Release 0.3.35

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

Cargo.lock

@@ -2948,7 +2948,7 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.3.13"
+version = "0.3.35"
 dependencies = [
  "anyhow",
  "arc-swap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.3.13"
+version = "0.3.35"
 edition = "2021"
 
 [lib]

README.md

@@ -70,7 +70,10 @@ stream.
 - **Answer chains** (`src/chain.rs`): each submission hashes its
   parent(s), so a visitor's path through the questions is a verifiable
   lineage; `?chain=` links carry it, and self-service transitions
-  (unsubscribe) authorize by holding one.
+  (unsubscribe) authorize by holding one. The question nav reads it
+  too: a `followup` page is offered only when it is on that path (the
+  page the chain verifiably answered) or further down from the current
+  page over `action` edges - one followup path never unlocks another.
 - **Live resources** (`src/resource.rs`): content can pull a KV
   bucket, Gitea starred/org repos/releases, or any public JSON URL
   (SSRF fail-closed), reshaped by a content-declared `jq` filter.

gesture.js

@@ -43,6 +43,77 @@ const MAX_ECHOES = 8;
 const RECONNECT_BASE_MS = 1000;
 const RECONNECT_MAX_MS = 30000;
 
+// ── Convergence animation (ink → what the network heard) ──────────
+//
+// When the ack lands, a glowing copy of the stroke peels off and
+// converges point-by-point onto the key's decoded path: a wave of
+// "being understood" travels from the stroke's start to its end,
+// and the ghost materializes where the light settles. WebGL point
+// sprites with additive glow on a dedicated overlay canvas; the 2d
+// layer underneath never changes its final render, so losing WebGL
+// (or prefers-reduced-motion) degrades to exactly today's behavior.
+const CONVERGE_MS = 1500;
+const CONVERGE_FADE_MS = 450;
+const CONVERGE_POINTS = 128;
+const CONVERGE_STAGGER = 0.6; // fraction of the timeline spent on the travelling wave
+
+const GLOW_VERT = `
+attribute vec2 aFrom;
+attribute vec2 aTo;
+attribute float aIndex;
+uniform float uT;
+uniform vec2 uResolution;
+uniform float uDpr;
+varying float vLife;
+void main() {
+    float lead = aIndex * ${CONVERGE_STAGGER};
+    float p = clamp((uT * ${1.0 + CONVERGE_STAGGER} - lead), 0.0, 1.0);
+    float e = p < 0.5 ? 4.0 * p * p * p : 1.0 - pow(-2.0 * p + 2.0, 3.0) / 2.0;
+    vec2 pos = mix(aFrom, aTo, e);
+    vec2 clip = (pos / uResolution) * 2.0 - 1.0;
+    gl_Position = vec4(clip.x, -clip.y, 0.0, 1.0);
+    float pulse = 1.0 + 1.4 * sin(3.14159 * p);
+    gl_PointSize = 9.0 * uDpr * pulse;
+    vLife = p;
+}`;
+
+const GLOW_FRAG = `
+precision mediump float;
+uniform vec3 uColor;
+uniform float uAlpha;
+varying float vLife;
+void main() {
+    vec2 d = gl_PointCoord - 0.5;
+    float fall = exp(-dot(d, d) * 18.0);
+    float breathe = 0.55 + 0.45 * sin(3.14159 * vLife);
+    gl_FragColor = vec4(uColor, 1.0) * (fall * uAlpha * breathe);
+}`;
+
+// Uniform arc-length resample of a pixel-space polyline to n points.
+function resamplePx(points, n) {
+    if (points.length === 1) return Array(n).fill(points[0]);
+    const dists = [0];
+    for (let i = 1; i < points.length; i++) {
+        const dx = points[i][0] - points[i - 1][0];
+        const dy = points[i][1] - points[i - 1][1];
+        dists.push(dists[i - 1] + Math.hypot(dx, dy));
+    }
+    const total = dists[dists.length - 1] || 1;
+    const out = [];
+    let seg = 0;
+    for (let i = 0; i < n; i++) {
+        const target = (i / (n - 1)) * total;
+        while (seg < points.length - 2 && dists[seg + 1] < target) seg++;
+        const span = dists[seg + 1] - dists[seg] || 1;
+        const t = (target - dists[seg]) / span;
+        out.push([
+            points[seg][0] + (points[seg + 1][0] - points[seg][0]) * t,
+            points[seg][1] + (points[seg + 1][1] - points[seg][1]) * t,
+        ]);
+    }
+    return out;
+}
+
 class GestureWidget {
     constructor(container, hidden, relayUrl) {
         this.container = container;
@@ -63,6 +134,17 @@ class GestureWidget {
         this.canvas = document.createElement('canvas');
         this.canvas.className = 'gesture-canvas';
         container.appendChild(this.canvas);
+        // Overlay for the convergence glow; sized with the main canvas,
+        // inert to pointers, empty until an ack arrives.
+        this.glow = document.createElement('canvas');
+        this.glow.className = 'gesture-glow';
+        this.glow.style.position = 'absolute';
+        this.glow.style.pointerEvents = 'none';
+        if (!container.style.position) container.style.position = 'relative';
+        container.appendChild(this.glow);
+        this.gl = null;
+        this.animFrame = null;
+        this.converging = false;
         this.echoes = document.createElement('div');
         this.echoes.className = 'gesture-echoes';
         this.echoes.setAttribute('role', 'listbox');
@@ -110,6 +192,13 @@ class GestureWidget {
         this.ctx.scale(dpr, dpr);
         this.cssWidth = rect.width;
         this.cssHeight = rect.height;
+        this.glow.style.left = `${this.canvas.offsetLeft}px`;
+        this.glow.style.top = `${this.canvas.offsetTop}px`;
+        this.glow.style.width = `${rect.width}px`;
+        this.glow.style.height = `${rect.height}px`;
+        this.glow.width = this.canvas.width;
+        this.glow.height = this.canvas.height;
+        this.cancelConvergence(); // buffers are in old pixels
     }
 
     pos(e) {
@@ -123,6 +212,7 @@ class GestureWidget {
         // One stroke only - a new pointerdown replaces the old drawing
         // (and any ghost from the previous round).
         this.drawing = true;
+        this.cancelConvergence();
         this.ghost = null;
         this.ownKey = null;
         this.selected = null;
@@ -254,6 +344,7 @@ class GestureWidget {
     applySelection() {
         if (this.points.length < 2) return;
         const points = this.normalized();
+        const before = this.ghost;
         if (this.selected) {
             this.ghost = this.selected.path;
             this.setValue({ points, key: this.selected.key, own_key: this.ownKey, selected_from: this.ownKey, selected_distance: this.selected.distance });
@@ -261,6 +352,7 @@ class GestureWidget {
             this.ghost = this.ownGhost || null;
             this.setValue({ points, key: this.ownKey });
         }
+        if (this.ghost && this.ghost !== before) this.startConvergence(this.ghost);
         for (const el of this.echoes.children) {
             el.classList.toggle('selected', !!this.selected && el.dataset.key === this.selected.key);
             el.setAttribute('aria-selected', String(!!this.selected && el.dataset.key === this.selected.key));
@@ -317,6 +409,140 @@ class GestureWidget {
         setTimeout(() => thumb.classList.add('shown'), 30);
     }
 
+    // ── Convergence ────────────────────────────────────────────────
+
+    initGlow() {
+        if (this.gl) return this.gl;
+        const gl = this.glow.getContext('webgl', { alpha: true, premultipliedAlpha: true });
+        if (!gl) return null;
+        const compile = (type, src) => {
+            const s = gl.createShader(type);
+            gl.shaderSource(s, src);
+            gl.compileShader(s);
+            return s;
+        };
+        const prog = gl.createProgram();
+        gl.attachShader(prog, compile(gl.VERTEX_SHADER, GLOW_VERT));
+        gl.attachShader(prog, compile(gl.FRAGMENT_SHADER, GLOW_FRAG));
+        gl.linkProgram(prog);
+        if (!gl.getProgramParameter(prog, gl.LINK_STATUS)) return null;
+        gl.useProgram(prog);
+        this.gl = gl;
+        this.glProg = prog;
+        this.glLoc = {
+            aFrom: gl.getAttribLocation(prog, 'aFrom'),
+            aTo: gl.getAttribLocation(prog, 'aTo'),
+            aIndex: gl.getAttribLocation(prog, 'aIndex'),
+            uT: gl.getUniformLocation(prog, 'uT'),
+            uResolution: gl.getUniformLocation(prog, 'uResolution'),
+            uDpr: gl.getUniformLocation(prog, 'uDpr'),
+            uColor: gl.getUniformLocation(prog, 'uColor'),
+            uAlpha: gl.getUniformLocation(prog, 'uAlpha'),
+        };
+        this.glBufFrom = gl.createBuffer();
+        this.glBufTo = gl.createBuffer();
+        this.glBufIndex = gl.createBuffer();
+        return gl;
+    }
+
+    // The ghost's pixel frame - same fit drawPath uses.
+    ghostToPx(path) {
+        const scale = (Math.min(this.cssWidth, this.cssHeight) / 2) * 0.8;
+        const cx = this.cssWidth / 2, cy = this.cssHeight / 2;
+        return path.map(([x, y]) => [cx + x * scale, cy + y * scale]);
+    }
+
+    startConvergence(targetPath) {
+        this.cancelConvergence();
+        if (!targetPath || this.points.length < 2) return;
+        if (window.matchMedia('(prefers-reduced-motion: reduce)').matches) return;
+        const gl = this.initGlow();
+        if (!gl) return;
+
+        const dpr = window.devicePixelRatio || 1;
+        const from = resamplePx(this.points.map((p) => [p.x, p.y]), CONVERGE_POINTS);
+        const to = resamplePx(this.ghostToPx(targetPath), CONVERGE_POINTS);
+        const f = new Float32Array(CONVERGE_POINTS * 2);
+        const t = new Float32Array(CONVERGE_POINTS * 2);
+        const idx = new Float32Array(CONVERGE_POINTS);
+        for (let i = 0; i < CONVERGE_POINTS; i++) {
+            f[i * 2] = from[i][0] * dpr;
+            f[i * 2 + 1] = from[i][1] * dpr;
+            t[i * 2] = to[i][0] * dpr;
+            t[i * 2 + 1] = to[i][1] * dpr;
+            idx[i] = i / (CONVERGE_POINTS - 1);
+        }
+        const bind = (buf, data, loc, size) => {
+            gl.bindBuffer(gl.ARRAY_BUFFER, buf);
+            gl.bufferData(gl.ARRAY_BUFFER, data, gl.STATIC_DRAW);
+            gl.enableVertexAttribArray(loc);
+            gl.vertexAttribPointer(loc, size, gl.FLOAT, false, 0, 0);
+        };
+        gl.useProgram(this.glProg);
+        bind(this.glBufFrom, f, this.glLoc.aFrom, 2);
+        bind(this.glBufTo, t, this.glLoc.aTo, 2);
+        bind(this.glBufIndex, idx, this.glLoc.aIndex, 1);
+        gl.viewport(0, 0, this.glow.width, this.glow.height);
+        gl.uniform2f(this.glLoc.uResolution, this.glow.width, this.glow.height);
+        gl.uniform1f(this.glLoc.uDpr, dpr);
+
+        const light = this._themeQuery.matches;
+        const color = light ? [0x47 / 255, 0x80 / 255, 0x7e / 255] : [0x8e / 255, 0xc2 / 255, 0xc0 / 255];
+        gl.uniform3f(this.glLoc.uColor, color[0], color[1], color[2]);
+        // Additive light on the dark ground; normal ink on the light one.
+        gl.enable(gl.BLEND);
+        if (light) gl.blendFunc(gl.SRC_ALPHA, gl.ONE_MINUS_SRC_ALPHA);
+        else gl.blendFunc(gl.ONE, gl.ONE);
+
+        this.converging = true;
+        this.render();
+        const started = performance.now();
+        const step = (now) => {
+            const raw = (now - started) / CONVERGE_MS;
+            if (raw >= 1) {
+                // Deposit the ghost, then let the glow breathe out.
+                if (this.converging) {
+                    this.converging = false;
+                    this.render();
+                }
+                const fade = (now - started - CONVERGE_MS) / CONVERGE_FADE_MS;
+                if (fade >= 1) {
+                    this.cancelConvergence();
+                    return;
+                }
+                gl.clearColor(0, 0, 0, 0);
+                gl.clear(gl.COLOR_BUFFER_BIT);
+                gl.uniform1f(this.glLoc.uT, 1);
+                gl.uniform1f(this.glLoc.uAlpha, 0.32 * (1 - fade));
+                gl.drawArrays(gl.POINTS, 0, CONVERGE_POINTS);
+            } else {
+                gl.clearColor(0, 0, 0, 0);
+                gl.clear(gl.COLOR_BUFFER_BIT);
+                // Trailing passes give the wave a comet tail.
+                for (const [lag, alpha] of [[0, 0.32], [0.035, 0.16], [0.07, 0.08], [0.105, 0.04]]) {
+                    gl.uniform1f(this.glLoc.uT, Math.max(0, raw - lag));
+                    gl.uniform1f(this.glLoc.uAlpha, alpha);
+                    gl.drawArrays(gl.POINTS, 0, CONVERGE_POINTS);
+                }
+            }
+            this.animFrame = requestAnimationFrame(step);
+        };
+        this.animFrame = requestAnimationFrame(step);
+    }
+
+    cancelConvergence() {
+        if (this.animFrame) cancelAnimationFrame(this.animFrame);
+        this.animFrame = null;
+        if (this.converging) {
+            this.converging = false;
+            this.render();
+        }
+        if (this.gl) {
+            this.gl.clearColor(0, 0, 0, 0);
+            this.gl.clear(this.gl.COLOR_BUFFER_BIT);
+        }
+    }
+
     // ── Rendering ──────────────────────────────────────────────────
 
     // Draw a normalized (-1..1) path fitted into w×h with padding.
@@ -341,7 +567,7 @@ class GestureWidget {
         if (!this.ctx) return;
         const t = this.theme();
         this.ctx.clearRect(0, 0, this.cssWidth, this.cssHeight);
-        if (this.ghost) {
+        if (this.ghost && !this.converging) {
             this.drawPath(this.ctx, this.ghost, this.cssWidth, this.cssHeight, t.ghost, 2, 0.2);
         }
         if (this.points.length >= 1) {
@@ -360,6 +586,7 @@ class GestureWidget {
 
     stop() {
         this.stopped = true;
+        if (this.animFrame) cancelAnimationFrame(this.animFrame);
         clearTimeout(this.emptyTimer);
         if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
         if (this.ws) {
@@ -378,5 +605,8 @@ class GestureWidget {
 }
 
 export function mountGesture(container, hidden, relayUrl) {
-    return new GestureWidget(container, hidden, relayUrl);
+    // Dev convenience: `?relay=ws://127.0.0.1:9040` points every widget
+    // on the page at a local relay (prod relays reject foreign Origins).
+    const override = new URLSearchParams(window.location.search).get('relay');
+    return new GestureWidget(container, hidden, override || relayUrl);
 }

src/announce.rs

@@ -92,6 +92,18 @@ pub async fn sweep(state: &AppState) -> anyhow::Result<()> {
             Some(a) => a,
         };
 
+        // Content is the source of truth while the window is still
+        // open: a corrected date or place flows into the record, so the
+        // followup fires on the schedule the page actually announces.
+        if answer.state == schema.initial && answer.responses != responses {
+            let mut refreshed = answer.clone();
+            refreshed.responses = responses.clone();
+            if let Some(store) = &store {
+                store.put(&id, serde_json::to_vec(&refreshed)?.into()).await?;
+                tracing::info!(question = %q.id, "event record refreshed from content");
+            }
+        }
+
         if answer.state == schema.initial && now_ms >= ends {
             let target = "awaiting_summary";
             let payload = serde_json::json!({ "to": target, "item": id, "by": "portal" });

src/app.rs

@@ -1,5 +1,5 @@
 use leptos::prelude::*;
-use leptos_meta::{provide_meta_context, HashedStylesheet, MetaTags, Title};
+use leptos_meta::{provide_meta_context, HashedStylesheet, Html, Link, MetaTags, Stylesheet, Title};
 use leptos_router::{
     components::{Route, Router, Routes},
     hooks::{use_location, use_navigate, use_query_map},
@@ -10,6 +10,7 @@ use serde::{Deserialize, Serialize};
 use crate::answers::{Answer, SelfTransitionAnswer, TransitionAnswers, TransitionItem};
 use crate::auth::{current_user, User};
 use crate::content::{is_qualified, render_inline_markdown, Alternative, Question, Responsible, SiteConfig, Transition};
+use crate::i18n::t;
 use crate::resource::{get_requirement_binding, get_requirement_options, get_resource};
 
 /// The visible site name/wordmark - "portal" is just this codebase's
@@ -39,6 +40,20 @@ pub fn shell(options: LeptosOptions) -> impl IntoView {
                 // once loaded via <link>/<img> on Safari/iOS.
                 <link rel="icon" media="(prefers-color-scheme: light)" href="/favicon-light.svg" type="image/svg+xml"/>
                 <link rel="icon" media="(prefers-color-scheme: dark)" href="/favicon-dark.svg" type="image/svg+xml"/>
+                // Fonts hide behind the stylesheet: the browser must
+                // fetch and parse CSS before it discovers them. The
+                // latin subset is on every page's critical path, so
+                // announce it up front; latin-ext and vietnamese stay
+                // unicode-range-gated and load only when script needs
+                // them - preloading those would tax everyone for a few.
+                // (Font preloads require crossorigin even same-origin.)
+                <link
+                    rel="preload"
+                    href="/fonts/quicksand-semibold-latin.woff2"
+                    r#as="font"
+                    type="font/woff2"
+                    crossorigin="anonymous"
+                />
                 // Server-side, so it can read hash.txt and link the
                 // content-hashed stylesheet (hash-files = true).
                 <HashedStylesheet id="leptos" options=options.clone()/>
@@ -68,8 +83,54 @@ pub fn App() -> impl IntoView {
     // context instead of fetching their own copy.
     let site = Resource::new(|| (), |_| get_site());
     provide_context(site);
+    // The chrome's language, from site.yaml (default "en"); content
+    // speaks for itself. Components read this via context for t().
+    let lang = Memo::new(move |_| {
+        site.get()
+            .and_then(|r| r.ok())
+            .and_then(|s| s.lang)
+            .unwrap_or_else(|| "en".to_string())
+    });
+    provide_context(Lang(lang));
+
+    // A content-shipped stylesheet (site.yaml `stylesheet:`) layered
+    // after the default one - leptos_meta appends it at the MetaTags
+    // slot, which the shell places after HashedStylesheet, so content
+    // rules win at equal specificity.
+    let custom_css = Memo::new(move |_| {
+        site.get()
+            .and_then(|r| r.ok())
+            .and_then(|s| s.stylesheet)
+            .map(|p| format!("/site/{p}"))
+    });
+    // The wordmark paints in the hero on first view; announcing it in
+    // the head starts the fetch during hydration instead of after. On
+    // redoal.com it lives on the content host, so a preconnect opens
+    // that TLS session while the preload is still queued.
+    let wordmark_href = Memo::new(move |_| {
+        site.get().and_then(|r| r.ok()).and_then(|s| s.wordmark)
+    });
+    let wordmark_origin = Memo::new(move |_| {
+        wordmark_href.get().and_then(|w| {
+            let rest = w.strip_prefix("https://")?;
+            Some(format!("https://{}", rest.split('/').next()?))
+        })
+    });
+    // A content-shipped favicon overrides the built-in one; injected
+    // into the head after the static defaults, so it wins.
+    let favicon = Memo::new(move |_| {
+        site.get()
+            .and_then(|r| r.ok())
+            .and_then(|s| s.favicon)
+            .map(|p| format!("/site/{p}"))
+    });
 
     view! {
+        <Html attr:lang=move || lang.get()/>
+        {move || wordmark_origin.get().map(|href| view! { <Link rel="preconnect" href=href crossorigin="anonymous"/> })}
+        {move || wordmark_href.get().map(|href| view! { <Link rel="preload" as_="image" href=href/> })}
+        {move || custom_css.get().map(|href| view! { <Stylesheet id="site-custom" href=href/> })}
+        {move || favicon.get().map(|href| view! { <Link rel="icon" href=href/> })}
         <Suspense fallback=|| ()>
             {move || {
                 site.get()
@@ -88,6 +149,15 @@ pub fn App() -> impl IntoView {
     }
 }
 
+/// The site's chrome language as a context signal - see App.
+#[derive(Clone, Copy)]
+pub struct Lang(pub Memo<String>);
+
+/// The current chrome language, for `t()` calls inside views.
+fn lang() -> Memo<String> {
+    expect_context::<Lang>().0
+}
+
 /// Every server-fn resource the pages read, created exactly once for
 /// the app's lifetime and handed down via context. Wrapper structs
 /// because a bare `Resource<T>` context is claimed by whoever provides
@@ -143,7 +213,10 @@ fn PortalShell() -> impl IntoView {
         |(path, chain)| get_question(path, chain),
     );
     let user = Resource::new(|| (), |_| current_user());
-    let nav = Resource::new(move || chain.get().is_some(), list_qualifying_questions);
+    let nav = Resource::new(
+        move || (path.get(), chain.get()),
+        |(path, chain)| list_qualifying_questions(path, chain),
+    );
     let announcements = Resource::new(|| (), |_| list_announcements());
     provide_context(QuestionRes(question));
     provide_context(UserRes(user));
@@ -219,7 +292,6 @@ fn QuestionView(
     site: SiteConfig,
 ) -> impl IntoView {
     let question_id = question.id.clone();
-    let has_chain = parent_hash.is_some();
 
     // The provenance counterpart to the qualifies gate below: a
     // requires_chain page whose visitor holds no verifiable lineage to
@@ -241,14 +313,14 @@ fn QuestionView(
             />
             <div class="alternatives">
                 <section class="alt-card gate-card">
-                    <p>"This page follows from an answer you don't seem to carry yet."</p>
+                    <p>{move || t(&lang().get(), "follows_answer")}</p>
                     <a class="alt-submit" href=target>
                         {label}
                     </a>
                 </section>
             </div>
             // A gate is never a dead end: the same nav as every page.
-            <QuestionNav current_id=question_id has_chain=has_chain/>
+            <QuestionNav current_id=question_id/>
         }
         .into_any();
     }
@@ -269,7 +341,7 @@ fn QuestionView(
             <div class="alternatives">
                 <section class="alt-card gate-card">
                     {if signed_in {
-                        view! { <p>"This part of the site is for organizational owners — sign in with that account to take a look."</p> }
+                        view! { <p>{move || t(&lang().get(), "owners_only")}</p> }
                             .into_any()
                     } else {
                         view! {
@@ -278,14 +350,14 @@ fn QuestionView(
                                 href=format!("/auth/login?redirect={question_id}")
                                 rel="external"
                             >
-                                "Sign in"
+                                {move || t(&lang().get(), "sign_in")}
                             </a>
                         }
                             .into_any()
                     }}
                 </section>
             </div>
-            <QuestionNav current_id=question_id has_chain=has_chain/>
+            <QuestionNav current_id=question_id/>
         }
         .into_any();
     }
@@ -348,7 +420,7 @@ fn QuestionView(
             .map(|r| {
                 view! { <ResponsibleNote responsible=r/> }
             })}
-        <QuestionNav current_id=question_id has_chain=has_chain/>
+        <QuestionNav current_id=question_id/>
     }
     .into_any()
 }
@@ -357,8 +429,7 @@ fn QuestionView(
 /// small nav - how a concern reaches the people it speaks to without
 /// claiming front-page space (an owner also sees the gated desks here).
 #[component]
-fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
-    let _ = has_chain; // keyed into the shared resource by PortalShell
+fn QuestionNav(current_id: String) -> impl IntoView {
     let NavRes(nav) = expect_context();
     view! {
         <Suspense fallback=|| ()>
@@ -371,7 +442,7 @@ fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
                         .collect();
                     (!others.is_empty()).then(|| view! {
                         <nav class="question-nav">
-                            <span class="question-nav-lead">"Also worth asking"</span>
+                            <span class="question-nav-lead">{move || t(&lang().get(), "also_worth_asking")}</span>
                             <For
                                 each=move || others.clone()
                                 key=|(id, _)| id.clone()
@@ -399,7 +470,7 @@ fn Announcements(current_id: String) -> impl IntoView {
                 let current_id = current_id.clone();
                 announcements.get().and_then(|res| res.ok()).map(|items| {
                     (!items.is_empty()).then(|| view! {
-                        <nav class="announce" aria-label="Announcements">
+                        <nav class="announce" aria-label=move || t(&lang().get(), "announcements")>
                             <For
                                 each=move || items.clone()
                                 key=|a| a.id.clone()
@@ -459,11 +530,11 @@ fn ResponsibleNote(responsible: Responsible) -> impl IntoView {
 
     view! {
         <small class="question-responsible">
-            "Asked by " {responsible.name.clone()} " — "
+            {move || t(&lang().get(), "asked_by")} {responsible.name.clone()} " — "
             <a data-user=user data-domain=domain on:mouseover=assemble on:click=assemble>
-                "contact them"
+                {move || t(&lang().get(), "contact_them")}
             </a>
-            " if you get stuck."
+            {move || t(&lang().get(), "if_stuck")}
         </small>
     }
 }
@@ -555,7 +626,17 @@ fn Hero(title: String, description: String, landing: bool, site: SiteConfig, cur
         None
     };
     let has_module = module.is_some();
+    // Light theme can invert a white-stroke wordmark to ink. Default:
+    // only the built-in house mark inverts; a content-shipped logo
+    // keeps its colours unless site.yaml opts in with wordmark_invert.
+    let house_wordmark = site.wordmark_invert.unwrap_or(site.wordmark.is_none());
     let wordmark = site.wordmark.clone().unwrap_or_else(|| "/wordmark.svg".to_string());
+    // Clamped server-side too, but belt and braces for the inline style.
+    let wordmark_style = site
+        .wordmark_height
+        .filter(|h| (0.5..=6.0).contains(h))
+        .map(|h| format!("height: {h}rem"))
+        .unwrap_or_default();
     let site_title = site.title.clone().unwrap_or_else(|| SITE_NAME.to_string());
 
     let piece_ref: NodeRef<leptos::html::Div> = NodeRef::new();
@@ -641,11 +722,11 @@ fn Hero(title: String, description: String, landing: bool, site: SiteConfig, cur
                     }
                 })}
             <div class="hero-copy">
-                <a class="wordmark" href="/">
-                    <img src=wordmark alt=site_title/>
+                <a class="wordmark" class:wordmark-house=house_wordmark href="/">
+                    <img src=wordmark alt=site_title style=wordmark_style/>
                 </a>
                 <h1>{title}</h1>
-                <p>{description}</p>
+                <p inner_html=render_inline_markdown(&description)></p>
             </div>
         </header>
     }
@@ -727,7 +808,7 @@ fn AlternativeCard(
                             </button>
                         }
                             .into_any(),
-                        Some(Ok(())) => view! { <p>"Done."</p> }.into_any(),
+                        Some(Ok(())) => view! { <p>{move || t(&lang().get(), "done")}</p> }.into_any(),
                         Some(Err(e)) => view! { <p class="resource-error">{e.to_string()}</p> }.into_any(),
                     }
                 }}
@@ -922,7 +1003,7 @@ fn AlternativeCard(
         .consequence
         .first()
         .cloned()
-        .unwrap_or_else(|| "Send".to_string());
+        .unwrap_or_else(|| t(&lang().get(), "send").to_string());
 
     view! {
         <section class="alt-card">
@@ -1244,6 +1325,20 @@ fn AlternativeCard(
                                                     .into_any();
                                                 }
 
+                                                if req.kind == "hidden" {
+                                                    // A carrier value only — no label row, or a
+                                                    // preset key reads as a second visible field.
+                                                    return view! {
+                                                        <input
+                                                            id=field_id
+                                                            type="hidden"
+                                                            prop:value=move || sig.get()
+                                                            on:input=move |ev| sig.set(event_target_value(&ev))
+                                                        />
+                                                    }
+                                                    .into_any();
+                                                }
+
                                                 view! {
                                                     <label class="field" for=label_for>
                                                         {label_text}
@@ -1398,7 +1493,7 @@ fn ResourceFeature(
                 {move || {
                     let feature_name = feature_name.clone();
                     let transitions = transitions.clone();
-                    let empty = empty.clone().unwrap_or_else(|| "Nothing here yet.".to_string());
+                    let empty = empty.clone().unwrap_or_else(|| t(&lang().get(), "nothing_here_yet").to_string());
                     data.get()
                         .map(|res| match res {
                             Ok(value) => {
@@ -1571,7 +1666,8 @@ fn ItemCard(item: serde_json::Value) -> impl IntoView {
                         </div>
                     }
                 })}
-            {description.map(|d| view! { <p class="item-card-description">{d}</p> })}
+            {description
+                .map(|d| view! { <p class="item-card-description" inner_html=render_inline_markdown(&d)></p> })}
             {audio.map(|src| view! { <audio class="item-card-audio" controls preload="none" src=src></audio> })}
             {(!extra.is_empty())
                 .then(|| {
@@ -1866,8 +1962,8 @@ fn format_ms(ms: i64) -> String {
 fn NotFound() -> impl IntoView {
     view! {
         <main class="not-found">
-            <h1>"Nothing here"</h1>
-            <a href="/">"back to the start"</a>
+            <h1>{move || t(&lang().get(), "nothing_here")}</h1>
+            <a href="/">{move || t(&lang().get(), "back_to_start")}</a>
         </main>
     }
 }
@@ -1934,16 +2030,21 @@ pub async fn get_site() -> Result<SiteConfig, ServerFnError> {
     Ok(state.site.load().as_ref().clone())
 }
 
-/// Every question the current visitor qualifies for, as (id, name) -
-/// the site nav's data. Context-dependent: an owner session sees the
-/// gated pages too, and `followup` pages only appear once the visitor
-/// carries an answer chain.
+/// Every question the visitor may be offered from `current`, as (id,
+/// name) - the question nav's data. Front-door pages the visitor
+/// qualifies for are always in (an owner session sees the gated desks
+/// too); `followup` pages and ended events only when they are on the
+/// visitor's path - the page their verified `?chain=` answered - or
+/// further down from `current` (see `content::outcomes_reachable_from`).
+/// A chain unlocks the followup it came from, never every followup on
+/// the site; an unverifiable hash unlocks nothing.
 #[server(endpoint = "list_qualifying_questions")]
 pub async fn list_qualifying_questions(
-    has_chain: bool,
+    current: String,
+    chain: Option<String>,
 ) -> Result<Vec<(String, String)>, ServerFnError> {
     use crate::auth::{User, SESSION_USER_KEY};
-    use crate::content::is_qualified;
+    use crate::content::{is_qualified, outcomes_reachable_from, Question};
     use crate::server::AppState;
 
     let state = expect_context::<AppState>();
@@ -1954,14 +2055,27 @@ pub async fn list_qualifying_questions(
         .map_err(|e| ServerFnError::new(e.to_string()))?;
 
     let now_ms = chrono::Utc::now().timestamp_millis();
-    let mut out: Vec<(String, String)> = state
-        .questions
-        .load()
+    let questions = state.questions.load();
+    // The one page the chain verifiably answered - the same lookup a
+    // `requires_chain` gate does, so a forged or foreign hash resolves
+    // to nothing relevant.
+    let answered: Option<String> = match &chain {
+        Some(hash) => crate::chain::lookup_node(&state.jetstream, hash)
+            .await
+            .map(|node| node.question_id),
+        None => None,
+    };
+    // An ended event page is a followup from then on.
+    let is_outcome = |q: &Question| q.is_followup() || q.event_ended_at(now_ms);
+    let reach = outcomes_reachable_from(&questions, &current, &is_outcome);
+    let mut out: Vec<(String, String)> = questions
         .values()
         .filter(|q| is_qualified(user.as_ref(), q))
-        // An ended event page is a followup from then on - only a
-        // visitor carrying a chain (they answered it) still sees it.
-        .filter(|q| !(q.is_followup() || q.event_ended_at(now_ms)) || has_chain)
+        .filter(|q| {
+            !is_outcome(q)
+                || answered.as_deref() == Some(q.id.as_str())
+                || reach.contains(&q.id)
+        })
         // A live event is announced in the header instead.
         .filter(|q| !q.event_live_at(now_ms))
         // A dynamic page has no URL of its own to link to.

src/content.rs

@@ -42,8 +42,11 @@ pub struct Question {
     #[serde(default)]
     pub responsible: Option<Responsible>,
     /// A page that only makes sense after answering something (the
-    /// post-submission pages) - kept out of the question nav unless the
-    /// visitor's context carries an answer chain. Unset means inferred
+    /// post-submission pages) - kept out of the question nav unless it is
+    /// on the visitor's path (the page their verified `?chain=` answered)
+    /// or further down from the page they are on, over `action` edges
+    /// (see `outcomes_reachable_from`). One followup path never unlocks
+    /// another. Unset means inferred
     /// from the file's place in the tree: files nested in a
     /// subdirectory are followups unless they're the directory's
     /// `index.yaml`; top-level files keep the historical default
@@ -183,6 +186,7 @@ pub fn render_inline_markdown(text: &str) -> String {
     use pulldown_cmark::{html, Event, Options, Parser, Tag, TagEnd};
     let parser = Parser::new_ext(text, Options::empty());
     let mut in_link = 0usize;
+    let mut in_dropped_image = 0usize;
     let filtered = parser.filter_map(|event| match event {
         Event::Html(_) | Event::InlineHtml(_) => None,
         Event::Start(Tag::Paragraph) | Event::End(TagEnd::Paragraph) => None,
@@ -190,6 +194,7 @@ pub fn render_inline_markdown(text: &str) -> String {
         Event::Start(Tag::Link { dest_url, .. })
             if !(dest_url.starts_with("https://")
                 || dest_url.starts_with("mailto:")
+                || dest_url.starts_with("tel:")
                 || dest_url.starts_with('/')) =>
         {
             in_link += 1;
@@ -199,11 +204,92 @@ pub fn render_inline_markdown(text: &str) -> String {
             in_link -= 1;
             None
         }
+        // Images take the same gate as links: https or same-origin
+        // only - no data:, no plain http. Unlike a dropped link (whose
+        // label is real text worth keeping), a dropped image's alt
+        // text is a caption for something that isn't there - swallow it.
+        Event::Start(Tag::Image { dest_url, .. })
+            if !(dest_url.starts_with("https://") || dest_url.starts_with('/')) =>
+        {
+            in_dropped_image += 1;
+            None
+        }
+        Event::End(TagEnd::Image) if in_dropped_image > 0 => {
+            in_dropped_image -= 1;
+            None
+        }
+        Event::Text(_) if in_dropped_image > 0 => None,
         other => Some(other),
     });
     let mut out = String::new();
     html::push_html(&mut out, filtered);
-    out.trim().to_string()
+    apply_image_hints(out.trim())
+}
+
+/// Translate a markdown image's title (`![alt](url "right 9rem")`)
+/// into layout: `left`/`right` float via a class, a bare number
+/// (optionally with `rem`) into a validated `max-width`. Unknown
+/// tokens are ignored; the title attribute is dropped either way.
+/// Only touches `<img>` tags in our own render output, and only ever
+/// emits a numeric max-width - no arbitrary CSS reaches the page.
+fn apply_image_hints(html: &str) -> String {
+    let mut out = String::new();
+    let mut rest = html;
+    while let Some(pos) = rest.find("<img ") {
+        out.push_str(&rest[..pos]);
+        let after = &rest[pos..];
+        let end = after.find('>').map(|e| e + 1).unwrap_or(after.len());
+        out.push_str(&rewrite_img_tag(&after[..end]));
+        rest = &after[end..];
+    }
+    out.push_str(rest);
+    out
+}
+
+fn rewrite_img_tag(tag: &str) -> String {
+    // Pull the title value, if any.
+    let title = tag
+        .find("title=\"")
+        .map(|i| &tag[i + 7..])
+        .and_then(|r| r.find('"').map(|e| &r[..e]))
+        .unwrap_or("");
+
+    let mut class = String::new();
+    let mut max_rem: Option<f32> = None;
+    for tok in title.split_whitespace() {
+        match tok {
+            "left" => class = "md-float-left".into(),
+            "right" => class = "md-float-right".into(),
+            other => {
+                if let Ok(n) = other.trim_end_matches("rem").parse::<f32>() {
+                    if n > 0.0 && n <= 60.0 {
+                        max_rem = Some(n);
+                    }
+                }
+            }
+        }
+    }
+
+    // Strip the title attribute from the tag.
+    let mut cleaned = tag.to_string();
+    if let Some(i) = cleaned.find(" title=\"") {
+        if let Some(e) = cleaned[i + 8..].find('"') {
+            cleaned.replace_range(i..i + 8 + e + 1, "");
+        }
+    }
+
+    // Inject class/style right after `<img`.
+    let mut attrs = String::new();
+    if !class.is_empty() {
+        attrs.push_str(&format!(" class=\"{class}\""));
+    }
+    if let Some(n) = max_rem {
+        attrs.push_str(&format!(" style=\"max-width:{n}rem\""));
+    }
+    if attrs.is_empty() {
+        return cleaned;
+    }
+    cleaned.replacen("<img", &format!("<img{attrs}"), 1)
 }
 
 /// Directory-scoped defaults: a `_section.yaml` file applies to every
@@ -430,6 +516,12 @@ pub struct Requirement {
     /// `ResourceSpec` mechanism a `Feature.resource` uses.
     #[serde(default)]
     pub resource: Option<ResourceSpec>,
+    /// `type: select` only - a static list of options, as an
+    /// alternative to a `resource`. Each string is both the option's
+    /// stored value and its label. Faithful to the ancestor format's
+    /// inline enums.
+    #[serde(default)]
+    pub options: Vec<String>,
     /// `type: select` only - which field in each item is the option's
     /// stable id. Defaults to trying `_id` then `id`.
     #[serde(default)]
@@ -501,6 +593,31 @@ pub struct SiteConfig {
     /// `None` falls back to `/wordmark.svg`.
     #[serde(default)]
     pub wordmark: Option<String>,
+    /// Whether to invert the wordmark in light theme. `None` inverts
+    /// only the built-in house wordmark (a white-stroke SVG); a
+    /// content-shipped logo keeps its own colours unless it sets this
+    /// true (e.g. a sibling site's white-stroke mark).
+    #[serde(default)]
+    pub wordmark_invert: Option<bool>,
+    /// Wordmark display height in rem (0.5–6.0). `None` keeps the
+    /// stylesheet's default. Raster logos look best at or below their
+    /// intrinsic pixel height.
+    #[serde(default)]
+    pub wordmark_height: Option<f32>,
+    /// BCP 47-ish language code for the portal's own chrome strings
+    /// ("Asked by", the nav lead...) and the html lang attribute.
+    /// `None` means "en"; unknown codes fall back to English per key.
+    #[serde(default)]
+    pub lang: Option<String>,
+    /// A content-repo-relative CSS file (e.g. "custom.css") layered
+    /// *after* the default stylesheet, so it overrides. Served
+    /// same-origin at `/site/<path>`; plain path only.
+    #[serde(default)]
+    pub stylesheet: Option<String>,
+    /// A content-repo-relative favicon (svg/png/ico), served at
+    /// `/site/<path>` and used in place of the built-in one.
+    #[serde(default)]
+    pub favicon: Option<String>,
     #[serde(default)]
     pub hero: HeroConfig,
 }
@@ -556,6 +673,21 @@ impl SiteConfig {
             }
             other => anyhow::bail!("site.yaml: hero.kind {other:?} is not one of plain | module"),
         }
+        if let Some(sheet) = &self.stylesheet {
+            if !is_safe_site_path(sheet) || !sheet.ends_with(".css") {
+                anyhow::bail!(
+                    "site.yaml: stylesheet {sheet:?} must be a plain repo-relative .css path"
+                );
+            }
+        }
+        if let Some(icon) = &self.favicon {
+            let ok = [".svg", ".png", ".ico"].iter().any(|e| icon.ends_with(e));
+            if !is_safe_site_path(icon) || !ok {
+                anyhow::bail!(
+                    "site.yaml: favicon {icon:?} must be a plain repo-relative .svg/.png/.ico path"
+                );
+            }
+        }
         Ok(())
     }
 }
@@ -793,6 +925,74 @@ pub fn path_matches(pattern: &str, path: &str) -> Option<Vec<(String, String)>>
     Some(captures)
 }
 
+/// The question an alternative's `action` lands on, as a question id:
+/// a plain path resolves directly, a templated one
+/// (`/shape/{curve.key}`) to the dynamic page whose pattern has the
+/// same shape (`/shape/[key]`). `None` when no page declares it.
+pub fn action_target_id(
+    questions: &std::collections::HashMap<String, Question>,
+    action: &str,
+) -> Option<String> {
+    if questions.contains_key(action) {
+        return Some(action.to_string());
+    }
+    let want: Vec<&str> = action.split('/').filter(|s| !s.is_empty()).collect();
+    questions
+        .values()
+        .filter(|q| q.is_dynamic())
+        .map(|q| &q.id)
+        .find(|id| {
+            let pat: Vec<&str> = id.split('/').filter(|s| !s.is_empty()).collect();
+            pat.len() == want.len()
+                && pat
+                    .iter()
+                    .zip(&want)
+                    .all(|(p, w)| p == w || (p.starts_with('[') && w.starts_with('{')))
+        })
+        .cloned()
+}
+
+/// The outcome pages "further down" from `from`: every `is_outcome`
+/// question reachable from it over `alternatives[].action` edges,
+/// walking only *through* outcome pages. A front-door page (not an
+/// outcome) is where the walk ends, so a "back to the start" action
+/// never fans out into the whole site. `from` itself is never in the
+/// result. This, plus the one page a visitor's verified chain answered,
+/// decides which followups the question nav offers - one followup path
+/// never unlocks another (an email-link page like redoal's `/watching`,
+/// which nothing links to, stays out of every nav).
+pub fn outcomes_reachable_from(
+    questions: &std::collections::HashMap<String, Question>,
+    from: &str,
+    is_outcome: &dyn Fn(&Question) -> bool,
+) -> std::collections::HashSet<String> {
+    use std::collections::{HashSet, VecDeque};
+    let mut seen: HashSet<String> = HashSet::new();
+    let mut queue: VecDeque<Question> = VecDeque::new();
+    if let Some(q) = resolve_question(questions, from) {
+        queue.push_back(q);
+    }
+    while let Some(q) = queue.pop_front() {
+        for action in q.alternatives.iter().filter_map(|a| a.action.as_deref()) {
+            let Some(id) = action_target_id(questions, action) else {
+                continue;
+            };
+            // A page's own dynamic pattern (`/shape/abc` -> `/shape/[key]`)
+            // is itself, not somewhere further down.
+            if id == from || path_matches(&id, from).is_some() || seen.contains(&id) {
+                continue;
+            }
+            let target = &questions[&id];
+            if !is_outcome(target) {
+                continue;
+            }
+            seen.insert(id.clone());
+            queue.push_back(target.clone());
+        }
+    }
+    seen
+}
+
 /// Resolves a URL path to its question: an exact id first, else the
 /// one dynamic page whose pattern matches, with each captured segment
 /// substituted into `{name}` placeholders in the clone's resource keys
@@ -1166,9 +1366,12 @@ pub fn validate_questions(
                 .collect();
             for feature in &alternative.features {
                 for requirement in &feature.requirements {
-                    if requirement.kind == "select" && requirement.resource.is_none() {
+                    if requirement.kind == "select"
+                        && requirement.resource.is_none()
+                        && requirement.options.is_empty()
+                    {
                         anyhow::bail!(
-                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: select but declares no resource to select from",
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: select but declares neither a resource nor inline options",
                             question.id, alternative.name, feature.name, requirement.name
                         );
                     }
@@ -1416,6 +1619,8 @@ pub async fn site_asset_handler(
         Some("json") => "application/json",
         Some("png") => "image/png",
         Some("webp") => "image/webp",
+        Some("avif") => "image/avif",
+        Some("ico") => "image/x-icon",
         Some("woff2") => "font/woff2",
         _ => "application/octet-stream",
     };
@@ -1827,6 +2032,48 @@ alternatives:
         assert!(!questions.contains_key("/review/_draft"));
     }
 
+    #[test]
+    fn followups_surface_by_reach_not_by_carrying_any_chain() {
+        use std::collections::HashSet;
+        let files = vec![
+            // Front door with three outcomes, one of them templated onto
+            // a dynamic page.
+            ("index.yaml".to_string(), "name: Home\nalternatives:\n  - name: apply\n    action: applied\n  - name: subscribe\n    action: subscribed\n  - name: draw\n    action: /shape/{curve.key}\n".to_string()),
+            ("applied.yaml".to_string(), "name: Applied\nfollowup: true\n".to_string()),
+            ("subscribed.yaml".to_string(), "name: Subscribed\nfollowup: true\nalternatives:\n  - name: back\n    action: /\n".to_string()),
+            // Nested -> followup by inference; leads on to /subscribed.
+            ("shape/[key].yaml".to_string(), "name: Shape\nalternatives:\n  - name: watch\n    action: /subscribed\n  - name: back\n    action: /\n".to_string()),
+            // Reached only by an out-of-band link: nothing points here.
+            ("watching.yaml".to_string(), "name: Watching\nfollowup: true\n".to_string()),
+            // A second, unrelated path with its own outcome.
+            ("kontakt.yaml".to_string(), "name: Kontakt\nalternatives:\n  - name: send\n    action: takk\n".to_string()),
+            ("takk.yaml".to_string(), "name: Takk\nfollowup: true\nalternatives:\n  - name: back\n    action: /\n".to_string()),
+        ];
+        let questions = build_questions(&files).unwrap();
+        let is_outcome = |q: &Question| q.is_followup();
+        let reach = |from: &str| outcomes_reachable_from(&questions, from, &is_outcome);
+        let set = |ids: &[&str]| ids.iter().map(|s| s.to_string()).collect::<HashSet<_>>();
+
+        // Templated actions resolve to the dynamic page's pattern.
+        assert_eq!(action_target_id(&questions, "/shape/{curve.key}").as_deref(), Some("/shape/[key]"));
+        assert_eq!(action_target_id(&questions, "/nowhere"), None);
+
+        // From the front door: its own outcomes, and what they lead on
+        // to - but not the other path's outcome, nor the orphan.
+        assert_eq!(reach("/"), set(&["/applied", "/subscribed", "/shape/[key]"]));
+        // The other path only sees its own outcome. Its "back to /"
+        // edge ends the walk at the front door instead of fanning out.
+        assert_eq!(reach("/kontakt"), set(&["/takk"]));
+        // Standing on an outcome: nothing further down through outcomes.
+        assert_eq!(reach("/subscribed"), set(&[]));
+        assert_eq!(reach("/takk"), set(&[]));
+        // The email-link page reaches nothing and nothing reaches it.
+        assert_eq!(reach("/watching"), set(&[]));
+        // A concrete dynamic path resolves to its pattern and walks on;
+        // the pattern itself is not "further down" from its own page.
+        assert_eq!(reach("/shape/abc"), set(&["/subscribed"]));
+    }
+
     #[test]
     fn declared_id_wins_over_path() {
         let files = vec![(
@@ -2026,6 +2273,34 @@ alternatives:
     fn markdown_drops_html_and_unsafe_links() {
         assert_eq!(render_inline_markdown("x <script>y</script> z"), "x y z");
         assert_eq!(render_inline_markdown("[bad](javascript:alert(1))"), "bad");
+        assert_eq!(
+            render_inline_markdown("[ring](tel:+4791180485)"),
+            "<a href=\"tel:+4791180485\">ring</a>"
+        );
+        assert_eq!(
+            render_inline_markdown("![site](https://x.no/a.jpg)"),
+            "<img src=\"https://x.no/a.jpg\" alt=\"site\" />"
+        );
+        assert_eq!(render_inline_markdown("![x](data:image/png;base64,AA)"), "");
+        assert_eq!(
+            render_inline_markdown("![local](/images/a.jpg)"),
+            "<img src=\"/images/a.jpg\" alt=\"local\" />"
+        );
+        // Image title hints: float + max-width, title dropped.
+        assert_eq!(
+            render_inline_markdown("![J](https://x.no/j.jpg \"right 9rem\")"),
+            "<img class=\"md-float-right\" style=\"max-width:9rem\" src=\"https://x.no/j.jpg\" alt=\"J\" />"
+        );
+        assert_eq!(
+            render_inline_markdown("![J](https://x.no/j.jpg \"12\")"),
+            "<img style=\"max-width:12rem\" src=\"https://x.no/j.jpg\" alt=\"J\" />"
+        );
+        // Unknown hint tokens are ignored; a safe image with no title
+        // is untouched.
+        assert_eq!(
+            render_inline_markdown("![J](https://x.no/j.jpg \"wat\")"),
+            "<img src=\"https://x.no/j.jpg\" alt=\"J\" />"
+        );
         assert_eq!(render_inline_markdown("[ok](/shape)"), "<a href=\"/shape\">ok</a>");
         assert_eq!(render_inline_markdown("[mail](mailto:bl@uhhm.no)"), "<a href=\"mailto:bl@uhhm.no\">mail</a>");
     }

src/i18n.rs

@@ -0,0 +1,97 @@
+//! Chrome-string translations, selected by `site.yaml`'s `lang`.
+//!
+//! Content carries its own language; this covers only the strings the
+//! portal itself speaks around it ("Asked by", the nav lead, the
+//! not-found page...). Unknown languages and unknown keys fall back
+//! to English, so a typo degrades to the default instead of a blank.
+
+/// Translate `key` for `lang`. `en` is the reference table; every
+/// other language falls through to it for keys it doesn't carry.
+pub fn t(lang: &str, key: &str) -> &'static str {
+    if let Some(s) = lookup(lang, key) {
+        return s;
+    }
+    lookup("en", key).unwrap_or(key_missing(key))
+}
+
+fn lookup(lang: &str, key: &str) -> Option<&'static str> {
+    Some(match (lang, key) {
+        ("en", "also_worth_asking") => "Also worth asking",
+        ("en", "asked_by") => "Asked by ",
+        ("en", "contact_them") => "contact them",
+        ("en", "if_stuck") => " if you get stuck.",
+        ("en", "send") => "Send",
+        ("en", "sign_in") => "Sign in",
+        ("en", "nothing_here_yet") => "Nothing here yet.",
+        ("en", "nothing_here") => "Nothing here",
+        ("en", "back_to_start") => "back to the start",
+        ("en", "done") => "Done.",
+        ("en", "follows_answer") => {
+            "This page follows from an answer you don't seem to carry yet."
+        }
+        ("en", "owners_only") => {
+            "This part of the site is for organizational owners — sign in with that account to take a look."
+        }
+        ("en", "announcements") => "Announcements",
+
+        ("no", "also_worth_asking") => "Også verdt å spørre",
+        ("no", "asked_by") => "Stilt av ",
+        ("no", "contact_them") => "ta kontakt",
+        ("no", "if_stuck") => " om du står fast.",
+        ("no", "send") => "Send",
+        ("no", "sign_in") => "Logg inn",
+        ("no", "nothing_here_yet") => "Ingenting her ennå.",
+        ("no", "nothing_here") => "Ingenting her",
+        ("no", "back_to_start") => "tilbake til start",
+        ("no", "done") => "Ferdig.",
+        ("no", "follows_answer") => {
+            "Denne siden følger av et svar du ikke ser ut til å bære ennå."
+        }
+        ("no", "owners_only") => {
+            "Denne delen av siden er for organisasjonens eiere — logg inn med den kontoen for å ta en titt."
+        }
+        ("no", "announcements") => "Kunngjøringer",
+
+        _ => return None,
+    })
+}
+
+/// A missing key is a programmer error; render the key itself so it
+/// is findable, never a panic in a view.
+fn key_missing(key: &str) -> &'static str {
+    // Leak is bounded: keys are a small fixed set of literals.
+    Box::leak(key.to_string().into_boxed_str())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn norwegian_covers_the_english_table() {
+        for key in [
+            "also_worth_asking",
+            "asked_by",
+            "contact_them",
+            "if_stuck",
+            "send",
+            "sign_in",
+            "nothing_here_yet",
+            "nothing_here",
+            "back_to_start",
+            "done",
+            "follows_answer",
+            "owners_only",
+            "announcements",
+        ] {
+            assert!(lookup("en", key).is_some(), "en missing {key}");
+            assert!(lookup("no", key).is_some(), "no missing {key}");
+        }
+    }
+
+    #[test]
+    fn unknown_language_falls_back_to_english() {
+        assert_eq!(t("de", "sign_in"), "Sign in");
+        assert_eq!(t("en", "sign_in"), "Sign in");
+    }
+}

src/lib.rs

@@ -4,6 +4,7 @@ pub mod auth;
 pub mod chain;
 pub mod content;
 pub mod events;
+pub mod i18n;
 pub mod resource;
 
 #[cfg(feature = "ssr")]

src/resource.rs

@@ -68,6 +68,16 @@ pub async fn get_requirement_options(
         .iter()
         .find(|r| r.name == requirement_name)
         .ok_or_else(|| ServerFnError::new("unknown requirement"))?;
+    // Inline options: return them as {id,label} objects, the shape the
+    // SelectField renders, without touching a resource.
+    if !requirement.options.is_empty() {
+        let items: Vec<serde_json::Value> = requirement
+            .options
+            .iter()
+            .map(|o| serde_json::json!({ "id": o, "label": o }))
+            .collect();
+        return Ok(serde_json::Value::Array(items));
+    }
     let resource = requirement
         .resource
         .as_ref()

src/server/oidc.rs

@@ -33,6 +33,13 @@ type OidcClient = CoreClient<
 >;
 
 pub struct Oidc {
+    /// `None` when `KANIDM_URL` is unset: a content-only instance with
+    /// sign-in disabled - auth routes answer 503, everything public
+    /// renders as usual.
+    inner: Option<OidcInner>,
+}
+
+struct OidcInner {
     client: OidcClient,
     http: openidconnect::reqwest::Client,
 }
@@ -45,7 +52,13 @@ const REDIRECT_KEY: &str = "oidc_post_login_redirect";
 impl Oidc {
     /// Discovers the provider and builds the client from environment:
     /// `KANIDM_URL`, `OAUTH2_CLIENT_ID`, `OAUTH2_CLIENT_SECRET`, `PUBLIC_URL`.
+    /// With `KANIDM_URL` unset, sign-in is disabled instead of fatal -
+    /// the shape of a public content instance without a review desk.
     pub async fn from_env() -> anyhow::Result<Self> {
+        if std::env::var("KANIDM_URL").is_err() {
+            tracing::warn!("KANIDM_URL not set - sign-in disabled on this instance");
+            return Ok(Self { inner: None });
+        }
         let kanidm_url = require_env("KANIDM_URL")?;
         let client_id = require_env("OAUTH2_CLIENT_ID")?;
         let client_secret = require_env("OAUTH2_CLIENT_SECRET")?;
@@ -75,7 +88,16 @@ impl Oidc {
         )
         .set_redirect_uri(redirect);
 
-        Ok(Self { client, http })
+        Ok(Self {
+            inner: Some(OidcInner { client, http }),
+        })
+    }
+
+    fn configured(&self) -> Result<&OidcInner, HandlerError> {
+        self.inner.as_ref().ok_or((
+            StatusCode::SERVICE_UNAVAILABLE,
+            "sign-in is not configured on this instance".to_string(),
+        ))
     }
 }
 
@@ -118,10 +140,10 @@ pub async fn login(
         session.insert(REDIRECT_KEY, redirect).await.map_err(internal)?;
     }
 
+    let oidc = state.oidc.configured()?;
     let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();
 
-    let (auth_url, csrf_state, nonce) = state
-        .oidc
+    let (auth_url, csrf_state, nonce) = oidc
         .client
         .authorize_url(
             CoreAuthenticationFlow::AuthorizationCode,
@@ -182,7 +204,7 @@ pub async fn callback(
         ));
     }
 
-    let oidc = &state.oidc;
+    let oidc = state.oidc.configured()?;
     let token_response = oidc
         .client
         .exchange_code(AuthorizationCode::new(params.code))

style/main.css

@@ -99,10 +99,10 @@
     --hero-glow: rgba(246, 245, 241, 0.85);
   }
 
-  /* The wordmark SVG is a hardcoded white stroke (also used raw in
-     dark contexts elsewhere) - flip it to ink here rather than fork
-     the asset. */
-  .wordmark img {
+  /* The house wordmark SVG is a hardcoded white stroke (also used
+     raw in dark contexts elsewhere) - flip it to ink here rather
+     than fork the asset. A content-provided logo keeps its colors. */
+  .wordmark-house img {
     filter: invert(0.92);
   }
 
@@ -147,6 +147,10 @@ a {
 main.loading,
 main.not-found {
   min-height: 60vh;
+  /* svh so wrapper browsers that resize the webview as their toolbar
+     animates (Firefox/Chrome iOS) don't reflow this placeholder - the
+     small viewport is a fixed value. Same ladder as .hero-piece. */
+  min-height: 60svh;
   display: flex;
   flex-direction: column;
   align-items: center;
@@ -193,6 +197,10 @@ main.not-found {
   color: var(--ink-dim);
   font-size: 1.05rem;
   max-width: 46ch;
+  /* The measure cap shrinks the box below the copy column; without
+     auto margins the box left-anchors and its centered text centers
+     in the wrong frame. */
+  margin-inline: auto;
 }
 
 /* A content-shipped hero module (site.yaml hero.kind: module) draws
@@ -364,8 +372,12 @@ main.not-found {
 .alt-image {
   display: block;
   width: 100%;
-  max-height: 14rem;
-  object-fit: cover;
+  height: auto;
+  /* Natural aspect, not a cropped band; a very tall image is still
+     bounded so it can't tower. The deck below overrides for its
+     fixed-height cards. */
+  max-height: 32rem;
+  object-fit: contain;
   border-radius: calc(var(--radius) - 0.3rem);
   margin-bottom: 1.1rem;
 }
@@ -430,10 +442,9 @@ main.not-found {
 }
 
 .feature-icon {
-  float: left;
   width: 1.3rem;
   height: 1.3rem;
-  margin: 0.1rem 0.6rem 0.4rem 0;
+  margin-top: 0.1rem;
   background-color: var(--feature-accent, currentColor);
   mask-repeat: no-repeat;
   mask-size: contain;
@@ -443,6 +454,26 @@ main.not-found {
   -webkit-mask-position: center;
 }
 
+/* With an icon the feature is two columns: the icon in the first,
+   everything else - name, description, fields, resources - in the
+   second, so every line of text shares one left edge instead of
+   wrapping back under the icon. */
+.feature:has(> .feature-icon) {
+  display: grid;
+  grid-template-columns: 1.3rem minmax(0, 1fr);
+  column-gap: 0.7rem;
+  align-items: start;
+}
+
+.feature:has(> .feature-icon) > .feature-icon {
+  grid-column: 1;
+  grid-row: 1;
+}
+
+.feature:has(> .feature-icon) > :not(.feature-icon) {
+  grid-column: 2;
+}
+
 .feature h3 {
   font-size: 1rem;
   margin-bottom: 0.15em;
@@ -517,6 +548,42 @@ main.not-found {
   color: var(--accent);
 }
 
+/* images inside markdown descriptions: full-width figures in the
+   card's flow, framed like the rest of the press sheet */
+.alt-description img,
+.item-card-description img,
+.feature p img {
+  display: block;
+  width: 100%;
+  margin: 0.6rem 0 0.2rem;
+  border-radius: 0.5rem;
+  border: 0.06rem solid var(--line);
+}
+
+/* Content hint via a markdown image title (`![alt](url "right 9rem")`):
+   float and shrink so text wraps around a portrait. */
+.alt-description img.md-float-left,
+.item-card-description img.md-float-left,
+.feature p img.md-float-left,
+.alt-description img.md-float-right,
+.item-card-description img.md-float-right,
+.feature p img.md-float-right {
+  width: auto;
+  max-width: 45%;
+}
+.alt-description img.md-float-left,
+.item-card-description img.md-float-left,
+.feature p img.md-float-left {
+  float: left;
+  margin: 0.2rem 1.1rem 0.5rem 0;
+}
+.alt-description img.md-float-right,
+.item-card-description img.md-float-right,
+.feature p img.md-float-right {
+  float: right;
+  margin: 0.2rem 0 0.5rem 1.1rem;
+}
+
 .alt-description code,
 .feature p code {
   font-size: 0.9em;
@@ -628,11 +695,17 @@ textarea:focus {
   touch-action: none;
 }
 
+/* Results overlay the canvas instead of growing the widget - the
+   page never jumps when places arrive (or don't). */
 .gesture-echoes {
+  position: absolute;
+  left: 0.6rem;
+  right: 0.6rem;
+  bottom: 0.6rem;
   display: flex;
+  justify-content: center;
   gap: 0.5rem;
-  margin-top: 0.5rem;
-  min-height: 3rem;
+  pointer-events: none;
 }
 
 .gesture-echoes:empty {
@@ -647,6 +720,8 @@ textarea:focus {
   border-radius: 0.4rem;
   opacity: 0;
   transition: opacity 0.5s ease;
+  pointer-events: auto;
+  box-shadow: 0 0.15rem 0.6rem rgba(0, 0, 0, 0.18);
 }
 
 .gesture-echo.shown {
@@ -672,9 +747,15 @@ textarea:focus {
 }
 
 .gesture-empty {
-  margin: 0.5rem 0 0;
+  position: absolute;
+  left: 0;
+  right: 0;
+  bottom: 0.7rem;
+  margin: 0;
+  text-align: center;
   font-size: 0.85rem;
   color: var(--ink-dim);
+  pointer-events: none;
 }
 
 .gesture-empty:empty {
@@ -812,6 +893,10 @@ textarea:focus {
   padding: 0.75rem 1.4rem;
   cursor: pointer;
   transition: filter 120ms, transform 120ms;
+  /* A gateway alternative renders this as an <a> (navigation, no POST);
+     kill the link chrome so it reads as the button it looks like. */
+  text-decoration: none;
+  display: inline-block;
 }
 
 .alt-submit:hover {
@@ -960,6 +1045,9 @@ textarea:focus {
 .item-card-description {
   font-size: 0.9rem;
   color: var(--ink-dim);
+  /* The card is a grid with its own gap; the global p bottom margin
+     would stack on top of it. */
+  margin: 0;
 }
 
 .item-card-fields {