Release 0.3.37

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH
The lint moves out to uhhm/iris
2026-09-22 17:48:30 +02:00 · 2026-09-22 17:29:26 +02:00 · 2026-09-22 17:03:09 +02:00 · 2026-09-22 16:58:47 +02:00 · 2026-09-22 16:58:40 +02:00 · 2026-09-22 16:51:15 +02:00
28 changed files with 3587 additions and 1732 deletions
@@ -37,6 +37,8 @@ jobs:
      SCCACHE_DIR: /var/local/sccache
      SCCACHE_SERVER_PORT: "4228"
      CARGO_TARGET_DIR: /var/local/cargo-target
      # The iris release shipped in this portal release's tarball.
      IRIS_RELEASE: v0.1.1
      # cargo-leptos's own downloaded tools (wasm-bindgen, wasm-opt) cache
      # under $XDG_CACHE_HOME - left at its default that resolves inside
      # this unit's systemd StateDirectory, files it creates there end up
@@ -58,8 +60,11 @@ jobs:
      # cargo-leptos only builds the leptos bin-target ("portal") - the
      # question-lint utility binary needs its own plain cargo build.
-      - name: Build question-lint
+      # The lint lives in uhhm/iris and is pinned to the portal release it
-        run: cargo build --release --bin question_lint --features ssr
+      # matches; shipping it in the tarball keeps a site that pins nothing
      # extra lint-capable at /srv/app/<instance>/current/iris.
      - name: Build iris
        run: cargo install --git "${{ github.server_url }}/uhhm/iris.git" --tag "$IRIS_RELEASE" --root "$CARGO_TARGET_DIR/iris-install" --force iris
      - name: Package
        run: |
@@ -67,12 +72,15 @@ jobs:
          tag="${{ github.ref_name }}"
          stage=$(mktemp -d)
          cp "$CARGO_TARGET_DIR/release/portal" "$stage/portal"
-          cp "$CARGO_TARGET_DIR/release/question_lint" "$stage/question_lint"
+          cp "$CARGO_TARGET_DIR/iris-install/bin/iris" "$stage/iris"
          # hash-files = true: leptos resolves hash.txt next to the running
          # binary, so it ships beside portal in the release dir.
          cp "$CARGO_TARGET_DIR/release/hash.txt" "$stage/hash.txt"
          # site-root ("target/site" in Cargo.toml) is project-relative,
          # not affected by CARGO_TARGET_DIR - only the plain `cargo build`
          # outputs (release/, front/) move with that override.
          cp -r target/site "$stage/site"
-          tar -C "$stage" -czf "portal-$tag.tar.gz" portal question_lint site
+          tar -C "$stage" -czf "portal-$tag.tar.gz" portal iris hash.txt site
          rm -rf "$stage"
      # The run's own ephemeral token has write access to this repo -
@@ -85,9 +93,9 @@ jobs:
          tag="${{ github.ref_name }}"
          api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
          auth="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
-          subject=$(git log -1 --format=%s)
+          # The release notes are this version's section of CHANGELOG.md.
-          body=$(printf '{"tag_name":"%s","name":"%s"}' \
+          notes=$(awk -v v="${tag#v}" '/^## /{p = ($2 == v)} p' CHANGELOG.md | tail -n +2)
-            "$tag" "$tag: $(echo "$subject" | sed 's/"/\\"/g')")
+          body=$(jq -n --arg tag "$tag" --arg notes "$notes" '{tag_name: $tag, name: $tag, body: $notes}')
          id=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
            -d "$body" "$api/releases" | jq .id) \
            || id=$(curl -sf -H "$auth" "$api/releases/tags/$tag" | jq .id)
@@ -22,5 +22,22 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      # A throwaway JetStream for tests/jetstream.rs. Best effort: if the
      # runner cannot use docker the variable stays unset and that one
      # test reports itself skipped rather than failing the build.
      - name: Start a throwaway JetStream
        run: |
          docker rm -f portal-test-nats >/dev/null 2>&1 || true
          if docker run -d --rm --name portal-test-nats -p 127.0.0.1:14223:4222 nats:2.14.6-alpine -js >/dev/null 2>&1; then
            sleep 2
            echo "PORTAL_TEST_NATS_URL=nats://127.0.0.1:14223" >> "$GITHUB_ENV"
          else
            echo "::warning::no docker on this runner - the JetStream integration test will be skipped"
          fi
      - name: Test
        run: cargo test --features ssr
      - name: Stop the throwaway JetStream
        if: always()
        run: docker rm -f portal-test-nats >/dev/null 2>&1 || true
@@ -0,0 +1,287 @@
 # Changelog
 One line per change, grouped by the release that shipped it. Newest
 first. A release is a Cargo.toml bump plus a `v<version>` tag; the
 content repos pin the tag they run (see the end of this file).
 ## 0.3.37 (2026-09-22)
 - The lint moves to its own repo, uhhm/iris: `question_lint` becomes `iris check`, `needs_replay` becomes `iris replay`; the tarball ships `iris` (pinned in publish.yml) instead of `question_lint`; the needs module and local loaders leave portal
 ## 0.3.36 (2026-09-22)
 - Question nav: a followup is offered only once earned - the verified chain answered the alternative leading there, or a link that records nothing leads on from an earned page. Standing on a page no longer unlocks the pages behind its forms; the chain index now records which alternative was answered
 - One bounded HTTP client for every server-side fetch: 20 s budget, size caps per kind of fetch (`src/http.rs`)
 - Uploads are refused past 20 MB while streaming, and the route body limit that had capped them at axum's 2 MB default is raised to match
 - `tests/jetstream.rs`: the store, the event log and the projection tested against a real JetStream (CI starts a throwaway one)
 - `content` split into `gitea`, `validate`, `markdown`, `handlers`; every path still `content::x`
 - This changelog, and the table of what each site runs
 - Business needs as a checkable spec: needs.yaml + question_lint pass
 - needs: `success` states and a resolved simulation model
 - needs: `stages` - every stage the business named must be a state
 - needs_replay: make simulated cases real aggregates, report buckets by state
 - needs: also_moved_by - a need carried by more than one group's desk
 ## 0.3.35 (2026-09-12)
 - Item cards: no paragraph margin under the description
 ## 0.3.34 (2026-09-11)
 - Question nav: offer followups by reach, not by carrying any chain
 ## 0.3.33 (2026-09-02)
 - Head preloads: latin font, wordmark, content-host preconnect
 ## 0.3.32 (2026-09-01)
 - Per-site favicon via site.yaml
 ## 0.3.31 (2026-09-01)
 - Markdown links allow tel:
 ## 0.3.30 (2026-09-01)
 - Single alt-image shows natural height
 ## 0.3.29 (2026-09-01)
 - Markdown image layout hints + AVIF assets
 ## 0.3.28 (2026-09-01)
 - Hero description renders inline markdown
 ## 0.3.27 (2026-09-01)
 - wordmark_invert: explicit, not inferred from .svg
 ## 0.3.26 (2026-09-01)
 - Select fields: inline static options
 ## 0.3.25 (2026-09-01)
 - Content-shipped stylesheet override (site.yaml stylesheet)
 ## 0.3.24 (2026-09-01)
 - Gateway submit-as-link loses the underline
 ## 0.3.23 (2026-09-01)
 - Chrome speaks the site's language: site.yaml lang + i18n table
 ## 0.3.22 (2026-09-01)
 - site.yaml wordmark_height; raster logos keep their colors
 ## 0.3.21 (2026-09-01)
 - Hero paragraph centers its measure box
 ## 0.3.20 (2026-09-01)
 - Sign-in becomes optional: KANIDM_URL unset disables auth cleanly
 ## 0.3.19 (2026-09-01)
 - Markdown images in descriptions, gated and framed
 ## 0.3.18 (2026-09-01)
 - Item cards render inline markdown descriptions
 - Convergence: ink converges onto the decoded key (WebGL glow)
 - Gesture results overlay the canvas - the page never jumps
 ## 0.3.16 (2026-08-30)
 - Announce sweeper: refresh open records from content
 ## 0.3.15 (2026-08-30)
 - Hidden fields: carrier value without a label row
 ## 0.3.14 (2026-08-30)
 - Feature cards: icon column, one text edge
 ## 0.3.13 (2026-08-30)
 - Voice field: nothing leaves the browser until Keep it here
 ## 0.3.12 (2026-08-30)
 - Voice preview stays hidden until there is something to play
 ## 0.3.11 (2026-08-30)
 - README: gesture and voice fields
 - Validate templated actions against the page pattern
 ## 0.3.10 (2026-08-30)
 - type: voice, Requirement.value, playable resource cards
 ## 0.3.9 (2026-08-30)
 - Templated actions; places are pickable in the gesture input
 ## 0.3.8 (2026-08-30)
 - Descriptions are inline markdown; Feature.link withdrawn
 ## 0.3.7 (2026-08-30)
 - Feature.link: a card's name may point elsewhere
 ## 0.3.6 (2026-08-30)
 - Announced pages: event windows, header announcements, summary tasks
 ## 0.3.5 (2026-08-30)
 - Gesture widget: stop drawing the decoded ghost path
 - Gesture widget: ghost path back, for v2 keys only
 ## 0.3.4 (2026-08-25)
 - Alternative.disabled: announced but not yet takeable
 ## 0.3.3 (2026-08-25)
 - Empty list says so before it can parse as zero answers
 ## 0.3.2 (2026-08-25)
 - README: hashed pkg assets in the release flow
 - Resource empty text: content-declared, and null counts as empty
 ## 0.3.1 (2026-08-25)
 - Content-hashed pkg assets (hash-files) so stale bundles can't pair with new wasm
 ## 0.3.0 (2026-08-25)
 - Hero becomes a content-owned module; site asset proxy; gesture growth fix
 ## 0.2.4 (2026-08-25)
 - Gates keep the question nav
 ## 0.2.3 (2026-08-25)
 - Attended-bucket lint rule; app-lifetime resources fix first-nav corruption
 ## 0.2.2 (2026-08-24)
 - One app-level Title fed by a shared site resource
 ## 0.2.1 (2026-08-24)
 - Docs: routing bullet + design doc marked implemented
 - Revalidating cache on app assets; site title survives SPA navigation
 ## 0.2.0 (2026-08-24)
 - Initial commit: content-driven onboarding portal
 - Load content from Gitea directly, drop the local clone; add deploy workflow
 - Share sccache between manual dev builds and CI
 - Give CI its own SCCACHE_SERVER_PORT
 - Erase view types at every list/component boundary, not just leaves
 - Redirect cargo-leptos's tool cache out of act-runner-bare's StateDirectory
 - Fix Ship release: site-root is project-relative, not CARGO_TARGET_DIR
 - Drop sudo from the deploy workflow - NoNewPrivileges blocks it outright
 - Caddy snippet: use multi-line log block
 - Fix static asset 404s and build-time SITE_NAME
 - Hot-reload content on a NATS trigger instead of requiring a restart
 - Add prosekit rich-text field, Gitea repo embeds, automation KV read endpoint; fix apex/www session-cookie mismatch on /auth/callback
 - Fix prosekit-editor.js: remove bare CSS imports that aborted the whole module
 - Redirect back to the originating page after sign-in, not always /
 - Fix hero-canvas navigation race; style the prosekit editor and add a toolbar
 - yes.js: guard against the canvas not being in the DOM yet
 - Fix get_resource/transition_answer: scope feature lookup to its own alternative
 - Add self-service transitions, authorized by item possession not group membership
 - Event-sourced applicant/subscriber/project aggregates, generalized resources
 - deploy.yml: write GITEA_API_TOKEN for the new GiteaStarred/OrgRepos resource sources
 - Cargo.toml: disambiguate bin-target for cargo-leptos
 - Add manually-triggered backfill workflow, no terminal/sudo needed
 - Trigger redeploy to pick up PORTAL_GITEA_API_TOKEN secret
 - Render generic resource lists as cards, not raw JSON dump
 - Fix recursion-limit build failure in the new item-card renderer
 - Resource-backed multi/single-select requirement
 - Add Organization aggregate (client-as-status), wired but inert
 - Fix favicon (real icon, not an unrelated orange circle) + stack encouragements with the submit button
 - Fix bucket-404 on empty resources, redesign review actions as select-then-confirm, CSS polish
 - Inline encouragements with the submit button, vertically centered
 - Use the real institutional logo for the header wordmark, not plain text
 - Use the actual UHHM-letters wordmark, not the institutional mark
 - Responsive base font size via svmin, not fixed 17px
 - Add plain-unit fallbacks for svmin/svh in case of unsupported engines
 - Size the YES canvas from its container, not window.innerHeight
 - Debounce the YES canvas resize handler and skip no-op resizes
 - Revert canvas sizing to window.innerWidth/innerHeight, gate resize on width change
 - Stop blocking native scroll on the YES canvas's touch handlers
 - Quicksand: font-display optional, not swap, to stop the text-jump on scroll
 - Use lvh/lvmin, not svh/svmin - svh was the wrong end of the viewport
 - Update style/main.css
 - Update style/main.css
 - YES canvas: size off its own container rect, not window.innerHeight
 - yes.js: freeze .hero-yes's height via inline style, don't trust svh alone
 - add responsive container width
 - deploy.yml: build and publish question_lint alongside the app binary
 - Make aggregate state graphs content-driven, not compiled Rust
 - One shared, content-labeled Confirm button per alternative instead of one per row
 - get_resource/get_requirement_options: #[server(default)] on params
 - Add optional Alternative.image and Feature.color/icon for richer layouts
 - Drop the feature list's left-padding
 - Drop question-report entirely, obfuscate the mailto link instead
 - Transition.from: state graphs deeper than one decision
 - Alternative.images: array of urls, rendered as a Swiper card deck
 - Reseed lost event history from the KV projection on transition
 - Lighten the comment load
 - Validate action targets; format timestamps client-side; clippy cleanup
 - Question nav + gateway alternatives
 - Responsible note under the title; followup pages out of the nav until a chain exists
 - README: what the engine provides
 - Feature icons: masked span painted by currentColor, not <img>
 - Responsible note: one line, same hue and size as the hero description
 - Responsible note as <small>: meta information, dimmer than the description
 - Responsible note back to the footer, above the question nav
 - Bound inputs: a field that loads its value from a sibling-parameterized resource
 - add some more width to our alternatives
 - Accent to a dusty press-cyan, a muted echo of the canvas's cyan ink
 - Editor type in rem: prosekit's px typography ignored the responsive root
 - Ban px from stylesheets: every length rem/em off the responsive root
 - No translucent input chrome: solid ink-dim placeholders and embed meta
 - Editor type scales for real: drop prosekit typography.css, fix selectors
 - Stable server fn endpoints: open tabs survive deploys
 - Drop stray local tool temp file, ignore .claude/
 - Noise-driven YES, sticky hero with frosted cards, full light theme
 - increase translucency of laternative cards
 - Showcase jq test tracks Gitea repo shape and website-first links
 - Gesture input type, redoal-relay client, gitea_releases, content-driven branding
 - Echo thumbnails fade in via timeout, not rAF
 - Trigger deploy: redoal OAuth2 credentials now configured
 - Deploy becomes publish: portal ships as a versioned release artifact
 - Semver releases cut with cargo-release; publish on v* tags only
 - Docs: release/rollout flow after the instance-ownership refactor
 - README: frame portal as a generic multi-site question engine
 - Design doc: filesystem routes, sections, dynamic segments
 - Filesystem routes, sections, dynamic segments; instant YES hero
 ## What each site runs
 Read from the hosts on 2026-09-22; a rollout is a pin bump in the
 site's content repo (`PORTAL_RELEASE` in its `deploy.yml`), or a manual
 tarball deploy on kasse.
 | Site | Host | Instance | Version |
 |---|---|---|---|
 | uhhm.no | ergo | `app@uhhm-portal` | v0.3.36 |
 | redoal.com | ergo | `app@redoal-portal` | v0.3.36 |
 | westra.klingenbergbygg.no | kasse | `app@westra-portal` | v0.3.35 |
 | portal.klingenbergbygg.no | kasse | `app@klingenberg-portal` | v0.3.35 |
@@ -2948,7 +2948,7 @@ dependencies = [
 [[package]]
 name = "portal"
-version = "0.2.3"
+version = "0.3.37"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -2970,6 +2970,7 @@ dependencies = [
 "leptos_router",
 "openidconnect",
 "proptest",
 "pulldown-cmark",
 "serde",
 "serde_json",
 "serde_yaml",
@@ -3104,6 +3105,24 @@ dependencies = [
 "unarray",
 ]
 [[package]]
 name = "pulldown-cmark"
 version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
 dependencies = [
 "bitflags 2.13.1",
 "memchr",
 "pulldown-cmark-escape",
 "unicase",
 ]
 [[package]]
 name = "pulldown-cmark-escape"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "007d8adb5ddab6f8e3f491ac63566a7d5002cc7ed73901f72057943fa71ae1ae"
 [[package]]
 name = "quick-error"
 version = "1.2.3"
@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.2.3"
+version = "0.3.37"
 edition = "2021"
 [lib]
@@ -12,6 +12,9 @@ leptos_meta = { version = "0.8" }
 leptos_router = { version = "0.8" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # Inline markdown for content descriptions (links, emphasis, code) -
 # runs on both server and client renders, so not feature-gated.
 pulldown-cmark = { version = "0.13", default-features = false, features = ["html"] }
 # --- server only ---
 leptos_axum = { version = "0.8", optional = true }
@@ -103,9 +106,8 @@ ssr = [
 [dev-dependencies]
 proptest = "1"
-[[bin]]
+[[test]]
-name = "question_lint"
+name = "jetstream"
 path = "src/bin/question_lint.rs"
 required-features = ["ssr"]
 [profile.wasm-release]
@@ -131,6 +133,12 @@ bin-default-features = false
 lib-features = ["hydrate"]
 lib-default-features = false
 lib-profile-release = "wasm-release"
 # Content-hashed pkg names (portal.<hash>.js/wasm/css) + hash.txt: a
 # freshly served page can never reference a stale cached bundle - an
 # iPhone kept a heuristically-cached portal.js across three releases
 # and paired it with new wasm, silently killing hydration. Runtime
 # needs LEPTOS_HASH_FILES=true (set in each content repo's deploy env).
 hash-files = true
 # cargo release <level> is how a portal version is cut: bump, commit,
 # tag v{{version}}, push. CI (publish.yml) reacts to the tag and
@@ -8,9 +8,12 @@ serves is declared in its content repo, and the same build serves any
 number of sites.
 Point an instance at a content repo and that repo *is* the site:
-pages, copy, state graphs, and branding (`site.yaml`: title,
+pages, copy, state graphs, branding, and even the landing hero
-wordmark, and which hero the landing page opens on — the YES canvas,
+(`site.yaml`: title, wordmark, and `hero: {kind: module, module:
-a gesture-drawing canvas wired to a relay, or plain copy). Content
+hero.js}` — a JavaScript module the content repo ships, served
 same-origin at `/site/<path>`, that portal mounts at parse time and
 stops on navigation; the YES canvas and redoal's sine swings are both
 content, not engine). Content
 pushes hot-reload every running instance; instances differ only by
 env vars. [uhhm.no](https://uhhm.no)
 ([uhhm/questions](https://project.uhhm.no/uhhm/questions)) and
@@ -27,7 +30,7 @@ stream.
 ## What the engine provides
- **Content-driven pages** (`src/content.rs`, `src/app.rs`): YAML
+- **Content-driven pages** (`src/content/`, `src/app.rs`): YAML
  loaded from Gitea at boot and hot-swapped on a NATS reload signal;
  a bad push keeps the last-good content serving. The `questions/`
  tree IS the router — file paths become URLs, `_section.yaml`
@@ -36,6 +39,23 @@ stream.
  `requires_chain` gates a page on verifiable answer provenance next
  to `qualifies`' Kanidm-group identity gate (see
  `docs/design/filesystem-routes.md`).
 - **Gesture and voice fields** (`gesture.js`, `voice.js`): a stroke
  becomes a redoal gesture key through a relay (ADR-0013/0015 in the
  redoal repo) - the input shows the key's own decode under the
  stroke, who is at a similar shape now, and *places* with recordings
  the visitor can pick to make that key theirs; a voice field records
  in the browser and leaves the audio at a key. Actions may be
  templated from the answer (`/shape/{curve.key}`) onto dynamic
  pages, whose URL segment also fills `value: "{key}"` presets and
  `url` resource sources; resource items with an https `audio` field
  render a player.
 - **Announced pages** (`src/announce.rs`): a question with an
  `event: {starts, duration, place}` window is announced in the
  header (not the footer nav) while the window is open, becomes a
  followup when it closes, and its record in the runtime-owned
  `portal_events` bucket moves to `awaiting_summary` - a "post what
  happened" task any review desk can read, published on NATS like a
  decision. A one-minute sweeper keeps it all idempotent.
 - **State machines as content** (`src/aggregates/`): `aggregates.yaml`
  declares each bucket's states and legal transitions; the engine
  replays a record's event history and refuses undeclared moves, with
@@ -50,7 +70,17 @@ stream.
 - **Answer chains** (`src/chain.rs`): each submission hashes its
  parent(s), so a visitor's path through the questions is a verifiable
  lineage; `?chain=` links carry it, and self-service transitions
-  (unsubscribe) authorize by holding one.
+  (unsubscribe) authorize by holding one. The question nav reads it
  too: a `followup` page is offered only once the visitor has earned
  it - the chain verifiably answered the alternative that leads there,
  or it hangs off an earned page by a link that records nothing. A
  page behind an answer they have not given is never offered.
 - **Business needs as a checkable spec** (in
  [uhhm/iris](https://project.uhhm.no/uhhm/iris)): a content repo may
  ship a `needs.yaml` saying who wants what, which bucket the answer
  must land in, and which group has to carry it to a finished state.
  `iris check` proves the site meets it. The runtime never reads the
  file; portal only provides the content types iris reads.
 - **Live resources** (`src/resource.rs`): content can pull a KV
  bucket, Gitea starred/org repos/releases, or any public JSON URL
  (SSRF fail-closed), reshaped by a content-declared `jq` filter.
@@ -67,17 +97,18 @@ stream.
 ## Binaries
 - `portal` — the server (Leptos SSR + hydrate, Axum underneath).
- `question_lint` — headless content validation, shipped inside every
+- `iris` — the lint, from [uhhm/iris](https://project.uhhm.no/uhhm/iris),
-  release artifact so each content repo's CI lints with the exact
+  which depends on this crate as a library pinned to a release tag.
-  portal version its instance runs; also works offline:
+  Every release tarball ships the matching `iris` binary
-  `question_lint --path <dir>`.
+  (`IRIS_RELEASE` in `publish.yml`), so each content repo's CI can
  lint with the exact portal version its instance runs:
  `iris check --path <dir>`.
 ## Development
 ```sh
 cargo leptos build            # full app (server + wasm)
-cargo test --features ssr     # engine tests
+cargo test --features ssr     # engine tests; tests/jetstream.rs needs PORTAL_TEST_NATS_URL
 cargo build --features ssr --bin question_lint
 ```
 Runtime configuration is env vars (see `src/main.rs`, and each
@@ -101,10 +132,18 @@ cargo release patch        # or minor / major
 That bumps `Cargo.toml`, tags `v<version>`, and pushes; CI
 (`.gitea/workflows/publish.yml`) reacts to the tag, builds once, and
-attaches `portal-v<version>.tar.gz` (`portal` + `question_lint` +
+attaches `portal-v<version>.tar.gz` (`portal` + `iris` +
-`site/`) to the Gitea release. Plain pushes to `main` only run the
+`hash.txt` + `site/`) to the Gitea release. Pkg files are
 content-hashed (`hash-files = true`; instances run with
 `LEPTOS_HASH_FILES=true`), so a freshly served page can never pair a
 stale cached bundle with new wasm. Plain pushes to `main` only run the
 tests (`test.yml`) — nothing reaches production from this repo.
 Before cutting, move the `Unreleased` lines in `CHANGELOG.md` under a
 heading for the new version. That section becomes the Gitea release
 notes, and the table at the end of the file records which version each
 site runs; update it when a pin moves.
 **Roll it out** (in a content repo): edit one line in that repo's
 `.gitea/workflows/deploy.yml` —
@@ -12,8 +12,10 @@
 //
 // When a relay URL is given, the widget also speaks the redoal-relay
 // protocol (ADR-0013 in the redoal repo): announce the stroke, receive
-// an ack carrying the stroke's gesture key + the key's own decoded
+// an ack carrying the stroke's gesture key plus the key's own decoded
-// path ("what the network heard", drawn as a ghost), and receive
+// path - "what the network heard", drawn as a ghost under the stroke
 // when the key is v2 or later (ADR-0014's ordered turning chain; a v1
 // key's histogram decode is a blob and stays hidden) - and receive
 // echoes of similar strokes other visitors drew, shown as thumbnails.
 // Everything network is best-effort: no relay, refused connection, or
 // a dropped socket all degrade to a plain offline drawing input.
@@ -26,13 +28,13 @@
 const THEMES = {
    dark: {
        stroke: '#8ec2c0',
        ghost: 'rgba(255, 255, 255, 0.28)',
        echo: '#8ec2c0',
        ghost: 'rgba(255, 255, 255, 0.28)',
    },
    light: {
        stroke: '#47807e',
        ghost: 'rgba(29, 29, 27, 0.30)',
        echo: '#47807e',
        ghost: 'rgba(29, 29, 27, 0.30)',
    },
 };
@@ -41,15 +43,87 @@ const MAX_ECHOES = 8;
 const RECONNECT_BASE_MS = 1000;
 const RECONNECT_MAX_MS = 30000;
 // ── Convergence animation (ink → what the network heard) ──────────
 //
 // When the ack lands, a glowing copy of the stroke peels off and
 // converges point-by-point onto the key's decoded path: a wave of
 // "being understood" travels from the stroke's start to its end,
 // and the ghost materializes where the light settles. WebGL point
 // sprites with additive glow on a dedicated overlay canvas; the 2d
 // layer underneath never changes its final render, so losing WebGL
 // (or prefers-reduced-motion) degrades to exactly today's behavior.
 const CONVERGE_MS = 1500;
 const CONVERGE_FADE_MS = 450;
 const CONVERGE_POINTS = 128;
 const CONVERGE_STAGGER = 0.6; // fraction of the timeline spent on the travelling wave
 const GLOW_VERT = `
 attribute vec2 aFrom;
 attribute vec2 aTo;
 attribute float aIndex;
 uniform float uT;
 uniform vec2 uResolution;
 uniform float uDpr;
 varying float vLife;
 void main() {
    float lead = aIndex * ${CONVERGE_STAGGER};
    float p = clamp((uT * ${1.0 + CONVERGE_STAGGER} - lead), 0.0, 1.0);
    float e = p < 0.5 ? 4.0 * p * p * p : 1.0 - pow(-2.0 * p + 2.0, 3.0) / 2.0;
    vec2 pos = mix(aFrom, aTo, e);
    vec2 clip = (pos / uResolution) * 2.0 - 1.0;
    gl_Position = vec4(clip.x, -clip.y, 0.0, 1.0);
    float pulse = 1.0 + 1.4 * sin(3.14159 * p);
    gl_PointSize = 9.0 * uDpr * pulse;
    vLife = p;
 }`;
 const GLOW_FRAG = `
 precision mediump float;
 uniform vec3 uColor;
 uniform float uAlpha;
 varying float vLife;
 void main() {
    vec2 d = gl_PointCoord - 0.5;
    float fall = exp(-dot(d, d) * 18.0);
    float breathe = 0.55 + 0.45 * sin(3.14159 * vLife);
    gl_FragColor = vec4(uColor, 1.0) * (fall * uAlpha * breathe);
 }`;
 // Uniform arc-length resample of a pixel-space polyline to n points.
 function resamplePx(points, n) {
    if (points.length === 1) return Array(n).fill(points[0]);
    const dists = [0];
    for (let i = 1; i < points.length; i++) {
        const dx = points[i][0] - points[i - 1][0];
        const dy = points[i][1] - points[i - 1][1];
        dists.push(dists[i - 1] + Math.hypot(dx, dy));
    }
    const total = dists[dists.length - 1] || 1;
    const out = [];
    let seg = 0;
    for (let i = 0; i < n; i++) {
        const target = (i / (n - 1)) * total;
        while (seg < points.length - 2 && dists[seg + 1] < target) seg++;
        const span = dists[seg + 1] - dists[seg] || 1;
        const t = (target - dists[seg]) / span;
        out.push([
            points[seg][0] + (points[seg + 1][0] - points[seg][0]) * t,
            points[seg][1] + (points[seg + 1][1] - points[seg][1]) * t,
        ]);
    }
    return out;
 }
 class GestureWidget {
-    constructor(container, hidden, relayUrl, hero) {
+    constructor(container, hidden, relayUrl) {
        this.container = container;
        this.hidden = hidden || null;
        this.relayUrl = relayUrl || '';
        this.hero = !!hero;
        this.points = [];
        this.ghost = null;
-        this.ambient = []; // hero mode: echoed strokes drawn in place
+        this.ownKey = null;
        this.selected = null; // {key, path, distance} - a place the visitor picked
        this.seenKeys = new Set();
        this.points = [];
        this.drawing = false;
        this.stopped = false;
        this.ws = null;
@@ -60,11 +134,25 @@ class GestureWidget {
        this.canvas = document.createElement('canvas');
        this.canvas.className = 'gesture-canvas';
        container.appendChild(this.canvas);
-        if (!this.hero) {
+        // Overlay for the convergence glow; sized with the main canvas,
-            this.echoes = document.createElement('div');
+        // inert to pointers, empty until an ack arrives.
-            this.echoes.className = 'gesture-echoes';
+        this.glow = document.createElement('canvas');
-            container.appendChild(this.echoes);
+        this.glow.className = 'gesture-glow';
-        }
+        this.glow.style.position = 'absolute';
        this.glow.style.pointerEvents = 'none';
        if (!container.style.position) container.style.position = 'relative';
        container.appendChild(this.glow);
        this.gl = null;
        this.animFrame = null;
        this.converging = false;
        this.echoes = document.createElement('div');
        this.echoes.className = 'gesture-echoes';
        this.echoes.setAttribute('role', 'listbox');
        this.echoes.setAttribute('aria-label', 'places near your shape');
        container.appendChild(this.echoes);
        this.empty = document.createElement('p');
        this.empty.className = 'gesture-empty';
        container.appendChild(this.empty);
        if (this.relayUrl) {
            this.status = document.createElement('span');
            this.status.className = 'gesture-status offline';
@@ -104,6 +192,13 @@ class GestureWidget {
        this.ctx.scale(dpr, dpr);
        this.cssWidth = rect.width;
        this.cssHeight = rect.height;
        this.glow.style.left = `${this.canvas.offsetLeft}px`;
        this.glow.style.top = `${this.canvas.offsetTop}px`;
        this.glow.style.width = `${rect.width}px`;
        this.glow.style.height = `${rect.height}px`;
        this.glow.width = this.canvas.width;
        this.glow.height = this.canvas.height;
        this.cancelConvergence(); // buffers are in old pixels
    }
    pos(e) {
@@ -115,11 +210,16 @@ class GestureWidget {
        e.preventDefault();
        this.canvas.setPointerCapture(e.pointerId);
        // One stroke only - a new pointerdown replaces the old drawing
-        // (and any ghost/ambient trails from the previous round).
+        // (and any ghost from the previous round).
        this.drawing = true;
-        this.points = [this.pos(e)];
+        this.cancelConvergence();
        this.ghost = null;
-        this.ambient = [];
+        this.ownKey = null;
        this.selected = null;
        this.seenKeys.clear();
        this.echoes.replaceChildren();
        this.empty.textContent = '';
        this.points = [this.pos(e)];
        this.render();
    }
@@ -217,28 +317,77 @@ class GestureWidget {
            return;
        }
        if (msg.type === 'ack') {
-            if (this.points.length >= 2) {
+            this.ownKey = msg.key;
-                this.setValue({ points: this.normalized(), key: msg.key });
+            // Version nibble is the key's first hex digit.
-            }
+            const version = parseInt((msg.key || '0')[0], 16);
-            this.ghost = msg.path;
+            this.ownGhost = version >= 2 && Array.isArray(msg.path) ? msg.path : null;
-            this.render();
+            this.applySelection();
-        } else if (msg.type === 'echo') {
+            // Places arrive right after the ack; say so if none do.
-            if (this.hero) {
+            clearTimeout(this.emptyTimer);
-                this.ambient.push(msg.path);
+            this.emptyTimer = setTimeout(() => {
-                if (this.ambient.length > MAX_ECHOES) this.ambient.shift();
+                if (!this.echoes.children.length) this.empty.textContent = msg.empty || 'Nothing kept at this shape yet.';
-                this.render();
+            }, 1500);
-            } else {
+        } else if (msg.type === 'echo' || msg.type === 'place') {
-                this.addEchoThumbnail(msg);
+            if (!msg.key || this.seenKeys.has(msg.key)) return;
-            }
+            this.seenKeys.add(msg.key);
            this.empty.textContent = '';
            this.addEchoThumbnail(msg);
        }
        // 'error' frames are intentionally silent: the widget is a
        // form field first, and a rate-limited announce shouldn't
        // alarm anyone mid-form.
    }
    // The key the input carries: the visitor's own, or the place they
    // picked (selection re-derives the key - the ghost under the
    // stroke becomes that place's decode, and the answer records both).
    applySelection() {
        if (this.points.length < 2) return;
        const points = this.normalized();
        const before = this.ghost;
        if (this.selected) {
            this.ghost = this.selected.path;
            this.setValue({ points, key: this.selected.key, own_key: this.ownKey, selected_from: this.ownKey, selected_distance: this.selected.distance });
        } else {
            this.ghost = this.ownGhost || null;
            this.setValue({ points, key: this.ownKey });
        }
        if (this.ghost && this.ghost !== before) this.startConvergence(this.ghost);
        for (const el of this.echoes.children) {
            el.classList.toggle('selected', !!this.selected && el.dataset.key === this.selected.key);
            el.setAttribute('aria-selected', String(!!this.selected && el.dataset.key === this.selected.key));
        }
        this.render();
    }
    select(thumb) {
        const key = thumb.dataset.key;
        if (this.selected && this.selected.key === key) {
            this.selected = null;
        } else {
            this.selected = { key, path: JSON.parse(thumb.dataset.path), distance: Number(thumb.dataset.distance) };
            // The relay counts picks per place for ranking.
            if (this.ws && this.ws.readyState === WebSocket.OPEN && this.ownKey) {
                this.ws.send(JSON.stringify({ type: 'select', key, from: this.ownKey, distance: this.selected.distance }));
            }
        }
        this.applySelection();
    }
    addEchoThumbnail(msg) {
        const thumb = document.createElement('canvas');
-        thumb.className = 'gesture-echo';
+        thumb.className = 'gesture-echo' + (msg.type === 'place' ? ' place' : '');
        thumb.dataset.key = msg.key;
        thumb.dataset.path = JSON.stringify(msg.path || []);
        thumb.dataset.distance = String(msg.distance || 0);
        thumb.setAttribute('role', 'option');
        thumb.setAttribute('tabindex', '0');
        thumb.setAttribute('aria-selected', 'false');
        thumb.title = msg.type === 'place'
            ? `A place with ${msg.recordings || 0} recording${msg.recordings === 1 ? '' : 's'} - tap to make it your address`
            : 'Someone at this shape right now';
        thumb.addEventListener('click', () => this.select(thumb));
        thumb.addEventListener('keydown', (e) => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); this.select(thumb); } });
        // Closer strokes render stronger; 500 is comfortably past the
        // relay's default threshold, so everything stays visible.
        const strength = Math.max(0.35, Math.min(1, 1 - msg.distance / 500));
@@ -260,6 +409,140 @@ class GestureWidget {
        setTimeout(() => thumb.classList.add('shown'), 30);
    }
    // ── Convergence ────────────────────────────────────────────────
    initGlow() {
        if (this.gl) return this.gl;
        const gl = this.glow.getContext('webgl', { alpha: true, premultipliedAlpha: true });
        if (!gl) return null;
        const compile = (type, src) => {
            const s = gl.createShader(type);
            gl.shaderSource(s, src);
            gl.compileShader(s);
            return s;
        };
        const prog = gl.createProgram();
        gl.attachShader(prog, compile(gl.VERTEX_SHADER, GLOW_VERT));
        gl.attachShader(prog, compile(gl.FRAGMENT_SHADER, GLOW_FRAG));
        gl.linkProgram(prog);
        if (!gl.getProgramParameter(prog, gl.LINK_STATUS)) return null;
        gl.useProgram(prog);
        this.gl = gl;
        this.glProg = prog;
        this.glLoc = {
            aFrom: gl.getAttribLocation(prog, 'aFrom'),
            aTo: gl.getAttribLocation(prog, 'aTo'),
            aIndex: gl.getAttribLocation(prog, 'aIndex'),
            uT: gl.getUniformLocation(prog, 'uT'),
            uResolution: gl.getUniformLocation(prog, 'uResolution'),
            uDpr: gl.getUniformLocation(prog, 'uDpr'),
            uColor: gl.getUniformLocation(prog, 'uColor'),
            uAlpha: gl.getUniformLocation(prog, 'uAlpha'),
        };
        this.glBufFrom = gl.createBuffer();
        this.glBufTo = gl.createBuffer();
        this.glBufIndex = gl.createBuffer();
        return gl;
    }
    // The ghost's pixel frame - same fit drawPath uses.
    ghostToPx(path) {
        const scale = (Math.min(this.cssWidth, this.cssHeight) / 2) * 0.8;
        const cx = this.cssWidth / 2, cy = this.cssHeight / 2;
        return path.map(([x, y]) => [cx + x * scale, cy + y * scale]);
    }
    startConvergence(targetPath) {
        this.cancelConvergence();
        if (!targetPath || this.points.length < 2) return;
        if (window.matchMedia('(prefers-reduced-motion: reduce)').matches) return;
        const gl = this.initGlow();
        if (!gl) return;
        const dpr = window.devicePixelRatio || 1;
        const from = resamplePx(this.points.map((p) => [p.x, p.y]), CONVERGE_POINTS);
        const to = resamplePx(this.ghostToPx(targetPath), CONVERGE_POINTS);
        const f = new Float32Array(CONVERGE_POINTS * 2);
        const t = new Float32Array(CONVERGE_POINTS * 2);
        const idx = new Float32Array(CONVERGE_POINTS);
        for (let i = 0; i < CONVERGE_POINTS; i++) {
            f[i * 2] = from[i][0] * dpr;
            f[i * 2 + 1] = from[i][1] * dpr;
            t[i * 2] = to[i][0] * dpr;
            t[i * 2 + 1] = to[i][1] * dpr;
            idx[i] = i / (CONVERGE_POINTS - 1);
        }
        const bind = (buf, data, loc, size) => {
            gl.bindBuffer(gl.ARRAY_BUFFER, buf);
            gl.bufferData(gl.ARRAY_BUFFER, data, gl.STATIC_DRAW);
            gl.enableVertexAttribArray(loc);
            gl.vertexAttribPointer(loc, size, gl.FLOAT, false, 0, 0);
        };
        gl.useProgram(this.glProg);
        bind(this.glBufFrom, f, this.glLoc.aFrom, 2);
        bind(this.glBufTo, t, this.glLoc.aTo, 2);
        bind(this.glBufIndex, idx, this.glLoc.aIndex, 1);
        gl.viewport(0, 0, this.glow.width, this.glow.height);
        gl.uniform2f(this.glLoc.uResolution, this.glow.width, this.glow.height);
        gl.uniform1f(this.glLoc.uDpr, dpr);
        const light = this._themeQuery.matches;
        const color = light ? [0x47 / 255, 0x80 / 255, 0x7e / 255] : [0x8e / 255, 0xc2 / 255, 0xc0 / 255];
        gl.uniform3f(this.glLoc.uColor, color[0], color[1], color[2]);
        // Additive light on the dark ground; normal ink on the light one.
        gl.enable(gl.BLEND);
        if (light) gl.blendFunc(gl.SRC_ALPHA, gl.ONE_MINUS_SRC_ALPHA);
        else gl.blendFunc(gl.ONE, gl.ONE);
        this.converging = true;
        this.render();
        const started = performance.now();
        const step = (now) => {
            const raw = (now - started) / CONVERGE_MS;
            if (raw >= 1) {
                // Deposit the ghost, then let the glow breathe out.
                if (this.converging) {
                    this.converging = false;
                    this.render();
                }
                const fade = (now - started - CONVERGE_MS) / CONVERGE_FADE_MS;
                if (fade >= 1) {
                    this.cancelConvergence();
                    return;
                }
                gl.clearColor(0, 0, 0, 0);
                gl.clear(gl.COLOR_BUFFER_BIT);
                gl.uniform1f(this.glLoc.uT, 1);
                gl.uniform1f(this.glLoc.uAlpha, 0.32 * (1 - fade));
                gl.drawArrays(gl.POINTS, 0, CONVERGE_POINTS);
            } else {
                gl.clearColor(0, 0, 0, 0);
                gl.clear(gl.COLOR_BUFFER_BIT);
                // Trailing passes give the wave a comet tail.
                for (const [lag, alpha] of [[0, 0.32], [0.035, 0.16], [0.07, 0.08], [0.105, 0.04]]) {
                    gl.uniform1f(this.glLoc.uT, Math.max(0, raw - lag));
                    gl.uniform1f(this.glLoc.uAlpha, alpha);
                    gl.drawArrays(gl.POINTS, 0, CONVERGE_POINTS);
                }
            }
            this.animFrame = requestAnimationFrame(step);
        };
        this.animFrame = requestAnimationFrame(step);
    }
    cancelConvergence() {
        if (this.animFrame) cancelAnimationFrame(this.animFrame);
        this.animFrame = null;
        if (this.converging) {
            this.converging = false;
            this.render();
        }
        if (this.gl) {
            this.gl.clearColor(0, 0, 0, 0);
            this.gl.clear(this.gl.COLOR_BUFFER_BIT);
        }
    }
    // ── Rendering ──────────────────────────────────────────────────
    // Draw a normalized (-1..1) path fitted into w×h with padding.
@@ -284,12 +567,7 @@ class GestureWidget {
        if (!this.ctx) return;
        const t = this.theme();
        this.ctx.clearRect(0, 0, this.cssWidth, this.cssHeight);
-        for (const path of this.ambient) {
+        if (this.ghost && !this.converging) {
            this.ctx.globalAlpha = 0.25;
            this.drawPath(this.ctx, path, this.cssWidth, this.cssHeight, t.echo, 1.5, 0.2);
        }
        this.ctx.globalAlpha = 1;
        if (this.ghost) {
            this.drawPath(this.ctx, this.ghost, this.cssWidth, this.cssHeight, t.ghost, 2, 0.2);
        }
        if (this.points.length >= 1) {
@@ -308,6 +586,8 @@ class GestureWidget {
    stop() {
        this.stopped = true;
        if (this.animFrame) cancelAnimationFrame(this.animFrame);
        clearTimeout(this.emptyTimer);
        if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
        if (this.ws) {
            // The close event still fires, but scheduleReconnect
@@ -325,11 +605,8 @@ class GestureWidget {
 }
 export function mountGesture(container, hidden, relayUrl) {
-    return new GestureWidget(container, hidden, relayUrl, false);
+    // Dev convenience: `?relay=ws://127.0.0.1:9040` points every widget
-}
+    // on the page at a local relay (prod relays reject foreign Origins).
-
+    const override = new URLSearchParams(window.location.search).get('relay');
-// Hero variant: no form field to mirror into, and echoes render as
+    return new GestureWidget(container, hidden, override || relayUrl);
 // ambient strokes on the drawing canvas itself instead of thumbnails.
 export function mountGestureHero(container, relayUrl) {
    return new GestureWidget(container, null, relayUrl, true);
 }
@@ -1,578 +0,0 @@
 // Ported from ~/repos/webpage/content/visualize/ah.html ("YES - Rasterized
 // Lines"), the piece currently live at uhhm.no - kept as the actual asset,
 // not reinvented. Two changes from the original: exported as a class (no
 // auto-init on `window load`, since Leptos controls when this mounts) and
 // a `stop()` method that actually breaks the requestAnimationFrame loop -
 // the original ran forever once started, fine for a static page that's
 // the whole document, not fine in an SPA where this hero mounts/unmounts
 // as you navigate.
 export class RasterizedYES {
    constructor() {
        this.rasterCanvas = document.getElementById('rasterCanvas');
        this.lineCanvas = document.getElementById('lineCanvas');
        // The Rust side only constructs this once it's confirmed (via a
        // NodeRef) that the canvas is mounted, but that guard has shown
        // a real gap on fast client-side re-navigation back to `/` -
        // this is the actual failure point, so it gets its own defense
        // rather than depending on getting that timing exactly right
        // from the other side of the wasm boundary. Leaving the
        // instance otherwise-inert (no crash, no animation) rather than
        // throwing mid-render - `stop()` already tolerates a partially
        // (non-)initialized instance.
        if (!this.rasterCanvas || !this.lineCanvas) {
            console.warn('RasterizedYES: canvas not in DOM yet, skipping');
            this.destroyed = true;
            return;
        }
        this.rasterCtx = this.rasterCanvas.getContext('2d');
        this.lineCtx = this.lineCanvas.getContext('2d');
        this.lines = [];
        this.rasterData = null;
        this.isActive = true;
        this.destroyed = false;
        this.time = 0;
        this.containmentStrength = 0.5;
        this.wiggleAmount = 0.5;
        // .hero-canvas is inset:0 inside this - freezing an inline
        // height here (below) is what actually locks the box, not
        // just reading its rect.
        this.heroEl = this.rasterCanvas.closest('.hero');
        this.setupCanvas();
        this.setupResizeHandler();
        this.setupDrift();
        this.setupTheme();
        this.setupScrollFade();
        this.setupClickHandler();
        this.rasterizeText();
        this.initializeLines();
        this.animate();
    }
    stop() {
        this.destroyed = true;
        if (this._resizeHandler) {
            window.removeEventListener('resize', this._resizeHandler);
        }
        if (this._themeQuery) {
            this._themeQuery.removeEventListener('change', this._themeHandler);
        }
        if (this._scrollHandler) {
            window.removeEventListener('scroll', this._scrollHandler);
        }
    }
    // The hero is position: sticky (main.css), so without this the
    // title/wordmark stay pinned at the viewport bottom for the whole
    // page and ghost through the translucent cards scrolling over
    // them. Fade the copy out across the first half-screen of scroll;
    // visibility: hidden at the end so the wordmark link can't be
    // clicked while invisible.
    setupScrollFade() {
        this.heroCopy = this.heroEl ? this.heroEl.querySelector('.hero-copy') : null;
        if (!this.heroCopy) return;
        this._scrollHandler = () => {
            const opacity = Math.max(0, 1 - window.scrollY / (this.displayHeight * 0.5));
            this.heroCopy.style.opacity = opacity;
            this.heroCopy.style.visibility = opacity <= 0.01 ? 'hidden' : '';
        };
        window.addEventListener('scroll', this._scrollHandler, { passive: true });
        this._scrollHandler();
    }
    // Canvas paint can't read CSS custom properties, so the piece
    // carries its own copy of both palettes and follows
    // prefers-color-scheme itself - values must track main.css's :root
    // (--paper especially: the fade fill IS the page background where
    // the canvas shows through translucent cards). Dark keeps the
    // original neon-on-black inks; light restates them as CMYK process
    // inks dark enough to carry on paper, since 80%-lightness pastels
    // vanish on white.
    setupTheme() {
        this._themeQuery = window.matchMedia('(prefers-color-scheme: light)');
        this._themeHandler = () => {
            this.applyTheme();
            // Repaint the raster ghost in the new theme's ink and
            // hard-clear the trails - a slow 3%-alpha fade from the
            // old paper color would smear across the flip otherwise.
            this.rasterizeText();
            this.lineCtx.fillStyle = this.theme.paper;
            this.lineCtx.fillRect(0, 0, this.displayWidth, this.displayHeight);
        };
        this._themeQuery.addEventListener('change', this._themeHandler);
        this.applyTheme();
    }
    applyTheme() {
        this.theme = this._themeQuery.matches
            ? {
                paper: '#f6f5f1',
                fade: 'rgba(246, 245, 241, 0.03)',
                // White ground so multiply (the light theme's CSS
                // blend mode for #rasterCanvas) leaves the paper
                // untouched; gray ink becomes the faint YES ghost.
                rasterBg: '#ffffff',
                rasterInk: '#6b6b6b',
                strokes: [
                    'hsla(185, 70%, 32%, 0.85)',
                    'hsla(315, 60%, 38%, 0.85)',
                    'hsla(50, 90%, 40%, 0.85)'
                ]
            }
            : {
                paper: '#0a0a0a',
                fade: 'rgba(10, 10, 10, 0.03)',
                rasterBg: '#111111',
                rasterInk: '#ffffff',
                strokes: [
                    'hsla(180, 90%, 80%, 0.8)',
                    'hsla(300, 90%, 80%, 0.8)',
                    'hsla(60, 90%, 80%, 0.8)'
                ]
            };
    }
    // Reading .hero-canvas's rendered rect (a prior attempt at this)
    // only helps if that rect actually stays put - and on real mobile
    // Safari it didn't: .hero-copy (bottom-aligned via flexbox inside
    // .hero-yes) kept sliding down as the address bar collapsed, even
    // with a spec'd-stable viewport unit (svh, then lvh) driving the
    // box's height. Either the browser isn't holding up its end, or
    // something in the cascade is still landing on a live value - not
    // provable from here without the device. Rather than keep
    // guessing at which CSS viewport unit actually holds still, yes.js
    // becomes the source of truth instead: it freezes .hero-yes's
    // rendered height to a literal inline px value once, up front. An
    // inline style always wins the cascade over the stylesheet's
    // `height: 100svh`, so once this runs, nothing the browser does
    // with that unit afterward can move the box - the number is fixed
    // in the DOM, not recomputed from a unit at all.
    setupCanvas() {
        const pixelRatio = window.devicePixelRatio || 1;
        const width = window.innerWidth;
        const height = window.innerHeight;
        if (this.heroEl) {
            this.heroEl.style.height = height + 'px';
        }
        this.rasterCanvas.style.width = width + 'px';
        this.rasterCanvas.style.height = height + 'px';
        this.lineCanvas.style.width = width + 'px';
        this.lineCanvas.style.height = height + 'px';
        this.rasterCanvas.width = width * pixelRatio;
        this.rasterCanvas.height = height * pixelRatio;
        this.lineCanvas.width = width * pixelRatio;
        this.lineCanvas.height = height * pixelRatio;
        this.rasterCtx.scale(pixelRatio, pixelRatio);
        this.lineCtx.scale(pixelRatio, pixelRatio);
        this.displayWidth = width;
        this.displayHeight = height;
        this.pixelRatio = pixelRatio;
    }
    setupResizeHandler() {
        // Gate on width, not height: mobile Safari's address-bar
        // animation changes window.innerHeight continuously with no
        // real layout change to react to (that's the live value this
        // whole method exists to stop trusting). A genuine resize -
        // orientation change, desktop window drag - always changes
        // width too, so that's the real signal to re-freeze on.
        this._resizeHandler = () => {
            if (window.innerWidth === this.displayWidth) return;
            this.setupCanvas();
            this.rasterizeText();
        };
        window.addEventListener('resize', this._resizeHandler);
    }
    // The two behavior dials (containmentStrength from x, wiggleAmount
    // from y) used to follow the pointer. Now a smooth noise field
    // wanders them instead - the same 0..1 inputs a mouse would give,
    // but drifting at cloud pace, so the piece breathes on its own and
    // behaves identically with nobody touching it (which on a landing
    // hero is most of the time, and on touch devices was always the
    // case between taps). Value noise with two octaves: smooth
    // (C1-continuous via smoothstep), never repeats visibly, no jumps.
    setupDrift() {
        const channel = (seed) => {
            const rand = (i) => {
                let h = Math.imul(i ^ seed, 2654435761) >>> 0;
                h ^= h >>> 13;
                h = Math.imul(h, 0x5bd1e995) >>> 0;
                // The >>> 0 here is load-bearing: ^ yields a SIGNED
                // 32-bit value, and without the reinterpret a set top
                // bit made this "0..1" noise go as low as -0.5,
                // pushing both dials below their intended floors.
                h = (h ^ (h >>> 15)) >>> 0;
                return h / 4294967296;
            };
            const noise = (t) => {
                const i = Math.floor(t);
                const f = t - i;
                const s = f * f * (3 - 2 * f);
                return rand(i) * (1 - s) + rand(i + 1) * s;
            };
            // Two octaves, renormalized to 0..1: the slow octave sets
            // the overall weather, the faster one keeps it from
            // feeling like a pendulum.
            return (t) => (noise(t) * 2 / 3 + noise(t * 2.7 + 913) * 1 / 3);
        };
        // One full "weather change" roughly every DRIFT_PERIOD
        // seconds per octave - the pace of watching clouds, not of a
        // hand on a mouse.
        this.driftPeriod = 25;
        this.driftX = channel(0x9e3779b9);
        this.driftY = channel(0x85ebca6b);
        this.containmentStrength = 0.55;
        this.wiggleAmount = 1.05;
    }
    updateDrift() {
        const t = this.time / this.driftPeriod;
        const x = this.driftX(t);
        const y = this.driftY(t);
        // Same mapping the mouse position used to feed.
        this.containmentStrength = 0.1 + (x * 0.9);
        this.wiggleAmount = 0.1 + (y * 1.9);
    }
    setupClickHandler() {
        this.lineCanvas.addEventListener('click', () => {
            this.restartAnimation();
        });
    }
    restartAnimation() {
        this.time = 0;
        this.lineCtx.fillStyle = this.theme.paper;
        this.lineCtx.fillRect(0, 0, this.displayWidth, this.displayHeight);
        this.initializeLines();
        this.isActive = true;
    }
    rasterizeText() {
        const width = this.displayWidth;
        const height = this.displayHeight;
        const aspectRatio = width / height;
        let fontSize;
        if (aspectRatio < 1) {
            fontSize = width * 0.4;
        } else {
            fontSize = height * 0.5;
        }
        this.fontSize = fontSize;
        this.rasterCtx.font = `bold ${fontSize}px Arial, sans-serif`;
        this.rasterCtx.textAlign = 'left';
        this.rasterCtx.textBaseline = 'middle';
        const fullTextMetrics = this.rasterCtx.measureText('YES');
        const textWidth = fullTextMetrics.width;
        const textStartX = (width - textWidth) / 2;
        const textY = height / 2;
        const letters = ['Y', 'E', 'S'];
        this.letterPositions = [];
        let currentX = textStartX;
        for (let i = 0; i < letters.length; i++) {
            const letterMetrics = this.rasterCtx.measureText(letters[i]);
            this.letterPositions[i] = {
                x: currentX,
                y: textY,
                width: letterMetrics.width,
                centerX: currentX + letterMetrics.width / 2
            };
            currentX += letterMetrics.width;
        }
        this.letterRasters = [];
        for (let i = 0; i < 3; i++) {
            this.rasterCtx.fillStyle = '#111';
            this.rasterCtx.fillRect(0, 0, width, height);
            this.rasterCtx.fillStyle = '#ffffff';
            this.rasterCtx.fillText(letters[i], this.letterPositions[i].x, this.letterPositions[i].y);
            this.letterRasters[i] = this.rasterCtx.getImageData(0, 0, this.rasterCanvas.width, this.rasterCanvas.height);
        }
        // The visible layer, distinct from the letterRasters sampled
        // above (those stay #111/#fff - isInSpecificLetter's red>128
        // test depends on it): painted in theme ink so the ghost works
        // under the theme's blend mode (overlay on dark, multiply on
        // light - see #rasterCanvas in main.css).
        this.rasterCtx.fillStyle = this.theme.rasterBg;
        this.rasterCtx.fillRect(0, 0, width, height);
        this.rasterCtx.fillStyle = this.theme.rasterInk;
        this.rasterCtx.fillText('YES', textStartX, textY);
        this.rasterData = this.rasterCtx.getImageData(0, 0, this.rasterCanvas.width, this.rasterCanvas.height);
    }
    isInSpecificLetter(x, y, letterIndex) {
        const canvasX = x * this.pixelRatio;
        const canvasY = y * this.pixelRatio;
        if (!this.letterRasters || !this.letterRasters[letterIndex] ||
            canvasX < 0 || canvasY < 0 ||
            canvasX >= this.rasterCanvas.width || canvasY >= this.rasterCanvas.height) {
            return false;
        }
        const index = (Math.floor(canvasY) * this.rasterCanvas.width + Math.floor(canvasX)) * 4;
        const red = this.letterRasters[letterIndex].data[index];
        return red > 128;
    }
    initializeLines() {
        this.lines = [];
        const numLines = 60;
        const letterCentroids = this.calculateLetterCentroids();
        for (let i = 0; i < numLines; i++) {
            const letterIndex = Math.floor(i / (numLines / 3));
            let startX, startY, centerX, centerY;
            if (letterCentroids[letterIndex]) {
                centerX = letterCentroids[letterIndex].x;
                centerY = letterCentroids[letterIndex].y;
                const startVariation = this.fontSize * 0.1;
                startX = centerX + (Math.random() - 0.5) * startVariation;
                startY = centerY + (Math.random() - 0.5) * startVariation;
                if (!this.isInSpecificLetter(startX, startY, letterIndex)) {
                    const nearestPoint = this.findNearestSpecificLetterPixel(startX, startY, letterIndex);
                    if (nearestPoint) {
                        startX = nearestPoint.x;
                        startY = nearestPoint.y;
                    } else {
                        startX = centerX;
                        startY = centerY;
                    }
                }
            } else {
                const letterPos = this.letterPositions[letterIndex];
                startX = letterPos.centerX;
                startY = letterPos.y;
                centerX = startX;
                centerY = startY;
            }
            // Stroke color lives on the theme, looked up per frame by
            // letterIndex (see draw()) - not frozen per line - so a
            // theme flip recolors live lines instead of leaving
            // dark-theme neon smearing across light paper.
            this.lines.push({
                relativeX: (startX - centerX) / this.fontSize,
                relativeY: (startY - centerY) / this.fontSize,
                prevRelativeX: (startX - centerX) / this.fontSize,
                prevRelativeY: (startY - centerY) / this.fontSize,
                angle: Math.random() * Math.PI * 2,
                letterIndex: letterIndex,
                lastSeenInside: { x: (startX - centerX) / this.fontSize, y: (startY - centerY) / this.fontSize },
                outsideDuration: 0
            });
        }
    }
    calculateLetterCentroids() {
        const centroids = [];
        for (let letterIndex = 0; letterIndex < 3; letterIndex++) {
            let sumX = 0, sumY = 0, count = 0;
            const letterPos = this.letterPositions[letterIndex];
            const searchStartX = Math.max(0, letterPos.x - this.fontSize * 0.1);
            const searchEndX = Math.min(this.displayWidth, letterPos.x + letterPos.width + this.fontSize * 0.1);
            const searchStartY = Math.max(0, letterPos.y - this.fontSize * 0.6);
            const searchEndY = Math.min(this.displayHeight, letterPos.y + this.fontSize * 0.6);
            const step = Math.max(1, Math.floor(this.fontSize * 0.02));
            for (let y = searchStartY; y <= searchEndY; y += step) {
                for (let x = searchStartX; x <= searchEndX; x += step) {
                    if (this.isInSpecificLetter(x, y, letterIndex)) {
                        sumX += x;
                        sumY += y;
                        count++;
                    }
                }
            }
            if (count > 0) {
                centroids[letterIndex] = {
                    x: sumX / count,
                    y: sumY / count
                };
            } else {
                centroids[letterIndex] = {
                    x: letterPos.centerX,
                    y: letterPos.y
                };
            }
        }
        return centroids;
    }
    updateLines() {
        this.time += 0.016;
        this.updateDrift();
        if (!this.isActive) return;
        const letterCentroids = this.calculateLetterCentroids();
        this.lines.forEach(line => {
            line.prevRelativeX = line.relativeX;
            line.prevRelativeY = line.relativeY;
            const centroid = letterCentroids[line.letterIndex];
            if (!centroid) return;
            const currentX = centroid.x + line.relativeX * this.fontSize;
            const currentY = centroid.y + line.relativeY * this.fontSize;
            const currentlyInside = this.isInSpecificLetter(currentX, currentY, line.letterIndex);
            if (currentlyInside) {
                line.outsideDuration = 0;
                line.lastSeenInside = { x: line.relativeX, y: line.relativeY };
            } else {
                line.outsideDuration++;
            }
            const visionDistance = 0.08 * this.fontSize;
            const centerX = currentX + Math.cos(line.angle) * visionDistance;
            const centerY = currentY + Math.sin(line.angle) * visionDistance;
            const leftX = currentX + Math.cos(line.angle - 0.4) * visionDistance;
            const leftY = currentY + Math.sin(line.angle - 0.4) * visionDistance;
            const rightX = currentX + Math.cos(line.angle + 0.4) * visionDistance;
            const rightY = currentY + Math.sin(line.angle + 0.4) * visionDistance;
            const centerSees = this.isInSpecificLetter(centerX, centerY, line.letterIndex);
            const leftSees = this.isInSpecificLetter(leftX, leftY, line.letterIndex);
            const rightSees = this.isInSpecificLetter(rightX, rightY, line.letterIndex);
            let speed = 0.02;
            const attractionThreshold = Math.floor(15 + (1 - this.containmentStrength) * 45);
            if (line.outsideDuration > attractionThreshold) {
                const targetX = line.lastSeenInside.x;
                const targetY = line.lastSeenInside.y;
                const deltaX = targetX - line.relativeX;
                const deltaY = targetY - line.relativeY;
                const angleToTarget = Math.atan2(deltaY, deltaX);
                let angleDiff = angleToTarget - line.angle;
                while (angleDiff > Math.PI) angleDiff -= 2 * Math.PI;
                while (angleDiff < -Math.PI) angleDiff += 2 * Math.PI;
                const baseAttraction = Math.min(0.4, line.outsideDuration / 80);
                const attractionStrength = baseAttraction * this.containmentStrength;
                line.angle += angleDiff * attractionStrength;
            }
            if (centerSees) {
                const baseWiggle = 0.15;
                line.angle += (Math.random() - 0.5) * baseWiggle * this.wiggleAmount;
            } else {
                speed *= (0.3 + this.containmentStrength * 0.4);
                const baseTurnStrength = 0.3 + (this.containmentStrength * 0.4);
                const randomTurnAmount = 0.2 * this.wiggleAmount;
                if (leftSees && !rightSees) {
                    line.angle -= baseTurnStrength + Math.random() * randomTurnAmount;
                } else if (rightSees && !leftSees) {
                    line.angle += baseTurnStrength + Math.random() * randomTurnAmount;
                } else {
                    const randomTurn = (Math.random() - 0.5) * (0.8 + this.wiggleAmount * 0.7);
                    line.angle += randomTurn;
                }
            }
            line.relativeX += Math.cos(line.angle) * speed;
            line.relativeY += Math.sin(line.angle) * speed;
            line.relativeX = Math.max(-1.7, Math.min(1.7, line.relativeX));
            line.relativeY = Math.max(-1.7, Math.min(1.7, line.relativeY));
        });
    }
    findNearestSpecificLetterPixel(x, y, letterIndex) {
        const searchRadius = this.fontSize * 0.08;
        const step = Math.max(1, Math.floor(this.fontSize * 0.01));
        let nearestPoint = null;
        let nearestDistance = Infinity;
        for (let dy = -searchRadius; dy <= searchRadius; dy += step) {
            for (let dx = -searchRadius; dx <= searchRadius; dx += step) {
                const testX = x + dx;
                const testY = y + dy;
                if (this.isInSpecificLetter(testX, testY, letterIndex)) {
                    const distance = Math.sqrt(dx * dx + dy * dy);
                    if (distance < nearestDistance) {
                        nearestDistance = distance;
                        nearestPoint = { x: testX, y: testY };
                    }
                }
            }
        }
        return nearestPoint;
    }
    draw() {
        this.lineCtx.fillStyle = this.theme.fade;
        this.lineCtx.fillRect(0, 0, this.displayWidth, this.displayHeight);
        const letterCentroids = this.calculateLetterCentroids();
        this.lines.forEach(line => {
            const centroid = letterCentroids[line.letterIndex];
            if (!centroid) return;
            const currentX = centroid.x + line.relativeX * this.fontSize;
            const currentY = centroid.y + line.relativeY * this.fontSize;
            const prevX = centroid.x + line.prevRelativeX * this.fontSize;
            const prevY = centroid.y + line.prevRelativeY * this.fontSize;
            if (prevX === currentX && prevY === currentY) return;
            this.lineCtx.strokeStyle = this.theme.strokes[line.letterIndex];
            this.lineCtx.lineWidth = this.fontSize * 0.003;
            this.lineCtx.lineCap = 'round';
            this.lineCtx.beginPath();
            this.lineCtx.moveTo(prevX, prevY);
            this.lineCtx.lineTo(currentX, currentY);
            this.lineCtx.stroke();
        });
    }
    animate() {
        if (this.destroyed) return;
        this.updateLines();
        this.draw();
        requestAnimationFrame(() => this.animate());
    }
 }
@@ -0,0 +1,159 @@
 //! Announced pages (`Question.event`): keeps one `portal_events` record
 //! per event question and, once a window closes, moves it to
 //! `awaiting_summary` - the "post what happened" task - publishing the
 //! transition on `portal.answers.submitted` like any desk decision, so
 //! the desktop notifier and n8n hear it. Runs on a one-minute tick;
 //! every step is idempotent, so a restart or a content reload in the
 //! middle changes nothing.
 use crate::answers::{store_answer, Answer};
 use crate::content::EVENTS_BUCKET;
 use crate::events::{emit_answer_submitted, AnswerSubmitted};
 use crate::server::AppState;
 /// Alternative name stamped on the auto-created record and on the
 /// transition event - what an n8n workflow gates on.
 pub const EVENT_ALTERNATIVE: &str = "Announced";
 pub const SUMMARY_DUE_LABEL: &str = "Summary due";
 /// Record id for an event question: its id with `/` folded to `-`
 /// (`/events/opening` -> `events-opening`), so one page is one record
 /// however many times the sweeper runs.
 pub fn record_id(question_id: &str) -> String {
    question_id.trim_matches('/').replace('/', "-")
 }
 pub async fn run(state: AppState) {
    let mut tick = tokio::time::interval(std::time::Duration::from_secs(60));
    loop {
        tick.tick().await;
        if let Err(e) = sweep(&state).await {
            tracing::warn!(error = %e, "event sweep failed");
        }
    }
 }
 /// One pass: create missing records, close ended windows.
 pub async fn sweep(state: &AppState) -> anyhow::Result<()> {
    let now_ms = chrono::Utc::now().timestamp_millis();
    let questions = state.questions.load();
    let events: Vec<_> = questions.values().filter(|q| q.event.is_some()).cloned().collect();
    if events.is_empty() {
        return Ok(());
    }
    let aggregates = state.aggregates.load();
    let schema = aggregates
        .get(EVENTS_BUCKET)
        .ok_or_else(|| anyhow::anyhow!("no {EVENTS_BUCKET} schema"))?;
    let store = match state.jetstream.get_key_value(EVENTS_BUCKET).await {
        Ok(store) => Some(store),
        Err(_) => None,
    };
    for q in events {
        let event = q.event.as_ref().expect("filtered");
        let (starts, ends) = match event.window_ms() {
            Ok(w) => w,
            Err(_) => continue, // validated on load; belt and braces
        };
        let id = record_id(&q.id);
        let existing: Option<Answer> = match &store {
            Some(store) => store
                .get(&id)
                .await?
                .and_then(|bytes| serde_json::from_slice(&bytes).ok()),
            None => None,
        };
        let responses = serde_json::json!({
            "name": q.name,
            "starts": event.starts,
            "starts_ms": starts,
            "ends_ms": ends,
            "place": event.place,
            "page": q.id,
        });
        let answer = match existing {
            None => {
                store_answer(
                    &state.jetstream,
                    &aggregates,
                    EVENTS_BUCKET,
                    id.clone(),
                    &q.id,
                    EVENT_ALTERNATIVE,
                    &responses,
                    now_ms,
                )
                .await?;
                tracing::info!(question = %q.id, "event record created");
                continue;
            }
            Some(a) => a,
        };
        // Content is the source of truth while the window is still
        // open: a corrected date or place flows into the record, so the
        // followup fires on the schedule the page actually announces.
        if answer.state == schema.initial && answer.responses != responses {
            let mut refreshed = answer.clone();
            refreshed.responses = responses.clone();
            if let Some(store) = &store {
                store.put(&id, serde_json::to_vec(&refreshed)?.into()).await?;
                tracing::info!(question = %q.id, "event record refreshed from content");
            }
        }
        if answer.state == schema.initial && now_ms >= ends {
            let target = "awaiting_summary";
            let payload = serde_json::json!({ "to": target, "item": id, "by": "portal" });
            match crate::aggregates::transition(&state.jetstream, schema, &id, target, payload.clone(), now_ms).await {
                Ok(_) => {}
                Err(crate::aggregates::TransitionError::UnknownAggregate) => {
                    crate::aggregates::reseed(&state.jetstream, schema, &id, &answer.state, now_ms)
                        .await
                        .map_err(|e| anyhow::anyhow!("{e}"))?;
                    crate::aggregates::transition(&state.jetstream, schema, &id, target, payload.clone(), now_ms)
                        .await
                        .map_err(|e| anyhow::anyhow!("{e}"))?;
                }
                Err(e) => return Err(anyhow::anyhow!("{e}")),
            }
            let mut answer = answer;
            answer.state = target.to_string();
            answer.decided_ms = Some(now_ms);
            answer.decided_by = Some("portal".to_string());
            let store = state.jetstream.get_key_value(EVENTS_BUCKET).await?;
            store.put(&id, serde_json::to_vec(&answer)?.into()).await?;
            let parent_hashes = vec![id.clone()];
            let chain_hash = crate::chain::hash_node(&q.id, &parent_hashes, &payload, now_ms);
            emit_answer_submitted(
                &state.nats,
                &AnswerSubmitted {
                    chain_hash,
                    parent_hashes,
                    question_id: q.id.clone(),
                    alternative: SUMMARY_DUE_LABEL.to_string(),
                    responses: payload,
                    timestamp_ms: now_ms,
                },
            )
            .await?;
            tracing::info!(question = %q.id, "event ended - summary due");
        }
    }
    Ok(())
 }
 #[cfg(test)]
 mod tests {
    use super::record_id;
    #[test]
    fn record_id_is_stable_and_flat() {
        assert_eq!(record_id("/events/opening"), "events-opening");
        assert_eq!(record_id("/"), "");
        assert_eq!(record_id("/opening"), "opening");
    }
 }
@@ -1,5 +1,5 @@
 use leptos::prelude::*;
-use leptos_meta::{provide_meta_context, MetaTags, Stylesheet, Title};
+use leptos_meta::{provide_meta_context, HashedStylesheet, Html, Link, MetaTags, Stylesheet, Title};
 use leptos_router::{
    components::{Route, Router, Routes},
    hooks::{use_location, use_navigate, use_query_map},
@@ -9,7 +9,8 @@ use serde::{Deserialize, Serialize};
 use crate::answers::{Answer, SelfTransitionAnswer, TransitionAnswers, TransitionItem};
 use crate::auth::{current_user, User};
-use crate::content::{is_qualified, Alternative, Question, Responsible, SiteConfig, Transition};
+use crate::content::{is_qualified, render_inline_markdown, Alternative, Question, Responsible, SiteConfig, Transition};
 use crate::i18n::t;
 use crate::resource::{get_requirement_binding, get_requirement_options, get_resource};
 /// The visible site name/wordmark - "portal" is just this codebase's
@@ -39,6 +40,23 @@ pub fn shell(options: LeptosOptions) -> impl IntoView {
                // once loaded via <link>/<img> on Safari/iOS.
                <link rel="icon" media="(prefers-color-scheme: light)" href="/favicon-light.svg" type="image/svg+xml"/>
                <link rel="icon" media="(prefers-color-scheme: dark)" href="/favicon-dark.svg" type="image/svg+xml"/>
                // Fonts hide behind the stylesheet: the browser must
                // fetch and parse CSS before it discovers them. The
                // latin subset is on every page's critical path, so
                // announce it up front; latin-ext and vietnamese stay
                // unicode-range-gated and load only when script needs
                // them - preloading those would tax everyone for a few.
                // (Font preloads require crossorigin even same-origin.)
                <link
                    rel="preload"
                    href="/fonts/quicksand-semibold-latin.woff2"
                    r#as="font"
                    type="font/woff2"
                    crossorigin="anonymous"
                />
                // Server-side, so it can read hash.txt and link the
                // content-hashed stylesheet (hash-files = true).
                <HashedStylesheet id="leptos" options=options.clone()/>
                <AutoReload options=options.clone()/>
                <HydrationScripts options/>
                <MetaTags/>
@@ -65,9 +83,54 @@ pub fn App() -> impl IntoView {
    // context instead of fetching their own copy.
    let site = Resource::new(|| (), |_| get_site());
    provide_context(site);
    // The chrome's language, from site.yaml (default "en"); content
    // speaks for itself. Components read this via context for t().
    let lang = Memo::new(move |_| {
        site.get()
            .and_then(|r| r.ok())
            .and_then(|s| s.lang)
            .unwrap_or_else(|| "en".to_string())
    });
    provide_context(Lang(lang));
    // A content-shipped stylesheet (site.yaml `stylesheet:`) layered
    // after the default one - leptos_meta appends it at the MetaTags
    // slot, which the shell places after HashedStylesheet, so content
    // rules win at equal specificity.
    let custom_css = Memo::new(move |_| {
        site.get()
            .and_then(|r| r.ok())
            .and_then(|s| s.stylesheet)
            .map(|p| format!("/site/{p}"))
    });
    // The wordmark paints in the hero on first view; announcing it in
    // the head starts the fetch during hydration instead of after. On
    // redoal.com it lives on the content host, so a preconnect opens
    // that TLS session while the preload is still queued.
    let wordmark_href = Memo::new(move |_| {
        site.get().and_then(|r| r.ok()).and_then(|s| s.wordmark)
    });
    let wordmark_origin = Memo::new(move |_| {
        wordmark_href.get().and_then(|w| {
            let rest = w.strip_prefix("https://")?;
            Some(format!("https://{}", rest.split('/').next()?))
        })
    });
    // A content-shipped favicon overrides the built-in one; injected
    // into the head after the static defaults, so it wins.
    let favicon = Memo::new(move |_| {
        site.get()
            .and_then(|r| r.ok())
            .and_then(|s| s.favicon)
            .map(|p| format!("/site/{p}"))
    });
    view! {
-        <Stylesheet id="leptos" href="/pkg/portal.css"/>
+        <Html attr:lang=move || lang.get()/>
        {move || wordmark_origin.get().map(|href| view! { <Link rel="preconnect" href=href crossorigin="anonymous"/> })}
        {move || wordmark_href.get().map(|href| view! { <Link rel="preload" as_="image" href=href/> })}
        {move || custom_css.get().map(|href| view! { <Stylesheet id="site-custom" href=href/> })}
        {move || favicon.get().map(|href| view! { <Link rel="icon" href=href/> })}
        <Suspense fallback=|| ()>
            {move || {
                site.get()
@@ -86,6 +149,15 @@ pub fn App() -> impl IntoView {
    }
 }
 /// The site's chrome language as a context signal - see App.
 #[derive(Clone, Copy)]
 pub struct Lang(pub Memo<String>);
 /// The current chrome language, for `t()` calls inside views.
 fn lang() -> Memo<String> {
    expect_context::<Lang>().0
 }
 /// Every server-fn resource the pages read, created exactly once for
 /// the app's lifetime and handed down via context. Wrapper structs
 /// because a bare `Resource<T>` context is claimed by whoever provides
@@ -96,6 +168,21 @@ struct QuestionRes(Resource<Result<Option<Page>, ServerFnError>>);
 struct UserRes(Resource<Result<Option<User>, ServerFnError>>);
 #[derive(Clone, Copy)]
 struct NavRes(Resource<Result<Vec<(String, String)>, ServerFnError>>);
 #[derive(Clone, Copy)]
 struct AnnounceRes(Resource<Result<Vec<Announcement>, ServerFnError>>);
 /// One live announced page (`Question.event`), pre-formatted on the
 /// server so both renders agree and no client clock is involved.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Announcement {
    pub id: String,
    pub name: String,
    /// "Sat 12 Sep, 18:00"
    pub when: String,
    /// "in 3 days" / "in 4 h" / "now"
    pub relative: String,
    pub place: Option<String>,
 }
 /// Owns the app's data resources, above the routes and reactive on the
 /// location instead of recreated per page. Route components creating
@@ -126,10 +213,15 @@ fn PortalShell() -> impl IntoView {
        |(path, chain)| get_question(path, chain),
    );
    let user = Resource::new(|| (), |_| current_user());
-    let nav = Resource::new(move || chain.get().is_some(), list_qualifying_questions);
+    let nav = Resource::new(
        move || (path.get(), chain.get()),
        |(path, chain)| list_qualifying_questions(path, chain),
    );
    let announcements = Resource::new(|| (), |_| list_announcements());
    provide_context(QuestionRes(question));
    provide_context(UserRes(user));
    provide_context(NavRes(nav));
    provide_context(AnnounceRes(announcements));
    view! {
        <Routes fallback=|| view! { <NotFound/> }>
@@ -216,16 +308,19 @@ fn QuestionView(
                title=question.name.clone()
                description=question.description.clone()
                landing=question_id == "/"
                current_id=question_id.clone()
                site=site.clone()
            />
            <div class="alternatives">
                <section class="alt-card gate-card">
-                    <p>"This page follows from an answer you don't seem to carry yet."</p>
+                    <p>{move || t(&lang().get(), "follows_answer")}</p>
                    <a class="alt-submit" href=target>
                        {label}
                    </a>
                </section>
            </div>
            // A gate is never a dead end: the same nav as every page.
            <QuestionNav current_id=question_id/>
        }
        .into_any();
    }
@@ -240,12 +335,13 @@ fn QuestionView(
                title=question.name.clone()
                description=question.description.clone()
                landing=question_id == "/"
                current_id=question_id.clone()
                site=site.clone()
            />
            <div class="alternatives">
                <section class="alt-card gate-card">
                    {if signed_in {
-                        view! { <p>"This part of the site is for organizational owners — sign in with that account to take a look."</p> }
+                        view! { <p>{move || t(&lang().get(), "owners_only")}</p> }
                            .into_any()
                    } else {
                        view! {
@@ -254,13 +350,14 @@ fn QuestionView(
                                href=format!("/auth/login?redirect={question_id}")
                                rel="external"
                            >
-                                "Sign in"
+                                {move || t(&lang().get(), "sign_in")}
                            </a>
                        }
                            .into_any()
                    }}
                </section>
            </div>
            <QuestionNav current_id=question_id/>
        }
        .into_any();
    }
@@ -270,7 +367,6 @@ fn QuestionView(
    // on pages where some alternative actually declares a deck.
    let needs_swiper = question.alternatives.iter().any(|a| a.images.len() > 1);
    let has_chain = parent_hash.is_some();
    view! {
        {needs_swiper.then(|| view! { <leptos_meta::Script src="/swiper-element-bundle.min.js"/> })}
@@ -279,6 +375,7 @@ fn QuestionView(
            description=question.description.clone()
            landing=question_id == "/"
            site=site.clone()
            current_id=question_id.clone()
        />
        <div class="alternatives">
            <For
@@ -323,7 +420,7 @@ fn QuestionView(
            .map(|r| {
                view! { <ResponsibleNote responsible=r/> }
            })}
-        <QuestionNav current_id=question_id has_chain=has_chain/>
+        <QuestionNav current_id=question_id/>
    }
    .into_any()
 }
@@ -332,8 +429,7 @@ fn QuestionView(
 /// small nav - how a concern reaches the people it speaks to without
 /// claiming front-page space (an owner also sees the gated desks here).
 #[component]
-fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
+fn QuestionNav(current_id: String) -> impl IntoView {
    let _ = has_chain; // keyed into the shared resource by PortalShell
    let NavRes(nav) = expect_context();
    view! {
        <Suspense fallback=|| ()>
@@ -346,7 +442,7 @@ fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
                        .collect();
                    (!others.is_empty()).then(|| view! {
                        <nav class="question-nav">
-                            <span class="question-nav-lead">"Also worth asking"</span>
+                            <span class="question-nav-lead">{move || t(&lang().get(), "also_worth_asking")}</span>
                            <For
                                each=move || others.clone()
                                key=|(id, _)| id.clone()
@@ -362,6 +458,45 @@ fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
    }
 }
 /// Live announced pages, as a strip at the top of the header - the one
 /// place a page gets to claim attention before the question. Empty
 /// (and unrendered) when nothing is announced.
 #[component]
 fn Announcements(current_id: String) -> impl IntoView {
    let AnnounceRes(announcements) = expect_context();
    view! {
        <Suspense fallback=|| ()>
            {move || {
                let current_id = current_id.clone();
                announcements.get().and_then(|res| res.ok()).map(|items| {
                    (!items.is_empty()).then(|| view! {
                        <nav class="announce" aria-label=move || t(&lang().get(), "announcements")>
                            <For
                                each=move || items.clone()
                                key=|a| a.id.clone()
                                children=move |a: Announcement| {
                                    let current = a.id == current_id;
                                    view! {
                                        <a href=a.id.clone() class="announce-item" aria-current=current.then_some("page")>
                                            <span class="announce-name">{a.name}</span>
                                            <span class="announce-when">
                                                {a.when}
                                                {a.place.map(|p| format!(" · {p}"))}
                                            </span>
                                            <span class="announce-relative">{a.relative}</span>
                                        </a>
                                    }
                                    .into_any()
                                }
                            />
                        </nav>
                    })
                })
            }}
        </Suspense>
    }
 }
 /// "Asked by X — contact them if you get stuck."
 /// The mailto address is assembled from `data-user`/`data-domain` on a
 /// real mouse event, never baked into the server-rendered `href` -
@@ -395,41 +530,15 @@ fn ResponsibleNote(responsible: Responsible) -> impl IntoView {
    view! {
        <small class="question-responsible">
-            "Asked by " {responsible.name.clone()} " — "
+            {move || t(&lang().get(), "asked_by")} {responsible.name.clone()} " — "
            <a data-user=user data-domain=domain on:mouseover=assemble on:click=assemble>
-                "contact them"
+                {move || t(&lang().get(), "contact_them")}
            </a>
-            " if you get stuck."
+            {move || t(&lang().get(), "if_stuck")}
        </small>
    }
 }
 // Binds the actual "YES - Rasterized Lines" piece live at uhhm.no
 // (ported to `public/yes.js`, an ES module now instead of a page-owning
 // script) as a typed JS class - the idiomatic wasm-bindgen way to drive
 // an existing JS module from Rust, rather than re-implementing canvas
 // animation logic here.
 #[cfg(feature = "hydrate")]
 mod yes {
    use wasm_bindgen::prelude::*;
    // raw_module (a runtime URL, not a bundled snippet) on purpose:
    // the file lives in public/ so it's served at the stable /yes.js
    // - the same URL the hero's inline early-mount script imports.
    // A bundled snippet would sit under a per-build hashed
    // /pkg/snippets/ path the inline script couldn't know.
    #[wasm_bindgen(raw_module = "/yes.js")]
    extern "C" {
        #[wasm_bindgen(js_name = RasterizedYES)]
        pub type RasterizedYes;
        #[wasm_bindgen(constructor, js_class = "RasterizedYES")]
        pub fn new() -> RasterizedYes;
        #[wasm_bindgen(method)]
        pub fn stop(this: &RasterizedYes);
    }
 }
 // Same idiomatic-typed-module approach as `yes` above, for the
 // prosekit-backed rich-text requirement kind (`prosekit-editor.js`,
@@ -460,6 +569,28 @@ mod prosekit {
 // prosekit's hidden-input bridge for the value, yes.js's typed-handle
 // lifecycle for cleanup - it may own a live WebSocket to a
 // redoal-relay, which SPA navigation must close (`stop()`).
 #[cfg(feature = "hydrate")]
 #[cfg(feature = "hydrate")]
 mod voice {
    use wasm_bindgen::prelude::*;
    #[wasm_bindgen(module = "/voice.js")]
    extern "C" {
        pub type VoiceWidget;
        #[wasm_bindgen(js_name = mountVoice)]
        pub fn mount_voice(
            container: &web_sys::HtmlDivElement,
            hidden: &web_sys::HtmlInputElement,
            relay_url: &str,
            key: &str,
        ) -> VoiceWidget;
        #[wasm_bindgen(method)]
        pub fn stop(this: &VoiceWidget);
    }
 }
 #[cfg(feature = "hydrate")]
 mod gesture {
    use wasm_bindgen::prelude::*;
@@ -475,150 +606,127 @@ mod gesture {
            relay_url: &str,
        ) -> GestureWidget;
        #[wasm_bindgen(js_name = mountGestureHero)]
        pub fn mount_gesture_hero(
            container: &web_sys::HtmlDivElement,
            relay_url: &str,
        ) -> GestureWidget;
        #[wasm_bindgen(method)]
        pub fn stop(this: &GestureWidget);
    }
 }
 #[component]
-fn Hero(title: String, description: String, landing: bool, site: SiteConfig) -> impl IntoView {
+fn Hero(title: String, description: String, landing: bool, site: SiteConfig, current_id: String) -> impl IntoView {
-    // Only the landing page gets a full interactive piece - it's the
+    // Only the landing page gets a piece - it's the one page a hero is
-    // one page a hero is actually "the" hero for; other pages
+    // actually "the" hero for; every other page gets the plain header.
-    // (thank-you pages, /review) get the plain dark header below.
+    // WHAT the piece is belongs to the content repo: site.yaml's
-    // WHICH piece is the content repo's call (`site.yaml`'s
+    // `hero: {kind: module, module: hero.js}` names a JavaScript module
-    // hero.kind): the YES canvas (default - uhhm's look), a redoal
+    // (served same-origin at /site/<path>) exporting
-    // gesture canvas, or nothing.
+    // `mount(container) -> handle` with `handle.stop()`. Portal knows
-    let hero_kind = if landing { site.hero.kind.clone() } else { "plain".to_string() };
+    // nothing about what it draws.
-    let show_yes = hero_kind == "yes";
+    let module = if landing && site.hero.kind == "module" {
-    let show_gesture = hero_kind == "gesture";
+        site.hero.module.clone()
    } else {
        None
    };
    let has_module = module.is_some();
    // Light theme can invert a white-stroke wordmark to ink. Default:
    // only the built-in house mark inverts; a content-shipped logo
    // keeps its colours unless site.yaml opts in with wordmark_invert.
    let house_wordmark = site.wordmark_invert.unwrap_or(site.wordmark.is_none());
    let wordmark = site.wordmark.clone().unwrap_or_else(|| "/wordmark.svg".to_string());
    // Clamped server-side too, but belt and braces for the inline style.
    let wordmark_style = site
        .wordmark_height
        .filter(|h| (0.5..=6.0).contains(h))
        .map(|h| format!("height: {h}rem"))
        .unwrap_or_default();
    let site_title = site.title.clone().unwrap_or_else(|| SITE_NAME.to_string());
-    // Starts the YES animation once the canvas elements exist, and
+    let piece_ref: NodeRef<leptos::html::Div> = NodeRef::new();
    // explicitly stops the requestAnimationFrame loop on unmount - the
    // original page-owning script never needed this since navigating
    // away meant a full document unload, which doesn't happen in an
    // SPA.
    let raster_ref: NodeRef<leptos::html::Canvas> = NodeRef::new();
    let gesture_ref: NodeRef<leptos::html::Div> = NodeRef::new();
    #[cfg(feature = "hydrate")]
-    if show_yes {
+    if has_module {
-        // `on_cleanup` requires Send + Sync (even single-threaded, wasm),
+        use wasm_bindgen::JsCast;
-        // which a JS-backed value never is - `StoredValue`'s `LocalStorage`
+        // Handle = whatever the module's mount() returned; kept as a
-        // variant is the established way around this (same pattern
+        // raw JsValue so the contract stays "has a stop()", nothing
-        // cnats' WebRTC call state uses for its own non-Send peer map).
+        // typed on the Rust side.
-        let instance: StoredValue<Option<yes::RasterizedYes>, LocalStorage> =
+        let handle: StoredValue<Option<wasm_bindgen::JsValue>, LocalStorage> =
            StoredValue::new_local(None);
        // Gated on the canvas NodeRef resolving, not just "the Effect
        // ran" - on a fresh page load the DOM is already there by the
        // time this fires, but navigating back to `/` client-side hit a
        // real race: the Effect ran before the new view's <canvas> was
        // actually inserted, RasterizedYES::new() (yes.js) did an
        // unchecked `document.getElementById(...).getContext(...)` on
        // null and threw mid-reactive-update - which then corrupted
        // wasm_bindgen_futures' single-threaded executor state badly
        // enough to panic ("RefCell already borrowed") on the next
        // tick. Waiting for the NodeRef itself guarantees DOM presence
        // the same way the prosekit editor's own mount Effect does.
        Effect::new(move |_| {
-            if raster_ref.get().is_none() {
+            let Some(container) = piece_ref.get() else {
                return;
            };
            if handle.with_value(|h| h.is_some()) {
                return;
            }
-            if instance.with_value(|i| i.is_some()) {
+            // Adopt the inline early-mount's instance (started at HTML
-                return;
+            // parse time) if it's there; otherwise (client-side
-            }
+            // navigation back to /) mount fresh through the helper the
-            // Adopt the hero's inline early-mount instance (started at
+            // inline script left on window. Either order is safe.
            // HTML parse time, long before this wasm was even fetched)
            // instead of starting a second animation. The flag covers
            // the opposite ordering too: an inline script that runs
            // after this sees it and stays inert.
            use wasm_bindgen::JsCast;
            let global = js_sys::global();
-            let _ = js_sys::Reflect::set(&global, &"__yesAdopted".into(), &true.into());
+            let _ = js_sys::Reflect::set(&global, &"__heroAdopted".into(), &true.into());
-            let early = js_sys::Reflect::get(&global, &"__yesEarly".into())
+            let early = js_sys::Reflect::get(&global, &"__heroEarly".into())
                .ok()
                .filter(|v| !v.is_undefined() && !v.is_null());
-            let inst = match early {
+            match early {
                Some(v) => {
-                    let _ = js_sys::Reflect::delete_property(&global, &"__yesEarly".into());
+                    let _ = js_sys::Reflect::delete_property(&global, &"__heroEarly".into());
-                    v.unchecked_into::<yes::RasterizedYes>()
+                    handle.set_value(Some(v));
                }
-                None => yes::RasterizedYes::new(),
+                None => {
-            };
+                    if let Ok(mounter) = js_sys::Reflect::get(&global, &"__mountHero".into()) {
-            instance.set_value(Some(inst));
+                        if let Some(f) = mounter.dyn_ref::<js_sys::Function>() {
                            if let Ok(promise) = f.call1(&global, &container) {
                                let promise: js_sys::Promise = promise.unchecked_into();
                                leptos::task::spawn_local(async move {
                                    if let Ok(h) =
                                        wasm_bindgen_futures::JsFuture::from(promise).await
                                    {
                                        handle.set_value(Some(h));
                                    }
                                });
                            }
                        }
                    }
                }
            }
        });
        on_cleanup(move || {
-            instance.update_value(|opt| {
+            handle.update_value(|opt| {
-                if let Some(inst) = opt.take() {
+                if let Some(h) = opt.take() {
-                    inst.stop();
+                    if let Ok(stop) = js_sys::Reflect::get(&h, &"stop".into()) {
                        if let Some(f) = stop.dyn_ref::<js_sys::Function>() {
                            let _ = f.call0(&h);
                        }
                    }
                }
            });
        });
    }
-    // The gesture hero mounts the same widget the `type: gesture`
+    // The inline script starts the piece at HTML parse time instead of
-    // requirement uses, in hero mode (no form field; echoes render as
+    // waiting out the wasm bundle; it also leaves __mountHero for the
-    // ambient strokes on the canvas itself). Same StoredValue +
+    // hydrate side's client-side-navigation case. Module path is
-    // on_cleanup shape as the YES piece - it may own a live WebSocket.
+    // validated to plain segments by SiteConfig::validate, so it can't
-    #[cfg(feature = "hydrate")]
+    // break out of the string here.
-    if show_gesture {
+    let early_script = module.as_ref().map(|m| {
-        let relay = site.hero.relay.clone().unwrap_or_default();
+        format!(
-        let widget: StoredValue<Option<gesture::GestureWidget>, LocalStorage> =
+            "const url = '/site/{m}'; window.__mountHero = (el) => import(url).then((mod) => mod.mount(el)); if (!window.__heroAdopted && !window.__heroEarly) window.__mountHero(document.querySelector('.hero-piece')).then((h) => {{ if (!window.__heroAdopted) window.__heroEarly = h; else if (h && h.stop) h.stop(); }});"
-            StoredValue::new_local(None);
+        )
-        Effect::new(move |_| {
+    });
            let Some(container) = gesture_ref.get() else {
                return;
            };
            if widget.with_value(|w| w.is_some()) {
                return;
            }
            widget.set_value(Some(gesture::mount_gesture_hero(&container, &relay)));
        });
        on_cleanup(move || {
            widget.update_value(|opt| {
                if let Some(w) = opt.take() {
                    w.stop();
                }
            });
        });
    }
    view! {
-        <header class="hero" class:hero-yes=show_yes class:hero-gesture=show_gesture>
+        <header class="hero" class:hero-module=has_module>
-            {show_yes
+            <Announcements current_id=current_id/>
            {has_module
                .then(|| {
                    view! {
-                        <div class="hero-canvas" aria-hidden="true">
+                        <div class="hero-piece" aria-hidden="true" node_ref=piece_ref></div>
-                            <canvas id="lineCanvas"></canvas>
+                        <script type="module" inner_html=early_script.unwrap_or_default()></script>
                            <canvas id="rasterCanvas" node_ref=raster_ref></canvas>
                        </div>
                        // Starts the animation at HTML parse time
                        // instead of waiting out the wasm bundle's
                        // fetch + hydration; the hydrate Effect above
                        // adopts (never duplicates) the instance, and
                        // the guards make either execution order safe.
                        <script
                            type="module"
                            inner_html="import('/yes.js').then((m) => { if (!window.__yesAdopted && !window.__yesEarly) window.__yesEarly = new m.RasterizedYES(); });"
                        ></script>
                    }
                })}
            {show_gesture
                .then(|| {
                    view! { <div class="hero-draw" node_ref=gesture_ref></div> }
                })}
            <div class="hero-copy">
-                <a class="wordmark" href="/">
+                <a class="wordmark" class:wordmark-house=house_wordmark href="/">
-                    <img src=wordmark alt=site_title/>
+                    <img src=wordmark alt=site_title style=wordmark_style/>
                </a>
                <h1>{title}</h1>
-                <p>{description}</p>
+                <p inner_html=render_inline_markdown(&description)></p>
            </div>
        </header>
    }
@@ -675,7 +783,7 @@ fn AlternativeCard(
        return view! {
            <section class="alt-card">
                <h2>{alternative.name.clone()}</h2>
-                <p class="alt-description">{alternative.description.clone()}</p>
+                <p class="alt-description" inner_html=render_inline_markdown(&alternative.description)></p>
                {move || {
                    let question_id_for_action = question_id_for_action.clone();
                    let alt_name_for_action = alt_name_for_action.clone();
@@ -700,7 +808,7 @@ fn AlternativeCard(
                            </button>
                        }
                            .into_any(),
-                        Some(Ok(())) => view! { <p>"Done."</p> }.into_any(),
+                        Some(Ok(())) => view! { <p>{move || t(&lang().get(), "done")}</p> }.into_any(),
                        Some(Err(e)) => view! { <p class="resource-error">{e.to_string()}</p> }.into_any(),
                    }
                }}
@@ -761,12 +869,16 @@ fn AlternativeCard(
                    .or_insert_with(|| RwSignal::new(Vec::new()));
                select_multi.insert(req.name.clone(), req.multiple);
            } else {
-                if req.kind == "gesture" {
+                // Widget-owned fields hold JSON objects, not strings.
                if req.kind == "gesture" || req.kind == "voice" {
                    gesture_fields.insert(req.name.clone());
                }
                // A voice field's preset is the key it records at,
                // not a value to submit.
                let preset = if req.kind == "voice" { String::new() } else { req.value.clone().unwrap_or_default() };
                field_map
                    .entry(req.name.clone())
-                    .or_insert_with(|| RwSignal::new(String::new()));
+                    .or_insert_with(|| RwSignal::new(preset));
            }
        }
    }
@@ -891,13 +1003,13 @@ fn AlternativeCard(
        .consequence
        .first()
        .cloned()
-        .unwrap_or_else(|| "Send".to_string());
+        .unwrap_or_else(|| t(&lang().get(), "send").to_string());
    view! {
        <section class="alt-card">
            <AltImages images=alternative.images.clone() />
            <h2>{alternative.name.clone()}</h2>
-            <p class="alt-description">{alternative.description.clone()}</p>
+            <p class="alt-description" inner_html=render_inline_markdown(&alternative.description)></p>
            <div class="features">
                <For
                    each={
@@ -946,7 +1058,7 @@ fn AlternativeCard(
                                        let description = feature.description.clone();
                                        move || !description.is_empty()
                                    }>
-                                        <p>{feature.description.clone()}</p>
+                                        <p inner_html=render_inline_markdown(&feature.description)></p>
                                    </Show>
                                    {resource.map(|spec| {
                                        view! {
@@ -955,6 +1067,7 @@ fn AlternativeCard(
                                                alternative=alt_name.clone()
                                                feature_name=feature_name.clone()
                                                transitions=spec.transitions.clone()
                                                empty=spec.empty.clone()
                                                pending_transitions=pending_transitions
                                                transition_batch=transition_batch
                                            />
@@ -1132,6 +1245,54 @@ fn AlternativeCard(
                                                    .into_any();
                                                }
                                                if req.kind == "voice" {
                                                    let container_ref: NodeRef<leptos::html::Div> = NodeRef::new();
                                                    let hidden_ref: NodeRef<leptos::html::Input> = NodeRef::new();
                                                    #[cfg(feature = "hydrate")]
                                                    {
                                                        let relay = req.relay.clone().unwrap_or_default();
                                                        let key = req.value.clone().unwrap_or_default();
                                                        let widget: StoredValue<Option<voice::VoiceWidget>, LocalStorage> =
                                                            StoredValue::new_local(None);
                                                        Effect::new(move |_| {
                                                            let (Some(container), Some(hidden)) =
                                                                (container_ref.get(), hidden_ref.get())
                                                            else {
                                                                return;
                                                            };
                                                            if widget.with_value(|w| w.is_some()) {
                                                                return;
                                                            }
                                                            widget.set_value(Some(voice::mount_voice(
                                                                &container, &hidden, &relay, &key,
                                                            )));
                                                        });
                                                        on_cleanup(move || {
                                                            widget.update_value(|opt| {
                                                                if let Some(w) = opt.take() {
                                                                    w.stop();
                                                                }
                                                            });
                                                        });
                                                    }
                                                    return view! {
                                                        <div class="field">
                                                            {label_text}
                                                            <input
                                                                id=field_id
                                                                type="hidden"
                                                                node_ref=hidden_ref
                                                                prop:value=move || sig.get()
                                                                on:input=move |ev| sig.set(event_target_value(&ev))
                                                            />
                                                            <div class="voice-wrap" node_ref=container_ref></div>
                                                        </div>
                                                    }
                                                    .into_any();
                                                }
                                                if req.kind == "prosekit" {
                                                    let container_ref: NodeRef<leptos::html::Div> = NodeRef::new();
                                                    let hidden_ref: NodeRef<leptos::html::Input> = NodeRef::new();
@@ -1164,6 +1325,20 @@ fn AlternativeCard(
                                                    .into_any();
                                                }
                                                if req.kind == "hidden" {
                                                    // A carrier value only — no label row, or a
                                                    // preset key reads as a second visible field.
                                                    return view! {
                                                        <input
                                                            id=field_id
                                                            type="hidden"
                                                            prop:value=move || sig.get()
                                                            on:input=move |ev| sig.set(event_target_value(&ev))
                                                        />
                                                    }
                                                    .into_any();
                                                }
                                                view! {
                                                    <label class="field" for=label_for>
                                                        {label_text}
@@ -1231,7 +1406,17 @@ fn AlternativeCard(
                                    children=move |e| view! { <p class="alt-encouragement">{e}</p> }
                                />
                            </div>
-                            {if is_gateway {
+                            {if alternative.disabled {
                                // Advertised, not yet takeable: the label
                                // stays (it says what will be possible),
                                // the button doesn't act.
                                view! {
                                    <button type="button" class="alt-submit soon" disabled=true title="Not yet">
                                        {button_label.clone()}
                                    </button>
                                }
                                .into_any()
                            } else if is_gateway {
                                let href = alternative.action.clone().unwrap_or_default();
                                view! {
                                    <a class="alt-submit" href=href>{button_label.clone()}</a>
@@ -1274,6 +1459,7 @@ fn ResourceFeature(
    alternative: String,
    feature_name: String,
    transitions: Vec<Transition>,
    empty: Option<String>,
    pending_transitions: RwSignal<std::collections::HashMap<(String, String), String>>,
    transition_batch: ServerAction<TransitionAnswers>,
 ) -> impl IntoView {
@@ -1307,6 +1493,7 @@ fn ResourceFeature(
                {move || {
                    let feature_name = feature_name.clone();
                    let transitions = transitions.clone();
                    let empty = empty.clone().unwrap_or_else(|| t(&lang().get(), "nothing_here_yet").to_string());
                    data.get()
                        .map(|res| match res {
                            Ok(value) => {
@@ -1314,6 +1501,7 @@ fn ResourceFeature(
                                    <ResourceValue
                                        feature_name=feature_name
                                        transitions=transitions
                                        empty=empty
                                        value=value
                                        pending_transitions=pending_transitions
                                        transition_batch=transition_batch
@@ -1340,11 +1528,23 @@ fn ResourceFeature(
 fn ResourceValue(
    feature_name: String,
    transitions: Vec<Transition>,
    empty: String,
    value: serde_json::Value,
    pending_transitions: RwSignal<std::collections::HashMap<(String, String), String>>,
    transition_batch: ServerAction<TransitionAnswers>,
 ) -> impl IntoView {
    // A jq like `.[] | {...}` over an empty list yields no output at
    // all - that arrives as null, and it's the same silence as [].
    if value.is_null() {
        return view! { <p class="resource-empty">{empty}</p> }.into_any();
    }
    if let serde_json::Value::Array(items) = &value {
        // Before the Answer parse below: an empty list deserializes as
        // an (empty) Vec<Answer> too, and rendered as a blank
        // answer-list instead of saying anything.
        if items.is_empty() {
            return view! { <p class="resource-empty">{empty}</p> }.into_any();
        }
        if let Ok(answers) = serde_json::from_value::<Vec<Answer>>(value.clone()) {
            let mut answers = answers;
            answers.sort_by(|a, b| {
@@ -1377,9 +1577,6 @@ fn ResourceValue(
            }
            .into_any();
        }
        if items.is_empty() {
            return view! { <p class="resource-empty">"Nothing here yet."</p> }.into_any();
        }
        // A list of plain objects (e.g. a jq-shaped GiteaStarred/Url
        // resource) - render as cards rather than dumping raw JSON.
        // Generic on purpose, no content-declared "kind": `name`/`title`
@@ -1426,8 +1623,11 @@ fn ItemCard(item: serde_json::Value) -> impl IntoView {
    let name = text_field(&obj, &["name", "title"]);
    let description = text_field(&obj, &["description"]);
    let url = text_field(&obj, &["url", "html_url"]);
    // A playable recording (an https URL to audio) renders as a
    // player, not a link - the relay's /blob/<digest>.wav.
    let audio = text_field(&obj, &["audio"]).filter(|a| a.starts_with("https://"));
-    let known = ["name", "title", "description", "url", "html_url"];
+    let known = ["name", "title", "description", "url", "html_url", "audio"];
    let extra: Vec<(String, String)> = obj
        .iter()
        .filter(|(k, v)| !known.contains(&k.as_str()) && !v.is_null())
@@ -1466,7 +1666,9 @@ fn ItemCard(item: serde_json::Value) -> impl IntoView {
                        </div>
                    }
                })}
-            {description.map(|d| view! { <p class="item-card-description">{d}</p> })}
+            {description
                .map(|d| view! { <p class="item-card-description" inner_html=render_inline_markdown(&d)></p> })}
            {audio.map(|src| view! { <audio class="item-card-audio" controls preload="none" src=src></audio> })}
            {(!extra.is_empty())
                .then(|| {
                    view! {
@@ -1760,8 +1962,8 @@ fn format_ms(ms: i64) -> String {
 fn NotFound() -> impl IntoView {
    view! {
        <main class="not-found">
-            <h1>"Nothing here"</h1>
+            <h1>{move || t(&lang().get(), "nothing_here")}</h1>
-            <a href="/">"back to the start"</a>
+            <a href="/">{move || t(&lang().get(), "back_to_start")}</a>
        </main>
    }
 }
@@ -1828,14 +2030,64 @@ pub async fn get_site() -> Result<SiteConfig, ServerFnError> {
    Ok(state.site.load().as_ref().clone())
 }
-/// Every question the current visitor qualifies for, as (id, name) -
+/// Every question the visitor may be offered from `current`, as (id,
-/// the site nav's data. Context-dependent: an owner session sees the
+/// name) - the question nav's data. Front-door pages the visitor
-/// gated pages too, and `followup` pages only appear once the visitor
+/// qualifies for are always in (an owner session sees the gated desks
-/// carries an answer chain.
+/// too). A `followup` page or an ended event is in only when the
 /// visitor has earned it: their verified `?chain=` answered the
 /// alternative that leads there, or it is reachable from an earned
 /// page over links that record nothing (see `content::earned_followups`).
 /// Nothing is offered that sits behind an answer they have not given;
 /// an unverifiable hash unlocks nothing.
 #[server(endpoint = "list_qualifying_questions")]
 pub async fn list_qualifying_questions(
-    has_chain: bool,
+    current: String,
    chain: Option<String>,
 ) -> Result<Vec<(String, String)>, ServerFnError> {
    use crate::auth::{User, SESSION_USER_KEY};
    use crate::content::{earned_followups, is_qualified, unlocked_by, Question};
    use crate::server::AppState;
    let state = expect_context::<AppState>();
    let session: tower_sessions::Session = leptos_axum::extract().await?;
    let user = session
        .get::<User>(SESSION_USER_KEY)
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    let now_ms = chrono::Utc::now().timestamp_millis();
    let questions = state.questions.load();
    // What the chain verifiably answered - the same lookup a
    // `requires_chain` gate does, so a forged or foreign hash resolves
    // to nothing - and therefore where it sent the visitor.
    let seeds: Vec<String> = match &chain {
        Some(hash) => match crate::chain::lookup_node(&state.jetstream, hash).await {
            Some(node) => unlocked_by(&questions, &node.question_id, node.alternative.as_deref()),
            None => Vec::new(),
        },
        None => Vec::new(),
    };
    // An ended event page is a followup from then on.
    let is_outcome = |q: &Question| q.is_followup() || q.event_ended_at(now_ms);
    let earned = earned_followups(&questions, &current, &seeds, &is_outcome);
    let mut out: Vec<(String, String)> = questions
        .values()
        .filter(|q| is_qualified(user.as_ref(), q))
        .filter(|q| !is_outcome(q) || earned.contains(&q.id))
        // A live event is announced in the header instead.
        .filter(|q| !q.event_live_at(now_ms))
        // A dynamic page has no URL of its own to link to.
        .filter(|q| !q.is_dynamic())
        .map(|q| (q.id.clone(), q.name.clone()))
        .collect();
    out.sort();
    Ok(out)
 }
 /// Every announced page whose window is still open and that the
 /// visitor qualifies for, soonest first.
 #[server(endpoint = "list_announcements")]
 pub async fn list_announcements() -> Result<Vec<Announcement>, ServerFnError> {
    use crate::auth::{User, SESSION_USER_KEY};
    use crate::content::is_qualified;
    use crate::server::AppState;
@@ -1846,19 +2098,51 @@ pub async fn list_qualifying_questions(
        .get::<User>(SESSION_USER_KEY)
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    let now_ms = chrono::Utc::now().timestamp_millis();
-    let mut out: Vec<(String, String)> = state
+    let mut live: Vec<(i64, Announcement)> = state
        .questions
        .load()
        .values()
-        .filter(|q| is_qualified(user.as_ref(), q))
+        .filter(|q| is_qualified(user.as_ref(), q) && q.event_live_at(now_ms))
-        .filter(|q| !q.is_followup() || has_chain)
+        .filter_map(|q| {
-        // A dynamic page has no URL of its own to link to.
+            let event = q.event.as_ref()?;
-        .filter(|q| !q.is_dynamic())
+            let starts = chrono::DateTime::parse_from_rfc3339(&event.starts).ok()?;
-        .map(|q| (q.id.clone(), q.name.clone()))
+            let starts_ms = starts.timestamp_millis();
            let relative = relative_until(starts_ms - now_ms);
            Some((
                starts_ms,
                Announcement {
                    id: q.id.clone(),
                    name: q.name.clone(),
                    when: starts.format("%a %-d %b, %H:%M").to_string(),
                    relative,
                    place: event.place.clone(),
                },
            ))
        })
        .collect();
-    out.sort();
+    live.sort_by_key(|(starts, _)| *starts);
-    Ok(out)
+    Ok(live.into_iter().map(|(_, a)| a).collect())
 }
 /// "in 3 days" / "in 4 h" / "in 20 min" / "now" (already started).
 #[cfg(feature = "ssr")]
 fn relative_until(delta_ms: i64) -> String {
    const MIN: i64 = 60_000;
    const HOUR: i64 = 60 * MIN;
    const DAY: i64 = 24 * HOUR;
    if delta_ms <= 0 {
        "now".to_string()
    } else if delta_ms >= 2 * DAY {
        format!("in {} days", delta_ms / DAY)
    } else if delta_ms >= DAY {
        "tomorrow".to_string()
    } else if delta_ms >= HOUR {
        format!("in {} h", delta_ms / HOUR)
    } else {
        format!("in {} min", (delta_ms / MIN).max(1))
    }
 }
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -1902,11 +2186,21 @@ pub async fn submit_answer(
        .iter()
        .find(|a| a.name == alternative)
        .ok_or_else(|| ServerFnError::new("unknown alternative"))?;
-    let next = alt.action.clone();
+    if alt.disabled {
        return Err(ServerFnError::new("this alternative isn't open yet"));
    }
    let record_as = alt.record_as.clone();
    let responses: serde_json::Value = serde_json::from_str(&responses_json)
        .map_err(|e| ServerFnError::new(format!("invalid responses: {e}")))?;
    // `/shape/{curve.key}`: the next page may be chosen by the answer.
    let next = match alt.action.as_deref() {
        Some(action) => Some(
            crate::content::template_action(action, &responses)
                .ok_or_else(|| ServerFnError::new("this answer is missing what the next page needs"))?,
        ),
        None => None,
    };
    let parent_hashes: Vec<String> = parent_hash.into_iter().collect();
    let timestamp_ms = chrono::Utc::now().timestamp_millis();
@@ -1929,7 +2223,7 @@ pub async fn submit_answer(
    // Index the node so requires_chain pages can verify lineage.
    // Best-effort: the NATS event above is the durable record.
    if let Err(e) =
-        crate::chain::record_node(&state.jetstream, &chain_hash, &question_id, timestamp_ms).await
+        crate::chain::record_node(&state.jetstream, &chain_hash, &question_id, &alternative, timestamp_ms).await
    {
        tracing::error!("failed to index chain node: {e}");
    }
@@ -1,145 +0,0 @@
 //! Headless schema-check binary - loads content and `aggregates.yaml`
 //! (from a Gitea repo URL or a local directory) and validates them
 //! exactly the way `content::watch_for_reload`/`main.rs`'s boot path
 //! do, with no NATS, OIDC, web server, or JetStream connection
 //! involved. Built once by portal's own deploy workflow and run
 //! directly by `questions`' own CI (same bare-metal runner/host,
 //! published to a stable path - no artifact download needed), rather
 //! than compiled there - keeps that repo's CI coupling to "run a
 //! static binary," not "build a Rust workspace."
 #![cfg(feature = "ssr")]
 use portal::{aggregates, content};
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
    let mut args = std::env::args().skip(1);
    let mut repo: Option<String> = None;
    let mut branch = "main".to_string();
    let mut subdir = "questions".to_string();
    let mut path: Option<String> = None;
    while let Some(arg) = args.next() {
        match arg.as_str() {
            "--repo" => repo = args.next(),
            "--branch" => branch = args.next().unwrap_or(branch),
            "--subdir" => subdir = args.next().unwrap_or(subdir),
            "--path" => path = args.next(),
            other => {
                eprintln!("unknown argument: {other}");
                std::process::exit(2);
            }
        }
    }
    let (questions, aggregates_map, site) = if let Some(dir) = path {
        (load_from_dir(&dir)?, load_aggregates_from_dir(&dir)?, load_site_from_dir(&dir)?)
    } else if let Some(repo_url) = repo {
        let questions = content::load_questions_from_gitea(&repo_url, &branch, &subdir).await?;
        let aggregates_map = content::load_aggregates_from_gitea(&repo_url, &branch).await?;
        // load_site_from_gitea already validates; a missing file is
        // the default config, same as at portal boot.
        let site = content::load_site_from_gitea(&repo_url, &branch).await?;
        (questions, aggregates_map, site)
    } else {
        eprintln!(
            "usage: question-lint --repo <gitea-url> [--branch main] [--subdir questions] | --path <local-dir>"
        );
        std::process::exit(2);
    };
    if let Err(e) = site.validate() {
        eprintln!("FAIL: {e}");
        std::process::exit(1);
    }
    match content::validate_questions(&questions, &aggregates_map) {
        Ok(()) => {
            println!(
                "OK: {} question(s), {} aggregate(s) valid",
                questions.len(),
                aggregates_map.len()
            );
            Ok(())
        }
        Err(e) => {
            eprintln!("FAIL: {e}");
            std::process::exit(1);
        }
    }
 }
 /// The offline counterpart to `content::load_site_from_gitea` -
 /// `site.yaml` lives at the repo root like `aggregates.yaml`, and is
 /// just as optional locally: missing means default branding.
 fn load_site_from_dir(dir: &str) -> anyhow::Result<content::SiteConfig> {
    let site_path = std::path::Path::new(dir)
        .parent()
        .unwrap_or_else(|| std::path::Path::new("."))
        .join("site.yaml");
    if !site_path.exists() {
        return Ok(content::SiteConfig::default());
    }
    let raw = std::fs::read_to_string(&site_path)
        .map_err(|e| anyhow::anyhow!("reading {}: {e}", site_path.display()))?;
    serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing {}: {e}", site_path.display()))
 }
 /// The offline counterpart to `content::load_aggregates_from_gitea` -
 /// `aggregates.yaml` lives at the repo root, one level up from the
 /// pages directory `--path` names, so `dir`'s parent is where it's
 /// looked for. Missing entirely is not an error here (unlike
 /// `--repo` mode, where `aggregates.yaml` is required) - a local
 /// checkout being linted may not have one, and every declared
 /// transition still gets checked against whatever *is* found; an
 /// empty map just means nothing is checked.
 fn load_aggregates_from_dir(
    dir: &str,
 ) -> anyhow::Result<std::collections::HashMap<String, aggregates::AggregateSchema>> {
    let aggregates_path = std::path::Path::new(dir)
        .parent()
        .unwrap_or_else(|| std::path::Path::new("."))
        .join("aggregates.yaml");
    if !aggregates_path.exists() {
        return Ok(std::collections::HashMap::new());
    }
    let raw = std::fs::read_to_string(&aggregates_path)
        .map_err(|e| anyhow::anyhow!("reading {}: {e}", aggregates_path.display()))?;
    aggregates::parse_aggregates_yaml(&raw)
 }
 /// The offline counterpart to `content::load_questions_from_gitea` -
 /// the same recursive tree walk and `content::build_questions`
 /// pipeline (derived ids, relative refs, sections, followup
 /// inference), just reading a local checkout instead of Gitea's API,
 /// for linting a branch that hasn't been pushed yet.
 fn load_from_dir(
    dir: &str,
 ) -> anyhow::Result<std::collections::HashMap<String, content::Question>> {
    let base = std::path::Path::new(dir);
    let mut files = Vec::new();
    collect_yaml(base, base, &mut files)?;
    content::build_questions(&files)
 }
 fn collect_yaml(
    base: &std::path::Path,
    dir: &std::path::Path,
    out: &mut Vec<(String, String)>,
 ) -> anyhow::Result<()> {
    for entry in std::fs::read_dir(dir)? {
        let path = entry?.path();
        if path.is_dir() {
            collect_yaml(base, &path, out)?;
        } else if path.extension().and_then(|e| e.to_str()) == Some("yaml") {
            let rel = path
                .strip_prefix(base)
                .expect("walked paths sit under their base")
                .to_string_lossy()
                .replace('\\', "/");
            let raw = std::fs::read_to_string(&path)
                .map_err(|e| anyhow::anyhow!("reading {}: {e}", path.display()))?;
            out.push((rel, raw));
        }
    }
    Ok(())
 }
@@ -20,6 +20,11 @@ pub const CHAIN_BUCKET: &str = "portal_chains";
 #[derive(serde::Serialize, serde::Deserialize)]
 pub struct ChainNode {
    pub question_id: String,
    /// Which alternative was answered - what decides where the visitor
    /// was sent next, and so which followup the chain has earned. Nodes
    /// indexed before this field existed carry `None`.
    #[serde(default)]
    pub alternative: Option<String>,
    pub timestamp_ms: i64,
 }
@@ -30,6 +35,7 @@ pub async fn record_node(
    js: &async_nats::jetstream::Context,
    chain_hash: &str,
    question_id: &str,
    alternative: &str,
    timestamp_ms: i64,
 ) -> anyhow::Result<()> {
    let store = match js.get_key_value(CHAIN_BUCKET).await {
@@ -44,6 +50,7 @@ pub async fn record_node(
    };
    let node = ChainNode {
        question_id: question_id.to_string(),
        alternative: Some(alternative.to_string()),
        timestamp_ms,
    };
    store.put(chain_hash, serde_json::to_vec(&node)?.into()).await?;
@@ -0,0 +1,239 @@
 //! Loading a content repo from Gitea, and the NATS-signalled reload
 //! that hot-swaps it (last-good content is kept on any failure). Every
 //! fetch goes through `crate::http`: bounded in time and size.
 use super::*;
 /// Fetches and parses `site.yaml` from the content repo root. A fetch
 /// failure (typically 404 - the file is optional) yields the default
 /// config; a file that exists but doesn't parse or validate is a real
 /// error, surfaced at boot rather than papered over.
 #[cfg(feature = "ssr")]
 pub async fn load_site_from_gitea(repo_url: &str, branch: &str) -> anyhow::Result<SiteConfig> {
    let (owner, repo) = parse_owner_repo(repo_url)?;
    let api_base = gitea_api_base(repo_url)?;
    let raw = match fetch_gitea_file(&api_base, &owner, &repo, branch, "site.yaml").await {
        Ok(raw) => raw,
        Err(e) => {
            tracing::info!("no site.yaml in content repo ({e}), using default branding");
            return Ok(SiteConfig::default());
        }
    };
    let site: SiteConfig =
        serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing site.yaml: {e}"))?;
    site.validate()?;
    Ok(site)
 }
 /// Extracts `scheme://host` from a repo's normal browser URL - the
 /// Gitea API base every helper in this module builds requests against.
 #[cfg(feature = "ssr")]
 /// `{gitea}/api/v1/repos/{owner}/{repo}/raw` - the base
 /// `site_asset_handler` proxies content-shipped files from.
 #[cfg(feature = "ssr")]
 pub fn gitea_raw_base(repo_url: &str) -> anyhow::Result<String> {
    let (owner, repo) = parse_owner_repo(repo_url)?;
    Ok(format!("{}/api/v1/repos/{owner}/{repo}/raw", gitea_api_base(repo_url)?))
 }
 #[cfg(feature = "ssr")]
 pub fn gitea_api_base(repo_url: &str) -> anyhow::Result<String> {
    let parsed = url::Url::parse(repo_url)
        .map_err(|e| anyhow::anyhow!("parsing repo url {repo_url}: {e}"))?;
    Ok(format!(
        "{}://{}",
        parsed.scheme(),
        parsed
            .host_str()
            .ok_or_else(|| anyhow::anyhow!("no host in repo url {repo_url}"))?
    ))
 }
 /// Splits a repo's normal browser URL into `(owner, repo)` - shared by
 /// every loader in this module that needs to build a Gitea contents API
 /// URL (`load_questions_from_gitea`, `load_aggregates_from_gitea`).
 #[cfg(feature = "ssr")]
 pub(crate) fn parse_owner_repo(repo_url: &str) -> anyhow::Result<(String, String)> {
    let parsed = url::Url::parse(repo_url)
        .map_err(|e| anyhow::anyhow!("parsing content repo url {repo_url}: {e}"))?;
    let mut segments = parsed
        .path_segments()
        .ok_or_else(|| anyhow::anyhow!("no path in content repo url {repo_url}"))?;
    let owner = segments
        .next()
        .filter(|s| !s.is_empty())
        .ok_or_else(|| anyhow::anyhow!("missing owner in content repo url {repo_url}"))?
        .to_string();
    let repo = segments
        .next()
        .filter(|s| !s.is_empty())
        .ok_or_else(|| anyhow::anyhow!("missing repo name in content repo url {repo_url}"))?
        .to_string();
    Ok((owner, repo))
 }
 /// Fetches one file from a Gitea repo's contents API and returns its raw
 /// text - the single-file counterpart to `load_questions_from_gitea`'s
 /// directory-listing loop, used by `load_aggregates_from_gitea` for the
 /// one `aggregates.yaml` file at the repo root.
 #[cfg(feature = "ssr")]
 pub(crate) async fn fetch_gitea_file(
    api_base: &str,
    owner: &str,
    repo: &str,
    branch: &str,
    path: &str,
 ) -> anyhow::Result<String> {
    let meta_url = format!("{api_base}/api/v1/repos/{owner}/{repo}/contents/{path}?ref={branch}");
    let meta_text = crate::http::get_text(&meta_url, crate::http::GITEA_CAP)
        .await
        .map_err(|e| anyhow::anyhow!("fetching {meta_url}: {e}"))?;
    let meta: serde_json::Value = serde_json::from_str(&meta_text)
        .map_err(|e| anyhow::anyhow!("parsing contents response from {meta_url}: {e}"))?;
    let download_url = meta
        .get("download_url")
        .and_then(|v| v.as_str())
        .ok_or_else(|| anyhow::anyhow!("no download_url for {path}"))?;
    crate::http::get_text(download_url, crate::http::GITEA_CAP)
        .await
        .map_err(|e| anyhow::anyhow!("fetching {path}: {e}"))
 }
 /// Fetches and parses `aggregates.yaml` from the repo root (sibling to
 /// the pages `subdir`, so the "every yaml under subdir is a page"
 /// convention needs no exclusion). A malformed file fails here, before
 /// ever reaching `AppState`.
 #[cfg(feature = "ssr")]
 pub async fn load_aggregates_from_gitea(
    repo_url: &str,
    branch: &str,
 ) -> anyhow::Result<std::collections::HashMap<String, crate::aggregates::AggregateSchema>> {
    let (owner, repo) = parse_owner_repo(repo_url)?;
    let api_base = gitea_api_base(repo_url)?;
    let raw = fetch_gitea_file(&api_base, &owner, &repo, branch, "aggregates.yaml").await?;
    crate::aggregates::parse_aggregates_yaml(&raw)
 }
 #[cfg(feature = "ssr")]
 pub async fn load_questions_from_gitea(
    repo_url: &str,
    branch: &str,
    subdir: &str,
 ) -> anyhow::Result<std::collections::HashMap<String, Question>> {
    let (owner, repo) = parse_owner_repo(repo_url)?;
    let api_base = gitea_api_base(repo_url)?;
    // One recursive git-trees call for the whole repo instead of a
    // contents listing per directory - the tree IS the router now, so
    // nested files matter.
    let tree_url =
        format!("{api_base}/api/v1/repos/{owner}/{repo}/git/trees/{branch}?recursive=true");
    let listing = crate::http::get_text(&tree_url, crate::http::GITEA_CAP)
        .await
        .map_err(|e| anyhow::anyhow!("listing {tree_url}: {e}"))?;
    let tree: serde_json::Value = serde_json::from_str(&listing)
        .map_err(|e| anyhow::anyhow!("parsing tree from {tree_url}: {e}"))?;
    if tree.get("truncated").and_then(|v| v.as_bool()) == Some(true) {
        anyhow::bail!("git tree listing for {owner}/{repo} was truncated - repo too large");
    }
    let prefix = format!("{subdir}/");
    let mut files = Vec::new();
    for entry in tree
        .get("tree")
        .and_then(|v| v.as_array())
        .map(|v| v.as_slice())
        .unwrap_or_default()
    {
        let path = entry.get("path").and_then(|v| v.as_str()).unwrap_or("");
        if entry.get("type").and_then(|v| v.as_str()) != Some("blob")
            || !path.starts_with(&prefix)
            || !path.ends_with(".yaml")
        {
            continue;
        }
        // Brackets (dynamic pages like `[record].yaml`) must be
        // percent-encoded in the raw URL's path.
        let encoded = path.replace('[', "%5B").replace(']', "%5D");
        let raw_url = format!("{api_base}/api/v1/repos/{owner}/{repo}/raw/{encoded}?ref={branch}");
        let raw = crate::http::get_text(&raw_url, crate::http::GITEA_CAP)
            .await
            .map_err(|e| anyhow::anyhow!("fetching {path}: {e}"))?;
        files.push((path[prefix.len()..].to_string(), raw));
    }
    build_questions(&files)
 }
 /// Published by the content repo's own CI (after it lints a push) to
 /// tell every running instance to pick up the change - a plain fire
 /// and forget NATS publish, no payload, matching `events.rs`'s
 /// `ANSWERS_SUBJECT` pattern.
 #[cfg(feature = "ssr")]
 pub const CONTENT_RELOAD_SUBJECT: &str = "portal.content.reload";
 /// Runs for the life of the process: re-fetches `repo_url`/`branch` and
 /// atomically swaps both `questions` and `aggregates` on every
 /// `CONTENT_RELOAD_SUBJECT` message - the two only ever swap together,
 /// after both have loaded and validated successfully, so a reader never
 /// sees pages that reference a half-updated state graph. A fetch/parse
 /// failure logs and keeps serving the last-good content rather than
 /// clearing it - a bad push to the content repo (which should already
 /// have been caught by its own lint step) doesn't take the site down.
 #[cfg(feature = "ssr")]
 pub async fn watch_for_reload(
    nats: async_nats::Client,
    repo_url: String,
    branch: String,
    subdir: String,
    questions: std::sync::Arc<arc_swap::ArcSwap<std::collections::HashMap<String, Question>>>,
    aggregates: std::sync::Arc<
        arc_swap::ArcSwap<std::collections::HashMap<String, crate::aggregates::AggregateSchema>>,
    >,
    site: std::sync::Arc<arc_swap::ArcSwap<SiteConfig>>,
 ) {
    let mut sub = match nats.subscribe(CONTENT_RELOAD_SUBJECT).await {
        Ok(sub) => sub,
        Err(e) => {
            tracing::error!(error = %e, "failed to subscribe to content reload subject");
            return;
        }
    };
    use futures::StreamExt;
    while sub.next().await.is_some() {
        let loaded_aggregates = match load_aggregates_from_gitea(&repo_url, &branch).await {
            Ok(loaded) => with_builtin_aggregates(loaded),
            Err(e) => {
                tracing::error!(error = %e, "aggregates.yaml reload failed, keeping last-good content");
                continue;
            }
        };
        // Branding swaps with the same all-or-nothing rule: a
        // present-but-broken site.yaml keeps last-good everything
        // (load_site distinguishes "absent" - a normal default - from
        // "present but invalid").
        let loaded_site = match load_site_from_gitea(&repo_url, &branch).await {
            Ok(loaded) => loaded,
            Err(e) => {
                tracing::error!(error = %e, "site.yaml reload failed, keeping last-good content");
                continue;
            }
        };
        match load_questions_from_gitea(&repo_url, &branch, &subdir).await {
            Ok(loaded) => {
                if let Err(e) = validate_questions(&loaded, &loaded_aggregates) {
                    tracing::error!(error = %e, "content reload failed validation, keeping last-good content");
                    continue;
                }
                let count = loaded.len();
                questions.store(std::sync::Arc::new(loaded));
                aggregates.store(std::sync::Arc::new(loaded_aggregates));
                site.store(std::sync::Arc::new(loaded_site));
                tracing::info!(count, "reloaded content");
            }
            Err(e) => {
                tracing::error!(error = %e, "content reload failed, keeping last-good content");
            }
        }
    }
 }
@@ -0,0 +1,193 @@
 //! The Axum routes that expose content and buckets outside the Leptos
 //! app: content-shipped assets proxied same-origin, repo info for the
 //! showcase, and the automation read API over KV buckets.
 use super::*;
 /// A repo-relative asset path portal is willing to proxy from the
 /// content repo: plain segments only - no traversal, no leading slash,
 /// no scheme - so `/site/<path>` can only ever reach the content repo.
 pub fn is_safe_site_path(path: &str) -> bool {
    !path.is_empty()
        && !path.starts_with('/')
        && path.split('/').all(|seg| {
            !seg.is_empty()
                && seg != ".."
                && seg
                    .chars()
                    .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
        })
 }
 /// A public Gitea repo's basic info - what `resolve_gitea_repo` returns
 /// for the prosekit editor's repo-embed node to render as a static
 /// card, baked in once at embed time rather than re-fetched by every
 /// reader (an emailed newsletter can't run JS to do that anyway).
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct GiteaRepoInfo {
    pub owner: String,
    pub repo: String,
    pub description: String,
    pub url: String,
 }
 #[derive(Deserialize)]
 #[cfg(feature = "ssr")]
 pub struct GiteaRepoQuery {
    pub owner: String,
    pub repo: String,
 }
 /// `GET /site/{*path}` - serves a file from the content repo's default
 /// branch same-origin, so content-shipped assets (the hero module,
 /// its stylesheet) are importable by the page: Gitea's raw endpoint
 /// sends no CORS headers, and an ES module import across origins is
 /// refused without them. Path is validated to plain segments
 /// (`is_safe_site_path`), the response revalidates like /pkg
 /// (Cache-Control: no-cache) so a content push shows up on reload.
 #[cfg(feature = "ssr")]
 pub async fn site_asset_handler(
    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
    axum::extract::Path(path): axum::extract::Path<String>,
 ) -> axum::response::Response {
    use axum::http::{header, StatusCode};
    use axum::response::IntoResponse;
    if !is_safe_site_path(&path) {
        return (StatusCode::BAD_REQUEST, "invalid asset path").into_response();
    }
    let url = format!("{}/{path}?ref={}", state.content_raw_base, state.content_branch);
    let resp = match crate::http::client().get(&url).send().await.and_then(|r| r.error_for_status()) {
        Ok(r) => r,
        Err(e) => {
            tracing::warn!("site asset {path}: {e}");
            return (StatusCode::NOT_FOUND, "no such site asset").into_response();
        }
    };
    let bytes = match crate::http::bytes(resp, crate::http::ASSET_CAP).await {
        Ok(b) => axum::body::Bytes::from(b),
        Err(e) => return (StatusCode::BAD_GATEWAY, e.to_string()).into_response(),
    };
    let mime = match path.rsplit('.').next() {
        Some("js") | Some("mjs") => "text/javascript; charset=utf-8",
        Some("css") => "text/css; charset=utf-8",
        Some("svg") => "image/svg+xml",
        Some("json") => "application/json",
        Some("png") => "image/png",
        Some("webp") => "image/webp",
        Some("avif") => "image/avif",
        Some("ico") => "image/x-icon",
        Some("woff2") => "font/woff2",
        _ => "application/octet-stream",
    };
    (
        [(header::CONTENT_TYPE, mime), (header::CACHE_CONTROL, "no-cache")],
        bytes,
    )
        .into_response()
 }
 /// Looks up `owner/repo` on the same Gitea instance content is loaded
 /// from (`AppState.gitea_base`) - a raw Axum handler (mounted at
 /// `/gitea-repo` in `main.rs`), not a Leptos server fn, since the
 /// caller here is the prosekit editor's own paste-to-embed rule (see
 /// `prosekit-editor.js`) doing a plain `fetch`, the same reason
 /// `/upload` (`src/upload.rs`) is a raw handler rather than a `#[server]`
 /// fn. Keeping this server-resolved (rather than having the browser
 /// call Gitea's API directly) is consistent with every other backing
 /// store in this app, and sidesteps needing a CORS allowance on Gitea's
 /// side just for this. No auth, same as content loading - resolves
 /// only what's already public.
 #[cfg(feature = "ssr")]
 pub async fn gitea_repo_handler(
    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
    axum::extract::Query(query): axum::extract::Query<GiteaRepoQuery>,
 ) -> Result<axum::Json<GiteaRepoInfo>, (axum::http::StatusCode, String)> {
    let is_safe_segment = |s: &str| {
        !s.is_empty()
            && s.chars()
                .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
    };
    if !is_safe_segment(&query.owner) || !is_safe_segment(&query.repo) {
        return Err((axum::http::StatusCode::BAD_REQUEST, "invalid owner/repo".to_string()));
    }
    let GiteaRepoQuery { owner, repo } = query;
    let api_url = format!("{}/api/v1/repos/{owner}/{repo}", state.gitea_base);
    let body = crate::http::get_text(&api_url, crate::http::GITEA_CAP)
        .await
        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, format!("fetching {api_url}: {e}")))?;
    let json: serde_json::Value = serde_json::from_str(&body).map_err(|e| {
        (
            axum::http::StatusCode::BAD_GATEWAY,
            format!("parsing repo info from {api_url}: {e}"),
        )
    })?;
    Ok(axum::Json(GiteaRepoInfo {
        owner: owner.clone(),
        repo: repo.clone(),
        description: json
            .get("description")
            .and_then(|v| v.as_str())
            .unwrap_or("")
            .to_string(),
        url: json
            .get("html_url")
            .and_then(|v| v.as_str())
            .map(|s| s.to_string())
            .unwrap_or_else(|| format!("{}/{owner}/{repo}", state.gitea_base)),
    }))
 }
 /// Lists every entry in a NATS KV bucket as JSON - a raw Axum handler
 /// (mounted at `/automation/kv/{bucket}` in `main.rs`), for backing
 /// automations (e.g. an n8n workflow reading `portal_subscribers` to
 /// send a newsletter) that aren't a signed-in browser session and so
 /// can't go through `resource::get_resource`'s Kanidm-group check.
 /// Gated by a single shared bearer token (`AUTOMATION_READ_TOKEN`) -
 /// deliberately not per-caller/per-bucket scoped, since every current
 /// caller is a trusted internal automation, not a third party. Read
 /// only, matching `get_resource`'s own "reads can be public/shared,
 /// mutations always need real identity" split - nothing here writes.
 #[cfg(feature = "ssr")]
 pub async fn automation_kv_handler(
    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
    axum::extract::Path(bucket): axum::extract::Path<String>,
    headers: axum::http::HeaderMap,
 ) -> Result<axum::Json<serde_json::Value>, (axum::http::StatusCode, String)> {
    let expected = std::env::var("AUTOMATION_READ_TOKEN").unwrap_or_default();
    let presented = headers
        .get(axum::http::header::AUTHORIZATION)
        .and_then(|v| v.to_str().ok())
        .and_then(|v| v.strip_prefix("Bearer "))
        .unwrap_or("");
    if expected.is_empty() || presented != expected {
        return Err((axum::http::StatusCode::UNAUTHORIZED, "unauthorized".to_string()));
    }
    let store = state
        .jetstream
        .get_key_value(&bucket)
        .await
        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, format!("bucket unavailable: {e}")))?;
    use futures::TryStreamExt;
    let keys: Vec<String> = store
        .keys()
        .await
        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, e.to_string()))?
        .try_collect()
        .await
        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, e.to_string()))?;
    let mut items = Vec::new();
    for key in keys {
        if let Ok(Some(bytes)) = store.get(&key).await {
            if let Ok(value) = serde_json::from_slice::<serde_json::Value>(&bytes) {
                items.push(value);
            }
        }
    }
    Ok(axum::Json(serde_json::Value::Array(items)))
 }
@@ -0,0 +1,120 @@
 //! Inline markdown for descriptions: links on a short allow-list of
 //! schemes, images gated and framed, with layout hints read from the
 //! image title. Never raw HTML.
 /// Descriptions are inline markdown: `[text](https://…)` links,
 /// `*emphasis*`, `**strong**`, `` `code` ``. Block structure is
 /// flattened (a description is one paragraph) and raw HTML in the
 /// source is dropped, so content can link out without being able to
 /// inject markup. Link targets are limited to https, mailto and
 /// site-relative paths; anything else renders as plain text.
 pub fn render_inline_markdown(text: &str) -> String {
    use pulldown_cmark::{html, Event, Options, Parser, Tag, TagEnd};
    let parser = Parser::new_ext(text, Options::empty());
    let mut in_link = 0usize;
    let mut in_dropped_image = 0usize;
    let filtered = parser.filter_map(|event| match event {
        Event::Html(_) | Event::InlineHtml(_) => None,
        Event::Start(Tag::Paragraph) | Event::End(TagEnd::Paragraph) => None,
        Event::SoftBreak => Some(Event::Text(" ".into())),
        Event::Start(Tag::Link { dest_url, .. })
            if !(dest_url.starts_with("https://")
                || dest_url.starts_with("mailto:")
                || dest_url.starts_with("tel:")
                || dest_url.starts_with('/')) =>
        {
            in_link += 1;
            None
        }
        Event::End(TagEnd::Link) if in_link > 0 => {
            in_link -= 1;
            None
        }
        // Images take the same gate as links: https or same-origin
        // only - no data:, no plain http. Unlike a dropped link (whose
        // label is real text worth keeping), a dropped image's alt
        // text is a caption for something that isn't there - swallow it.
        Event::Start(Tag::Image { dest_url, .. })
            if !(dest_url.starts_with("https://") || dest_url.starts_with('/')) =>
        {
            in_dropped_image += 1;
            None
        }
        Event::End(TagEnd::Image) if in_dropped_image > 0 => {
            in_dropped_image -= 1;
            None
        }
        Event::Text(_) if in_dropped_image > 0 => None,
        other => Some(other),
    });
    let mut out = String::new();
    html::push_html(&mut out, filtered);
    apply_image_hints(out.trim())
 }
 /// Translate a markdown image's title (`![alt](url "right 9rem")`)
 /// into layout: `left`/`right` float via a class, a bare number
 /// (optionally with `rem`) into a validated `max-width`. Unknown
 /// tokens are ignored; the title attribute is dropped either way.
 /// Only touches `<img>` tags in our own render output, and only ever
 /// emits a numeric max-width - no arbitrary CSS reaches the page.
 pub(crate) fn apply_image_hints(html: &str) -> String {
    let mut out = String::new();
    let mut rest = html;
    while let Some(pos) = rest.find("<img ") {
        out.push_str(&rest[..pos]);
        let after = &rest[pos..];
        let end = after.find('>').map(|e| e + 1).unwrap_or(after.len());
        out.push_str(&rewrite_img_tag(&after[..end]));
        rest = &after[end..];
    }
    out.push_str(rest);
    out
 }
 pub(crate) fn rewrite_img_tag(tag: &str) -> String {
    // Pull the title value, if any.
    let title = tag
        .find("title=\"")
        .map(|i| &tag[i + 7..])
        .and_then(|r| r.find('"').map(|e| &r[..e]))
        .unwrap_or("");
    let mut class = String::new();
    let mut max_rem: Option<f32> = None;
    for tok in title.split_whitespace() {
        match tok {
            "left" => class = "md-float-left".into(),
            "right" => class = "md-float-right".into(),
            other => {
                if let Ok(n) = other.trim_end_matches("rem").parse::<f32>() {
                    if n > 0.0 && n <= 60.0 {
                        max_rem = Some(n);
                    }
                }
            }
        }
    }
    // Strip the title attribute from the tag.
    let mut cleaned = tag.to_string();
    if let Some(i) = cleaned.find(" title=\"") {
        if let Some(e) = cleaned[i + 8..].find('"') {
            cleaned.replace_range(i..i + 8 + e + 1, "");
        }
    }
    // Inject class/style right after `<img`.
    let mut attrs = String::new();
    if !class.is_empty() {
        attrs.push_str(&format!(" class=\"{class}\""));
    }
    if let Some(n) = max_rem {
        attrs.push_str(&format!(" style=\"max-width:{n}rem\""));
    }
    if attrs.is_empty() {
        return cleaned;
    }
    cleaned.replacen("<img", &format!("<img{attrs}"), 1)
 }
@@ -0,0 +1,290 @@
 //! What a content repo must satisfy before it serves: every action
 //! lands on a page, every transition is one the state machine allows,
 //! every recorded bucket is read back somewhere, and the built-in
 //! aggregates the runtime owns are always present.
 #[allow(unused_imports)] // the browser build sees fewer items
 use super::*;
 /// A relay must be a ws:// or wss:// URL - shared between site.yaml's
 /// hero and `Requirement.relay` validation.
 #[cfg(feature = "ssr")]
 pub fn validate_relay_url(relay: &str) -> anyhow::Result<()> {
    let parsed = url::Url::parse(relay)
        .map_err(|e| anyhow::anyhow!("relay {relay:?} is not a valid URL: {e}"))?;
    if !matches!(parsed.scheme(), "ws" | "wss") {
        anyhow::bail!("relay {relay:?} must use the ws:// or wss:// scheme");
    }
    Ok(())
 }
 /// Validates every declared transition target (`SelfTransition.to`,
 /// `ResourceSpec.transitions[].to`) against `aggregates` - the real
 /// state graph loaded from `aggregates.yaml` - for every bucket that
 /// has one declared. A bucket with no entry in `aggregates` is left
 /// alone entirely (no validation applied): not every bucket needs to
 /// be event-sourced to keep working. Called on every content
 /// load/reload (`watch_for_reload`, `main.rs`'s boot path) and by the
 /// standalone `question-lint` binary, so a YAML typo becomes a caught,
 /// logged rejection instead of a silently-accepted, later-broken
 /// string.
 /// Bucket the runtime keeps for announced pages (`Question.event`):
 /// one record per event question, `announced` while the window is
 /// open, `awaiting_summary` once it closes - the "post what happened"
 /// task a desk reading this bucket picks up - and `summarized` when an
 /// owner marks it done. Declared here, not in content, because the
 /// runtime's sweeper (`announce.rs`) is what moves the records.
 pub const EVENTS_BUCKET: &str = "portal_events";
 #[cfg(feature = "ssr")]
 const BUILTIN_AGGREGATES_YAML: &str = "\
 aggregates:
  - bucket: portal_events
    initial: announced
    states:
      announced: { event: announced }
      awaiting_summary: { event: ended }
      summarized: { event: summarized }
    transitions:
      announced: [awaiting_summary, summarized]
      awaiting_summary: [summarized]
 ";
 /// Adds the runtime's own state graphs to a content repo's. Content
 /// wins if it declares the same bucket (say, to add states).
 #[cfg(feature = "ssr")]
 pub fn with_builtin_aggregates(
    mut aggregates: std::collections::HashMap<String, crate::aggregates::AggregateSchema>,
 ) -> std::collections::HashMap<String, crate::aggregates::AggregateSchema> {
    let builtin = crate::aggregates::parse_aggregates_yaml(BUILTIN_AGGREGATES_YAML)
        .expect("builtin aggregates yaml is valid");
    for (bucket, schema) in builtin {
        aggregates.entry(bucket).or_insert(schema);
    }
    aggregates
 }
 /// True when some kv resource in the content reads `bucket` - the
 /// attended-bucket check, exposed so the lint can warn about the
 /// runtime's own `portal_events` (a warning, not a failure: a repo
 /// with no event pages has nothing to attend).
 #[cfg(feature = "ssr")]
 pub fn bucket_is_read(questions: &std::collections::HashMap<String, Question>, bucket: &str) -> bool {
    questions.values().any(|q| {
        q.alternatives.iter().any(|a| {
            a.features
                .iter()
                .any(|f| f.resource.as_ref().and_then(|r| r.bucket()).is_some_and(|b| b == bucket))
        })
    })
 }
 #[cfg(feature = "ssr")]
 pub fn validate_questions(
    questions: &std::collections::HashMap<String, Question>,
    aggregates: &std::collections::HashMap<String, crate::aggregates::AggregateSchema>,
 ) -> anyhow::Result<()> {
    for question in questions.values() {
        if let Some(event) = &question.event {
            if question.is_dynamic() {
                anyhow::bail!("question {:?}: a dynamic page can't carry an event", question.id);
            }
            if let Err(e) = event.window_ms() {
                anyhow::bail!("question {:?}: event: {e}", question.id);
            }
        }
        if let Some(target) = &question.requires_chain {
            if !questions.contains_key(target) {
                anyhow::bail!(
                    "question {:?}: requires_chain {:?} does not match any declared question id",
                    question.id,
                    target
                );
            }
        }
        for alternative in &question.alternatives {
            // A dangling action is a literal dead end: the submit
            // button navigates to "Nothing here".
            if let Some(action) = &alternative.action {
                if action.contains('{') {
                    // Placeholders are filled at submit time; the
                    // shape must land on a dynamic page once filled.
                    let probe = template_action(action, &serde_json::json!({}));
                    let filled = {
                        let mut a = action.clone();
                        while let (Some(i), Some(j)) = (a.find('{'), a.find('}')) {
                            a.replace_range(i..=j, "x");
                        }
                        a
                    };
                    let _ = probe;
                    // Match the pattern itself: resolve_question would
                    // hand back a clone whose id is already concrete.
                    let lands = questions
                        .values()
                        .any(|q| q.is_dynamic() && path_matches(&q.id, &filled).is_some());
                    if lands {
                        continue;
                    }
                    anyhow::bail!(
                        "question {:?} alternative {:?}: templated action {:?} must land on a dynamic page ([name].yaml)",
                        question.id, alternative.name, action
                    );
                }
                match questions.get(action) {
                    None => anyhow::bail!(
                        "question {:?} alternative {:?}: action {:?} does not match any declared question id",
                        question.id, alternative.name, action
                    ),
                    // A dynamic page needs a concrete segment value to
                    // be a URL - a submit button can't supply one.
                    Some(target) if target.is_dynamic() => anyhow::bail!(
                        "question {:?} alternative {:?}: action {:?} targets a dynamic page - actions must name a concrete question",
                        question.id, alternative.name, action
                    ),
                    Some(_) => {}
                }
            }
            if let Some(st) = &alternative.self_transition {
                if let Some(schema) = aggregates.get(&st.bucket) {
                    if !schema.has_state(&st.to) {
                        anyhow::bail!(
                            "question {:?} alternative {:?}: self_transition.to {:?} is not a declared state for bucket {:?}",
                            question.id, alternative.name, st.to, st.bucket
                        );
                    }
                }
            }
            // Bind targets resolve across the whole alternative, same
            // scope as the signal maps the renderer builds.
            let sibling_names: std::collections::HashSet<&str> = alternative
                .features
                .iter()
                .flat_map(|f| f.requirements.iter())
                .map(|r| r.name.as_str())
                .collect();
            for feature in &alternative.features {
                for requirement in &feature.requirements {
                    if requirement.kind == "select"
                        && requirement.resource.is_none()
                        && requirement.options.is_empty()
                    {
                        anyhow::bail!(
                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: select but declares neither a resource nor inline options",
                            question.id, alternative.name, feature.name, requirement.name
                        );
                    }
                    if let Some(relay) = &requirement.relay {
                        if requirement.kind != "gesture" && requirement.kind != "voice" {
                            anyhow::bail!(
                                "question {:?} alternative {:?} feature {:?}: requirement {:?} declares relay but is type {:?} - relay only makes sense on type: gesture or voice",
                                question.id, alternative.name, feature.name, requirement.name, requirement.kind
                            );
                        }
                        validate_relay_url(relay).map_err(|e| anyhow::anyhow!(
                            "question {:?} alternative {:?} feature {:?}: requirement {:?}: {e}",
                            question.id, alternative.name, feature.name, requirement.name
                        ))?;
                    }
                    if requirement.kind == "gesture"
                        && (requirement.resource.is_some() || requirement.bind.is_some())
                    {
                        anyhow::bail!(
                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: gesture - it draws its value, it can't also load one from a resource or bind",
                            question.id, alternative.name, feature.name, requirement.name
                        );
                    }
                    if let Some(bind) = &requirement.bind {
                        if bind.field == requirement.name
                            || !sibling_names.contains(bind.field.as_str())
                        {
                            anyhow::bail!(
                                "question {:?} alternative {:?} feature {:?}: requirement {:?} binds to {:?}, which is not another requirement on this alternative",
                                question.id, alternative.name, feature.name, requirement.name, bind.field
                            );
                        }
                    }
                }
                let Some(resource) = &feature.resource else {
                    continue;
                };
                let Some(bucket) = resource.bucket() else {
                    continue;
                };
                let Some(schema) = aggregates.get(bucket) else {
                    continue;
                };
                for transition in &resource.transitions {
                    if !schema.has_state(&transition.from) {
                        anyhow::bail!(
                            "question {:?} alternative {:?} feature {:?}: transition.from {:?} is not a declared state for bucket {:?}",
                            question.id, alternative.name, feature.name, transition.from, bucket
                        );
                    }
                    if !schema.has_state(&transition.to) {
                        anyhow::bail!(
                            "question {:?} alternative {:?} feature {:?}: transition.to {:?} is not a declared state for bucket {:?}",
                            question.id, alternative.name, feature.name, transition.to, bucket
                        );
                    }
                    if !schema.allowed(&transition.from).iter().any(|s| s == &transition.to) {
                        anyhow::bail!(
                            "question {:?} alternative {:?} feature {:?}: transition {:?} -> {:?} is not a declared edge for bucket {:?}",
                            question.id, alternative.name, feature.name, transition.from, transition.to, bucket
                        );
                    }
                }
            }
        }
    }
    // Attended buckets: no publicly collected answer may land somewhere
    // nothing reads. Every `record_as` bucket must either be read back
    // by some Kv resource in this same content repo (a desk or listing)
    // or carry an explicit `attended_by:` annotation in aggregates.yaml
    // naming the automation that consumes it. This is a contract, not a
    // convention, because convention already failed once: a question
    // was dropped and its bucket - answers included - silently fell out
    // of every reader's view.
    let mut read_buckets = std::collections::HashSet::new();
    let note_resource = |spec: &ResourceSpec, set: &mut std::collections::HashSet<String>| {
        if let ResourceSource::Kv { bucket } = &spec.source {
            set.insert(bucket.clone());
        }
    };
    for question in questions.values() {
        for alternative in &question.alternatives {
            for feature in &alternative.features {
                if let Some(spec) = &feature.resource {
                    note_resource(spec, &mut read_buckets);
                }
                for requirement in &feature.requirements {
                    if let Some(spec) = &requirement.resource {
                        note_resource(spec, &mut read_buckets);
                    }
                    if let Some(bind) = &requirement.bind {
                        note_resource(&bind.resource, &mut read_buckets);
                    }
                }
            }
        }
    }
    for question in questions.values() {
        for alternative in &question.alternatives {
            if let Some(bucket) = &alternative.record_as {
                let attended = read_buckets.contains(bucket)
                    || aggregates
                        .get(bucket)
                        .is_some_and(|schema| schema.attended_by.is_some());
                if !attended {
                    anyhow::bail!(
                        "question {:?} alternative {:?}: record_as {bucket:?} is unattended - no page reads that bucket back, and aggregates.yaml declares no attended_by for it. Add a desk/listing resource over it, or annotate the automation that consumes it.",
                        question.id, alternative.name
                    );
                }
            }
        }
    }
    Ok(())
 }
@@ -0,0 +1,64 @@
 //! The one outbound HTTP client, bounded. Every server-side fetch -
 //! Gitea content at boot and on reload, the raw-asset proxy, the
 //! repo-info endpoint, and the content-declared `url` resource - goes
 //! through here, so a slow or oversized upstream can cost a request at
 //! most `TIMEOUT` and `cap` bytes, never a thread or the heap. Before
 //! this module each call site built its own client with no timeout and
 //! read whole bodies with `.text()`.
 #![cfg(feature = "ssr")]
 use std::sync::OnceLock;
 use std::time::Duration;
 use openidconnect::reqwest;
 /// Whole-request budget: connect, headers, and body.
 pub const TIMEOUT: Duration = Duration::from_secs(20);
 const CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
 /// A content-declared URL resource: JSON for one card.
 pub const URL_RESOURCE_CAP: usize = 2 * 1024 * 1024;
 /// A Gitea API reply or one content file (a tree listing, a YAML page).
 pub const GITEA_CAP: usize = 8 * 1024 * 1024;
 /// A content-shipped asset proxied to the browser (an image, a font).
 pub const ASSET_CAP: usize = 32 * 1024 * 1024;
 pub fn client() -> &'static reqwest::Client {
    static CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
    CLIENT.get_or_init(|| {
        reqwest::Client::builder()
            .connect_timeout(CONNECT_TIMEOUT)
            .timeout(TIMEOUT)
            .redirect(reqwest::redirect::Policy::limited(5))
            .user_agent(concat!("portal/", env!("CARGO_PKG_VERSION")))
            .build()
            .expect("a client with static options always builds")
    })
 }
 /// Reads a body up to `cap` bytes; one byte more is an error, not a
 /// truncation, so a caller never parses half a document.
 pub async fn bytes(mut response: reqwest::Response, cap: usize) -> anyhow::Result<Vec<u8>> {
    let hint = response.content_length().unwrap_or(0) as usize;
    if hint > cap {
        anyhow::bail!("response of {hint} bytes exceeds the cap of {cap}");
    }
    let mut out = Vec::with_capacity(hint.min(cap));
    while let Some(chunk) = response.chunk().await? {
        if out.len() + chunk.len() > cap {
            anyhow::bail!("response exceeds the cap of {cap} bytes");
        }
        out.extend_from_slice(&chunk);
    }
    Ok(out)
 }
 pub async fn text(response: reqwest::Response, cap: usize) -> anyhow::Result<String> {
    Ok(String::from_utf8(bytes(response, cap).await?)?)
 }
 /// `GET url`, status checked, body read under `cap`.
 pub async fn get_text(url: &str, cap: usize) -> anyhow::Result<String> {
    let response = client().get(url).send().await?.error_for_status()?;
    text(response, cap).await
 }
@@ -0,0 +1,97 @@
 //! Chrome-string translations, selected by `site.yaml`'s `lang`.
 //!
 //! Content carries its own language; this covers only the strings the
 //! portal itself speaks around it ("Asked by", the nav lead, the
 //! not-found page...). Unknown languages and unknown keys fall back
 //! to English, so a typo degrades to the default instead of a blank.
 /// Translate `key` for `lang`. `en` is the reference table; every
 /// other language falls through to it for keys it doesn't carry.
 pub fn t(lang: &str, key: &str) -> &'static str {
    if let Some(s) = lookup(lang, key) {
        return s;
    }
    lookup("en", key).unwrap_or(key_missing(key))
 }
 fn lookup(lang: &str, key: &str) -> Option<&'static str> {
    Some(match (lang, key) {
        ("en", "also_worth_asking") => "Also worth asking",
        ("en", "asked_by") => "Asked by ",
        ("en", "contact_them") => "contact them",
        ("en", "if_stuck") => " if you get stuck.",
        ("en", "send") => "Send",
        ("en", "sign_in") => "Sign in",
        ("en", "nothing_here_yet") => "Nothing here yet.",
        ("en", "nothing_here") => "Nothing here",
        ("en", "back_to_start") => "back to the start",
        ("en", "done") => "Done.",
        ("en", "follows_answer") => {
            "This page follows from an answer you don't seem to carry yet."
        }
        ("en", "owners_only") => {
            "This part of the site is for organizational owners — sign in with that account to take a look."
        }
        ("en", "announcements") => "Announcements",
        ("no", "also_worth_asking") => "Også verdt å spørre",
        ("no", "asked_by") => "Stilt av ",
        ("no", "contact_them") => "ta kontakt",
        ("no", "if_stuck") => " om du står fast.",
        ("no", "send") => "Send",
        ("no", "sign_in") => "Logg inn",
        ("no", "nothing_here_yet") => "Ingenting her ennå.",
        ("no", "nothing_here") => "Ingenting her",
        ("no", "back_to_start") => "tilbake til start",
        ("no", "done") => "Ferdig.",
        ("no", "follows_answer") => {
            "Denne siden følger av et svar du ikke ser ut til å bære ennå."
        }
        ("no", "owners_only") => {
            "Denne delen av siden er for organisasjonens eiere — logg inn med den kontoen for å ta en titt."
        }
        ("no", "announcements") => "Kunngjøringer",
        _ => return None,
    })
 }
 /// A missing key is a programmer error; render the key itself so it
 /// is findable, never a panic in a view.
 fn key_missing(key: &str) -> &'static str {
    // Leak is bounded: keys are a small fixed set of literals.
    Box::leak(key.to_string().into_boxed_str())
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn norwegian_covers_the_english_table() {
        for key in [
            "also_worth_asking",
            "asked_by",
            "contact_them",
            "if_stuck",
            "send",
            "sign_in",
            "nothing_here_yet",
            "nothing_here",
            "back_to_start",
            "done",
            "follows_answer",
            "owners_only",
            "announcements",
        ] {
            assert!(lookup("en", key).is_some(), "en missing {key}");
            assert!(lookup("no", key).is_some(), "no missing {key}");
        }
    }
    #[test]
    fn unknown_language_falls_back_to_english() {
        assert_eq!(t("de", "sign_in"), "Sign in");
        assert_eq!(t("en", "sign_in"), "Sign in");
    }
 }
@@ -4,11 +4,18 @@ pub mod auth;
 pub mod chain;
 pub mod content;
 pub mod events;
 pub mod i18n;
 pub mod resource;
 #[cfg(feature = "ssr")]
 pub mod aggregates;
 #[cfg(feature = "ssr")]
 pub mod announce;
 #[cfg(feature = "ssr")]
 pub mod http;
 #[cfg(feature = "ssr")]
 pub mod server;
@@ -29,7 +29,10 @@ async fn main() -> anyhow::Result<()> {
        .unwrap_or_else(|_| "https://project.uhhm.no/uhhm/questions".to_string());
    let content_branch = std::env::var("CONTENT_BRANCH").unwrap_or_else(|_| "main".to_string());
    let gitea_base = content::gitea_api_base(&content_repo)?;
-    let aggregates = content::load_aggregates_from_gitea(&content_repo, &content_branch).await?;
+    let content_raw_base = content::gitea_raw_base(&content_repo)?;
    let aggregates = content::with_builtin_aggregates(
        content::load_aggregates_from_gitea(&content_repo, &content_branch).await?,
    );
    let questions = content::load_questions_from_gitea(&content_repo, &content_branch, "questions").await?;
    content::validate_questions(&questions, &aggregates)?;
    let site = content::load_site_from_gitea(&content_repo, &content_branch).await?;
@@ -67,7 +70,7 @@ async fn main() -> anyhow::Result<()> {
    tokio::spawn(content::watch_for_reload(
        nats.clone(),
        content_repo,
-        content_branch,
+        content_branch.clone(),
        "questions".to_string(),
        questions.clone(),
        aggregates.clone(),
@@ -82,10 +85,16 @@ async fn main() -> anyhow::Result<()> {
        aggregates,
        site,
        gitea_base,
        content_raw_base,
        content_branch: content_branch.clone(),
        oidc: oidc_state,
        garage,
    };
    // Announced pages: keep their desk records current, close ended
    // windows (see announce.rs).
    tokio::spawn(portal::announce::run(state.clone()));
    // Dev-friendly defaults: in-memory sessions, secure cookies only when
    // COOKIE_SECURE=true (set it behind TLS in production) - same
    // defaults cnats uses. SameSite=Lax (tower-sessions defaults to
@@ -129,10 +138,6 @@ async fn main() -> anyhow::Result<()> {
    let favicon_dark_path = format!("{}/favicon-dark.svg", leptos_options.site_root);
    let wordmark_path = format!("{}/wordmark.svg", leptos_options.site_root);
    let swiper_path = format!("{}/swiper-element-bundle.min.js", leptos_options.site_root);
    // yes.js sits in public/ (not a wasm-bindgen snippet) so the
    // hero's inline early-mount script and the wasm binding can share
    // one stable URL - see `mod yes` in app.rs.
    let yes_path = format!("{}/yes.js", leptos_options.site_root);
    let fonts_dir = format!("{}/fonts", leptos_options.site_root);
    let app = Router::new()
@@ -140,8 +145,16 @@ async fn main() -> anyhow::Result<()> {
        .route("/auth/callback", get(oidc::callback))
        .route("/auth/logout", get(oidc::logout))
        .route("/api/{*fn_name}", any(server_fn_handler))
-        .route("/upload", post(upload::upload))
+        // axum caps request bodies at 2 MB by default, which had made the
        // 20 MB upload limit unreachable; raise the fence on this route only,
        // with room for the multipart framing.
        .route(
            "/upload",
            post(upload::upload).layer(axum::extract::DefaultBodyLimit::max(upload::MAX_UPLOAD_BYTES + 64 * 1024)),
        )
        .route("/gitea-repo", get(content::gitea_repo_handler))
        // Content-shipped assets (hero module etc.), same-origin.
        .route("/site/{*path}", get(content::site_asset_handler))
        .route("/automation/kv/{bucket}", get(content::automation_kv_handler))
        // no-cache = "revalidate before reuse", not "don't cache":
        // pkg files keep the same names across releases (portal.js,
@@ -167,17 +180,6 @@ async fn main() -> anyhow::Result<()> {
            "/swiper-element-bundle.min.js",
            ServeFile::new(swiper_path),
        )
        // Same skew concern as /pkg: the wasm's raw_module import and
        // the hero's inline script both load this by fixed name.
        .route_service(
            "/yes.js",
            tower::ServiceBuilder::new()
                .layer(tower_http::set_header::SetResponseHeaderLayer::overriding(
                    axum::http::header::CACHE_CONTROL,
                    axum::http::HeaderValue::from_static("no-cache"),
                ))
                .service(ServeFile::new(yes_path)),
        )
        .leptos_routes_with_context(
            &state,
            routes,
@@ -68,6 +68,16 @@ pub async fn get_requirement_options(
        .iter()
        .find(|r| r.name == requirement_name)
        .ok_or_else(|| ServerFnError::new("unknown requirement"))?;
    // Inline options: return them as {id,label} objects, the shape the
    // SelectField renders, without touching a resource.
    if !requirement.options.is_empty() {
        let items: Vec<serde_json::Value> = requirement
            .options
            .iter()
            .map(|o| serde_json::json!({ "id": o, "label": o }))
            .collect();
        return Ok(serde_json::Value::Array(items));
    }
    let resource = requirement
        .resource
        .as_ref()
@@ -250,21 +260,20 @@ async fn fetch_gitea_json(
    for (k, v) in params {
        url.query_pairs_mut().append_pair(k, v);
    }
-    let client = openidconnect::reqwest::Client::new();
+    let mut req = crate::http::client().get(url.clone());
    let mut req = client.get(url.clone());
    if let Ok(token) = std::env::var("GITEA_API_TOKEN") {
        if !token.is_empty() {
            req = req.header("Authorization", format!("token {token}"));
        }
    }
-    let text = req
+    let response = req
        .send()
        .await
        .and_then(|r| r.error_for_status())
-        .map_err(|e| ServerFnError::new(format!("fetching {url}: {e}")))?
+        .map_err(|e| ServerFnError::new(format!("fetching {url}: {e}")))?;
-        .text()
+    let text = crate::http::text(response, crate::http::GITEA_CAP)
        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
+        .map_err(|e| ServerFnError::new(format!("reading {url}: {e}")))?;
    serde_json::from_str(&text).map_err(|e| ServerFnError::new(e.to_string()))
 }
@@ -331,16 +340,17 @@ async fn fetch_url_json(
    for (k, v) in &leftover {
        parsed.query_pairs_mut().append_pair(k, v);
    }
-    let client = openidconnect::reqwest::Client::new();
+    let response = crate::http::client()
    let text = client
        .get(parsed.clone())
        .send()
        .await
        .and_then(|r| r.error_for_status())
-        .map_err(|e| ServerFnError::new(format!("fetching {parsed}: {e}")))?
+        .map_err(|e| ServerFnError::new(format!("fetching {parsed}: {e}")))?;
-        .text()
+    // Content picks the URL; the cap is what keeps a runaway endpoint
    // from becoming a runaway allocation here.
    let text = crate::http::text(response, crate::http::URL_RESOURCE_CAP)
        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
+        .map_err(|e| ServerFnError::new(format!("reading {parsed}: {e}")))?;
    serde_json::from_str(&text).map_err(|e| ServerFnError::new(e.to_string()))
 }
@@ -38,6 +38,10 @@ pub struct AppState {
    /// rather than re-derived per call, since `resolve_gitea_repo` needs
    /// it too and has no other reason to see `CONTENT_REPO` itself.
    pub gitea_base: String,
    /// `{gitea}/api/v1/repos/{owner}/{repo}/raw` and the branch - what
    /// `content::site_asset_handler` proxies content-shipped assets from.
    pub content_raw_base: String,
    pub content_branch: String,
    pub oidc: Arc<oidc::Oidc>,
    /// `None` when `GARAGE_*` env vars aren't set - uploads are the one
    /// optional feature, everything else works without Garage.
@@ -33,6 +33,13 @@ type OidcClient = CoreClient<
 >;
 pub struct Oidc {
    /// `None` when `KANIDM_URL` is unset: a content-only instance with
    /// sign-in disabled - auth routes answer 503, everything public
    /// renders as usual.
    inner: Option<OidcInner>,
 }
 struct OidcInner {
    client: OidcClient,
    http: openidconnect::reqwest::Client,
 }
@@ -45,7 +52,13 @@ const REDIRECT_KEY: &str = "oidc_post_login_redirect";
 impl Oidc {
    /// Discovers the provider and builds the client from environment:
    /// `KANIDM_URL`, `OAUTH2_CLIENT_ID`, `OAUTH2_CLIENT_SECRET`, `PUBLIC_URL`.
    /// With `KANIDM_URL` unset, sign-in is disabled instead of fatal -
    /// the shape of a public content instance without a review desk.
    pub async fn from_env() -> anyhow::Result<Self> {
        if std::env::var("KANIDM_URL").is_err() {
            tracing::warn!("KANIDM_URL not set - sign-in disabled on this instance");
            return Ok(Self { inner: None });
        }
        let kanidm_url = require_env("KANIDM_URL")?;
        let client_id = require_env("OAUTH2_CLIENT_ID")?;
        let client_secret = require_env("OAUTH2_CLIENT_SECRET")?;
@@ -75,7 +88,16 @@ impl Oidc {
        )
        .set_redirect_uri(redirect);
-        Ok(Self { client, http })
+        Ok(Self {
            inner: Some(OidcInner { client, http }),
        })
    }
    fn configured(&self) -> Result<&OidcInner, HandlerError> {
        self.inner.as_ref().ok_or((
            StatusCode::SERVICE_UNAVAILABLE,
            "sign-in is not configured on this instance".to_string(),
        ))
    }
 }
@@ -118,10 +140,10 @@ pub async fn login(
        session.insert(REDIRECT_KEY, redirect).await.map_err(internal)?;
    }
    let oidc = state.oidc.configured()?;
    let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();
-    let (auth_url, csrf_state, nonce) = state
+    let (auth_url, csrf_state, nonce) = oidc
        .oidc
        .client
        .authorize_url(
            CoreAuthenticationFlow::AuthorizationCode,
@@ -182,7 +204,7 @@ pub async fn callback(
        ));
    }
-    let oidc = &state.oidc;
+    let oidc = state.oidc.configured()?;
    let token_response = oidc
        .client
        .exchange_code(AuthorizationCode::new(params.code))
@@ -15,7 +15,7 @@ use serde::Serialize;
 use crate::server::AppState;
-const MAX_UPLOAD_BYTES: usize = 20 * 1024 * 1024;
+pub const MAX_UPLOAD_BYTES: usize = 20 * 1024 * 1024;
 #[derive(Clone)]
 pub struct Garage {
@@ -84,12 +84,20 @@ pub async fn upload(
            .unwrap_or("application/octet-stream")
            .to_string();
        let filename = field.file_name().unwrap_or("upload").to_string();
-        let bytes = field
+        // Chunk by chunk, refused the moment the cap is crossed: an
-            .bytes()
+        // oversized body is never buffered whole before being turned
        // away. The route's body limit (main.rs) is the outer fence.
        let mut bytes: Vec<u8> = Vec::new();
        let mut field = field;
        while let Some(chunk) = field
            .chunk()
            .await
-            .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?;
+            .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?
-        if bytes.len() > MAX_UPLOAD_BYTES {
+        {
-            return Err((StatusCode::PAYLOAD_TOO_LARGE, "file too large".to_string()));
+            if bytes.len() + chunk.len() > MAX_UPLOAD_BYTES {
                return Err((StatusCode::PAYLOAD_TOO_LARGE, "file too large".to_string()));
            }
            bytes.extend_from_slice(&chunk);
        }
        let key = format!("{}-{filename}", uuid::Uuid::new_v4());
@@ -51,7 +51,7 @@
  --ink-dim: #9a9a9a;
  --line: #2a2a2a;
-  /* Cards float over the sticky YES canvas - translucent so the piece
+  /* Cards float over a sticky hero piece - translucent so the piece
     reads faintly through them (paired with backdrop-filter on
     .alt-card), shadowed so their edge against the animated backdrop
     is a soft lift rather than a hard contrast line. */
@@ -78,8 +78,9 @@
 /* Light theme: the same muted-press idea on white stock - warm paper,
   near-black ink, and the accent deepened from dusty cyan to a teal
   ink that actually carries as text on light paper (the dark theme's
-   #8ec2c0 washes out there). yes.js mirrors this palette on its own
+   #8ec2c0 washes out there). Canvas-drawing modules (gesture.js, and
-   (matchMedia in setupTheme) since canvas paint can't read CSS vars. */
+   content-shipped hero modules) mirror this palette on their own,
   since canvas paint can't read CSS vars. */
@media (prefers-color-scheme: light) {
  :root {
    --accent: #47807e;
@@ -98,19 +99,13 @@
    --hero-glow: rgba(246, 245, 241, 0.85);
  }
-  /* The wordmark SVG is a hardcoded white stroke (also used raw in
+  /* The house wordmark SVG is a hardcoded white stroke (also used
-     dark contexts elsewhere) - flip it to ink here rather than fork
+     raw in dark contexts elsewhere) - flip it to ink here rather
-     the asset. */
+     than fork the asset. A content-provided logo keeps its colors. */
-  .wordmark img {
+  .wordmark-house img {
    filter: invert(0.92);
  }
  /* overlay against near-white paper resolves to ~white and the
     raster ghost vanishes; multiply lets the light theme's gray YES
     (see rasterizeText's themed repaint in yes.js) show as ink. */
  .hero-canvas #rasterCanvas {
    mix-blend-mode: multiply;
  }
 }
 * {
@@ -152,6 +147,10 @@ a {
 main.loading,
 main.not-found {
  min-height: 60vh;
  /* svh so wrapper browsers that resize the webview as their toolbar
     animates (Firefox/Chrome iOS) don't reflow this placeholder - the
     small viewport is a fixed value. Same ladder as .hero-piece. */
  min-height: 60svh;
  display: flex;
  flex-direction: column;
  align-items: center;
@@ -198,98 +197,71 @@ main.not-found {
  color: var(--ink-dim);
  font-size: 1.05rem;
  max-width: 46ch;
  /* The measure cap shrinks the box below the copy column; without
     auto margins the box left-anchors and its centered text centers
     in the wrong frame. */
  margin-inline: auto;
 }
-/* the actual "YES - Rasterized Lines" piece live at uhhm.no (see
+/* A content-shipped hero module (site.yaml hero.kind: module) draws
-   public/yes.js) - landing page only. Full-viewport so it's a real
+   into .hero-piece; the module owns its look (it may restyle .hero
-   moment, not a thumbnail; hero-copy overlays near the bottom rather
+   itself). Portal only reserves the box so the copy doesn't jump when
-   than interrupting the canvas. */
+   the module mounts - plain-vh fallback first, as everywhere. */
-
+.hero-module .hero-piece {
 .hero-yes {
  /* Sticky at the viewport top for the whole scroll (its containing
     block is the page itself), so the piece stays animating behind
     everything that follows - the translucent cards scroll over it
     and it shows through them and in the gaps around them. z-index 0
     so positioned content below can stack above with z-index 1. */
  position: sticky;
  top: 0;
  z-index: 0;
  max-width: none;
  width: 100%;
  /* svh here is only the pre-JS/no-JS fallback (and first paint before
     yes.js's constructor runs). Once yes.js mounts, it overwrites this
     with an inline `height: <px>` frozen from a single measurement -
     see setupCanvas()'s comment in yes.js for why: on real mobile
     Safari, content bottom-aligned inside this box kept sliding down
     as the address bar collapsed even with a spec'd-stable viewport
     unit here, so the box's actual height can't be trusted to stay
     put on that unit alone. An inline style set from JS always wins
     the cascade over this rule, so that frozen number is what
     actually governs once the page is interactive.
     Plain-vh fallback declared first - an engine without svh support
     ignores the invalid second line rather than falling through to
     auto height, which would collapse this to the height of its
     in-flow content and clip the canvas via overflow:hidden below. */
  height: 100vh;
  height: 100svh;
  padding: 0;
  justify-content: flex-end;
  overflow: hidden;
 }
 .hero-canvas {
  position: absolute;
  inset: 0;
 }
 .hero-canvas canvas {
  position: absolute;
  top: 0;
  left: 0;
  cursor: pointer;
 }
 .hero-canvas #rasterCanvas {
  mix-blend-mode: overlay;
  opacity: 0.5;
 }
 .hero-yes .hero-copy {
  position: relative;
  z-index: 1;
  padding: 0 1.5rem 3.5rem;
  gap: 0.6rem;
  text-shadow: 0 0.12em 1.4em var(--hero-glow);
 }
 /* The gesture hero (site.yaml hero.kind: gesture - redoal.com's
   landing): a tall drawing surface where the visitor's stroke and
   ambient echoes from the relay share the stage. Not sticky like the
   YES piece - drawing and scrolling fight over the same finger. */
 .hero-gesture .hero-draw {
  position: relative;
  width: 100%;
  max-width: 46rem;
  /* Same jump-avoidance as .gesture-wrap: the canvas (55svh tall)
     only exists after hydration, so hold its height open from the
     first paint. Plain-vh fallback first, like the canvas itself. */
  min-height: 55vh;
  min-height: 55svh;
 }
-.hero-gesture .gesture-canvas {
+/* announcements - live event pages, a strip above the hero copy.
-  aspect-ratio: auto;
+   Header, not footer: the one place a page claims attention before
-  /* Plain-vh fallback first, same reasoning as .hero-yes's height. */
+   the question is asked. */
-  height: 55vh;
+.announce {
-  height: 55svh;
+  width: 100%;
-  border: none;
+  display: flex;
-  background: transparent;
+  flex-wrap: wrap;
  justify-content: center;
  gap: 0.6rem 1.2rem;
  margin: -2rem 0 0.5rem;
  font-size: 0.88rem;
  position: relative;
  z-index: 1;
 }
-.hero-gesture .gesture-status {
+.announce-item {
-  top: auto;
+  display: inline-flex;
-  bottom: 0.55rem;
+  flex-wrap: wrap;
-  right: 0.55rem;
+  align-items: baseline;
  gap: 0.35rem 0.7rem;
  padding: 0.45rem 0.9rem;
  border: 0.06rem solid var(--line);
  border-left: 0.2rem solid var(--accent);
  border-radius: 0.3rem;
  color: var(--ink);
  text-decoration: none;
  background: var(--paper);
  transition: border-color 120ms;
 }
 .announce-item:hover,
 .announce-item[aria-current="page"] {
  border-color: var(--accent);
 }
 .announce-name {
  font-weight: 600;
 }
 .announce-when {
  color: var(--ink-dim);
 }
 .announce-relative {
  color: var(--accent);
  text-transform: uppercase;
  letter-spacing: 0.06em;
  font-size: 0.72rem;
 }
 /* alternatives */
@@ -400,8 +372,12 @@ main.not-found {
 .alt-image {
  display: block;
  width: 100%;
-  max-height: 14rem;
+  height: auto;
-  object-fit: cover;
+  /* Natural aspect, not a cropped band; a very tall image is still
     bounded so it can't tower. The deck below overrides for its
     fixed-height cards. */
  max-height: 32rem;
  object-fit: contain;
  border-radius: calc(var(--radius) - 0.3rem);
  margin-bottom: 1.1rem;
 }
@@ -466,10 +442,9 @@ main.not-found {
 }
 .feature-icon {
  float: left;
  width: 1.3rem;
  height: 1.3rem;
-  margin: 0.1rem 0.6rem 0.4rem 0;
+  margin-top: 0.1rem;
  background-color: var(--feature-accent, currentColor);
  mask-repeat: no-repeat;
  mask-size: contain;
@@ -479,11 +454,141 @@ main.not-found {
  -webkit-mask-position: center;
 }
 /* With an icon the feature is two columns: the icon in the first,
   everything else - name, description, fields, resources - in the
   second, so every line of text shares one left edge instead of
   wrapping back under the icon. */
 .feature:has(> .feature-icon) {
  display: grid;
  grid-template-columns: 1.3rem minmax(0, 1fr);
  column-gap: 0.7rem;
  align-items: start;
 }
 .feature:has(> .feature-icon) > .feature-icon {
  grid-column: 1;
  grid-row: 1;
 }
 .feature:has(> .feature-icon) > :not(.feature-icon) {
  grid-column: 2;
 }
 .feature h3 {
  font-size: 1rem;
  margin-bottom: 0.15em;
 }
 /* voice field (voice.js): a record button, a status line, a preview */
 .voice-wrap {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 0.6rem 1rem;
 }
 .voice-button {
  font: inherit;
  padding: 0.55rem 1.1rem;
  border: 0.06rem solid var(--accent);
  border-radius: 2rem;
  background: transparent;
  color: var(--ink);
  cursor: pointer;
 }
 .voice-button:hover:not(:disabled) {
  background: var(--accent);
  color: var(--paper);
 }
 .voice-button.recording {
  background: var(--accent);
  color: var(--paper);
  animation: voice-pulse 1.2s ease-in-out infinite;
 }
 .voice-button:disabled {
  opacity: 0.5;
  cursor: default;
 }
@keyframes voice-pulse {
  50% { opacity: 0.6; }
 }
 .voice-status {
  font-size: 0.85rem;
  color: var(--ink-dim);
 }
 .voice-preview,
 .item-card-audio {
  display: block;
  width: 100%;
  max-width: 28rem;
  margin-top: 0.4rem;
 }
 /* display:block above would beat the hidden attribute */
 .voice-preview[hidden] {
  display: none;
 }
 /* links inside markdown descriptions */
 .alt-description a,
 .feature p a {
  color: inherit;
  text-decoration: none;
  border-bottom: 0.06rem solid var(--accent);
 }
 .alt-description a:hover,
 .feature p a:hover {
  color: var(--accent);
 }
 /* images inside markdown descriptions: full-width figures in the
   card's flow, framed like the rest of the press sheet */
 .alt-description img,
 .item-card-description img,
 .feature p img {
  display: block;
  width: 100%;
  margin: 0.6rem 0 0.2rem;
  border-radius: 0.5rem;
  border: 0.06rem solid var(--line);
 }
 /* Content hint via a markdown image title (`![alt](url "right 9rem")`):
   float and shrink so text wraps around a portrait. */
 .alt-description img.md-float-left,
 .item-card-description img.md-float-left,
 .feature p img.md-float-left,
 .alt-description img.md-float-right,
 .item-card-description img.md-float-right,
 .feature p img.md-float-right {
  width: auto;
  max-width: 45%;
 }
 .alt-description img.md-float-left,
 .item-card-description img.md-float-left,
 .feature p img.md-float-left {
  float: left;
  margin: 0.2rem 1.1rem 0.5rem 0;
 }
 .alt-description img.md-float-right,
 .item-card-description img.md-float-right,
 .feature p img.md-float-right {
  float: right;
  margin: 0.2rem 0 0.5rem 1.1rem;
 }
 .alt-description code,
 .feature p code {
  font-size: 0.9em;
 }
 .feature p {
  color: var(--ink-dim);
  font-size: 0.95rem;
@@ -564,10 +669,16 @@ textarea:focus {
   custom properties - so palette changes go there AND here. */
 .gesture-wrap {
  position: relative;
-  /* The canvas is created by JS only after wasm hydration - reserve
+  width: 100%;
-     its 3/2 box now so content below doesn't jump when it appears.
+}
-     aspect-ratio is a preferred size, so the box still grows when the
+
-     echo thumbnail strip shows up under the canvas. */
+/* The canvas is created by JS only after wasm hydration - reserve its
   3/2 box until then so content below doesn't jump. Scoped to :empty
   on purpose: on the mounted wrap (a stretched item inside the flex
   .field) the same aspect-ratio turned the echo strip's extra height
   into extra WIDTH and the whole card ballooned past the viewport
   after the first stroke. */
 .gesture-wrap:empty {
  aspect-ratio: 3 / 2;
 }
@@ -584,11 +695,17 @@ textarea:focus {
  touch-action: none;
 }
 /* Results overlay the canvas instead of growing the widget - the
   page never jumps when places arrive (or don't). */
 .gesture-echoes {
  position: absolute;
  left: 0.6rem;
  right: 0.6rem;
  bottom: 0.6rem;
  display: flex;
  justify-content: center;
  gap: 0.5rem;
-  margin-top: 0.5rem;
+  pointer-events: none;
  min-height: 3rem;
 }
 .gesture-echoes:empty {
@@ -603,12 +720,48 @@ textarea:focus {
  border-radius: 0.4rem;
  opacity: 0;
  transition: opacity 0.5s ease;
  pointer-events: auto;
  box-shadow: 0 0.15rem 0.6rem rgba(0, 0, 0, 0.18);
 }
 .gesture-echo.shown {
  opacity: var(--echo-strength, 1);
 }
 /* places are pickable: the pick re-derives the input's key */
 .gesture-echo {
  cursor: pointer;
  transition: opacity 0.5s ease, border-color 120ms, transform 120ms;
 }
 .gesture-echo:hover,
 .gesture-echo:focus-visible {
  border-color: var(--accent);
  outline: none;
 }
 .gesture-echo.selected {
  border-color: var(--accent);
  box-shadow: 0 0 0 0.12rem var(--accent);
  transform: translateY(-0.1rem);
 }
 .gesture-empty {
  position: absolute;
  left: 0;
  right: 0;
  bottom: 0.7rem;
  margin: 0;
  text-align: center;
  font-size: 0.85rem;
  color: var(--ink-dim);
  pointer-events: none;
 }
 .gesture-empty:empty {
  display: none;
 }
 .gesture-status {
  position: absolute;
  top: 0.55rem;
@@ -740,6 +893,10 @@ textarea:focus {
  padding: 0.75rem 1.4rem;
  cursor: pointer;
  transition: filter 120ms, transform 120ms;
  /* A gateway alternative renders this as an <a> (navigation, no POST);
     kill the link chrome so it reads as the button it looks like. */
  text-decoration: none;
  display: inline-block;
 }
 .alt-submit:hover {
@@ -755,6 +912,13 @@ textarea:focus {
  cursor: wait;
 }
 /* A content-disabled alternative (`disabled: true`): announced, not
   yet takeable - reads as a promise, not as a stuck form. */
 .alt-submit.soon:disabled {
  cursor: not-allowed;
  opacity: 0.6;
 }
 .gate-card {
  text-align: center;
 }
@@ -881,6 +1045,9 @@ textarea:focus {
 .item-card-description {
  font-size: 0.9rem;
  color: var(--ink-dim);
  /* The card is a grid with its own gap; the global p bottom margin
     would stack on top of it. */
  margin: 0;
 }
 .item-card-fields {
@@ -0,0 +1,66 @@
 //! The one test that meets a real JetStream: a submission becomes an
 //! aggregate, a desk move is accepted, an undeclared move is refused,
 //! and the record reads back from its own event log. Everything else
 //! in the suite replays in memory; this is what proves the store, the
 //! event log and the projection agree with each other.
 //!
 //! Runs only when `PORTAL_TEST_NATS_URL` points at a JetStream (CI
 //! starts a throwaway one, see `.gitea/workflows/test.yml`); without
 //! it the test passes as skipped, so `cargo test` stays green offline.
 #![cfg(feature = "ssr")]
 use portal::aggregates::{self, parse_aggregates_yaml, TransitionError};
 use portal::answers::{store_answer, Answer};
 use portal::events::store::{ensure_stream, load_events};
 use serde_json::json;
 #[tokio::test]
 async fn a_submission_is_created_moved_refused_and_read_back_through_the_real_engine() {
    let Ok(url) = std::env::var("PORTAL_TEST_NATS_URL") else {
        eprintln!("skipped: PORTAL_TEST_NATS_URL is not set");
        return;
    };
    let js = async_nats::jetstream::new(async_nats::connect(&url).await.expect("connect"));
    ensure_stream(&js).await.expect("event stream");
    // A bucket of its own per run, so reruns and parallel runs never
    // read each other's records.
    let bucket = format!("it_{}", chrono::Utc::now().timestamp_millis());
    let schemas = parse_aggregates_yaml(&format!(
        "aggregates:\n  - bucket: {bucket}\n    initial: open\n    states:\n      open: {{ event: received }}\n      quoted: {{ event: quoted }}\n      won: {{ event: won }}\n      lost: {{ event: lost }}\n    transitions:\n      open: [quoted, lost]\n      quoted: [won, lost]\n"
    ))
    .expect("schema");
    let schema = &schemas[&bucket];
    let now = chrono::Utc::now().timestamp_millis();
    // The submission: a KV record in the initial state, plus the first event.
    store_answer(&js, &schemas, &bucket, "rec-1".into(), "/", "Hire us", &json!({"email": "a@b.example"}), now)
        .await
        .expect("store");
    let store = js.get_key_value(&bucket).await.expect("bucket exists");
    let stored: Answer = serde_json::from_slice(&store.get("rec-1").await.unwrap().expect("record")).unwrap();
    assert_eq!(stored.state, "open");
    assert_eq!(stored.responses["email"], "a@b.example");
    // A desk move the machine allows.
    let moved = aggregates::transition(&js, schema, "rec-1", "quoted", json!({"by": "test"}), now + 1)
        .await
        .expect("open -> quoted is declared");
    assert_eq!(moved.state, "quoted");
    // Moves the machine does not allow are refused, whoever asks.
    let back = aggregates::transition(&js, schema, "rec-1", "open", json!({}), now + 2).await;
    assert!(matches!(back, Err(TransitionError::DisallowedTransition { .. })), "{back:?}");
    let skip = aggregates::transition(&js, schema, "rec-1", "won", json!({}), now + 2).await;
    assert!(skip.is_ok(), "quoted -> won is declared: {skip:?}");
    let nobody = aggregates::transition(&js, schema, "rec-9", "quoted", json!({}), now + 3).await;
    assert!(matches!(nobody, Err(TransitionError::UnknownAggregate)), "{nobody:?}");
    // The record reads back from its own event log, in the state the
    // accepted moves left it, with a sequence that moved forward.
    let events = load_events(&js, &bucket, "rec-1").await.expect("events");
    assert_eq!(events.len(), 3, "received, quoted, won");
    let replayed = aggregates::replay(schema, "rec-1", &events).expect("replays");
    assert_eq!(replayed.state, "won");
    assert!(replayed.sequence > moved.sequence);
 }
@@ -0,0 +1,205 @@
 // A `type: voice` requirement: leave a recording at a gesture key.
 // Same contract as gesture.js - portal mounts it with the field's
 // hidden input and the relay URL, and calls stop() on navigation.
 //
 // The browser records with MediaRecorder (whatever container it
 // likes), decodes that to PCM with WebAudio, resamples to mono 48 kHz,
 // and ships one binary frame `[0x01][20-byte key][i16le PCM]` to the
 // relay, which encodes with the one recording codec, signs as itself,
 // keeps it and announces it (ADR-0015).
 //
 // Nothing leaves the browser until the alternative's own submit
 // ("Keep it here") is pressed: the widget intercepts that click,
 // uploads, sets the field's value to {key, digest, duration_ms} on
 // the relay's confirmation, and only then lets the submit through.
 // A relay error keeps the recording for another try and submits
 // nothing.
 //
 // Palette: colors come from the page's custom properties, no copy here.
 const MAX_SECONDS = 60;
 const SAMPLE_RATE = 48000;
 class VoiceWidget {
    constructor(container, hidden, relayUrl, key) {
        this.container = container;
        this.hidden = hidden || null;
        this.relayUrl = relayUrl || '';
        this.key = (key || '').trim();
        this.stopped = false;
        this.recorder = null;
        this.stream = null;
        this.chunks = [];
        this.ws = null;
        this.button = document.createElement('button');
        this.button.type = 'button';
        this.button.className = 'voice-button';
        this.button.textContent = 'Record';
        this.status = document.createElement('span');
        this.status.className = 'voice-status';
        this.preview = document.createElement('audio');
        this.preview.className = 'voice-preview';
        this.preview.controls = true;
        this.preview.hidden = true;
        container.append(this.button, this.status, this.preview);
        this._onClick = () => this.toggle();
        this.button.addEventListener('click', this._onClick);
        this.pcm = null;      // decoded, ready to upload
        this.published = null;
        this.passthrough = false;
        // The alternative's submit button: hold it until the recording
        // is kept at the relay.
        this.card = container.closest('.alt-card');
        this._onSubmit = (e) => this.onSubmitClick(e);
        if (this.card) this.card.addEventListener('click', this._onSubmit, true);
        if (!this.key || this.key.length !== 40) {
            this.button.disabled = true;
            this.say('This page has no address to leave a voice at.');
        } else if (!navigator.mediaDevices || !window.MediaRecorder) {
            this.button.disabled = true;
            this.say('Recording needs a browser with a microphone API.');
        }
    }
    say(text) {
        this.status.textContent = text;
    }
    async toggle() {
        if (this.recorder && this.recorder.state === 'recording') {
            this.recorder.stop();
            return;
        }
        try {
            this.stream = await navigator.mediaDevices.getUserMedia({ audio: true });
        } catch {
            this.say('Microphone access was declined.');
            return;
        }
        this.chunks = [];
        this.recorder = new MediaRecorder(this.stream);
        this.recorder.addEventListener('dataavailable', (e) => { if (e.data.size) this.chunks.push(e.data); });
        this.recorder.addEventListener('stop', () => this.finish());
        this.recorder.start();
        this.button.textContent = 'Stop';
        this.button.classList.add('recording');
        this.say(`Recording — up to ${MAX_SECONDS} seconds.`);
        this.capTimer = setTimeout(() => { if (this.recorder && this.recorder.state === 'recording') this.recorder.stop(); }, MAX_SECONDS * 1000);
    }
    async finish() {
        clearTimeout(this.capTimer);
        this.button.textContent = 'Record again';
        this.button.classList.remove('recording');
        if (this.stream) { this.stream.getTracks().forEach((t) => t.stop()); this.stream = null; }
        const blob = new Blob(this.chunks, { type: this.recorder.mimeType || 'audio/webm' });
        if (!blob.size) { this.say('Nothing was recorded.'); return; }
        this.preview.src = URL.createObjectURL(blob);
        this.preview.hidden = false;
        this.published = null;
        this.setValue(null);
        try {
            this.pcm = await this.toPcm16(await blob.arrayBuffer());
        } catch (e) {
            this.pcm = null;
            this.say('Could not decode the recording — try once more.');
            return;
        }
        this.say(`${Math.round(this.pcm.length / 2 / SAMPLE_RATE)} s recorded. Listen back, then press the button below to keep it here.`);
    }
    onSubmitClick(e) {
        const button = e.target.closest && e.target.closest('.alt-submit');
        if (!button || this.passthrough) return;
        if (this.published) return; // already kept: let the submit go
        e.preventDefault();
        e.stopPropagation();
        if (!this.pcm) {
            this.say(this.recorder && this.recorder.state === 'recording' ? 'Stop the recording first.' : 'Record something first.');
            return;
        }
        this.say('Sending to the relay…');
        this.upload(this.pcm, () => {
            // The relay confirmed: now the answer itself is submitted.
            this.passthrough = true;
            button.click();
            this.passthrough = false;
        });
    }
    // Decode → mono 48 kHz Float32 → Int16 little-endian bytes.
    async toPcm16(buffer) {
        const ctx = new (window.AudioContext || window.webkitAudioContext)();
        const decoded = await ctx.decodeAudioData(buffer);
        await ctx.close();
        const frames = Math.ceil(decoded.duration * SAMPLE_RATE);
        const offline = new OfflineAudioContext(1, frames, SAMPLE_RATE);
        const src = offline.createBufferSource();
        src.buffer = decoded;
        src.connect(offline.destination);
        src.start();
        const rendered = await offline.startRendering();
        const f32 = rendered.getChannelData(0);
        const out = new Uint8Array(f32.length * 2);
        const view = new DataView(out.buffer);
        for (let i = 0; i < f32.length; i++) {
            const s = Math.max(-1, Math.min(1, f32[i]));
            view.setInt16(i * 2, s < 0 ? s * 32768 : s * 32767, true);
        }
        return out;
    }
    upload(pcm, onPublished) {
        if (!this.relayUrl) { this.say('No relay to send to.'); return; }
        const frame = new Uint8Array(1 + 20 + pcm.length);
        frame[0] = 1;
        for (let i = 0; i < 20; i++) frame[1 + i] = parseInt(this.key.substr(i * 2, 2), 16);
        frame.set(pcm, 21);
        const ws = new WebSocket(this.relayUrl);
        ws.binaryType = 'arraybuffer';
        this.ws = ws;
        ws.addEventListener('open', () => ws.send(frame));
        ws.addEventListener('message', (e) => {
            let msg; try { msg = JSON.parse(e.data); } catch { return; }
            if (msg.type === 'published') {
                this.published = { key: this.key, digest: msg.digest, duration_ms: msg.duration_ms };
                this.setValue(this.published);
                this.say(`Kept at this address — ${Math.round(msg.duration_ms / 1000)} s.`);
                this.button.disabled = true;
                ws.close();
                if (onPublished) onPublished();
            } else if (msg.type === 'error') {
                this.say((msg.message || 'The relay declined the recording.') + ' Your recording is still here — try again.');
                ws.close();
            }
        });
        ws.addEventListener('error', () => this.say('The relay could not be reached. Your recording is still here — try again.'));
        ws.addEventListener('close', (e) => {
            if (!this.published && e.code !== 1000 && e.code !== 1005) {
                this.say('The relay closed the connection. Your recording is still here — try again.');
            }
        });
    }
    setValue(value) {
        if (!this.hidden) return;
        this.hidden.value = value ? JSON.stringify(value) : '';
        this.hidden.dispatchEvent(new Event('input', { bubbles: true }));
    }
    stop() {
        this.stopped = true;
        clearTimeout(this.capTimer);
        if (this.recorder && this.recorder.state === 'recording') this.recorder.stop();
        if (this.stream) this.stream.getTracks().forEach((t) => t.stop());
        if (this.ws) this.ws.close();
        this.button.removeEventListener('click', this._onClick);
        if (this.card) this.card.removeEventListener('click', this._onSubmit, true);
    }
 }
 export function mountVoice(container, hidden, relayUrl, key) {
    return new VoiceWidget(container, hidden, relayUrl, key);
 }