear(this.gl.COLOR_BUFFER_BIT);
+        }
+    }
+
     // ── Rendering ──────────────────────────────────────────────────
 
     // Draw a normalized (-1..1) path fitted into w×h with padding.
@@ -284,12 +567,7 @@ class GestureWidget {
         if (!this.ctx) return;
         const t = this.theme();
         this.ctx.clearRect(0, 0, this.cssWidth, this.cssHeight);
-        for (const path of this.ambient) {
+        if (this.ghost && !this.converging) {
-            this.ctx.globalAlpha = 0.25;
-            this.drawPath(this.ctx, path, this.cssWidth, this.cssHeight, t.echo, 1.5, 0.2);
-        }
-        this.ctx.globalAlpha = 1;
-        if (this.ghost) {
             this.drawPath(this.ctx, this.ghost, this.cssWidth, this.cssHeight, t.ghost, 2, 0.2);
         }
         if (this.points.length >= 1) {
@@ -308,6 +586,8 @@ class GestureWidget {
 
     stop() {
         this.stopped = true;
+        if (this.animFrame) cancelAnimationFrame(this.animFrame);
+        clearTimeout(this.emptyTimer);
         if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
         if (this.ws) {
             // The close event still fires, but scheduleReconnect
@@ -325,11 +605,8 @@ class GestureWidget {
 }
 
 export function mountGesture(container, hidden, relayUrl) {
-    return new GestureWidget(container, hidden, relayUrl, false);
+    // Dev convenience: `?relay=ws://127.0.0.1:9040` points every widget
-}
+    // on the page at a local relay (prod relays reject foreign Origins).
-
+    const override = new URLSearchParams(window.location.search).get('relay');
-// Hero variant: no form field to mirror into, and echoes render as
+    return new GestureWidget(container, hidden, override || relayUrl);
-// ambient strokes on the drawing canvas itself instead of thumbnails.
-export function mountGestureHero(container, relayUrl) {
-    return new GestureWidget(container, null, relayUrl, true);
 }

public/yes.js

@@ -1,578 +0,0 @@
-// Ported from ~/repos/webpage/content/visualize/ah.html ("YES - Rasterized
-// Lines"), the piece currently live at uhhm.no - kept as the actual asset,
-// not reinvented. Two changes from the original: exported as a class (no
-// auto-init on `window load`, since Leptos controls when this mounts) and
-// a `stop()` method that actually breaks the requestAnimationFrame loop -
-// the original ran forever once started, fine for a static page that's
-// the whole document, not fine in an SPA where this hero mounts/unmounts
-// as you navigate.
-
-export class RasterizedYES {
-    constructor() {
-        this.rasterCanvas = document.getElementById('rasterCanvas');
-        this.lineCanvas = document.getElementById('lineCanvas');
-
-        // The Rust side only constructs this once it's confirmed (via a
-        // NodeRef) that the canvas is mounted, but that guard has shown
-        // a real gap on fast client-side re-navigation back to `/` -
-        // this is the actual failure point, so it gets its own defense
-        // rather than depending on getting that timing exactly right
-        // from the other side of the wasm boundary. Leaving the
-        // instance otherwise-inert (no crash, no animation) rather than
-        // throwing mid-render - `stop()` already tolerates a partially
-        // (non-)initialized instance.
-        if (!this.rasterCanvas || !this.lineCanvas) {
-            console.warn('RasterizedYES: canvas not in DOM yet, skipping');
-            this.destroyed = true;
-            return;
-        }
-
-        this.rasterCtx = this.rasterCanvas.getContext('2d');
-        this.lineCtx = this.lineCanvas.getContext('2d');
-
-        this.lines = [];
-        this.rasterData = null;
-        this.isActive = true;
-        this.destroyed = false;
-        this.time = 0;
-
-        this.containmentStrength = 0.5;
-        this.wiggleAmount = 0.5;
-
-        // .hero-canvas is inset:0 inside this - freezing an inline
-        // height here (below) is what actually locks the box, not
-        // just reading its rect.
-        this.heroEl = this.rasterCanvas.closest('.hero');
-
-        this.setupCanvas();
-        this.setupResizeHandler();
-        this.setupDrift();
-        this.setupTheme();
-        this.setupScrollFade();
-        this.setupClickHandler();
-        this.rasterizeText();
-        this.initializeLines();
-        this.animate();
-    }
-
-    stop() {
-        this.destroyed = true;
-        if (this._resizeHandler) {
-            window.removeEventListener('resize', this._resizeHandler);
-        }
-        if (this._themeQuery) {
-            this._themeQuery.removeEventListener('change', this._themeHandler);
-        }
-        if (this._scrollHandler) {
-            window.removeEventListener('scroll', this._scrollHandler);
-        }
-    }
-
-    // The hero is position: sticky (main.css), so without this the
-    // title/wordmark stay pinned at the viewport bottom for the whole
-    // page and ghost through the translucent cards scrolling over
-    // them. Fade the copy out across the first half-screen of scroll;
-    // visibility: hidden at the end so the wordmark link can't be
-    // clicked while invisible.
-    setupScrollFade() {
-        this.heroCopy = this.heroEl ? this.heroEl.querySelector('.hero-copy') : null;
-        if (!this.heroCopy) return;
-        this._scrollHandler = () => {
-            const opacity = Math.max(0, 1 - window.scrollY / (this.displayHeight * 0.5));
-            this.heroCopy.style.opacity = opacity;
-            this.heroCopy.style.visibility = opacity <= 0.01 ? 'hidden' : '';
-        };
-        window.addEventListener('scroll', this._scrollHandler, { passive: true });
-        this._scrollHandler();
-    }
-
-    // Canvas paint can't read CSS custom properties, so the piece
-    // carries its own copy of both palettes and follows
-    // prefers-color-scheme itself - values must track main.css's :root
-    // (--paper especially: the fade fill IS the page background where
-    // the canvas shows through translucent cards). Dark keeps the
-    // original neon-on-black inks; light restates them as CMYK process
-    // inks dark enough to carry on paper, since 80%-lightness pastels
-    // vanish on white.
-    setupTheme() {
-        this._themeQuery = window.matchMedia('(prefers-color-scheme: light)');
-        this._themeHandler = () => {
-            this.applyTheme();
-            // Repaint the raster ghost in the new theme's ink and
-            // hard-clear the trails - a slow 3%-alpha fade from the
-            // old paper color would smear across the flip otherwise.
-            this.rasterizeText();
-            this.lineCtx.fillStyle = this.theme.paper;
-            this.lineCtx.fillRect(0, 0, this.displayWidth, this.displayHeight);
-        };
-        this._themeQuery.addEventListener('change', this._themeHandler);
-        this.applyTheme();
-    }
-
-    applyTheme() {
-        this.theme = this._themeQuery.matches
-            ? {
-                paper: '#f6f5f1',
-                fade: 'rgba(246, 245, 241, 0.03)',
-                // White ground so multiply (the light theme's CSS
-                // blend mode for #rasterCanvas) leaves the paper
-                // untouched; gray ink becomes the faint YES ghost.
-                rasterBg: '#ffffff',
-                rasterInk: '#6b6b6b',
-                strokes: [
-                    'hsla(185, 70%, 32%, 0.85)',
-                    'hsla(315, 60%, 38%, 0.85)',
-                    'hsla(50, 90%, 40%, 0.85)'
-                ]
-            }
-            : {
-                paper: '#0a0a0a',
-                fade: 'rgba(10, 10, 10, 0.03)',
-                rasterBg: '#111111',
-                rasterInk: '#ffffff',
-                strokes: [
-                    'hsla(180, 90%, 80%, 0.8)',
-                    'hsla(300, 90%, 80%, 0.8)',
-                    'hsla(60, 90%, 80%, 0.8)'
-                ]
-            };
-    }
-
-    // Reading .hero-canvas's rendered rect (a prior attempt at this)
-    // only helps if that rect actually stays put - and on real mobile
-    // Safari it didn't: .hero-copy (bottom-aligned via flexbox inside
-    // .hero-yes) kept sliding down as the address bar collapsed, even
-    // with a spec'd-stable viewport unit (svh, then lvh) driving the
-    // box's height. Either the browser isn't holding up its end, or
-    // something in the cascade is still landing on a live value - not
-    // provable from here without the device. Rather than keep
-    // guessing at which CSS viewport unit actually holds still, yes.js
-    // becomes the source of truth instead: it freezes .hero-yes's
-    // rendered height to a literal inline px value once, up front. An
-    // inline style always wins the cascade over the stylesheet's
-    // `height: 100svh`, so once this runs, nothing the browser does
-    // with that unit afterward can move the box - the number is fixed
-    // in the DOM, not recomputed from a unit at all.
-    setupCanvas() {
-        const pixelRatio = window.devicePixelRatio || 1;
-        const width = window.innerWidth;
-        const height = window.innerHeight;
-
-        if (this.heroEl) {
-            this.heroEl.style.height = height + 'px';
-        }
-
-        this.rasterCanvas.style.width = width + 'px';
-        this.rasterCanvas.style.height = height + 'px';
-        this.lineCanvas.style.width = width + 'px';
-        this.lineCanvas.style.height = height + 'px';
-
-        this.rasterCanvas.width = width * pixelRatio;
-        this.rasterCanvas.height = height * pixelRatio;
-        this.lineCanvas.width = width * pixelRatio;
-        this.lineCanvas.height = height * pixelRatio;
-
-        this.rasterCtx.scale(pixelRatio, pixelRatio);
-        this.lineCtx.scale(pixelRatio, pixelRatio);
-
-        this.displayWidth = width;
-        this.displayHeight = height;
-        this.pixelRatio = pixelRatio;
-    }
-
-    setupResizeHandler() {
-        // Gate on width, not height: mobile Safari's address-bar
-        // animation changes window.innerHeight continuously with no
-        // real layout change to react to (that's the live value this
-        // whole method exists to stop trusting). A genuine resize -
-        // orientation change, desktop window drag - always changes
-        // width too, so that's the real signal to re-freeze on.
-        this._resizeHandler = () => {
-            if (window.innerWidth === this.displayWidth) return;
-            this.setupCanvas();
-            this.rasterizeText();
-        };
-        window.addEventListener('resize', this._resizeHandler);
-    }
-
-    // The two behavior dials (containmentStrength from x, wiggleAmount
-    // from y) used to follow the pointer. Now a smooth noise field
-    // wanders them instead - the same 0..1 inputs a mouse would give,
-    // but drifting at cloud pace, so the piece breathes on its own and
-    // behaves identically with nobody touching it (which on a landing
-    // hero is most of the time, and on touch devices was always the
-    // case between taps). Value noise with two octaves: smooth
-    // (C1-continuous via smoothstep), never repeats visibly, no jumps.
-    setupDrift() {
-        const channel = (seed) => {
-            const rand = (i) => {
-                let h = Math.imul(i ^ seed, 2654435761) >>> 0;
-                h ^= h >>> 13;
-                h = Math.imul(h, 0x5bd1e995) >>> 0;
-                // The >>> 0 here is load-bearing: ^ yields a SIGNED
-                // 32-bit value, and without the reinterpret a set top
-                // bit made this "0..1" noise go as low as -0.5,
-                // pushing both dials below their intended floors.
-                h = (h ^ (h >>> 15)) >>> 0;
-                return h / 4294967296;
-            };
-            const noise = (t) => {
-                const i = Math.floor(t);
-                const f = t - i;
-                const s = f * f * (3 - 2 * f);
-                return rand(i) * (1 - s) + rand(i + 1) * s;
-            };
-            // Two octaves, renormalized to 0..1: the slow octave sets
-            // the overall weather, the faster one keeps it from
-            // feeling like a pendulum.
-            return (t) => (noise(t) * 2 / 3 + noise(t * 2.7 + 913) * 1 / 3);
-        };
-
-        // One full "weather change" roughly every DRIFT_PERIOD
-        // seconds per octave - the pace of watching clouds, not of a
-        // hand on a mouse.
-        this.driftPeriod = 25;
-        this.driftX = channel(0x9e3779b9);
-        this.driftY = channel(0x85ebca6b);
-
-        this.containmentStrength = 0.55;
-        this.wiggleAmount = 1.05;
-    }
-
-    updateDrift() {
-        const t = this.time / this.driftPeriod;
-        const x = this.driftX(t);
-        const y = this.driftY(t);
-        // Same mapping the mouse position used to feed.
-        this.containmentStrength = 0.1 + (x * 0.9);
-        this.wiggleAmount = 0.1 + (y * 1.9);
-    }
-
-    setupClickHandler() {
-        this.lineCanvas.addEventListener('click', () => {
-            this.restartAnimation();
-        });
-    }
-
-    restartAnimation() {
-        this.time = 0;
-        this.lineCtx.fillStyle = this.theme.paper;
-        this.lineCtx.fillRect(0, 0, this.displayWidth, this.displayHeight);
-        this.initializeLines();
-        this.isActive = true;
-    }
-
-    rasterizeText() {
-        const width = this.displayWidth;
-        const height = this.displayHeight;
-
-        const aspectRatio = width / height;
-        let fontSize;
-        if (aspectRatio < 1) {
-            fontSize = width * 0.4;
-        } else {
-            fontSize = height * 0.5;
-        }
-
-        this.fontSize = fontSize;
-
-        this.rasterCtx.font = `bold ${fontSize}px Arial, sans-serif`;
-        this.rasterCtx.textAlign = 'left';
-        this.rasterCtx.textBaseline = 'middle';
-
-        const fullTextMetrics = this.rasterCtx.measureText('YES');
-        const textWidth = fullTextMetrics.width;
-        const textStartX = (width - textWidth) / 2;
-        const textY = height / 2;
-
-        const letters = ['Y', 'E', 'S'];
-        this.letterPositions = [];
-        let currentX = textStartX;
-
-        for (let i = 0; i < letters.length; i++) {
-            const letterMetrics = this.rasterCtx.measureText(letters[i]);
-            this.letterPositions[i] = {
-                x: currentX,
-                y: textY,
-                width: letterMetrics.width,
-                centerX: currentX + letterMetrics.width / 2
-            };
-            currentX += letterMetrics.width;
-        }
-
-        this.letterRasters = [];
-
-        for (let i = 0; i < 3; i++) {
-            this.rasterCtx.fillStyle = '#111';
-            this.rasterCtx.fillRect(0, 0, width, height);
-
-            this.rasterCtx.fillStyle = '#ffffff';
-            this.rasterCtx.fillText(letters[i], this.letterPositions[i].x, this.letterPositions[i].y);
-
-            this.letterRasters[i] = this.rasterCtx.getImageData(0, 0, this.rasterCanvas.width, this.rasterCanvas.height);
-        }
-
-        // The visible layer, distinct from the letterRasters sampled
-        // above (those stay #111/#fff - isInSpecificLetter's red>128
-        // test depends on it): painted in theme ink so the ghost works
-        // under the theme's blend mode (overlay on dark, multiply on
-        // light - see #rasterCanvas in main.css).
-        this.rasterCtx.fillStyle = this.theme.rasterBg;
-        this.rasterCtx.fillRect(0, 0, width, height);
-        this.rasterCtx.fillStyle = this.theme.rasterInk;
-        this.rasterCtx.fillText('YES', textStartX, textY);
-
-        this.rasterData = this.rasterCtx.getImageData(0, 0, this.rasterCanvas.width, this.rasterCanvas.height);
-    }
-
-    isInSpecificLetter(x, y, letterIndex) {
-        const canvasX = x * this.pixelRatio;
-        const canvasY = y * this.pixelRatio;
-
-        if (!this.letterRasters || !this.letterRasters[letterIndex] ||
-            canvasX < 0 || canvasY < 0 ||
-            canvasX >= this.rasterCanvas.width || canvasY >= this.rasterCanvas.height) {
-            return false;
-        }
-
-        const index = (Math.floor(canvasY) * this.rasterCanvas.width + Math.floor(canvasX)) * 4;
-        const red = this.letterRasters[letterIndex].data[index];
-        return red > 128;
-    }
-
-    initializeLines() {
-        this.lines = [];
-        const numLines = 60;
-
-        const letterCentroids = this.calculateLetterCentroids();
-
-        for (let i = 0; i < numLines; i++) {
-            const letterIndex = Math.floor(i / (numLines / 3));
-            let startX, startY, centerX, centerY;
-
-            if (letterCentroids[letterIndex]) {
-                centerX = letterCentroids[letterIndex].x;
-                centerY = letterCentroids[letterIndex].y;
-
-                const startVariation = this.fontSize * 0.1;
-                startX = centerX + (Math.random() - 0.5) * startVariation;
-                startY = centerY + (Math.random() - 0.5) * startVariation;
-
-                if (!this.isInSpecificLetter(startX, startY, letterIndex)) {
-                    const nearestPoint = this.findNearestSpecificLetterPixel(startX, startY, letterIndex);
-                    if (nearestPoint) {
-                        startX = nearestPoint.x;
-                        startY = nearestPoint.y;
-                    } else {
-                        startX = centerX;
-                        startY = centerY;
-                    }
-                }
-            } else {
-                const letterPos = this.letterPositions[letterIndex];
-                startX = letterPos.centerX;
-                startY = letterPos.y;
-                centerX = startX;
-                centerY = startY;
-            }
-
-            // Stroke color lives on the theme, looked up per frame by
-            // letterIndex (see draw()) - not frozen per line - so a
-            // theme flip recolors live lines instead of leaving
-            // dark-theme neon smearing across light paper.
-            this.lines.push({
-                relativeX: (startX - centerX) / this.fontSize,
-                relativeY: (startY - centerY) / this.fontSize,
-                prevRelativeX: (startX - centerX) / this.fontSize,
-                prevRelativeY: (startY - centerY) / this.fontSize,
-                angle: Math.random() * Math.PI * 2,
-                letterIndex: letterIndex,
-                lastSeenInside: { x: (startX - centerX) / this.fontSize, y: (startY - centerY) / this.fontSize },
-                outsideDuration: 0
-            });
-        }
-    }
-
-    calculateLetterCentroids() {
-        const centroids = [];
-
-        for (let letterIndex = 0; letterIndex < 3; letterIndex++) {
-            let sumX = 0, sumY = 0, count = 0;
-
-            const letterPos = this.letterPositions[letterIndex];
-            const searchStartX = Math.max(0, letterPos.x - this.fontSize * 0.1);
-            const searchEndX = Math.min(this.displayWidth, letterPos.x + letterPos.width + this.fontSize * 0.1);
-            const searchStartY = Math.max(0, letterPos.y - this.fontSize * 0.6);
-            const searchEndY = Math.min(this.displayHeight, letterPos.y + this.fontSize * 0.6);
-
-            const step = Math.max(1, Math.floor(this.fontSize * 0.02));
-            for (let y = searchStartY; y <= searchEndY; y += step) {
-                for (let x = searchStartX; x <= searchEndX; x += step) {
-                    if (this.isInSpecificLetter(x, y, letterIndex)) {
-                        sumX += x;
-                        sumY += y;
-                        count++;
-                    }
-                }
-            }
-
-            if (count > 0) {
-                centroids[letterIndex] = {
-                    x: sumX / count,
-                    y: sumY / count
-                };
-            } else {
-                centroids[letterIndex] = {
-                    x: letterPos.centerX,
-                    y: letterPos.y
-                };
-            }
-        }
-
-        return centroids;
-    }
-
-    updateLines() {
-        this.time += 0.016;
-        this.updateDrift();
-        if (!this.isActive) return;
-
-        const letterCentroids = this.calculateLetterCentroids();
-
-        this.lines.forEach(line => {
-            line.prevRelativeX = line.relativeX;
-            line.prevRelativeY = line.relativeY;
-
-            const centroid = letterCentroids[line.letterIndex];
-            if (!centroid) return;
-
-            const currentX = centroid.x + line.relativeX * this.fontSize;
-            const currentY = centroid.y + line.relativeY * this.fontSize;
-
-            const currentlyInside = this.isInSpecificLetter(currentX, currentY, line.letterIndex);
-
-            if (currentlyInside) {
-                line.outsideDuration = 0;
-                line.lastSeenInside = { x: line.relativeX, y: line.relativeY };
-            } else {
-                line.outsideDuration++;
-            }
-
-            const visionDistance = 0.08 * this.fontSize;
-            const centerX = currentX + Math.cos(line.angle) * visionDistance;
-            const centerY = currentY + Math.sin(line.angle) * visionDistance;
-            const leftX = currentX + Math.cos(line.angle - 0.4) * visionDistance;
-            const leftY = currentY + Math.sin(line.angle - 0.4) * visionDistance;
-            const rightX = currentX + Math.cos(line.angle + 0.4) * visionDistance;
-            const rightY = currentY + Math.sin(line.angle + 0.4) * visionDistance;
-
-            const centerSees = this.isInSpecificLetter(centerX, centerY, line.letterIndex);
-            const leftSees = this.isInSpecificLetter(leftX, leftY, line.letterIndex);
-            const rightSees = this.isInSpecificLetter(rightX, rightY, line.letterIndex);
-
-            let speed = 0.02;
-
-            const attractionThreshold = Math.floor(15 + (1 - this.containmentStrength) * 45);
-
-            if (line.outsideDuration > attractionThreshold) {
-                const targetX = line.lastSeenInside.x;
-                const targetY = line.lastSeenInside.y;
-                const deltaX = targetX - line.relativeX;
-                const deltaY = targetY - line.relativeY;
-                const angleToTarget = Math.atan2(deltaY, deltaX);
-
-                let angleDiff = angleToTarget - line.angle;
-                while (angleDiff > Math.PI) angleDiff -= 2 * Math.PI;
-                while (angleDiff < -Math.PI) angleDiff += 2 * Math.PI;
-
-                const baseAttraction = Math.min(0.4, line.outsideDuration / 80);
-                const attractionStrength = baseAttraction * this.containmentStrength;
-                line.angle += angleDiff * attractionStrength;
-            }
-
-            if (centerSees) {
-                const baseWiggle = 0.15;
-                line.angle += (Math.random() - 0.5) * baseWiggle * this.wiggleAmount;
-            } else {
-                speed *= (0.3 + this.containmentStrength * 0.4);
-
-                const baseTurnStrength = 0.3 + (this.containmentStrength * 0.4);
-                const randomTurnAmount = 0.2 * this.wiggleAmount;
-
-                if (leftSees && !rightSees) {
-                    line.angle -= baseTurnStrength + Math.random() * randomTurnAmount;
-                } else if (rightSees && !leftSees) {
-                    line.angle += baseTurnStrength + Math.random() * randomTurnAmount;
-                } else {
-                    const randomTurn = (Math.random() - 0.5) * (0.8 + this.wiggleAmount * 0.7);
-                    line.angle += randomTurn;
-                }
-            }
-
-            line.relativeX += Math.cos(line.angle) * speed;
-            line.relativeY += Math.sin(line.angle) * speed;
-
-            line.relativeX = Math.max(-1.7, Math.min(1.7, line.relativeX));
-            line.relativeY = Math.max(-1.7, Math.min(1.7, line.relativeY));
-        });
-    }
-
-    findNearestSpecificLetterPixel(x, y, letterIndex) {
-        const searchRadius = this.fontSize * 0.08;
-        const step = Math.max(1, Math.floor(this.fontSize * 0.01));
-        let nearestPoint = null;
-        let nearestDistance = Infinity;
-
-        for (let dy = -searchRadius; dy <= searchRadius; dy += step) {
-            for (let dx = -searchRadius; dx <= searchRadius; dx += step) {
-                const testX = x + dx;
-                const testY = y + dy;
-
-                if (this.isInSpecificLetter(testX, testY, letterIndex)) {
-                    const distance = Math.sqrt(dx * dx + dy * dy);
-                    if (distance < nearestDistance) {
-                        nearestDistance = distance;
-                        nearestPoint = { x: testX, y: testY };
-                    }
-                }
-            }
-        }
-
-        return nearestPoint;
-    }
-
-    draw() {
-        this.lineCtx.fillStyle = this.theme.fade;
-        this.lineCtx.fillRect(0, 0, this.displayWidth, this.displayHeight);
-
-        const letterCentroids = this.calculateLetterCentroids();
-
-        this.lines.forEach(line => {
-            const centroid = letterCentroids[line.letterIndex];
-            if (!centroid) return;
-
-            const currentX = centroid.x + line.relativeX * this.fontSize;
-            const currentY = centroid.y + line.relativeY * this.fontSize;
-            const prevX = centroid.x + line.prevRelativeX * this.fontSize;
-            const prevY = centroid.y + line.prevRelativeY * this.fontSize;
-
-            if (prevX === currentX && prevY === currentY) return;
-
-            this.lineCtx.strokeStyle = this.theme.strokes[line.letterIndex];
-            this.lineCtx.lineWidth = this.fontSize * 0.003;
-            this.lineCtx.lineCap = 'round';
-
-            this.lineCtx.beginPath();
-            this.lineCtx.moveTo(prevX, prevY);
-            this.lineCtx.lineTo(currentX, currentY);
-            this.lineCtx.stroke();
-        });
-    }
-
-    animate() {
-        if (this.destroyed) return;
-        this.updateLines();
-        this.draw();
-        requestAnimationFrame(() => this.animate());
-    }
-}

src/announce.rs

@@ -0,0 +1,159 @@
+//! Announced pages (`Question.event`): keeps one `portal_events` record
+//! per event question and, once a window closes, moves it to
+//! `awaiting_summary` - the "post what happened" task - publishing the
+//! transition on `portal.answers.submitted` like any desk decision, so
+//! the desktop notifier and n8n hear it. Runs on a one-minute tick;
+//! every step is idempotent, so a restart or a content reload in the
+//! middle changes nothing.
+
+use crate::answers::{store_answer, Answer};
+use crate::content::EVENTS_BUCKET;
+use crate::events::{emit_answer_submitted, AnswerSubmitted};
+use crate::server::AppState;
+
+/// Alternative name stamped on the auto-created record and on the
+/// transition event - what an n8n workflow gates on.
+pub const EVENT_ALTERNATIVE: &str = "Announced";
+pub const SUMMARY_DUE_LABEL: &str = "Summary due";
+
+/// Record id for an event question: its id with `/` folded to `-`
+/// (`/events/opening` -> `events-opening`), so one page is one record
+/// however many times the sweeper runs.
+pub fn record_id(question_id: &str) -> String {
+    question_id.trim_matches('/').replace('/', "-")
+}
+
+pub async fn run(state: AppState) {
+    let mut tick = tokio::time::interval(std::time::Duration::from_secs(60));
+    loop {
+        tick.tick().await;
+        if let Err(e) = sweep(&state).await {
+            tracing::warn!(error = %e, "event sweep failed");
+        }
+    }
+}
+
+/// One pass: create missing records, close ended windows.
+pub async fn sweep(state: &AppState) -> anyhow::Result<()> {
+    let now_ms = chrono::Utc::now().timestamp_millis();
+    let questions = state.questions.load();
+    let events: Vec<_> = questions.values().filter(|q| q.event.is_some()).cloned().collect();
+    if events.is_empty() {
+        return Ok(());
+    }
+    let aggregates = state.aggregates.load();
+    let schema = aggregates
+        .get(EVENTS_BUCKET)
+        .ok_or_else(|| anyhow::anyhow!("no {EVENTS_BUCKET} schema"))?;
+    let store = match state.jetstream.get_key_value(EVENTS_BUCKET).await {
+        Ok(store) => Some(store),
+        Err(_) => None,
+    };
+
+    for q in events {
+        let event = q.event.as_ref().expect("filtered");
+        let (starts, ends) = match event.window_ms() {
+            Ok(w) => w,
+            Err(_) => continue, // validated on load; belt and braces
+        };
+        let id = record_id(&q.id);
+        let existing: Option<Answer> = match &store {
+            Some(store) => store
+                .get(&id)
+                .await?
+                .and_then(|bytes| serde_json::from_slice(&bytes).ok()),
+            None => None,
+        };
+        let responses = serde_json::json!({
+            "name": q.name,
+            "starts": event.starts,
+            "starts_ms": starts,
+            "ends_ms": ends,
+            "place": event.place,
+            "page": q.id,
+        });
+
+        let answer = match existing {
+            None => {
+                store_answer(
+                    &state.jetstream,
+                    &aggregates,
+                    EVENTS_BUCKET,
+                    id.clone(),
+                    &q.id,
+                    EVENT_ALTERNATIVE,
+                    &responses,
+                    now_ms,
+                )
+                .await?;
+                tracing::info!(question = %q.id, "event record created");
+                continue;
+            }
+            Some(a) => a,
+        };
+
+        // Content is the source of truth while the window is still
+        // open: a corrected date or place flows into the record, so the
+        // followup fires on the schedule the page actually announces.
+        if answer.state == schema.initial && answer.responses != responses {
+            let mut refreshed = answer.clone();
+            refreshed.responses = responses.clone();
+            if let Some(store) = &store {
+                store.put(&id, serde_json::to_vec(&refreshed)?.into()).await?;
+                tracing::info!(question = %q.id, "event record refreshed from content");
+            }
+        }
+
+        if answer.state == schema.initial && now_ms >= ends {
+            let target = "awaiting_summary";
+            let payload = serde_json::json!({ "to": target, "item": id, "by": "portal" });
+            match crate::aggregates::transition(&state.jetstream, schema, &id, target, payload.clone(), now_ms).await {
+                Ok(_) => {}
+                Err(crate::aggregates::TransitionError::UnknownAggregate) => {
+                    crate::aggregates::reseed(&state.jetstream, schema, &id, &answer.state, now_ms)
+                        .await
+                        .map_err(|e| anyhow::anyhow!("{e}"))?;
+                    crate::aggregates::transition(&state.jetstream, schema, &id, target, payload.clone(), now_ms)
+                        .await
+                        .map_err(|e| anyhow::anyhow!("{e}"))?;
+                }
+                Err(e) => return Err(anyhow::anyhow!("{e}")),
+            }
+            let mut answer = answer;
+            answer.state = target.to_string();
+            answer.decided_ms = Some(now_ms);
+            answer.decided_by = Some("portal".to_string());
+            let store = state.jetstream.get_key_value(EVENTS_BUCKET).await?;
+            store.put(&id, serde_json::to_vec(&answer)?.into()).await?;
+
+            let parent_hashes = vec![id.clone()];
+            let chain_hash = crate::chain::hash_node(&q.id, &parent_hashes, &payload, now_ms);
+            emit_answer_submitted(
+                &state.nats,
+                &AnswerSubmitted {
+                    chain_hash,
+                    parent_hashes,
+                    question_id: q.id.clone(),
+                    alternative: SUMMARY_DUE_LABEL.to_string(),
+                    responses: payload,
+                    timestamp_ms: now_ms,
+                },
+            )
+            .await?;
+            tracing::info!(question = %q.id, "event ended - summary due");
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::record_id;
+
+    #[test]
+    fn record_id_is_stable_and_flat() {
+        assert_eq!(record_id("/events/opening"), "events-opening");
+        assert_eq!(record_id("/"), "");
+        assert_eq!(record_id("/opening"), "opening");
+    }
+}

src/app.rs

@@ -1,5 +1,5 @@
 use leptos::prelude::*;
-use leptos_meta::{provide_meta_context, MetaTags, Stylesheet, Title};
+use leptos_meta::{provide_meta_context, HashedStylesheet, Html, Link, MetaTags, Stylesheet, Title};
 use leptos_router::{
     components::{Route, Router, Routes},
     hooks::{use_location, use_navigate, use_query_map},
@@ -9,7 +9,8 @@ use serde::{Deserialize, Serialize};
 
 use crate::answers::{Answer, SelfTransitionAnswer, TransitionAnswers, TransitionItem};
 use crate::auth::{current_user, User};
-use crate::content::{is_qualified, Alternative, Question, Responsible, SiteConfig, Transition};
+use crate::content::{is_qualified, render_inline_markdown, Alternative, Question, Responsible, SiteConfig, Transition};
+use crate::i18n::t;
 use crate::resource::{get_requirement_binding, get_requirement_options, get_resource};
 
 /// The visible site name/wordmark - "portal" is just this codebase's
@@ -39,6 +40,23 @@ pub fn shell(options: LeptosOptions) -> impl IntoView {
                 // once loaded via <link>/<img> on Safari/iOS.
                 <link rel="icon" media="(prefers-color-scheme: light)" href="/favicon-light.svg" type="image/svg+xml"/>
                 <link rel="icon" media="(prefers-color-scheme: dark)" href="/favicon-dark.svg" type="image/svg+xml"/>
+                // Fonts hide behind the stylesheet: the browser must
+                // fetch and parse CSS before it discovers them. The
+                // latin subset is on every page's critical path, so
+                // announce it up front; latin-ext and vietnamese stay
+                // unicode-range-gated and load only when script needs
+                // them - preloading those would tax everyone for a few.
+                // (Font preloads require crossorigin even same-origin.)
+                <link
+                    rel="preload"
+                    href="/fonts/quicksand-semibold-latin.woff2"
+                    r#as="font"
+                    type="font/woff2"
+                    crossorigin="anonymous"
+                />
+                // Server-side, so it can read hash.txt and link the
+                // content-hashed stylesheet (hash-files = true).
+                <HashedStylesheet id="leptos" options=options.clone()/>
                 <AutoReload options=options.clone()/>
                 <HydrationScripts options/>
                 <MetaTags/>
@@ -65,9 +83,54 @@ pub fn App() -> impl IntoView {
     // context instead of fetching their own copy.
     let site = Resource::new(|| (), |_| get_site());
     provide_context(site);
+    // The chrome's language, from site.yaml (default "en"); content
+    // speaks for itself. Components read this via context for t().
+    let lang = Memo::new(move |_| {
+        site.get()
+            .and_then(|r| r.ok())
+            .and_then(|s| s.lang)
+            .unwrap_or_else(|| "en".to_string())
+    });
+    provide_context(Lang(lang));
+
+    // A content-shipped stylesheet (site.yaml `stylesheet:`) layered
+    // after the default one - leptos_meta appends it at the MetaTags
+    // slot, which the shell places after HashedStylesheet, so content
+    // rules win at equal specificity.
+    let custom_css = Memo::new(move |_| {
+        site.get()
+            .and_then(|r| r.ok())
+            .and_then(|s| s.stylesheet)
+            .map(|p| format!("/site/{p}"))
+    });
+    // The wordmark paints in the hero on first view; announcing it in
+    // the head starts the fetch during hydration instead of after. On
+    // redoal.com it lives on the content host, so a preconnect opens
+    // that TLS session while the preload is still queued.
+    let wordmark_href = Memo::new(move |_| {
+        site.get().and_then(|r| r.ok()).and_then(|s| s.wordmark)
+    });
+    let wordmark_origin = Memo::new(move |_| {
+        wordmark_href.get().and_then(|w| {
+            let rest = w.strip_prefix("https://")?;
+            Some(format!("https://{}", rest.split('/').next()?))
+        })
+    });
+    // A content-shipped favicon overrides the built-in one; injected
+    // into the head after the static defaults, so it wins.
+    let favicon = Memo::new(move |_| {
+        site.get()
+            .and_then(|r| r.ok())
+            .and_then(|s| s.favicon)
+            .map(|p| format!("/site/{p}"))
+    });
 
     view! {
-        <Stylesheet id="leptos" href="/pkg/portal.css"/>
+        <Html attr:lang=move || lang.get()/>
+        {move || wordmark_origin.get().map(|href| view! { <Link rel="preconnect" href=href crossorigin="anonymous"/> })}
+        {move || wordmark_href.get().map(|href| view! { <Link rel="preload" as_="image" href=href/> })}
+        {move || custom_css.get().map(|href| view! { <Stylesheet id="site-custom" href=href/> })}
+        {move || favicon.get().map(|href| view! { <Link rel="icon" href=href/> })}
         <Suspense fallback=|| ()>
             {move || {
                 site.get()
@@ -86,6 +149,15 @@ pub fn App() -> impl IntoView {
     }
 }
 
+/// The site's chrome language as a context signal - see App.
+#[derive(Clone, Copy)]
+pub struct Lang(pub Memo<String>);
+
+/// The current chrome language, for `t()` calls inside views.
+fn lang() -> Memo<String> {
+    expect_context::<Lang>().0
+}
+
 /// Every server-fn resource the pages read, created exactly once for
 /// the app's lifetime and handed down via context. Wrapper structs
 /// because a bare `Resource<T>` context is claimed by whoever provides
@@ -96,6 +168,21 @@ struct QuestionRes(Resource<Result<Option<Page>, ServerFnError>>);
 struct UserRes(Resource<Result<Option<User>, ServerFnError>>);
 #[derive(Clone, Copy)]
 struct NavRes(Resource<Result<Vec<(String, String)>, ServerFnError>>);
+#[derive(Clone, Copy)]
+struct AnnounceRes(Resource<Result<Vec<Announcement>, ServerFnError>>);
+
+/// One live announced page (`Question.event`), pre-formatted on the
+/// server so both renders agree and no client clock is involved.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Announcement {
+    pub id: String,
+    pub name: String,
+    /// "Sat 12 Sep, 18:00"
+    pub when: String,
+    /// "in 3 days" / "in 4 h" / "now"
+    pub relative: String,
+    pub place: Option<String>,
+}
 
 /// Owns the app's data resources, above the routes and reactive on the
 /// location instead of recreated per page. Route components creating
@@ -126,10 +213,15 @@ fn PortalShell() -> impl IntoView {
         |(path, chain)| get_question(path, chain),
     );
     let user = Resource::new(|| (), |_| current_user());
-    let nav = Resource::new(move || chain.get().is_some(), list_qualifying_questions);
+    let nav = Resource::new(
+        move || (path.get(), chain.get()),
+        |(path, chain)| list_qualifying_questions(path, chain),
+    );
+    let announcements = Resource::new(|| (), |_| list_announcements());
     provide_context(QuestionRes(question));
     provide_context(UserRes(user));
     provide_context(NavRes(nav));
+    provide_context(AnnounceRes(announcements));
 
     view! {
         <Routes fallback=|| view! { <NotFound/> }>
@@ -216,16 +308,19 @@ fn QuestionView(
                 title=question.name.clone()
                 description=question.description.clone()
                 landing=question_id == "/"
+                current_id=question_id.clone()
                 site=site.clone()
             />
             <div class="alternatives">
                 <section class="alt-card gate-card">
-                    <p>"This page follows from an answer you don't seem to carry yet."</p>
+                    <p>{move || t(&lang().get(), "follows_answer")}</p>
                     <a class="alt-submit" href=target>
                         {label}
                     </a>
                 </section>
             </div>
+            // A gate is never a dead end: the same nav as every page.
+            <QuestionNav current_id=question_id/>
         }
         .into_any();
     }
@@ -240,12 +335,13 @@ fn QuestionView(
                 title=question.name.clone()
                 description=question.description.clone()
                 landing=question_id == "/"
+                current_id=question_id.clone()
                 site=site.clone()
             />
             <div class="alternatives">
                 <section class="alt-card gate-card">
                     {if signed_in {
-                        view! { <p>"This part of the site is for organizational owners — sign in with that account to take a look."</p> }
+                        view! { <p>{move || t(&lang().get(), "owners_only")}</p> }
                             .into_any()
                     } else {
                         view! {
@@ -254,13 +350,14 @@ fn QuestionView(
                                 href=format!("/auth/login?redirect={question_id}")
                                 rel="external"
                             >
-                                "Sign in"
+                                {move || t(&lang().get(), "sign_in")}
                             </a>
                         }
                             .into_any()
                     }}
                 </section>
             </div>
+            <QuestionNav current_id=question_id/>
         }
         .into_any();
     }
@@ -270,7 +367,6 @@ fn QuestionView(
     // on pages where some alternative actually declares a deck.
     let needs_swiper = question.alternatives.iter().any(|a| a.images.len() > 1);
 
-    let has_chain = parent_hash.is_some();
 
     view! {
         {needs_swiper.then(|| view! { <leptos_meta::Script src="/swiper-element-bundle.min.js"/> })}
@@ -279,6 +375,7 @@ fn QuestionView(
             description=question.description.clone()
             landing=question_id == "/"
             site=site.clone()
+            current_id=question_id.clone()
         />
         <div class="alternatives">
             <For
@@ -323,7 +420,7 @@ fn QuestionView(
             .map(|r| {
                 view! { <ResponsibleNote responsible=r/> }
             })}
-        <QuestionNav current_id=question_id has_chain=has_chain/>
+        <QuestionNav current_id=question_id/>
     }
     .into_any()
 }
@@ -332,8 +429,7 @@ fn QuestionView(
 /// small nav - how a concern reaches the people it speaks to without
 /// claiming front-page space (an owner also sees the gated desks here).
 #[component]
-fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
+fn QuestionNav(current_id: String) -> impl IntoView {
-    let _ = has_chain; // keyed into the shared resource by PortalShell
     let NavRes(nav) = expect_context();
     view! {
         <Suspense fallback=|| ()>
@@ -346,7 +442,7 @@ fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
                         .collect();
                     (!others.is_empty()).then(|| view! {
                         <nav class="question-nav">
-                            <span class="question-nav-lead">"Also worth asking"</span>
+                            <span class="question-nav-lead">{move || t(&lang().get(), "also_worth_asking")}</span>
                             <For
                                 each=move || others.clone()
                                 key=|(id, _)| id.clone()
@@ -362,6 +458,45 @@ fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
     }
 }
 
+/// Live announced pages, as a strip at the top of the header - the one
+/// place a page gets to claim attention before the question. Empty
+/// (and unrendered) when nothing is announced.
+#[component]
+fn Announcements(current_id: String) -> impl IntoView {
+    let AnnounceRes(announcements) = expect_context();
+    view! {
+        <Suspense fallback=|| ()>
+            {move || {
+                let current_id = current_id.clone();
+                announcements.get().and_then(|res| res.ok()).map(|items| {
+                    (!items.is_empty()).then(|| view! {
+                        <nav class="announce" aria-label=move || t(&lang().get(), "announcements")>
+                            <For
+                                each=move || items.clone()
+                                key=|a| a.id.clone()
+                                children=move |a: Announcement| {
+                                    let current = a.id == current_id;
+                                    view! {
+                                        <a href=a.id.clone() class="announce-item" aria-current=current.then_some("page")>
+                                            <span class="announce-name">{a.name}</span>
+                                            <span class="announce-when">
+                                                {a.when}
+                                                {a.place.map(|p| format!(" · {p}"))}
+                                            </span>
+                                            <span class="announce-relative">{a.relative}</span>
+                                        </a>
+                                    }
+                                    .into_any()
+                                }
+                            />
+                        </nav>
+                    })
+                })
+            }}
+        </Suspense>
+    }
+}
+
 /// "Asked by X — contact them if you get stuck."
 /// The mailto address is assembled from `data-user`/`data-domain` on a
 /// real mouse event, never baked into the server-rendered `href` -
@@ -395,41 +530,15 @@ fn ResponsibleNote(responsible: Responsible) -> impl IntoView {
 
     view! {
         <small class="question-responsible">
-            "Asked by " {responsible.name.clone()} " — "
+            {move || t(&lang().get(), "asked_by")} {responsible.name.clone()} " — "
             <a data-user=user data-domain=domain on:mouseover=assemble on:click=assemble>
-                "contact them"
+                {move || t(&lang().get(), "contact_them")}
             </a>
-            " if you get stuck."
+            {move || t(&lang().get(), "if_stuck")}
         </small>
     }
 }
 
-// Binds the actual "YES - Rasterized Lines" piece live at uhhm.no
-// (ported to `public/yes.js`, an ES module now instead of a page-owning
-// script) as a typed JS class - the idiomatic wasm-bindgen way to drive
-// an existing JS module from Rust, rather than re-implementing canvas
-// animation logic here.
-#[cfg(feature = "hydrate")]
-mod yes {
-    use wasm_bindgen::prelude::*;
-
-    // raw_module (a runtime URL, not a bundled snippet) on purpose:
-    // the file lives in public/ so it's served at the stable /yes.js
-    // - the same URL the hero's inline early-mount script imports.
-    // A bundled snippet would sit under a per-build hashed
-    // /pkg/snippets/ path the inline script couldn't know.
-    #[wasm_bindgen(raw_module = "/yes.js")]
-    extern "C" {
-        #[wasm_bindgen(js_name = RasterizedYES)]
-        pub type RasterizedYes;
-
-        #[wasm_bindgen(constructor, js_class = "RasterizedYES")]
-        pub fn new() -> RasterizedYes;
-
-        #[wasm_bindgen(method)]
-        pub fn stop(this: &RasterizedYes);
-    }
-}
 
 // Same idiomatic-typed-module approach as `yes` above, for the
 // prosekit-backed rich-text requirement kind (`prosekit-editor.js`,
@@ -460,6 +569,28 @@ mod prosekit {
 // prosekit's hidden-input bridge for the value, yes.js's typed-handle
 // lifecycle for cleanup - it may own a live WebSocket to a
 // redoal-relay, which SPA navigation must close (`stop()`).
+#[cfg(feature = "hydrate")]
+#[cfg(feature = "hydrate")]
+mod voice {
+    use wasm_bindgen::prelude::*;
+
+    #[wasm_bindgen(module = "/voice.js")]
+    extern "C" {
+        pub type VoiceWidget;
+
+        #[wasm_bindgen(js_name = mountVoice)]
+        pub fn mount_voice(
+            container: &web_sys::HtmlDivElement,
+            hidden: &web_sys::HtmlInputElement,
+            relay_url: &str,
+            key: &str,
+        ) -> VoiceWidget;
+
+        #[wasm_bindgen(method)]
+        pub fn stop(this: &VoiceWidget);
+    }
+}
+
 #[cfg(feature = "hydrate")]
 mod gesture {
     use wasm_bindgen::prelude::*;
@@ -475,150 +606,127 @@ mod gesture {
             relay_url: &str,
         ) -> GestureWidget;
 
-        #[wasm_bindgen(js_name = mountGestureHero)]
-        pub fn mount_gesture_hero(
-            container: &web_sys::HtmlDivElement,
-            relay_url: &str,
-        ) -> GestureWidget;
-
         #[wasm_bindgen(method)]
         pub fn stop(this: &GestureWidget);
     }
 }
 
 #[component]
-fn Hero(title: String, description: String, landing: bool, site: SiteConfig) -> impl IntoView {
+fn Hero(title: String, description: String, landing: bool, site: SiteConfig, current_id: String) -> impl IntoView {
-    // Only the landing page gets a full interactive piece - it's the
+    // Only the landing page gets a piece - it's the one page a hero is
-    // one page a hero is actually "the" hero for; other pages
+    // actually "the" hero for; every other page gets the plain header.
-    // (thank-you pages, /review) get the plain dark header below.
+    // WHAT the piece is belongs to the content repo: site.yaml's
-    // WHICH piece is the content repo's call (`site.yaml`'s
+    // `hero: {kind: module, module: hero.js}` names a JavaScript module
-    // hero.kind): the YES canvas (default - uhhm's look), a redoal
+    // (served same-origin at /site/<path>) exporting
-    // gesture canvas, or nothing.
+    // `mount(container) -> handle` with `handle.stop()`. Portal knows
-    let hero_kind = if landing { site.hero.kind.clone() } else { "plain".to_string() };
+    // nothing about what it draws.
-    let show_yes = hero_kind == "yes";
+    let module = if landing && site.hero.kind == "module" {
-    let show_gesture = hero_kind == "gesture";
+        site.hero.module.clone()
+    } else {
+        None
+    };
+    let has_module = module.is_some();
+    // Light theme can invert a white-stroke wordmark to ink. Default:
+    // only the built-in house mark inverts; a content-shipped logo
+    // keeps its colours unless site.yaml opts in with wordmark_invert.
+    let house_wordmark = site.wordmark_invert.unwrap_or(site.wordmark.is_none());
     let wordmark = site.wordmark.clone().unwrap_or_else(|| "/wordmark.svg".to_string());
+    // Clamped server-side too, but belt and braces for the inline style.
+    let wordmark_style = site
+        .wordmark_height
+        .filter(|h| (0.5..=6.0).contains(h))
+        .map(|h| format!("height: {h}rem"))
+        .unwrap_or_default();
     let site_title = site.title.clone().unwrap_or_else(|| SITE_NAME.to_string());
 
-    // Starts the YES animation once the canvas elements exist, and
+    let piece_ref: NodeRef<leptos::html::Div> = NodeRef::new();
-    // explicitly stops the requestAnimationFrame loop on unmount - the
-    // original page-owning script never needed this since navigating
-    // away meant a full document unload, which doesn't happen in an
-    // SPA.
-    let raster_ref: NodeRef<leptos::html::Canvas> = NodeRef::new();
-    let gesture_ref: NodeRef<leptos::html::Div> = NodeRef::new();
     #[cfg(feature = "hydrate")]
-    if show_yes {
+    if has_module {
-        // `on_cleanup` requires Send + Sync (even single-threaded, wasm),
+        use wasm_bindgen::JsCast;
-        // which a JS-backed value never is - `StoredValue`'s `LocalStorage`
+        // Handle = whatever the module's mount() returned; kept as a
-        // variant is the established way around this (same pattern
+        // raw JsValue so the contract stays "has a stop()", nothing
-        // cnats' WebRTC call state uses for its own non-Send peer map).
+        // typed on the Rust side.
-        let instance: StoredValue<Option<yes::RasterizedYes>, LocalStorage> =
+        let handle: StoredValue<Option<wasm_bindgen::JsValue>, LocalStorage> =
             StoredValue::new_local(None);
-        // Gated on the canvas NodeRef resolving, not just "the Effect
-        // ran" - on a fresh page load the DOM is already there by the
-        // time this fires, but navigating back to `/` client-side hit a
-        // real race: the Effect ran before the new view's <canvas> was
-        // actually inserted, RasterizedYES::new() (yes.js) did an
-        // unchecked `document.getElementById(...).getContext(...)` on
-        // null and threw mid-reactive-update - which then corrupted
-        // wasm_bindgen_futures' single-threaded executor state badly
-        // enough to panic ("RefCell already borrowed") on the next
-        // tick. Waiting for the NodeRef itself guarantees DOM presence
-        // the same way the prosekit editor's own mount Effect does.
         Effect::new(move |_| {
-            if raster_ref.get().is_none() {
+            let Some(container) = piece_ref.get() else {
+                return;
+            };
+            if handle.with_value(|h| h.is_some()) {
                 return;
             }
-            if instance.with_value(|i| i.is_some()) {
+            // Adopt the inline early-mount's instance (started at HTML
-                return;
+            // parse time) if it's there; otherwise (client-side
-            }
+            // navigation back to /) mount fresh through the helper the
-            // Adopt the hero's inline early-mount instance (started at
+            // inline script left on window. Either order is safe.
-            // HTML parse time, long before this wasm was even fetched)
-            // instead of starting a second animation. The flag covers
-            // the opposite ordering too: an inline script that runs
-            // after this sees it and stays inert.
-            use wasm_bindgen::JsCast;
             let global = js_sys::global();
-            let _ = js_sys::Reflect::set(&global, &"__yesAdopted".into(), &true.into());
+            let _ = js_sys::Reflect::set(&global, &"__heroAdopted".into(), &true.into());
-            let early = js_sys::Reflect::get(&global, &"__yesEarly".into())
+            let early = js_sys::Reflect::get(&global, &"__heroEarly".into())
                 .ok()
                 .filter(|v| !v.is_undefined() && !v.is_null());
-            let inst = match early {
+            match early {
                 Some(v) => {
-                    let _ = js_sys::Reflect::delete_property(&global, &"__yesEarly".into());
+                    let _ = js_sys::Reflect::delete_property(&global, &"__heroEarly".into());
-                    v.unchecked_into::<yes::RasterizedYes>()
+                    handle.set_value(Some(v));
                 }
-                None => yes::RasterizedYes::new(),
+                None => {
-            };
+                    if let Ok(mounter) = js_sys::Reflect::get(&global, &"__mountHero".into()) {
-            instance.set_value(Some(inst));
+                        if let Some(f) = mounter.dyn_ref::<js_sys::Function>() {
+                            if let Ok(promise) = f.call1(&global, &container) {
+                                let promise: js_sys::Promise = promise.unchecked_into();
+                                leptos::task::spawn_local(async move {
+                                    if let Ok(h) =
+                                        wasm_bindgen_futures::JsFuture::from(promise).await
+                                    {
+                                        handle.set_value(Some(h));
+                                    }
+                                });
+                            }
+                        }
+                    }
+                }
+            }
         });
         on_cleanup(move || {
-            instance.update_value(|opt| {
+            handle.update_value(|opt| {
-                if let Some(inst) = opt.take() {
+                if let Some(h) = opt.take() {
-                    inst.stop();
+                    if let Ok(stop) = js_sys::Reflect::get(&h, &"stop".into()) {
+                        if let Some(f) = stop.dyn_ref::<js_sys::Function>() {
+                            let _ = f.call0(&h);
+                        }
+                    }
                 }
             });
         });
     }
 
-    // The gesture hero mounts the same widget the `type: gesture`
+    // The inline script starts the piece at HTML parse time instead of
-    // requirement uses, in hero mode (no form field; echoes render as
+    // waiting out the wasm bundle; it also leaves __mountHero for the
-    // ambient strokes on the canvas itself). Same StoredValue +
+    // hydrate side's client-side-navigation case. Module path is
-    // on_cleanup shape as the YES piece - it may own a live WebSocket.
+    // validated to plain segments by SiteConfig::validate, so it can't
-    #[cfg(feature = "hydrate")]
+    // break out of the string here.
-    if show_gesture {
+    let early_script = module.as_ref().map(|m| {
-        let relay = site.hero.relay.clone().unwrap_or_default();
+        format!(
-        let widget: StoredValue<Option<gesture::GestureWidget>, LocalStorage> =
+            "const url = '/site/{m}'; window.__mountHero = (el) => import(url).then((mod) => mod.mount(el)); if (!window.__heroAdopted && !window.__heroEarly) window.__mountHero(document.querySelector('.hero-piece')).then((h) => {{ if (!window.__heroAdopted) window.__heroEarly = h; else if (h && h.stop) h.stop(); }});"
-            StoredValue::new_local(None);
+        )
-        Effect::new(move |_| {
+    });
-            let Some(container) = gesture_ref.get() else {
-                return;
-            };
-            if widget.with_value(|w| w.is_some()) {
-                return;
-            }
-            widget.set_value(Some(gesture::mount_gesture_hero(&container, &relay)));
-        });
-        on_cleanup(move || {
-            widget.update_value(|opt| {
-                if let Some(w) = opt.take() {
-                    w.stop();
-                }
-            });
-        });
-    }
 
     view! {
-        <header class="hero" class:hero-yes=show_yes class:hero-gesture=show_gesture>
+        <header class="hero" class:hero-module=has_module>
-            {show_yes
+            <Announcements current_id=current_id/>
+            {has_module
                 .then(|| {
                     view! {
-                        <div class="hero-canvas" aria-hidden="true">
+                        <div class="hero-piece" aria-hidden="true" node_ref=piece_ref></div>
-                            <canvas id="lineCanvas"></canvas>
+                        <script type="module" inner_html=early_script.unwrap_or_default()></script>
-                            <canvas id="rasterCanvas" node_ref=raster_ref></canvas>
-                        </div>
-                        // Starts the animation at HTML parse time
-                        // instead of waiting out the wasm bundle's
-                        // fetch + hydration; the hydrate Effect above
-                        // adopts (never duplicates) the instance, and
-                        // the guards make either execution order safe.
-                        <script
-                            type="module"
-                            inner_html="import('/yes.js').then((m) => { if (!window.__yesAdopted && !window.__yesEarly) window.__yesEarly = new m.RasterizedYES(); });"
-                        ></script>
                     }
                 })}
-            {show_gesture
-                .then(|| {
-                    view! { <div class="hero-draw" node_ref=gesture_ref></div> }
-                })}
             <div class="hero-copy">
-                <a class="wordmark" href="/">
+                <a class="wordmark" class:wordmark-house=house_wordmark href="/">
-                    <img src=wordmark alt=site_title/>
+                    <img src=wordmark alt=site_title style=wordmark_style/>
                 </a>
                 <h1>{title}</h1>
-                <p>{description}</p>
+                <p inner_html=render_inline_markdown(&description)></p>
             </div>
         </header>
     }
@@ -675,7 +783,7 @@ fn AlternativeCard(
         return view! {
             <section class="alt-card">
                 <h2>{alternative.name.clone()}</h2>
-                <p class="alt-description">{alternative.description.clone()}</p>
+                <p class="alt-description" inner_html=render_inline_markdown(&alternative.description)></p>
                 {move || {
                     let question_id_for_action = question_id_for_action.clone();
                     let alt_name_for_action = alt_name_for_action.clone();
@@ -700,7 +808,7 @@ fn AlternativeCard(
                             </button>
                         }
                             .into_any(),
-                        Some(Ok(())) => view! { <p>"Done."</p> }.into_any(),
+                        Some(Ok(())) => view! { <p>{move || t(&lang().get(), "done")}</p> }.into_any(),
                         Some(Err(e)) => view! { <p class="resource-error">{e.to_string()}</p> }.into_any(),
                     }
                 }}
@@ -761,12 +869,16 @@ fn AlternativeCard(
                     .or_insert_with(|| RwSignal::new(Vec::new()));
                 select_multi.insert(req.name.clone(), req.multiple);
             } else {
-                if req.kind == "gesture" {
+                // Widget-owned fields hold JSON objects, not strings.
+                if req.kind == "gesture" || req.kind == "voice" {
                     gesture_fields.insert(req.name.clone());
                 }
+                // A voice field's preset is the key it records at,
+                // not a value to submit.
+                let preset = if req.kind == "voice" { String::new() } else { req.value.clone().unwrap_or_default() };
                 field_map
                     .entry(req.name.clone())
-                    .or_insert_with(|| RwSignal::new(String::new()));
+                    .or_insert_with(|| RwSignal::new(preset));
             }
         }
     }
@@ -891,13 +1003,13 @@ fn AlternativeCard(
         .consequence
         .first()
         .cloned()
-        .unwrap_or_else(|| "Send".to_string());
+        .unwrap_or_else(|| t(&lang().get(), "send").to_string());
 
     view! {
         <section class="alt-card">
             <AltImages images=alternative.images.clone() />
             <h2>{alternative.name.clone()}</h2>
-            <p class="alt-description">{alternative.description.clone()}</p>
+            <p class="alt-description" inner_html=render_inline_markdown(&alternative.description)></p>
             <div class="features">
                 <For
                     each={
@@ -946,7 +1058,7 @@ fn AlternativeCard(
                                         let description = feature.description.clone();
                                         move || !description.is_empty()
                                     }>
-                                        <p>{feature.description.clone()}</p>
+                                        <p inner_html=render_inline_markdown(&feature.description)></p>
                                     </Show>
                                     {resource.map(|spec| {
                                         view! {
@@ -955,6 +1067,7 @@ fn AlternativeCard(
                                                 alternative=alt_name.clone()
                                                 feature_name=feature_name.clone()
                                                 transitions=spec.transitions.clone()
+                                                empty=spec.empty.clone()
                                                 pending_transitions=pending_transitions
                                                 transition_batch=transition_batch
                                             />
@@ -1132,6 +1245,54 @@ fn AlternativeCard(
                                                     .into_any();
                                                 }
 
+                                                if req.kind == "voice" {
+                                                    let container_ref: NodeRef<leptos::html::Div> = NodeRef::new();
+                                                    let hidden_ref: NodeRef<leptos::html::Input> = NodeRef::new();
+
+                                                    #[cfg(feature = "hydrate")]
+                                                    {
+                                                        let relay = req.relay.clone().unwrap_or_default();
+                                                        let key = req.value.clone().unwrap_or_default();
+                                                        let widget: StoredValue<Option<voice::VoiceWidget>, LocalStorage> =
+                                                            StoredValue::new_local(None);
+                                                        Effect::new(move |_| {
+                                                            let (Some(container), Some(hidden)) =
+                                                                (container_ref.get(), hidden_ref.get())
+                                                            else {
+                                                                return;
+                                                            };
+                                                            if widget.with_value(|w| w.is_some()) {
+                                                                return;
+                                                            }
+                                                            widget.set_value(Some(voice::mount_voice(
+                                                                &container, &hidden, &relay, &key,
+                                                            )));
+                                                        });
+                                                        on_cleanup(move || {
+                                                            widget.update_value(|opt| {
+                                                                if let Some(w) = opt.take() {
+                                                                    w.stop();
+                                                                }
+                                                            });
+                                                        });
+                                                    }
+
+                                                    return view! {
+                                                        <div class="field">
+                                                            {label_text}
+                                                            <input
+                                                                id=field_id
+                                                                type="hidden"
+                                                                node_ref=hidden_ref
+                                                                prop:value=move || sig.get()
+                                                                on:input=move |ev| sig.set(event_target_value(&ev))
+                                                            />
+                                                            <div class="voice-wrap" node_ref=container_ref></div>
+                                                        </div>
+                                                    }
+                                                    .into_any();
+                                                }
+
                                                 if req.kind == "prosekit" {
                                                     let container_ref: NodeRef<leptos::html::Div> = NodeRef::new();
                                                     let hidden_ref: NodeRef<leptos::html::Input> = NodeRef::new();
@@ -1164,6 +1325,20 @@ fn AlternativeCard(
                                                     .into_any();
                                                 }
 
+                                                if req.kind == "hidden" {
+                                                    // A carrier value only — no label row, or a
+                                                    // preset key reads as a second visible field.
+                                                    return view! {
+                                                        <input
+                                                            id=field_id
+                                                            type="hidden"
+                                                            prop:value=move || sig.get()
+                                                            on:input=move |ev| sig.set(event_target_value(&ev))
+                                                        />
+                                                    }
+                                                    .into_any();
+                                                }
+
                                                 view! {
                                                     <label class="field" for=label_for>
                                                         {label_text}
@@ -1231,7 +1406,17 @@ fn AlternativeCard(
                                     children=move |e| view! { <p class="alt-encouragement">{e}</p> }
                                 />
                             </div>
-                            {if is_gateway {
+                            {if alternative.disabled {
+                                // Advertised, not yet takeable: the label
+                                // stays (it says what will be possible),
+                                // the button doesn't act.
+                                view! {
+                                    <button type="button" class="alt-submit soon" disabled=true title="Not yet">
+                                        {button_label.clone()}
+                                    </button>
+                                }
+                                .into_any()
+                            } else if is_gateway {
                                 let href = alternative.action.clone().unwrap_or_default();
                                 view! {
                                     <a class="alt-submit" href=href>{button_label.clone()}</a>
@@ -1274,6 +1459,7 @@ fn ResourceFeature(
     alternative: String,
     feature_name: String,
     transitions: Vec<Transition>,
+    empty: Option<String>,
     pending_transitions: RwSignal<std::collections::HashMap<(String, String), String>>,
     transition_batch: ServerAction<TransitionAnswers>,
 ) -> impl IntoView {
@@ -1307,6 +1493,7 @@ fn ResourceFeature(
                 {move || {
                     let feature_name = feature_name.clone();
                     let transitions = transitions.clone();
+                    let empty = empty.clone().unwrap_or_else(|| t(&lang().get(), "nothing_here_yet").to_string());
                     data.get()
                         .map(|res| match res {
                             Ok(value) => {
@@ -1314,6 +1501,7 @@ fn ResourceFeature(
                                     <ResourceValue
                                         feature_name=feature_name
                                         transitions=transitions
+                                        empty=empty
                                         value=value
                                         pending_transitions=pending_transitions
                                         transition_batch=transition_batch
@@ -1340,11 +1528,23 @@ fn ResourceFeature(
 fn ResourceValue(
     feature_name: String,
     transitions: Vec<Transition>,
+    empty: String,
     value: serde_json::Value,
     pending_transitions: RwSignal<std::collections::HashMap<(String, String), String>>,
     transition_batch: ServerAction<TransitionAnswers>,
 ) -> impl IntoView {
+    // A jq like `.[] | {...}` over an empty list yields no output at
+    // all - that arrives as null, and it's the same silence as [].
+    if value.is_null() {
+        return view! { <p class="resource-empty">{empty}</p> }.into_any();
+    }
     if let serde_json::Value::Array(items) = &value {
+        // Before the Answer parse below: an empty list deserializes as
+        // an (empty) Vec<Answer> too, and rendered as a blank
+        // answer-list instead of saying anything.
+        if items.is_empty() {
+            return view! { <p class="resource-empty">{empty}</p> }.into_any();
+        }
         if let Ok(answers) = serde_json::from_value::<Vec<Answer>>(value.clone()) {
             let mut answers = answers;
             answers.sort_by(|a, b| {
@@ -1377,9 +1577,6 @@ fn ResourceValue(
             }
             .into_any();
         }
-        if items.is_empty() {
-            return view! { <p class="resource-empty">"Nothing here yet."</p> }.into_any();
-        }
         // A list of plain objects (e.g. a jq-shaped GiteaStarred/Url
         // resource) - render as cards rather than dumping raw JSON.
         // Generic on purpose, no content-declared "kind": `name`/`title`
@@ -1426,8 +1623,11 @@ fn ItemCard(item: serde_json::Value) -> impl IntoView {
     let name = text_field(&obj, &["name", "title"]);
     let description = text_field(&obj, &["description"]);
     let url = text_field(&obj, &["url", "html_url"]);
+    // A playable recording (an https URL to audio) renders as a
+    // player, not a link - the relay's /blob/<digest>.wav.
+    let audio = text_field(&obj, &["audio"]).filter(|a| a.starts_with("https://"));
 
-    let known = ["name", "title", "description", "url", "html_url"];
+    let known = ["name", "title", "description", "url", "html_url", "audio"];
     let extra: Vec<(String, String)> = obj
         .iter()
         .filter(|(k, v)| !known.contains(&k.as_str()) && !v.is_null())
@@ -1466,7 +1666,9 @@ fn ItemCard(item: serde_json::Value) -> impl IntoView {
                         </div>
                     }
                 })}
-            {description.map(|d| view! { <p class="item-card-description">{d}</p> })}
+            {description
+                .map(|d| view! { <p class="item-card-description" inner_html=render_inline_markdown(&d)></p> })}
+            {audio.map(|src| view! { <audio class="item-card-audio" controls preload="none" src=src></audio> })}
             {(!extra.is_empty())
                 .then(|| {
                     view! {
@@ -1760,8 +1962,8 @@ fn format_ms(ms: i64) -> String {
 fn NotFound() -> impl IntoView {
     view! {
         <main class="not-found">
-            <h1>"Nothing here"</h1>
+            <h1>{move || t(&lang().get(), "nothing_here")}</h1>
-            <a href="/">"back to the start"</a>
+            <a href="/">{move || t(&lang().get(), "back_to_start")}</a>
         </main>
     }
 }
@@ -1828,14 +2030,64 @@ pub async fn get_site() -> Result<SiteConfig, ServerFnError> {
     Ok(state.site.load().as_ref().clone())
 }
 
-/// Every question the current visitor qualifies for, as (id, name) -
+/// Every question the visitor may be offered from `current`, as (id,
-/// the site nav's data. Context-dependent: an owner session sees the
+/// name) - the question nav's data. Front-door pages the visitor
-/// gated pages too, and `followup` pages only appear once the visitor
+/// qualifies for are always in (an owner session sees the gated desks
-/// carries an answer chain.
+/// too). A `followup` page or an ended event is in only when the
+/// visitor has earned it: their verified `?chain=` answered the
+/// alternative that leads there, or it is reachable from an earned
+/// page over links that record nothing (see `content::earned_followups`).
+/// Nothing is offered that sits behind an answer they have not given;
+/// an unverifiable hash unlocks nothing.
 #[server(endpoint = "list_qualifying_questions")]
 pub async fn list_qualifying_questions(
-    has_chain: bool,
+    current: String,
+    chain: Option<String>,
 ) -> Result<Vec<(String, String)>, ServerFnError> {
+    use crate::auth::{User, SESSION_USER_KEY};
+    use crate::content::{earned_followups, is_qualified, unlocked_by, Question};
+    use crate::server::AppState;
+
+    let state = expect_context::<AppState>();
+    let session: tower_sessions::Session = leptos_axum::extract().await?;
+    let user = session
+        .get::<User>(SESSION_USER_KEY)
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+
+    let now_ms = chrono::Utc::now().timestamp_millis();
+    let questions = state.questions.load();
+    // What the chain verifiably answered - the same lookup a
+    // `requires_chain` gate does, so a forged or foreign hash resolves
+    // to nothing - and therefore where it sent the visitor.
+    let seeds: Vec<String> = match &chain {
+        Some(hash) => match crate::chain::lookup_node(&state.jetstream, hash).await {
+            Some(node) => unlocked_by(&questions, &node.question_id, node.alternative.as_deref()),
+            None => Vec::new(),
+        },
+        None => Vec::new(),
+    };
+    // An ended event page is a followup from then on.
+    let is_outcome = |q: &Question| q.is_followup() || q.event_ended_at(now_ms);
+    let earned = earned_followups(&questions, &current, &seeds, &is_outcome);
+    let mut out: Vec<(String, String)> = questions
+        .values()
+        .filter(|q| is_qualified(user.as_ref(), q))
+        .filter(|q| !is_outcome(q) || earned.contains(&q.id))
+        // A live event is announced in the header instead.
+        .filter(|q| !q.event_live_at(now_ms))
+        // A dynamic page has no URL of its own to link to.
+        .filter(|q| !q.is_dynamic())
+        .map(|q| (q.id.clone(), q.name.clone()))
+        .collect();
+    out.sort();
+    Ok(out)
+}
+
+/// Every announced page whose window is still open and that the
+/// visitor qualifies for, soonest first.
+#[server(endpoint = "list_announcements")]
+pub async fn list_announcements() -> Result<Vec<Announcement>, ServerFnError> {
     use crate::auth::{User, SESSION_USER_KEY};
     use crate::content::is_qualified;
     use crate::server::AppState;
@@ -1846,19 +2098,51 @@ pub async fn list_qualifying_questions(
         .get::<User>(SESSION_USER_KEY)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let now_ms = chrono::Utc::now().timestamp_millis();
 
-    let mut out: Vec<(String, String)> = state
+    let mut live: Vec<(i64, Announcement)> = state
         .questions
         .load()
         .values()
-        .filter(|q| is_qualified(user.as_ref(), q))
+        .filter(|q| is_qualified(user.as_ref(), q) && q.event_live_at(now_ms))
-        .filter(|q| !q.is_followup() || has_chain)
+        .filter_map(|q| {
-        // A dynamic page has no URL of its own to link to.
+            let event = q.event.as_ref()?;
-        .filter(|q| !q.is_dynamic())
+            let starts = chrono::DateTime::parse_from_rfc3339(&event.starts).ok()?;
-        .map(|q| (q.id.clone(), q.name.clone()))
+            let starts_ms = starts.timestamp_millis();
+            let relative = relative_until(starts_ms - now_ms);
+            Some((
+                starts_ms,
+                Announcement {
+                    id: q.id.clone(),
+                    name: q.name.clone(),
+                    when: starts.format("%a %-d %b, %H:%M").to_string(),
+                    relative,
+                    place: event.place.clone(),
+                },
+            ))
+        })
         .collect();
-    out.sort();
+    live.sort_by_key(|(starts, _)| *starts);
-    Ok(out)
+    Ok(live.into_iter().map(|(_, a)| a).collect())
+}
+
+/// "in 3 days" / "in 4 h" / "in 20 min" / "now" (already started).
+#[cfg(feature = "ssr")]
+fn relative_until(delta_ms: i64) -> String {
+    const MIN: i64 = 60_000;
+    const HOUR: i64 = 60 * MIN;
+    const DAY: i64 = 24 * HOUR;
+    if delta_ms <= 0 {
+        "now".to_string()
+    } else if delta_ms >= 2 * DAY {
+        format!("in {} days", delta_ms / DAY)
+    } else if delta_ms >= DAY {
+        "tomorrow".to_string()
+    } else if delta_ms >= HOUR {
+        format!("in {} h", delta_ms / HOUR)
+    } else {
+        format!("in {} min", (delta_ms / MIN).max(1))
+    }
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -1902,11 +2186,21 @@ pub async fn submit_answer(
         .iter()
         .find(|a| a.name == alternative)
         .ok_or_else(|| ServerFnError::new("unknown alternative"))?;
-    let next = alt.action.clone();
+    if alt.disabled {
+        return Err(ServerFnError::new("this alternative isn't open yet"));
+    }
     let record_as = alt.record_as.clone();
 
     let responses: serde_json::Value = serde_json::from_str(&responses_json)
         .map_err(|e| ServerFnError::new(format!("invalid responses: {e}")))?;
+    // `/shape/{curve.key}`: the next page may be chosen by the answer.
+    let next = match alt.action.as_deref() {
+        Some(action) => Some(
+            crate::content::template_action(action, &responses)
+                .ok_or_else(|| ServerFnError::new("this answer is missing what the next page needs"))?,
+        ),
+        None => None,
+    };
 
     let parent_hashes: Vec<String> = parent_hash.into_iter().collect();
     let timestamp_ms = chrono::Utc::now().timestamp_millis();
@@ -1929,7 +2223,7 @@ pub async fn submit_answer(
     // Index the node so requires_chain pages can verify lineage.
     // Best-effort: the NATS event above is the durable record.
     if let Err(e) =
-        crate::chain::record_node(&state.jetstream, &chain_hash, &question_id, timestamp_ms).await
+        crate::chain::record_node(&state.jetstream, &chain_hash, &question_id, &alternative, timestamp_ms).await
     {
         tracing::error!("failed to index chain node: {e}");
     }

src/bin/needs_replay.rs

@@ -0,0 +1,107 @@
+//! Makes a simulation's cases real: every case becomes an aggregate in
+//! its bucket, created and moved by the same code the running site
+//! uses - `answers::store_answer` for the submission,
+//! `aggregates::transition` for each desk move, against a real
+//! JetStream with its event log and its refusal of undeclared moves.
+//! Then the buckets are read back by replaying each record's events,
+//! and reported per need against `done_when` and `success`.
+//!
+//! The report half runs on its own (`--report-only`) against any
+//! JetStream, which is how the same scorecard is taken from a live
+//! site's buckets.
+//!
+//! Point it at a throwaway NATS, never a site's own: it writes.
+#![cfg(feature = "ssr")]
+
+use std::collections::{BTreeMap, HashMap};
+
+use futures::StreamExt;
+use portal::events::store::{ensure_stream, load_events};
+use portal::local::{load_aggregates_from_dir, load_from_dir, load_needs_from_dir};
+use portal::{aggregates, answers, content, needs};
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    let argv: Vec<String> = std::env::args().skip(1).collect();
+    let value = |flag: &str| argv.iter().position(|a| a == flag).and_then(|i| argv.get(i + 1)).cloned();
+    let usage = "usage: needs_replay --path <questions dir> --nats <url> (--cases <cases.jsonl> | --report-only)";
+    let dir = value("--path").ok_or_else(|| anyhow::anyhow!(usage))?;
+    let nats_url = value("--nats").ok_or_else(|| anyhow::anyhow!(usage))?;
+    let cases_path = value("--cases");
+    if cases_path.is_none() && !argv.iter().any(|a| a == "--report-only") {
+        anyhow::bail!(usage);
+    }
+
+    let questions = load_from_dir(&dir)?;
+    let schemas = content::with_builtin_aggregates(load_aggregates_from_dir(&dir)?);
+    let file = needs::parse(&load_needs_from_dir(&dir)?.ok_or_else(|| anyhow::anyhow!("the repo has no needs.yaml"))?)?;
+    let js = async_nats::jetstream::new(async_nats::connect(&nats_url).await?);
+    // The same call the site makes at boot.
+    ensure_stream(&js).await?;
+
+    if let Some(path) = cases_path {
+        let raw = std::fs::read_to_string(&path).map_err(|e| anyhow::anyhow!("reading {path}: {e}"))?;
+        let (mut created, mut moved, mut refused) = (0, 0, 0);
+        for (n, line) in raw.lines().filter(|l| !l.trim().is_empty()).enumerate() {
+            let case: serde_json::Value = serde_json::from_str(line)?;
+            let Some(need) = file.needs.iter().find(|need| case["need"] == need.id.as_str()) else { continue };
+            let Some(schema) = schemas.get(&need.lands_in) else { continue };
+            // Only a case that got as far as submitting leaves a record.
+            let states: Vec<&str> = case["states"].as_array().into_iter().flatten().filter_map(|s| s.as_str()).collect();
+            if states.is_empty() {
+                continue;
+            }
+            let step = needs::path_for(&questions, need).and_then(|p| p.last().cloned());
+            let (page, alternative) = step.map(|s| (s.page, s.alternative)).unwrap_or_default();
+            let id = format!("sim-{}-{}-{n}", case["persona"].as_str().unwrap_or("x"), case["run"]);
+            let now = chrono::Utc::now().timestamp_millis();
+            answers::store_answer(&js, &schemas, &need.lands_in, id.clone(), &page, &alternative, &case["record"], now).await?;
+            created += 1;
+            for target in &states[1..] {
+                match aggregates::transition(&js, schema, &id, target, serde_json::json!({"by": "simulation"}), now).await {
+                    Ok(_) => moved += 1,
+                    Err(e) => {
+                        refused += 1;
+                        eprintln!("REFUSED by the engine: {id} -> {target}: {e:?}");
+                        break;
+                    }
+                }
+            }
+        }
+        println!("{created} aggregate(s) created, {moved} transition(s) accepted, {refused} refused by the engine\n");
+    }
+
+    // Read every bucket back the way the engine knows it: by replaying
+    // each record's own event log.
+    let mut by_bucket: HashMap<String, BTreeMap<String, usize>> = HashMap::new();
+    for bucket in file.needs.iter().map(|n| n.lands_in.clone()).collect::<std::collections::BTreeSet<_>>() {
+        let (Some(schema), Ok(store)) = (schemas.get(&bucket), js.get_key_value(&bucket).await) else { continue };
+        let mut keys = store.keys().await?;
+        while let Some(Ok(id)) = keys.next().await {
+            let events = load_events(&js, &bucket, &id).await?;
+            if let Some(record) = aggregates::replay(schema, &id, &events) {
+                *by_bucket.entry(bucket.clone()).or_default().entry(record.state).or_default() += 1;
+            }
+        }
+    }
+    println!("{:<18} {:>8} {:>9} {:>9}   {}", "bucket", "records", "finished", "success", "by state");
+    let mut buckets: Vec<_> = by_bucket.iter().collect();
+    buckets.sort();
+    for (bucket, states) in buckets {
+        let needs_here: Vec<&needs::Need> = file.needs.iter().filter(|n| &n.lands_in == bucket).collect();
+        let is = |pick: fn(&needs::Need) -> &Vec<String>, state: &String| needs_here.iter().any(|n| pick(n).contains(state));
+        let total: usize = states.values().sum();
+        let finished: usize = states.iter().filter(|(s, _)| is(|n| &n.done_when, s)).map(|(_, c)| c).sum();
+        let success: usize = states.iter().filter(|(s, _)| is(|n| &n.success, s)).map(|(_, c)| c).sum();
+        let pct = |n: usize| if total == 0 { "-".to_string() } else { format!("{:.0}%", n as f64 * 100.0 / total as f64) };
+        println!(
+            "{:<18} {:>8} {:>9} {:>9}   {}",
+            bucket,
+            total,
+            pct(finished),
+            pct(success),
+            states.iter().map(|(s, c)| format!("{s} {c}")).collect::<Vec<_>>().join(", ")
+        );
+    }
+    Ok(())
+}

src/bin/question_lint.rs

@@ -9,7 +9,8 @@
 //! static binary," not "build a Rust workspace."
 #![cfg(feature = "ssr")]
 
-use portal::{aggregates, content};
+use portal::local::{load_aggregates_from_dir, load_from_dir, load_needs_from_dir, load_site_from_dir};
+use portal::{aggregates, content, needs};
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
@@ -18,6 +19,11 @@ async fn main() -> anyhow::Result<()> {
     let mut branch = "main".to_string();
     let mut subdir = "questions".to_string();
     let mut path: Option<String> = None;
+    let mut tasks_out: Option<String> = None;
+    let mut answers_in: Option<String> = None;
+    let mut min_accuracy: f64 = 0.0;
+    let mut skim = false;
+    let mut sim_out: Option<String> = None;
 
     while let Some(arg) = args.next() {
         match arg.as_str() {
@@ -25,6 +31,13 @@ async fn main() -> anyhow::Result<()> {
             "--branch" => branch = args.next().unwrap_or(branch),
             "--subdir" => subdir = args.next().unwrap_or(subdir),
             "--path" => path = args.next(),
+            "--needs-tasks" => tasks_out = args.next(),
+            "--skim" => skim = true,
+            "--needs-sim" => sim_out = args.next(),
+            "--needs-score" => answers_in = args.next(),
+            "--min-accuracy" => {
+                min_accuracy = args.next().and_then(|v| v.parse().ok()).unwrap_or(min_accuracy)
+            }
             other => {
                 eprintln!("unknown argument: {other}");
                 std::process::exit(2);
@@ -32,18 +45,24 @@ async fn main() -> anyhow::Result<()> {
         }
     }
 
-    let (questions, aggregates_map, site) = if let Some(dir) = path {
+    let (questions, aggregates_map, site, needs_raw) = if let Some(dir) = path {
-        (load_from_dir(&dir)?, load_aggregates_from_dir(&dir)?, load_site_from_dir(&dir)?)
+        (
+            load_from_dir(&dir)?,
+            load_aggregates_from_dir(&dir)?,
+            load_site_from_dir(&dir)?,
+            load_needs_from_dir(&dir)?,
+        )
     } else if let Some(repo_url) = repo {
         let questions = content::load_questions_from_gitea(&repo_url, &branch, &subdir).await?;
         let aggregates_map = content::load_aggregates_from_gitea(&repo_url, &branch).await?;
         // load_site_from_gitea already validates; a missing file is
         // the default config, same as at portal boot.
         let site = content::load_site_from_gitea(&repo_url, &branch).await?;
-        (questions, aggregates_map, site)
+        let needs_raw = content::load_needs_from_gitea(&repo_url, &branch).await?;
+        (questions, aggregates_map, site, needs_raw)
     } else {
         eprintln!(
-            "usage: question-lint --repo <gitea-url> [--branch main] [--subdir questions] | --path <local-dir>"
+            "usage: question-lint (--repo <gitea-url> [--branch main] [--subdir questions] | --path <local-dir>) [--needs-tasks <out.jsonl> [--skim]] [--needs-sim <model.json>] [--needs-score <answers.jsonl> [--min-accuracy 0.8]]"
         );
         std::process::exit(2);
     };
@@ -52,14 +71,36 @@ async fn main() -> anyhow::Result<()> {
         eprintln!("FAIL: {e}");
         std::process::exit(1);
     }
+    let aggregates_map = content::with_builtin_aggregates(aggregates_map);
     match content::validate_questions(&questions, &aggregates_map) {
         Ok(()) => {
+            // The runtime's own event desk: a repo announcing pages
+            // (Question.event) should read portal_events somewhere, or
+            // "post what happened" tasks pile up unseen. Warn, don't
+            // fail - the runtime creates the records either way.
+            if questions.values().any(|q| q.event.is_some())
+                && !content::bucket_is_read(&questions, content::EVENTS_BUCKET)
+            {
+                eprintln!(
+                    "WARN: pages carry `event:` but no kv resource reads bucket {:?} - add a desk so summaries get posted",
+                    content::EVENTS_BUCKET
+                );
+            }
             println!(
                 "OK: {} question(s), {} aggregate(s) valid",
                 questions.len(),
                 aggregates_map.len()
             );
-            Ok(())
+            check_needs(
+                needs_raw.as_deref(),
+                &questions,
+                &aggregates_map,
+                tasks_out.as_deref(),
+                skim,
+                sim_out.as_deref(),
+                answers_in.as_deref(),
+                min_accuracy,
+            )
         }
         Err(e) => {
             eprintln!("FAIL: {e}");
@@ -68,78 +109,118 @@ async fn main() -> anyhow::Result<()> {
     }
 }
 
-/// The offline counterpart to `content::load_site_from_gitea` -
+/// The business-needs pass (see `portal::needs`): structure always,
-/// `site.yaml` lives at the repo root like `aggregates.yaml`, and is
+/// then the wording tasks written out and/or an engine's answers
-/// just as optional locally: missing means default branding.
+/// scored, when asked. A repo without `needs.yaml` skips all of it.
-fn load_site_from_dir(dir: &str) -> anyhow::Result<content::SiteConfig> {
+fn check_needs(
-    let site_path = std::path::Path::new(dir)
+    raw: Option<&str>,
-        .parent()
+    questions: &std::collections::HashMap<String, content::Question>,
-        .unwrap_or_else(|| std::path::Path::new("."))
+    aggregates_map: &std::collections::HashMap<String, aggregates::AggregateSchema>,
-        .join("site.yaml");
+    tasks_out: Option<&str>,
-    if !site_path.exists() {
+    skim: bool,
-        return Ok(content::SiteConfig::default());
+    sim_out: Option<&str>,
-    }
+    answers_in: Option<&str>,
-    let raw = std::fs::read_to_string(&site_path)
+    min_accuracy: f64,
-        .map_err(|e| anyhow::anyhow!("reading {}: {e}", site_path.display()))?;
-    serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing {}: {e}", site_path.display()))
-}
-
-/// The offline counterpart to `content::load_aggregates_from_gitea` -
-/// `aggregates.yaml` lives at the repo root, one level up from the
-/// pages directory `--path` names, so `dir`'s parent is where it's
-/// looked for. Missing entirely is not an error here (unlike
-/// `--repo` mode, where `aggregates.yaml` is required) - a local
-/// checkout being linted may not have one, and every declared
-/// transition still gets checked against whatever *is* found; an
-/// empty map just means nothing is checked.
-fn load_aggregates_from_dir(
-    dir: &str,
-) -> anyhow::Result<std::collections::HashMap<String, aggregates::AggregateSchema>> {
-    let aggregates_path = std::path::Path::new(dir)
-        .parent()
-        .unwrap_or_else(|| std::path::Path::new("."))
-        .join("aggregates.yaml");
-    if !aggregates_path.exists() {
-        return Ok(std::collections::HashMap::new());
-    }
-    let raw = std::fs::read_to_string(&aggregates_path)
-        .map_err(|e| anyhow::anyhow!("reading {}: {e}", aggregates_path.display()))?;
-    aggregates::parse_aggregates_yaml(&raw)
-}
-
-/// The offline counterpart to `content::load_questions_from_gitea` -
-/// the same recursive tree walk and `content::build_questions`
-/// pipeline (derived ids, relative refs, sections, followup
-/// inference), just reading a local checkout instead of Gitea's API,
-/// for linting a branch that hasn't been pushed yet.
-fn load_from_dir(
-    dir: &str,
-) -> anyhow::Result<std::collections::HashMap<String, content::Question>> {
-    let base = std::path::Path::new(dir);
-    let mut files = Vec::new();
-    collect_yaml(base, base, &mut files)?;
-    content::build_questions(&files)
-}
-
-fn collect_yaml(
-    base: &std::path::Path,
-    dir: &std::path::Path,
-    out: &mut Vec<(String, String)>,
 ) -> anyhow::Result<()> {
-    for entry in std::fs::read_dir(dir)? {
+    let Some(raw) = raw else {
-        let path = entry?.path();
+        if tasks_out.is_some() || answers_in.is_some() {
-        if path.is_dir() {
+            eprintln!("FAIL: --needs-tasks/--needs-score given, but the repo has no needs.yaml");
-            collect_yaml(base, &path, out)?;
+            std::process::exit(1);
-        } else if path.extension().and_then(|e| e.to_str()) == Some("yaml") {
-            let rel = path
-                .strip_prefix(base)
-                .expect("walked paths sit under their base")
-                .to_string_lossy()
-                .replace('\\', "/");
-            let raw = std::fs::read_to_string(&path)
-                .map_err(|e| anyhow::anyhow!("reading {}: {e}", path.display()))?;
-            out.push((rel, raw));
         }
+        return Ok(());
+    };
+    let file = match needs::parse(raw) {
+        Ok(file) => file,
+        Err(e) => {
+            eprintln!("FAIL: {e}");
+            std::process::exit(1);
+        }
+    };
+    let findings = needs::check(&file, questions, aggregates_map);
+    let mut failed = 0;
+    for finding in &findings {
+        let level = match finding.level {
+            needs::Level::Fail => {
+                failed += 1;
+                "FAIL"
+            }
+            needs::Level::Warn => "WARN",
+        };
+        eprintln!("{level}: need {:?}: {}", finding.need, finding.message);
+    }
+    for need in &file.needs {
+        if let Some(path) = needs::path_for(questions, need) {
+            let steps: Vec<String> = path
+                .iter()
+                .map(|s| format!("{} [{}]", s.page, s.alternative))
+                .collect();
+            println!("need {:?}: {} -> {:?}", need.id, steps.join(" -> "), need.lands_in);
+        }
+    }
+    if failed == 0 {
+        let planned = file.needs.iter().filter(|n| n.planned).count();
+        println!(
+            "OK: {} need(s) structurally met, {} planned, {} persona(s)",
+            file.needs.len() - planned,
+            planned,
+            file.personas.len()
+        );
+    }
+    // The wording pass still runs for the needs that do have a path -
+    // a closed flow elsewhere is no reason to stop grading the rest.
+
+    if let Some(out) = sim_out {
+        let model = needs::sim_model(&file, questions, aggregates_map);
+        std::fs::write(out, serde_json::to_string_pretty(&model)?)
+            .map_err(|e| anyhow::anyhow!("writing {out}: {e}"))?;
+        println!("wrote the simulation model to {out}");
+    }
+    let tasks = needs::tasks(&file, questions, skim);
+    if let Some(out) = tasks_out {
+        let mut lines = String::new();
+        for task in &tasks {
+            lines.push_str(&serde_json::to_string(task)?);
+            lines.push('\n');
+        }
+        std::fs::write(out, lines).map_err(|e| anyhow::anyhow!("writing {out}: {e}"))?;
+        println!("wrote {} wording task(s) to {out}", tasks.len());
+    }
+    if let Some(path) = answers_in {
+        let raw = std::fs::read_to_string(path).map_err(|e| anyhow::anyhow!("reading {path}: {e}"))?;
+        let mut answers = Vec::new();
+        for (n, line) in raw.lines().enumerate().filter(|(_, l)| !l.trim().is_empty()) {
+            answers.push(
+                serde_json::from_str::<needs::Answer>(line)
+                    .map_err(|e| anyhow::anyhow!("{path}:{}: {e}", n + 1))?,
+            );
+        }
+        let score = needs::score(&tasks, &answers, 0.6);
+        for (id, picked, expected, confidence) in &score.misroutes {
+            eprintln!(
+                "MISROUTE: {id}: picked {picked:?}{}, the need is met by {expected:?}",
+                confidence.map(|c| format!(" ({c:.2})")).unwrap_or_default()
+            );
+        }
+        for (id, confidence) in &score.hesitant {
+            eprintln!("HESITANT: {id}: right, at {confidence:.2}");
+        }
+        for id in &score.unanswered {
+            eprintln!("UNANSWERED: {id}");
+        }
+        println!(
+            "wording: {}/{} routed right ({:.0}%)",
+            score.correct,
+            score.total,
+            score.accuracy() * 100.0
+        );
+        if score.accuracy() < min_accuracy {
+            eprintln!("FAIL: below --min-accuracy {min_accuracy}");
+            std::process::exit(1);
+        }
+    }
+    if failed > 0 {
+        eprintln!("FAIL: {failed} unmet business need finding(s)");
+        std::process::exit(1);
     }
     Ok(())
 }

src/chain.rs

@@ -20,6 +20,11 @@ pub const CHAIN_BUCKET: &str = "portal_chains";
 #[derive(serde::Serialize, serde::Deserialize)]
 pub struct ChainNode {
     pub question_id: String,
+    /// Which alternative was answered - what decides where the visitor
+    /// was sent next, and so which followup the chain has earned. Nodes
+    /// indexed before this field existed carry `None`.
+    #[serde(default)]
+    pub alternative: Option<String>,
     pub timestamp_ms: i64,
 }
 
@@ -30,6 +35,7 @@ pub async fn record_node(
     js: &async_nats::jetstream::Context,
     chain_hash: &str,
     question_id: &str,
+    alternative: &str,
     timestamp_ms: i64,
 ) -> anyhow::Result<()> {
     let store = match js.get_key_value(CHAIN_BUCKET).await {
@@ -44,6 +50,7 @@ pub async fn record_node(
     };
     let node = ChainNode {
         question_id: question_id.to_string(),
+        alternative: Some(alternative.to_string()),
         timestamp_ms,
     };
     store.put(chain_hash, serde_json::to_vec(&node)?.into()).await?;

src/content/gitea.rs

@@ -0,0 +1,252 @@
+//! Loading a content repo from Gitea, and the NATS-signalled reload
+//! that hot-swaps it (last-good content is kept on any failure). Every
+//! fetch goes through `crate::http`: bounded in time and size.
+
+use super::*;
+
+/// Fetches `needs.yaml` from the content repo root - the business's
+/// needs spec `question_lint` checks the pages against (see
+/// `crate::needs`). Optional: a fetch failure means the repo declares
+/// none. The runtime never reads it.
+#[cfg(feature = "ssr")]
+pub async fn load_needs_from_gitea(repo_url: &str, branch: &str) -> anyhow::Result<Option<String>> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+    Ok(fetch_gitea_file(&api_base, &owner, &repo, branch, "needs.yaml")
+        .await
+        .ok())
+}
+
+/// Fetches and parses `site.yaml` from the content repo root. A fetch
+/// failure (typically 404 - the file is optional) yields the default
+/// config; a file that exists but doesn't parse or validate is a real
+/// error, surfaced at boot rather than papered over.
+#[cfg(feature = "ssr")]
+pub async fn load_site_from_gitea(repo_url: &str, branch: &str) -> anyhow::Result<SiteConfig> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+    let raw = match fetch_gitea_file(&api_base, &owner, &repo, branch, "site.yaml").await {
+        Ok(raw) => raw,
+        Err(e) => {
+            tracing::info!("no site.yaml in content repo ({e}), using default branding");
+            return Ok(SiteConfig::default());
+        }
+    };
+    let site: SiteConfig =
+        serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing site.yaml: {e}"))?;
+    site.validate()?;
+    Ok(site)
+}
+
+/// Extracts `scheme://host` from a repo's normal browser URL - the
+/// Gitea API base every helper in this module builds requests against.
+#[cfg(feature = "ssr")]
+/// `{gitea}/api/v1/repos/{owner}/{repo}/raw` - the base
+/// `site_asset_handler` proxies content-shipped files from.
+#[cfg(feature = "ssr")]
+pub fn gitea_raw_base(repo_url: &str) -> anyhow::Result<String> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    Ok(format!("{}/api/v1/repos/{owner}/{repo}/raw", gitea_api_base(repo_url)?))
+}
+
+#[cfg(feature = "ssr")]
+pub fn gitea_api_base(repo_url: &str) -> anyhow::Result<String> {
+    let parsed = url::Url::parse(repo_url)
+        .map_err(|e| anyhow::anyhow!("parsing repo url {repo_url}: {e}"))?;
+    Ok(format!(
+        "{}://{}",
+        parsed.scheme(),
+        parsed
+            .host_str()
+            .ok_or_else(|| anyhow::anyhow!("no host in repo url {repo_url}"))?
+    ))
+}
+
+/// Splits a repo's normal browser URL into `(owner, repo)` - shared by
+/// every loader in this module that needs to build a Gitea contents API
+/// URL (`load_questions_from_gitea`, `load_aggregates_from_gitea`).
+#[cfg(feature = "ssr")]
+pub(crate) fn parse_owner_repo(repo_url: &str) -> anyhow::Result<(String, String)> {
+    let parsed = url::Url::parse(repo_url)
+        .map_err(|e| anyhow::anyhow!("parsing content repo url {repo_url}: {e}"))?;
+    let mut segments = parsed
+        .path_segments()
+        .ok_or_else(|| anyhow::anyhow!("no path in content repo url {repo_url}"))?;
+    let owner = segments
+        .next()
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("missing owner in content repo url {repo_url}"))?
+        .to_string();
+    let repo = segments
+        .next()
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("missing repo name in content repo url {repo_url}"))?
+        .to_string();
+    Ok((owner, repo))
+}
+
+/// Fetches one file from a Gitea repo's contents API and returns its raw
+/// text - the single-file counterpart to `load_questions_from_gitea`'s
+/// directory-listing loop, used by `load_aggregates_from_gitea` for the
+/// one `aggregates.yaml` file at the repo root.
+#[cfg(feature = "ssr")]
+pub(crate) async fn fetch_gitea_file(
+    api_base: &str,
+    owner: &str,
+    repo: &str,
+    branch: &str,
+    path: &str,
+) -> anyhow::Result<String> {
+    let meta_url = format!("{api_base}/api/v1/repos/{owner}/{repo}/contents/{path}?ref={branch}");
+    let meta_text = crate::http::get_text(&meta_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| anyhow::anyhow!("fetching {meta_url}: {e}"))?;
+    let meta: serde_json::Value = serde_json::from_str(&meta_text)
+        .map_err(|e| anyhow::anyhow!("parsing contents response from {meta_url}: {e}"))?;
+    let download_url = meta
+        .get("download_url")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow::anyhow!("no download_url for {path}"))?;
+    crate::http::get_text(download_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| anyhow::anyhow!("fetching {path}: {e}"))
+}
+
+/// Fetches and parses `aggregates.yaml` from the repo root (sibling to
+/// the pages `subdir`, so the "every yaml under subdir is a page"
+/// convention needs no exclusion). A malformed file fails here, before
+/// ever reaching `AppState`.
+#[cfg(feature = "ssr")]
+pub async fn load_aggregates_from_gitea(
+    repo_url: &str,
+    branch: &str,
+) -> anyhow::Result<std::collections::HashMap<String, crate::aggregates::AggregateSchema>> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+    let raw = fetch_gitea_file(&api_base, &owner, &repo, branch, "aggregates.yaml").await?;
+    crate::aggregates::parse_aggregates_yaml(&raw)
+}
+
+#[cfg(feature = "ssr")]
+pub async fn load_questions_from_gitea(
+    repo_url: &str,
+    branch: &str,
+    subdir: &str,
+) -> anyhow::Result<std::collections::HashMap<String, Question>> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+
+    // One recursive git-trees call for the whole repo instead of a
+    // contents listing per directory - the tree IS the router now, so
+    // nested files matter.
+    let tree_url =
+        format!("{api_base}/api/v1/repos/{owner}/{repo}/git/trees/{branch}?recursive=true");
+    let listing = crate::http::get_text(&tree_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| anyhow::anyhow!("listing {tree_url}: {e}"))?;
+    let tree: serde_json::Value = serde_json::from_str(&listing)
+        .map_err(|e| anyhow::anyhow!("parsing tree from {tree_url}: {e}"))?;
+    if tree.get("truncated").and_then(|v| v.as_bool()) == Some(true) {
+        anyhow::bail!("git tree listing for {owner}/{repo} was truncated - repo too large");
+    }
+    let prefix = format!("{subdir}/");
+
+    let mut files = Vec::new();
+    for entry in tree
+        .get("tree")
+        .and_then(|v| v.as_array())
+        .map(|v| v.as_slice())
+        .unwrap_or_default()
+    {
+        let path = entry.get("path").and_then(|v| v.as_str()).unwrap_or("");
+        if entry.get("type").and_then(|v| v.as_str()) != Some("blob")
+            || !path.starts_with(&prefix)
+            || !path.ends_with(".yaml")
+        {
+            continue;
+        }
+        // Brackets (dynamic pages like `[record].yaml`) must be
+        // percent-encoded in the raw URL's path.
+        let encoded = path.replace('[', "%5B").replace(']', "%5D");
+        let raw_url = format!("{api_base}/api/v1/repos/{owner}/{repo}/raw/{encoded}?ref={branch}");
+        let raw = crate::http::get_text(&raw_url, crate::http::GITEA_CAP)
+            .await
+            .map_err(|e| anyhow::anyhow!("fetching {path}: {e}"))?;
+        files.push((path[prefix.len()..].to_string(), raw));
+    }
+    build_questions(&files)
+}
+
+/// Published by the content repo's own CI (after it lints a push) to
+/// tell every running instance to pick up the change - a plain fire
+/// and forget NATS publish, no payload, matching `events.rs`'s
+/// `ANSWERS_SUBJECT` pattern.
+#[cfg(feature = "ssr")]
+pub const CONTENT_RELOAD_SUBJECT: &str = "portal.content.reload";
+
+/// Runs for the life of the process: re-fetches `repo_url`/`branch` and
+/// atomically swaps both `questions` and `aggregates` on every
+/// `CONTENT_RELOAD_SUBJECT` message - the two only ever swap together,
+/// after both have loaded and validated successfully, so a reader never
+/// sees pages that reference a half-updated state graph. A fetch/parse
+/// failure logs and keeps serving the last-good content rather than
+/// clearing it - a bad push to the content repo (which should already
+/// have been caught by its own lint step) doesn't take the site down.
+#[cfg(feature = "ssr")]
+pub async fn watch_for_reload(
+    nats: async_nats::Client,
+    repo_url: String,
+    branch: String,
+    subdir: String,
+    questions: std::sync::Arc<arc_swap::ArcSwap<std::collections::HashMap<String, Question>>>,
+    aggregates: std::sync::Arc<
+        arc_swap::ArcSwap<std::collections::HashMap<String, crate::aggregates::AggregateSchema>>,
+    >,
+    site: std::sync::Arc<arc_swap::ArcSwap<SiteConfig>>,
+) {
+    let mut sub = match nats.subscribe(CONTENT_RELOAD_SUBJECT).await {
+        Ok(sub) => sub,
+        Err(e) => {
+            tracing::error!(error = %e, "failed to subscribe to content reload subject");
+            return;
+        }
+    };
+    use futures::StreamExt;
+    while sub.next().await.is_some() {
+        let loaded_aggregates = match load_aggregates_from_gitea(&repo_url, &branch).await {
+            Ok(loaded) => with_builtin_aggregates(loaded),
+            Err(e) => {
+                tracing::error!(error = %e, "aggregates.yaml reload failed, keeping last-good content");
+                continue;
+            }
+        };
+        // Branding swaps with the same all-or-nothing rule: a
+        // present-but-broken site.yaml keeps last-good everything
+        // (load_site distinguishes "absent" - a normal default - from
+        // "present but invalid").
+        let loaded_site = match load_site_from_gitea(&repo_url, &branch).await {
+            Ok(loaded) => loaded,
+            Err(e) => {
+                tracing::error!(error = %e, "site.yaml reload failed, keeping last-good content");
+                continue;
+            }
+        };
+        match load_questions_from_gitea(&repo_url, &branch, &subdir).await {
+            Ok(loaded) => {
+                if let Err(e) = validate_questions(&loaded, &loaded_aggregates) {
+                    tracing::error!(error = %e, "content reload failed validation, keeping last-good content");
+                    continue;
+                }
+                let count = loaded.len();
+                questions.store(std::sync::Arc::new(loaded));
+                aggregates.store(std::sync::Arc::new(loaded_aggregates));
+                site.store(std::sync::Arc::new(loaded_site));
+                tracing::info!(count, "reloaded content");
+            }
+            Err(e) => {
+                tracing::error!(error = %e, "content reload failed, keeping last-good content");
+            }
+        }
+    }
+}
+

src/content/handlers.rs

@@ -0,0 +1,193 @@
+//! The Axum routes that expose content and buckets outside the Leptos
+//! app: content-shipped assets proxied same-origin, repo info for the
+//! showcase, and the automation read API over KV buckets.
+
+use super::*;
+
+/// A repo-relative asset path portal is willing to proxy from the
+/// content repo: plain segments only - no traversal, no leading slash,
+/// no scheme - so `/site/<path>` can only ever reach the content repo.
+pub fn is_safe_site_path(path: &str) -> bool {
+    !path.is_empty()
+        && !path.starts_with('/')
+        && path.split('/').all(|seg| {
+            !seg.is_empty()
+                && seg != ".."
+                && seg
+                    .chars()
+                    .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
+        })
+}
+
+/// A public Gitea repo's basic info - what `resolve_gitea_repo` returns
+/// for the prosekit editor's repo-embed node to render as a static
+/// card, baked in once at embed time rather than re-fetched by every
+/// reader (an emailed newsletter can't run JS to do that anyway).
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct GiteaRepoInfo {
+    pub owner: String,
+    pub repo: String,
+    pub description: String,
+    pub url: String,
+}
+
+#[derive(Deserialize)]
+#[cfg(feature = "ssr")]
+pub struct GiteaRepoQuery {
+    pub owner: String,
+    pub repo: String,
+}
+
+/// `GET /site/{*path}` - serves a file from the content repo's default
+/// branch same-origin, so content-shipped assets (the hero module,
+/// its stylesheet) are importable by the page: Gitea's raw endpoint
+/// sends no CORS headers, and an ES module import across origins is
+/// refused without them. Path is validated to plain segments
+/// (`is_safe_site_path`), the response revalidates like /pkg
+/// (Cache-Control: no-cache) so a content push shows up on reload.
+#[cfg(feature = "ssr")]
+pub async fn site_asset_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Path(path): axum::extract::Path<String>,
+) -> axum::response::Response {
+    use axum::http::{header, StatusCode};
+    use axum::response::IntoResponse;
+
+    if !is_safe_site_path(&path) {
+        return (StatusCode::BAD_REQUEST, "invalid asset path").into_response();
+    }
+    let url = format!("{}/{path}?ref={}", state.content_raw_base, state.content_branch);
+    let resp = match crate::http::client().get(&url).send().await.and_then(|r| r.error_for_status()) {
+        Ok(r) => r,
+        Err(e) => {
+            tracing::warn!("site asset {path}: {e}");
+            return (StatusCode::NOT_FOUND, "no such site asset").into_response();
+        }
+    };
+    let bytes = match crate::http::bytes(resp, crate::http::ASSET_CAP).await {
+        Ok(b) => axum::body::Bytes::from(b),
+        Err(e) => return (StatusCode::BAD_GATEWAY, e.to_string()).into_response(),
+    };
+    let mime = match path.rsplit('.').next() {
+        Some("js") | Some("mjs") => "text/javascript; charset=utf-8",
+        Some("css") => "text/css; charset=utf-8",
+        Some("svg") => "image/svg+xml",
+        Some("json") => "application/json",
+        Some("png") => "image/png",
+        Some("webp") => "image/webp",
+        Some("avif") => "image/avif",
+        Some("ico") => "image/x-icon",
+        Some("woff2") => "font/woff2",
+        _ => "application/octet-stream",
+    };
+    (
+        [(header::CONTENT_TYPE, mime), (header::CACHE_CONTROL, "no-cache")],
+        bytes,
+    )
+        .into_response()
+}
+
+/// Looks up `owner/repo` on the same Gitea instance content is loaded
+/// from (`AppState.gitea_base`) - a raw Axum handler (mounted at
+/// `/gitea-repo` in `main.rs`), not a Leptos server fn, since the
+/// caller here is the prosekit editor's own paste-to-embed rule (see
+/// `prosekit-editor.js`) doing a plain `fetch`, the same reason
+/// `/upload` (`src/upload.rs`) is a raw handler rather than a `#[server]`
+/// fn. Keeping this server-resolved (rather than having the browser
+/// call Gitea's API directly) is consistent with every other backing
+/// store in this app, and sidesteps needing a CORS allowance on Gitea's
+/// side just for this. No auth, same as content loading - resolves
+/// only what's already public.
+#[cfg(feature = "ssr")]
+pub async fn gitea_repo_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Query(query): axum::extract::Query<GiteaRepoQuery>,
+) -> Result<axum::Json<GiteaRepoInfo>, (axum::http::StatusCode, String)> {
+    let is_safe_segment = |s: &str| {
+        !s.is_empty()
+            && s.chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
+    };
+    if !is_safe_segment(&query.owner) || !is_safe_segment(&query.repo) {
+        return Err((axum::http::StatusCode::BAD_REQUEST, "invalid owner/repo".to_string()));
+    }
+    let GiteaRepoQuery { owner, repo } = query;
+
+    let api_url = format!("{}/api/v1/repos/{owner}/{repo}", state.gitea_base);
+    let body = crate::http::get_text(&api_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, format!("fetching {api_url}: {e}")))?;
+    let json: serde_json::Value = serde_json::from_str(&body).map_err(|e| {
+        (
+            axum::http::StatusCode::BAD_GATEWAY,
+            format!("parsing repo info from {api_url}: {e}"),
+        )
+    })?;
+
+    Ok(axum::Json(GiteaRepoInfo {
+        owner: owner.clone(),
+        repo: repo.clone(),
+        description: json
+            .get("description")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .to_string(),
+        url: json
+            .get("html_url")
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string())
+            .unwrap_or_else(|| format!("{}/{owner}/{repo}", state.gitea_base)),
+    }))
+}
+
+/// Lists every entry in a NATS KV bucket as JSON - a raw Axum handler
+/// (mounted at `/automation/kv/{bucket}` in `main.rs`), for backing
+/// automations (e.g. an n8n workflow reading `portal_subscribers` to
+/// send a newsletter) that aren't a signed-in browser session and so
+/// can't go through `resource::get_resource`'s Kanidm-group check.
+/// Gated by a single shared bearer token (`AUTOMATION_READ_TOKEN`) -
+/// deliberately not per-caller/per-bucket scoped, since every current
+/// caller is a trusted internal automation, not a third party. Read
+/// only, matching `get_resource`'s own "reads can be public/shared,
+/// mutations always need real identity" split - nothing here writes.
+#[cfg(feature = "ssr")]
+pub async fn automation_kv_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Path(bucket): axum::extract::Path<String>,
+    headers: axum::http::HeaderMap,
+) -> Result<axum::Json<serde_json::Value>, (axum::http::StatusCode, String)> {
+    let expected = std::env::var("AUTOMATION_READ_TOKEN").unwrap_or_default();
+    let presented = headers
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .unwrap_or("");
+    if expected.is_empty() || presented != expected {
+        return Err((axum::http::StatusCode::UNAUTHORIZED, "unauthorized".to_string()));
+    }
+
+    let store = state
+        .jetstream
+        .get_key_value(&bucket)
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, format!("bucket unavailable: {e}")))?;
+
+    use futures::TryStreamExt;
+    let keys: Vec<String> = store
+        .keys()
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, e.to_string()))?
+        .try_collect()
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, e.to_string()))?;
+    let mut items = Vec::new();
+    for key in keys {
+        if let Ok(Some(bytes)) = store.get(&key).await {
+            if let Ok(value) = serde_json::from_slice::<serde_json::Value>(&bytes) {
+                items.push(value);
+            }
+        }
+    }
+    Ok(axum::Json(serde_json::Value::Array(items)))
+}
+

src/content/markdown.rs

@@ -0,0 +1,120 @@
+//! Inline markdown for descriptions: links on a short allow-list of
+//! schemes, images gated and framed, with layout hints read from the
+//! image title. Never raw HTML.
+
+/// Descriptions are inline markdown: `[text](https://…)` links,
+/// `*emphasis*`, `**strong**`, `` `code` ``. Block structure is
+/// flattened (a description is one paragraph) and raw HTML in the
+/// source is dropped, so content can link out without being able to
+/// inject markup. Link targets are limited to https, mailto and
+/// site-relative paths; anything else renders as plain text.
+pub fn render_inline_markdown(text: &str) -> String {
+    use pulldown_cmark::{html, Event, Options, Parser, Tag, TagEnd};
+    let parser = Parser::new_ext(text, Options::empty());
+    let mut in_link = 0usize;
+    let mut in_dropped_image = 0usize;
+    let filtered = parser.filter_map(|event| match event {
+        Event::Html(_) | Event::InlineHtml(_) => None,
+        Event::Start(Tag::Paragraph) | Event::End(TagEnd::Paragraph) => None,
+        Event::SoftBreak => Some(Event::Text(" ".into())),
+        Event::Start(Tag::Link { dest_url, .. })
+            if !(dest_url.starts_with("https://")
+                || dest_url.starts_with("mailto:")
+                || dest_url.starts_with("tel:")
+                || dest_url.starts_with('/')) =>
+        {
+            in_link += 1;
+            None
+        }
+        Event::End(TagEnd::Link) if in_link > 0 => {
+            in_link -= 1;
+            None
+        }
+        // Images take the same gate as links: https or same-origin
+        // only - no data:, no plain http. Unlike a dropped link (whose
+        // label is real text worth keeping), a dropped image's alt
+        // text is a caption for something that isn't there - swallow it.
+        Event::Start(Tag::Image { dest_url, .. })
+            if !(dest_url.starts_with("https://") || dest_url.starts_with('/')) =>
+        {
+            in_dropped_image += 1;
+            None
+        }
+        Event::End(TagEnd::Image) if in_dropped_image > 0 => {
+            in_dropped_image -= 1;
+            None
+        }
+        Event::Text(_) if in_dropped_image > 0 => None,
+        other => Some(other),
+    });
+    let mut out = String::new();
+    html::push_html(&mut out, filtered);
+    apply_image_hints(out.trim())
+}
+
+/// Translate a markdown image's title (`![alt](url "right 9rem")`)
+/// into layout: `left`/`right` float via a class, a bare number
+/// (optionally with `rem`) into a validated `max-width`. Unknown
+/// tokens are ignored; the title attribute is dropped either way.
+/// Only touches `<img>` tags in our own render output, and only ever
+/// emits a numeric max-width - no arbitrary CSS reaches the page.
+pub(crate) fn apply_image_hints(html: &str) -> String {
+    let mut out = String::new();
+    let mut rest = html;
+    while let Some(pos) = rest.find("<img ") {
+        out.push_str(&rest[..pos]);
+        let after = &rest[pos..];
+        let end = after.find('>').map(|e| e + 1).unwrap_or(after.len());
+        out.push_str(&rewrite_img_tag(&after[..end]));
+        rest = &after[end..];
+    }
+    out.push_str(rest);
+    out
+}
+
+pub(crate) fn rewrite_img_tag(tag: &str) -> String {
+    // Pull the title value, if any.
+    let title = tag
+        .find("title=\"")
+        .map(|i| &tag[i + 7..])
+        .and_then(|r| r.find('"').map(|e| &r[..e]))
+        .unwrap_or("");
+
+    let mut class = String::new();
+    let mut max_rem: Option<f32> = None;
+    for tok in title.split_whitespace() {
+        match tok {
+            "left" => class = "md-float-left".into(),
+            "right" => class = "md-float-right".into(),
+            other => {
+                if let Ok(n) = other.trim_end_matches("rem").parse::<f32>() {
+                    if n > 0.0 && n <= 60.0 {
+                        max_rem = Some(n);
+                    }
+                }
+            }
+        }
+    }
+
+    // Strip the title attribute from the tag.
+    let mut cleaned = tag.to_string();
+    if let Some(i) = cleaned.find(" title=\"") {
+        if let Some(e) = cleaned[i + 8..].find('"') {
+            cleaned.replace_range(i..i + 8 + e + 1, "");
+        }
+    }
+
+    // Inject class/style right after `<img`.
+    let mut attrs = String::new();
+    if !class.is_empty() {
+        attrs.push_str(&format!(" class=\"{class}\""));
+    }
+    if let Some(n) = max_rem {
+        attrs.push_str(&format!(" style=\"max-width:{n}rem\""));
+    }
+    if attrs.is_empty() {
+        return cleaned;
+    }
+    cleaned.replacen("<img", &format!("<img{attrs}"), 1)
+}
+

src/content/validate.rs

@@ -0,0 +1,290 @@
+//! What a content repo must satisfy before it serves: every action
+//! lands on a page, every transition is one the state machine allows,
+//! every recorded bucket is read back somewhere, and the built-in
+//! aggregates the runtime owns are always present.
+
+#[allow(unused_imports)] // the browser build sees fewer items
+use super::*;
+
+/// A relay must be a ws:// or wss:// URL - shared between site.yaml's
+/// hero and `Requirement.relay` validation.
+#[cfg(feature = "ssr")]
+pub fn validate_relay_url(relay: &str) -> anyhow::Result<()> {
+    let parsed = url::Url::parse(relay)
+        .map_err(|e| anyhow::anyhow!("relay {relay:?} is not a valid URL: {e}"))?;
+    if !matches!(parsed.scheme(), "ws" | "wss") {
+        anyhow::bail!("relay {relay:?} must use the ws:// or wss:// scheme");
+    }
+    Ok(())
+}
+
+/// Validates every declared transition target (`SelfTransition.to`,
+/// `ResourceSpec.transitions[].to`) against `aggregates` - the real
+/// state graph loaded from `aggregates.yaml` - for every bucket that
+/// has one declared. A bucket with no entry in `aggregates` is left
+/// alone entirely (no validation applied): not every bucket needs to
+/// be event-sourced to keep working. Called on every content
+/// load/reload (`watch_for_reload`, `main.rs`'s boot path) and by the
+/// standalone `question-lint` binary, so a YAML typo becomes a caught,
+/// logged rejection instead of a silently-accepted, later-broken
+/// string.
+/// Bucket the runtime keeps for announced pages (`Question.event`):
+/// one record per event question, `announced` while the window is
+/// open, `awaiting_summary` once it closes - the "post what happened"
+/// task a desk reading this bucket picks up - and `summarized` when an
+/// owner marks it done. Declared here, not in content, because the
+/// runtime's sweeper (`announce.rs`) is what moves the records.
+pub const EVENTS_BUCKET: &str = "portal_events";
+
+#[cfg(feature = "ssr")]
+const BUILTIN_AGGREGATES_YAML: &str = "\
+aggregates:
+  - bucket: portal_events
+    initial: announced
+    states:
+      announced: { event: announced }
+      awaiting_summary: { event: ended }
+      summarized: { event: summarized }
+    transitions:
+      announced: [awaiting_summary, summarized]
+      awaiting_summary: [summarized]
+";
+
+/// Adds the runtime's own state graphs to a content repo's. Content
+/// wins if it declares the same bucket (say, to add states).
+#[cfg(feature = "ssr")]
+pub fn with_builtin_aggregates(
+    mut aggregates: std::collections::HashMap<String, crate::aggregates::AggregateSchema>,
+) -> std::collections::HashMap<String, crate::aggregates::AggregateSchema> {
+    let builtin = crate::aggregates::parse_aggregates_yaml(BUILTIN_AGGREGATES_YAML)
+        .expect("builtin aggregates yaml is valid");
+    for (bucket, schema) in builtin {
+        aggregates.entry(bucket).or_insert(schema);
+    }
+    aggregates
+}
+
+/// True when some kv resource in the content reads `bucket` - the
+/// attended-bucket check, exposed so the lint can warn about the
+/// runtime's own `portal_events` (a warning, not a failure: a repo
+/// with no event pages has nothing to attend).
+#[cfg(feature = "ssr")]
+pub fn bucket_is_read(questions: &std::collections::HashMap<String, Question>, bucket: &str) -> bool {
+    questions.values().any(|q| {
+        q.alternatives.iter().any(|a| {
+            a.features
+                .iter()
+                .any(|f| f.resource.as_ref().and_then(|r| r.bucket()).is_some_and(|b| b == bucket))
+        })
+    })
+}
+
+#[cfg(feature = "ssr")]
+pub fn validate_questions(
+    questions: &std::collections::HashMap<String, Question>,
+    aggregates: &std::collections::HashMap<String, crate::aggregates::AggregateSchema>,
+) -> anyhow::Result<()> {
+    for question in questions.values() {
+        if let Some(event) = &question.event {
+            if question.is_dynamic() {
+                anyhow::bail!("question {:?}: a dynamic page can't carry an event", question.id);
+            }
+            if let Err(e) = event.window_ms() {
+                anyhow::bail!("question {:?}: event: {e}", question.id);
+            }
+        }
+        if let Some(target) = &question.requires_chain {
+            if !questions.contains_key(target) {
+                anyhow::bail!(
+                    "question {:?}: requires_chain {:?} does not match any declared question id",
+                    question.id,
+                    target
+                );
+            }
+        }
+        for alternative in &question.alternatives {
+            // A dangling action is a literal dead end: the submit
+            // button navigates to "Nothing here".
+            if let Some(action) = &alternative.action {
+                if action.contains('{') {
+                    // Placeholders are filled at submit time; the
+                    // shape must land on a dynamic page once filled.
+                    let probe = template_action(action, &serde_json::json!({}));
+                    let filled = {
+                        let mut a = action.clone();
+                        while let (Some(i), Some(j)) = (a.find('{'), a.find('}')) {
+                            a.replace_range(i..=j, "x");
+                        }
+                        a
+                    };
+                    let _ = probe;
+                    // Match the pattern itself: resolve_question would
+                    // hand back a clone whose id is already concrete.
+                    let lands = questions
+                        .values()
+                        .any(|q| q.is_dynamic() && path_matches(&q.id, &filled).is_some());
+                    if lands {
+                        continue;
+                    }
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: templated action {:?} must land on a dynamic page ([name].yaml)",
+                        question.id, alternative.name, action
+                    );
+                }
+                match questions.get(action) {
+                    None => anyhow::bail!(
+                        "question {:?} alternative {:?}: action {:?} does not match any declared question id",
+                        question.id, alternative.name, action
+                    ),
+                    // A dynamic page needs a concrete segment value to
+                    // be a URL - a submit button can't supply one.
+                    Some(target) if target.is_dynamic() => anyhow::bail!(
+                        "question {:?} alternative {:?}: action {:?} targets a dynamic page - actions must name a concrete question",
+                        question.id, alternative.name, action
+                    ),
+                    Some(_) => {}
+                }
+            }
+            if let Some(st) = &alternative.self_transition {
+                if let Some(schema) = aggregates.get(&st.bucket) {
+                    if !schema.has_state(&st.to) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?}: self_transition.to {:?} is not a declared state for bucket {:?}",
+                            question.id, alternative.name, st.to, st.bucket
+                        );
+                    }
+                }
+            }
+            // Bind targets resolve across the whole alternative, same
+            // scope as the signal maps the renderer builds.
+            let sibling_names: std::collections::HashSet<&str> = alternative
+                .features
+                .iter()
+                .flat_map(|f| f.requirements.iter())
+                .map(|r| r.name.as_str())
+                .collect();
+            for feature in &alternative.features {
+                for requirement in &feature.requirements {
+                    if requirement.kind == "select"
+                        && requirement.resource.is_none()
+                        && requirement.options.is_empty()
+                    {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: select but declares neither a resource nor inline options",
+                            question.id, alternative.name, feature.name, requirement.name
+                        );
+                    }
+                    if let Some(relay) = &requirement.relay {
+                        if requirement.kind != "gesture" && requirement.kind != "voice" {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} declares relay but is type {:?} - relay only makes sense on type: gesture or voice",
+                                question.id, alternative.name, feature.name, requirement.name, requirement.kind
+                            );
+                        }
+                        validate_relay_url(relay).map_err(|e| anyhow::anyhow!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?}: {e}",
+                            question.id, alternative.name, feature.name, requirement.name
+                        ))?;
+                    }
+                    if requirement.kind == "gesture"
+                        && (requirement.resource.is_some() || requirement.bind.is_some())
+                    {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: gesture - it draws its value, it can't also load one from a resource or bind",
+                            question.id, alternative.name, feature.name, requirement.name
+                        );
+                    }
+                    if let Some(bind) = &requirement.bind {
+                        if bind.field == requirement.name
+                            || !sibling_names.contains(bind.field.as_str())
+                        {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} binds to {:?}, which is not another requirement on this alternative",
+                                question.id, alternative.name, feature.name, requirement.name, bind.field
+                            );
+                        }
+                    }
+                }
+                let Some(resource) = &feature.resource else {
+                    continue;
+                };
+                let Some(bucket) = resource.bucket() else {
+                    continue;
+                };
+                let Some(schema) = aggregates.get(bucket) else {
+                    continue;
+                };
+                for transition in &resource.transitions {
+                    if !schema.has_state(&transition.from) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: transition.from {:?} is not a declared state for bucket {:?}",
+                            question.id, alternative.name, feature.name, transition.from, bucket
+                        );
+                    }
+                    if !schema.has_state(&transition.to) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: transition.to {:?} is not a declared state for bucket {:?}",
+                            question.id, alternative.name, feature.name, transition.to, bucket
+                        );
+                    }
+                    if !schema.allowed(&transition.from).iter().any(|s| s == &transition.to) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: transition {:?} -> {:?} is not a declared edge for bucket {:?}",
+                            question.id, alternative.name, feature.name, transition.from, transition.to, bucket
+                        );
+                    }
+                }
+            }
+        }
+    }
+
+    // Attended buckets: no publicly collected answer may land somewhere
+    // nothing reads. Every `record_as` bucket must either be read back
+    // by some Kv resource in this same content repo (a desk or listing)
+    // or carry an explicit `attended_by:` annotation in aggregates.yaml
+    // naming the automation that consumes it. This is a contract, not a
+    // convention, because convention already failed once: a question
+    // was dropped and its bucket - answers included - silently fell out
+    // of every reader's view.
+    let mut read_buckets = std::collections::HashSet::new();
+    let note_resource = |spec: &ResourceSpec, set: &mut std::collections::HashSet<String>| {
+        if let ResourceSource::Kv { bucket } = &spec.source {
+            set.insert(bucket.clone());
+        }
+    };
+    for question in questions.values() {
+        for alternative in &question.alternatives {
+            for feature in &alternative.features {
+                if let Some(spec) = &feature.resource {
+                    note_resource(spec, &mut read_buckets);
+                }
+                for requirement in &feature.requirements {
+                    if let Some(spec) = &requirement.resource {
+                        note_resource(spec, &mut read_buckets);
+                    }
+                    if let Some(bind) = &requirement.bind {
+                        note_resource(&bind.resource, &mut read_buckets);
+                    }
+                }
+            }
+        }
+    }
+    for question in questions.values() {
+        for alternative in &question.alternatives {
+            if let Some(bucket) = &alternative.record_as {
+                let attended = read_buckets.contains(bucket)
+                    || aggregates
+                        .get(bucket)
+                        .is_some_and(|schema| schema.attended_by.is_some());
+                if !attended {
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: record_as {bucket:?} is unattended - no page reads that bucket back, and aggregates.yaml declares no attended_by for it. Add a desk/listing resource over it, or annotate the automation that consumes it.",
+                        question.id, alternative.name
+                    );
+                }
+            }
+        }
+    }
+    Ok(())
+}
+

src/http.rs

@@ -0,0 +1,64 @@
+//! The one outbound HTTP client, bounded. Every server-side fetch -
+//! Gitea content at boot and on reload, the raw-asset proxy, the
+//! repo-info endpoint, and the content-declared `url` resource - goes
+//! through here, so a slow or oversized upstream can cost a request at
+//! most `TIMEOUT` and `cap` bytes, never a thread or the heap. Before
+//! this module each call site built its own client with no timeout and
+//! read whole bodies with `.text()`.
+#![cfg(feature = "ssr")]
+
+use std::sync::OnceLock;
+use std::time::Duration;
+
+use openidconnect::reqwest;
+
+/// Whole-request budget: connect, headers, and body.
+pub const TIMEOUT: Duration = Duration::from_secs(20);
+const CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
+
+/// A content-declared URL resource: JSON for one card.
+pub const URL_RESOURCE_CAP: usize = 2 * 1024 * 1024;
+/// A Gitea API reply or one content file (a tree listing, a YAML page).
+pub const GITEA_CAP: usize = 8 * 1024 * 1024;
+/// A content-shipped asset proxied to the browser (an image, a font).
+pub const ASSET_CAP: usize = 32 * 1024 * 1024;
+
+pub fn client() -> &'static reqwest::Client {
+    static CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
+    CLIENT.get_or_init(|| {
+        reqwest::Client::builder()
+            .connect_timeout(CONNECT_TIMEOUT)
+            .timeout(TIMEOUT)
+            .redirect(reqwest::redirect::Policy::limited(5))
+            .user_agent(concat!("portal/", env!("CARGO_PKG_VERSION")))
+            .build()
+            .expect("a client with static options always builds")
+    })
+}
+
+/// Reads a body up to `cap` bytes; one byte more is an error, not a
+/// truncation, so a caller never parses half a document.
+pub async fn bytes(mut response: reqwest::Response, cap: usize) -> anyhow::Result<Vec<u8>> {
+    let hint = response.content_length().unwrap_or(0) as usize;
+    if hint > cap {
+        anyhow::bail!("response of {hint} bytes exceeds the cap of {cap}");
+    }
+    let mut out = Vec::with_capacity(hint.min(cap));
+    while let Some(chunk) = response.chunk().await? {
+        if out.len() + chunk.len() > cap {
+            anyhow::bail!("response exceeds the cap of {cap} bytes");
+        }
+        out.extend_from_slice(&chunk);
+    }
+    Ok(out)
+}
+
+pub async fn text(response: reqwest::Response, cap: usize) -> anyhow::Result<String> {
+    Ok(String::from_utf8(bytes(response, cap).await?)?)
+}
+
+/// `GET url`, status checked, body read under `cap`.
+pub async fn get_text(url: &str, cap: usize) -> anyhow::Result<String> {
+    let response = client().get(url).send().await?.error_for_status()?;
+    text(response, cap).await
+}

src/i18n.rs

@@ -0,0 +1,97 @@
+//! Chrome-string translations, selected by `site.yaml`'s `lang`.
+//!
+//! Content carries its own language; this covers only the strings the
+//! portal itself speaks around it ("Asked by", the nav lead, the
+//! not-found page...). Unknown languages and unknown keys fall back
+//! to English, so a typo degrades to the default instead of a blank.
+
+/// Translate `key` for `lang`. `en` is the reference table; every
+/// other language falls through to it for keys it doesn't carry.
+pub fn t(lang: &str, key: &str) -> &'static str {
+    if let Some(s) = lookup(lang, key) {
+        return s;
+    }
+    lookup("en", key).unwrap_or(key_missing(key))
+}
+
+fn lookup(lang: &str, key: &str) -> Option<&'static str> {
+    Some(match (lang, key) {
+        ("en", "also_worth_asking") => "Also worth asking",
+        ("en", "asked_by") => "Asked by ",
+        ("en", "contact_them") => "contact them",
+        ("en", "if_stuck") => " if you get stuck.",
+        ("en", "send") => "Send",
+        ("en", "sign_in") => "Sign in",
+        ("en", "nothing_here_yet") => "Nothing here yet.",
+        ("en", "nothing_here") => "Nothing here",
+        ("en", "back_to_start") => "back to the start",
+        ("en", "done") => "Done.",
+        ("en", "follows_answer") => {
+            "This page follows from an answer you don't seem to carry yet."
+        }
+        ("en", "owners_only") => {
+            "This part of the site is for organizational owners — sign in with that account to take a look."
+        }
+        ("en", "announcements") => "Announcements",
+
+        ("no", "also_worth_asking") => "Også verdt å spørre",
+        ("no", "asked_by") => "Stilt av ",
+        ("no", "contact_them") => "ta kontakt",
+        ("no", "if_stuck") => " om du står fast.",
+        ("no", "send") => "Send",
+        ("no", "sign_in") => "Logg inn",
+        ("no", "nothing_here_yet") => "Ingenting her ennå.",
+        ("no", "nothing_here") => "Ingenting her",
+        ("no", "back_to_start") => "tilbake til start",
+        ("no", "done") => "Ferdig.",
+        ("no", "follows_answer") => {
+            "Denne siden følger av et svar du ikke ser ut til å bære ennå."
+        }
+        ("no", "owners_only") => {
+            "Denne delen av siden er for organisasjonens eiere — logg inn med den kontoen for å ta en titt."
+        }
+        ("no", "announcements") => "Kunngjøringer",
+
+        _ => return None,
+    })
+}
+
+/// A missing key is a programmer error; render the key itself so it
+/// is findable, never a panic in a view.
+fn key_missing(key: &str) -> &'static str {
+    // Leak is bounded: keys are a small fixed set of literals.
+    Box::leak(key.to_string().into_boxed_str())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn norwegian_covers_the_english_table() {
+        for key in [
+            "also_worth_asking",
+            "asked_by",
+            "contact_them",
+            "if_stuck",
+            "send",
+            "sign_in",
+            "nothing_here_yet",
+            "nothing_here",
+            "back_to_start",
+            "done",
+            "follows_answer",
+            "owners_only",
+            "announcements",
+        ] {
+            assert!(lookup("en", key).is_some(), "en missing {key}");
+            assert!(lookup("no", key).is_some(), "no missing {key}");
+        }
+    }
+
+    #[test]
+    fn unknown_language_falls_back_to_english() {
+        assert_eq!(t("de", "sign_in"), "Sign in");
+        assert_eq!(t("en", "sign_in"), "Sign in");
+    }
+}

src/lib.rs

@@ -4,11 +4,24 @@ pub mod auth;
 pub mod chain;
 pub mod content;
 pub mod events;
+pub mod i18n;
 pub mod resource;
 
 #[cfg(feature = "ssr")]
 pub mod aggregates;
 
+#[cfg(feature = "ssr")]
+pub mod announce;
+
+#[cfg(feature = "ssr")]
+pub mod needs;
+
+#[cfg(feature = "ssr")]
+pub mod local;
+
+#[cfg(feature = "ssr")]
+pub mod http;
+
 #[cfg(feature = "ssr")]
 pub mod server;
 

src/local.rs

@@ -0,0 +1,100 @@
+//! Loading a content repo from a local checkout - the offline
+//! counterparts to the Gitea loaders in `content`, for tools that lint
+//! or replay a branch that has not been pushed (question_lint,
+//! needs_replay). `dir` is always the pages directory (`questions/`);
+//! `site.yaml`, `aggregates.yaml` and `needs.yaml` sit one level up.
+#![cfg(feature = "ssr")]
+
+use crate::{aggregates, content};
+
+/// The offline counterpart to `content::load_site_from_gitea` -
+/// `site.yaml` lives at the repo root like `aggregates.yaml`, and is
+/// just as optional locally: missing means default branding.
+pub fn load_site_from_dir(dir: &str) -> anyhow::Result<content::SiteConfig> {
+    let site_path = std::path::Path::new(dir)
+        .parent()
+        .unwrap_or_else(|| std::path::Path::new("."))
+        .join("site.yaml");
+    if !site_path.exists() {
+        return Ok(content::SiteConfig::default());
+    }
+    let raw = std::fs::read_to_string(&site_path)
+        .map_err(|e| anyhow::anyhow!("reading {}: {e}", site_path.display()))?;
+    serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing {}: {e}", site_path.display()))
+}
+
+/// The offline counterpart to `content::load_aggregates_from_gitea` -
+/// `aggregates.yaml` lives at the repo root, one level up from the
+/// pages directory `--path` names, so `dir`'s parent is where it's
+/// looked for. Missing entirely is not an error here (unlike
+/// `--repo` mode, where `aggregates.yaml` is required) - a local
+/// checkout being linted may not have one, and every declared
+/// transition still gets checked against whatever *is* found; an
+/// empty map just means nothing is checked.
+pub fn load_aggregates_from_dir(
+    dir: &str,
+) -> anyhow::Result<std::collections::HashMap<String, aggregates::AggregateSchema>> {
+    let aggregates_path = std::path::Path::new(dir)
+        .parent()
+        .unwrap_or_else(|| std::path::Path::new("."))
+        .join("aggregates.yaml");
+    if !aggregates_path.exists() {
+        return Ok(std::collections::HashMap::new());
+    }
+    let raw = std::fs::read_to_string(&aggregates_path)
+        .map_err(|e| anyhow::anyhow!("reading {}: {e}", aggregates_path.display()))?;
+    aggregates::parse_aggregates_yaml(&raw)
+}
+
+/// The offline counterpart to `content::load_questions_from_gitea` -
+/// the same recursive tree walk and `content::build_questions`
+/// pipeline (derived ids, relative refs, sections, followup
+/// inference), just reading a local checkout instead of Gitea's API,
+/// for linting a branch that hasn't been pushed yet.
+pub fn load_from_dir(
+    dir: &str,
+) -> anyhow::Result<std::collections::HashMap<String, content::Question>> {
+    let base = std::path::Path::new(dir);
+    let mut files = Vec::new();
+    collect_yaml(base, base, &mut files)?;
+    content::build_questions(&files)
+}
+
+fn collect_yaml(
+    base: &std::path::Path,
+    dir: &std::path::Path,
+    out: &mut Vec<(String, String)>,
+) -> anyhow::Result<()> {
+    for entry in std::fs::read_dir(dir)? {
+        let path = entry?.path();
+        if path.is_dir() {
+            collect_yaml(base, &path, out)?;
+        } else if path.extension().and_then(|e| e.to_str()) == Some("yaml") {
+            let rel = path
+                .strip_prefix(base)
+                .expect("walked paths sit under their base")
+                .to_string_lossy()
+                .replace('\\', "/");
+            let raw = std::fs::read_to_string(&path)
+                .map_err(|e| anyhow::anyhow!("reading {}: {e}", path.display()))?;
+            out.push((rel, raw));
+        }
+    }
+    Ok(())
+}
+
+/// The offline counterpart to `content::load_needs_from_gitea` -
+/// `needs.yaml` sits at the repo root beside `aggregates.yaml`.
+pub fn load_needs_from_dir(dir: &str) -> anyhow::Result<Option<String>> {
+    let needs_path = std::path::Path::new(dir)
+        .parent()
+        .unwrap_or_else(|| std::path::Path::new("."))
+        .join("needs.yaml");
+    if !needs_path.exists() {
+        return Ok(None);
+    }
+    std::fs::read_to_string(&needs_path)
+        .map(Some)
+        .map_err(|e| anyhow::anyhow!("reading {}: {e}", needs_path.display()))
+}
+

src/main.rs

@@ -29,7 +29,10 @@ async fn main() -> anyhow::Result<()> {
         .unwrap_or_else(|_| "https://project.uhhm.no/uhhm/questions".to_string());
     let content_branch = std::env::var("CONTENT_BRANCH").unwrap_or_else(|_| "main".to_string());
     let gitea_base = content::gitea_api_base(&content_repo)?;
-    let aggregates = content::load_aggregates_from_gitea(&content_repo, &content_branch).await?;
+    let content_raw_base = content::gitea_raw_base(&content_repo)?;
+    let aggregates = content::with_builtin_aggregates(
+        content::load_aggregates_from_gitea(&content_repo, &content_branch).await?,
+    );
     let questions = content::load_questions_from_gitea(&content_repo, &content_branch, "questions").await?;
     content::validate_questions(&questions, &aggregates)?;
     let site = content::load_site_from_gitea(&content_repo, &content_branch).await?;
@@ -67,7 +70,7 @@ async fn main() -> anyhow::Result<()> {
     tokio::spawn(content::watch_for_reload(
         nats.clone(),
         content_repo,
-        content_branch,
+        content_branch.clone(),
         "questions".to_string(),
         questions.clone(),
         aggregates.clone(),
@@ -82,10 +85,16 @@ async fn main() -> anyhow::Result<()> {
         aggregates,
         site,
         gitea_base,
+        content_raw_base,
+        content_branch: content_branch.clone(),
         oidc: oidc_state,
         garage,
     };
 
+    // Announced pages: keep their desk records current, close ended
+    // windows (see announce.rs).
+    tokio::spawn(portal::announce::run(state.clone()));
+
     // Dev-friendly defaults: in-memory sessions, secure cookies only when
     // COOKIE_SECURE=true (set it behind TLS in production) - same
     // defaults cnats uses. SameSite=Lax (tower-sessions defaults to
@@ -129,10 +138,6 @@ async fn main() -> anyhow::Result<()> {
     let favicon_dark_path = format!("{}/favicon-dark.svg", leptos_options.site_root);
     let wordmark_path = format!("{}/wordmark.svg", leptos_options.site_root);
     let swiper_path = format!("{}/swiper-element-bundle.min.js", leptos_options.site_root);
-    // yes.js sits in public/ (not a wasm-bindgen snippet) so the
-    // hero's inline early-mount script and the wasm binding can share
-    // one stable URL - see `mod yes` in app.rs.
-    let yes_path = format!("{}/yes.js", leptos_options.site_root);
     let fonts_dir = format!("{}/fonts", leptos_options.site_root);
 
     let app = Router::new()
@@ -140,8 +145,16 @@ async fn main() -> anyhow::Result<()> {
         .route("/auth/callback", get(oidc::callback))
         .route("/auth/logout", get(oidc::logout))
         .route("/api/{*fn_name}", any(server_fn_handler))
-        .route("/upload", post(upload::upload))
+        // axum caps request bodies at 2 MB by default, which had made the
+        // 20 MB upload limit unreachable; raise the fence on this route only,
+        // with room for the multipart framing.
+        .route(
+            "/upload",
+            post(upload::upload).layer(axum::extract::DefaultBodyLimit::max(upload::MAX_UPLOAD_BYTES + 64 * 1024)),
+        )
         .route("/gitea-repo", get(content::gitea_repo_handler))
+        // Content-shipped assets (hero module etc.), same-origin.
+        .route("/site/{*path}", get(content::site_asset_handler))
         .route("/automation/kv/{bucket}", get(content::automation_kv_handler))
         // no-cache = "revalidate before reuse", not "don't cache":
         // pkg files keep the same names across releases (portal.js,
@@ -167,17 +180,6 @@ async fn main() -> anyhow::Result<()> {
             "/swiper-element-bundle.min.js",
             ServeFile::new(swiper_path),
         )
-        // Same skew concern as /pkg: the wasm's raw_module import and
-        // the hero's inline script both load this by fixed name.
-        .route_service(
-            "/yes.js",
-            tower::ServiceBuilder::new()
-                .layer(tower_http::set_header::SetResponseHeaderLayer::overriding(
-                    axum::http::header::CACHE_CONTROL,
-                    axum::http::HeaderValue::from_static("no-cache"),
-                ))
-                .service(ServeFile::new(yes_path)),
-        )
         .leptos_routes_with_context(
             &state,
             routes,

src/needs.rs

@@ -0,0 +1,969 @@
+//! A business's needs, stated apart from how its pages word them.
+//!
+//! A content repo may ship a `needs.yaml` at its root: each *need* says
+//! who wants what, where they enter, which bucket the answer must land
+//! in, and which group has to be able to carry it to a finished state.
+//! Two things are checked against it:
+//!
+//! - **Structure** (`check`): deterministic. A path of submissions
+//!   leads from the entry page to the bucket, within an effort budget;
+//!   the handling group has a desk over that bucket; every finished
+//!   state is reachable through the moves that desk offers, and no
+//!   record strands on the way.
+//! - **Wording** (`tasks` / `score`): each *persona* is a visitor in
+//!   their own words. Every page on their path becomes one typed
+//!   `choice` question for an external answering engine - the page's
+//!   question, its alternatives as the options - and the engine's picks
+//!   are scored against the alternatives that actually meet the need.
+//!   A misroute is a wording defect: the page said one thing and the
+//!   visitor heard another.
+//!
+//! The engine is deliberately outside this crate: tasks go out as
+//! JSONL, answers come back as JSONL, so any classifier or LLM can sit
+//! in between and be compared on the same tasks.
+#![cfg(feature = "ssr")]
+
+use std::collections::{BTreeMap, HashMap, HashSet, VecDeque};
+
+use serde::{Deserialize, Serialize};
+
+use crate::aggregates::AggregateSchema;
+use crate::content::{action_target_id, Alternative, Question};
+
+#[derive(Debug, Default, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct NeedsFile {
+    #[serde(default)]
+    pub needs: Vec<Need>,
+    #[serde(default)]
+    pub personas: Vec<Persona>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Need {
+    pub id: String,
+    /// The kind of visitor - prose, for the reader of the report.
+    pub who: String,
+    pub wants: String,
+    /// The page they arrive on.
+    #[serde(default = "root")]
+    pub enters: String,
+    /// The group they hold when they arrive; unset means anonymous.
+    #[serde(default)]
+    pub enters_as: Option<String>,
+    /// The alternative on the entry page that serves this need, when
+    /// several record into the same bucket.
+    #[serde(default)]
+    pub via: Option<String>,
+    /// The bucket their answer must be recorded into.
+    pub lands_in: String,
+    /// The group that must be able to see the record and move it.
+    pub handled_by: String,
+    /// The states that count as handled.
+    pub done_when: Vec<String>,
+    /// Submissions the visitor may be asked for before the record
+    /// exists.
+    #[serde(default = "default_max_steps")]
+    pub max_steps: usize,
+    /// Required fields across the whole path - the onboarding effort
+    /// budget.
+    #[serde(default)]
+    pub max_fields: Option<usize>,
+    /// Declared, and knowingly not open yet: what is missing reports
+    /// as a warning, so the gap stays visible without failing CI.
+    #[serde(default)]
+    pub planned: bool,
+    /// The finished states that are a good outcome for the business -
+    /// a subset of `done_when`. "lost" is finished; "won" is success.
+    /// What a simulation or a live bucket report counts toward.
+    #[serde(default)]
+    pub success: Vec<String>,
+    /// Every stage the business said a case goes through, in its own
+    /// order, first to last. Written from how the business describes
+    /// its work, before any state machine exists, so that a machine
+    /// which quietly skips a stage ("we go and look, then we quote"
+    /// becoming open -> quoted) fails instead of passing.
+    #[serde(default)]
+    pub stages: Vec<String>,
+    /// Other groups whose desks carry some of this need's moves: a
+    /// site manager closing what a project manager opened. Their
+    /// buttons count toward reaching `done_when` exactly as
+    /// `handled_by`'s do. `handled_by` must still hold a desk of its
+    /// own - someone has to be answerable for the record.
+    #[serde(default)]
+    pub also_moved_by: Vec<String>,
+}
+
+fn root() -> String {
+    "/".to_string()
+}
+
+fn default_max_steps() -> usize {
+    2
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Persona {
+    pub id: String,
+    pub need: String,
+    /// The visitor's situation in their own words - never the page's.
+    pub text: String,
+}
+
+pub fn parse(raw: &str) -> anyhow::Result<NeedsFile> {
+    serde_yaml::from_str(raw).map_err(|e| anyhow::anyhow!("parsing needs.yaml: {e}"))
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Level {
+    Fail,
+    Warn,
+}
+
+#[derive(Debug)]
+pub struct Finding {
+    pub need: String,
+    pub level: Level,
+    pub message: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Step {
+    pub page: String,
+    pub alternative: String,
+}
+
+/// One alternative on a page that still meets the need, with the
+/// cheapest way on from it.
+struct Viable {
+    alternative: String,
+    path: Vec<Step>,
+    fields: usize,
+    records_with_action: Option<bool>,
+}
+
+type Questions = HashMap<String, Question>;
+
+fn visible(q: &Question, as_group: Option<&str>) -> bool {
+    match &q.qualifies {
+        None => true,
+        Some(group) => as_group == Some(group.as_str()),
+    }
+}
+
+fn required_fields(alt: &Alternative) -> usize {
+    alt.features
+        .iter()
+        .flat_map(|f| &f.requirements)
+        .filter(|r| !r.optional)
+        .count()
+}
+
+/// The alternatives on `page` from which the need is still met within
+/// `remaining` submissions.
+fn viable(
+    questions: &Questions,
+    need: &Need,
+    page: &Question,
+    remaining: usize,
+    entry: bool,
+    include_disabled: bool,
+    trail: &mut Vec<String>,
+) -> Vec<Viable> {
+    let mut out = Vec::new();
+    if remaining == 0 {
+        return out;
+    }
+    for alt in page.alternatives.iter().filter(|a| include_disabled || !a.disabled) {
+        if entry && need.via.as_deref().is_some_and(|via| via != alt.name) {
+            continue;
+        }
+        let step = Step {
+            page: page.id.clone(),
+            alternative: alt.name.clone(),
+        };
+        let fields = required_fields(alt);
+        if alt.record_as.as_deref() == Some(need.lands_in.as_str()) {
+            out.push(Viable {
+                alternative: alt.name.clone(),
+                path: vec![step],
+                fields,
+                records_with_action: Some(alt.action.is_some()),
+            });
+            continue;
+        }
+        let Some(target) = alt
+            .action
+            .as_deref()
+            .and_then(|a| action_target_id(questions, a))
+            .and_then(|id| questions.get(&id))
+        else {
+            continue;
+        };
+        if trail.contains(&target.id) || !visible(target, need.enters_as.as_deref()) {
+            continue;
+        }
+        trail.push(target.id.clone());
+        let onward = viable(questions, need, target, remaining - 1, false, include_disabled, trail);
+        trail.pop();
+        if let Some(best) = onward.into_iter().min_by_key(|v| (v.path.len(), v.fields)) {
+            let mut path = vec![step];
+            path.extend(best.path);
+            out.push(Viable {
+                alternative: alt.name.clone(),
+                path,
+                fields: fields + best.fields,
+                records_with_action: best.records_with_action,
+            });
+        }
+    }
+    out
+}
+
+fn entry_viable(questions: &Questions, need: &Need, include_disabled: bool) -> Option<Vec<Viable>> {
+    let page = questions.get(&need.enters)?;
+    let mut trail = vec![page.id.clone()];
+    Some(viable(questions, need, page, need.max_steps, true, include_disabled, &mut trail))
+}
+
+/// The cheapest path that meets the need, if any.
+pub fn path_for(questions: &Questions, need: &Need) -> Option<Vec<Step>> {
+    entry_viable(questions, need, false)?
+        .into_iter()
+        .min_by_key(|v| (v.path.len(), v.fields))
+        .map(|v| v.path)
+}
+
+struct Desk {
+    page: String,
+    group: Option<String>,
+    /// (from, to, button label)
+    moves: Vec<(String, String, String)>,
+}
+
+fn desks_over(questions: &Questions, bucket: &str) -> Vec<Desk> {
+    let mut desks = Vec::new();
+    for q in questions.values() {
+        for resource in q
+            .alternatives
+            .iter()
+            .flat_map(|a| &a.features)
+            .filter_map(|f| f.resource.as_ref())
+            .filter(|r| r.bucket() == Some(bucket))
+        {
+            desks.push(Desk {
+                page: q.id.clone(),
+                group: resource.requires_group.clone().or_else(|| q.qualifies.clone()),
+                moves: resource
+                    .transitions
+                    .iter()
+                    .map(|t| (t.from.clone(), t.to.clone(), t.label.clone()))
+                    .collect(),
+            });
+        }
+    }
+    desks.sort_by(|a, b| a.page.cmp(&b.page));
+    desks
+}
+
+/// Self-service moves into `bucket` - a visitor holding their own
+/// record's link, no group involved (unsubscribe).
+fn self_moves(questions: &Questions, bucket: &str) -> Vec<String> {
+    questions
+        .values()
+        .flat_map(|q| &q.alternatives)
+        .filter_map(|a| a.self_transition.as_ref())
+        .filter(|s| s.bucket == bucket)
+        .map(|s| s.to.clone())
+        .collect()
+}
+
+/// Structural check of every need. `Fail` findings mean the business
+/// need is not met by the content as written.
+pub fn check(
+    file: &NeedsFile,
+    questions: &Questions,
+    aggregates: &HashMap<String, AggregateSchema>,
+) -> Vec<Finding> {
+    let mut findings = Vec::new();
+    let mut seen = HashSet::new();
+    for need in &file.needs {
+        let mut report = |level: Level, message: String| {
+            findings.push(Finding {
+                need: need.id.clone(),
+                level: if need.planned { Level::Warn } else { level },
+                message: if need.planned && level == Level::Fail {
+                    format!("planned, not met yet: {message}")
+                } else {
+                    message
+                },
+            })
+        };
+        if !seen.insert(need.id.as_str()) {
+            report(Level::Fail, "declared more than once".to_string());
+            continue;
+        }
+
+        // The visitor's side: can they get their answer recorded?
+        match questions.get(&need.enters) {
+            None => report(Level::Fail, format!("entry page {:?} does not exist", need.enters)),
+            Some(page) if !visible(page, need.enters_as.as_deref()) => report(
+                Level::Fail,
+                format!(
+                    "entry page {:?} is gated on {:?}, which this visitor does not hold",
+                    need.enters, page.qualifies
+                ),
+            ),
+            Some(page) => {
+                if page.responsible.is_none() {
+                    report(
+                        Level::Warn,
+                        format!("entry page {:?} names no one responsible to turn to", need.enters),
+                    );
+                }
+                let best = entry_viable(questions, need, false)
+                    .unwrap_or_default()
+                    .into_iter()
+                    .min_by_key(|v| (v.path.len(), v.fields));
+                match best {
+                    None if entry_viable(questions, need, true).is_some_and(|v| !v.is_empty()) => {
+                        let blocked = entry_viable(questions, need, true)
+                            .unwrap_or_default()
+                            .into_iter()
+                            .min_by_key(|v| (v.path.len(), v.fields))
+                            .map(|v| v.path)
+                            .unwrap_or_default();
+                        let at = blocked
+                            .iter()
+                            .find(|s| {
+                                questions[&s.page]
+                                    .alternatives
+                                    .iter()
+                                    .any(|a| a.name == s.alternative && a.disabled)
+                            })
+                            .map(|s| format!("{:?} on {}", s.alternative, s.page))
+                            .unwrap_or_default();
+                        report(
+                            Level::Fail,
+                            format!(
+                                "the path exists but is closed: {at} is `disabled`, so the answer is advertised and refused"
+                            ),
+                        )
+                    }
+                    None => report(
+                        Level::Fail,
+                        format!(
+                            "no path from {:?}{} records into {:?} within {} submission(s)",
+                            need.enters,
+                            need.via
+                                .as_ref()
+                                .map(|v| format!(" via {v:?}"))
+                                .unwrap_or_default(),
+                            need.lands_in,
+                            need.max_steps
+                        ),
+                    ),
+                    Some(best) => {
+                        if let Some(budget) = need.max_fields {
+                            if best.fields > budget {
+                                report(
+                                    Level::Fail,
+                                    format!(
+                                        "the path asks for {} required field(s), over the budget of {budget}",
+                                        best.fields
+                                    ),
+                                );
+                            }
+                        }
+                        if best.records_with_action == Some(false) {
+                            report(
+                                Level::Warn,
+                                "the recording alternative has no `action` - the visitor is never told what happens next".to_string(),
+                            );
+                        }
+                    }
+                }
+            }
+        }
+
+        // The business's side: can the handling group finish it?
+        let Some(schema) = aggregates.get(&need.lands_in) else {
+            report(
+                Level::Fail,
+                format!("aggregates.yaml declares no state machine for {:?}", need.lands_in),
+            );
+            continue;
+        };
+        let desks = desks_over(questions, &need.lands_in);
+        let own: Vec<&Desk> = desks
+            .iter()
+            .filter(|d| {
+                d.group.as_deref().is_some_and(|g| g == need.handled_by || need.also_moved_by.iter().any(|m| m == g))
+            })
+            .collect();
+        if !desks.iter().any(|d| d.group.as_deref() == Some(need.handled_by.as_str())) {
+            let others: Vec<String> = desks
+                .iter()
+                .map(|d| format!("{} ({})", d.page, d.group.as_deref().unwrap_or("ungated")))
+                .collect();
+            report(
+                Level::Fail,
+                format!(
+                    "no desk gated on {:?} reads {:?}{}",
+                    need.handled_by,
+                    need.lands_in,
+                    if others.is_empty() {
+                        String::new()
+                    } else {
+                        format!(" - it is read by {}", others.join(", "))
+                    }
+                ),
+            );
+            continue;
+        }
+        let selfs = self_moves(questions, &need.lands_in);
+        let exits = |state: &str| -> Vec<String> {
+            let allowed = schema.allowed(state);
+            let mut to: Vec<String> = own
+                .iter()
+                .flat_map(|d| &d.moves)
+                .filter(|(from, to, _)| from == state && allowed.contains(to))
+                .map(|(_, to, _)| to.clone())
+                .collect();
+            to.extend(selfs.iter().filter(|to| allowed.contains(to)).cloned());
+            to
+        };
+        let done: HashSet<&str> = need.done_when.iter().map(String::as_str).collect();
+        // Reachability walks the whole machine (a finished state may
+        // lead on to another: subscribed, then unsubscribed). Stranding
+        // only counts on the way to the first finished state - what
+        // happens to a handled record afterwards is not this need.
+        let mut reached: HashSet<String> = HashSet::from([schema.initial.clone()]);
+        let mut queue = VecDeque::from([(schema.initial.clone(), false)]);
+        let mut stranded = Vec::new();
+        while let Some((state, past_done)) = queue.pop_front() {
+            let past_done = past_done || done.contains(state.as_str());
+            let next = exits(&state);
+            if next.is_empty() && !past_done {
+                stranded.push(state.clone());
+            }
+            for to in next {
+                if reached.insert(to.clone()) {
+                    queue.push_back((to, past_done));
+                }
+            }
+        }
+        for state in &need.done_when {
+            if !schema.has_state(state) {
+                report(
+                    Level::Fail,
+                    format!("done_when names {state:?}, which {:?} has no such state", need.lands_in),
+                );
+            } else if !reached.contains(state) {
+                report(
+                    Level::Fail,
+                    format!(
+                        "{:?} cannot move a record to {state:?} - no desk of theirs offers the moves",
+                        need.handled_by
+                    ),
+                );
+            }
+        }
+        for stage in &need.stages {
+            if !schema.has_state(stage) {
+                report(
+                    Level::Fail,
+                    format!(
+                        "the business describes a stage {stage:?} that {:?} has no state for",
+                        need.lands_in
+                    ),
+                );
+            } else if !reached.contains(stage) {
+                report(
+                    Level::Fail,
+                    format!(
+                        "stage {stage:?} exists but {:?} is offered no moves that reach it",
+                        need.handled_by
+                    ),
+                );
+            }
+        }
+        for state in &need.success {
+            if !need.done_when.contains(state) {
+                report(
+                    Level::Fail,
+                    format!("success names {state:?}, which is not one of done_when"),
+                );
+            }
+        }
+        stranded.sort();
+        for state in stranded {
+            report(
+                Level::Fail,
+                format!(
+                    "records strand in {state:?}: {:?} is offered no move out of it",
+                    need.handled_by
+                ),
+            );
+        }
+    }
+
+    let need_ids: HashSet<&str> = file.needs.iter().map(|n| n.id.as_str()).collect();
+    for persona in &file.personas {
+        if !need_ids.contains(persona.need.as_str()) {
+            findings.push(Finding {
+                need: persona.need.clone(),
+                level: Level::Fail,
+                message: format!("persona {:?} points at a need that is not declared", persona.id),
+            });
+        }
+    }
+    findings
+}
+
+/// Everything a simulation of the business needs, resolved: each
+/// need's path with the choice on every page and the form that gets
+/// filled, each bucket's state machine with the buttons every desk
+/// offers, and the personas. Portal resolves it because only portal
+/// loads content the way the runtime does (derived ids, relative
+/// refs, sections); whoever simulates reads plain JSON.
+pub fn sim_model(
+    file: &NeedsFile,
+    questions: &Questions,
+    aggregates: &HashMap<String, AggregateSchema>,
+) -> serde_json::Value {
+    use serde_json::json;
+    let mut needs = Vec::new();
+    let mut buckets = serde_json::Map::new();
+    for need in &file.needs {
+        let Some(path) = path_for(questions, need) else {
+            continue;
+        };
+        let steps: Vec<serde_json::Value> = path
+            .iter()
+            .enumerate()
+            .map(|(i, step)| {
+                let page = &questions[&step.page];
+                let mut trail: Vec<String> = path[..=i].iter().map(|s| s.page.clone()).collect();
+                let expect: Vec<String> =
+                    viable(questions, need, page, need.max_steps - i, i == 0, false, &mut trail)
+                        .into_iter()
+                        .map(|v| v.alternative)
+                        .collect();
+                let fields: Vec<serde_json::Value> = page
+                    .alternatives
+                    .iter()
+                    .find(|a| a.name == step.alternative)
+                    .into_iter()
+                    .flat_map(|a| &a.features)
+                    .flat_map(|f| &f.requirements)
+                    .map(|r| {
+                        json!({
+                            "name": r.name,
+                            "label": r.label.clone().unwrap_or_else(|| r.name.clone()),
+                            "type": r.kind,
+                            "optional": r.optional,
+                            "options": r.options,
+                        })
+                    })
+                    .collect();
+                json!({
+                    "page": step.page,
+                    "question": page.name,
+                    "options": page.alternatives.iter().filter(|a| !a.disabled).map(|a| json!({
+                        "name": a.name,
+                        "description": plain(&a.description),
+                    })).collect::<Vec<_>>(),
+                    "expect": expect,
+                    "alternative": step.alternative,
+                    "fields": fields,
+                })
+            })
+            .collect();
+        needs.push(json!({
+            "id": need.id,
+            "who": need.who,
+            "wants": need.wants,
+            "enters_as": need.enters_as,
+            "lands_in": need.lands_in,
+            "handled_by": need.handled_by,
+            "done_when": need.done_when,
+            "success": need.success,
+            "steps": steps,
+        }));
+        if let Some(schema) = aggregates.get(&need.lands_in) {
+            buckets.entry(need.lands_in.clone()).or_insert_with(|| {
+                json!({
+                    "initial": schema.initial,
+                    "transitions": schema.transitions,
+                    "desks": desks_over(questions, &need.lands_in).iter().map(|d| json!({
+                        "page": d.page,
+                        "group": d.group,
+                        "moves": d.moves.iter().map(|(from, to, label)| json!({
+                            "from": from, "to": to, "label": label,
+                        })).collect::<Vec<_>>(),
+                    })).collect::<Vec<_>>(),
+                    "self_moves": self_moves(questions, &need.lands_in),
+                })
+            });
+        }
+    }
+    json!({
+        "needs": needs,
+        "buckets": buckets,
+        "personas": file.personas.iter().map(|p| json!({
+            "id": p.id, "need": p.need, "text": plain(&p.text),
+        })).collect::<Vec<_>>(),
+    })
+}
+
+/// One decision for the answering engine - the shape is laya's
+/// `predict(state, questions)` input, so an adapter is a loop and
+/// nothing more; any other engine reads the same fields.
+#[derive(Debug, Serialize)]
+pub struct Task {
+    pub id: String,
+    pub persona: String,
+    pub need: String,
+    pub page: String,
+    pub state: BTreeMap<&'static str, String>,
+    pub questions: BTreeMap<&'static str, ChoiceQuestion>,
+    /// Every alternative that still meets the need from here. The
+    /// engine never sees this.
+    pub expect: Vec<String>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct ChoiceQuestion {
+    #[serde(rename = "type")]
+    pub kind: &'static str,
+    pub instructions: String,
+    pub criteria: BTreeMap<String, String>,
+}
+
+fn plain(text: &str) -> String {
+    text.split_whitespace().collect::<Vec<_>>().join(" ")
+}
+
+/// Every (persona, page-on-their-path) pair with a real choice on it.
+/// `skim` shows the engine only each alternative's heading - what a
+/// visitor who never reads the description has to go on.
+pub fn tasks(file: &NeedsFile, questions: &Questions, skim: bool) -> Vec<Task> {
+    let mut out = Vec::new();
+    for persona in &file.personas {
+        let Some(need) = file.needs.iter().find(|n| n.id == persona.need) else {
+            continue;
+        };
+        let Some(path) = path_for(questions, need) else {
+            continue;
+        };
+        for (i, step) in path.iter().enumerate() {
+            let page = &questions[&step.page];
+            let open: Vec<&Alternative> = page.alternatives.iter().filter(|a| !a.disabled).collect();
+            if open.len() < 2 {
+                continue;
+            }
+            let mut trail: Vec<String> = path[..=i].iter().map(|s| s.page.clone()).collect();
+            let expect: Vec<String> = viable(questions, need, page, need.max_steps - i, i == 0, false, &mut trail)
+                .into_iter()
+                .map(|v| v.alternative)
+                .collect();
+            let criteria = open
+                .iter()
+                .map(|a| {
+                    let description = plain(&a.description);
+                    (
+                        a.name.clone(),
+                        if skim || description.is_empty() { a.name.clone() } else { description },
+                    )
+                })
+                .collect();
+            out.push(Task {
+                id: format!("{}@{}", persona.id, step.page),
+                persona: persona.id.clone(),
+                need: need.id.clone(),
+                page: step.page.clone(),
+                state: BTreeMap::from([("body", plain(&persona.text))]),
+                questions: BTreeMap::from([(
+                    "pick",
+                    ChoiceQuestion {
+                        kind: "choice",
+                        instructions: format!(
+                            "A visitor reads the page question {:?}. Which alternative do they choose?",
+                            page.name
+                        ),
+                        criteria,
+                    },
+                )]),
+                expect,
+            });
+        }
+    }
+    out
+}
+
+#[derive(Debug, Deserialize)]
+pub struct Answer {
+    pub id: String,
+    pub choice: String,
+    #[serde(default)]
+    pub confidence: Option<f64>,
+}
+
+#[derive(Debug, Default)]
+pub struct Score {
+    pub total: usize,
+    pub correct: usize,
+    /// (task id, picked, expected, confidence)
+    pub misroutes: Vec<(String, String, Vec<String>, Option<f64>)>,
+    /// Right, but the engine was under `hesitant_below` - wording that
+    /// works and is still close to a coin flip.
+    pub hesitant: Vec<(String, f64)>,
+    pub unanswered: Vec<String>,
+}
+
+impl Score {
+    pub fn accuracy(&self) -> f64 {
+        if self.total == 0 {
+            1.0
+        } else {
+            self.correct as f64 / self.total as f64
+        }
+    }
+}
+
+pub fn score(tasks: &[Task], answers: &[Answer], hesitant_below: f64) -> Score {
+    let by_id: HashMap<&str, &Answer> = answers.iter().map(|a| (a.id.as_str(), a)).collect();
+    let mut score = Score {
+        total: tasks.len(),
+        ..Score::default()
+    };
+    for task in tasks {
+        match by_id.get(task.id.as_str()) {
+            None => score.unanswered.push(task.id.clone()),
+            Some(answer) if task.expect.contains(&answer.choice) => {
+                score.correct += 1;
+                if let Some(c) = answer.confidence.filter(|c| *c < hesitant_below) {
+                    score.hesitant.push((task.id.clone(), c));
+                }
+            }
+            Some(answer) => score.misroutes.push((
+                task.id.clone(),
+                answer.choice.clone(),
+                task.expect.clone(),
+                answer.confidence,
+            )),
+        }
+    }
+    score
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::aggregates::parse_aggregates_yaml;
+    use crate::content::build_questions;
+
+    fn site(desk_moves: &str) -> (Questions, HashMap<String, AggregateSchema>) {
+        let files = vec![
+            (
+                "index.yaml".to_string(),
+                "name: What are you here for?\nresponsible: { name: A, contact: a@b.c }\nalternatives:\n  - name: Hire us\n    description: Bring a problem.\n    action: /thanks\n    record_as: projects\n    features:\n      - name: Brief\n        requirements:\n          - name: email\n            type: email\n          - name: brief\n            type: textarea\n          - name: budget\n            optional: true\n  - name: Follow along\n    description: Notes by mail.\n    action: /thanks\n    record_as: subscribers\n".to_string(),
+            ),
+            ("thanks.yaml".to_string(), "name: Thanks\nfollowup: true\n".to_string()),
+            (
+                "desk/index.yaml".to_string(),
+                format!("name: Desk\nqualifies: owners\nalternatives:\n  - name: Projects\n    features:\n      - name: \"\"\n        resource:\n          source: {{ kind: kv, bucket: projects }}\n          requires_group: owners\n          transitions:\n{desk_moves}"),
+            ),
+        ];
+        let aggregates = parse_aggregates_yaml(
+            "aggregates:\n  - bucket: projects\n    initial: open\n    states:\n      open: { event: submitted }\n      quoted: { event: quoted }\n      won: { event: won }\n      lost: { event: lost }\n    transitions:\n      open: [quoted, lost]\n      quoted: [won, lost]\n  - bucket: subscribers\n    attended_by: a mailer\n    initial: open\n    states:\n      open: { event: subscribed }\n    transitions: {}\n",
+        )
+        .unwrap();
+        (build_questions(&files).unwrap(), aggregates)
+    }
+
+    const FULL_DESK: &str = "            - { to: quoted, label: Quote }\n            - { to: lost, label: Lose }\n            - { from: quoted, to: won, label: Win }\n            - { from: quoted, to: lost, label: Lose }\n";
+
+    fn needs(extra: &str) -> NeedsFile {
+        parse(&format!(
+            "needs:\n  - id: hire\n    who: a client\n    wants: work done\n    lands_in: projects\n    handled_by: owners\n    done_when: [won, lost]\n{extra}personas:\n  - id: founder\n    need: hire\n    text: I need someone to build our booking tool.\n"
+        ))
+        .unwrap()
+    }
+
+    fn fails(findings: &[Finding]) -> Vec<&str> {
+        findings
+            .iter()
+            .filter(|f| f.level == Level::Fail)
+            .map(|f| f.message.as_str())
+            .collect()
+    }
+
+    #[test]
+    fn a_met_need_is_silent() {
+        let (questions, aggregates) = site(FULL_DESK);
+        let findings = check(&needs("    max_fields: 2\n"), &questions, &aggregates);
+        assert!(findings.is_empty(), "{findings:?}");
+    }
+
+    #[test]
+    fn effort_budget_counts_required_fields_only() {
+        let (questions, aggregates) = site(FULL_DESK);
+        let findings = check(&needs("    max_fields: 1\n"), &questions, &aggregates);
+        assert_eq!(fails(&findings), vec!["the path asks for 2 required field(s), over the budget of 1"]);
+    }
+
+    #[test]
+    fn a_desk_missing_a_move_strands_records_and_cannot_finish() {
+        // The desk can quote, but never close a quoted job.
+        let (questions, aggregates) = site("            - { to: quoted, label: Quote }\n            - { to: lost, label: Lose }\n");
+        let findings = check(&needs(""), &questions, &aggregates);
+        assert_eq!(
+            fails(&findings),
+            vec![
+                "\"owners\" cannot move a record to \"won\" - no desk of theirs offers the moves",
+                "records strand in \"quoted\": \"owners\" is offered no move out of it",
+            ]
+        );
+    }
+
+    #[test]
+    fn a_finished_state_may_lead_on_to_another() {
+        // quoted counts as handled here, yet won must still be
+        // reachable past it; lost-after-quoted is not this need's
+        // business, so nothing strands.
+        let (questions, aggregates) = site(FULL_DESK);
+        let mut file = needs("");
+        file.needs[0].done_when = vec!["quoted".to_string(), "won".to_string(), "lost".to_string()];
+        let findings = check(&file, &questions, &aggregates);
+        assert!(findings.is_empty(), "{findings:?}");
+    }
+
+    #[test]
+    fn a_disabled_alternative_is_named_as_the_reason() {
+        let (mut questions, aggregates) = site(FULL_DESK);
+        questions.get_mut("/").unwrap().alternatives[0].disabled = true;
+        let findings = check(&needs(""), &questions, &aggregates);
+        assert_eq!(
+            fails(&findings),
+            vec!["the path exists but is closed: \"Hire us\" on / is `disabled`, so the answer is advertised and refused"]
+        );
+    }
+
+    #[test]
+    fn success_must_be_a_finished_state_and_the_sim_model_carries_the_whole_flow() {
+        let (questions, aggregates) = site(FULL_DESK);
+        let mut file = needs("    success: [won]\n");
+        assert!(check(&file, &questions, &aggregates).is_empty());
+
+        let model = sim_model(&file, &questions, &aggregates);
+        let need = &model["needs"][0];
+        assert_eq!(need["success"][0], "won");
+        let step = &need["steps"][0];
+        assert_eq!(step["question"], "What are you here for?");
+        assert_eq!(step["expect"][0], "Hire us");
+        assert_eq!(step["options"].as_array().unwrap().len(), 2);
+        // The form the visitor fills, required and optional alike.
+        let fields = step["fields"].as_array().unwrap();
+        assert_eq!(fields.len(), 3);
+        assert_eq!(fields[2]["optional"], true);
+        // The desk's buttons, labelled, per state.
+        let moves = model["buckets"]["projects"]["desks"][0]["moves"].as_array().unwrap();
+        assert!(moves.iter().any(|m| m["from"] == "quoted" && m["to"] == "won" && m["label"] == "Win"));
+        assert_eq!(model["buckets"]["projects"]["initial"], "open");
+        assert_eq!(model["personas"][0]["id"], "founder");
+
+        // A stage the business named must exist as a state.
+        file.needs[0].stages = vec!["open".into(), "surveyed".into(), "quoted".into()];
+        assert_eq!(
+            fails(&check(&file, &questions, &aggregates)),
+            vec!["the business describes a stage \"surveyed\" that \"projects\" has no state for"]
+        );
+        file.needs[0].stages = vec!["open".into(), "quoted".into(), "won".into()];
+        assert!(check(&file, &questions, &aggregates).is_empty());
+
+        file.needs[0].success = vec!["quoted".to_string()];
+        assert_eq!(
+            fails(&check(&file, &questions, &aggregates)),
+            vec!["success names \"quoted\", which is not one of done_when"]
+        );
+    }
+
+    #[test]
+    fn a_need_can_be_carried_by_more_than_one_groups_desk() {
+        // owners may only quote or lose; closing a quoted job is the
+        // site managers' button, on a desk of their own.
+        let (mut questions, aggregates) = site("            - { to: quoted, label: Quote }\n            - { to: lost, label: Lose }\n");
+        let more = build_questions(&[(
+            "site/index.yaml".to_string(),
+            "name: Site desk\nqualifies: site_managers\nalternatives:\n  - name: Projects\n    features:\n      - name: \"\"\n        resource:\n          source: { kind: kv, bucket: projects }\n          requires_group: site_managers\n          transitions:\n            - { from: quoted, to: won, label: Win }\n            - { from: quoted, to: lost, label: Lose }\n".to_string(),
+        )])
+        .unwrap();
+        questions.extend(more);
+
+        let mut file = needs("");
+        // Alone, owners cannot finish it...
+        assert_eq!(fails(&check(&file, &questions, &aggregates)).len(), 2);
+        // ...with the site managers' buttons counted, they can.
+        file.needs[0].also_moved_by = vec!["site_managers".to_string()];
+        assert!(check(&file, &questions, &aggregates).is_empty());
+        // But someone has to be answerable: handled_by needs its own desk.
+        file.needs[0].handled_by = "nobody".to_string();
+        assert!(fails(&check(&file, &questions, &aggregates))[0].starts_with("no desk gated on \"nobody\""));
+    }
+
+    #[test]
+    fn the_wrong_group_holding_the_desk_is_a_failure() {
+        let (questions, aggregates) = site(FULL_DESK);
+        let mut file = needs("");
+        file.needs[0].handled_by = "sales".to_string();
+        let findings = check(&file, &questions, &aggregates);
+        assert_eq!(
+            fails(&findings),
+            vec!["no desk gated on \"sales\" reads \"projects\" - it is read by /desk (owners)"]
+        );
+    }
+
+    #[test]
+    fn via_pins_the_entry_alternative() {
+        let (questions, aggregates) = site(FULL_DESK);
+        let mut file = needs("");
+        file.needs[0].via = Some("Follow along".to_string());
+        let findings = check(&file, &questions, &aggregates);
+        assert_eq!(
+            fails(&findings),
+            vec!["no path from \"/\" via \"Follow along\" records into \"projects\" within 2 submission(s)"]
+        );
+    }
+
+    #[test]
+    fn tasks_carry_the_page_as_a_choice_and_score_separates_misroutes() {
+        let (questions, _) = site(FULL_DESK);
+        let file = needs("");
+        let tasks = tasks(&file, &questions, false);
+        let skimmed = super::tasks(&file, &questions, true);
+        assert_eq!(skimmed[0].questions["pick"].criteria["Follow along"], "Follow along");
+        assert_eq!(tasks.len(), 1);
+        let task = &tasks[0];
+        assert_eq!(task.id, "founder@/");
+        assert_eq!(task.expect, vec!["Hire us"]);
+        let q = &task.questions["pick"];
+        assert_eq!(q.kind, "choice");
+        assert_eq!(q.criteria["Follow along"], "Notes by mail.");
+        assert!(q.instructions.contains("What are you here for?"));
+
+        let right = vec![Answer { id: "founder@/".into(), choice: "Hire us".into(), confidence: Some(0.55) }];
+        let s = score(&tasks, &right, 0.6);
+        assert_eq!((s.correct, s.misroutes.len(), s.hesitant.len()), (1, 0, 1));
+
+        let wrong = vec![Answer { id: "founder@/".into(), choice: "Follow along".into(), confidence: Some(0.9) }];
+        let s = score(&tasks, &wrong, 0.6);
+        assert_eq!((s.correct, s.misroutes.len()), (0, 1));
+        assert_eq!(s.accuracy(), 0.0);
+
+        assert_eq!(score(&tasks, &[], 0.6).unanswered, vec!["founder@/"]);
+    }
+}

src/resource.rs

@@ -68,6 +68,16 @@ pub async fn get_requirement_options(
         .iter()
         .find(|r| r.name == requirement_name)
         .ok_or_else(|| ServerFnError::new("unknown requirement"))?;
+    // Inline options: return them as {id,label} objects, the shape the
+    // SelectField renders, without touching a resource.
+    if !requirement.options.is_empty() {
+        let items: Vec<serde_json::Value> = requirement
+            .options
+            .iter()
+            .map(|o| serde_json::json!({ "id": o, "label": o }))
+            .collect();
+        return Ok(serde_json::Value::Array(items));
+    }
     let resource = requirement
         .resource
         .as_ref()
@@ -250,21 +260,20 @@ async fn fetch_gitea_json(
     for (k, v) in params {
         url.query_pairs_mut().append_pair(k, v);
     }
-    let client = openidconnect::reqwest::Client::new();
+    let mut req = crate::http::client().get(url.clone());
-    let mut req = client.get(url.clone());
     if let Ok(token) = std::env::var("GITEA_API_TOKEN") {
         if !token.is_empty() {
             req = req.header("Authorization", format!("token {token}"));
         }
     }
-    let text = req
+    let response = req
         .send()
         .await
         .and_then(|r| r.error_for_status())
-        .map_err(|e| ServerFnError::new(format!("fetching {url}: {e}")))?
+        .map_err(|e| ServerFnError::new(format!("fetching {url}: {e}")))?;
-        .text()
+    let text = crate::http::text(response, crate::http::GITEA_CAP)
         .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
+        .map_err(|e| ServerFnError::new(format!("reading {url}: {e}")))?;
     serde_json::from_str(&text).map_err(|e| ServerFnError::new(e.to_string()))
 }
 
@@ -331,16 +340,17 @@ async fn fetch_url_json(
     for (k, v) in &leftover {
         parsed.query_pairs_mut().append_pair(k, v);
     }
-    let client = openidconnect::reqwest::Client::new();
+    let response = crate::http::client()
-    let text = client
         .get(parsed.clone())
         .send()
         .await
         .and_then(|r| r.error_for_status())
-        .map_err(|e| ServerFnError::new(format!("fetching {parsed}: {e}")))?
+        .map_err(|e| ServerFnError::new(format!("fetching {parsed}: {e}")))?;
-        .text()
+    // Content picks the URL; the cap is what keeps a runaway endpoint
+    // from becoming a runaway allocation here.
+    let text = crate::http::text(response, crate::http::URL_RESOURCE_CAP)
         .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
+        .map_err(|e| ServerFnError::new(format!("reading {parsed}: {e}")))?;
     serde_json::from_str(&text).map_err(|e| ServerFnError::new(e.to_string()))
 }
 

src/server/mod.rs

@@ -38,6 +38,10 @@ pub struct AppState {
     /// rather than re-derived per call, since `resolve_gitea_repo` needs
     /// it too and has no other reason to see `CONTENT_REPO` itself.
     pub gitea_base: String,
+    /// `{gitea}/api/v1/repos/{owner}/{repo}/raw` and the branch - what
+    /// `content::site_asset_handler` proxies content-shipped assets from.
+    pub content_raw_base: String,
+    pub content_branch: String,
     pub oidc: Arc<oidc::Oidc>,
     /// `None` when `GARAGE_*` env vars aren't set - uploads are the one
     /// optional feature, everything else works without Garage.

src/server/oidc.rs

@@ -33,6 +33,13 @@ type OidcClient = CoreClient<
 >;
 
 pub struct Oidc {
+    /// `None` when `KANIDM_URL` is unset: a content-only instance with
+    /// sign-in disabled - auth routes answer 503, everything public
+    /// renders as usual.
+    inner: Option<OidcInner>,
+}
+
+struct OidcInner {
     client: OidcClient,
     http: openidconnect::reqwest::Client,
 }
@@ -45,7 +52,13 @@ const REDIRECT_KEY: &str = "oidc_post_login_redirect";
 impl Oidc {
     /// Discovers the provider and builds the client from environment:
     /// `KANIDM_URL`, `OAUTH2_CLIENT_ID`, `OAUTH2_CLIENT_SECRET`, `PUBLIC_URL`.
+    /// With `KANIDM_URL` unset, sign-in is disabled instead of fatal -
+    /// the shape of a public content instance without a review desk.
     pub async fn from_env() -> anyhow::Result<Self> {
+        if std::env::var("KANIDM_URL").is_err() {
+            tracing::warn!("KANIDM_URL not set - sign-in disabled on this instance");
+            return Ok(Self { inner: None });
+        }
         let kanidm_url = require_env("KANIDM_URL")?;
         let client_id = require_env("OAUTH2_CLIENT_ID")?;
         let client_secret = require_env("OAUTH2_CLIENT_SECRET")?;
@@ -75,7 +88,16 @@ impl Oidc {
         )
         .set_redirect_uri(redirect);
 
-        Ok(Self { client, http })
+        Ok(Self {
+            inner: Some(OidcInner { client, http }),
+        })
+    }
+
+    fn configured(&self) -> Result<&OidcInner, HandlerError> {
+        self.inner.as_ref().ok_or((
+            StatusCode::SERVICE_UNAVAILABLE,
+            "sign-in is not configured on this instance".to_string(),
+        ))
     }
 }
 
@@ -118,10 +140,10 @@ pub async fn login(
         session.insert(REDIRECT_KEY, redirect).await.map_err(internal)?;
     }
 
+    let oidc = state.oidc.configured()?;
     let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();
 
-    let (auth_url, csrf_state, nonce) = state
+    let (auth_url, csrf_state, nonce) = oidc
-        .oidc
         .client
         .authorize_url(
             CoreAuthenticationFlow::AuthorizationCode,
@@ -182,7 +204,7 @@ pub async fn callback(
         ));
     }
 
-    let oidc = &state.oidc;
+    let oidc = state.oidc.configured()?;
     let token_response = oidc
         .client
         .exchange_code(AuthorizationCode::new(params.code))

src/upload.rs

@@ -15,7 +15,7 @@ use serde::Serialize;
 
 use crate::server::AppState;
 
-const MAX_UPLOAD_BYTES: usize = 20 * 1024 * 1024;
+pub const MAX_UPLOAD_BYTES: usize = 20 * 1024 * 1024;
 
 #[derive(Clone)]
 pub struct Garage {
@@ -84,12 +84,20 @@ pub async fn upload(
             .unwrap_or("application/octet-stream")
             .to_string();
         let filename = field.file_name().unwrap_or("upload").to_string();
-        let bytes = field
+        // Chunk by chunk, refused the moment the cap is crossed: an
-            .bytes()
+        // oversized body is never buffered whole before being turned
+        // away. The route's body limit (main.rs) is the outer fence.
+        let mut bytes: Vec<u8> = Vec::new();
+        let mut field = field;
+        while let Some(chunk) = field
+            .chunk()
             .await
-            .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?;
+            .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?
-        if bytes.len() > MAX_UPLOAD_BYTES {
+        {
-            return Err((StatusCode::PAYLOAD_TOO_LARGE, "file too large".to_string()));
+            if bytes.len() + chunk.len() > MAX_UPLOAD_BYTES {
+                return Err((StatusCode::PAYLOAD_TOO_LARGE, "file too large".to_string()));
+            }
+            bytes.extend_from_slice(&chunk);
         }
 
         let key = format!("{}-{filename}", uuid::Uuid::new_v4());

style/main.css

@@ -51,7 +51,7 @@
   --ink-dim: #9a9a9a;
   --line: #2a2a2a;
 
-  /* Cards float over the sticky YES canvas - translucent so the piece
+  /* Cards float over a sticky hero piece - translucent so the piece
      reads faintly through them (paired with backdrop-filter on
      .alt-card), shadowed so their edge against the animated backdrop
      is a soft lift rather than a hard contrast line. */
@@ -78,8 +78,9 @@
 /* Light theme: the same muted-press idea on white stock - warm paper,
    near-black ink, and the accent deepened from dusty cyan to a teal
    ink that actually carries as text on light paper (the dark theme's
-   #8ec2c0 washes out there). yes.js mirrors this palette on its own
+   #8ec2c0 washes out there). Canvas-drawing modules (gesture.js, and
-   (matchMedia in setupTheme) since canvas paint can't read CSS vars. */
+   content-shipped hero modules) mirror this palette on their own,
+   since canvas paint can't read CSS vars. */
 @media (prefers-color-scheme: light) {
   :root {
     --accent: #47807e;
@@ -98,19 +99,13 @@
     --hero-glow: rgba(246, 245, 241, 0.85);
   }
 
-  /* The wordmark SVG is a hardcoded white stroke (also used raw in
+  /* The house wordmark SVG is a hardcoded white stroke (also used
-     dark contexts elsewhere) - flip it to ink here rather than fork
+     raw in dark contexts elsewhere) - flip it to ink here rather
-     the asset. */
+     than fork the asset. A content-provided logo keeps its colors. */
-  .wordmark img {
+  .wordmark-house img {
     filter: invert(0.92);
   }
 
-  /* overlay against near-white paper resolves to ~white and the
-     raster ghost vanishes; multiply lets the light theme's gray YES
-     (see rasterizeText's themed repaint in yes.js) show as ink. */
-  .hero-canvas #rasterCanvas {
-    mix-blend-mode: multiply;
-  }
 }
 
 * {
@@ -152,6 +147,10 @@ a {
 main.loading,
 main.not-found {
   min-height: 60vh;
+  /* svh so wrapper browsers that resize the webview as their toolbar
+     animates (Firefox/Chrome iOS) don't reflow this placeholder - the
+     small viewport is a fixed value. Same ladder as .hero-piece. */
+  min-height: 60svh;
   display: flex;
   flex-direction: column;
   align-items: center;
@@ -198,98 +197,71 @@ main.not-found {
   color: var(--ink-dim);
   font-size: 1.05rem;
   max-width: 46ch;
+  /* The measure cap shrinks the box below the copy column; without
+     auto margins the box left-anchors and its centered text centers
+     in the wrong frame. */
+  margin-inline: auto;
 }
 
-/* the actual "YES - Rasterized Lines" piece live at uhhm.no (see
+/* A content-shipped hero module (site.yaml hero.kind: module) draws
-   public/yes.js) - landing page only. Full-viewport so it's a real
+   into .hero-piece; the module owns its look (it may restyle .hero
-   moment, not a thumbnail; hero-copy overlays near the bottom rather
+   itself). Portal only reserves the box so the copy doesn't jump when
-   than interrupting the canvas. */
+   the module mounts - plain-vh fallback first, as everywhere. */
-
+.hero-module .hero-piece {
-.hero-yes {
-  /* Sticky at the viewport top for the whole scroll (its containing
-     block is the page itself), so the piece stays animating behind
-     everything that follows - the translucent cards scroll over it
-     and it shows through them and in the gaps around them. z-index 0
-     so positioned content below can stack above with z-index 1. */
-  position: sticky;
-  top: 0;
-  z-index: 0;
-  max-width: none;
-  width: 100%;
-  /* svh here is only the pre-JS/no-JS fallback (and first paint before
-     yes.js's constructor runs). Once yes.js mounts, it overwrites this
-     with an inline `height: <px>` frozen from a single measurement -
-     see setupCanvas()'s comment in yes.js for why: on real mobile
-     Safari, content bottom-aligned inside this box kept sliding down
-     as the address bar collapsed even with a spec'd-stable viewport
-     unit here, so the box's actual height can't be trusted to stay
-     put on that unit alone. An inline style set from JS always wins
-     the cascade over this rule, so that frozen number is what
-     actually governs once the page is interactive.
-     Plain-vh fallback declared first - an engine without svh support
-     ignores the invalid second line rather than falling through to
-     auto height, which would collapse this to the height of its
-     in-flow content and clip the canvas via overflow:hidden below. */
-  height: 100vh;
-  height: 100svh;
-  padding: 0;
-  justify-content: flex-end;
-  overflow: hidden;
-}
-
-.hero-canvas {
-  position: absolute;
-  inset: 0;
-}
-
-.hero-canvas canvas {
-  position: absolute;
-  top: 0;
-  left: 0;
-  cursor: pointer;
-}
-
-.hero-canvas #rasterCanvas {
-  mix-blend-mode: overlay;
-  opacity: 0.5;
-}
-
-.hero-yes .hero-copy {
-  position: relative;
-  z-index: 1;
-  padding: 0 1.5rem 3.5rem;
-  gap: 0.6rem;
-  text-shadow: 0 0.12em 1.4em var(--hero-glow);
-}
-
-/* The gesture hero (site.yaml hero.kind: gesture - redoal.com's
-   landing): a tall drawing surface where the visitor's stroke and
-   ambient echoes from the relay share the stage. Not sticky like the
-   YES piece - drawing and scrolling fight over the same finger. */
-.hero-gesture .hero-draw {
   position: relative;
   width: 100%;
-  max-width: 46rem;
-  /* Same jump-avoidance as .gesture-wrap: the canvas (55svh tall)
-     only exists after hydration, so hold its height open from the
-     first paint. Plain-vh fallback first, like the canvas itself. */
   min-height: 55vh;
   min-height: 55svh;
 }
 
-.hero-gesture .gesture-canvas {
+/* announcements - live event pages, a strip above the hero copy.
-  aspect-ratio: auto;
+   Header, not footer: the one place a page claims attention before
-  /* Plain-vh fallback first, same reasoning as .hero-yes's height. */
+   the question is asked. */
-  height: 55vh;
+.announce {
-  height: 55svh;
+  width: 100%;
-  border: none;
+  display: flex;
-  background: transparent;
+  flex-wrap: wrap;
+  justify-content: center;
+  gap: 0.6rem 1.2rem;
+  margin: -2rem 0 0.5rem;
+  font-size: 0.88rem;
+  position: relative;
+  z-index: 1;
 }
 
-.hero-gesture .gesture-status {
+.announce-item {
-  top: auto;
+  display: inline-flex;
-  bottom: 0.55rem;
+  flex-wrap: wrap;
-  right: 0.55rem;
+  align-items: baseline;
+  gap: 0.35rem 0.7rem;
+  padding: 0.45rem 0.9rem;
+  border: 0.06rem solid var(--line);
+  border-left: 0.2rem solid var(--accent);
+  border-radius: 0.3rem;
+  color: var(--ink);
+  text-decoration: none;
+  background: var(--paper);
+  transition: border-color 120ms;
+}
+
+.announce-item:hover,
+.announce-item[aria-current="page"] {
+  border-color: var(--accent);
+}
+
+.announce-name {
+  font-weight: 600;
+}
+
+.announce-when {
+  color: var(--ink-dim);
+}
+
+.announce-relative {
+  color: var(--accent);
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  font-size: 0.72rem;
 }
 
 /* alternatives */
@@ -400,8 +372,12 @@ main.not-found {
 .alt-image {
   display: block;
   width: 100%;
-  max-height: 14rem;
+  height: auto;
-  object-fit: cover;
+  /* Natural aspect, not a cropped band; a very tall image is still
+     bounded so it can't tower. The deck below overrides for its
+     fixed-height cards. */
+  max-height: 32rem;
+  object-fit: contain;
   border-radius: calc(var(--radius) - 0.3rem);
   margin-bottom: 1.1rem;
 }
@@ -466,10 +442,9 @@ main.not-found {
 }
 
 .feature-icon {
-  float: left;
   width: 1.3rem;
   height: 1.3rem;
-  margin: 0.1rem 0.6rem 0.4rem 0;
+  margin-top: 0.1rem;
   background-color: var(--feature-accent, currentColor);
   mask-repeat: no-repeat;
   mask-size: contain;
@@ -479,11 +454,141 @@ main.not-found {
   -webkit-mask-position: center;
 }
 
+/* With an icon the feature is two columns: the icon in the first,
+   everything else - name, description, fields, resources - in the
+   second, so every line of text shares one left edge instead of
+   wrapping back under the icon. */
+.feature:has(> .feature-icon) {
+  display: grid;
+  grid-template-columns: 1.3rem minmax(0, 1fr);
+  column-gap: 0.7rem;
+  align-items: start;
+}
+
+.feature:has(> .feature-icon) > .feature-icon {
+  grid-column: 1;
+  grid-row: 1;
+}
+
+.feature:has(> .feature-icon) > :not(.feature-icon) {
+  grid-column: 2;
+}
+
 .feature h3 {
   font-size: 1rem;
   margin-bottom: 0.15em;
 }
 
+/* voice field (voice.js): a record button, a status line, a preview */
+.voice-wrap {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 0.6rem 1rem;
+}
+
+.voice-button {
+  font: inherit;
+  padding: 0.55rem 1.1rem;
+  border: 0.06rem solid var(--accent);
+  border-radius: 2rem;
+  background: transparent;
+  color: var(--ink);
+  cursor: pointer;
+}
+
+.voice-button:hover:not(:disabled) {
+  background: var(--accent);
+  color: var(--paper);
+}
+
+.voice-button.recording {
+  background: var(--accent);
+  color: var(--paper);
+  animation: voice-pulse 1.2s ease-in-out infinite;
+}
+
+.voice-button:disabled {
+  opacity: 0.5;
+  cursor: default;
+}
+
+@keyframes voice-pulse {
+  50% { opacity: 0.6; }
+}
+
+.voice-status {
+  font-size: 0.85rem;
+  color: var(--ink-dim);
+}
+
+.voice-preview,
+.item-card-audio {
+  display: block;
+  width: 100%;
+  max-width: 28rem;
+  margin-top: 0.4rem;
+}
+
+/* display:block above would beat the hidden attribute */
+.voice-preview[hidden] {
+  display: none;
+}
+
+/* links inside markdown descriptions */
+.alt-description a,
+.feature p a {
+  color: inherit;
+  text-decoration: none;
+  border-bottom: 0.06rem solid var(--accent);
+}
+
+.alt-description a:hover,
+.feature p a:hover {
+  color: var(--accent);
+}
+
+/* images inside markdown descriptions: full-width figures in the
+   card's flow, framed like the rest of the press sheet */
+.alt-description img,
+.item-card-description img,
+.feature p img {
+  display: block;
+  width: 100%;
+  margin: 0.6rem 0 0.2rem;
+  border-radius: 0.5rem;
+  border: 0.06rem solid var(--line);
+}
+
+/* Content hint via a markdown image title (`![alt](url "right 9rem")`):
+   float and shrink so text wraps around a portrait. */
+.alt-description img.md-float-left,
+.item-card-description img.md-float-left,
+.feature p img.md-float-left,
+.alt-description img.md-float-right,
+.item-card-description img.md-float-right,
+.feature p img.md-float-right {
+  width: auto;
+  max-width: 45%;
+}
+.alt-description img.md-float-left,
+.item-card-description img.md-float-left,
+.feature p img.md-float-left {
+  float: left;
+  margin: 0.2rem 1.1rem 0.5rem 0;
+}
+.alt-description img.md-float-right,
+.item-card-description img.md-float-right,
+.feature p img.md-float-right {
+  float: right;
+  margin: 0.2rem 0 0.5rem 1.1rem;
+}
+
+.alt-description code,
+.feature p code {
+  font-size: 0.9em;
+}
+
 .feature p {
   color: var(--ink-dim);
   font-size: 0.95rem;
@@ -564,10 +669,16 @@ textarea:focus {
    custom properties - so palette changes go there AND here. */
 .gesture-wrap {
   position: relative;
-  /* The canvas is created by JS only after wasm hydration - reserve
+  width: 100%;
-     its 3/2 box now so content below doesn't jump when it appears.
+}
-     aspect-ratio is a preferred size, so the box still grows when the
+
-     echo thumbnail strip shows up under the canvas. */
+/* The canvas is created by JS only after wasm hydration - reserve its
+   3/2 box until then so content below doesn't jump. Scoped to :empty
+   on purpose: on the mounted wrap (a stretched item inside the flex
+   .field) the same aspect-ratio turned the echo strip's extra height
+   into extra WIDTH and the whole card ballooned past the viewport
+   after the first stroke. */
+.gesture-wrap:empty {
   aspect-ratio: 3 / 2;
 }
 
@@ -584,11 +695,17 @@ textarea:focus {
   touch-action: none;
 }
 
+/* Results overlay the canvas instead of growing the widget - the
+   page never jumps when places arrive (or don't). */
 .gesture-echoes {
+  position: absolute;
+  left: 0.6rem;
+  right: 0.6rem;
+  bottom: 0.6rem;
   display: flex;
+  justify-content: center;
   gap: 0.5rem;
-  margin-top: 0.5rem;
+  pointer-events: none;
-  min-height: 3rem;
 }
 
 .gesture-echoes:empty {
@@ -603,12 +720,48 @@ textarea:focus {
   border-radius: 0.4rem;
   opacity: 0;
   transition: opacity 0.5s ease;
+  pointer-events: auto;
+  box-shadow: 0 0.15rem 0.6rem rgba(0, 0, 0, 0.18);
 }
 
 .gesture-echo.shown {
   opacity: var(--echo-strength, 1);
 }
 
+/* places are pickable: the pick re-derives the input's key */
+.gesture-echo {
+  cursor: pointer;
+  transition: opacity 0.5s ease, border-color 120ms, transform 120ms;
+}
+
+.gesture-echo:hover,
+.gesture-echo:focus-visible {
+  border-color: var(--accent);
+  outline: none;
+}
+
+.gesture-echo.selected {
+  border-color: var(--accent);
+  box-shadow: 0 0 0 0.12rem var(--accent);
+  transform: translateY(-0.1rem);
+}
+
+.gesture-empty {
+  position: absolute;
+  left: 0;
+  right: 0;
+  bottom: 0.7rem;
+  margin: 0;
+  text-align: center;
+  font-size: 0.85rem;
+  color: var(--ink-dim);
+  pointer-events: none;
+}
+
+.gesture-empty:empty {
+  display: none;
+}
+
 .gesture-status {
   position: absolute;
   top: 0.55rem;
@@ -740,6 +893,10 @@ textarea:focus {
   padding: 0.75rem 1.4rem;
   cursor: pointer;
   transition: filter 120ms, transform 120ms;
+  /* A gateway alternative renders this as an <a> (navigation, no POST);
+     kill the link chrome so it reads as the button it looks like. */
+  text-decoration: none;
+  display: inline-block;
 }
 
 .alt-submit:hover {
@@ -755,6 +912,13 @@ textarea:focus {
   cursor: wait;
 }
 
+/* A content-disabled alternative (`disabled: true`): announced, not
+   yet takeable - reads as a promise, not as a stuck form. */
+.alt-submit.soon:disabled {
+  cursor: not-allowed;
+  opacity: 0.6;
+}
+
 .gate-card {
   text-align: center;
 }
@@ -881,6 +1045,9 @@ textarea:focus {
 .item-card-description {
   font-size: 0.9rem;
   color: var(--ink-dim);
+  /* The card is a grid with its own gap; the global p bottom margin
+     would stack on top of it. */
+  margin: 0;
 }
 
 .item-card-fields {

tests/jetstream.rs

@@ -0,0 +1,66 @@
+//! The one test that meets a real JetStream: a submission becomes an
+//! aggregate, a desk move is accepted, an undeclared move is refused,
+//! and the record reads back from its own event log. Everything else
+//! in the suite replays in memory; this is what proves the store, the
+//! event log and the projection agree with each other.
+//!
+//! Runs only when `PORTAL_TEST_NATS_URL` points at a JetStream (CI
+//! starts a throwaway one, see `.gitea/workflows/test.yml`); without
+//! it the test passes as skipped, so `cargo test` stays green offline.
+#![cfg(feature = "ssr")]
+
+use portal::aggregates::{self, parse_aggregates_yaml, TransitionError};
+use portal::answers::{store_answer, Answer};
+use portal::events::store::{ensure_stream, load_events};
+use serde_json::json;
+
+#[tokio::test]
+async fn a_submission_is_created_moved_refused_and_read_back_through_the_real_engine() {
+    let Ok(url) = std::env::var("PORTAL_TEST_NATS_URL") else {
+        eprintln!("skipped: PORTAL_TEST_NATS_URL is not set");
+        return;
+    };
+    let js = async_nats::jetstream::new(async_nats::connect(&url).await.expect("connect"));
+    ensure_stream(&js).await.expect("event stream");
+
+    // A bucket of its own per run, so reruns and parallel runs never
+    // read each other's records.
+    let bucket = format!("it_{}", chrono::Utc::now().timestamp_millis());
+    let schemas = parse_aggregates_yaml(&format!(
+        "aggregates:\n  - bucket: {bucket}\n    initial: open\n    states:\n      open: {{ event: received }}\n      quoted: {{ event: quoted }}\n      won: {{ event: won }}\n      lost: {{ event: lost }}\n    transitions:\n      open: [quoted, lost]\n      quoted: [won, lost]\n"
+    ))
+    .expect("schema");
+    let schema = &schemas[&bucket];
+    let now = chrono::Utc::now().timestamp_millis();
+
+    // The submission: a KV record in the initial state, plus the first event.
+    store_answer(&js, &schemas, &bucket, "rec-1".into(), "/", "Hire us", &json!({"email": "a@b.example"}), now)
+        .await
+        .expect("store");
+    let store = js.get_key_value(&bucket).await.expect("bucket exists");
+    let stored: Answer = serde_json::from_slice(&store.get("rec-1").await.unwrap().expect("record")).unwrap();
+    assert_eq!(stored.state, "open");
+    assert_eq!(stored.responses["email"], "a@b.example");
+
+    // A desk move the machine allows.
+    let moved = aggregates::transition(&js, schema, "rec-1", "quoted", json!({"by": "test"}), now + 1)
+        .await
+        .expect("open -> quoted is declared");
+    assert_eq!(moved.state, "quoted");
+
+    // Moves the machine does not allow are refused, whoever asks.
+    let back = aggregates::transition(&js, schema, "rec-1", "open", json!({}), now + 2).await;
+    assert!(matches!(back, Err(TransitionError::DisallowedTransition { .. })), "{back:?}");
+    let skip = aggregates::transition(&js, schema, "rec-1", "won", json!({}), now + 2).await;
+    assert!(skip.is_ok(), "quoted -> won is declared: {skip:?}");
+    let nobody = aggregates::transition(&js, schema, "rec-9", "quoted", json!({}), now + 3).await;
+    assert!(matches!(nobody, Err(TransitionError::UnknownAggregate)), "{nobody:?}");
+
+    // The record reads back from its own event log, in the state the
+    // accepted moves left it, with a sequence that moved forward.
+    let events = load_events(&js, &bucket, "rec-1").await.expect("events");
+    assert_eq!(events.len(), 3, "received, quoted, won");
+    let replayed = aggregates::replay(schema, "rec-1", &events).expect("replays");
+    assert_eq!(replayed.state, "won");
+    assert!(replayed.sequence > moved.sequence);
+}

voice.js

@@ -0,0 +1,205 @@
+// A `type: voice` requirement: leave a recording at a gesture key.
+// Same contract as gesture.js - portal mounts it with the field's
+// hidden input and the relay URL, and calls stop() on navigation.
+//
+// The browser records with MediaRecorder (whatever container it
+// likes), decodes that to PCM with WebAudio, resamples to mono 48 kHz,
+// and ships one binary frame `[0x01][20-byte key][i16le PCM]` to the
+// relay, which encodes with the one recording codec, signs as itself,
+// keeps it and announces it (ADR-0015).
+//
+// Nothing leaves the browser until the alternative's own submit
+// ("Keep it here") is pressed: the widget intercepts that click,
+// uploads, sets the field's value to {key, digest, duration_ms} on
+// the relay's confirmation, and only then lets the submit through.
+// A relay error keeps the recording for another try and submits
+// nothing.
+//
+// Palette: colors come from the page's custom properties, no copy here.
+
+const MAX_SECONDS = 60;
+const SAMPLE_RATE = 48000;
+
+class VoiceWidget {
+    constructor(container, hidden, relayUrl, key) {
+        this.container = container;
+        this.hidden = hidden || null;
+        this.relayUrl = relayUrl || '';
+        this.key = (key || '').trim();
+        this.stopped = false;
+        this.recorder = null;
+        this.stream = null;
+        this.chunks = [];
+        this.ws = null;
+
+        this.button = document.createElement('button');
+        this.button.type = 'button';
+        this.button.className = 'voice-button';
+        this.button.textContent = 'Record';
+        this.status = document.createElement('span');
+        this.status.className = 'voice-status';
+        this.preview = document.createElement('audio');
+        this.preview.className = 'voice-preview';
+        this.preview.controls = true;
+        this.preview.hidden = true;
+        container.append(this.button, this.status, this.preview);
+
+        this._onClick = () => this.toggle();
+        this.button.addEventListener('click', this._onClick);
+        this.pcm = null;      // decoded, ready to upload
+        this.published = null;
+        this.passthrough = false;
+        // The alternative's submit button: hold it until the recording
+        // is kept at the relay.
+        this.card = container.closest('.alt-card');
+        this._onSubmit = (e) => this.onSubmitClick(e);
+        if (this.card) this.card.addEventListener('click', this._onSubmit, true);
+        if (!this.key || this.key.length !== 40) {
+            this.button.disabled = true;
+            this.say('This page has no address to leave a voice at.');
+        } else if (!navigator.mediaDevices || !window.MediaRecorder) {
+            this.button.disabled = true;
+            this.say('Recording needs a browser with a microphone API.');
+        }
+    }
+
+    say(text) {
+        this.status.textContent = text;
+    }
+
+    async toggle() {
+        if (this.recorder && this.recorder.state === 'recording') {
+            this.recorder.stop();
+            return;
+        }
+        try {
+            this.stream = await navigator.mediaDevices.getUserMedia({ audio: true });
+        } catch {
+            this.say('Microphone access was declined.');
+            return;
+        }
+        this.chunks = [];
+        this.recorder = new MediaRecorder(this.stream);
+        this.recorder.addEventListener('dataavailable', (e) => { if (e.data.size) this.chunks.push(e.data); });
+        this.recorder.addEventListener('stop', () => this.finish());
+        this.recorder.start();
+        this.button.textContent = 'Stop';
+        this.button.classList.add('recording');
+        this.say(`Recording — up to ${MAX_SECONDS} seconds.`);
+        this.capTimer = setTimeout(() => { if (this.recorder && this.recorder.state === 'recording') this.recorder.stop(); }, MAX_SECONDS * 1000);
+    }
+
+    async finish() {
+        clearTimeout(this.capTimer);
+        this.button.textContent = 'Record again';
+        this.button.classList.remove('recording');
+        if (this.stream) { this.stream.getTracks().forEach((t) => t.stop()); this.stream = null; }
+        const blob = new Blob(this.chunks, { type: this.recorder.mimeType || 'audio/webm' });
+        if (!blob.size) { this.say('Nothing was recorded.'); return; }
+        this.preview.src = URL.createObjectURL(blob);
+        this.preview.hidden = false;
+        this.published = null;
+        this.setValue(null);
+        try {
+            this.pcm = await this.toPcm16(await blob.arrayBuffer());
+        } catch (e) {
+            this.pcm = null;
+            this.say('Could not decode the recording — try once more.');
+            return;
+        }
+        this.say(`${Math.round(this.pcm.length / 2 / SAMPLE_RATE)} s recorded. Listen back, then press the button below to keep it here.`);
+    }
+
+    onSubmitClick(e) {
+        const button = e.target.closest && e.target.closest('.alt-submit');
+        if (!button || this.passthrough) return;
+        if (this.published) return; // already kept: let the submit go
+        e.preventDefault();
+        e.stopPropagation();
+        if (!this.pcm) {
+            this.say(this.recorder && this.recorder.state === 'recording' ? 'Stop the recording first.' : 'Record something first.');
+            return;
+        }
+        this.say('Sending to the relay…');
+        this.upload(this.pcm, () => {
+            // The relay confirmed: now the answer itself is submitted.
+            this.passthrough = true;
+            button.click();
+            this.passthrough = false;
+        });
+    }
+
+    // Decode → mono 48 kHz Float32 → Int16 little-endian bytes.
+    async toPcm16(buffer) {
+        const ctx = new (window.AudioContext || window.webkitAudioContext)();
+        const decoded = await ctx.decodeAudioData(buffer);
+        await ctx.close();
+        const frames = Math.ceil(decoded.duration * SAMPLE_RATE);
+        const offline = new OfflineAudioContext(1, frames, SAMPLE_RATE);
+        const src = offline.createBufferSource();
+        src.buffer = decoded;
+        src.connect(offline.destination);
+        src.start();
+        const rendered = await offline.startRendering();
+        const f32 = rendered.getChannelData(0);
+        const out = new Uint8Array(f32.length * 2);
+        const view = new DataView(out.buffer);
+        for (let i = 0; i < f32.length; i++) {
+            const s = Math.max(-1, Math.min(1, f32[i]));
+            view.setInt16(i * 2, s < 0 ? s * 32768 : s * 32767, true);
+        }
+        return out;
+    }
+
+    upload(pcm, onPublished) {
+        if (!this.relayUrl) { this.say('No relay to send to.'); return; }
+        const frame = new Uint8Array(1 + 20 + pcm.length);
+        frame[0] = 1;
+        for (let i = 0; i < 20; i++) frame[1 + i] = parseInt(this.key.substr(i * 2, 2), 16);
+        frame.set(pcm, 21);
+        const ws = new WebSocket(this.relayUrl);
+        ws.binaryType = 'arraybuffer';
+        this.ws = ws;
+        ws.addEventListener('open', () => ws.send(frame));
+        ws.addEventListener('message', (e) => {
+            let msg; try { msg = JSON.parse(e.data); } catch { return; }
+            if (msg.type === 'published') {
+                this.published = { key: this.key, digest: msg.digest, duration_ms: msg.duration_ms };
+                this.setValue(this.published);
+                this.say(`Kept at this address — ${Math.round(msg.duration_ms / 1000)} s.`);
+                this.button.disabled = true;
+                ws.close();
+                if (onPublished) onPublished();
+            } else if (msg.type === 'error') {
+                this.say((msg.message || 'The relay declined the recording.') + ' Your recording is still here — try again.');
+                ws.close();
+            }
+        });
+        ws.addEventListener('error', () => this.say('The relay could not be reached. Your recording is still here — try again.'));
+        ws.addEventListener('close', (e) => {
+            if (!this.published && e.code !== 1000 && e.code !== 1005) {
+                this.say('The relay closed the connection. Your recording is still here — try again.');
+            }
+        });
+    }
+
+    setValue(value) {
+        if (!this.hidden) return;
+        this.hidden.value = value ? JSON.stringify(value) : '';
+        this.hidden.dispatchEvent(new Event('input', { bubbles: true }));
+    }
+
+    stop() {
+        this.stopped = true;
+        clearTimeout(this.capTimer);
+        if (this.recorder && this.recorder.state === 'recording') this.recorder.stop();
+        if (this.stream) this.stream.getTracks().forEach((t) => t.stop());
+        if (this.ws) this.ws.close();
+        this.button.removeEventListener('click', this._onClick);
+        if (this.card) this.card.removeEventListener('click', this._onSubmit, true);
+    }
+}
+
+export function mountVoice(container, hidden, relayUrl, key) {
+    return new VoiceWidget(container, hidden, relayUrl, key);
+}