Release 0.5.0

A MemoryStore meant every restart signed out every desk on the site
being deployed. Bearable while a desk is three people, and not the
kind of thing that gets better on its own.

They live in NATS KV now: the JetStream already under the events, the
projections, the content reload and the access questions. No new
service, no new store, and the same bucket a second instance of a site
would read if there ever is one. `create` draws a fresh id rather than
writing over a session already at that key, the bucket's `max_age`
collects what nobody comes back for, and a record's own expiry is what
answers a load, whatever the bucket still holds.

Proved the only way it can be: a store opened twice against one
JetStream, which is what two runs of the binary are.

Also fixed, while there: the integration test asserted a record's
projected state was one that `aggregates::transition` never writes -
it appends events, the desk handler updates the projection - so it
failed whenever it was actually run. It now asserts what it says it
does, that a mailed reply leaves the state alone. test.yml has been
red since 0.3.47 while publish.yml stayed green, which is how v0.4.0
went out over it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/publish.yml

@@ -56,10 +56,67 @@ jobs:
       - name: Build
         run: SITE_NAME=${{ vars.PORTAL_SITE_NAME }} cargo leptos build --release
 
-      # cargo-leptos only builds the leptos bin-target ("portal") - the
-      # question-lint utility binary needs its own plain cargo build.
-      - name: Build question-lint
-        run: cargo build --release --bin question_lint --features ssr
+      # The lint (uhhm/iris) is versioned as portal: this step re-pins
+      # iris to the tag being released, builds and tests it against it,
+      # and pushes the matching iris tag, which iris's own CI publishes.
+      # A portal change to something the lint reads fails the release
+      # right here. Needs IRIS_PUSH_USER (a variable) and IRIS_PUSH_TOKEN
+      # (a secret) that may push to uhhm/iris; the workflow's own token
+      # is scoped to this repo. A re-run of a tag whose iris tag already
+      # exists just builds that.
+      - name: Release iris to match
+        env:
+          # The shared cargo home is read-only for the runner, and a git
+          # dependency has to be cloned into one (same as uhhm/iris's CI).
+          CARGO_HOME: /var/local/cargo-target/iris-cargo-home
+          RUSTC_WRAPPER: /usr/bin/sccache
+          IRIS_PUSH_USER: ${{ vars.IRIS_PUSH_USER }}
+          IRIS_PUSH_TOKEN: ${{ secrets.IRIS_PUSH_TOKEN }}
+        run: |
+          set -euo pipefail
+          tag="${{ github.ref_name }}"
+          ver="${tag#v}"
+          host="${{ github.server_url }}"
+          remote="https://${IRIS_PUSH_USER}:${IRIS_PUSH_TOKEN}@${host#https://}/uhhm/iris.git"
+          # Re-pin, version, changelog: idempotent, so a retry on a fresh
+          # clone redoes exactly the same edits.
+          match() {
+            sed -i -E "s|^(portal = \{ git = \"[^\"]+\", tag = \")[^\"]+(\")|\1$tag\2|" Cargo.toml
+            sed -i -E "0,/^version = \"[^\"]+\"/s//version = \"$ver\"/" Cargo.toml
+            cargo update -q -p portal
+            awk -v h="## $ver ($(date -u +%F)) - portal $tag" -v l="- Matches portal $tag (released by portal's publish job)." \
+              'done==0 && /^## /{print h; print ""; print l; print ""; done=1} {print}' CHANGELOG.md > CHANGELOG.new
+            mv CHANGELOG.new CHANGELOG.md
+            git config user.name "portal release"
+            git config user.email "portal@uhhm.no"
+            git commit -qam "Match portal $tag"
+            git tag "$tag"
+          }
+          # Someone may push to iris main while this job builds; a push
+          # then fails as non-fast-forward, and the answer is to start
+          # over on a fresh clone, once.
+          for attempt in 1 2; do
+            cd "$GITHUB_WORKSPACE"
+            rm -rf iris-src
+            git clone -q "$host/uhhm/iris.git" iris-src
+            cd iris-src
+            if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+              echo "iris $tag already exists, building it"
+              git checkout -q "$tag"
+              cargo build --release
+              cargo test
+              break
+            fi
+            match
+            cargo build --release
+            cargo test
+            if git push -q "$remote" main "$tag"; then
+              echo "pushed iris $tag"
+              break
+            fi
+            echo "push rejected on attempt $attempt (iris main moved), retrying on a fresh clone"
+            [ "$attempt" = 2 ] && exit 1
+          done
 
       - name: Package
         run: |
@@ -67,7 +124,7 @@ jobs:
           tag="${{ github.ref_name }}"
           stage=$(mktemp -d)
           cp "$CARGO_TARGET_DIR/release/portal" "$stage/portal"
-          cp "$CARGO_TARGET_DIR/release/question_lint" "$stage/question_lint"
+          cp "$CARGO_TARGET_DIR/release/iris" "$stage/iris"
           # hash-files = true: leptos resolves hash.txt next to the running
           # binary, so it ships beside portal in the release dir.
           cp "$CARGO_TARGET_DIR/release/hash.txt" "$stage/hash.txt"
@@ -75,7 +132,7 @@ jobs:
           # not affected by CARGO_TARGET_DIR - only the plain `cargo build`
           # outputs (release/, front/) move with that override.
           cp -r target/site "$stage/site"
-          tar -C "$stage" -czf "portal-$tag.tar.gz" portal question_lint hash.txt site
+          tar -C "$stage" -czf "portal-$tag.tar.gz" portal iris hash.txt site
           rm -rf "$stage"
 
       # The run's own ephemeral token has write access to this repo -
@@ -88,9 +145,10 @@ jobs:
           tag="${{ github.ref_name }}"
           api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
           auth="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
-          subject=$(git log -1 --format=%s)
-          body=$(printf '{"tag_name":"%s","name":"%s"}' \
-            "$tag" "$tag: $(echo "$subject" | sed 's/"/\\"/g')")
+          # The release notes are this version's section of CHANGELOG.md.
+          notes=$(awk -v v="${tag#v}" '/^## /{p = ($2 == v)} p' CHANGELOG.md | tail -n +2)
+          [ -n "$(printf "%s" "$notes" | tr -d "[:space:]")" ] || { echo "CHANGELOG.md has no section for $tag - write it and re-tag"; exit 1; }
+          body=$(jq -n --arg tag "$tag" --arg notes "$notes" '{tag_name: $tag, name: $tag, body: $notes}')
           id=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
             -d "$body" "$api/releases" | jq .id) \
             || id=$(curl -sf -H "$auth" "$api/releases/tags/$tag" | jq .id)

.gitea/workflows/test.yml

@@ -22,5 +22,22 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # A throwaway JetStream for tests/jetstream.rs. Best effort: if the
+      # runner cannot use docker the variable stays unset and that one
+      # test reports itself skipped rather than failing the build.
+      - name: Start a throwaway JetStream
+        run: |
+          docker rm -f portal-test-nats >/dev/null 2>&1 || true
+          if docker run -d --rm --name portal-test-nats -p 127.0.0.1:14223:4222 nats:2.14.6-alpine -js >/dev/null 2>&1; then
+            sleep 2
+            echo "PORTAL_TEST_NATS_URL=nats://127.0.0.1:14223" >> "$GITHUB_ENV"
+          else
+            echo "::warning::no docker on this runner - the JetStream integration test will be skipped"
+          fi
+
       - name: Test
         run: cargo test --features ssr
+
+      - name: Stop the throwaway JetStream
+        if: always()
+        run: docker rm -f portal-test-nats >/dev/null 2>&1 || true

CHANGELOG.md

@@ -0,0 +1,353 @@
+# Changelog
+
+One line per change, grouped by the release that shipped it. Newest
+first. A release is a Cargo.toml bump plus a `v<version>` tag; the
+content repos pin the tag they run (see the end of this file).
+
+## 0.5.0 (2026-09-28)
+
+- Sessions live in NATS KV (`src/sessions.rs`), not in memory. Every restart used to sign out every desk on the site being deployed; they now survive it, in the JetStream that is already under everything else - no new service and no new store to run. The bucket's `max_age` collects what nobody returns for, and a record's own expiry is what answers a load.
+- Fixed: the JetStream integration test asserted a record's projected state was one a desk move had never written to it, so it failed whenever it actually ran. `test.yml` has been red since 0.3.47 while `publish.yml` stayed green, which is how 0.4.0 shipped past it.
+- A file can come back out. `GET /attachment/{bucket}/{record}/{field}` streams what a `type: file` field stored, reading the object key out of the record rather than taking one from the caller - so a file is only reachable through a record somebody may see, and a key that leaks off a desk is a link to nothing. Before this, uploads were one-way: a desk showed the key as a string and there was no way to open it.
+- Rate limiting, per caller IP, outside everything else: a burst of 30 refilled one every two seconds (`PORTAL_RATE_BURST`, `PORTAL_RATE_SECONDS`; either 0 turns it off). A form-filling visitor never reaches it; a script does. There was none at all before.
+- `/upload` asks the policy, like every other way in. It asked nothing: any caller who could reach the host could put 20 MB in the bucket, as often as they liked, and a site whose forms are public is a site whose upload route is public. It now takes the `question` and `alternative` the file is being attached to, refuses a page that declares no `type: file` field or an alternative that is closed, and asks `Submit` on that page - the same question the submission itself will ask - before a byte is written. Latent until an instance had storage configured; the first one now does.
+- A submitter stays in dialogue with their case for as long as it runs. `self_transition` takes `from: [state, ...]`, and the access policy compiles one rule per state named; it defaulted to the initial state alone and was written that way in the compiler, so an applicant written to for a missing drawing could not send it, and nobody could withdraw once anything had happened. Omitted, it still means the initial state alone.
+- A record can belong to another record. `type: record` with `of: <bucket>` stores the parent's id, which arrives on the link rather than being typed; a submission naming a record that is not there is refused. The other half is `where: { field, equals }` on a Kv resource, so an application's page can list the objections that name it.
+- A public view need not publish the whole bucket. `states: [...]` on a Kv resource shows only those, for one record as well as a listing - a register that is public by law is public about what was decided, not about what was withdrawn. The desk over the same bucket is a different spec and still sees all of it.
+- A state can grant a group: `grants: <group>` beside its `event`, so an approval that means membership does not also need somebody to remember to invite them afterwards. The lint requires the forms that fill such a bucket to collect a required name and email, because by the time a desk presses approve there is nobody left to ask.
+- A state can be moved by a clock: `after: { days, to }`, swept hourly, measured from the record's last move (`src/deadlines.rs`). A deadline may only do what a person could have done - `after.to` is held to the same declared edge as a desk button - and the move fires the same mail and publishes the same event, stamped `deadline`.
+- Documentation moved out of the README into `docs/`: architecture, content reference, state machines, access, operations.
+- A page says nothing until it has something to say. The Suspense fallback on a question was the whole served page - no header, no wordmark - so the first and only thing a visitor or a crawler read was the word "loading…", which is true and is not about them. It now holds the space and stays quiet, with `aria-busy` for a reader that would otherwise find an empty document.
+- Gone: the `gitea_org_repos` resource kind, which no site ever named. `gitea_starred` and `gitea_releases` stay.
+
+## 0.4.0 (2026-09-24)
+
+- A field can be a place: `type: location` puts a pin on a map and stores `{lat, lon, zoom}`; a record holding one renders as a still map on its desk and in any resource card.
+- A question can be about a place: `place: { lat, lon, zoom, name }` is the counterpart to `event:` - event makes a page an occasion with a time, place makes it somewhere, draws the map under the question, and opens any location field on that page there instead of on the globe.
+- Maps are served from this origin. Portal fetches every tile and every still itself (`src/maps.rs`, MapLibre vendored), so a page with a map on it makes no third-party request, needs no consent banner, and the `MAPBOX_TOKEN` never leaves the server. Unset, the feature is simply off.
+- A reply to a case mail becomes a note on its record: whatever reads the mailbox publishes on `portal.mail.received` and portal appends the note, after checking the record exists and the sender is the address the record itself holds. A note never moves a case.
+
+## 0.3.47 (2026-09-24)
+
+- iris: needs.yaml takes `stage_words`, each state in the site's own words, carried into the simulation model for the trainer's desk score. No change to portal itself.
+
+## 0.3.46 (2026-09-23)
+
+- An invite first looks the email up in Kanidm (`/v1/raw/search` on `mail`, when the service account may read people: `idm_people_pii_read`) and only adds an existing account, under whatever username, to the group; no second account, no reset link.
+
+## 0.3.45 (2026-09-23)
+
+- A mail stream that cannot be created at boot (subjects owned by an older stream) is a warning, not a failed start; 0.3.44 took the kasse sites down for two minutes on the rename.
+
+## 0.3.44 (2026-09-23)
+
+- The mail stream is named `mail` (was `WORMHOLE`); gdo 0.1.2 matches. Delete the old stream on each NATS after upgrading both.
+
+## 0.3.43 (2026-09-23)
+
+- Mail is content: `mail: { to, subject, body }` on a state in aggregates.yaml sends when a record enters that state (`to: submitter` or one address; `{field}`, `{site}`, `{chain}`, `{email}` in the templates), and an invite mails its one-time link built in; `site.yaml` gains `mail: { from, reply_to, invite }`. Portal renders and publishes on `portal.mail.send` in the `WORMHOLE` stream; uhhm/gdo delivers. The lint requires a required `email` field on every form recording into a bucket that mails the submitter.
+
+## 0.3.42 (2026-09-23)
+
+- people: the Kanidm person lookup reads the body, since Kanidm 1.11 answers a missing person with 200 and `null` rather than 404; before this every invite skipped account creation and failed on the group step
+
+## 0.3.41 (2026-09-23)
+
+- publish: the iris release step retries on a fresh clone when its push loses a race against a push to iris main (the v0.3.40 tag never published)
+- iris: `check --access` prints the access matrix, and every check validates the compiled policy against the schema
+
+## 0.3.40 (2026-09-23)
+
+- One access policy, compiled from content into Cedar on every load (`src/access.rs`): pages, resource reads, desk transitions, self transitions and the automation endpoint all decide through it; decisions carry rule ids, refusals and mutations publish on `portal.access.decided`, and `portal.access.<site>.may` answers the same question for other apps over NATS
+- `invite: {group}` on an alternative onboards a person into Kanidm from a desk (`src/people.rs`, `KANIDM_API_TOKEN`), recording the one-time credential link in `portal_invites` and on `portal.people.invited`
+
+## 0.3.39 (2026-09-23)
+
+- publish: releases the matching uhhm/iris by proxy - re-pins, builds, tests and tags it as this version (needs the `IRIS_PUSH_USER` variable and `IRIS_PUSH_TOKEN` secret); iris carries portal's version number from here on
+
+## 0.3.38 (2026-09-22)
+
+- publish: the iris build step gets a writable cargo home; the v0.3.37 tag never published
+
+## 0.3.37 (2026-09-22)
+
+- The lint moves to its own repo, uhhm/iris: `question_lint` becomes `iris check`, `needs_replay` becomes `iris replay`; the tarball ships `iris` (pinned in publish.yml) instead of `question_lint`; the needs module and local loaders leave portal
+
+## 0.3.36 (2026-09-22)
+
+- Question nav: a followup is offered only once earned - the verified chain answered the alternative leading there, or a link that records nothing leads on from an earned page. Standing on a page no longer unlocks the pages behind its forms; the chain index now records which alternative was answered
+- One bounded HTTP client for every server-side fetch: 20 s budget, size caps per kind of fetch (`src/http.rs`)
+- Uploads are refused past 20 MB while streaming, and the route body limit that had capped them at axum's 2 MB default is raised to match
+- `tests/jetstream.rs`: the store, the event log and the projection tested against a real JetStream (CI starts a throwaway one)
+- `content` split into `gitea`, `validate`, `markdown`, `handlers`; every path still `content::x`
+- This changelog, and the table of what each site runs
+- Business needs as a checkable spec: needs.yaml + question_lint pass
+- needs: `success` states and a resolved simulation model
+- needs: `stages` - every stage the business named must be a state
+- needs_replay: make simulated cases real aggregates, report buckets by state
+- needs: also_moved_by - a need carried by more than one group's desk
+
+## 0.3.35 (2026-09-12)
+
+- Item cards: no paragraph margin under the description
+
+## 0.3.34 (2026-09-11)
+
+- Question nav: offer followups by reach, not by carrying any chain
+
+## 0.3.33 (2026-09-02)
+
+- Head preloads: latin font, wordmark, content-host preconnect
+
+## 0.3.32 (2026-09-01)
+
+- Per-site favicon via site.yaml
+
+## 0.3.31 (2026-09-01)
+
+- Markdown links allow tel:
+
+## 0.3.30 (2026-09-01)
+
+- Single alt-image shows natural height
+
+## 0.3.29 (2026-09-01)
+
+- Markdown image layout hints + AVIF assets
+
+## 0.3.28 (2026-09-01)
+
+- Hero description renders inline markdown
+
+## 0.3.27 (2026-09-01)
+
+- wordmark_invert: explicit, not inferred from .svg
+
+## 0.3.26 (2026-09-01)
+
+- Select fields: inline static options
+
+## 0.3.25 (2026-09-01)
+
+- Content-shipped stylesheet override (site.yaml stylesheet)
+
+## 0.3.24 (2026-09-01)
+
+- Gateway submit-as-link loses the underline
+
+## 0.3.23 (2026-09-01)
+
+- Chrome speaks the site's language: site.yaml lang + i18n table
+
+## 0.3.22 (2026-09-01)
+
+- site.yaml wordmark_height; raster logos keep their colors
+
+## 0.3.21 (2026-09-01)
+
+- Hero paragraph centers its measure box
+
+## 0.3.20 (2026-09-01)
+
+- Sign-in becomes optional: KANIDM_URL unset disables auth cleanly
+
+## 0.3.19 (2026-09-01)
+
+- Markdown images in descriptions, gated and framed
+
+## 0.3.18 (2026-09-01)
+
+- Item cards render inline markdown descriptions
+- Convergence: ink converges onto the decoded key (WebGL glow)
+- Gesture results overlay the canvas - the page never jumps
+
+## 0.3.16 (2026-08-30)
+
+- Announce sweeper: refresh open records from content
+
+## 0.3.15 (2026-08-30)
+
+- Hidden fields: carrier value without a label row
+
+## 0.3.14 (2026-08-30)
+
+- Feature cards: icon column, one text edge
+
+## 0.3.13 (2026-08-30)
+
+- Voice field: nothing leaves the browser until Keep it here
+
+## 0.3.12 (2026-08-30)
+
+- Voice preview stays hidden until there is something to play
+
+## 0.3.11 (2026-08-30)
+
+- README: gesture and voice fields
+- Validate templated actions against the page pattern
+
+## 0.3.10 (2026-08-30)
+
+- type: voice, Requirement.value, playable resource cards
+
+## 0.3.9 (2026-08-30)
+
+- Templated actions; places are pickable in the gesture input
+
+## 0.3.8 (2026-08-30)
+
+- Descriptions are inline markdown; Feature.link withdrawn
+
+## 0.3.7 (2026-08-30)
+
+- Feature.link: a card's name may point elsewhere
+
+## 0.3.6 (2026-08-30)
+
+- Announced pages: event windows, header announcements, summary tasks
+
+## 0.3.5 (2026-08-30)
+
+- Gesture widget: stop drawing the decoded ghost path
+- Gesture widget: ghost path back, for v2 keys only
+
+## 0.3.4 (2026-08-25)
+
+- Alternative.disabled: announced but not yet takeable
+
+## 0.3.3 (2026-08-25)
+
+- Empty list says so before it can parse as zero answers
+
+## 0.3.2 (2026-08-25)
+
+- README: hashed pkg assets in the release flow
+- Resource empty text: content-declared, and null counts as empty
+
+## 0.3.1 (2026-08-25)
+
+- Content-hashed pkg assets (hash-files) so stale bundles can't pair with new wasm
+
+## 0.3.0 (2026-08-25)
+
+- Hero becomes a content-owned module; site asset proxy; gesture growth fix
+
+## 0.2.4 (2026-08-25)
+
+- Gates keep the question nav
+
+## 0.2.3 (2026-08-25)
+
+- Attended-bucket lint rule; app-lifetime resources fix first-nav corruption
+
+## 0.2.2 (2026-08-24)
+
+- One app-level Title fed by a shared site resource
+
+## 0.2.1 (2026-08-24)
+
+- Docs: routing bullet + design doc marked implemented
+- Revalidating cache on app assets; site title survives SPA navigation
+
+## 0.2.0 (2026-08-24)
+
+- Initial commit: content-driven onboarding portal
+- Load content from Gitea directly, drop the local clone; add deploy workflow
+- Share sccache between manual dev builds and CI
+- Give CI its own SCCACHE_SERVER_PORT
+- Erase view types at every list/component boundary, not just leaves
+- Redirect cargo-leptos's tool cache out of act-runner-bare's StateDirectory
+- Fix Ship release: site-root is project-relative, not CARGO_TARGET_DIR
+- Drop sudo from the deploy workflow - NoNewPrivileges blocks it outright
+- Caddy snippet: use multi-line log block
+- Fix static asset 404s and build-time SITE_NAME
+- Hot-reload content on a NATS trigger instead of requiring a restart
+- Add prosekit rich-text field, Gitea repo embeds, automation KV read endpoint; fix apex/www session-cookie mismatch on /auth/callback
+- Fix prosekit-editor.js: remove bare CSS imports that aborted the whole module
+- Redirect back to the originating page after sign-in, not always /
+- Fix hero-canvas navigation race; style the prosekit editor and add a toolbar
+- yes.js: guard against the canvas not being in the DOM yet
+- Fix get_resource/transition_answer: scope feature lookup to its own alternative
+- Add self-service transitions, authorized by item possession not group membership
+- Event-sourced applicant/subscriber/project aggregates, generalized resources
+- deploy.yml: write GITEA_API_TOKEN for the new GiteaStarred/OrgRepos resource sources
+- Cargo.toml: disambiguate bin-target for cargo-leptos
+- Add manually-triggered backfill workflow, no terminal/sudo needed
+- Trigger redeploy to pick up PORTAL_GITEA_API_TOKEN secret
+- Render generic resource lists as cards, not raw JSON dump
+- Fix recursion-limit build failure in the new item-card renderer
+- Resource-backed multi/single-select requirement
+- Add Organization aggregate (client-as-status), wired but inert
+- Fix favicon (real icon, not an unrelated orange circle) + stack encouragements with the submit button
+- Fix bucket-404 on empty resources, redesign review actions as select-then-confirm, CSS polish
+- Inline encouragements with the submit button, vertically centered
+- Use the real institutional logo for the header wordmark, not plain text
+- Use the actual UHHM-letters wordmark, not the institutional mark
+- Responsive base font size via svmin, not fixed 17px
+- Add plain-unit fallbacks for svmin/svh in case of unsupported engines
+- Size the YES canvas from its container, not window.innerHeight
+- Debounce the YES canvas resize handler and skip no-op resizes
+- Revert canvas sizing to window.innerWidth/innerHeight, gate resize on width change
+- Stop blocking native scroll on the YES canvas's touch handlers
+- Quicksand: font-display optional, not swap, to stop the text-jump on scroll
+- Use lvh/lvmin, not svh/svmin - svh was the wrong end of the viewport
+- Update style/main.css
+- Update style/main.css
+- YES canvas: size off its own container rect, not window.innerHeight
+- yes.js: freeze .hero-yes's height via inline style, don't trust svh alone
+- add responsive container width
+- deploy.yml: build and publish question_lint alongside the app binary
+- Make aggregate state graphs content-driven, not compiled Rust
+- One shared, content-labeled Confirm button per alternative instead of one per row
+- get_resource/get_requirement_options: #[server(default)] on params
+- Add optional Alternative.image and Feature.color/icon for richer layouts
+- Drop the feature list's left-padding
+- Drop question-report entirely, obfuscate the mailto link instead
+- Transition.from: state graphs deeper than one decision
+- Alternative.images: array of urls, rendered as a Swiper card deck
+- Reseed lost event history from the KV projection on transition
+- Lighten the comment load
+- Validate action targets; format timestamps client-side; clippy cleanup
+- Question nav + gateway alternatives
+- Responsible note under the title; followup pages out of the nav until a chain exists
+- README: what the engine provides
+- Feature icons: masked span painted by currentColor, not <img>
+- Responsible note: one line, same hue and size as the hero description
+- Responsible note as <small>: meta information, dimmer than the description
+- Responsible note back to the footer, above the question nav
+- Bound inputs: a field that loads its value from a sibling-parameterized resource
+- add some more width to our alternatives
+- Accent to a dusty press-cyan, a muted echo of the canvas's cyan ink
+- Editor type in rem: prosekit's px typography ignored the responsive root
+- Ban px from stylesheets: every length rem/em off the responsive root
+- No translucent input chrome: solid ink-dim placeholders and embed meta
+- Editor type scales for real: drop prosekit typography.css, fix selectors
+- Stable server fn endpoints: open tabs survive deploys
+- Drop stray local tool temp file, ignore .claude/
+- Noise-driven YES, sticky hero with frosted cards, full light theme
+- increase translucency of laternative cards
+- Showcase jq test tracks Gitea repo shape and website-first links
+- Gesture input type, redoal-relay client, gitea_releases, content-driven branding
+- Echo thumbnails fade in via timeout, not rAF
+- Trigger deploy: redoal OAuth2 credentials now configured
+- Deploy becomes publish: portal ships as a versioned release artifact
+- Semver releases cut with cargo-release; publish on v* tags only
+- Docs: release/rollout flow after the instance-ownership refactor
+- README: frame portal as a generic multi-site question engine
+- Design doc: filesystem routes, sections, dynamic segments
+- Filesystem routes, sections, dynamic segments; instant YES hero
+
+
+## What each site runs
+
+Read from the hosts on 2026-09-28; a rollout is a pin bump in the
+site's content repo (`PORTAL_RELEASE` in its `deploy.yml`), or a manual
+tarball deploy on kasse.
+
+| Site | Host | Instance | Version |
+|---|---|---|---|
+| uhhm.no | ergo | `app@uhhm-portal` | v0.4.0 |
+| redoal.com | ergo | `app@redoal-portal` | v0.4.0 |
+| westra.klingenbergbygg.no | kasse | `app@westra-portal` | v0.4.0 |
+| portal.klingenbergbygg.no | kasse | `app@klingenberg-portal` | v0.4.0 |
+| vel.klingenbergbygg.no | kasse | `app@tomtervel-portal` | v0.4.0 |

Cargo.lock

@@ -44,6 +44,15 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
+[[package]]
+name = "ar_archive_writer"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73cd58deff2140a0a8eae87e417bd01db68a33e148aa93d1e8cd837e55e312b6"
+dependencies = [
+ "object",
+]
+
 [[package]]
 name = "arc-swap"
 version = "1.9.2"
@@ -53,6 +62,21 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "arrayvec"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
+
+[[package]]
+name = "ascii-canvas"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1e3e699d84ab1b0911a1010c5c106aa34ae89aeac103be5ce0c3859db1e891"
+dependencies = [
+ "term",
+]
+
 [[package]]
 name = "async-lock"
 version = "3.4.2"
@@ -108,9 +132,9 @@ checksum = "4288f83726785267c6f2ef073a3d83dc3f9b81464e9f99898240cced85fce35a"
 
 [[package]]
 name = "async-trait"
-version = "0.1.91"
+version = "0.1.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -661,6 +685,16 @@ dependencies = [
  "hybrid-array",
 ]
 
+[[package]]
+name = "borsh"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+]
+
 [[package]]
 name = "bs58"
 version = "0.5.1"
@@ -724,6 +758,70 @@ dependencies = [
  "shlex",
 ]
 
+[[package]]
+name = "cedar-policy"
+version = "4.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e4f5e46c425491b7133eecb3030d82d27301b84bfa08533c59a6902cca7eb80"
+dependencies = [
+ "cedar-policy-core",
+ "cedar-policy-formatter",
+ "itertools 0.15.0",
+ "linked-hash-map",
+ "linked_hash_set",
+ "miette",
+ "ref-cast",
+ "semver",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "smol_str",
+ "thiserror 2.0.19",
+]
+
+[[package]]
+name = "cedar-policy-core"
+version = "4.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a30d11033d59b262bbb380d8bb5dc5c3dd2dd2281675c558ef4fd8a161ce669"
+dependencies = [
+ "chrono",
+ "educe",
+ "either",
+ "itertools 0.15.0",
+ "lalrpop",
+ "lalrpop-util",
+ "linked-hash-map",
+ "linked_hash_set",
+ "miette",
+ "nonempty 0.12.0",
+ "ref-cast",
+ "regex",
+ "rustc-literal-escaper",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "smol_str",
+ "stacker",
+ "thiserror 2.0.19",
+ "unicode-security",
+]
+
+[[package]]
+name = "cedar-policy-formatter"
+version = "4.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a2c8dc671e62597c85caa11694365b76050abcd9f2177f0520ccac0580f9a41"
+dependencies = [
+ "cedar-policy-core",
+ "itertools 0.15.0",
+ "logos",
+ "miette",
+ "pretty",
+ "regex",
+ "smol_str",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.4"
@@ -962,6 +1060,12 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
+
 [[package]]
 name = "crypto-bigint"
 version = "0.5.5"
@@ -1063,6 +1167,20 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "dashmap"
+version = "6.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
 [[package]]
 name = "data-encoding"
 version = "2.11.0"
@@ -1229,6 +1347,18 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "educe"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e451fac8dd8dece16234604bf1efce6e90fddd8ab6ad4d66eec0eca5160959dd"
+dependencies = [
+ "enum-ordinalize",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "either"
 version = "1.17.0"
@@ -1266,6 +1396,15 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "ena"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eabffdaee24bd1bf95c5ef7cec31260444317e72ea56c4c91750e8b7ee58d5f1"
+dependencies = [
+ "log",
+]
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -1275,6 +1414,26 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "enum-ordinalize"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89dd01549b09589510cf0647475075d12071456586d70f5c75c98ae2a5537677"
+dependencies = [
+ "enum-ordinalize-derive",
+]
+
+[[package]]
+name = "enum-ordinalize-derive"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a65863d15a4ce2888bd2f0f543cc963d3879c3a022c8ee43f6141d479a3ac815"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -1345,6 +1504,12 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -1372,6 +1537,16 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "forwarded-header-value"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8835f84f38484cc86f110a805655697908257fb9a7af005234060891557198e9"
+dependencies = [
+ "nonempty 0.7.0",
+ "thiserror 1.0.69",
+]
+
 [[package]]
 name = "fs_extra"
 version = "1.3.0"
@@ -1449,6 +1624,12 @@ version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
 
+[[package]]
+name = "futures-timer"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
+
 [[package]]
 name = "futures-util"
 version = "0.3.33"
@@ -1497,9 +1678,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -1550,6 +1733,29 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "governor"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9efcab3c1958580ff1f25a2a41be1668f7603d849bb63af523b208a3cc1223b8"
+dependencies = [
+ "cfg-if",
+ "dashmap",
+ "futures-sink",
+ "futures-timer",
+ "futures-util",
+ "getrandom 0.3.4",
+ "hashbrown 0.16.1",
+ "nonzero_ext",
+ "parking_lot",
+ "portable-atomic",
+ "quanta",
+ "rand 0.9.5",
+ "smallvec",
+ "spinning_top",
+ "web-time",
+]
+
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -1611,6 +1817,12 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -1848,6 +2060,19 @@ dependencies = [
  "webpki-roots",
 ]
 
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper 1.11.0",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
@@ -2066,6 +2291,15 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b4baf93f58d4425749ca49a51c50ebab072c5df6994d08fed93541c331481dc"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -2193,6 +2427,15 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "keccak"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
+dependencies = [
+ "cpufeatures 0.2.17",
+]
+
 [[package]]
 name = "konst"
 version = "0.2.20"
@@ -2208,6 +2451,38 @@ version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
 
+[[package]]
+name = "lalrpop"
+version = "0.22.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba4ebbd48ce411c1d10fb35185f5a51a7bfa3d8b24b4e330d30c9e3a34129501"
+dependencies = [
+ "ascii-canvas",
+ "bit-set",
+ "ena",
+ "itertools 0.14.0",
+ "lalrpop-util",
+ "petgraph",
+ "pico-args",
+ "regex",
+ "regex-syntax",
+ "sha3",
+ "string_cache",
+ "term",
+ "unicode-xid",
+ "walkdir",
+]
+
+[[package]]
+name = "lalrpop-util"
+version = "0.22.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5baa5e9ff84f1aefd264e6869907646538a52147a755d494517a8007fb48733"
+dependencies = [
+ "regex-automata",
+ "rustversion",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -2451,6 +2726,24 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
+[[package]]
+name = "linked-hash-map"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "linked_hash_set"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "984fb35d06508d1e69fc91050cceba9c0b748f983e6739fa2c7a9237154c52c8"
+dependencies = [
+ "linked-hash-map",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -2479,6 +2772,38 @@ version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
+[[package]]
+name = "logos"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb2c55a318a87600ea870ff8c2012148b44bf18b74fad48d0f835c38c7d07c5f"
+dependencies = [
+ "logos-derive",
+]
+
+[[package]]
+name = "logos-codegen"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58b3ffaa284e1350d017a57d04ada118c4583cf260c8fb01e0fe28a2e9cf8970"
+dependencies = [
+ "fnv",
+ "proc-macro2",
+ "quote",
+ "regex-automata",
+ "regex-syntax",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "logos-derive"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52d3a9855747c17eaf4383823f135220716ab49bea5fbea7dd42cc9a92f8aa31"
+dependencies = [
+ "logos-codegen",
+]
+
 [[package]]
 name = "lru"
 version = "0.16.4"
@@ -2548,6 +2873,29 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
+[[package]]
+name = "miette"
+version = "7.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f98efec8807c63c752b5bd61f862c165c115b0a35685bdcfd9238c7aeb592b7"
+dependencies = [
+ "cfg-if",
+ "miette-derive",
+ "serde",
+ "unicode-width 0.1.14",
+]
+
+[[package]]
+name = "miette-derive"
+version = "7.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db5b29714e950dbb20d5e6f74f9dcec4edbcc1067bb7f8ed198c097b8c1a818b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -2592,6 +2940,12 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
 [[package]]
 name = "next_tuple"
 version = "0.1.0"
@@ -2613,6 +2967,27 @@ dependencies = [
  "signatory",
 ]
 
+[[package]]
+name = "nonempty"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9e591e719385e6ebaeb5ce5d3887f7d5676fceca6411d1925ccc95745f3d6f7"
+
+[[package]]
+name = "nonempty"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9737e026353e5cd0736f98eddae28665118eb6f6600902a7f50db585621fecb6"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "nonzero_ext"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -2712,6 +3087,15 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "object"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e5a6c098c7a3b6547378093f5cc30bc54fd361ce711e05293a5cc589562739b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "oco_ref"
 version = "0.2.1"
@@ -2872,6 +3256,31 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "petgraph"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772"
+dependencies = [
+ "fixedbitset",
+ "indexmap 2.14.0",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pico-args"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5be167a7af36ee22fe3115051bc51f6e6c7054c9348e28deb4f49bd6f705a315"
+
 [[package]]
 name = "pin-project"
 version = "1.1.13"
@@ -2948,14 +3357,16 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.3.35"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "arc-swap",
  "async-nats",
+ "async-trait",
  "aws-sdk-s3",
  "axum",
  "base64 0.22.1",
+ "cedar-policy",
  "chrono",
  "console_error_panic_hook",
  "dotenvy",
@@ -2979,6 +3390,7 @@ dependencies = [
  "tower",
  "tower-http",
  "tower-sessions",
+ "tower_governor",
  "tracing",
  "tracing-subscriber",
  "url",
@@ -3012,6 +3424,23 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "pretty"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d22152487193190344590e4f30e219cf3fe140d9e7a3fdb683d82aa2c5f4156"
+dependencies = [
+ "arrayvec",
+ "typed-arena",
+ "unicode-width 0.2.2",
+]
+
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -3105,6 +3534,16 @@ dependencies = [
  "unarray",
 ]
 
+[[package]]
+name = "psm"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dcd034599e63b970727f70d79e02d62390a4a84f7c6b827c27c46d5ac3fa622"
+dependencies = [
+ "ar_archive_writer",
+ "cc",
+]
+
 [[package]]
 name = "pulldown-cmark"
 version = "0.13.4"
@@ -3123,6 +3562,21 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "007d8adb5ddab6f8e3f491ac63566a7d5002cc7ed73901f72057943fa71ae1ae"
 
+[[package]]
+name = "quanta"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
+dependencies = [
+ "crossbeam-utils",
+ "libc",
+ "once_cell",
+ "raw-cpuid",
+ "wasi",
+ "web-sys",
+ "winapi",
+]
+
 [[package]]
 name = "quick-error"
 version = "1.2.3"
@@ -3322,6 +3776,15 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
+[[package]]
+name = "raw-cpuid"
+version = "11.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
 [[package]]
 name = "reactive_graph"
 version = "0.2.14"
@@ -3549,6 +4012,12 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
+[[package]]
+name = "rustc-literal-escaper"
+version = "0.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfe6f213fb658c8fb95baabd5420393438cf5a98d707f5dd701d9197c705f71e"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -3874,6 +4343,7 @@ version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
+ "indexmap 2.14.0",
  "itoa",
  "memchr",
  "serde",
@@ -4107,6 +4577,16 @@ dependencies = [
  "digest 0.11.3",
 ]
 
+[[package]]
+name = "sha3"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
+dependencies = [
+ "digest 0.10.7",
+ "keccak",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -4154,6 +4634,12 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "siphasher"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -4175,6 +4661,16 @@ version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
+[[package]]
+name = "smol_str"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aaa7368fcf4852a4c2dd92df0cace6a71f2091ca0a23391ce7f3a31833f1523"
+dependencies = [
+ "borsh",
+ "serde_core",
+]
+
 [[package]]
 name = "socket2"
 version = "0.5.10"
@@ -4207,6 +4703,15 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
 
+[[package]]
+name = "spinning_top"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
+dependencies = [
+ "lock_api",
+]
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -4223,6 +4728,31 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
+[[package]]
+name = "stacker"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707f49d46706bacf8a2b00d51dace3f9de527c13eec3778f570c411f89e69967"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "psm",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "string_cache"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+]
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -4334,6 +4864,15 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "term"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8c27177b12a6399ffc08b98f76f7c9a1f4fe9fc967c784c5a071fa8d93cf7e1"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -4494,6 +5033,17 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tokio-stream"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-tungstenite"
 version = "0.29.0"
@@ -4572,6 +5122,35 @@ dependencies = [
  "winnow",
 ]
 
+[[package]]
+name = "tonic"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "bytes",
+ "h2 0.4.15",
+ "http 1.4.2",
+ "http-body 1.1.0",
+ "http-body-util",
+ "hyper 1.11.0",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "socket2 0.6.5",
+ "sync_wrapper",
+ "tokio",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -4580,9 +5159,12 @@ checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
+ "indexmap 2.14.0",
  "pin-project-lite",
+ "slab",
  "sync_wrapper",
  "tokio",
+ "tokio-util",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -4694,6 +5276,23 @@ dependencies = [
  "tower-sessions-core",
 ]
 
+[[package]]
+name = "tower_governor"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44de9b94d849d3c46e06a883d72d408c2de6403367b39df2b1c9d9e7b6736fe6"
+dependencies = [
+ "axum",
+ "forwarded-header-value",
+ "governor",
+ "http 1.4.2",
+ "pin-project",
+ "thiserror 2.0.19",
+ "tonic",
+ "tower",
+ "tracing",
+]
+
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -4838,12 +5437,49 @@ version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-script"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "383ad40bb927465ec0ce7720e033cb4ca06912855fc35db31b5755d0de75b1ee"
+
+[[package]]
+name = "unicode-security"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e4ddba1535dd35ed8b61c52166b7155d7f4e4b8847cec6f48e71dc66d8b5e50"
+dependencies = [
+ "unicode-normalization",
+ "unicode-script",
+]
+
 [[package]]
 name = "unicode-segmentation"
 version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
+[[package]]
+name = "unicode-width"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
 [[package]]
 name = "unicode-xid"
 version = "0.2.6"
@@ -5079,6 +5715,22 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -5088,6 +5740,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
 [[package]]
 name = "windows-core"
 version = "0.62.2"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.3.35"
+version = "0.5.0"
 edition = "2021"
 
 [lib]
@@ -38,6 +38,7 @@ uuid = { version = "1", features = ["v4", "serde"], optional = true }
 dotenvy = { version = "0.15", optional = true }
 anyhow = { version = "1", optional = true }
 futures = { version = "0.3", optional = true }
+cedar-policy = { version = "4", optional = true }
 tracing = { version = "0.1", optional = true }
 tracing-subscriber = { version = "0.3", features = ["env-filter"], optional = true }
 # jq-filter evaluation for ResourceSource's optional `jq` field
@@ -62,6 +63,8 @@ web-sys = { version = "0.3", features = [
     "Response",
     "Window",
 ], optional = true }
+tower_governor = { version = "0.8.0", optional = true }
+async-trait = { version = "0.1.92", optional = true }
 
 [features]
 default = []
@@ -80,6 +83,8 @@ ssr = [
     "dep:leptos_axum",
     "dep:axum",
     "dep:aws-sdk-s3",
+    "dep:tower_governor",
+    "dep:async-trait",
     "dep:tokio",
     "dep:tower",
     "dep:tower-http",
@@ -96,6 +101,7 @@ ssr = [
     "dep:dotenvy",
     "dep:anyhow",
     "dep:futures",
+    "dep:cedar-policy",
     "dep:tracing",
     "dep:tracing-subscriber",
     "dep:jaq-core",
@@ -106,9 +112,8 @@ ssr = [
 [dev-dependencies]
 proptest = "1"
 
-[[bin]]
-name = "question_lint"
-path = "src/bin/question_lint.rs"
+[[test]]
+name = "jetstream"
 required-features = ["ssr"]
 
 [profile.wasm-release]

README.md

@@ -1,160 +1,51 @@
 # portal
 
 A content-driven question engine: one Rust binary that turns a Git
-repo of YAML into a live site — pages, forms, review desks, and state
+repo of YAML into a live site — pages, forms, review desks and state
 machines, with a durable event-sourced record of every answer
-underneath. The engine special-cases nothing: everything a site
-serves is declared in its content repo, and the same build serves any
-number of sites.
+underneath.
 
-Point an instance at a content repo and that repo *is* the site:
-pages, copy, state graphs, branding, and even the landing hero
-(`site.yaml`: title, wordmark, and `hero: {kind: module, module:
-hero.js}` — a JavaScript module the content repo ships, served
-same-origin at `/site/<path>`, that portal mounts at parse time and
-stops on navigation; the YES canvas and redoal's sine swings are both
-content, not engine). Content
-pushes hot-reload every running instance; instances differ only by
-env vars. [uhhm.no](https://uhhm.no)
-([uhhm/questions](https://project.uhhm.no/uhhm/questions)) and
-[redoal.com](https://redoal.com)
-([redoal/questions](https://project.uhhm.no/redoal/questions)) are
-two faces of the same binary, deployed from the same release
-artifact.
+The engine special-cases nothing. Everything a site serves is declared
+in its content repo, content pushes hot-reload every running instance,
+and the same build serves any number of sites: instances differ only
+by environment variables. [uhhm.no](https://uhhm.no) and
+[redoal.com](https://redoal.com) are two faces of the same binary from
+the same release artifact.
 
-It composes with the surrounding stack rather than bundling it: Gitea
-hosts and serves the content, NATS JetStream stores events and
-projections, Kanidm provides identity, and anything downstream
-(automations, newsletters, onboarding) subscribes to the answer
-stream.
+It composes with the surrounding stack rather than bundling it. Gitea
+hosts the content, NATS JetStream stores the events and projections,
+Kanidm provides identity, and anything downstream — automations,
+newsletters, onboarding — subscribes to the answer stream.
 
-## What the engine provides
+## Documentation
 
-- **Content-driven pages** (`src/content.rs`, `src/app.rs`): YAML
-  loaded from Gitea at boot and hot-swapped on a NATS reload signal;
-  a bad push keeps the last-good content serving. The `questions/`
-  tree IS the router — file paths become URLs, `_section.yaml`
-  applies criteria to a whole directory, `[name].yaml` pages serve
-  any `/dir/<value>` with the segment fed into resource keys, and
-  `requires_chain` gates a page on verifiable answer provenance next
-  to `qualifies`' Kanidm-group identity gate (see
-  `docs/design/filesystem-routes.md`).
-- **Gesture and voice fields** (`gesture.js`, `voice.js`): a stroke
-  becomes a redoal gesture key through a relay (ADR-0013/0015 in the
-  redoal repo) - the input shows the key's own decode under the
-  stroke, who is at a similar shape now, and *places* with recordings
-  the visitor can pick to make that key theirs; a voice field records
-  in the browser and leaves the audio at a key. Actions may be
-  templated from the answer (`/shape/{curve.key}`) onto dynamic
-  pages, whose URL segment also fills `value: "{key}"` presets and
-  `url` resource sources; resource items with an https `audio` field
-  render a player.
-- **Announced pages** (`src/announce.rs`): a question with an
-  `event: {starts, duration, place}` window is announced in the
-  header (not the footer nav) while the window is open, becomes a
-  followup when it closes, and its record in the runtime-owned
-  `portal_events` bucket moves to `awaiting_summary` - a "post what
-  happened" task any review desk can read, published on NATS like a
-  decision. A one-minute sweeper keeps it all idempotent.
-- **State machines as content** (`src/aggregates/`): `aggregates.yaml`
-  declares each bucket's states and legal transitions; the engine
-  replays a record's event history and refuses undeclared moves, with
-  optimistic concurrency (CAS on the event log's sequence) against
-  racing decisions. An empty history reseeds from the KV projection,
-  so wiping the event stream strands nothing.
-- **Durable events + projections** (`src/events/`, `src/answers.rs`):
-  every submission and decision appends to a JetStream event log and
-  projects into a NATS KV bucket pages read back; every one also
-  publishes on `portal.answers.submitted` for automations (n8n) to
-  react to.
-- **Answer chains** (`src/chain.rs`): each submission hashes its
-  parent(s), so a visitor's path through the questions is a verifiable
-  lineage; `?chain=` links carry it, and self-service transitions
-  (unsubscribe) authorize by holding one. The question nav reads it
-  too: a `followup` page is offered only when it is on that path (the
-  page the chain verifiably answered) or further down from the current
-  page over `action` edges - one followup path never unlocks another.
-- **Live resources** (`src/resource.rs`): content can pull a KV
-  bucket, Gitea starred/org repos/releases, or any public JSON URL
-  (SSRF fail-closed), reshaped by a content-declared `jq` filter.
-- **Input kinds as content**: a requirement's `type:` picks the
-  widget — plain fields, a rich-text editor, or a `gesture` drawing
-  canvas that can connect to a redoal relay so similar strokes echo
-  between visitors live. Submitted values are arbitrary JSON; the
-  engine records what the widget produced.
-- **Review desks**: any Kv resource with `transitions` renders rows
-  with per-state action buttons and one shared confirm per
-  alternative — owners walk records through their graphs without
-  bespoke UI per bucket.
+Everything is under [`docs/`](docs/README.md):
 
-## Binaries
-
-- `portal` — the server (Leptos SSR + hydrate, Axum underneath).
-- `question_lint` — headless content validation, shipped inside every
-  release artifact so each content repo's CI lints with the exact
-  portal version its instance runs; also works offline:
-  `question_lint --path <dir>`.
+- [Architecture](docs/architecture.md) — what the engine is made of.
+- [Content reference](docs/content-reference.md) — every key a content
+  repo may write.
+- [State machines](docs/state-machines.md) — `aggregates.yaml`.
+- [Access](docs/access.md) — the policy compiled from content.
+- [Operations](docs/operations.md) — releasing, deploying, adding a site.
 
 ## Development
 
 ```sh
-cargo leptos build            # full app (server + wasm)
-cargo test --features ssr     # engine tests
-cargo build --features ssr --bin question_lint
+cargo leptos build            # server + wasm
+cargo test --features ssr     # tests/jetstream.rs needs PORTAL_TEST_NATS_URL
 ```
 
-Runtime configuration is env vars (see `src/main.rs`, and each
-content repo's `.gitea/workflows/deploy.yml` for the values in
-production): `NATS_URL`, `CONTENT_REPO`/`CONTENT_BRANCH`, Kanidm OIDC
-(`KANIDM_URL`, `OAUTH2_CLIENT_*`), optional `GARAGE_*` for uploads,
-`GITEA_API_TOKEN` for authenticated resource pulls,
-`AUTOMATION_READ_TOKEN` for the automation KV read endpoint.
-
-## Release and deploy
-
-Portal doesn't deploy itself — it publishes versions, and each site
-decides when to take one. The whole day-to-day surface is two
-commands:
-
-**Cut a release** (here):
+Content is linted by [iris](https://project.uhhm.no/uhhm/iris), which
+depends on this crate and carries the same version, so a content repo
+can check itself against the exact portal its instance runs:
 
 ```sh
-cargo release patch        # or minor / major
+iris check --path questions
 ```
 
-That bumps `Cargo.toml`, tags `v<version>`, and pushes; CI
-(`.gitea/workflows/publish.yml`) reacts to the tag, builds once, and
-attaches `portal-v<version>.tar.gz` (`portal` + `question_lint` +
-`hash.txt` + `site/`) to the Gitea release. Pkg files are
-content-hashed (`hash-files = true`; instances run with
-`LEPTOS_HASH_FILES=true`), so a freshly served page can never pair a
-stale cached bundle with new wasm. Plain pushes to `main` only run the
-tests (`test.yml`) — nothing reaches production from this repo.
+## Releasing
 
-**Roll it out** (in a content repo): edit one line in that repo's
-`.gitea/workflows/deploy.yml` —
-
-```yaml
-env:
-  PORTAL_RELEASE: v0.1.1   # <- bump, commit, push
-```
-
-Its CI downloads the pinned artifact, ships
-`/srv/app/<instance>/releases/<tag>`, flips `current`, rewrites the
-instance env from that repo's own Actions variables/secrets, restarts
-`app@<instance>`, and refreshes the Caddy route. Every rollout is a
-commit, so reverting a bad version is `git revert` + push. Sites
-upgrade independently: uhhm.no (uhhm/questions → `app@uhhm-portal`,
-:3010) and redoal.com (redoal/questions → `app@redoal-portal`,
-:3020) can pin different versions.
-
-Content changes never come through any of this — they hot-reload
-live from the content repos over NATS.
-
-**Add a site**: new content repo with a copy of an existing
-`deploy.yml` (change `INSTANCE`, port, domains), Actions variables
-(`KANIDM_URL`, `OAUTH2_CLIENT_ID`, `PUBLIC_URL`, `SITE_NAME`) and
-secrets (`NATS_URL`, `OAUTH2_CLIENT_SECRET`,
-`PORTAL_GITEA_API_TOKEN` — Gitea reserves the `GITEA_` prefix for
-secret names), a Kanidm OAuth2 client, and DNS. `site.yaml` in the
-content repo handles all branding; no portal changes needed.
+`cargo release patch` tags and pushes; CI builds the tarball and
+attaches it to the Gitea release. A site takes it by bumping
+`PORTAL_RELEASE` in its own content repo. See
+[operations](docs/operations.md).

docs/README.md

@@ -0,0 +1,22 @@
+# portal documentation
+
+Portal turns a Git repo of YAML into a running site. Almost everything
+here is about that YAML: what a content repo may say, and what the
+engine does with it.
+
+| | |
+|---|---|
+| [Architecture](architecture.md) | What the engine is made of and where each piece lives in the source. |
+| [Content reference](content-reference.md) | Every key a content repo may write, and what it does. |
+| [State machines](state-machines.md) | `aggregates.yaml`: stages, who moves a case, mail, deadlines, memberships. |
+| [Access](access.md) | How the Cedar policy is compiled from content, and who may ask it what. |
+| [Operations](operations.md) | Releasing, deploying, adding a site, environment variables. |
+| [Filesystem routes](design/filesystem-routes.md) | Why the `questions/` tree is the router. |
+
+Two repos in the same family carry their own docs:
+
+- [uhhm/iris](https://project.uhhm.no/uhhm/iris) — the lint. Versioned
+  as portal and released by portal's publish job; it is the thing a
+  content repo's CI runs before anything reaches a site.
+- [uhhm/gdo](https://project.uhhm.no/uhhm/gdo) — the mailer. Delivers
+  what content asked to be sent, and carries replies back.

docs/access.md

@@ -0,0 +1,55 @@
+# Access
+
+Who may do what to what is compiled from content on every load into
+one Cedar policy set, and every server entry point asks that one
+policy. Identity stays Kanidm's; portal only decides.
+
+## What content compiles to
+
+| content | rule |
+|---|---|
+| a page with no `qualifies` | anyone may open and submit |
+| `qualifies: case_officers` | that group may open and submit |
+| `requires_chain: /start` | the visitor's verified answer lineage must reach it |
+| a resource with `public: true` | anyone may read it |
+| a resource with `requires_group: g` | that group may read it |
+| a desk resource's `transitions` | that group may make those moves |
+| an alternative's `self_transition` | the submitter may make it, from each state in `from`, with their link and their matching email |
+| an alternative's `invite: {group}` | the page's own group may invite into that group |
+
+Mutations always need a group, whatever `public` says. A resource with
+neither `public` nor `requires_group` is unreachable rather than open:
+the policy fails closed.
+
+## Reading the policy
+
+```sh
+iris check --path questions --access
+```
+
+prints every rule the content compiled to, as a table of who may do
+what from where to where. It is the fastest way to find a rule a
+content repo did not mean to write — a refusal available on the day a
+case arrives, a board that can decide a case it never received.
+
+## Asking it
+
+Every decision carries the rule ids that granted it. Refusals and
+every mutation are published on `portal.access.decided`.
+
+Other applications ask the same question over NATS request-reply on
+`portal.access.<site>.may`, with the same principal, action, resource
+and context the server uses internally — so an automation acting as a
+group gets exactly the answer a person in that group would.
+
+## The submitter
+
+A person who sent a form has no account. Their credential is the link:
+an unguessable chain hash, plus the email they gave, which the policy
+compares against the one stored on the record.
+
+What they may do, and from where, is `self_transition.from`. Its
+default is the initial state alone. A refusal reads "not found" while
+the record is somewhere the move could have been made from — so the
+endpoint cannot be used to discover which records or addresses exist —
+and "already processed" once the case has moved past it.

docs/architecture.md

@@ -0,0 +1,92 @@
+# Architecture
+
+One Rust binary (Leptos SSR + hydrate, Axum underneath) serving any
+number of sites. The engine special-cases nothing: every page, form,
+desk and state graph a site serves is declared in its content repo,
+and instances differ only by environment variables.
+
+It composes with the surrounding stack rather than bundling it. Gitea
+hosts the content, NATS JetStream stores the events and projections,
+Kanidm provides identity, and anything downstream subscribes to the
+answer stream.
+
+## The pieces
+
+**Content** (`src/content/`) — YAML loaded from Gitea at boot and
+hot-swapped on a NATS reload signal. A bad push keeps the last-good
+content serving. The `questions/` tree is the router: file paths
+become URLs, `_section.yaml` applies to a whole directory, and
+`[name].yaml` serves any `/dir/<value>` with the segment fed into the
+page's resource keys. See [filesystem routes](design/filesystem-routes.md).
+
+**The lint** (`src/content/validate.rs`) — every rule a content repo
+is held to. It runs at boot, on every hot reload, and in a content
+repo's CI through [iris](https://project.uhhm.no/uhhm/iris), which
+depends on this crate and so applies exactly the version the instance
+runs.
+
+**State machines** (`src/aggregates/`) — `aggregates.yaml` declares
+each bucket's states and legal moves. A record's state is replayed
+from its own event history, undeclared moves are refused, and racing
+decisions are settled by CAS on the log's sequence. An empty history
+reseeds from the KV projection, so wiping the event stream strands
+nothing. See [state machines](state-machines.md).
+
+**Events and projections** (`src/events/`, `src/answers.rs`) — every
+submission and decision appends to a JetStream log and projects into
+a NATS KV bucket that pages read back, and publishes on
+`portal.answers.submitted` for automations to react to.
+
+**Answer chains** (`src/chain.rs`) — each submission hashes its
+parents, so a visitor's path through the questions is a verifiable
+lineage. `?chain=` links carry it; a `followup` page is offered only
+once the chain has earned it, and a page behind an answer somebody has
+not given is never offered.
+
+**Access** (`src/access.rs`) — who may do what to what, compiled from
+content on every load into one Cedar policy set that every server
+entry point asks. See [access](access.md).
+
+**People** (`src/people.rs`) — onboarding as a form. An alternative
+with `invite: {group}` creates the person in Kanidm, records their
+email, adds them to the group and mints a one-time credential link. A
+state may also grant a group on its own (`grants:`), so an approval
+that means membership needs no second step.
+
+**Mail** (`src/mail.rs`) — a state may declare the mail its arrival
+sends. Portal renders it and publishes on `portal.mail.send`;
+[gdo](https://project.uhhm.no/uhhm/gdo) delivers it and carries
+replies back on `portal.mail.received`, where they become notes beside
+the record. A note never moves a case.
+
+**Sweepers** (`src/announce.rs`, `src/deadlines.rs`) — the two things
+that move without a person. An announced page's window closes and its
+record becomes a "post what happened" task; a state with a deadline
+waits out its days and then makes the move itself. Both go through the
+same transition path as a desk button and publish the same event.
+
+**Resources** (`src/resource.rs`) — content can read a KV bucket,
+Gitea starred repos, org repos or releases, or any public JSON URL
+(SSRF fail-closed), reshaped by a content-declared `jq` filter. What a
+resource reads is never a client-supplied parameter: the client names
+a page and a feature, never a bucket or URL.
+
+**Maps** (`src/maps.rs`) — MapLibre is vendored and every tile, style
+and still image is proxied through portal, so a page with a map makes
+no third-party request and needs no consent banner.
+
+**Desks** — any Kv resource with `transitions` renders rows with
+per-state buttons and one shared confirm. Owners walk records through
+their graphs with no bespoke UI per bucket.
+
+## Binaries
+
+- `portal` — the server.
+- `iris` — the lint, from its own repo, shipped in every release
+  tarball so a content repo's CI can lint with the exact version its
+  instance runs.
+
+**Sessions** (`src/sessions.rs`) — in the same JetStream KV as
+everything else, so a restart does not sign anybody out. The bucket
+carries a `max_age` so NATS collects what nobody comes back for, and
+each record's own `expiry_date` is what decides on the way out.

docs/content-reference.md

@@ -0,0 +1,232 @@
+# Content reference
+
+A content repo is the site. This is everything it may say.
+
+```
+site.yaml                 branding, language, mail
+aggregates.yaml           the state machine of every bucket
+needs.yaml                what the site is for (read by iris, never by portal)
+questions/
+  index.yaml              the front page, served at /
+  about.yaml              served at /about
+  review/
+    _section.yaml         applies to everything under /review
+    index.yaml            served at /review
+    [record].yaml         serves /review/<anything>
+```
+
+Nothing here is required except a `questions/` tree with something in
+it. Portal's lint refuses content it cannot serve honestly, at boot,
+on every hot reload, and in CI through `iris check`.
+
+## site.yaml
+
+```yaml
+title: Vestmark kommune          # the browser title and the header
+wordmark: /site/logo.svg         # an image instead of the title
+wordmark_invert: true            # flip it in dark mode
+wordmark_height: 2.4             # rem
+lang: no                         # the interface language: en or no
+stylesheet: /site/theme.css      # served same-origin from the repo
+favicon: /site/icon.svg
+hero: { kind: module, module: hero.js }   # or { kind: plain }
+mail:
+  from: Vestmark kommune <post@vestmark.example>
+  reply_to: post@vestmark.example
+  invite: { subject: "...", body: "..." }   # rewords the built-in invite mail
+```
+
+`mail.from` is required as soon as any state declares a mail.
+
+## A question
+
+One YAML file is one page.
+
+```yaml
+id: /apply              # defaults to the file's path
+name: Apply to build
+description: What we need from you.
+qualifies: case_officers        # a Kanidm group may open this page
+requires_chain: /start          # or: an answer they must already have given
+followup: true                  # keep it out of the nav until earned
+responsible: { name: Solveig, email: post@vestmark.example }
+event:                          # this page announces an occasion
+  starts: 2026-10-14T18:00
+  duration: 2h
+  place: The town hall
+place:                          # this page is about somewhere
+  lat: 59.8938
+  lon: 11.0332
+  zoom: 15
+  name: Tomter
+alternatives: [ ... ]
+```
+
+`qualifies`, `requires_chain` and `responsible` are inherited from the
+nearest `_section.yaml`. `event` makes a page an occasion with a time;
+`place` makes it a place, drawing a still map under the question and
+opening any `type: location` field on the page there rather than on
+the whole world.
+
+## An alternative
+
+One choice. Never two actions behind one heading: if two things can be
+done, they are two alternatives.
+
+```yaml
+alternatives:
+  - name: Send the drawings
+    description: We answer within twelve weeks.
+    action: /sent                  # the page to go to; /shape/{field} templates
+    record_as: applications        # the bucket the answer lands in
+    disabled: false
+    consequence: [What happens next]
+    encouragements: [It takes two minutes]
+    images: [/site/drawing.png]
+    features: [ ... ]
+```
+
+Three things an alternative may do instead of, or beside, recording an
+answer:
+
+```yaml
+    self_transition:               # the person moves their own record
+      bucket: applications
+      to: complete
+      from: [open, incomplete]     # defaults to the initial state alone
+      label: Send them
+    invite: { group: case_officers }   # onboard someone into Kanidm
+```
+
+`self_transition.from` is what keeps a person in dialogue with their
+case: an applicant written to for a missing drawing answers from
+`incomplete`, and may withdraw from wherever the case has got to.
+Omitted, it is the initial state alone, which is what a one-shot
+unsubscribe link means. Each state listed becomes its own access rule,
+and the lint refuses a `from -> to` the state machine does not declare.
+
+An `invite` needs a required `name` and `email` on the same
+alternative, and the inviting group must be allowed to invite that
+group by the policy.
+
+## A feature
+
+What an alternative offers, explained. A feature that is only layout
+is a feature wasted: each one says something true about the choice.
+
+```yaml
+    features:
+      - name: What you need
+        description: The case number from the letter.
+        icon: document
+        color: "#8ec2c0"
+        requirements: [ ... ]      # form fields
+        resource: { ... }          # live data
+```
+
+## A requirement (a form field)
+
+```yaml
+        requirements:
+          - name: email            # snake_case; this is the stored key
+            label: Your email
+            placeholder: you@example.no
+            type: email
+            optional: false
+            value: "{key}"         # a preset; a dynamic page's segment fills it
+```
+
+`type` is one of:
+
+| type | what it is |
+|---|---|
+| `text` | the default |
+| `email`, `tel`, `date`, `number`, … | anything else is passed straight through as the HTML input type |
+| `textarea` | several lines |
+| `prosekit` | a rich-text editor |
+| `select` | one choice, or `multiple: true` for any number |
+| `file` | an upload, with `accept:` and `multiple:` |
+| `location` | a pin on a map, stored as `{lat, lon, zoom}` |
+| `record` | the record this one belongs to |
+| `gesture`, `voice` | a drawn stroke or a recording, through a redoal relay |
+| `hidden` | a carrier value, no label row |
+| `module` | a widget the content repo ships |
+
+A `select` takes either inline `options: [...]` or a `resource:` to
+draw them from, with `id_field:` naming each item's stable id.
+
+A field may load its value from a resource when a sibling changes:
+
+```yaml
+          - name: contents
+            type: textarea
+            bind:
+              field: path          # the sibling to watch
+              resource: { source: { kind: url, url: "https://git.example/raw/{path}" } }
+```
+
+### type: record
+
+How one case belongs to another — an objection to the application it
+objects to, an appeal to the decision it appeals.
+
+```yaml
+          - name: case
+            type: record
+            of: applications       # the bucket the other record is in
+            value: "{key}"         # arrives on the link, on a dynamic page
+```
+
+Nobody types one of these: the stored value is the parent's record id,
+which is a chain hash. It arrives the way it was given out, so the
+field carries rather than asks, and renders hidden. A submission
+naming a record that is not there is refused, so a reference in a
+stored record is one that resolved at least once.
+
+The other half is a listing that asks for the children:
+
+```yaml
+        resource:
+          source: { kind: kv, bucket: objections }
+          requires_group: case_officers
+          where: { field: case, equals: "{key}" }
+```
+
+## A resource
+
+Live data, declared by content and read by the server. What a resource
+reads is never a client-supplied parameter.
+
+```yaml
+        resource:
+          source: { kind: kv, bucket: applications }
+          key: abc123              # one record instead of the list
+          public: true             # or requires_group: case_officers
+          states: [approved, refused]      # only these; empty means all
+          where: { field: case, equals: "{key}" }
+          jq: ".[] | {name, url: .html_url}"
+          empty: Nothing decided yet.
+          transitions:             # the desk's buttons
+            - { from: complete, to: on_hearing, label: Send it out }
+```
+
+`source.kind` is one of `kv`, `gitea_starred`,
+`gitea_releases`, `url`.
+
+A spec with neither `public: true` nor `requires_group` is
+unreachable: reads fail closed, and mutations always need a group
+whatever `public` says.
+
+`states` and `where` narrow a listing. They matter most for a register
+that is public by law — public about what was decided, not about what
+was withdrawn — while the desk working the same bucket is a different
+spec and still sees all of it. A record that has no such field never
+matches: "everything that did not say" is not something a page can ask
+for by accident.
+
+## needs.yaml
+
+What the site is for, as a checkable spec: who wants what, which
+bucket the answer must land in, which group carries it to a finished
+state. The runtime never reads it. `iris check` proves the site meets
+it, and `iris replay` runs cases through the real engine.

docs/operations.md

@@ -0,0 +1,126 @@
+# Operations
+
+Portal does not deploy itself. It publishes versions; each site
+decides when to take one.
+
+## Cut a release
+
+```sh
+cargo release patch        # or minor / major
+```
+
+That bumps `Cargo.toml`, tags `v<version>` and pushes. CI
+(`.gitea/workflows/publish.yml`) reacts to the tag, builds once, and
+attaches `portal-v<version>.tar.gz` (`portal`, `iris`, `hash.txt`,
+`site/`) to the Gitea release. Plain pushes to `main` only run the
+tests: nothing reaches production from this repo.
+
+The same job re-pins, tests and tags [iris](https://project.uhhm.no/uhhm/iris)
+to match, so a portal change to anything the lint reads fails the
+release rather than the next content push.
+
+Before cutting, move the `Unreleased` lines in `CHANGELOG.md` under a
+heading for the new version. That section becomes the release notes,
+and the table at the end of the file records which version each site
+runs.
+
+Pkg files are content-hashed (`hash-files = true`, instances run with
+`LEPTOS_HASH_FILES=true`), so a freshly served page can never pair a
+stale cached bundle with new wasm.
+
+## Roll it out
+
+In the content repo, one line of `.gitea/workflows/deploy.yml`:
+
+```yaml
+env:
+  PORTAL_RELEASE: v0.4.0
+```
+
+Its CI downloads the pinned artifact, ships
+`/srv/app/<instance>/releases/<tag>`, flips `current`, rewrites the
+instance env from that repo's own Actions variables and secrets,
+restarts `app@<instance>` and refreshes the Caddy route. Every rollout
+is a commit, so reverting a bad version is `git revert` and a push.
+
+Sites upgrade independently and may pin different versions.
+
+Content changes never come through any of this: they hot-reload live
+from the content repos over NATS.
+
+## Add a site
+
+A new content repo with a copy of an existing `deploy.yml` (change
+`INSTANCE`, the port and the domains), Actions variables
+(`KANIDM_URL`, `OAUTH2_CLIENT_ID`, `PUBLIC_URL`, `SITE_NAME`) and
+secrets (`NATS_URL`, `OAUTH2_CLIENT_SECRET`, `PORTAL_GITEA_API_TOKEN`
+— Gitea reserves the `GITEA_` prefix for secret names), a Kanidm
+OAuth2 client, and DNS. `site.yaml` handles all branding; no portal
+change is needed.
+
+## Environment
+
+Runtime configuration is environment variables; `src/main.rs` is the
+authority and each content repo's `deploy.yml` holds the production
+values.
+
+| | |
+|---|---|
+| `NATS_URL` | events, projections, sessions, content reload, access questions |
+| `CONTENT_REPO`, `CONTENT_BRANCH` | the repo that is the site |
+| `KANIDM_URL`, `OAUTH2_CLIENT_ID`, `OAUTH2_CLIENT_SECRET` | sign-in |
+| `KANIDM_API_TOKEN` | invites and `grants:`; unset, neither happens |
+| `PUBLIC_URL`, `SITE_NAME` | what the site calls itself in links and mail |
+| `GITEA_API_TOKEN` | authenticated resource pulls |
+| `AUTOMATION_READ_TOKEN` | the automation KV read endpoint |
+| `GARAGE_*` | uploads |
+| `MAPBOX_TOKEN` | map tiles, proxied; unset, maps are off |
+| `GARAGE_*` (4) | attachments; see below. Unset, upload fields fail closed |
+| `PORTAL_RATE_BURST`, `PORTAL_RATE_SECONDS` | the rate limit; see below |
+
+Mail is delivered by [gdo](https://project.uhhm.no/uhhm/gdo), a
+separate unit on the same host reading the same NATS.
+
+## Rate limiting
+
+Every request passes a per-caller-IP limit before a session is loaded
+or a handler is entered: a burst of 30, refilled one every two
+seconds. A visitor filling in a form never reaches it (a page load
+fetches several resources at once); a script does.
+
+| | |
+|---|---|
+| `PORTAL_RATE_BURST` | how many requests at once, default 30 |
+| `PORTAL_RATE_SECONDS` | seconds per refilled request, default 2 |
+
+Either set to `0` turns it off, for an instance behind something that
+already does this. The caller is read from `X-Forwarded-For` or
+`X-Real-IP`, falling back to the socket — all of these instances are
+behind Caddy.
+
+This is a fence, not an accounting system. What keeps uploads honest
+is the policy check on the route itself.
+
+## Attachments
+
+A `type: file` field stores an object key in the record. The file
+comes back out at:
+
+    GET /attachment/{bucket}/{record}/{field}
+
+which reads the key out of that record rather than taking one from the
+caller, so a file can only be fetched through a record somebody is
+allowed to see, and a leaked key is a link to nothing. Reading it
+needs the same policy permission as reading the bucket on a desk.
+
+Uploads need a bucket and a key in the Garage on the host:
+
+```sh
+garage bucket create <site>-attachments
+garage key create <site>-portal-uploads
+garage bucket allow --read --write <site>-attachments --key <site>-portal-uploads
+```
+
+then `GARAGE_S3_ENDPOINT`, `GARAGE_ACCESS_KEY`, `GARAGE_SECRET_KEY` and
+`GARAGE_UPLOADS_BUCKET` in that instance's env. Unset, an upload field
+fails closed rather than appearing to work and storing nowhere.

docs/state-machines.md

@@ -0,0 +1,151 @@
+# State machines
+
+`aggregates.yaml` declares what a bucket's records may be and how they
+move. It is the one file that decides what is possible; the pages only
+decide who presses what.
+
+```yaml
+aggregates:
+  - bucket: applications
+    initial: open
+    states:
+      open:        { event: received }
+      incomplete:  { event: incomplete }
+      complete:    { event: complete }
+      on_hearing:  { event: on_hearing }
+      recommended: { event: recommended }
+      approved:    { event: approved }
+      refused:     { event: refused }
+      withdrawn:   { event: withdrawn }
+    transitions:
+      open:        [incomplete, complete, withdrawn]
+      incomplete:  [complete, withdrawn]
+      complete:    [incomplete, on_hearing, refused, withdrawn]
+      on_hearing:  [incomplete, recommended, refused, withdrawn]
+      recommended: [approved, refused, withdrawn]
+```
+
+`transitions` is an arbitrary directed graph. Cycles are allowed and
+are often the honest shape: a case sent back for the drawing it was
+missing returns to a stage it was already past. A good ending may sit
+partway along — an authority that changes its own decision finishes
+the case without walking to the end of the line.
+
+Each state's `event` string is the name written into the log, and must
+be unique within the bucket. A record's state is replayed from its own
+events, so renaming an event orphans the records that carry the old
+name: when rebuilding a live site, keep the names it already has.
+
+## What a state may carry
+
+Beside its `event`, a state may declare three things that happen when
+a record arrives in it.
+
+### mail
+
+```yaml
+      approved:
+        event: approved
+        mail:
+          to: submitter            # or one fixed address
+          subject: "Your application"
+          body: |
+            Hello,
+
+            {property_address} is approved. The decision is at
+            {site}/status/{chain}.
+```
+
+`{field}` is any field of the record, plus `{site}`, `{chain}`,
+`{email}`, `{bucket}` and `{state}`. The body is markdown; it is sent
+as text with an HTML alternative. `to: submitter` means the record's
+`email` field, and the lint then requires every form filling that
+bucket to collect a required `email`.
+
+Portal renders it and publishes on `portal.mail.send`. gdo delivers
+it, and a reply comes back on `portal.mail.received` as a note beside
+the record. A note never moves a case.
+
+### grants
+
+```yaml
+      approved:
+        event: approved
+        grants: approved_firms
+```
+
+The person the record is about becomes a member of that group when the
+record arrives here. An approval that *means* membership should not
+also need somebody to remember to invite them afterwards.
+
+The lint requires every form filling that bucket to collect a required
+`name` and a required `email`, because by the time a desk presses
+approve there is nobody left to ask. An instance with no Kanidm
+configured grants nothing and says so in the log; the transition
+itself always stands.
+
+### after
+
+```yaml
+      on_hearing:
+        event: on_hearing
+        after: { days: 42, to: recommended }
+```
+
+The move a clock makes rather than a person. A hearing that gets no
+answer in six weeks has to go on without one, and nobody in the
+building is in a position to press that button.
+
+A deadline may only do what a person could have done: `after.to` is
+held to the same declared edge as a desk button, and content that says
+otherwise is refused when it loads, not when the hour comes round. The
+wait is measured from the record's last move. The move goes through
+the same transition path, fires the same mail, and lands on
+`portal.answers.submitted` like any decision, stamped `deadline`.
+
+The unit is days and the sweep is hourly. This is a deadline, not a
+job queue.
+
+## attended_by
+
+```yaml
+  - bucket: newsletter
+    initial: open
+    states: { open: { event: received } }
+    attended_by: n8n newsletter compose
+```
+
+Names what consumes a bucket no page reads back. The lint refuses a
+bucket that a form fills and nothing attends — a question was once
+dropped and its answers silently fell out of every reader's view, and
+this is the contract that replaced the convention.
+
+## Who moves what
+
+Nothing in this file says who. A move becomes possible for somebody
+when a page offers it:
+
+- a desk resource's `transitions` gives it to that resource's
+  `requires_group`;
+- an alternative's `self_transition` gives it to the person who sent
+  the record, by their link and their email, from the states its
+  `from` names;
+- a state's `after` gives it to the clock.
+
+All three compile into the same [access policy](access.md), and the
+engine refuses anything the graph above does not declare, whoever asks.
+
+## Testing one
+
+`iris replay` runs cases through this exact machinery — the same
+`store_answer` and `transition` the running site uses, against a
+throwaway JetStream, reporting what the engine accepted and refused.
+
+```sh
+docker run -d --rm -p 127.0.0.1:14222:4222 nats:2.14.6-alpine -js
+iris replay --path questions --nats nats://127.0.0.1:14222 --cases cases.jsonl
+```
+
+Each line of `cases.jsonl` is one case: a need, a record, and the
+states it walks. Point it at a throwaway NATS, never a site's own: it
+writes.

map.js

@@ -0,0 +1,128 @@
+// Glue for `type: location` requirement fields (see AlternativeCard in
+// src/app.rs) - the same hidden-input bridge every widget kind uses,
+// and the same typed handle with stop() that gesture.js and voice.js
+// use so SPA navigation tears the map down.
+//
+// The pin is the centre of the map, not a draggable marker: panning
+// works the same with a finger, a mouse or the arrow keys, and there
+// is nothing to miss by a few pixels. Whatever the map is looking at
+// when it stops moving is the answer, written into the paired hidden
+// <input> as {"lat","lon","zoom"} with a real `input` event, so the
+// Rust side reuses the signal wiring every other field already has.
+//
+// MapLibre is vendored and served from this origin (/maplibre-gl.js),
+// and every tile comes from this origin too (/map/tiles/...), so a
+// page with a map on it still talks to nobody but us.
+
+const WAIT_MS = 15000;
+
+async function maplibre() {
+  const started = Date.now();
+  while (!window.maplibregl) {
+    if (Date.now() - started > WAIT_MS) throw new Error('maplibre-gl did not load');
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  return window.maplibregl;
+}
+
+// The value as stored: five decimals is about a metre, which is as
+// much as a pin on a map means.
+function place(map) {
+  const c = map.getCenter();
+  return {
+    lat: Number(c.lat.toFixed(5)),
+    lon: Number(c.lng.toFixed(5)),
+    zoom: Number(map.getZoom().toFixed(2)),
+  };
+}
+
+// Where to open: what the field already holds, else what the content
+// gave as `value` ("lat,lon,zoom"), else the whole world, which is
+// honest about knowing nothing rather than guessing a country.
+function opening(hidden, initial) {
+  try {
+    const held = JSON.parse(hidden.value || 'null');
+    if (held && typeof held.lat === 'number' && typeof held.lon === 'number') {
+      return { center: [held.lon, held.lat], zoom: held.zoom ?? 13, pinned: true };
+    }
+  } catch {}
+  const parts = String(initial || '').split(',').map((p) => Number(p.trim()));
+  if (parts.length >= 2 && parts.every((n) => Number.isFinite(n))) {
+    return { center: [parts[1], parts[0]], zoom: parts[2] ?? 13, pinned: false };
+  }
+  return { center: [0, 20], zoom: 1, pinned: false };
+}
+
+class MapWidget {
+  constructor(container, hidden, initial) {
+    this.container = container;
+    this.map = null;
+    this.dead = false;
+    this.start(container, hidden, initial);
+  }
+
+  async start(container, hidden, initial) {
+    let gl;
+    try {
+      gl = await maplibre();
+    } catch (e) {
+      container.textContent = 'The map could not be loaded. ' + (hidden.value ? 'Your saved place is kept.' : '');
+      return;
+    }
+    if (this.dead) return;
+
+    const at = opening(hidden, initial);
+    const canvas = document.createElement('div');
+    canvas.className = 'map-canvas';
+    const pin = document.createElement('div');
+    pin.className = 'map-pin';
+    pin.setAttribute('aria-hidden', 'true');
+    const readout = document.createElement('p');
+    readout.className = 'map-readout';
+    container.append(canvas, pin, readout);
+
+    const map = new gl.Map({
+      container: canvas,
+      style: '/map/style.json',
+      center: at.center,
+      zoom: at.zoom,
+      attributionControl: { compact: true },
+    });
+    this.map = map;
+    map.addControl(new gl.NavigationControl({ showCompass: false }), 'top-right');
+    map.addControl(
+      new gl.GeolocateControl({ positionOptions: { enableHighAccuracy: true }, trackUserLocation: false }),
+      'top-right',
+    );
+
+    // Nothing is answered until the map has been moved, or was opened
+    // on an answer it already had: an untouched map means "no place",
+    // not "the middle of the ocean".
+    let answered = at.pinned;
+    const write = () => {
+      if (!answered) return;
+      const value = place(map);
+      hidden.value = JSON.stringify(value);
+      hidden.dispatchEvent(new Event('input', { bubbles: true }));
+      readout.textContent = `${value.lat}, ${value.lon}`;
+    };
+    map.on('moveend', () => {
+      answered = true;
+      write();
+    });
+    map.on('load', write);
+  }
+
+  stop() {
+    this.dead = true;
+    if (this.map) {
+      this.map.remove();
+      this.map = null;
+    }
+    this.container.replaceChildren();
+  }
+}
+
+export function mountMap(container, hidden, initial) {
+  return new MapWidget(container, hidden, initial);
+}

src/access.rs

@@ -0,0 +1,615 @@
+//! The one place a request is allowed or refused.
+//!
+//! Content already says who may do what: `qualifies` on a page,
+//! `requires_group`/`public` on a resource, the transitions a desk
+//! offers, a `self_transition` a submitter may fire with their own
+//! link, an `invite` a group may extend. Until now those were five
+//! checks in five files. Here they are compiled, on every content
+//! load, into one Cedar policy set, and every server entry point asks
+//! the same question: may this principal take this action on this
+//! resource? The answer carries the ids of the rules that granted it,
+//! and every decision that matters is published on NATS.
+//!
+//! The policy text is derived, never hand-written: content is the
+//! source, this module is the compiler, iris prints the result as a
+//! matrix and validates it against the schema.
+#![cfg(feature = "ssr")]
+
+use std::collections::{HashMap, HashSet};
+use std::str::FromStr;
+
+use cedar_policy::{
+    Authorizer, Context, Entities, Entity, EntityId, EntityTypeName, EntityUid, PolicySet, Request,
+    RestrictedExpression, Schema, ValidationMode, Validator,
+};
+use serde::{Deserialize, Serialize};
+
+use crate::aggregates::AggregateSchema;
+use crate::content::{path_matches, Question};
+
+/// What every entity and action may look like. The generated policies
+/// are validated against this, so a content shape the compiler does
+/// not know how to express fails loudly instead of granting nothing.
+pub const SCHEMA: &str = r#"
+entity Group;
+entity User in [Group];
+entity Submitter { email: String };
+entity Service;
+entity Page;
+entity Bucket;
+entity Feature;
+action open, submit appliesTo { principal: [User], resource: [Page] };
+action read appliesTo { principal: [User], resource: [Feature] };
+action transition appliesTo { principal: [User], resource: [Bucket], context: { from: String, to: String } };
+action self_transition appliesTo { principal: [Submitter], resource: [Bucket], context: { from: String, to: String, stored_email: String } };
+action automation_read appliesTo { principal: [Service], resource: [Bucket] };
+action invite appliesTo { principal: [User], resource: [Group] };
+"#;
+
+/// Who is asking.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum Principal {
+    /// A signed-in person, or nobody (`groups` empty, `sub` "anonymous").
+    User { sub: String, groups: Vec<String> },
+    /// Whoever holds one record's own link and knows the email on it.
+    Submitter { record: String, email: String },
+    /// A machine with a shared token.
+    Service { name: String },
+}
+
+impl Principal {
+    pub fn anonymous() -> Self {
+        Principal::User { sub: "anonymous".into(), groups: Vec::new() }
+    }
+
+    pub fn from_user(user: Option<&crate::auth::User>) -> Self {
+        match user {
+            Some(u) => Principal::User { sub: u.sub.clone(), groups: u.groups.clone() },
+            None => Principal::anonymous(),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Action {
+    Open,
+    Submit,
+    Read,
+    Transition,
+    SelfTransition,
+    AutomationRead,
+    Invite,
+}
+
+impl Action {
+    fn name(self) -> &'static str {
+        match self {
+            Action::Open => "open",
+            Action::Submit => "submit",
+            Action::Read => "read",
+            Action::Transition => "transition",
+            Action::SelfTransition => "self_transition",
+            Action::AutomationRead => "automation_read",
+            Action::Invite => "invite",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum Resource {
+    Page { id: String },
+    Bucket { name: String },
+    /// One resource block on one alternative of one page. `feature` is
+    /// the feature name, or `feature|requirement` (`|bind` appended)
+    /// for a requirement's own resource.
+    Feature { page: String, alternative: String, feature: String },
+    Group { name: String },
+}
+
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct Decision {
+    pub allow: bool,
+    /// The ids of the rules that granted it (empty on a refusal).
+    pub reasons: Vec<String>,
+}
+
+/// One row of the matrix iris prints: who may do what to what.
+#[derive(Clone, Debug, Serialize)]
+pub struct Rule {
+    pub id: String,
+    pub who: String,
+    pub action: String,
+    pub resource: String,
+    pub when: String,
+}
+
+pub struct Policy {
+    policies: PolicySet,
+    schema: Schema,
+    pub rules: Vec<Rule>,
+    pub text: String,
+    /// The dynamic pages' pattern ids, so a concrete `/shape/abc`
+    /// resolves to the policy written for `/shape/[key]`.
+    patterns: Vec<String>,
+}
+
+fn quote(s: &str) -> String {
+    format!("\"{}\"", s.replace('\\', "\\\\").replace('"', "\\\""))
+}
+
+impl Policy {
+    /// Compiles content into policy. Infallible on valid content: every
+    /// rule below is a shape the schema declares; the validation in
+    /// `validate` is what iris runs to prove that stays true.
+    pub fn from_content(
+        questions: &HashMap<String, Question>,
+        aggregates: &HashMap<String, AggregateSchema>,
+    ) -> Self {
+        let mut text = String::new();
+        let mut rules = Vec::new();
+        let mut ids: HashMap<String, usize> = HashMap::new();
+        // Each rule is parsed on its own under its own id, so a
+        // decision's reasons name rules, not `policy17`.
+        let mut sources: Vec<(String, String)> = Vec::new();
+        let mut emit = |id_base: String, who: String, action: &str, resource: String, when: String, policy: String, text: &mut String, rules: &mut Vec<Rule>| {
+            let n = ids.entry(id_base.clone()).or_insert(0);
+            *n += 1;
+            let id = if *n == 1 { id_base } else { format!("{id_base}#{n}") };
+            text.push_str(&format!("@id({})\n{policy}\n\n", quote(&id)));
+            rules.push(Rule { id: id.clone(), who, action: action.to_string(), resource, when });
+            sources.push((id, policy));
+        };
+
+        let mut pages: Vec<&Question> = questions.values().collect();
+        pages.sort_by(|a, b| a.id.cmp(&b.id));
+        for q in &pages {
+            let page = quote(&q.id);
+            let (who, principal) = match &q.qualifies {
+                None => ("anyone".to_string(), "principal".to_string()),
+                Some(g) => (format!("group {g}"), format!("principal in Group::{}", quote(g))),
+            };
+            emit(
+                format!("open:{}", q.id), who, "open, submit", format!("page {}", q.id), String::new(),
+                format!("permit({principal}, action in [Action::\"open\", Action::\"submit\"], resource == Page::{page});"),
+                &mut text, &mut rules,
+            );
+            for alt in &q.alternatives {
+                // A feature's own resource, and the resources its
+                // requirements read (select options, bound fields):
+                // each is a Feature entity of its own.
+                let mut specs: Vec<(String, &crate::content::ResourceSpec)> = Vec::new();
+                for feature in &alt.features {
+                    if let Some(spec) = &feature.resource {
+                        specs.push((format!("{}|{}|{}", q.id, alt.name, feature.name), spec));
+                    }
+                    for req in &feature.requirements {
+                        if let Some(spec) = &req.resource {
+                            specs.push((format!("{}|{}|{}|{}", q.id, alt.name, feature.name, req.name), spec));
+                        }
+                        if let Some(bind) = &req.bind {
+                            specs.push((format!("{}|{}|{}|{}|bind", q.id, alt.name, feature.name, req.name), &bind.resource));
+                        }
+                    }
+                }
+                for (fid, spec) in specs {
+                    let (who, principal) = match (&spec.requires_group, spec.public) {
+                        (Some(g), _) => (format!("group {g}"), format!("principal in Group::{}", quote(g))),
+                        (None, true) => ("anyone".to_string(), "principal".to_string()),
+                        // Neither: unreachable by design (fail closed).
+                        (None, false) => continue,
+                    };
+                    emit(
+                        format!("read:{fid}"), who.clone(), "read", format!("feature {fid}"), String::new(),
+                        format!("permit({principal}, action == Action::\"read\", resource == Feature::{});", quote(&fid)),
+                        &mut text, &mut rules,
+                    );
+                    if let (Some(bucket), Some(g)) = (spec.bucket(), &spec.requires_group) {
+                        for t in &spec.transitions {
+                            emit(
+                                format!("move:{bucket}:{}>{}", t.from, t.to), format!("group {g}"), "transition",
+                                format!("bucket {bucket}"), format!("{} -> {}", t.from, t.to),
+                                format!(
+                                    "permit(principal in Group::{}, action == Action::\"transition\", resource == Bucket::{}) when {{ context.from == {} && context.to == {} }};",
+                                    quote(g), quote(bucket), quote(&t.from), quote(&t.to)
+                                ),
+                                &mut text, &mut rules,
+                            );
+                        }
+                    }
+                }
+                if let Some(st) = &alt.self_transition {
+                    // One rule per state the move may be made from: a
+                    // person stays in dialogue with their case for as
+                    // long as it runs, and `from` says how long that is.
+                    for from in &st.from {
+                        emit(
+                            format!("self:{}:{from}>{}", st.bucket, st.to), "the submitter, by their link and email".to_string(), "self_transition",
+                            format!("bucket {}", st.bucket), format!("{from} -> {}", st.to),
+                            format!(
+                                "permit(principal is Submitter, action == Action::\"self_transition\", resource == Bucket::{}) when {{ context.from == {} && context.to == {} && principal.email == context.stored_email }};",
+                                quote(&st.bucket), quote(from), quote(&st.to)
+                            ),
+                            &mut text, &mut rules,
+                        );
+                    }
+                }
+                if let (Some(invite), Some(g)) = (&alt.invite, &q.qualifies) {
+                    emit(
+                        format!("invite:{}", invite.group), format!("group {g}"), "invite", format!("group {}", invite.group), String::new(),
+                        format!("permit(principal in Group::{}, action == Action::\"invite\", resource == Group::{});", quote(g), quote(&invite.group)),
+                        &mut text, &mut rules,
+                    );
+                }
+            }
+        }
+        // The one machine principal: the automation read endpoint, which
+        // authenticates by shared token and may read any bucket.
+        let mut buckets: Vec<&String> = aggregates.keys().collect();
+        buckets.sort();
+        emit(
+            "automation".to_string(), "service automation".to_string(), "automation_read", "any bucket".to_string(), String::new(),
+            "permit(principal == Service::\"automation\", action == Action::\"automation_read\", resource);".to_string(),
+            &mut text, &mut rules,
+        );
+        let _ = buckets;
+
+        let mut policies = PolicySet::new();
+        for (id, source) in &sources {
+            let policy = cedar_policy::Policy::parse(Some(cedar_policy::PolicyId::new(id)), source)
+                .expect("generated policy text always parses");
+            policies.add(policy).expect("rule ids are unique");
+        }
+        let schema = Schema::from_cedarschema_str(SCHEMA).map(|(s, _)| s).expect("the schema is a constant");
+        let patterns = questions.values().filter(|q| q.is_dynamic()).map(|q| q.id.clone()).collect();
+        Policy { policies, schema, rules, text, patterns }
+    }
+
+    /// Every generated rule type-checks against the schema. A rule the
+    /// schema cannot express is a compiler bug, and this is where it
+    /// shows.
+    pub fn validate(&self) -> Result<(), String> {
+        let result = Validator::new(self.schema.clone()).validate(&self.policies, ValidationMode::Strict);
+        if result.validation_passed() {
+            Ok(())
+        } else {
+            Err(result.validation_errors().map(|e| e.to_string()).collect::<Vec<_>>().join("; "))
+        }
+    }
+
+    fn page_entity(&self, id: &str) -> String {
+        if self.patterns.iter().any(|p| p == id) {
+            return id.to_string();
+        }
+        self.patterns
+            .iter()
+            .find(|p| path_matches(p, id).is_some())
+            .cloned()
+            .unwrap_or_else(|| id.to_string())
+    }
+
+    /// The decision. `context` holds what the action needs: `from`/`to`
+    /// for a transition, plus `stored_email` for a self transition.
+    pub fn decide(
+        &self,
+        principal: &Principal,
+        action: Action,
+        resource: &Resource,
+        context: serde_json::Value,
+    ) -> Decision {
+        let uid = |ty: &str, id: &str| {
+            EntityUid::from_type_name_and_id(EntityTypeName::from_str(ty).expect("static type"), EntityId::new(id))
+        };
+        let mut entities: Vec<Entity> = Vec::new();
+        let principal_uid = match principal {
+            Principal::User { sub, groups } => {
+                let parents: HashSet<EntityUid> = groups.iter().map(|g| uid("Group", g)).collect();
+                for g in &parents {
+                    entities.push(Entity::new_no_attrs(g.clone(), HashSet::new()));
+                }
+                let me = uid("User", sub);
+                entities.push(Entity::new_no_attrs(me.clone(), parents));
+                me
+            }
+            Principal::Submitter { record, email } => {
+                let me = uid("Submitter", record);
+                let attrs = HashMap::from([("email".to_string(), RestrictedExpression::new_string(email.clone()))]);
+                entities.push(Entity::new(me.clone(), attrs, HashSet::new()).expect("a string attribute always evaluates"));
+                me
+            }
+            Principal::Service { name } => {
+                let me = uid("Service", name);
+                entities.push(Entity::new_no_attrs(me.clone(), HashSet::new()));
+                me
+            }
+        };
+        let resource_uid = match resource {
+            Resource::Page { id } => uid("Page", &self.page_entity(id)),
+            Resource::Bucket { name } => uid("Bucket", name),
+            Resource::Feature { page, alternative, feature } => {
+                uid("Feature", &format!("{}|{alternative}|{feature}", self.page_entity(page)))
+            }
+            Resource::Group { name } => uid("Group", name),
+        };
+        entities.push(Entity::new_no_attrs(resource_uid.clone(), HashSet::new()));
+        let action_uid = uid("Action", action.name());
+
+        let Ok(entities) = Entities::from_entities(entities, None) else {
+            return Decision::default();
+        };
+        // An absent context is an empty one, not a malformed one.
+        let context = if context.is_object() { context } else { serde_json::json!({}) };
+        let Ok(context) = Context::from_json_value(context, None) else {
+            return Decision::default();
+        };
+        let Ok(request) = Request::new(principal_uid, action_uid, resource_uid, context, None) else {
+            return Decision::default();
+        };
+        let response = Authorizer::new().is_authorized(&request, &self.policies, &entities);
+        Decision {
+            allow: response.decision() == cedar_policy::Decision::Allow,
+            reasons: response.diagnostics().reason().map(|id| id.to_string()).collect(),
+        }
+    }
+
+    pub fn allows(&self, principal: &Principal, action: Action, resource: &Resource) -> bool {
+        self.decide(principal, action, resource, serde_json::json!({})).allow
+    }
+}
+
+/// What gets published on `portal.access.decided`: the question and
+/// the answer. Page opens and reads are published only when refused;
+/// every mutation is published either way.
+#[derive(Clone, Debug, Serialize)]
+pub struct Decided<'a> {
+    pub principal: &'a Principal,
+    pub action: Action,
+    pub resource: &'a Resource,
+    pub context: &'a serde_json::Value,
+    pub allow: bool,
+    pub reasons: &'a [String],
+    pub at_ms: i64,
+}
+
+pub const DECIDED_SUBJECT: &str = "portal.access.decided";
+
+pub fn worth_publishing(action: Action, allow: bool) -> bool {
+    !allow || !matches!(action, Action::Open | Action::Read)
+}
+
+/// Decides and, when it matters, publishes. Fire and forget: a NATS
+/// hiccup never changes an answer.
+pub fn decide_and_publish(
+    nats: &async_nats::Client,
+    policy: &Policy,
+    principal: &Principal,
+    action: Action,
+    resource: &Resource,
+    context: serde_json::Value,
+) -> Decision {
+    let decision = policy.decide(principal, action, resource, context.clone());
+    if worth_publishing(action, decision.allow) {
+        let event = Decided {
+            principal,
+            action,
+            resource,
+            context: &context,
+            allow: decision.allow,
+            reasons: &decision.reasons,
+            at_ms: chrono::Utc::now().timestamp_millis(),
+        };
+        if let Ok(bytes) = serde_json::to_vec(&event) {
+            let nats = nats.clone();
+            tokio::spawn(async move {
+                let _ = nats.publish(DECIDED_SUBJECT, bytes.into()).await;
+            });
+        }
+    }
+    decision
+}
+
+/// The request-reply face for other apps: a JSON question in, a
+/// decision out. Same policy, same answer as the site gives itself.
+#[derive(Debug, Deserialize)]
+pub struct Query {
+    pub principal: Principal,
+    pub action: Action,
+    pub resource: Resource,
+    #[serde(default)]
+    pub context: serde_json::Value,
+}
+
+pub fn subject_for(site: &str) -> String {
+    format!("portal.access.{site}.may")
+}
+
+pub fn policy_subject_for(site: &str) -> String {
+    format!("portal.access.{site}.policy")
+}
+
+/// Answers `portal.access.<site>.may` for as long as the process runs,
+/// with the policy as it is at the moment of each question (it is
+/// swapped on content reload). A malformed question gets a refusal
+/// with the parse error as its reason, never silence.
+pub async fn serve(
+    nats: async_nats::Client,
+    site: String,
+    access: std::sync::Arc<arc_swap::ArcSwap<Policy>>,
+) {
+    use futures::StreamExt;
+    let subject = subject_for(&site);
+    let mut sub = match nats.subscribe(subject.clone()).await {
+        Ok(sub) => sub,
+        Err(e) => {
+            tracing::error!(error = %e, %subject, "cannot serve access decisions");
+            return;
+        }
+    };
+    tracing::info!(%subject, "answering access questions");
+    while let Some(msg) = sub.next().await {
+        let Some(reply) = msg.reply else { continue };
+        let decision = match serde_json::from_slice::<Query>(&msg.payload) {
+            Ok(q) => decide_and_publish(&nats, &access.load(), &q.principal, q.action, &q.resource, q.context),
+            Err(e) => Decision { allow: false, reasons: vec![format!("malformed question: {e}")] },
+        };
+        let bytes = serde_json::to_vec(&decision).unwrap_or_else(|_| b"{\"allow\":false,\"reasons\":[]}".to_vec());
+        let _ = nats.publish(reply, bytes.into()).await;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::aggregates::parse_aggregates_yaml;
+    use crate::content::build_questions;
+    use serde_json::json;
+
+    fn site() -> Policy {
+        let files = vec![
+            ("index.yaml".to_string(), "name: Home\nalternatives:\n  - name: Apply\n    action: /applied\n    record_as: applicants\n  - name: Unsubscribe\n    self_transition: { bucket: subscribers, to: unsubscribed, label: Go }\n".to_string()),
+            ("applied.yaml".to_string(), "name: Applied\nfollowup: true\n".to_string()),
+            ("shape/[key].yaml".to_string(), "name: Shape\n".to_string()),
+            ("review/_section.yaml".to_string(), "qualifies: owners\n".to_string()),
+            ("review/index.yaml".to_string(), "name: Review\nalternatives:\n  - name: Applicants\n    features:\n      - name: \"\"\n        resource:\n          source: { kind: kv, bucket: applicants }\n          requires_group: owners\n          transitions:\n            - { to: invited, label: Invite }\n            - { from: invited, to: active, label: Onboard }\n      - name: Releases\n        resource:\n          public: true\n          source: { kind: gitea_releases, owner: o, repo: r }\n  - name: Invite a colleague\n    invite: { group: owners }\n    features:\n      - name: \"\"\n        requirements:\n          - { name: name }\n          - { name: email, type: email }\n".to_string()),
+        ];
+        let questions = build_questions(&files).unwrap();
+        let aggregates = parse_aggregates_yaml("aggregates:\n  - bucket: applicants\n    initial: open\n    states:\n      open: { event: a }\n      invited: { event: b }\n      active: { event: c }\n    transitions:\n      open: [invited]\n      invited: [active]\n").unwrap();
+        Policy::from_content(&questions, &aggregates)
+    }
+
+    fn user(groups: &[&str]) -> Principal {
+        Principal::User { sub: "u".into(), groups: groups.iter().map(|g| g.to_string()).collect() }
+    }
+
+    #[test]
+    fn the_generated_policy_validates_against_the_schema() {
+        let p = site();
+        assert_eq!(p.validate(), Ok(()), "{}", p.text);
+        assert!(p.rules.iter().any(|r| r.id == "move:applicants:open>invited"));
+    }
+
+    #[test]
+    fn pages_open_to_anyone_unless_qualified() {
+        let p = site();
+        let page = |id: &str| Resource::Page { id: id.into() };
+        assert!(p.allows(&Principal::anonymous(), Action::Open, &page("/")));
+        assert!(!p.allows(&Principal::anonymous(), Action::Open, &page("/review")));
+        assert!(!p.allows(&user(&["staff"]), Action::Submit, &page("/review")));
+        let d = p.decide(&user(&["owners"]), Action::Submit, &page("/review"), json!({}));
+        assert!(d.allow);
+        assert_eq!(d.reasons, vec!["open:/review"]);
+        // A concrete dynamic path resolves to its pattern's rule.
+        assert!(p.allows(&Principal::anonymous(), Action::Open, &page("/shape/abc")));
+        assert!(!p.allows(&Principal::anonymous(), Action::Open, &page("/nowhere")));
+    }
+
+    #[test]
+    fn reads_follow_requires_group_or_public() {
+        let p = site();
+        let desk = Resource::Feature { page: "/review".into(), alternative: "Applicants".into(), feature: "".into() };
+        let releases = Resource::Feature { page: "/review".into(), alternative: "Applicants".into(), feature: "Releases".into() };
+        assert!(p.allows(&user(&["owners"]), Action::Read, &desk));
+        assert!(!p.allows(&user(&["staff"]), Action::Read, &desk));
+        assert!(p.allows(&Principal::anonymous(), Action::Read, &releases));
+    }
+
+    #[test]
+    fn transitions_are_exactly_the_desks_buttons() {
+        let p = site();
+        let bucket = Resource::Bucket { name: "applicants".into() };
+        let ctx = |from: &str, to: &str| json!({ "from": from, "to": to });
+        assert!(p.decide(&user(&["owners"]), Action::Transition, &bucket, ctx("open", "invited")).allow);
+        assert!(p.decide(&user(&["owners"]), Action::Transition, &bucket, ctx("invited", "active")).allow);
+        // Right target, wrong starting state: no rule.
+        assert!(!p.decide(&user(&["owners"]), Action::Transition, &bucket, ctx("open", "active")).allow);
+        assert!(!p.decide(&user(&["staff"]), Action::Transition, &bucket, ctx("open", "invited")).allow);
+    }
+
+    #[test]
+    fn a_submitter_moves_their_own_record_only_with_the_matching_email() {
+        let p = site();
+        let bucket = Resource::Bucket { name: "subscribers".into() };
+        let me = Principal::Submitter { record: "r1".into(), email: "a@b.c".into() };
+        let ctx = |stored: &str| json!({ "from": "open", "to": "unsubscribed", "stored_email": stored });
+        assert!(p.decide(&me, Action::SelfTransition, &bucket, ctx("a@b.c")).allow);
+        assert!(!p.decide(&me, Action::SelfTransition, &bucket, ctx("x@y.z")).allow);
+        assert!(!p.decide(&me, Action::SelfTransition, &bucket, json!({ "from": "open", "to": "somewhere", "stored_email": "a@b.c" })).allow);
+        // A signed-in owner has no such rule: the link is the credential.
+        assert!(!p.decide(&user(&["owners"]), Action::SelfTransition, &bucket, ctx("a@b.c")).allow);
+    }
+
+    // The applicant written to for a missing drawing sends it from
+    // `incomplete`, and may withdraw at any point up to the signature.
+    // Before `from`, every one of those moves was compiled as if it
+    // could only be made on the day the case arrived.
+    #[test]
+    fn a_submitter_stays_in_dialogue_for_as_long_as_the_case_runs() {
+        let files = vec![(
+            "index.yaml".to_string(),
+            "name: Home\nalternatives:\n  - name: Apply\n    record_as: cases\n  - name: Send the papers\n    self_transition: { bucket: cases, to: complete, from: [open, incomplete], label: Send }\n  - name: Withdraw\n    self_transition: { bucket: cases, to: withdrawn, from: [open, incomplete, complete], label: Withdraw }\n".to_string(),
+        )];
+        let questions = build_questions(&files).unwrap();
+        let aggregates = parse_aggregates_yaml(
+            "aggregates:\n  - bucket: cases\n    initial: open\n    states:\n      open: { event: a }\n      incomplete: { event: b }\n      complete: { event: c }\n      withdrawn: { event: d }\n    transitions:\n      open: [incomplete, complete, withdrawn]\n      incomplete: [complete, withdrawn]\n      complete: [withdrawn]\n",
+        )
+        .unwrap();
+        let p = Policy::from_content(&questions, &aggregates);
+        assert_eq!(p.validate(), Ok(()), "{}", p.text);
+        let bucket = Resource::Bucket { name: "cases".into() };
+        let me = Principal::Submitter { record: "r1".into(), email: "a@b.c".into() };
+        let ctx = |from: &str, to: &str| json!({ "from": from, "to": to, "stored_email": "a@b.c" });
+        assert!(p.decide(&me, Action::SelfTransition, &bucket, ctx("incomplete", "complete")).allow);
+        assert!(p.decide(&me, Action::SelfTransition, &bucket, ctx("complete", "withdrawn")).allow);
+        // And only where it was said: the paperwork cannot be sent
+        // after the case is already withdrawn.
+        assert!(!p.decide(&me, Action::SelfTransition, &bucket, ctx("withdrawn", "complete")).allow);
+        assert!(!p.decide(&me, Action::SelfTransition, &bucket, ctx("complete", "complete")).allow);
+    }
+
+    // Omitted, `from` is the initial state alone - what every
+    // unsubscribe link written before this existed already meant.
+    #[test]
+    fn a_move_that_does_not_say_where_from_is_a_one_shot_on_arrival() {
+        let p = site();
+        assert!(p.rules.iter().any(|r| r.id == "self:subscribers:open>unsubscribed"));
+        assert_eq!(p.rules.iter().filter(|r| r.id.starts_with("self:subscribers:")).count(), 1);
+    }
+
+    #[test]
+    fn invites_and_automation() {
+        let p = site();
+        let owners = Resource::Group { name: "owners".into() };
+        assert!(p.allows(&user(&["owners"]), Action::Invite, &owners));
+        assert!(!p.allows(&user(&["staff"]), Action::Invite, &owners));
+        let bucket = Resource::Bucket { name: "applicants".into() };
+        assert!(p.allows(&Principal::Service { name: "automation".into() }, Action::AutomationRead, &bucket));
+        assert!(!p.allows(&Principal::Service { name: "someone".into() }, Action::AutomationRead, &bucket));
+        assert!(!p.allows(&user(&["owners"]), Action::AutomationRead, &bucket));
+    }
+
+    #[test]
+    fn a_question_over_nats_is_the_same_question() {
+        let p = site();
+        let q: Query = serde_json::from_str(
+            r#"{"principal":{"kind":"user","sub":"n8n-as-owner","groups":["owners"]},"action":"transition","resource":{"kind":"bucket","name":"applicants"},"context":{"from":"open","to":"invited"}}"#,
+        )
+        .unwrap();
+        assert!(p.decide(&q.principal, q.action, &q.resource, q.context).allow);
+        let q: Query = serde_json::from_str(
+            r#"{"principal":{"kind":"service","name":"automation"},"action":"automation_read","resource":{"kind":"bucket","name":"applicants"}}"#,
+        )
+        .unwrap();
+        assert!(p.decide(&q.principal, q.action, &q.resource, q.context).allow);
+        assert_eq!(subject_for("uhhm"), "portal.access.uhhm.may");
+    }
+
+    #[test]
+    fn only_refusals_and_mutations_are_worth_publishing() {
+        assert!(!worth_publishing(Action::Open, true));
+        assert!(worth_publishing(Action::Open, false));
+        assert!(worth_publishing(Action::Transition, true));
+        assert!(!worth_publishing(Action::Read, true));
+    }
+}

src/aggregates/mod.rs

@@ -36,6 +36,55 @@ pub struct AggregateSchema {
     /// rule has an explicit, auditable opt-out instead of a silent
     /// one, and so the next reader knows where the answers go.
     pub attended_by: Option<String>,
+    /// The mail a record's arrival in a state sends (see `mail.rs`):
+    /// declared on the state in aggregates.yaml, next to the event
+    /// that enters it, so content decides when a person hears
+    /// something and the mailer never has to know a site.
+    pub mail_for_state: HashMap<String, MailSpec>,
+    /// What a state grants the person whose record entered it: a group
+    /// they become a member of. A firm approved to file is a member of
+    /// the approved firms from that moment, and the decision that made
+    /// it so is the same one the desk already pressed - nobody should
+    /// have to remember to invite them afterwards.
+    pub grants_for_state: HashMap<String, String>,
+    /// The move a clock makes rather than a person. A hearing that gets
+    /// no answer in six weeks has to go on without one, and nothing in
+    /// a building is going to press that button.
+    pub after_for_state: HashMap<String, AfterSpec>,
+}
+
+/// A mail to send when a record enters a state. `to` is `submitter`
+/// (the record's `email` field, which the lint then requires the
+/// forms to collect) or one fixed address. Subject and body are
+/// templates: `{field}` for any field of the record, plus `{site}`
+/// (the instance's public URL), `{chain}` (the record id), `{email}`,
+/// `{bucket}` and `{state}`. The body is markdown; the mailer sends it
+/// as plain text with an HTML alternative.
+#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct MailSpec {
+    pub to: String,
+    pub subject: String,
+    pub body: String,
+}
+
+impl MailSpec {
+    pub fn to_submitter(&self) -> bool {
+        self.to == "submitter"
+    }
+}
+
+/// A move made by a clock: `after: { days: 42, to: no_answer }` on the
+/// state a record is waiting in. The wait is measured from when the
+/// record entered that state, and `to` must be an edge the same schema
+/// already declares - a deadline may only do what a person could have
+/// done. Days, because every deadline a public body keeps is in days
+/// and a shorter unit would invite this to be used as a job queue.
+#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct AfterSpec {
+    pub days: u32,
+    pub to: String,
 }
 
 impl AggregateSchema {
@@ -43,6 +92,18 @@ impl AggregateSchema {
         self.event_for_state.contains_key(state)
     }
 
+    pub fn mail_for(&self, state: &str) -> Option<&MailSpec> {
+        self.mail_for_state.get(state)
+    }
+
+    pub fn grants_for(&self, state: &str) -> Option<&str> {
+        self.grants_for_state.get(state).map(String::as_str)
+    }
+
+    pub fn after_for(&self, state: &str) -> Option<&AfterSpec> {
+        self.after_for_state.get(state)
+    }
+
     pub fn allowed(&self, state: &str) -> &[String] {
         self.transitions
             .get(state)
@@ -54,6 +115,12 @@ impl AggregateSchema {
 #[derive(Debug, serde::Deserialize)]
 struct RawState {
     event: String,
+    #[serde(default)]
+    mail: Option<MailSpec>,
+    #[serde(default)]
+    grants: Option<String>,
+    #[serde(default)]
+    after: Option<AfterSpec>,
 }
 
 #[derive(Debug, serde::Deserialize)]
@@ -123,6 +190,44 @@ pub fn parse_aggregates_yaml(raw: &str) -> anyhow::Result<HashMap<String, Aggreg
             }
         }
 
+        let mut mail_for_state = HashMap::new();
+        let mut grants_for_state = HashMap::new();
+        let mut after_for_state = HashMap::new();
+        for (state, raw_state) in raw_schema.states {
+            if let Some(group) = raw_state.grants {
+                if group.trim().is_empty() {
+                    anyhow::bail!("aggregates.yaml: bucket {bucket:?}: state {state:?}: grants needs a group");
+                }
+                grants_for_state.insert(state.clone(), group);
+            }
+            if let Some(after) = raw_state.after {
+                if after.days == 0 {
+                    anyhow::bail!("aggregates.yaml: bucket {bucket:?}: state {state:?}: after.days must be at least one");
+                }
+                // A clock may only make a move a person could have
+                // made, so it is held to the same graph.
+                if !raw_schema.transitions.get(&state).is_some_and(|tos| tos.contains(&after.to)) {
+                    anyhow::bail!(
+                        "aggregates.yaml: bucket {bucket:?}: state {state:?}: after.to {:?} is not a declared transition from it",
+                        after.to
+                    );
+                }
+                after_for_state.insert(state.clone(), after);
+            }
+            if let Some(mail) = raw_state.mail {
+                if mail.subject.trim().is_empty() || mail.body.trim().is_empty() {
+                    anyhow::bail!("aggregates.yaml: bucket {bucket:?}: state {state:?}: mail needs a subject and a body");
+                }
+                if !mail.to_submitter() && !(mail.to.contains('@') && !mail.to.contains(char::is_whitespace)) {
+                    anyhow::bail!(
+                        "aggregates.yaml: bucket {bucket:?}: state {state:?}: mail.to must be `submitter` or one address, not {:?}",
+                        mail.to
+                    );
+                }
+                mail_for_state.insert(state, mail);
+            }
+        }
+
         out.insert(
             bucket.clone(),
             AggregateSchema {
@@ -132,6 +237,9 @@ pub fn parse_aggregates_yaml(raw: &str) -> anyhow::Result<HashMap<String, Aggreg
                 state_for_event,
                 transitions: raw_schema.transitions,
                 attended_by: raw_schema.attended_by,
+                mail_for_state,
+                grants_for_state,
+                after_for_state,
             },
         );
     }
@@ -349,6 +457,37 @@ aggregates:
         .unwrap()
     }
 
+    #[test]
+    fn a_state_may_carry_the_mail_its_arrival_sends() {
+        let schemas = parse_aggregates_yaml(
+            r#"
+aggregates:
+  - bucket: reports
+    initial: open
+    states:
+      open: { event: received, mail: { to: submitter, subject: "Got it, {name}", body: "We read it. {site}/decide?chain={chain}" } }
+      fixed: { event: fixed, mail: { to: board@example.no, subject: "Fixed: {where}", body: "Done." } }
+      dropped: { event: dropped }
+    transitions:
+      open: [fixed, dropped]
+"#,
+        )
+        .unwrap();
+        let s = &schemas["reports"];
+        assert!(s.mail_for("open").unwrap().to_submitter());
+        assert_eq!(s.mail_for("fixed").unwrap().to, "board@example.no");
+        assert!(s.mail_for("dropped").is_none());
+
+        for bad in [
+            "mail: { to: submitter, subject: \"\", body: b }",
+            "mail: { to: \"the board\", subject: s, body: b }",
+            "mail: { to: submitter, subject: s, body: b, cc: x }",
+        ] {
+            let yaml = format!("aggregates:\n  - bucket: r\n    initial: open\n    states:\n      open: {{ event: received, {bad} }}\n");
+            assert!(parse_aggregates_yaml(&yaml).is_err(), "{bad}");
+        }
+    }
+
     fn event(seq: u64, event_type: &str) -> Event {
         Event {
             id: uuid::Uuid::new_v4(),

src/answers.rs

@@ -28,6 +28,26 @@ pub struct Answer {
     pub decided_ms: Option<i64>,
     #[serde(default)]
     pub decided_by: Option<String>,
+    /// Replies that came back by mail, oldest first (see
+    /// `mail::note_for`). A note never moves a record; it is the
+    /// conversation beside the case, which is the thing a desk could
+    /// not see before.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub notes: Vec<Note>,
+}
+
+/// One reply on a record. It lives here rather than with the mail
+/// code because it is part of what a record is: the desks render it,
+/// and the browser has to know its shape even though it will never
+/// speak to a mail server.
+#[derive(Clone, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
+pub struct Note {
+    pub id: String,
+    pub from: String,
+    #[serde(default)]
+    pub subject: String,
+    pub text: String,
+    pub received_ms: i64,
 }
 
 /// Writes a submitted answer into `bucket`, creating it on first use -
@@ -70,6 +90,7 @@ pub async fn store_answer(
         state: initial_state,
         submitted_ms,
         decided_ms: None,
+        notes: Vec::new(),
         decided_by: None,
     };
     let data = serde_json::to_vec(&answer)?;
@@ -195,14 +216,6 @@ async fn apply_transition(
         .resource
         .as_ref()
         .ok_or_else(|| ServerFnError::new("feature has no resource"))?;
-    let group = resource
-        .requires_group
-        .as_deref()
-        .ok_or_else(|| ServerFnError::new("resource has no transitions available"))?;
-    if !user.groups.iter().any(|g| g == group) {
-        return Err(ServerFnError::new("not authorized"));
-    }
-
     let bucket = resource
         .bucket()
         .ok_or_else(|| ServerFnError::new("resource is not kv-backed, has no transitions"))?;
@@ -232,6 +245,19 @@ async fn apply_transition(
             ))
         })?
         .clone();
+    // The policy holds exactly the buttons this desk offers to this
+    // group, keyed on (from, to); it is the one check.
+    let decision = crate::access::decide_and_publish(
+        &state.nats,
+        &state.access.load(),
+        &crate::access::Principal::from_user(Some(user)),
+        crate::access::Action::Transition,
+        &crate::access::Resource::Bucket { name: bucket.to_string() },
+        serde_json::json!({ "from": answer.state, "to": item.to }),
+    );
+    if !decision.allow {
+        return Err(ServerFnError::new("not authorized"));
+    }
 
     let decided_ms = chrono::Utc::now().timestamp_millis();
     let decision_payload_for_event =
@@ -263,6 +289,8 @@ async fn apply_transition(
         .put(&item.item_id, data.into())
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
+    crate::mail::on_state(state, bucket, &item.item_id, &item.to, &answer.responses).await;
+    crate::people::on_state(state, bucket, &item.item_id, &item.to, &answer.responses).await;
 
     // The decision extends the DAG as a child of the answer's own
     // submission hash, published like any other answer.
@@ -329,12 +357,27 @@ pub async fn self_transition_answer(
     let mut answer: Answer =
         serde_json::from_slice(&bytes).map_err(|e| ServerFnError::new(e.to_string()))?;
 
-    let stored_email = answer.responses.get("email").and_then(|v| v.as_str());
-    if stored_email != Some(email.as_str()) {
-        return Err(ServerFnError::new("not found"));
-    }
-    if answer.state != OPEN_STATE {
-        return Err(ServerFnError::new("already processed"));
+    // The link is the credential and the email its second factor; the
+    // policy compares them and knows the one move a submitter may make.
+    // Refusal reads "not found" so the endpoint cannot be used to probe
+    // which records or emails exist.
+    let stored_email = answer.responses.get("email").and_then(|v| v.as_str()).unwrap_or_default();
+    let decision = crate::access::decide_and_publish(
+        &state.nats,
+        &state.access.load(),
+        &crate::access::Principal::Submitter { record: item_id.clone(), email: email.clone() },
+        crate::access::Action::SelfTransition,
+        &crate::access::Resource::Bucket { name: self_transition.bucket.clone() },
+        serde_json::json!({ "from": answer.state, "to": self_transition.to, "stored_email": stored_email }),
+    );
+    if !decision.allow {
+        // Told apart by which half of the rule failed. If the record is
+        // somewhere this button may be fired from, the email was wrong,
+        // and the answer must not confirm that the record exists. If it
+        // is not, the case has moved past this move and saying so is no
+        // longer a way to learn anything about it.
+        let in_reach = self_transition.from.iter().any(|s| s == &answer.state);
+        return Err(ServerFnError::new(if in_reach { "not found" } else { "already processed" }));
     }
 
     let decided_ms = chrono::Utc::now().timestamp_millis();
@@ -364,6 +407,8 @@ pub async fn self_transition_answer(
         .put(&item_id, data.into())
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
+    crate::mail::on_state(&state, &self_transition.bucket, &item_id, &self_transition.to, &answer.responses).await;
+    crate::people::on_state(&state, &self_transition.bucket, &item_id, &self_transition.to, &answer.responses).await;
 
     let parent_hashes = vec![item_id.clone()];
     let chain_hash = hash_node(&question_id, &parent_hashes, &decision_payload_for_event, decided_ms);
@@ -403,6 +448,7 @@ mod tests {
                 submitted_ms: 1_700_000_000_000,
                 decided_ms: None,
                 decided_by: None,
+                notes: Vec::new(),
             },
             Answer {
                 id: "def456".to_string(),
@@ -413,6 +459,7 @@ mod tests {
                 submitted_ms: 1_700_000_001_000,
                 decided_ms: Some(1_700_000_002_000),
                 decided_by: Some("bl".to_string()),
+                notes: Vec::new(),
             },
         ];
         let value = serde_json::Value::Array(

src/app.rs

@@ -244,12 +244,16 @@ fn QuestionPage() -> impl IntoView {
     let site = expect_context::<Resource<Result<SiteConfig, ServerFnError>>>();
 
     view! {
+        // Nothing is written here on purpose. This fallback is the
+        // whole served page until the question resolves - no header,
+        // no wordmark - so any word in it is the first and only thing
+        // a visitor, or a crawler, reads about the site. It used to
+        // say "loading…", which is true and is not about them. The
+        // space is held so the page does not jump when the words
+        // arrive, and `aria-busy` says what is happening to anyone
+        // whose reader would otherwise find an empty document.
         <Suspense fallback=|| {
-            view! {
-                <main class="loading">
-                    <p>"loading…"</p>
-                </main>
-            }
+            view! { <main class="loading" aria-busy="true"></main> }
         }>
             {move || {
                 // Both read unconditionally (not nested inside the match
@@ -366,10 +370,26 @@ fn QuestionView(
     // (vendored, ~180KB) script runs - loaded once per page, and only
     // on pages where some alternative actually declares a deck.
     let needs_swiper = question.alternatives.iter().any(|a| a.images.len() > 1);
+    // MapLibre is vendored and large, so it loads only where a field
+    // actually asks for a place, and only where this instance can
+    // serve tiles at all.
+    // The page's place, in the form a location field opens on.
+    let place_value = question.place.as_ref().map(crate::content::Place::as_value);
+    let needs_map = site.maps
+        && question.alternatives.iter().any(|a| {
+            a.features.iter().any(|f| f.requirements.iter().any(|r| r.kind == "location"))
+        });
 
 
     view! {
         {needs_swiper.then(|| view! { <leptos_meta::Script src="/swiper-element-bundle.min.js"/> })}
+        {needs_map
+            .then(|| {
+                view! {
+                    <leptos_meta::Stylesheet href="/maplibre-gl.css" />
+                    <leptos_meta::Script src="/maplibre-gl.js" />
+                }
+            })}
         <Hero
             title=question.name.clone()
             description=question.description.clone()
@@ -377,6 +397,27 @@ fn QuestionView(
             site=site.clone()
             current_id=question_id.clone()
         />
+        // A page that is about somewhere says where, under the
+        // question: a still from this origin, and the place in words
+        // for anyone who cannot see it.
+        {question
+            .place
+            .clone()
+            .filter(|_| site.maps)
+            .map(|place| {
+                let name = place.name.clone().unwrap_or_else(|| format!("{}, {}", place.lat, place.lon));
+                view! {
+                    <figure class="question-place">
+                        <img
+                            class="map-still"
+                            src=crate::maps::still_url(place.lat, place.lon, place.zoom, 640, 280)
+                            alt=format!("Map of {name}")
+                            loading="lazy"
+                        />
+                        <figcaption>{name}</figcaption>
+                    </figure>
+                }
+            })}
         <div class="alternatives">
             <For
                 each={
@@ -407,6 +448,7 @@ fn QuestionView(
                                 alternative=alt
                                 parent_hash=parent_hash.clone()
                                 query_email=query_email.clone()
+                                place=place_value.clone().unwrap_or_default()
                             />
                         }
                         .into_any()
@@ -591,6 +633,30 @@ mod voice {
     }
 }
 
+// The `type: location` map (`map.js`, crate root): the same
+// hidden-input bridge, and a handle whose `stop()` tears the map down
+// on SPA navigation - MapLibre keeps a WebGL context and its own
+// listeners, and a page that has moved on must not keep either.
+#[cfg(feature = "hydrate")]
+mod map {
+    use wasm_bindgen::prelude::*;
+
+    #[wasm_bindgen(module = "/map.js")]
+    extern "C" {
+        pub type MapWidget;
+
+        #[wasm_bindgen(js_name = mountMap)]
+        pub fn mount_map(
+            container: &web_sys::HtmlDivElement,
+            hidden: &web_sys::HtmlInputElement,
+            initial: &str,
+        ) -> MapWidget;
+
+        #[wasm_bindgen(method)]
+        pub fn stop(this: &MapWidget);
+    }
+}
+
 #[cfg(feature = "hydrate")]
 mod gesture {
     use wasm_bindgen::prelude::*;
@@ -765,7 +831,16 @@ fn AlternativeCard(
     alternative: Alternative,
     parent_hash: Option<String>,
     query_email: Option<String>,
+    /// The page's own place as `lat,lon,zoom`, when it has one: where
+    /// a `type: location` field opens if the field does not say
+    /// otherwise. A question about a street corner should not hand the
+    /// visitor the globe. Empty means the page is about nowhere.
+    #[prop(optional)]
+    place: String,
 ) -> impl IntoView {
+    // Only the browser mounts a map, so the server build never reads it.
+    #[cfg(not(feature = "hydrate"))]
+    let _ = &place;
     // A link carrying both ?chain= and ?email= against an alternative
     // that declares a self_transition renders as a one-button
     // confirmation instead of the normal form - the visitor already
@@ -870,7 +945,7 @@ fn AlternativeCard(
                 select_multi.insert(req.name.clone(), req.multiple);
             } else {
                 // Widget-owned fields hold JSON objects, not strings.
-                if req.kind == "gesture" || req.kind == "voice" {
+                if req.kind == "gesture" || req.kind == "voice" || req.kind == "location" {
                     gesture_fields.insert(req.name.clone());
                 }
                 // A voice field's preset is the key it records at,
@@ -967,7 +1042,7 @@ fn AlternativeCard(
                 };
                 let Some(files) = input.files() else { continue };
                 let Some(file) = files.get(0) else { continue };
-                match upload_file(&file).await {
+                match upload_file(&file, &question_id_for_submit, &alt_name_for_submit).await {
                     Ok(key) => {
                         map.insert(name.clone(), serde_json::Value::String(key));
                     }
@@ -1087,6 +1162,7 @@ fn AlternativeCard(
                                             let question_id = question_id.clone();
                                             let alt_name = alt_name.clone();
                                             let feature_name = feature_name.clone();
+                                            let _place = place.clone();
                                             move |req| {
                                                 let field_id = format!("{}-{}", field_prefix, req.name);
                                                 let label_for = field_id.clone();
@@ -1245,6 +1321,60 @@ fn AlternativeCard(
                                                     .into_any();
                                                 }
 
+                                                if req.kind == "location" {
+                                                    let container_ref: NodeRef<leptos::html::Div> = NodeRef::new();
+                                                    let hidden_ref: NodeRef<leptos::html::Input> = NodeRef::new();
+
+                                                    #[cfg(feature = "hydrate")]
+                                                    {
+                                                        // `value` opens the map somewhere useful
+                                                        // ("lat,lon,zoom"); without it the map
+                                                        // opens on the world.
+                                                        let initial = req
+                                                            .value
+                                                            .clone()
+                                                            .filter(|v| !v.is_empty())
+                                                            .unwrap_or_else(|| _place.clone());
+                                                        let widget: StoredValue<Option<map::MapWidget>, LocalStorage> =
+                                                            StoredValue::new_local(None);
+                                                        Effect::new(move |_| {
+                                                            let (Some(container), Some(hidden)) =
+                                                                (container_ref.get(), hidden_ref.get())
+                                                            else {
+                                                                return;
+                                                            };
+                                                            if widget.with_value(|w| w.is_some()) {
+                                                                return;
+                                                            }
+                                                            widget.set_value(Some(map::mount_map(
+                                                                &container, &hidden, &initial,
+                                                            )));
+                                                        });
+                                                        on_cleanup(move || {
+                                                            widget.update_value(|opt| {
+                                                                if let Some(w) = opt.take() {
+                                                                    w.stop();
+                                                                }
+                                                            });
+                                                        });
+                                                    }
+
+                                                    return view! {
+                                                        <div class="field">
+                                                            {label_text}
+                                                            <input
+                                                                id=field_id
+                                                                type="hidden"
+                                                                node_ref=hidden_ref
+                                                                prop:value=move || sig.get()
+                                                                on:input=move |ev| sig.set(event_target_value(&ev))
+                                                            />
+                                                            <div class="map-wrap" node_ref=container_ref></div>
+                                                        </div>
+                                                    }
+                                                    .into_any();
+                                                }
+
                                                 if req.kind == "voice" {
                                                     let container_ref: NodeRef<leptos::html::Div> = NodeRef::new();
                                                     let hidden_ref: NodeRef<leptos::html::Input> = NodeRef::new();
@@ -1325,7 +1455,12 @@ fn AlternativeCard(
                                                     .into_any();
                                                 }
 
-                                                if req.kind == "hidden" {
+                                                // `record` carries the case this one belongs to.
+                                                // Nobody types a chain hash, so it rides in on the
+                                                // link and is carried, not asked for — the label
+                                                // row would only ask a person to confirm a string
+                                                // that means nothing to them.
+                                                if req.kind == "hidden" || req.kind == "record" {
                                                     // A carrier value only — no label row, or a
                                                     // preset key reads as a second visible field.
                                                     return view! {
@@ -1489,7 +1624,7 @@ fn ResourceFeature(
 
     view! {
         <div class="resource">
-            <Suspense fallback=|| view! { <p class="resource-loading">"loading…"</p> }>
+            <Suspense fallback=|| view! { <p class="resource-loading" aria-busy="true"></p> }>
                 {move || {
                     let feature_name = feature_name.clone();
                     let transitions = transitions.clone();
@@ -1628,9 +1763,17 @@ fn ItemCard(item: serde_json::Value) -> impl IntoView {
     let audio = text_field(&obj, &["audio"]).filter(|a| a.starts_with("https://"));
 
     let known = ["name", "title", "description", "url", "html_url", "audio"];
+    // A place renders as a still from this origin, the same as one
+    // stored on a record: the first location field wins, since a card
+    // shows one map.
+    let place = obj
+        .iter()
+        .filter(|(k, _)| !known.contains(&k.as_str()))
+        .find_map(|(_, v)| crate::maps::read(v))
+        .map(|(lat, lon, zoom)| (crate::maps::still_url(lat, lon, zoom, 480, 240), format!("{lat}, {lon}")));
     let extra: Vec<(String, String)> = obj
         .iter()
-        .filter(|(k, v)| !known.contains(&k.as_str()) && !v.is_null())
+        .filter(|(k, v)| !known.contains(&k.as_str()) && !v.is_null() && crate::maps::read(v).is_none())
         .map(|(k, v)| {
             let text = v.as_str().map(str::to_string).unwrap_or_else(|| v.to_string());
             (k.clone(), text)
@@ -1669,6 +1812,13 @@ fn ItemCard(item: serde_json::Value) -> impl IntoView {
             {description
                 .map(|d| view! { <p class="item-card-description" inner_html=render_inline_markdown(&d)></p> })}
             {audio.map(|src| view! { <audio class="item-card-audio" controls preload="none" src=src></audio> })}
+            {place
+                .map(|(src, coords)| {
+                    view! {
+                        <img class="map-still" src=src alt=format!("Map of {coords}") loading="lazy" />
+                        <span class="map-coords">{coords}</span>
+                    }
+                })}
             {(!extra.is_empty())
                 .then(|| {
                     view! {
@@ -1731,7 +1881,7 @@ fn SelectField(
 
     view! {
         <div class="select-field">
-            <Suspense fallback=|| view! { <p class="resource-loading">"loading…"</p> }>
+            <Suspense fallback=|| view! { <p class="resource-loading" aria-busy="true"></p> }>
                 {move || {
                     let id_field = id_field.clone();
                     data.get()
@@ -1835,6 +1985,7 @@ fn AnswerRow(
         .cloned()
         .unwrap_or_default();
     let submitted_ms = answer.submitted_ms;
+    let notes = answer.notes.clone();
     let state = answer.state.clone();
     let item_id = answer.id.clone();
     let key = (feature_name.clone(), item_id.clone());
@@ -1849,6 +2000,27 @@ fn AnswerRow(
                     }
                     key=|(k, _)| k.clone()
                     children=move |(key, value)| {
+                        // A stored location is a place, so it renders as
+                        // one: a still from this origin, with the
+                        // coordinates under it for anyone who wants to
+                        // put them into something else.
+                        if let Some((lat, lon, zoom)) = crate::maps::read(&value) {
+                            return view! {
+                                <div class="answer-field answer-field-map">
+                                    <span class="answer-field-key">{key}</span>
+                                    <span class="answer-field-value">
+                                        <img
+                                            class="map-still"
+                                            src=crate::maps::still_url(lat, lon, zoom, 480, 240)
+                                            alt=format!("Map of {lat}, {lon}")
+                                            loading="lazy"
+                                        />
+                                        <span class="map-coords">{format!("{lat}, {lon}")}</span>
+                                    </span>
+                                </div>
+                            }
+                                .into_any();
+                        }
                         let text = value.as_str().map(str::to_string).unwrap_or_else(|| value.to_string());
                         view! {
                             <div class="answer-field">
@@ -1864,6 +2036,29 @@ fn AnswerRow(
                 <span class="answer-state">{state}</span>
                 <span class="answer-time">{format_ms(submitted_ms)}</span>
             </div>
+            // What the person has written back since, oldest first: the
+            // conversation beside the case, which a desk could not see
+            // before. A note moves nothing, so there is no button here.
+            {(!notes.is_empty())
+                .then(|| {
+                    view! {
+                        <ol class="answer-notes">
+                            <For
+                                each=move || notes.clone()
+                                key=|note| note.id.clone()
+                                children=move |note| {
+                                    view! {
+                                        <li class="answer-note">
+                                            <span class="answer-note-who">{note.from}</span>
+                                            <span class="answer-note-time">{format_ms(note.received_ms)}</span>
+                                            <p class="answer-note-text">{note.text}</p>
+                                        </li>
+                                    }
+                                }
+                            />
+                        </ol>
+                    }
+                })}
             <Show when={
                 let available = available.clone();
                 move || !available.is_empty()
@@ -2027,24 +2222,30 @@ pub async fn get_question(
 pub async fn get_site() -> Result<SiteConfig, ServerFnError> {
     use crate::server::AppState;
     let state = expect_context::<AppState>();
-    Ok(state.site.load().as_ref().clone())
+    let mut site = state.site.load().as_ref().clone();
+    // Not content: whether this instance can serve tiles at all is its
+    // own configuration, and the browser has to know before it decides
+    // whether to draw a map or ask for two numbers.
+    site.maps = crate::maps::enabled();
+    Ok(site)
 }
 
 /// Every question the visitor may be offered from `current`, as (id,
 /// name) - the question nav's data. Front-door pages the visitor
 /// qualifies for are always in (an owner session sees the gated desks
-/// too); `followup` pages and ended events only when they are on the
-/// visitor's path - the page their verified `?chain=` answered - or
-/// further down from `current` (see `content::outcomes_reachable_from`).
-/// A chain unlocks the followup it came from, never every followup on
-/// the site; an unverifiable hash unlocks nothing.
+/// too). A `followup` page or an ended event is in only when the
+/// visitor has earned it: their verified `?chain=` answered the
+/// alternative that leads there, or it is reachable from an earned
+/// page over links that record nothing (see `content::earned_followups`).
+/// Nothing is offered that sits behind an answer they have not given;
+/// an unverifiable hash unlocks nothing.
 #[server(endpoint = "list_qualifying_questions")]
 pub async fn list_qualifying_questions(
     current: String,
     chain: Option<String>,
 ) -> Result<Vec<(String, String)>, ServerFnError> {
     use crate::auth::{User, SESSION_USER_KEY};
-    use crate::content::{is_qualified, outcomes_reachable_from, Question};
+    use crate::content::{earned_followups, unlocked_by, Question};
     use crate::server::AppState;
 
     let state = expect_context::<AppState>();
@@ -2056,26 +2257,28 @@ pub async fn list_qualifying_questions(
 
     let now_ms = chrono::Utc::now().timestamp_millis();
     let questions = state.questions.load();
-    // The one page the chain verifiably answered - the same lookup a
+    // What the chain verifiably answered - the same lookup a
     // `requires_chain` gate does, so a forged or foreign hash resolves
-    // to nothing relevant.
-    let answered: Option<String> = match &chain {
-        Some(hash) => crate::chain::lookup_node(&state.jetstream, hash)
-            .await
-            .map(|node| node.question_id),
-        None => None,
+    // to nothing - and therefore where it sent the visitor.
+    let seeds: Vec<String> = match &chain {
+        Some(hash) => match crate::chain::lookup_node(&state.jetstream, hash).await {
+            Some(node) => unlocked_by(&questions, &node.question_id, node.alternative.as_deref()),
+            None => Vec::new(),
+        },
+        None => Vec::new(),
     };
     // An ended event page is a followup from then on.
     let is_outcome = |q: &Question| q.is_followup() || q.event_ended_at(now_ms);
-    let reach = outcomes_reachable_from(&questions, &current, &is_outcome);
+    let earned = earned_followups(&questions, &current, &seeds, &is_outcome);
+    let access = state.access.load();
+    let principal = crate::access::Principal::from_user(user.as_ref());
+    let may_open = |q: &Question| {
+        access.allows(&principal, crate::access::Action::Open, &crate::access::Resource::Page { id: q.id.clone() })
+    };
     let mut out: Vec<(String, String)> = questions
         .values()
-        .filter(|q| is_qualified(user.as_ref(), q))
-        .filter(|q| {
-            !is_outcome(q)
-                || answered.as_deref() == Some(q.id.as_str())
-                || reach.contains(&q.id)
-        })
+        .filter(|q| may_open(q))
+        .filter(|q| !is_outcome(q) || earned.contains(&q.id))
         // A live event is announced in the header instead.
         .filter(|q| !q.event_live_at(now_ms))
         // A dynamic page has no URL of its own to link to.
@@ -2091,7 +2294,6 @@ pub async fn list_qualifying_questions(
 #[server(endpoint = "list_announcements")]
 pub async fn list_announcements() -> Result<Vec<Announcement>, ServerFnError> {
     use crate::auth::{User, SESSION_USER_KEY};
-    use crate::content::is_qualified;
     use crate::server::AppState;
 
     let state = expect_context::<AppState>();
@@ -2102,11 +2304,16 @@ pub async fn list_announcements() -> Result<Vec<Announcement>, ServerFnError> {
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let now_ms = chrono::Utc::now().timestamp_millis();
 
+    let access = state.access.load();
+    let principal = crate::access::Principal::from_user(user.as_ref());
     let mut live: Vec<(i64, Announcement)> = state
         .questions
         .load()
         .values()
-        .filter(|q| is_qualified(user.as_ref(), q) && q.event_live_at(now_ms))
+        .filter(|q| {
+            access.allows(&principal, crate::access::Action::Open, &crate::access::Resource::Page { id: q.id.clone() })
+                && q.event_live_at(now_ms)
+        })
         .filter_map(|q| {
             let event = q.event.as_ref()?;
             let starts = chrono::DateTime::parse_from_rfc3339(&event.starts).ok()?;
@@ -2163,7 +2370,6 @@ pub async fn submit_answer(
     use crate::answers::store_answer;
     use crate::auth::{User, SESSION_USER_KEY};
     use crate::chain::hash_node;
-    use crate::content::is_qualified;
     use crate::events::{emit_answer_submitted, AnswerSubmitted};
     use crate::server::AppState;
 
@@ -2179,7 +2385,16 @@ pub async fn submit_answer(
         .get::<User>(SESSION_USER_KEY)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
-    if !is_qualified(user.as_ref(), &question) {
+    let principal = crate::access::Principal::from_user(user.as_ref());
+    let submit = crate::access::decide_and_publish(
+        &state.nats,
+        &state.access.load(),
+        &principal,
+        crate::access::Action::Submit,
+        &crate::access::Resource::Page { id: question_id.clone() },
+        serde_json::json!({ "alternative": alternative }),
+    );
+    if !submit.allow {
         return Err(ServerFnError::new("not authorized for this question"));
     }
 
@@ -2191,10 +2406,71 @@ pub async fn submit_answer(
     if alt.disabled {
         return Err(ServerFnError::new("this alternative isn't open yet"));
     }
-    let record_as = alt.record_as.clone();
+    let mut record_as = alt.record_as.clone();
 
-    let responses: serde_json::Value = serde_json::from_str(&responses_json)
+    let mut responses: serde_json::Value = serde_json::from_str(&responses_json)
         .map_err(|e| ServerFnError::new(format!("invalid responses: {e}")))?;
+
+    // A record that belongs to another record: check the other one is
+    // there before this one is written, so a reference in a stored
+    // record is one that resolved at least once. An optional field
+    // left empty points at nothing and is nothing to check.
+    for requirement in alt.features.iter().flat_map(|f| &f.requirements) {
+        let (Some(of), true) = (&requirement.of, requirement.kind == "record") else {
+            continue;
+        };
+        let given = responses.get(&requirement.name).and_then(|v| v.as_str()).map(str::trim).unwrap_or_default();
+        if given.is_empty() {
+            if requirement.optional {
+                continue;
+            }
+            return Err(ServerFnError::new(format!("this answer is missing the {} it is about", requirement.name)));
+        }
+        let found = match state.jetstream.get_key_value(of).await {
+            Ok(store) => store.get(given).await.ok().flatten().is_some(),
+            Err(_) => false,
+        };
+        if !found {
+            return Err(ServerFnError::new(format!("the {} this is about is not on file", requirement.name)));
+        }
+    }
+
+    // An invite: the policy says whether this group may extend one,
+    // Kanidm does the onboarding, and what came back (the account, the
+    // one-time link) is recorded with the answer for the inviter's desk
+    // and announced for whatever sends the mail.
+    if let Some(invite) = &alt.invite {
+        let may = crate::access::decide_and_publish(
+            &state.nats,
+            &state.access.load(),
+            &principal,
+            crate::access::Action::Invite,
+            &crate::access::Resource::Group { name: invite.group.clone() },
+            serde_json::json!({}),
+        );
+        if !may.allow {
+            return Err(ServerFnError::new("not authorized to invite into this group"));
+        }
+        let kanidm = crate::people::Kanidm::from_env()
+            .ok_or_else(|| ServerFnError::new("invites are not configured on this instance (KANIDM_API_TOKEN)"))?;
+        let field = |name: &str| responses.get(name).and_then(|v| v.as_str()).map(str::trim).filter(|s| !s.is_empty()).map(String::from);
+        let (name, email) = match (field("name"), field("email")) {
+            (Some(n), Some(e)) => (n, e),
+            _ => return Err(ServerFnError::new("an invite needs a name and an email")),
+        };
+        let invited = kanidm
+            .invite(&name, &email, &invite.group)
+            .await
+            .map_err(|e| ServerFnError::new(format!("invite failed: {e}")))?;
+        if let Some(map) = responses.as_object_mut() {
+            map.insert("invited".to_string(), serde_json::to_value(&invited).unwrap_or_default());
+        }
+        record_as.get_or_insert_with(|| crate::people::INVITES_BUCKET.to_string());
+        if let Ok(bytes) = serde_json::to_vec(&invited) {
+            let _ = state.nats.publish(crate::people::INVITED_SUBJECT, bytes.into()).await;
+        }
+        crate::mail::on_invite(&state, &invited).await;
+    }
     // `/shape/{curve.key}`: the next page may be chosen by the answer.
     let next = match alt.action.as_deref() {
         Some(action) => Some(
@@ -2225,7 +2501,7 @@ pub async fn submit_answer(
     // Index the node so requires_chain pages can verify lineage.
     // Best-effort: the NATS event above is the durable record.
     if let Err(e) =
-        crate::chain::record_node(&state.jetstream, &chain_hash, &question_id, timestamp_ms).await
+        crate::chain::record_node(&state.jetstream, &chain_hash, &question_id, &alternative, timestamp_ms).await
     {
         tracing::error!("failed to index chain node: {e}");
     }
@@ -2247,6 +2523,12 @@ pub async fn submit_answer(
         {
             tracing::error!("failed to store answer in {bucket}: {e}");
         }
+        // Arrival is a state too: what the schema says the first
+        // state sends, it sends now.
+        if let Some(initial) = state.aggregates.load().get(bucket).map(|s| s.initial.clone()) {
+            crate::mail::on_state(&state, bucket, &chain_hash, &initial, &responses).await;
+            crate::people::on_state(&state, bucket, &chain_hash, &initial, &responses).await;
+        }
     }
 
     Ok(SubmitResult { next, chain_hash })
@@ -2259,12 +2541,21 @@ pub async fn submit_answer(
 /// server side is a raw Axum multipart handler (`src/upload.rs`) for
 /// the same reason.
 #[cfg(feature = "hydrate")]
-async fn upload_file(file: &web_sys::File) -> Result<String, wasm_bindgen::JsValue> {
+async fn upload_file(
+    file: &web_sys::File,
+    question_id: &str,
+    alternative: &str,
+) -> Result<String, wasm_bindgen::JsValue> {
     use wasm_bindgen::{JsCast, JsValue};
     use wasm_bindgen_futures::JsFuture;
     use web_sys::{FormData, Request, RequestInit, Response};
 
     let form = FormData::new()?;
+    // Which page and which choice this file is being attached to. The
+    // server refuses an upload that does not name a page it may
+    // submit, so these travel with every file.
+    form.append_with_str("question", question_id)?;
+    form.append_with_str("alternative", alternative)?;
     form.append_with_blob("file", file)?;
 
     let opts = RequestInit::new();

src/bin/question_lint.rs

@@ -1,158 +0,0 @@
-//! Headless schema-check binary - loads content and `aggregates.yaml`
-//! (from a Gitea repo URL or a local directory) and validates them
-//! exactly the way `content::watch_for_reload`/`main.rs`'s boot path
-//! do, with no NATS, OIDC, web server, or JetStream connection
-//! involved. Built once by portal's own deploy workflow and run
-//! directly by `questions`' own CI (same bare-metal runner/host,
-//! published to a stable path - no artifact download needed), rather
-//! than compiled there - keeps that repo's CI coupling to "run a
-//! static binary," not "build a Rust workspace."
-#![cfg(feature = "ssr")]
-
-use portal::{aggregates, content};
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let mut args = std::env::args().skip(1);
-    let mut repo: Option<String> = None;
-    let mut branch = "main".to_string();
-    let mut subdir = "questions".to_string();
-    let mut path: Option<String> = None;
-
-    while let Some(arg) = args.next() {
-        match arg.as_str() {
-            "--repo" => repo = args.next(),
-            "--branch" => branch = args.next().unwrap_or(branch),
-            "--subdir" => subdir = args.next().unwrap_or(subdir),
-            "--path" => path = args.next(),
-            other => {
-                eprintln!("unknown argument: {other}");
-                std::process::exit(2);
-            }
-        }
-    }
-
-    let (questions, aggregates_map, site) = if let Some(dir) = path {
-        (load_from_dir(&dir)?, load_aggregates_from_dir(&dir)?, load_site_from_dir(&dir)?)
-    } else if let Some(repo_url) = repo {
-        let questions = content::load_questions_from_gitea(&repo_url, &branch, &subdir).await?;
-        let aggregates_map = content::load_aggregates_from_gitea(&repo_url, &branch).await?;
-        // load_site_from_gitea already validates; a missing file is
-        // the default config, same as at portal boot.
-        let site = content::load_site_from_gitea(&repo_url, &branch).await?;
-        (questions, aggregates_map, site)
-    } else {
-        eprintln!(
-            "usage: question-lint --repo <gitea-url> [--branch main] [--subdir questions] | --path <local-dir>"
-        );
-        std::process::exit(2);
-    };
-
-    if let Err(e) = site.validate() {
-        eprintln!("FAIL: {e}");
-        std::process::exit(1);
-    }
-    let aggregates_map = content::with_builtin_aggregates(aggregates_map);
-    match content::validate_questions(&questions, &aggregates_map) {
-        Ok(()) => {
-            // The runtime's own event desk: a repo announcing pages
-            // (Question.event) should read portal_events somewhere, or
-            // "post what happened" tasks pile up unseen. Warn, don't
-            // fail - the runtime creates the records either way.
-            if questions.values().any(|q| q.event.is_some())
-                && !content::bucket_is_read(&questions, content::EVENTS_BUCKET)
-            {
-                eprintln!(
-                    "WARN: pages carry `event:` but no kv resource reads bucket {:?} - add a desk so summaries get posted",
-                    content::EVENTS_BUCKET
-                );
-            }
-            println!(
-                "OK: {} question(s), {} aggregate(s) valid",
-                questions.len(),
-                aggregates_map.len()
-            );
-            Ok(())
-        }
-        Err(e) => {
-            eprintln!("FAIL: {e}");
-            std::process::exit(1);
-        }
-    }
-}
-
-/// The offline counterpart to `content::load_site_from_gitea` -
-/// `site.yaml` lives at the repo root like `aggregates.yaml`, and is
-/// just as optional locally: missing means default branding.
-fn load_site_from_dir(dir: &str) -> anyhow::Result<content::SiteConfig> {
-    let site_path = std::path::Path::new(dir)
-        .parent()
-        .unwrap_or_else(|| std::path::Path::new("."))
-        .join("site.yaml");
-    if !site_path.exists() {
-        return Ok(content::SiteConfig::default());
-    }
-    let raw = std::fs::read_to_string(&site_path)
-        .map_err(|e| anyhow::anyhow!("reading {}: {e}", site_path.display()))?;
-    serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing {}: {e}", site_path.display()))
-}
-
-/// The offline counterpart to `content::load_aggregates_from_gitea` -
-/// `aggregates.yaml` lives at the repo root, one level up from the
-/// pages directory `--path` names, so `dir`'s parent is where it's
-/// looked for. Missing entirely is not an error here (unlike
-/// `--repo` mode, where `aggregates.yaml` is required) - a local
-/// checkout being linted may not have one, and every declared
-/// transition still gets checked against whatever *is* found; an
-/// empty map just means nothing is checked.
-fn load_aggregates_from_dir(
-    dir: &str,
-) -> anyhow::Result<std::collections::HashMap<String, aggregates::AggregateSchema>> {
-    let aggregates_path = std::path::Path::new(dir)
-        .parent()
-        .unwrap_or_else(|| std::path::Path::new("."))
-        .join("aggregates.yaml");
-    if !aggregates_path.exists() {
-        return Ok(std::collections::HashMap::new());
-    }
-    let raw = std::fs::read_to_string(&aggregates_path)
-        .map_err(|e| anyhow::anyhow!("reading {}: {e}", aggregates_path.display()))?;
-    aggregates::parse_aggregates_yaml(&raw)
-}
-
-/// The offline counterpart to `content::load_questions_from_gitea` -
-/// the same recursive tree walk and `content::build_questions`
-/// pipeline (derived ids, relative refs, sections, followup
-/// inference), just reading a local checkout instead of Gitea's API,
-/// for linting a branch that hasn't been pushed yet.
-fn load_from_dir(
-    dir: &str,
-) -> anyhow::Result<std::collections::HashMap<String, content::Question>> {
-    let base = std::path::Path::new(dir);
-    let mut files = Vec::new();
-    collect_yaml(base, base, &mut files)?;
-    content::build_questions(&files)
-}
-
-fn collect_yaml(
-    base: &std::path::Path,
-    dir: &std::path::Path,
-    out: &mut Vec<(String, String)>,
-) -> anyhow::Result<()> {
-    for entry in std::fs::read_dir(dir)? {
-        let path = entry?.path();
-        if path.is_dir() {
-            collect_yaml(base, &path, out)?;
-        } else if path.extension().and_then(|e| e.to_str()) == Some("yaml") {
-            let rel = path
-                .strip_prefix(base)
-                .expect("walked paths sit under their base")
-                .to_string_lossy()
-                .replace('\\', "/");
-            let raw = std::fs::read_to_string(&path)
-                .map_err(|e| anyhow::anyhow!("reading {}: {e}", path.display()))?;
-            out.push((rel, raw));
-        }
-    }
-    Ok(())
-}

src/chain.rs

@@ -20,6 +20,11 @@ pub const CHAIN_BUCKET: &str = "portal_chains";
 #[derive(serde::Serialize, serde::Deserialize)]
 pub struct ChainNode {
     pub question_id: String,
+    /// Which alternative was answered - what decides where the visitor
+    /// was sent next, and so which followup the chain has earned. Nodes
+    /// indexed before this field existed carry `None`.
+    #[serde(default)]
+    pub alternative: Option<String>,
     pub timestamp_ms: i64,
 }
 
@@ -30,6 +35,7 @@ pub async fn record_node(
     js: &async_nats::jetstream::Context,
     chain_hash: &str,
     question_id: &str,
+    alternative: &str,
     timestamp_ms: i64,
 ) -> anyhow::Result<()> {
     let store = match js.get_key_value(CHAIN_BUCKET).await {
@@ -44,6 +50,7 @@ pub async fn record_node(
     };
     let node = ChainNode {
         question_id: question_id.to_string(),
+        alternative: Some(alternative.to_string()),
         timestamp_ms,
     };
     store.put(chain_hash, serde_json::to_vec(&node)?.into()).await?;

src/content/gitea.rs

@@ -0,0 +1,243 @@
+//! Loading a content repo from Gitea, and the NATS-signalled reload
+//! that hot-swaps it (last-good content is kept on any failure). Every
+//! fetch goes through `crate::http`: bounded in time and size.
+
+use super::*;
+
+/// Fetches and parses `site.yaml` from the content repo root. A fetch
+/// failure (typically 404 - the file is optional) yields the default
+/// config; a file that exists but doesn't parse or validate is a real
+/// error, surfaced at boot rather than papered over.
+#[cfg(feature = "ssr")]
+pub async fn load_site_from_gitea(repo_url: &str, branch: &str) -> anyhow::Result<SiteConfig> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+    let raw = match fetch_gitea_file(&api_base, &owner, &repo, branch, "site.yaml").await {
+        Ok(raw) => raw,
+        Err(e) => {
+            tracing::info!("no site.yaml in content repo ({e}), using default branding");
+            return Ok(SiteConfig::default());
+        }
+    };
+    let site: SiteConfig =
+        serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing site.yaml: {e}"))?;
+    site.validate()?;
+    Ok(site)
+}
+
+/// Extracts `scheme://host` from a repo's normal browser URL - the
+/// Gitea API base every helper in this module builds requests against.
+#[cfg(feature = "ssr")]
+/// `{gitea}/api/v1/repos/{owner}/{repo}/raw` - the base
+/// `site_asset_handler` proxies content-shipped files from.
+#[cfg(feature = "ssr")]
+pub fn gitea_raw_base(repo_url: &str) -> anyhow::Result<String> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    Ok(format!("{}/api/v1/repos/{owner}/{repo}/raw", gitea_api_base(repo_url)?))
+}
+
+#[cfg(feature = "ssr")]
+pub fn gitea_api_base(repo_url: &str) -> anyhow::Result<String> {
+    let parsed = url::Url::parse(repo_url)
+        .map_err(|e| anyhow::anyhow!("parsing repo url {repo_url}: {e}"))?;
+    Ok(format!(
+        "{}://{}",
+        parsed.scheme(),
+        parsed
+            .host_str()
+            .ok_or_else(|| anyhow::anyhow!("no host in repo url {repo_url}"))?
+    ))
+}
+
+/// Splits a repo's normal browser URL into `(owner, repo)` - shared by
+/// every loader in this module that needs to build a Gitea contents API
+/// URL (`load_questions_from_gitea`, `load_aggregates_from_gitea`).
+#[cfg(feature = "ssr")]
+pub(crate) fn parse_owner_repo(repo_url: &str) -> anyhow::Result<(String, String)> {
+    let parsed = url::Url::parse(repo_url)
+        .map_err(|e| anyhow::anyhow!("parsing content repo url {repo_url}: {e}"))?;
+    let mut segments = parsed
+        .path_segments()
+        .ok_or_else(|| anyhow::anyhow!("no path in content repo url {repo_url}"))?;
+    let owner = segments
+        .next()
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("missing owner in content repo url {repo_url}"))?
+        .to_string();
+    let repo = segments
+        .next()
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("missing repo name in content repo url {repo_url}"))?
+        .to_string();
+    Ok((owner, repo))
+}
+
+/// Fetches one file from a Gitea repo's contents API and returns its raw
+/// text - the single-file counterpart to `load_questions_from_gitea`'s
+/// directory-listing loop, used by `load_aggregates_from_gitea` for the
+/// one `aggregates.yaml` file at the repo root.
+#[cfg(feature = "ssr")]
+pub(crate) async fn fetch_gitea_file(
+    api_base: &str,
+    owner: &str,
+    repo: &str,
+    branch: &str,
+    path: &str,
+) -> anyhow::Result<String> {
+    let meta_url = format!("{api_base}/api/v1/repos/{owner}/{repo}/contents/{path}?ref={branch}");
+    let meta_text = crate::http::get_text(&meta_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| anyhow::anyhow!("fetching {meta_url}: {e}"))?;
+    let meta: serde_json::Value = serde_json::from_str(&meta_text)
+        .map_err(|e| anyhow::anyhow!("parsing contents response from {meta_url}: {e}"))?;
+    let download_url = meta
+        .get("download_url")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow::anyhow!("no download_url for {path}"))?;
+    crate::http::get_text(download_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| anyhow::anyhow!("fetching {path}: {e}"))
+}
+
+/// Fetches and parses `aggregates.yaml` from the repo root (sibling to
+/// the pages `subdir`, so the "every yaml under subdir is a page"
+/// convention needs no exclusion). A malformed file fails here, before
+/// ever reaching `AppState`.
+#[cfg(feature = "ssr")]
+pub async fn load_aggregates_from_gitea(
+    repo_url: &str,
+    branch: &str,
+) -> anyhow::Result<std::collections::HashMap<String, crate::aggregates::AggregateSchema>> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+    let raw = fetch_gitea_file(&api_base, &owner, &repo, branch, "aggregates.yaml").await?;
+    crate::aggregates::parse_aggregates_yaml(&raw)
+}
+
+#[cfg(feature = "ssr")]
+pub async fn load_questions_from_gitea(
+    repo_url: &str,
+    branch: &str,
+    subdir: &str,
+) -> anyhow::Result<std::collections::HashMap<String, Question>> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+
+    // One recursive git-trees call for the whole repo instead of a
+    // contents listing per directory - the tree IS the router now, so
+    // nested files matter.
+    let tree_url =
+        format!("{api_base}/api/v1/repos/{owner}/{repo}/git/trees/{branch}?recursive=true");
+    let listing = crate::http::get_text(&tree_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| anyhow::anyhow!("listing {tree_url}: {e}"))?;
+    let tree: serde_json::Value = serde_json::from_str(&listing)
+        .map_err(|e| anyhow::anyhow!("parsing tree from {tree_url}: {e}"))?;
+    if tree.get("truncated").and_then(|v| v.as_bool()) == Some(true) {
+        anyhow::bail!("git tree listing for {owner}/{repo} was truncated - repo too large");
+    }
+    let prefix = format!("{subdir}/");
+
+    let mut files = Vec::new();
+    for entry in tree
+        .get("tree")
+        .and_then(|v| v.as_array())
+        .map(|v| v.as_slice())
+        .unwrap_or_default()
+    {
+        let path = entry.get("path").and_then(|v| v.as_str()).unwrap_or("");
+        if entry.get("type").and_then(|v| v.as_str()) != Some("blob")
+            || !path.starts_with(&prefix)
+            || !path.ends_with(".yaml")
+        {
+            continue;
+        }
+        // Brackets (dynamic pages like `[record].yaml`) must be
+        // percent-encoded in the raw URL's path.
+        let encoded = path.replace('[', "%5B").replace(']', "%5D");
+        let raw_url = format!("{api_base}/api/v1/repos/{owner}/{repo}/raw/{encoded}?ref={branch}");
+        let raw = crate::http::get_text(&raw_url, crate::http::GITEA_CAP)
+            .await
+            .map_err(|e| anyhow::anyhow!("fetching {path}: {e}"))?;
+        files.push((path[prefix.len()..].to_string(), raw));
+    }
+    build_questions(&files)
+}
+
+/// Published by the content repo's own CI (after it lints a push) to
+/// tell every running instance to pick up the change - a plain fire
+/// and forget NATS publish, no payload, matching `events.rs`'s
+/// `ANSWERS_SUBJECT` pattern.
+#[cfg(feature = "ssr")]
+pub const CONTENT_RELOAD_SUBJECT: &str = "portal.content.reload";
+
+/// Runs for the life of the process: re-fetches `repo_url`/`branch` and
+/// atomically swaps both `questions` and `aggregates` on every
+/// `CONTENT_RELOAD_SUBJECT` message - the two only ever swap together,
+/// after both have loaded and validated successfully, so a reader never
+/// sees pages that reference a half-updated state graph. A fetch/parse
+/// failure logs and keeps serving the last-good content rather than
+/// clearing it - a bad push to the content repo (which should already
+/// have been caught by its own lint step) doesn't take the site down.
+#[cfg(feature = "ssr")]
+pub async fn watch_for_reload(
+    nats: async_nats::Client,
+    repo_url: String,
+    branch: String,
+    subdir: String,
+    questions: std::sync::Arc<arc_swap::ArcSwap<std::collections::HashMap<String, Question>>>,
+    aggregates: std::sync::Arc<
+        arc_swap::ArcSwap<std::collections::HashMap<String, crate::aggregates::AggregateSchema>>,
+    >,
+    site: std::sync::Arc<arc_swap::ArcSwap<SiteConfig>>,
+    access: std::sync::Arc<arc_swap::ArcSwap<crate::access::Policy>>,
+) {
+    let mut sub = match nats.subscribe(CONTENT_RELOAD_SUBJECT).await {
+        Ok(sub) => sub,
+        Err(e) => {
+            tracing::error!(error = %e, "failed to subscribe to content reload subject");
+            return;
+        }
+    };
+    use futures::StreamExt;
+    while sub.next().await.is_some() {
+        let loaded_aggregates = match load_aggregates_from_gitea(&repo_url, &branch).await {
+            Ok(loaded) => with_builtin_aggregates(loaded),
+            Err(e) => {
+                tracing::error!(error = %e, "aggregates.yaml reload failed, keeping last-good content");
+                continue;
+            }
+        };
+        // Branding swaps with the same all-or-nothing rule: a
+        // present-but-broken site.yaml keeps last-good everything
+        // (load_site distinguishes "absent" - a normal default - from
+        // "present but invalid").
+        let loaded_site = match load_site_from_gitea(&repo_url, &branch).await {
+            Ok(loaded) => loaded,
+            Err(e) => {
+                tracing::error!(error = %e, "site.yaml reload failed, keeping last-good content");
+                continue;
+            }
+        };
+        match load_questions_from_gitea(&repo_url, &branch, &subdir).await {
+            Ok(loaded) => {
+                if let Err(e) = validate_questions(&loaded, &loaded_aggregates) {
+                    tracing::error!(error = %e, "content reload failed validation, keeping last-good content");
+                    continue;
+                }
+                let count = loaded.len();
+                // The policy is compiled from the content it gates, so
+                // it swaps in the same breath.
+                access.store(std::sync::Arc::new(crate::access::Policy::from_content(&loaded, &loaded_aggregates)));
+                questions.store(std::sync::Arc::new(loaded));
+                aggregates.store(std::sync::Arc::new(loaded_aggregates));
+                site.store(std::sync::Arc::new(loaded_site));
+                tracing::info!(count, "reloaded content");
+            }
+            Err(e) => {
+                tracing::error!(error = %e, "content reload failed, keeping last-good content");
+            }
+        }
+    }
+}
+

src/content/handlers.rs

@@ -0,0 +1,206 @@
+//! The Axum routes that expose content and buckets outside the Leptos
+//! app: content-shipped assets proxied same-origin, repo info for the
+//! showcase, and the automation read API over KV buckets.
+
+use super::*;
+
+/// A repo-relative asset path portal is willing to proxy from the
+/// content repo: plain segments only - no traversal, no leading slash,
+/// no scheme - so `/site/<path>` can only ever reach the content repo.
+pub fn is_safe_site_path(path: &str) -> bool {
+    !path.is_empty()
+        && !path.starts_with('/')
+        && path.split('/').all(|seg| {
+            !seg.is_empty()
+                && seg != ".."
+                && seg
+                    .chars()
+                    .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
+        })
+}
+
+/// A public Gitea repo's basic info - what `resolve_gitea_repo` returns
+/// for the prosekit editor's repo-embed node to render as a static
+/// card, baked in once at embed time rather than re-fetched by every
+/// reader (an emailed newsletter can't run JS to do that anyway).
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct GiteaRepoInfo {
+    pub owner: String,
+    pub repo: String,
+    pub description: String,
+    pub url: String,
+}
+
+#[derive(Deserialize)]
+#[cfg(feature = "ssr")]
+pub struct GiteaRepoQuery {
+    pub owner: String,
+    pub repo: String,
+}
+
+/// `GET /site/{*path}` - serves a file from the content repo's default
+/// branch same-origin, so content-shipped assets (the hero module,
+/// its stylesheet) are importable by the page: Gitea's raw endpoint
+/// sends no CORS headers, and an ES module import across origins is
+/// refused without them. Path is validated to plain segments
+/// (`is_safe_site_path`), the response revalidates like /pkg
+/// (Cache-Control: no-cache) so a content push shows up on reload.
+#[cfg(feature = "ssr")]
+pub async fn site_asset_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Path(path): axum::extract::Path<String>,
+) -> axum::response::Response {
+    use axum::http::{header, StatusCode};
+    use axum::response::IntoResponse;
+
+    if !is_safe_site_path(&path) {
+        return (StatusCode::BAD_REQUEST, "invalid asset path").into_response();
+    }
+    let url = format!("{}/{path}?ref={}", state.content_raw_base, state.content_branch);
+    let resp = match crate::http::client().get(&url).send().await.and_then(|r| r.error_for_status()) {
+        Ok(r) => r,
+        Err(e) => {
+            tracing::warn!("site asset {path}: {e}");
+            return (StatusCode::NOT_FOUND, "no such site asset").into_response();
+        }
+    };
+    let bytes = match crate::http::bytes(resp, crate::http::ASSET_CAP).await {
+        Ok(b) => axum::body::Bytes::from(b),
+        Err(e) => return (StatusCode::BAD_GATEWAY, e.to_string()).into_response(),
+    };
+    let mime = match path.rsplit('.').next() {
+        Some("js") | Some("mjs") => "text/javascript; charset=utf-8",
+        Some("css") => "text/css; charset=utf-8",
+        Some("svg") => "image/svg+xml",
+        Some("json") => "application/json",
+        Some("png") => "image/png",
+        Some("webp") => "image/webp",
+        Some("avif") => "image/avif",
+        Some("ico") => "image/x-icon",
+        Some("woff2") => "font/woff2",
+        _ => "application/octet-stream",
+    };
+    (
+        [(header::CONTENT_TYPE, mime), (header::CACHE_CONTROL, "no-cache")],
+        bytes,
+    )
+        .into_response()
+}
+
+/// Looks up `owner/repo` on the same Gitea instance content is loaded
+/// from (`AppState.gitea_base`) - a raw Axum handler (mounted at
+/// `/gitea-repo` in `main.rs`), not a Leptos server fn, since the
+/// caller here is the prosekit editor's own paste-to-embed rule (see
+/// `prosekit-editor.js`) doing a plain `fetch`, the same reason
+/// `/upload` (`src/upload.rs`) is a raw handler rather than a `#[server]`
+/// fn. Keeping this server-resolved (rather than having the browser
+/// call Gitea's API directly) is consistent with every other backing
+/// store in this app, and sidesteps needing a CORS allowance on Gitea's
+/// side just for this. No auth, same as content loading - resolves
+/// only what's already public.
+#[cfg(feature = "ssr")]
+pub async fn gitea_repo_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Query(query): axum::extract::Query<GiteaRepoQuery>,
+) -> Result<axum::Json<GiteaRepoInfo>, (axum::http::StatusCode, String)> {
+    let is_safe_segment = |s: &str| {
+        !s.is_empty()
+            && s.chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
+    };
+    if !is_safe_segment(&query.owner) || !is_safe_segment(&query.repo) {
+        return Err((axum::http::StatusCode::BAD_REQUEST, "invalid owner/repo".to_string()));
+    }
+    let GiteaRepoQuery { owner, repo } = query;
+
+    let api_url = format!("{}/api/v1/repos/{owner}/{repo}", state.gitea_base);
+    let body = crate::http::get_text(&api_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, format!("fetching {api_url}: {e}")))?;
+    let json: serde_json::Value = serde_json::from_str(&body).map_err(|e| {
+        (
+            axum::http::StatusCode::BAD_GATEWAY,
+            format!("parsing repo info from {api_url}: {e}"),
+        )
+    })?;
+
+    Ok(axum::Json(GiteaRepoInfo {
+        owner: owner.clone(),
+        repo: repo.clone(),
+        description: json
+            .get("description")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .to_string(),
+        url: json
+            .get("html_url")
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string())
+            .unwrap_or_else(|| format!("{}/{owner}/{repo}", state.gitea_base)),
+    }))
+}
+
+/// Lists every entry in a NATS KV bucket as JSON - a raw Axum handler
+/// (mounted at `/automation/kv/{bucket}` in `main.rs`), for backing
+/// automations (e.g. an n8n workflow reading `portal_subscribers` to
+/// send a newsletter) that aren't a signed-in browser session and so
+/// can't go through `resource::get_resource`'s Kanidm-group check.
+/// Gated by a single shared bearer token (`AUTOMATION_READ_TOKEN`) -
+/// deliberately not per-caller/per-bucket scoped, since every current
+/// caller is a trusted internal automation, not a third party. Read
+/// only, matching `get_resource`'s own "reads can be public/shared,
+/// mutations always need real identity" split - nothing here writes.
+#[cfg(feature = "ssr")]
+pub async fn automation_kv_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Path(bucket): axum::extract::Path<String>,
+    headers: axum::http::HeaderMap,
+) -> Result<axum::Json<serde_json::Value>, (axum::http::StatusCode, String)> {
+    let expected = std::env::var("AUTOMATION_READ_TOKEN").unwrap_or_default();
+    let presented = headers
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .unwrap_or("");
+    if expected.is_empty() || presented != expected {
+        return Err((axum::http::StatusCode::UNAUTHORIZED, "unauthorized".to_string()));
+    }
+    // The token authenticates the automation service; what it may read
+    // is the policy's to say, like every other principal.
+    let decision = crate::access::decide_and_publish(
+        &state.nats,
+        &state.access.load(),
+        &crate::access::Principal::Service { name: "automation".to_string() },
+        crate::access::Action::AutomationRead,
+        &crate::access::Resource::Bucket { name: bucket.clone() },
+        serde_json::json!({}),
+    );
+    if !decision.allow {
+        return Err((axum::http::StatusCode::FORBIDDEN, "not authorized".to_string()));
+    }
+
+    let store = state
+        .jetstream
+        .get_key_value(&bucket)
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, format!("bucket unavailable: {e}")))?;
+
+    use futures::TryStreamExt;
+    let keys: Vec<String> = store
+        .keys()
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, e.to_string()))?
+        .try_collect()
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, e.to_string()))?;
+    let mut items = Vec::new();
+    for key in keys {
+        if let Ok(Some(bytes)) = store.get(&key).await {
+            if let Ok(value) = serde_json::from_slice::<serde_json::Value>(&bytes) {
+                items.push(value);
+            }
+        }
+    }
+    Ok(axum::Json(serde_json::Value::Array(items)))
+}
+

src/content/markdown.rs

@@ -0,0 +1,120 @@
+//! Inline markdown for descriptions: links on a short allow-list of
+//! schemes, images gated and framed, with layout hints read from the
+//! image title. Never raw HTML.
+
+/// Descriptions are inline markdown: `[text](https://…)` links,
+/// `*emphasis*`, `**strong**`, `` `code` ``. Block structure is
+/// flattened (a description is one paragraph) and raw HTML in the
+/// source is dropped, so content can link out without being able to
+/// inject markup. Link targets are limited to https, mailto and
+/// site-relative paths; anything else renders as plain text.
+pub fn render_inline_markdown(text: &str) -> String {
+    use pulldown_cmark::{html, Event, Options, Parser, Tag, TagEnd};
+    let parser = Parser::new_ext(text, Options::empty());
+    let mut in_link = 0usize;
+    let mut in_dropped_image = 0usize;
+    let filtered = parser.filter_map(|event| match event {
+        Event::Html(_) | Event::InlineHtml(_) => None,
+        Event::Start(Tag::Paragraph) | Event::End(TagEnd::Paragraph) => None,
+        Event::SoftBreak => Some(Event::Text(" ".into())),
+        Event::Start(Tag::Link { dest_url, .. })
+            if !(dest_url.starts_with("https://")
+                || dest_url.starts_with("mailto:")
+                || dest_url.starts_with("tel:")
+                || dest_url.starts_with('/')) =>
+        {
+            in_link += 1;
+            None
+        }
+        Event::End(TagEnd::Link) if in_link > 0 => {
+            in_link -= 1;
+            None
+        }
+        // Images take the same gate as links: https or same-origin
+        // only - no data:, no plain http. Unlike a dropped link (whose
+        // label is real text worth keeping), a dropped image's alt
+        // text is a caption for something that isn't there - swallow it.
+        Event::Start(Tag::Image { dest_url, .. })
+            if !(dest_url.starts_with("https://") || dest_url.starts_with('/')) =>
+        {
+            in_dropped_image += 1;
+            None
+        }
+        Event::End(TagEnd::Image) if in_dropped_image > 0 => {
+            in_dropped_image -= 1;
+            None
+        }
+        Event::Text(_) if in_dropped_image > 0 => None,
+        other => Some(other),
+    });
+    let mut out = String::new();
+    html::push_html(&mut out, filtered);
+    apply_image_hints(out.trim())
+}
+
+/// Translate a markdown image's title (`![alt](url "right 9rem")`)
+/// into layout: `left`/`right` float via a class, a bare number
+/// (optionally with `rem`) into a validated `max-width`. Unknown
+/// tokens are ignored; the title attribute is dropped either way.
+/// Only touches `<img>` tags in our own render output, and only ever
+/// emits a numeric max-width - no arbitrary CSS reaches the page.
+pub(crate) fn apply_image_hints(html: &str) -> String {
+    let mut out = String::new();
+    let mut rest = html;
+    while let Some(pos) = rest.find("<img ") {
+        out.push_str(&rest[..pos]);
+        let after = &rest[pos..];
+        let end = after.find('>').map(|e| e + 1).unwrap_or(after.len());
+        out.push_str(&rewrite_img_tag(&after[..end]));
+        rest = &after[end..];
+    }
+    out.push_str(rest);
+    out
+}
+
+pub(crate) fn rewrite_img_tag(tag: &str) -> String {
+    // Pull the title value, if any.
+    let title = tag
+        .find("title=\"")
+        .map(|i| &tag[i + 7..])
+        .and_then(|r| r.find('"').map(|e| &r[..e]))
+        .unwrap_or("");
+
+    let mut class = String::new();
+    let mut max_rem: Option<f32> = None;
+    for tok in title.split_whitespace() {
+        match tok {
+            "left" => class = "md-float-left".into(),
+            "right" => class = "md-float-right".into(),
+            other => {
+                if let Ok(n) = other.trim_end_matches("rem").parse::<f32>() {
+                    if n > 0.0 && n <= 60.0 {
+                        max_rem = Some(n);
+                    }
+                }
+            }
+        }
+    }
+
+    // Strip the title attribute from the tag.
+    let mut cleaned = tag.to_string();
+    if let Some(i) = cleaned.find(" title=\"") {
+        if let Some(e) = cleaned[i + 8..].find('"') {
+            cleaned.replace_range(i..i + 8 + e + 1, "");
+        }
+    }
+
+    // Inject class/style right after `<img`.
+    let mut attrs = String::new();
+    if !class.is_empty() {
+        attrs.push_str(&format!(" class=\"{class}\""));
+    }
+    if let Some(n) = max_rem {
+        attrs.push_str(&format!(" style=\"max-width:{n}rem\""));
+    }
+    if attrs.is_empty() {
+        return cleaned;
+    }
+    cleaned.replacen("<img", &format!("<img{attrs}"), 1)
+}
+

src/content/validate.rs

@@ -0,0 +1,464 @@
+//! What a content repo must satisfy before it serves: every action
+//! lands on a page, every transition is one the state machine allows,
+//! every recorded bucket is read back somewhere, and the built-in
+//! aggregates the runtime owns are always present.
+
+#[allow(unused_imports)] // the browser build sees fewer items
+use super::*;
+
+/// A relay must be a ws:// or wss:// URL - shared between site.yaml's
+/// hero and `Requirement.relay` validation.
+#[cfg(feature = "ssr")]
+pub fn validate_relay_url(relay: &str) -> anyhow::Result<()> {
+    let parsed = url::Url::parse(relay)
+        .map_err(|e| anyhow::anyhow!("relay {relay:?} is not a valid URL: {e}"))?;
+    if !matches!(parsed.scheme(), "ws" | "wss") {
+        anyhow::bail!("relay {relay:?} must use the ws:// or wss:// scheme");
+    }
+    Ok(())
+}
+
+/// Validates every declared transition target (`SelfTransition.to`,
+/// `ResourceSpec.transitions[].to`) against `aggregates` - the real
+/// state graph loaded from `aggregates.yaml` - for every bucket that
+/// has one declared. A bucket with no entry in `aggregates` is left
+/// alone entirely (no validation applied): not every bucket needs to
+/// be event-sourced to keep working. Called on every content
+/// load/reload (`watch_for_reload`, `main.rs`'s boot path) and by the
+/// standalone `question-lint` binary, so a YAML typo becomes a caught,
+/// logged rejection instead of a silently-accepted, later-broken
+/// string.
+/// Bucket the runtime keeps for announced pages (`Question.event`):
+/// one record per event question, `announced` while the window is
+/// open, `awaiting_summary` once it closes - the "post what happened"
+/// task a desk reading this bucket picks up - and `summarized` when an
+/// owner marks it done. Declared here, not in content, because the
+/// runtime's sweeper (`announce.rs`) is what moves the records.
+pub const EVENTS_BUCKET: &str = "portal_events";
+
+#[cfg(feature = "ssr")]
+const BUILTIN_AGGREGATES_YAML: &str = "\
+aggregates:
+  - bucket: portal_events
+    initial: announced
+    states:
+      announced: { event: announced }
+      awaiting_summary: { event: ended }
+      summarized: { event: summarized }
+    transitions:
+      announced: [awaiting_summary, summarized]
+      awaiting_summary: [summarized]
+  - bucket: portal_invites
+    attended_by: the inviting group's own desk, or the link in the invite event
+    initial: open
+    states:
+      open: { event: invited }
+      done: { event: done }
+    transitions:
+      open: [done]
+";
+
+/// Adds the runtime's own state graphs to a content repo's. Content
+/// wins if it declares the same bucket (say, to add states).
+#[cfg(feature = "ssr")]
+pub fn with_builtin_aggregates(
+    mut aggregates: std::collections::HashMap<String, crate::aggregates::AggregateSchema>,
+) -> std::collections::HashMap<String, crate::aggregates::AggregateSchema> {
+    let builtin = crate::aggregates::parse_aggregates_yaml(BUILTIN_AGGREGATES_YAML)
+        .expect("builtin aggregates yaml is valid");
+    for (bucket, schema) in builtin {
+        aggregates.entry(bucket).or_insert(schema);
+    }
+    aggregates
+}
+
+/// True when some kv resource in the content reads `bucket` - the
+/// attended-bucket check, exposed so the lint can warn about the
+/// runtime's own `portal_events` (a warning, not a failure: a repo
+/// with no event pages has nothing to attend).
+#[cfg(feature = "ssr")]
+pub fn bucket_is_read(questions: &std::collections::HashMap<String, Question>, bucket: &str) -> bool {
+    questions.values().any(|q| {
+        q.alternatives.iter().any(|a| {
+            a.features
+                .iter()
+                .any(|f| f.resource.as_ref().and_then(|r| r.bucket()).is_some_and(|b| b == bucket))
+        })
+    })
+}
+
+#[cfg(feature = "ssr")]
+pub fn validate_questions(
+    questions: &std::collections::HashMap<String, Question>,
+    aggregates: &std::collections::HashMap<String, crate::aggregates::AggregateSchema>,
+) -> anyhow::Result<()> {
+    // A mail to the submitter needs an address to go to: every form
+    // that records into that bucket has to collect a required email.
+    for (bucket, schema) in aggregates {
+        let submitter_states: Vec<&String> = schema.mail_for_state.iter().filter(|(_, m)| m.to_submitter()).map(|(s, _)| s).collect();
+        if submitter_states.is_empty() {
+            continue;
+        }
+        for question in questions.values() {
+            for alternative in question.alternatives.iter().filter(|a| a.record_as.as_deref() == Some(bucket.as_str())) {
+                let collects_email = alternative
+                    .features
+                    .iter()
+                    .flat_map(|f| &f.requirements)
+                    .any(|r| r.name == "email" && r.kind == "email" && !r.optional);
+                if !collects_email {
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: records into {bucket:?}, whose state(s) {:?} mail the submitter, so it must collect a required `email` field of type email",
+                        question.id, alternative.name, submitter_states
+                    );
+                }
+            }
+        }
+    }
+
+    // A state that grants a group makes an account for the person the
+    // record is about, so the record has to know who they are. Same
+    // shape as an invite's own rule, one step further back: the form
+    // that fills the bucket is where the name and the address have to
+    // be asked for, because by the time a desk presses approve there is
+    // nobody left to ask.
+    for (bucket, schema) in aggregates {
+        let mut granting: Vec<&String> = schema.grants_for_state.keys().collect();
+        if granting.is_empty() {
+            continue;
+        }
+        granting.sort();
+        for question in questions.values() {
+            for alternative in question.alternatives.iter().filter(|a| a.record_as.as_deref() == Some(bucket.as_str())) {
+                let required = |name: &str, kind: &str| {
+                    alternative
+                        .features
+                        .iter()
+                        .flat_map(|f| &f.requirements)
+                        .any(|r| r.name == name && r.kind == kind && !r.optional)
+                };
+                if !required("email", "email") || !required("name", "text") {
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: records into {bucket:?}, whose state(s) {:?} grant a group, so it must collect a required `name` and a required `email` field of type email",
+                        question.id, alternative.name, granting
+                    );
+                }
+            }
+        }
+    }
+
+    for question in questions.values() {
+        if let Some(event) = &question.event {
+            if question.is_dynamic() {
+                anyhow::bail!("question {:?}: a dynamic page can't carry an event", question.id);
+            }
+            if let Err(e) = event.window_ms() {
+                anyhow::bail!("question {:?}: event: {e}", question.id);
+            }
+        }
+        if let Some(place) = &question.place {
+            if let Err(e) = place.validate() {
+                anyhow::bail!("question {:?}: place: {e}", question.id);
+            }
+        }
+        if let Some(target) = &question.requires_chain {
+            if !questions.contains_key(target) {
+                anyhow::bail!(
+                    "question {:?}: requires_chain {:?} does not match any declared question id",
+                    question.id,
+                    target
+                );
+            }
+        }
+        for alternative in &question.alternatives {
+            // A dangling action is a literal dead end: the submit
+            // button navigates to "Nothing here".
+            if let Some(action) = &alternative.action {
+                if action.contains('{') {
+                    // Placeholders are filled at submit time; the
+                    // shape must land on a dynamic page once filled.
+                    let probe = template_action(action, &serde_json::json!({}));
+                    let filled = {
+                        let mut a = action.clone();
+                        while let (Some(i), Some(j)) = (a.find('{'), a.find('}')) {
+                            a.replace_range(i..=j, "x");
+                        }
+                        a
+                    };
+                    let _ = probe;
+                    // Match the pattern itself: resolve_question would
+                    // hand back a clone whose id is already concrete.
+                    let lands = questions
+                        .values()
+                        .any(|q| q.is_dynamic() && path_matches(&q.id, &filled).is_some());
+                    if lands {
+                        continue;
+                    }
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: templated action {:?} must land on a dynamic page ([name].yaml)",
+                        question.id, alternative.name, action
+                    );
+                }
+                match questions.get(action) {
+                    None => anyhow::bail!(
+                        "question {:?} alternative {:?}: action {:?} does not match any declared question id",
+                        question.id, alternative.name, action
+                    ),
+                    // A dynamic page needs a concrete segment value to
+                    // be a URL - a submit button can't supply one.
+                    Some(target) if target.is_dynamic() => anyhow::bail!(
+                        "question {:?} alternative {:?}: action {:?} targets a dynamic page - actions must name a concrete question",
+                        question.id, alternative.name, action
+                    ),
+                    Some(_) => {}
+                }
+            }
+            if let Some(invite) = &alternative.invite {
+                if question.qualifies.is_none() {
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: an invite into {:?} must sit on a page gated by `qualifies` - that group is who may extend it",
+                        question.id, alternative.name, invite.group
+                    );
+                }
+                let has = |name: &str| {
+                    alternative
+                        .features
+                        .iter()
+                        .flat_map(|f| &f.requirements)
+                        .any(|r| r.name == name && !r.optional)
+                };
+                if !has("name") || !has("email") {
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: an invite must collect required `name` and `email` fields",
+                        question.id, alternative.name
+                    );
+                }
+            }
+            if let Some(st) = &alternative.self_transition {
+                if let Some(schema) = aggregates.get(&st.bucket) {
+                    if !schema.has_state(&st.to) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?}: self_transition.to {:?} is not a declared state for bucket {:?}",
+                            question.id, alternative.name, st.to, st.bucket
+                        );
+                    }
+                    if st.from.is_empty() {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?}: self_transition.from is empty, so the move can never be made",
+                            question.id, alternative.name
+                        );
+                    }
+                    for from in &st.from {
+                        if !schema.has_state(from) {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?}: self_transition.from {:?} is not a declared state for bucket {:?}",
+                                question.id, alternative.name, from, st.bucket
+                            );
+                        }
+                        // The policy would otherwise permit a move the
+                        // engine refuses: the reader of the content
+                        // should hear about that here, not from a
+                        // person who clicked the button.
+                        if !schema.allowed(from).iter().any(|s| s == &st.to) {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?}: self_transition {:?} -> {:?} is not a declared edge for bucket {:?}",
+                                question.id, alternative.name, from, st.to, st.bucket
+                            );
+                        }
+                    }
+                }
+            }
+            // Bind targets resolve across the whole alternative, same
+            // scope as the signal maps the renderer builds.
+            let sibling_names: std::collections::HashSet<&str> = alternative
+                .features
+                .iter()
+                .flat_map(|f| f.requirements.iter())
+                .map(|r| r.name.as_str())
+                .collect();
+            for feature in &alternative.features {
+                for requirement in &feature.requirements {
+                    if requirement.kind == "select"
+                        && requirement.resource.is_none()
+                        && requirement.options.is_empty()
+                    {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: select but declares neither a resource nor inline options",
+                            question.id, alternative.name, feature.name, requirement.name
+                        );
+                    }
+                    if let Some(relay) = &requirement.relay {
+                        if requirement.kind != "gesture" && requirement.kind != "voice" {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} declares relay but is type {:?} - relay only makes sense on type: gesture or voice",
+                                question.id, alternative.name, feature.name, requirement.name, requirement.kind
+                            );
+                        }
+                        validate_relay_url(relay).map_err(|e| anyhow::anyhow!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?}: {e}",
+                            question.id, alternative.name, feature.name, requirement.name
+                        ))?;
+                    }
+                    if requirement.kind == "gesture"
+                        && (requirement.resource.is_some() || requirement.bind.is_some())
+                    {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: gesture - it draws its value, it can't also load one from a resource or bind",
+                            question.id, alternative.name, feature.name, requirement.name
+                        );
+                    }
+                    if requirement.kind == "location" {
+                        if requirement.resource.is_some() || requirement.bind.is_some() {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: location - the visitor puts the pin, it can't also load one from a resource or bind",
+                                question.id, alternative.name, feature.name, requirement.name
+                            );
+                        }
+                        // `value` opens the map somewhere useful. It is
+                        // the content author's own coordinates, so a
+                        // typo here is a map of the Atlantic.
+                        if let Some(value) = &requirement.value {
+                            let parts: Vec<&str> = value.split(',').map(str::trim).collect();
+                            let ok = (2..=3).contains(&parts.len())
+                                && parts.iter().all(|p| p.parse::<f64>().is_ok())
+                                && parts[0].parse::<f64>().is_ok_and(|lat| (-90.0..=90.0).contains(&lat))
+                                && parts[1].parse::<f64>().is_ok_and(|lon| (-180.0..=180.0).contains(&lon));
+                            if !ok {
+                                anyhow::bail!(
+                                    "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: location - its `value` opens the map and must be `lat,lon` or `lat,lon,zoom`, not {value:?}",
+                                    question.id, alternative.name, feature.name, requirement.name
+                                );
+                            }
+                        }
+                    }
+                    // One case belonging to another. The bucket has to
+                    // be one this repo declares, or the reference could
+                    // never resolve; and it is the only thing `of`
+                    // means, so it belongs to no other type.
+                    if requirement.kind == "record" {
+                        let Some(of) = &requirement.of else {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: record - it must say `of: <bucket>`, the bucket the record it points at lives in",
+                                question.id, alternative.name, feature.name, requirement.name
+                            );
+                        };
+                        if !aggregates.contains_key(of) {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} points at bucket {of:?}, which has no aggregate declared",
+                                question.id, alternative.name, feature.name, requirement.name
+                            );
+                        }
+                        if requirement.resource.is_some() || requirement.bind.is_some() {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: record - the link it came in on carries the id, it can't also load one from a resource or bind",
+                                question.id, alternative.name, feature.name, requirement.name
+                            );
+                        }
+                    } else if requirement.of.is_some() {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?} has `of`, which only a type: record field has",
+                            question.id, alternative.name, feature.name, requirement.name
+                        );
+                    }
+                    if let Some(bind) = &requirement.bind {
+                        if bind.field == requirement.name
+                            || !sibling_names.contains(bind.field.as_str())
+                        {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} binds to {:?}, which is not another requirement on this alternative",
+                                question.id, alternative.name, feature.name, requirement.name, bind.field
+                            );
+                        }
+                    }
+                }
+                let Some(resource) = &feature.resource else {
+                    continue;
+                };
+                let Some(bucket) = resource.bucket() else {
+                    continue;
+                };
+                let Some(schema) = aggregates.get(bucket) else {
+                    continue;
+                };
+                for state in &resource.states {
+                    if !schema.has_state(state) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: states {:?} is not a declared state for bucket {:?}",
+                            question.id, alternative.name, feature.name, state, bucket
+                        );
+                    }
+                }
+                for transition in &resource.transitions {
+                    if !schema.has_state(&transition.from) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: transition.from {:?} is not a declared state for bucket {:?}",
+                            question.id, alternative.name, feature.name, transition.from, bucket
+                        );
+                    }
+                    if !schema.has_state(&transition.to) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: transition.to {:?} is not a declared state for bucket {:?}",
+                            question.id, alternative.name, feature.name, transition.to, bucket
+                        );
+                    }
+                    if !schema.allowed(&transition.from).iter().any(|s| s == &transition.to) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: transition {:?} -> {:?} is not a declared edge for bucket {:?}",
+                            question.id, alternative.name, feature.name, transition.from, transition.to, bucket
+                        );
+                    }
+                }
+            }
+        }
+    }
+
+    // Attended buckets: no publicly collected answer may land somewhere
+    // nothing reads. Every `record_as` bucket must either be read back
+    // by some Kv resource in this same content repo (a desk or listing)
+    // or carry an explicit `attended_by:` annotation in aggregates.yaml
+    // naming the automation that consumes it. This is a contract, not a
+    // convention, because convention already failed once: a question
+    // was dropped and its bucket - answers included - silently fell out
+    // of every reader's view.
+    let mut read_buckets = std::collections::HashSet::new();
+    let note_resource = |spec: &ResourceSpec, set: &mut std::collections::HashSet<String>| {
+        if let ResourceSource::Kv { bucket } = &spec.source {
+            set.insert(bucket.clone());
+        }
+    };
+    for question in questions.values() {
+        for alternative in &question.alternatives {
+            for feature in &alternative.features {
+                if let Some(spec) = &feature.resource {
+                    note_resource(spec, &mut read_buckets);
+                }
+                for requirement in &feature.requirements {
+                    if let Some(spec) = &requirement.resource {
+                        note_resource(spec, &mut read_buckets);
+                    }
+                    if let Some(bind) = &requirement.bind {
+                        note_resource(&bind.resource, &mut read_buckets);
+                    }
+                }
+            }
+        }
+    }
+    for question in questions.values() {
+        for alternative in &question.alternatives {
+            if let Some(bucket) = &alternative.record_as {
+                let attended = read_buckets.contains(bucket)
+                    || aggregates
+                        .get(bucket)
+                        .is_some_and(|schema| schema.attended_by.is_some());
+                if !attended {
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: record_as {bucket:?} is unattended - no page reads that bucket back, and aggregates.yaml declares no attended_by for it. Add a desk/listing resource over it, or annotate the automation that consumes it.",
+                        question.id, alternative.name
+                    );
+                }
+            }
+        }
+    }
+    Ok(())
+}
+

src/deadlines.rs

@@ -0,0 +1,196 @@
+//! The moves a clock makes rather than a person.
+//!
+//! A state in `aggregates.yaml` may carry `after: { days: 42, to:
+//! no_answer }`: when a record has waited there that long, portal makes
+//! the move itself. Every deadline a public body keeps is of this
+//! shape - a hearing goes out and the authority has six weeks to
+//! answer, and when it does not the case has to go on without one, with
+//! nobody in the building in a position to press that button.
+//!
+//! A deadline may only do what a person could have done: `after.to` is
+//! held to the same declared edge as a desk button (see
+//! `parse_aggregates_yaml`), the move goes through the same
+//! `aggregates::transition`, the same mail fires, and it lands on
+//! `portal.answers.submitted` like any other decision. What it is not
+//! is a job queue: the unit is days, the tick is an hour, and a record
+//! that has waited long enough is moved once, because after the move it
+//! is no longer in a state that has a deadline.
+
+use crate::answers::Answer;
+use crate::events::{emit_answer_submitted, AnswerSubmitted};
+use crate::server::AppState;
+
+/// Stamped on the record and on the transition event in place of a
+/// username, so a desk and an n8n workflow can both tell a decision
+/// nobody made from one somebody did.
+pub const BY: &str = "deadline";
+
+const DAY_MS: i64 = 24 * 60 * 60 * 1000;
+
+pub async fn run(state: AppState) {
+    let mut tick = tokio::time::interval(std::time::Duration::from_secs(60 * 60));
+    loop {
+        tick.tick().await;
+        if let Err(e) = sweep(&state).await {
+            tracing::warn!(error = %e, "deadline sweep failed");
+        }
+    }
+}
+
+/// When a record entered the state it is in now. A record nobody has
+/// moved has been waiting since it was sent.
+fn waiting_since(answer: &Answer) -> i64 {
+    answer.decided_ms.unwrap_or(answer.submitted_ms)
+}
+
+/// Whether a record in `state` has waited out its deadline by `now_ms`.
+pub fn due(schema: &crate::aggregates::AggregateSchema, answer: &Answer, now_ms: i64) -> Option<String> {
+    let after = schema.after_for(&answer.state)?;
+    let deadline = waiting_since(answer) + i64::from(after.days) * DAY_MS;
+    (now_ms >= deadline).then(|| after.to.clone())
+}
+
+/// One pass over every bucket that has a deadline on any of its states.
+pub async fn sweep(state: &AppState) -> anyhow::Result<()> {
+    let now_ms = chrono::Utc::now().timestamp_millis();
+    let aggregates = state.aggregates.load();
+    for schema in aggregates.values() {
+        if schema.after_for_state.is_empty() {
+            continue;
+        }
+        // A bucket is created on first write, so one that has never
+        // been written to is an ordinary empty bucket, not an error.
+        let Ok(store) = state.jetstream.get_key_value(&schema.bucket).await else {
+            continue;
+        };
+        let keys: Vec<String> = {
+            use futures::TryStreamExt;
+            match store.keys().await {
+                Ok(keys) => keys.try_collect().await.unwrap_or_default(),
+                Err(_) => continue,
+            }
+        };
+        for id in keys {
+            let Ok(Some(bytes)) = store.get(&id).await else { continue };
+            let Ok(mut answer) = serde_json::from_slice::<Answer>(&bytes) else { continue };
+            let Some(target) = due(schema, &answer, now_ms) else { continue };
+
+            let payload = serde_json::json!({ "to": target, "item": id, "by": BY });
+            if let Err(e) = crate::aggregates::transition(
+                &state.jetstream, schema, &id, &target, payload.clone(), now_ms,
+            )
+            .await
+            {
+                // A record whose events are gone, or one another writer
+                // moved between the read and the write: neither is this
+                // sweep's to fix, and the next tick sees it again.
+                tracing::warn!(bucket = %schema.bucket, id, target, "a deadline could not be made: {e}");
+                continue;
+            }
+
+            answer.state = target.clone();
+            answer.decided_ms = Some(now_ms);
+            answer.decided_by = Some(BY.to_string());
+            if let Ok(data) = serde_json::to_vec(&answer) {
+                let _ = store.put(&id, data.into()).await;
+            }
+            crate::mail::on_state(state, &schema.bucket, &id, &target, &answer.responses).await;
+            crate::people::on_state(state, &schema.bucket, &id, &target, &answer.responses).await;
+
+            let parent_hashes = vec![id.clone()];
+            let chain_hash = crate::chain::hash_node(&answer.question_id, &parent_hashes, &payload, now_ms);
+            if let Err(e) = emit_answer_submitted(
+                &state.nats,
+                &AnswerSubmitted {
+                    chain_hash,
+                    parent_hashes,
+                    question_id: answer.question_id.clone(),
+                    alternative: target.clone(),
+                    responses: payload,
+                    timestamp_ms: now_ms,
+                },
+            )
+            .await
+            {
+                tracing::warn!(bucket = %schema.bucket, id, "the deadline was made but not published: {e}");
+            }
+            tracing::info!(bucket = %schema.bucket, id, target, "a deadline passed and the case went on");
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn schema(yaml: &str) -> crate::aggregates::AggregateSchema {
+        crate::aggregates::parse_aggregates_yaml(yaml).unwrap().into_values().next().unwrap()
+    }
+
+    const HEARINGS: &str = r#"
+aggregates:
+  - bucket: hearings
+    initial: open
+    states:
+      open: { event: received, after: { days: 42, to: no_answer } }
+      answered: { event: answered }
+      no_answer: { event: no_answer }
+    transitions:
+      open: [answered, no_answer]
+"#;
+
+    fn waiting(state: &str, since_ms: i64) -> Answer {
+        Answer {
+            id: "r".into(), question_id: "/q".into(), alternative: "a".into(),
+            responses: serde_json::json!({}), state: state.into(),
+            submitted_ms: since_ms, decided_ms: None, decided_by: None, notes: vec![],
+        }
+    }
+
+    #[test]
+    fn a_deadline_comes_due_the_day_it_says_and_not_before() {
+        let s = schema(HEARINGS);
+        let sent = 1_000_000_000_000;
+        let answer = waiting("open", sent);
+        assert_eq!(due(&s, &answer, sent), None);
+        assert_eq!(due(&s, &answer, sent + 41 * DAY_MS), None);
+        assert_eq!(due(&s, &answer, sent + 42 * DAY_MS), Some("no_answer".into()));
+    }
+
+    // The six weeks run from the last move, not from the day the case
+    // was opened: a record someone touched has been waiting since then.
+    #[test]
+    fn the_wait_is_measured_from_the_last_move() {
+        let s = schema(HEARINGS);
+        let sent = 1_000_000_000_000;
+        let mut answer = waiting("open", sent);
+        answer.decided_ms = Some(sent + 40 * DAY_MS);
+        assert_eq!(due(&s, &answer, sent + 42 * DAY_MS), None);
+        assert_eq!(due(&s, &answer, sent + 82 * DAY_MS), Some("no_answer".into()));
+    }
+
+    #[test]
+    fn a_state_with_no_deadline_waits_forever() {
+        let s = schema(HEARINGS);
+        let answer = waiting("answered", 0);
+        assert_eq!(due(&s, &answer, i64::MAX / 2), None);
+    }
+
+    // A clock may only make a move a person could have made, so a
+    // deadline onto an undeclared edge is refused when content loads,
+    // not when the hour comes round.
+    #[test]
+    fn a_deadline_onto_an_undeclared_edge_is_refused_on_load() {
+        let bad = HEARINGS.replace("to: no_answer }", "to: answered }").replace("open: [answered, no_answer]", "open: [no_answer]");
+        let err = crate::aggregates::parse_aggregates_yaml(&bad).unwrap_err().to_string();
+        assert!(err.contains("not a declared transition"), "{err}");
+    }
+
+    #[test]
+    fn a_deadline_of_no_days_is_refused() {
+        let bad = HEARINGS.replace("days: 42", "days: 0");
+        let err = crate::aggregates::parse_aggregates_yaml(&bad).unwrap_err().to_string();
+        assert!(err.contains("at least one"), "{err}");
+    }
+}

src/http.rs

@@ -0,0 +1,64 @@
+//! The one outbound HTTP client, bounded. Every server-side fetch -
+//! Gitea content at boot and on reload, the raw-asset proxy, the
+//! repo-info endpoint, and the content-declared `url` resource - goes
+//! through here, so a slow or oversized upstream can cost a request at
+//! most `TIMEOUT` and `cap` bytes, never a thread or the heap. Before
+//! this module each call site built its own client with no timeout and
+//! read whole bodies with `.text()`.
+#![cfg(feature = "ssr")]
+
+use std::sync::OnceLock;
+use std::time::Duration;
+
+use openidconnect::reqwest;
+
+/// Whole-request budget: connect, headers, and body.
+pub const TIMEOUT: Duration = Duration::from_secs(20);
+const CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
+
+/// A content-declared URL resource: JSON for one card.
+pub const URL_RESOURCE_CAP: usize = 2 * 1024 * 1024;
+/// A Gitea API reply or one content file (a tree listing, a YAML page).
+pub const GITEA_CAP: usize = 8 * 1024 * 1024;
+/// A content-shipped asset proxied to the browser (an image, a font).
+pub const ASSET_CAP: usize = 32 * 1024 * 1024;
+
+pub fn client() -> &'static reqwest::Client {
+    static CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
+    CLIENT.get_or_init(|| {
+        reqwest::Client::builder()
+            .connect_timeout(CONNECT_TIMEOUT)
+            .timeout(TIMEOUT)
+            .redirect(reqwest::redirect::Policy::limited(5))
+            .user_agent(concat!("portal/", env!("CARGO_PKG_VERSION")))
+            .build()
+            .expect("a client with static options always builds")
+    })
+}
+
+/// Reads a body up to `cap` bytes; one byte more is an error, not a
+/// truncation, so a caller never parses half a document.
+pub async fn bytes(mut response: reqwest::Response, cap: usize) -> anyhow::Result<Vec<u8>> {
+    let hint = response.content_length().unwrap_or(0) as usize;
+    if hint > cap {
+        anyhow::bail!("response of {hint} bytes exceeds the cap of {cap}");
+    }
+    let mut out = Vec::with_capacity(hint.min(cap));
+    while let Some(chunk) = response.chunk().await? {
+        if out.len() + chunk.len() > cap {
+            anyhow::bail!("response exceeds the cap of {cap} bytes");
+        }
+        out.extend_from_slice(&chunk);
+    }
+    Ok(out)
+}
+
+pub async fn text(response: reqwest::Response, cap: usize) -> anyhow::Result<String> {
+    Ok(String::from_utf8(bytes(response, cap).await?)?)
+}
+
+/// `GET url`, status checked, body read under `cap`.
+pub async fn get_text(url: &str, cap: usize) -> anyhow::Result<String> {
+    let response = client().get(url).send().await?.error_for_status()?;
+    text(response, cap).await
+}

src/lib.rs

@@ -13,6 +13,26 @@ pub mod aggregates;
 #[cfg(feature = "ssr")]
 pub mod announce;
 
+#[cfg(feature = "ssr")]
+pub mod deadlines;
+
+#[cfg(feature = "ssr")]
+pub mod sessions;
+
+#[cfg(feature = "ssr")]
+pub mod http;
+
+#[cfg(feature = "ssr")]
+pub mod access;
+
+#[cfg(feature = "ssr")]
+pub mod people;
+
+#[cfg(feature = "ssr")]
+pub mod mail;
+
+pub mod maps;
+
 #[cfg(feature = "ssr")]
 pub mod server;
 

src/mail.rs

@@ -0,0 +1,489 @@
+//! Portal's side of the mail gate. Content decides when a person
+//! hears something (`mail:` on a state in aggregates.yaml, and the
+//! built-in invite mail); portal renders the message the moment a
+//! record enters that state and publishes it on one JetStream subject.
+//! gdo (uhhm/gdo) holds a durable consumer on that subject and hands
+//! each message to the host's SMTP. Portal never talks SMTP, gdo never
+//! reads content, and a message survives either of them being down.
+//!
+//! The message is the contract between the two, `Outgoing` below,
+//! versioned by `v`. Its id is the JetStream message id, so a
+//! transition that fires twice (a retry, a reseed) sends once.
+#![cfg(feature = "ssr")]
+
+use serde::{Deserialize, Serialize};
+use std::time::Duration;
+
+/// The stream both sides create on boot, with the same config, so
+/// whichever starts first owns nothing the other lacks.
+pub const STREAM: &str = "mail";
+pub const SUBJECTS: &str = "portal.mail.>";
+pub const SUBJECT: &str = "portal.mail.send";
+/// Where a reply to a case mail arrives, published by whatever reads
+/// the mailbox (uhhm/gdo over JMAP). Portal turns it into a note on
+/// the record it names and nothing else: no state moves on a reply.
+pub const RECEIVED_SUBJECT: &str = "portal.mail.received";
+/// Bumped when `Outgoing` changes shape; gdo refuses what it does not
+/// know rather than guessing.
+pub const CONTRACT: u8 = 1;
+
+/// One mail, fully rendered: everything gdo needs and nothing it has
+/// to look up.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Outgoing {
+    pub v: u8,
+    /// `<bucket>:<record>:<state>` or `invite:<user>:<group>:<ms>` -
+    /// the dedup key.
+    pub id: String,
+    pub site: String,
+    pub from: String,
+    #[serde(default)]
+    pub reply_to: Option<String>,
+    pub to: String,
+    pub subject: String,
+    pub text: String,
+    pub html: String,
+}
+
+/// A reply that came back, already matched to a record by whatever
+/// read the mailbox. Portal trusts the match no further than it can
+/// check it: the record must exist, the bucket must be one this site
+/// has, and the sender must be the address the record itself holds.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Incoming {
+    pub v: u8,
+    /// The mail's own id, so the same reply read twice lands once.
+    pub id: String,
+    pub bucket: String,
+    pub record: String,
+    /// Who sent it, as the mail server saw it.
+    pub from: String,
+    #[serde(default)]
+    pub subject: String,
+    /// The reply itself, already stripped of quoted history and
+    /// signatures by the reader; portal stores what it is given.
+    pub text: String,
+    pub received_ms: i64,
+}
+
+/// What a reply may add to a record, and what it may never do. Returns
+/// the note to append, or why the reply is not one.
+///
+/// The address a reply comes back on is unguessable, so it is proof of
+/// having been sent the mail - but a mailbox is a public door, and an
+/// address can be forged. The sender must therefore also match the
+/// address the record already holds, which is the one portal wrote to
+/// in the first place.
+pub fn note_for(incoming: &Incoming, answer: &crate::answers::Answer) -> Result<crate::answers::Note, String> {
+    if incoming.v != CONTRACT {
+        return Err(format!("reply contract v{} is not v{CONTRACT}", incoming.v));
+    }
+    let text = incoming.text.trim();
+    if text.is_empty() {
+        return Err("the reply has no text".to_string());
+    }
+    let held = answer
+        .responses
+        .get("email")
+        .and_then(|v| v.as_str())
+        .map(|e| e.trim().to_lowercase())
+        .filter(|e| !e.is_empty())
+        .ok_or_else(|| "the record holds no address to compare the sender with".to_string())?;
+    if address_of(&incoming.from) != held {
+        return Err(format!("{} is not the address this record was written to", incoming.from));
+    }
+    if answer.notes.iter().any(|n| n.id == incoming.id) {
+        return Err("this reply is already on the record".to_string());
+    }
+    Ok(crate::answers::Note {
+        id: incoming.id.clone(),
+        from: address_of(&incoming.from),
+        subject: incoming.subject.trim().to_string(),
+        text: text.to_string(),
+        received_ms: incoming.received_ms,
+    })
+}
+
+/// The bare address out of `Name <a@b>` or `a@b`, folded for
+/// comparison. Mail addresses are case-insensitive in the part that
+/// matters here, and a display name is not identity.
+pub fn address_of(from: &str) -> String {
+    let inner = match (from.rfind('<'), from.rfind('>')) {
+        (Some(open), Some(close)) if close > open => &from[open + 1..close],
+        _ => from,
+    };
+    inner.trim().to_lowercase()
+}
+
+/// Listens for replies and writes each one onto the record it names.
+/// A reply is a note and never a decision: nothing here moves a case,
+/// so a mailbox - the one door anyone may knock on - cannot drive a
+/// state machine even if someone forges their way past the checks.
+pub async fn receive(state: crate::server::AppState) {
+    use futures::StreamExt;
+    let mut sub = match state.nats.subscribe(RECEIVED_SUBJECT).await {
+        Ok(sub) => sub,
+        Err(e) => {
+            tracing::error!(error = %e, "cannot listen for replies");
+            return;
+        }
+    };
+    tracing::info!(subject = RECEIVED_SUBJECT, "listening for replies to case mail");
+    while let Some(msg) = sub.next().await {
+        let incoming: Incoming = match serde_json::from_slice(&msg.payload) {
+            Ok(i) => i,
+            Err(e) => {
+                tracing::warn!("unreadable reply on {RECEIVED_SUBJECT}: {e}");
+                continue;
+            }
+        };
+        match note_onto(&state, &incoming).await {
+            Ok(()) => tracing::info!(bucket = %incoming.bucket, record = %incoming.record, "a reply was added to the record"),
+            Err(e) => tracing::warn!(bucket = %incoming.bucket, record = %incoming.record, "reply refused: {e}"),
+        }
+    }
+}
+
+/// The record's own bucket is the only one a reply may touch, and the
+/// note is appended under the same read-modify-write the desks use.
+async fn note_onto(state: &crate::server::AppState, incoming: &Incoming) -> anyhow::Result<()> {
+    if !state.aggregates.load().contains_key(&incoming.bucket) && !crate::content::bucket_is_read(&state.questions.load(), &incoming.bucket) {
+        anyhow::bail!("{} is not a bucket of this site", incoming.bucket);
+    }
+    let store = state.jetstream.get_key_value(&incoming.bucket).await?;
+    let bytes = store
+        .get(&incoming.record)
+        .await?
+        .ok_or_else(|| anyhow::anyhow!("no such record"))?;
+    let mut answer: crate::answers::Answer = serde_json::from_slice(&bytes)?;
+    let note = note_for(incoming, &answer).map_err(|e| anyhow::anyhow!(e))?;
+    answer.notes.push(note);
+    store.put(&incoming.record, serde_json::to_vec(&answer)?.into()).await?;
+    Ok(())
+}
+
+/// Idempotent, called by portal at boot and by gdo. A week of
+/// retention: a mail nobody delivered in a week is stale, not owed.
+/// The duplicate window has to fit inside it.
+pub async fn ensure_stream(js: &async_nats::jetstream::Context) -> anyhow::Result<async_nats::jetstream::stream::Stream> {
+    Ok(js
+        .get_or_create_stream(async_nats::jetstream::stream::Config {
+            name: STREAM.to_string(),
+            subjects: vec![SUBJECTS.to_string()],
+            max_age: Duration::from_secs(7 * 24 * 3600),
+            duplicate_window: Duration::from_secs(24 * 3600),
+            ..Default::default()
+        })
+        .await?)
+}
+
+/// `{key}` in a template becomes the variable's value, an unknown key
+/// becomes nothing, and a brace that opens no key stays a brace.
+pub fn render(template: &str, vars: &serde_json::Map<String, serde_json::Value>) -> String {
+    let mut out = String::with_capacity(template.len());
+    let mut rest = template;
+    while let Some(start) = rest.find('{') {
+        out.push_str(&rest[..start]);
+        let after = &rest[start + 1..];
+        let key_len = after
+            .char_indices()
+            .take_while(|(_, c)| c.is_ascii_alphanumeric() || *c == '_' || *c == '-' || *c == '.')
+            .last()
+            .map(|(i, c)| i + c.len_utf8())
+            .unwrap_or(0);
+        if key_len > 0 && after[key_len..].starts_with('}') {
+            let key = &after[..key_len];
+            match vars.get(key) {
+                Some(serde_json::Value::String(s)) => out.push_str(s),
+                Some(serde_json::Value::Null) | None => {}
+                Some(other) => out.push_str(&other.to_string()),
+            }
+            rest = &after[key_len + 1..];
+        } else {
+            out.push('{');
+            rest = after;
+        }
+    }
+    out.push_str(rest);
+    out
+}
+
+/// The HTML alternative: the markdown body as a single column with
+/// inline styles, which is as much as mail clients agree on. Raw HTML
+/// in the body is dropped, the same rule as page descriptions.
+pub fn to_html(markdown: &str) -> String {
+    use pulldown_cmark::{html, Event, Options, Parser};
+    let parser = Parser::new_ext(markdown, Options::empty()).filter(|e| !matches!(e, Event::Html(_) | Event::InlineHtml(_)));
+    let mut body = String::new();
+    html::push_html(&mut body, parser);
+    format!(
+        "<!doctype html><html><body style=\"margin:0;padding:1.5em;background:#f4f4f2;color:#1c1c1a;font:16px/1.5 -apple-system,Segoe UI,Helvetica,Arial,sans-serif\"><div style=\"max-width:36em;margin:0 auto;background:#fff;padding:1.5em 2em;border-radius:0.5em\">{body}</div></body></html>"
+    )
+}
+
+fn public_url() -> String {
+    std::env::var("PUBLIC_URL").unwrap_or_default().trim_end_matches('/').to_string()
+}
+
+fn site_name(site: &crate::content::SiteConfig) -> String {
+    site.title.clone().unwrap_or_else(|| option_env!("SITE_NAME").unwrap_or("portal").to_string())
+}
+
+/// The variables a state mail may use: every field of the record,
+/// then the runtime's own.
+pub fn vars_for(bucket: &str, id: &str, state: &str, responses: &serde_json::Value) -> serde_json::Map<String, serde_json::Value> {
+    let mut vars = serde_json::Map::new();
+    if let Some(fields) = responses.as_object() {
+        for (k, v) in fields {
+            vars.insert(k.clone(), match v {
+                serde_json::Value::String(s) => serde_json::Value::String(s.clone()),
+                serde_json::Value::Null => serde_json::Value::String(String::new()),
+                other => serde_json::Value::String(other.to_string()),
+            });
+        }
+    }
+    let email = responses.get("email").and_then(|v| v.as_str()).unwrap_or_default().trim().to_string();
+    vars.insert("email".into(), email.into());
+    vars.insert("site".into(), public_url().into());
+    vars.insert("chain".into(), id.into());
+    vars.insert("bucket".into(), bucket.into());
+    vars.insert("state".into(), state.into());
+    vars
+}
+
+async fn publish(js: &async_nats::jetstream::Context, mail: &Outgoing) -> anyhow::Result<()> {
+    let mut headers = async_nats::HeaderMap::new();
+    headers.insert("Nats-Msg-Id", mail.id.as_str());
+    let bytes = serde_json::to_vec(mail)?;
+    js.publish_with_headers(SUBJECT, headers, bytes.into()).await?.await?;
+    Ok(())
+}
+
+/// A record entered `state` in `bucket`: send what the schema says,
+/// if anything. Best-effort by design - the transition is already
+/// committed, and a mail that cannot be rendered is logged, never a
+/// failed request.
+pub async fn on_state(state: &crate::server::AppState, bucket: &str, id: &str, to_state: &str, responses: &serde_json::Value) {
+    let Some(spec) = state.aggregates.load().get(bucket).and_then(|s| s.mail_for(to_state)).cloned() else {
+        return;
+    };
+    let site = state.site.load();
+    let Some(cfg) = &site.mail else {
+        tracing::warn!(bucket, to_state, "a mail is declared for this state, but site.yaml has no `mail.from` - not sent");
+        return;
+    };
+    let vars = vars_for(bucket, id, to_state, responses);
+    let to = if spec.to_submitter() {
+        match vars.get("email").and_then(|v| v.as_str()).filter(|e| e.contains('@')) {
+            Some(e) => e.to_string(),
+            None => {
+                tracing::warn!(bucket, id, to_state, "mail to the submitter, but the record carries no email - not sent");
+                return;
+            }
+        }
+    } else {
+        spec.to.clone()
+    };
+    let text = render(&spec.body, &vars);
+    let mail = Outgoing {
+        v: CONTRACT,
+        id: format!("{bucket}:{id}:{to_state}"),
+        site: site_name(&site),
+        from: cfg.from.clone(),
+        reply_to: cfg.reply_to.clone(),
+        to,
+        subject: render(&spec.subject, &vars),
+        html: to_html(&text),
+        text,
+    };
+    if let Err(e) = publish(&state.jetstream, &mail).await {
+        tracing::error!(bucket, id, to_state, "publishing the mail failed: {e}");
+    }
+}
+
+/// The invite mail: the one-time link to the person just onboarded.
+/// Built in, since portal knows everything about it; `mail.invite` in
+/// site.yaml rewords it. `{name}`, `{email}`, `{group}`, `{link}`,
+/// `{site}`, `{expires}`.
+pub async fn on_invite(state: &crate::server::AppState, invited: &crate::people::Invited) {
+    let site = state.site.load();
+    let Some(cfg) = &site.mail else {
+        tracing::warn!(user = %invited.username, "invite made, but site.yaml has no `mail.from` - the link is on the desk only");
+        return;
+    };
+    let norwegian = site.lang.as_deref().is_some_and(|l| l.starts_with("no") || l.starts_with("nb") || l.starts_with("nn"));
+    let (subject, body) = match (&cfg.invite, invited.reset_link.is_some(), norwegian) {
+        (Some(t), _, _) => (t.subject.clone(), t.body.clone()),
+        (None, true, true) => (
+            "Du er invitert inn i {group} på {site_name}".to_string(),
+            "Hei {name},\n\nDu har fått en konto på {site} og en plass i {group}. Velg passord eller passnøkkel her, lenken virker fram til {expires}:\n\n{link}\n\nBrukernavnet ditt er {username}.".to_string(),
+        ),
+        (None, false, true) => (
+            "Du har fått plass i {group} på {site_name}".to_string(),
+            "Hei {name},\n\nKontoen din på {site} har nå plass i {group}. Logg inn som vanlig.".to_string(),
+        ),
+        (None, true, false) => (
+            "You are invited into {group} at {site_name}".to_string(),
+            "Hello {name},\n\nYou have an account at {site} and a place in {group}. Set your password or passkey here; the link works until {expires}:\n\n{link}\n\nYour username is {username}.".to_string(),
+        ),
+        (None, false, false) => (
+            "You now have a place in {group} at {site_name}".to_string(),
+            "Hello {name},\n\nYour account at {site} now has a place in {group}. Sign in as usual.".to_string(),
+        ),
+    };
+    let now_ms = chrono::Utc::now().timestamp_millis();
+    let expires = invited
+        .link_expires_ms
+        .and_then(chrono::DateTime::<chrono::Utc>::from_timestamp_millis)
+        .map(|t| t.format("%Y-%m-%d %H:%M UTC").to_string())
+        .unwrap_or_default();
+    let mut vars = serde_json::Map::new();
+    vars.insert("name".into(), invited.display_name.clone().into());
+    vars.insert("username".into(), invited.username.clone().into());
+    vars.insert("email".into(), invited.email.clone().into());
+    vars.insert("group".into(), invited.group.clone().into());
+    vars.insert("link".into(), invited.reset_link.clone().unwrap_or_default().into());
+    vars.insert("site".into(), public_url().into());
+    vars.insert("site_name".into(), site_name(&site).into());
+    vars.insert("expires".into(), expires.into());
+    let text = render(&body, &vars);
+    let mail = Outgoing {
+        v: CONTRACT,
+        id: format!("invite:{}:{}:{now_ms}", invited.username, invited.group),
+        site: site_name(&site),
+        from: cfg.from.clone(),
+        reply_to: cfg.reply_to.clone(),
+        to: invited.email.clone(),
+        subject: render(&subject, &vars),
+        html: to_html(&text),
+        text,
+    };
+    if let Err(e) = publish(&state.jetstream, &mail).await {
+        tracing::error!(user = %invited.username, "publishing the invite mail failed: {e}");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn templates_take_fields_and_leave_stray_braces_alone() {
+        let responses = serde_json::json!({ "name": "Kari", "email": " kari@x.no ", "count": 3, "hva": null });
+        let vars = vars_for("reports", "abc", "fixed", &responses);
+        assert_eq!(render("Hi {name}, {count} at {site}/decide?chain={chain}&email={email}", &vars), "Hi Kari, 3 at /decide?chain=abc&email=kari@x.no");
+        assert_eq!(render("{unknown} {hva} {not a key} {", &vars), "  {not a key} {");
+        assert_eq!(vars["bucket"], "reports");
+        assert_eq!(vars["state"], "fixed");
+    }
+
+    #[test]
+    fn the_html_alternative_keeps_markdown_and_drops_raw_html() {
+        let html = to_html("Hello **there**\n\n<script>x()</script>\n\n[link](https://x.no)");
+        assert!(html.contains("<strong>there</strong>"));
+        assert!(html.contains("<a href=\"https://x.no\">link</a>"));
+        assert!(!html.contains("<script>"));
+        assert!(html.starts_with("<!doctype html>"));
+    }
+
+    #[test]
+    fn the_contract_round_trips() {
+        let mail = Outgoing {
+            v: CONTRACT,
+            id: "reports:abc:fixed".into(),
+            site: "Tomter Vel".into(),
+            from: "Tomter Vel <vel@example.no>".into(),
+            reply_to: None,
+            to: "kari@x.no".into(),
+            subject: "Fixed".into(),
+            text: "Done.".into(),
+            html: to_html("Done."),
+        };
+        let back: Outgoing = serde_json::from_slice(&serde_json::to_vec(&mail).unwrap()).unwrap();
+        assert_eq!(back, mail);
+        // A gdo that predates reply addresses sends none, and reads
+        // one from a portal that does: the field is optional on the
+        // wire in both directions.
+        let older: Outgoing = serde_json::from_str(
+            r#"{"v":1,"id":"a","site":"s","from":"f@x.no","to":"t@x.no","subject":"s","text":"t","html":"h"}"#,
+        )
+        .unwrap();
+        assert_eq!(older.subject, "s");
+        assert!(serde_json::to_string(&older).unwrap().contains("\"html\":\"h\""));
+    }
+
+    fn record(email: &str) -> crate::answers::Answer {
+        crate::answers::Answer {
+            id: "abc".into(),
+            question_id: "/report".into(),
+            alternative: "Report a hazard".into(),
+            responses: serde_json::json!({ "email": email, "where": "The bend" }),
+            state: "open".into(),
+            submitted_ms: 1,
+            decided_ms: None,
+            decided_by: None,
+            notes: Vec::new(),
+        }
+    }
+
+    fn reply(from: &str, text: &str) -> Incoming {
+        Incoming {
+            v: CONTRACT,
+            id: "mail-1".into(),
+            bucket: "hazards".into(),
+            record: "abc".into(),
+            from: from.into(),
+            subject: "Re: We have it".into(),
+            text: text.into(),
+            received_ms: 2,
+        }
+    }
+
+    #[test]
+    fn a_reply_from_the_address_on_the_record_becomes_a_note() {
+        let note = note_for(&reply("Kari <KARI@x.no>", "  It is fixed now.  "), &record("kari@x.no")).unwrap();
+        assert_eq!(note.from, "kari@x.no");
+        assert_eq!(note.text, "It is fixed now.");
+        assert_eq!(note.id, "mail-1");
+        assert_eq!(note.received_ms, 2);
+    }
+
+    #[test]
+    fn a_reply_from_anyone_else_is_refused() {
+        // The address a reply arrives on is unguessable, but a From is
+        // a claim, and a mailbox is a door anyone may knock on.
+        let err = note_for(&reply("someone@else.no", "Let me in"), &record("kari@x.no")).unwrap_err();
+        assert!(err.contains("not the address this record was written to"), "{err}");
+
+        // Nothing to compare against is also a refusal, not a pass.
+        let mut anonymous = record("kari@x.no");
+        anonymous.responses = serde_json::json!({ "where": "The bend" });
+        assert!(note_for(&reply("kari@x.no", "hi"), &anonymous).unwrap_err().contains("no address"));
+    }
+
+    #[test]
+    fn an_empty_reply_and_a_repeated_one_add_nothing() {
+        assert!(note_for(&reply("kari@x.no", "   \n "), &record("kari@x.no")).unwrap_err().contains("no text"));
+
+        let mut already = record("kari@x.no");
+        already.notes.push(note_for(&reply("kari@x.no", "It is fixed."), &already).unwrap());
+        let err = note_for(&reply("kari@x.no", "It is fixed."), &already).unwrap_err();
+        assert!(err.contains("already on the record"), "{err}");
+    }
+
+    #[test]
+    fn a_reply_from_a_contract_this_portal_does_not_know_is_refused() {
+        let mut future = reply("kari@x.no", "hello");
+        future.v = CONTRACT + 1;
+        assert!(note_for(&future, &record("kari@x.no")).unwrap_err().contains("contract"));
+    }
+
+    #[test]
+    fn an_address_is_read_out_of_whatever_the_mail_server_said() {
+        assert_eq!(address_of("Kari Nordmann <Kari@X.no>"), "kari@x.no");
+        assert_eq!(address_of("  kari@x.no "), "kari@x.no");
+        assert_eq!(address_of("<kari@x.no>"), "kari@x.no");
+        // A display name that looks like an address is not the address.
+        assert_eq!(address_of("\"admin@bank.no\" <kari@x.no>"), "kari@x.no");
+    }
+}

src/main.rs

@@ -10,7 +10,7 @@ async fn main() -> anyhow::Result<()> {
     use portal::upload::{self, Garage};
     use std::sync::Arc;
     use tower_http::services::{ServeDir, ServeFile};
-    use tower_sessions::{MemoryStore, SessionManagerLayer};
+    use tower_sessions::SessionManagerLayer;
 
     dotenvy::dotenv().ok();
     tracing_subscriber::fmt()
@@ -37,6 +37,7 @@ async fn main() -> anyhow::Result<()> {
     content::validate_questions(&questions, &aggregates)?;
     let site = content::load_site_from_gitea(&content_repo, &content_branch).await?;
     tracing::info!(count = questions.len(), repo = %content_repo, branch = %content_branch, "loaded content");
+    let access = Arc::new(arc_swap::ArcSwap::from_pointee(portal::access::Policy::from_content(&questions, &aggregates)));
     let questions = Arc::new(arc_swap::ArcSwap::from_pointee(questions));
     let aggregates = Arc::new(arc_swap::ArcSwap::from_pointee(aggregates));
     let site = Arc::new(arc_swap::ArcSwap::from_pointee(site));
@@ -59,6 +60,14 @@ async fn main() -> anyhow::Result<()> {
     // into, and `answers::store_answer` creates it on first use.
     let jetstream = async_nats::jetstream::new(nats.clone());
     portal::events::store::ensure_stream(&jetstream).await?;
+    // Outgoing mail waits here for gdo; a mail is never lost to gdo
+    // being down, and never sent by portal itself.
+    // Best-effort: a stream that already owns these subjects under an
+    // older name (a rename mid-upgrade) must not keep a site from
+    // booting; mail waits until the old stream is removed.
+    if let Err(e) = portal::mail::ensure_stream(&jetstream).await {
+        tracing::warn!("the mail stream could not be created: {e} - outgoing mail is off until a stream owns portal.mail.>");
+    }
 
     let oidc_state = Arc::new(oidc::Oidc::from_env().await?);
 
@@ -75,7 +84,10 @@ async fn main() -> anyhow::Result<()> {
         questions.clone(),
         aggregates.clone(),
         site.clone(),
+        access.clone(),
     ));
+    // The same decisions, answerable by other apps over NATS.
+    tokio::spawn(portal::access::serve(nats.clone(), site_name_for_subjects(), access.clone()));
 
     let state = AppState {
         leptos_options: leptos_options.clone(),
@@ -84,6 +96,7 @@ async fn main() -> anyhow::Result<()> {
         questions,
         aggregates,
         site,
+        access,
         gitea_base,
         content_raw_base,
         content_branch: content_branch.clone(),
@@ -94,6 +107,12 @@ async fn main() -> anyhow::Result<()> {
     // Announced pages: keep their desk records current, close ended
     // windows (see announce.rs).
     tokio::spawn(portal::announce::run(state.clone()));
+    tokio::spawn(portal::deadlines::run(state.clone()));
+
+    // Replies to case mail, matched to their record by whatever reads
+    // the mailbox (uhhm/gdo over JMAP) and turned into notes here. A
+    // site with no mailbox simply never sees a message on the subject.
+    tokio::spawn(portal::mail::receive(state.clone()));
 
     // Dev-friendly defaults: in-memory sessions, secure cookies only when
     // COOKIE_SECURE=true (set it behind TLS in production) - same
@@ -108,11 +127,50 @@ async fn main() -> anyhow::Result<()> {
     let cookie_secure = std::env::var("COOKIE_SECURE")
         .map(|v| v == "true" || v == "1")
         .unwrap_or(false);
-    let session_layer = SessionManagerLayer::new(MemoryStore::default())
+    // Sessions live in the same JetStream as everything else, so a
+    // deploy no longer signs out every desk on the site it deploys.
+    let session_store = portal::sessions::NatsStore::open(&state.jetstream).await?;
+    let session_layer = SessionManagerLayer::new(session_store)
         .with_secure(cookie_secure)
         .with_same_site(tower_sessions::cookie::SameSite::Lax)
         .with_name("portal_session");
 
+    // What a person does costs a little; what a script does costs a
+    // lot. A burst of 30 with one refilled every two seconds is well
+    // above anything a visitor filling in a form will reach - a page
+    // load fetches several resources at once - and well below what it
+    // takes to be a nuisance. Per caller IP, in memory, no store: this
+    // is a fence, not an accounting system, and the fence that matters
+    // for uploads is the policy check on the route itself.
+    //
+    // PORTAL_RATE_PER_SECOND / PORTAL_RATE_BURST retune it per site;
+    // 0 for either turns it off, for an instance behind something that
+    // already does this.
+    let rate_seconds: u64 = std::env::var("PORTAL_RATE_SECONDS")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(2);
+    let rate_burst: u32 = std::env::var("PORTAL_RATE_BURST")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(30);
+    let governor = (rate_seconds > 0 && rate_burst > 0).then(|| {
+        // SmartIpKeyExtractor reads X-Forwarded-For/X-Real-IP, which is
+        // what every one of these instances is behind; it falls back to
+        // the socket address when neither is set.
+        let conf = tower_governor::governor::GovernorConfigBuilder::default()
+            .per_second(rate_seconds)
+            .burst_size(rate_burst)
+            .key_extractor(tower_governor::key_extractor::SmartIpKeyExtractor)
+            .finish()
+            .expect("a rate limit of at least one per second and a burst of at least one");
+        std::sync::Arc::new(conf)
+    });
+    match &governor {
+        Some(_) => tracing::info!(rate_seconds, rate_burst, "rate limiting per caller IP"),
+        None => tracing::warn!("rate limiting is off (PORTAL_RATE_SECONDS or PORTAL_RATE_BURST is 0)"),
+    }
+
     async fn server_fn_handler(
         State(state): State<AppState>,
         request: Request<Body>,
@@ -138,6 +196,10 @@ async fn main() -> anyhow::Result<()> {
     let favicon_dark_path = format!("{}/favicon-dark.svg", leptos_options.site_root);
     let wordmark_path = format!("{}/wordmark.svg", leptos_options.site_root);
     let swiper_path = format!("{}/swiper-element-bundle.min.js", leptos_options.site_root);
+    // Vendored, not loaded from a CDN: a map must not be the one thing
+    // on the page that phones a stranger.
+    let maplibre_js = format!("{}/maplibre-gl.js", leptos_options.site_root);
+    let maplibre_css = format!("{}/maplibre-gl.css", leptos_options.site_root);
     let fonts_dir = format!("{}/fonts", leptos_options.site_root);
 
     let app = Router::new()
@@ -145,11 +207,27 @@ async fn main() -> anyhow::Result<()> {
         .route("/auth/callback", get(oidc::callback))
         .route("/auth/logout", get(oidc::logout))
         .route("/api/{*fn_name}", any(server_fn_handler))
-        .route("/upload", post(upload::upload))
+        // axum caps request bodies at 2 MB by default, which had made the
+        // 20 MB upload limit unreachable; raise the fence on this route only,
+        // with room for the multipart framing.
+        .route(
+            "/upload",
+            post(upload::upload).layer(axum::extract::DefaultBodyLimit::max(upload::MAX_UPLOAD_BYTES + 64 * 1024)),
+        )
+        .route(
+            "/attachment/{bucket}/{record}/{field}",
+            get(upload::attachment),
+        )
         .route("/gitea-repo", get(content::gitea_repo_handler))
         // Content-shipped assets (hero module etc.), same-origin.
         .route("/site/{*path}", get(content::site_asset_handler))
         .route("/automation/kv/{bucket}", get(content::automation_kv_handler))
+        // Maps, proxied: the browser asks this origin for every tile
+        // and every still, so nothing third-party loads in a page and
+        // the token stays here (see maps.rs).
+        .route("/map/style.json", get(portal::maps::style))
+        .route("/map/tiles/{z}/{x}/{y}", get(portal::maps::tile))
+        .route("/map/still/{place}/{size}", get(portal::maps::still))
         // no-cache = "revalidate before reuse", not "don't cache":
         // pkg files keep the same names across releases (portal.js,
         // portal.wasm), and without this browsers heuristically cache
@@ -174,6 +252,8 @@ async fn main() -> anyhow::Result<()> {
             "/swiper-element-bundle.min.js",
             ServeFile::new(swiper_path),
         )
+        .route_service("/maplibre-gl.js", ServeFile::new(maplibre_js))
+        .route_service("/maplibre-gl.css", ServeFile::new(maplibre_css))
         .leptos_routes_with_context(
             &state,
             routes,
@@ -187,8 +267,14 @@ async fn main() -> anyhow::Result<()> {
             },
         )
         .fallback(leptos_axum::file_and_error_handler::<AppState, _>(shell))
-        .layer(session_layer)
-        .with_state(state);
+        .layer(session_layer);
+    // Outermost, so a caller who is over the limit is turned away
+    // before a session is loaded or a handler is entered.
+    let app = match governor {
+        Some(conf) => app.layer(tower_governor::GovernorLayer::new(conf)),
+        None => app,
+    }
+    .with_state(state);
 
     tracing::info!("listening on http://{addr}");
     let listener = tokio::net::TcpListener::bind(&addr).await?;
@@ -201,3 +287,15 @@ fn main() {
     // The browser build is a cdylib; this stub only exists so `cargo check`
     // without features still succeeds.
 }
+
+#[cfg(feature = "ssr")]
+/// The site's name in NATS subjects (`portal.access.<site>.may`):
+/// `SITE_NAME`, folded to what a subject token allows.
+fn site_name_for_subjects() -> String {
+    let raw = std::env::var("SITE_NAME").unwrap_or_else(|_| "portal".to_string());
+    let folded: String = raw
+        .chars()
+        .map(|c| if c.is_ascii_alphanumeric() || c == '_' || c == '-' { c.to_ascii_lowercase() } else { '_' })
+        .collect();
+    if folded.is_empty() { "portal".to_string() } else { folded }
+}

src/maps.rs

@@ -0,0 +1,246 @@
+//! Maps, served entirely from this origin.
+//!
+//! A `type: location` field lets someone put a pin on a map, and a
+//! record that holds one shows where it is. Both need tiles, and tiles
+//! come from Mapbox - but the visitor's browser never talks to Mapbox:
+//! portal fetches every tile and every static image itself, with the
+//! token kept server-side. Nothing third-party loads in the page, so
+//! there is no third-party cookie, no consent banner, and no address
+//! book of who looked at which hazard.
+//!
+//! `MAPBOX_TOKEN` unset means the whole feature is off: the field
+//! degrades to two number inputs and a stored location renders as its
+//! coordinates, the same fail-closed shape uploads take without
+//! `GARAGE_*`.
+//!
+//! Only the proxy handlers are server-side; reading a stored location
+//! and addressing its still are needed in the browser too, where the
+//! desks and the public lists render.
+
+#[cfg(feature = "ssr")]
+use axum::extract::Path;
+#[cfg(feature = "ssr")]
+use axum::http::{header, StatusCode};
+#[cfg(feature = "ssr")]
+use axum::response::{IntoResponse, Response};
+
+/// Where the still of one location lives on this origin. The path is
+/// the same shape the handler parses back out.
+pub fn still_url(lat: f64, lon: f64, zoom: f64, width: u32, height: u32) -> String {
+    format!("/map/still/{lon:.5},{lat:.5},{zoom:.2}/{width}x{height}")
+}
+
+/// A Mapbox style, as `<owner>/<style-id>`. Overridable per instance
+/// (`MAPBOX_STYLE`); anything that is not two plain segments is
+/// ignored, since it goes into a URL path.
+#[cfg(feature = "ssr")]
+fn style_id() -> String {
+    std::env::var("MAPBOX_STYLE")
+        .ok()
+        .filter(|s| {
+            let mut parts = s.split('/');
+            let (Some(owner), Some(id), None) = (parts.next(), parts.next(), parts.next()) else {
+                return false;
+            };
+            [owner, id].iter().all(|p| !p.is_empty() && p.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_'))
+        })
+        .unwrap_or_else(|| "mapbox/streets-v12".to_string())
+}
+
+/// The instance's Mapbox token, or `None` when maps are off.
+#[cfg(feature = "ssr")]
+pub fn token() -> Option<String> {
+    std::env::var("MAPBOX_TOKEN").ok().filter(|t| !t.trim().is_empty())
+}
+
+#[cfg(feature = "ssr")]
+pub fn enabled() -> bool {
+    token().is_some()
+}
+
+/// Everything MapLibre needs, pointed back at this origin: raster
+/// tiles, so there are no sprite or glyph URLs to rewrite and no
+/// second round of proxying. The labels are baked into the tiles.
+#[cfg(feature = "ssr")]
+pub async fn style() -> Response {
+    if !enabled() {
+        return (StatusCode::NOT_FOUND, "maps are not configured on this instance").into_response();
+    }
+    let style = serde_json::json!({
+        "version": 8,
+        "sources": {
+            "base": {
+                "type": "raster",
+                "tiles": ["/map/tiles/{z}/{x}/{y}"],
+                "tileSize": 512,
+                "attribution": "© <a href=\"https://www.mapbox.com/about/maps/\">Mapbox</a> © <a href=\"https://www.openstreetmap.org/copyright\">OpenStreetMap</a>",
+            }
+        },
+        "layers": [{ "id": "base", "type": "raster", "source": "base" }],
+    });
+    (
+        [(header::CONTENT_TYPE, "application/json"), (header::CACHE_CONTROL, "public, max-age=3600")],
+        style.to_string(),
+    )
+        .into_response()
+}
+
+/// One raster tile. The path is three integers and nothing else, so
+/// there is no way to steer the upstream request anywhere but a tile.
+#[cfg(feature = "ssr")]
+pub async fn tile(Path((z, x, y)): Path<(u32, u32, u32)>) -> Response {
+    let Some(token) = token() else {
+        return (StatusCode::NOT_FOUND, "maps are not configured on this instance").into_response();
+    };
+    if z > 22 || x >= 1 << z.min(22) || y >= 1 << z.min(22) {
+        return (StatusCode::BAD_REQUEST, "no such tile").into_response();
+    }
+    let url = format!(
+        "https://api.mapbox.com/styles/v1/{}/tiles/512/{z}/{x}/{y}?access_token={token}",
+        style_id()
+    );
+    fetch(&url, "image/png", "public, max-age=86400").await
+}
+
+/// A still map of one point, for a record that holds a location: an
+/// image, so a list of twenty of them costs no JavaScript at all.
+/// `{place}` is `<lon>,<lat>,<zoom>` and `{size}` is `<w>x<h>`.
+#[cfg(feature = "ssr")]
+pub async fn still(Path((place, size)): Path<(String, String)>) -> Response {
+    let Some(token) = token() else {
+        return (StatusCode::NOT_FOUND, "maps are not configured on this instance").into_response();
+    };
+    let Some((lon, lat, zoom)) = parse_place(&place) else {
+        return (StatusCode::BAD_REQUEST, "expected <lon>,<lat>,<zoom>").into_response();
+    };
+    let Some((w, h)) = parse_size(&size) else {
+        return (StatusCode::BAD_REQUEST, "expected <width>x<height>, at most 1280").into_response();
+    };
+    // The pin is drawn by Mapbox so the image is self-contained; the
+    // marker colour is portal's ink, not a brand colour.
+    let url = format!(
+        "https://api.mapbox.com/styles/v1/{}/static/pin-s+3c3c3a({lon},{lat})/{lon},{lat},{zoom},0/{w}x{h}@2x?access_token={token}",
+        style_id()
+    );
+    fetch(&url, "image/png", "public, max-age=604800").await
+}
+
+#[cfg(feature = "ssr")]
+async fn fetch(url: &str, mime: &'static str, cache: &'static str) -> Response {
+    let resp = match crate::http::client().get(url).send().await.and_then(|r| r.error_for_status()) {
+        Ok(r) => r,
+        Err(e) => {
+            tracing::warn!("map upstream: {e}");
+            return (StatusCode::BAD_GATEWAY, "the map service did not answer").into_response();
+        }
+    };
+    let upstream = resp
+        .headers()
+        .get(openidconnect::reqwest::header::CONTENT_TYPE)
+        .and_then(|v| v.to_str().ok())
+        .filter(|v| v.starts_with("image/"))
+        .map(str::to_string);
+    match crate::http::bytes(resp, crate::http::ASSET_CAP).await {
+        Ok(bytes) => (
+            [
+                (header::CONTENT_TYPE, upstream.unwrap_or_else(|| mime.to_string())),
+                (header::CACHE_CONTROL, cache.to_string()),
+            ],
+            axum::body::Bytes::from(bytes),
+        )
+            .into_response(),
+        Err(e) => (StatusCode::BAD_GATEWAY, e.to_string()).into_response(),
+    }
+}
+
+/// `<lon>,<lat>,<zoom>`, each a plain number in range. Formatted back
+/// out rather than passed through, so nothing of the caller's string
+/// reaches the upstream URL.
+#[cfg(feature = "ssr")]
+fn parse_place(place: &str) -> Option<(String, String, String)> {
+    let mut parts = place.split(',');
+    let (Some(lon), Some(lat), Some(zoom), None) = (parts.next(), parts.next(), parts.next(), parts.next()) else {
+        return None;
+    };
+    let lon: f64 = lon.parse().ok()?;
+    let lat: f64 = lat.parse().ok()?;
+    let zoom: f64 = zoom.parse().ok()?;
+    if !(-180.0..=180.0).contains(&lon) || !(-85.0511..=85.0511).contains(&lat) || !(0.0..=22.0).contains(&zoom) {
+        return None;
+    }
+    Some((format!("{lon:.5}"), format!("{lat:.5}"), format!("{zoom:.2}")))
+}
+
+#[cfg(feature = "ssr")]
+fn parse_size(size: &str) -> Option<(u32, u32)> {
+    let (w, h) = size.split_once('x')?;
+    let (w, h): (u32, u32) = (w.parse().ok()?, h.parse().ok()?);
+    (1..=1280).contains(&w).then_some(())?;
+    (1..=1280).contains(&h).then_some(())?;
+    Some((w, h))
+}
+
+/// The `{lat, lon, zoom}` a `type: location` field stores, read back
+/// out of a record. Anything else is not a location.
+pub fn read(value: &serde_json::Value) -> Option<(f64, f64, f64)> {
+    let obj = value.as_object()?;
+    let num = |k: &str| obj.get(k).and_then(serde_json::Value::as_f64);
+    let (lat, lon) = (num("lat")?, num("lon")?);
+    if !(-90.0..=90.0).contains(&lat) || !(-180.0..=180.0).contains(&lon) {
+        return None;
+    }
+    Some((lat, lon, num("zoom").unwrap_or(13.0).clamp(0.0, 22.0)))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    #[cfg(feature = "ssr")]
+    fn a_place_is_three_numbers_in_range_and_is_reformatted() {
+        assert_eq!(
+            parse_place("11.123456,59.987654,13.5"),
+            Some(("11.12346".into(), "59.98765".into(), "13.50".into()))
+        );
+        for bad in ["11,59", "11,59,13,0", "200,59,13", "11,95,13", "11,59,30", "11,59,x", "11,59,13?a=b"] {
+            assert_eq!(parse_place(bad), None, "{bad}");
+        }
+    }
+
+    #[test]
+    #[cfg(feature = "ssr")]
+    fn a_size_is_two_numbers_within_what_the_service_draws() {
+        assert_eq!(parse_size("600x300"), Some((600, 300)));
+        for bad in ["600", "0x300", "600x0", "2000x300", "600x2000", "600x300x2", "sixx300"] {
+            assert_eq!(parse_size(bad), None, "{bad}");
+        }
+    }
+
+    #[test]
+    fn a_location_is_a_lat_and_a_lon_and_a_zoom_it_may_leave_out() {
+        let v = serde_json::json!({ "lat": 59.5, "lon": 11.0, "zoom": 16 });
+        assert_eq!(read(&v), Some((59.5, 11.0, 16.0)));
+        assert_eq!(read(&serde_json::json!({ "lat": 59.5, "lon": 11.0 })), Some((59.5, 11.0, 13.0)));
+        for not in [
+            serde_json::json!({ "lat": 91.0, "lon": 11.0 }),
+            serde_json::json!({ "lat": 59.5 }),
+            serde_json::json!("59.5, 11.0"),
+            serde_json::Value::Null,
+        ] {
+            assert_eq!(read(&not), None);
+        }
+    }
+
+    #[test]
+    #[cfg(feature = "ssr")]
+    fn a_style_id_is_two_plain_segments_or_the_default() {
+        std::env::set_var("MAPBOX_STYLE", "mapbox/outdoors-v12");
+        assert_eq!(style_id(), "mapbox/outdoors-v12");
+        for bad in ["../../secrets", "mapbox/streets-v12?x=1", "mapbox", "a/b/c"] {
+            std::env::set_var("MAPBOX_STYLE", bad);
+            assert_eq!(style_id(), "mapbox/streets-v12", "{bad}");
+        }
+        std::env::remove_var("MAPBOX_STYLE");
+    }
+}

src/people.rs

@@ -0,0 +1,282 @@
+//! Onboarding a person into Kanidm from a desk, without an admin
+//! session: create the account, record their email, add them to the
+//! group, and mint a one-time link where they set their own password
+//! or passkey. Kanidm has no self-registration by design; a member of
+//! the business vouching for each person is the intended shape, and
+//! this is that, as a form.
+//!
+//! Talks to Kanidm's REST API with a service-account token
+//! (`KANIDM_API_TOKEN`, read-write) through the bounded client. The
+//! service account belongs to `idm_people_on_boarding`, which may
+//! create persons and issue first-credential resets and nothing else,
+//! so a leaked token cannot touch existing credentials or admins.
+#![cfg(feature = "ssr")]
+
+use serde::{Deserialize, Serialize};
+
+pub const INVITES_BUCKET: &str = "portal_invites";
+pub const INVITED_SUBJECT: &str = "portal.people.invited";
+
+/// What an invite produced: the account, and the link that sets it up.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct Invited {
+    pub username: String,
+    pub display_name: String,
+    pub email: String,
+    pub group: String,
+    /// Absent when the person already had an account: they were added
+    /// to the group and their credentials were left alone.
+    pub reset_link: Option<String>,
+    pub link_expires_ms: Option<i64>,
+    pub created: bool,
+}
+
+/// Whether a `GET /v1/person/<name>` answer means the person exists.
+/// Kanidm 1.11 answers a missing person with 200 and the body `null`
+/// rather than 404, so the status alone would report everyone as
+/// existing and no account would ever get created. `None` for an
+/// answer that is neither.
+fn person_lookup_found(status: u16, body: &str) -> Option<bool> {
+    match status {
+        200 => Some(body.trim() != "null" && !body.trim().is_empty()),
+        404 => Some(false),
+        _ => None,
+    }
+}
+
+/// The first entry's `name` in a `/v1/raw/search` answer, which is
+/// `{"entries": [{"attrs": {"name": ["…"], …}}]}`.
+fn name_from_search(body: &str) -> Option<String> {
+    let v: serde_json::Value = serde_json::from_str(body).ok()?;
+    v.get("entries")?.as_array()?.first()?.get("attrs")?.get("name")?.as_array()?.first()?.as_str().map(str::to_string)
+}
+
+pub struct Kanidm {
+    base: String,
+    token: String,
+}
+
+impl Kanidm {
+    /// `None` when `KANIDM_API_TOKEN` is unset: invites fail closed with
+    /// a clear message instead of a half-made account.
+    pub fn from_env() -> Option<Self> {
+        let base = std::env::var("KANIDM_URL").ok()?.trim_end_matches('/').to_string();
+        let token = std::env::var("KANIDM_API_TOKEN").ok().filter(|t| !t.is_empty())?;
+        Some(Kanidm { base, token })
+    }
+
+    async fn call(&self, method: openidconnect::reqwest::Method, path: &str, body: Option<serde_json::Value>) -> anyhow::Result<(u16, String)> {
+        let mut req = crate::http::client()
+            .request(method, format!("{}{path}", self.base))
+            .bearer_auth(&self.token)
+            .header("content-type", "application/json");
+        if let Some(body) = body {
+            req = req.body(serde_json::to_vec(&body)?);
+        }
+        let response = req.send().await?;
+        let status = response.status().as_u16();
+        let text = crate::http::text(response, crate::http::GITEA_CAP).await?;
+        Ok((status, text))
+    }
+
+    async fn person_exists(&self, username: &str) -> anyhow::Result<bool> {
+        let (status, text) = self.call(openidconnect::reqwest::Method::GET, &format!("/v1/person/{username}"), None).await?;
+        person_lookup_found(status, &text).ok_or_else(|| anyhow::anyhow!("kanidm: looking up {username}: http {status}"))
+    }
+
+    /// The account that already carries this email, if the token may
+    /// see it (the service account in `idm_people_pii_read`). None
+    /// when nobody has it, or when the search is not permitted: then
+    /// the username derived from the email decides, as before.
+    async fn find_by_mail(&self, email: &str) -> anyhow::Result<Option<String>> {
+        let (status, text) = self
+            .call(
+                openidconnect::reqwest::Method::POST,
+                "/v1/raw/search",
+                Some(serde_json::json!({ "filter": { "eq": ["mail", email.trim().to_lowercase()] } })),
+            )
+            .await?;
+        if !(200..300).contains(&status) {
+            tracing::warn!(status, "kanidm: searching people by mail is not permitted for this token; matching by username instead");
+            return Ok(None);
+        }
+        Ok(name_from_search(&text))
+    }
+
+    /// The whole onboarding, in the order that leaves the least behind
+    /// if a step fails: find or create, then email, then group, then
+    /// the link. A person who already has an account, under whatever
+    /// username, is only added to the group; their credentials are
+    /// left alone and no link is made.
+    pub async fn invite(&self, name: &str, email: &str, group: &str) -> anyhow::Result<Invited> {
+        let existing = self.find_by_mail(email).await?;
+        let username = existing.clone().unwrap_or_else(|| username_for(email));
+        let created = if existing.is_some() || self.person_exists(&username).await? {
+            false
+        } else {
+            let (status, text) = self
+                .call(
+                    openidconnect::reqwest::Method::POST,
+                    "/v1/person",
+                    Some(serde_json::json!({ "attrs": { "name": [username], "displayname": [name] } })),
+                )
+                .await?;
+            if !(200..300).contains(&status) {
+                anyhow::bail!("kanidm: creating {username}: http {status}: {text}");
+            }
+            let (status, text) = self
+                .call(openidconnect::reqwest::Method::PUT, &format!("/v1/person/{username}/_attr/mail"), Some(serde_json::json!([email])))
+                .await?;
+            if !(200..300).contains(&status) {
+                anyhow::bail!("kanidm: setting mail on {username}: http {status}: {text}");
+            }
+            true
+        };
+        let (status, text) = self
+            .call(openidconnect::reqwest::Method::POST, &format!("/v1/group/{group}/_attr/member"), Some(serde_json::json!([username])))
+            .await?;
+        if !(200..300).contains(&status) {
+            anyhow::bail!("kanidm: adding {username} to {group}: http {status}: {text}");
+        }
+        let (reset_link, link_expires_ms) = if created {
+            // 24 hours: the longest Kanidm allows, since the link travels
+            // by email and is read when the person gets to it.
+            let (status, text) = self
+                .call(openidconnect::reqwest::Method::GET, &format!("/v1/person/{username}/_credential/_update_intent/86400"), None)
+                .await?;
+            if !(200..300).contains(&status) {
+                anyhow::bail!("kanidm: reset token for {username}: http {status}: {text}");
+            }
+            #[derive(Deserialize)]
+            struct Intent {
+                token: String,
+                #[serde(default)]
+                expiry_time: Option<serde_json::Value>,
+            }
+            let intent: Intent = serde_json::from_str(&text)?;
+            let expires = intent.expiry_time.as_ref().and_then(|v| v.as_str()).and_then(|s| chrono::DateTime::parse_from_rfc3339(s).ok()).map(|t| t.timestamp_millis());
+            (Some(format!("{}/ui/reset?token={}", self.base, intent.token)), expires)
+        } else {
+            (None, None)
+        };
+        Ok(Invited {
+            username,
+            display_name: name.to_string(),
+            email: email.to_string(),
+            group: group.to_string(),
+            reset_link,
+            link_expires_ms,
+            created,
+        })
+    }
+}
+
+/// A Kanidm account name from an email: the local part, lowercased,
+/// anything outside `[a-z0-9._-]` folded to `-`, led by a letter.
+pub fn username_for(email: &str) -> String {
+    let local = email.split('@').next().unwrap_or(email).to_lowercase();
+    let mut out: String = local
+        .chars()
+        .map(|c| if c.is_ascii_lowercase() || c.is_ascii_digit() || matches!(c, '.' | '_' | '-') { c } else { '-' })
+        .collect();
+    while out.starts_with(|c: char| !c.is_ascii_lowercase()) && !out.is_empty() {
+        out.remove(0);
+    }
+    if out.is_empty() {
+        "person".to_string()
+    } else {
+        out
+    }
+}
+
+/// The person a record is about, for a state that grants a group.
+/// Both are required by the lint of any form that fills such a bucket
+/// (see `validate_questions`), so a record missing either is one that
+/// predates the rule, and is reported rather than guessed at.
+pub fn who_for(responses: &serde_json::Value) -> Option<(String, String)> {
+    let field = |name: &str| {
+        responses
+            .get(name)
+            .and_then(|v| v.as_str())
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+            .map(String::from)
+    };
+    let email = field("email").filter(|e| e.contains('@'))?;
+    Some((field("name")?, email))
+}
+
+/// A record entered `state`: if that state grants a group, put the
+/// person the record is about in it. The decision the desk already
+/// pressed is the whole ceremony - an approval that means membership
+/// should not also need somebody to remember to invite them.
+///
+/// Best-effort, exactly like the mail beside it: the transition is
+/// committed either way, and an instance with no Kanidm configured
+/// simply grants nothing and says so once per occurrence.
+pub async fn on_state(
+    state: &crate::server::AppState,
+    bucket: &str,
+    id: &str,
+    to_state: &str,
+    responses: &serde_json::Value,
+) {
+    let Some(group) = state
+        .aggregates
+        .load()
+        .get(bucket)
+        .and_then(|s| s.grants_for(to_state).map(str::to_string))
+    else {
+        return;
+    };
+    let Some(kanidm) = Kanidm::from_env() else {
+        tracing::warn!(bucket, id, to_state, group, "this state grants a group, but invites are not configured on this instance (KANIDM_API_TOKEN) - nobody was added");
+        return;
+    };
+    let Some((name, email)) = who_for(responses) else {
+        tracing::warn!(bucket, id, to_state, group, "this state grants a group, but the record carries no name and email - nobody was added");
+        return;
+    };
+    let invited = match kanidm.invite(&name, &email, &group).await {
+        Ok(invited) => invited,
+        Err(e) => {
+            tracing::error!(bucket, id, to_state, group, "granting the group failed: {e}");
+            return;
+        }
+    };
+    if let Ok(bytes) = serde_json::to_vec(&invited) {
+        let _ = state.nats.publish(INVITED_SUBJECT, bytes.into()).await;
+    }
+    crate::mail::on_invite(state, &invited).await;
+    tracing::info!(bucket, id, to_state, group, user = %invited.username, created = invited.created, "the decision granted a group");
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn usernames_are_the_email_local_part_made_safe() {
+        assert_eq!(username_for("jorn@westra-engineering.no"), "jorn");
+        assert_eq!(username_for("Ole.Nordmann+site@Example.com"), "ole.nordmann-site");
+        assert_eq!(username_for("42@x.no"), "person");
+        assert_eq!(username_for("Ærlig@x.no"), "rlig");
+    }
+
+    #[test]
+    fn a_search_by_mail_yields_the_accounts_own_name() {
+        assert_eq!(name_from_search(r#"{"entries":[{"attrs":{"name":["ole.n"],"mail":["ole@x.no"]}}]}"#), Some("ole.n".into()));
+        assert_eq!(name_from_search(r#"{"entries":[]}"#), None);
+        assert_eq!(name_from_search("null"), None);
+        assert_eq!(name_from_search("not json"), None);
+    }
+
+    #[test]
+    fn a_null_person_answer_means_nobody_there() {
+        assert_eq!(person_lookup_found(200, "null"), Some(false));
+        assert_eq!(person_lookup_found(200, "null\n"), Some(false));
+        assert_eq!(person_lookup_found(200, r#"{"attrs":{"name":["bl"]}}"#), Some(true));
+        assert_eq!(person_lookup_found(404, ""), Some(false));
+        assert_eq!(person_lookup_found(401, "unauthorized"), None);
+    }
+}

src/resource.rs

@@ -13,7 +13,7 @@ use leptos::prelude::*;
 /// `public: true` nor `requires_group` set is unreachable, not "open"
 /// by omission. `params` are the requesting form's current field
 /// values (if any) - forwarded as query parameters to a live external
-/// fetch (`GiteaStarred`/`GiteaOrgRepos`/`Url`), the mechanism behind
+/// fetch (`GiteaStarred`/`GiteaReleases`/`Url`), the mechanism behind
 /// "a resource parameterized by other form fields"; a `Kv` resource
 /// ignores them entirely, same as today.
 #[server(endpoint = "get_resource")]
@@ -38,7 +38,7 @@ pub async fn get_resource(
         .resource
         .as_ref()
         .ok_or_else(|| ServerFnError::new("feature has no resource"))?;
-    authorize_resource(resource).await?;
+    authorize_resource(&state, &question_id, &alternative, &feature_name).await?;
     fetch_resource_value(&state, resource, &params).await
 }
 
@@ -82,7 +82,7 @@ pub async fn get_requirement_options(
         .resource
         .as_ref()
         .ok_or_else(|| ServerFnError::new("requirement has no resource"))?;
-    authorize_resource(resource).await?;
+    authorize_resource(&state, &question_id, &alternative, &format!("{feature_name}|{requirement_name}")).await?;
     fetch_resource_value(&state, resource, &params).await
 }
 
@@ -113,7 +113,7 @@ pub async fn get_requirement_binding(
         .bind
         .as_ref()
         .ok_or_else(|| ServerFnError::new("requirement has no binding"))?;
-    authorize_resource(&bind.resource).await?;
+    authorize_resource(&state, &question_id, &alternative, &format!("{feature_name}|{requirement_name}|bind")).await?;
     fetch_resource_value(&state, &bind.resource, &params).await
 }
 
@@ -152,26 +152,84 @@ fn find_feature(
 }
 
 #[cfg(feature = "ssr")]
-async fn authorize_resource(resource: &crate::content::ResourceSpec) -> Result<(), ServerFnError> {
+async fn authorize_resource(
+    state: &crate::server::AppState,
+    question_id: &str,
+    alternative: &str,
+    feature: &str,
+) -> Result<(), ServerFnError> {
+    use crate::access::{decide_and_publish, Action, Principal, Resource};
     use crate::auth::{User, SESSION_USER_KEY};
 
-    if resource.public {
-        return Ok(());
-    }
-    let group = resource
-        .requires_group
-        .as_deref()
-        .ok_or_else(|| ServerFnError::new("resource is not accessible"))?;
     let session: tower_sessions::Session = leptos_axum::extract().await?;
     let user = session
         .get::<User>(SESSION_USER_KEY)
         .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?
-        .ok_or_else(|| ServerFnError::new("not signed in"))?;
-    if !user.groups.iter().any(|g| g == group) {
-        return Err(ServerFnError::new("not authorized"));
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let resource = Resource::Feature {
+        page: question_id.to_string(),
+        alternative: alternative.to_string(),
+        feature: feature.to_string(),
+    };
+    let decision = decide_and_publish(
+        &state.nats,
+        &state.access.load(),
+        &Principal::from_user(user.as_ref()),
+        Action::Read,
+        &resource,
+        serde_json::json!({}),
+    );
+    if decision.allow {
+        Ok(())
+    } else if user.is_none() {
+        Err(ServerFnError::new("not signed in"))
+    } else {
+        Err(ServerFnError::new("not authorized"))
+    }
+}
+
+/// Whether a stored record passes the resource's `states` filter. No
+/// filter shows everything, which is what every resource written
+/// before this existed means. A record with no `state` at all is not
+/// an aggregate and is left alone.
+#[cfg(feature = "ssr")]
+fn shows_state(resource: &crate::content::ResourceSpec, value: &serde_json::Value) -> bool {
+    if resource.states.is_empty() {
+        return true;
+    }
+    match value.get("state").and_then(|s| s.as_str()) {
+        Some(state) => resource.states.iter().any(|s| s == state),
+        None => true,
+    }
+}
+
+/// Whether a stored record passes the resource's `where` filter. The
+/// field is looked for in the record's `responses`, which is where a
+/// form's answers live, and then on the record itself, so a listing
+/// can be narrowed by what was submitted or by what the runtime
+/// stamped on it. A missing field never matches: "everything that did
+/// not say" is not something a page should be able to ask for by
+/// accident.
+#[cfg(feature = "ssr")]
+fn matches_filter(
+    resource: &crate::content::ResourceSpec,
+    value: &serde_json::Value,
+    params: &std::collections::HashMap<String, String>,
+) -> bool {
+    let Some(filter) = &resource.filter else {
+        return true;
+    };
+    let wanted = crate::content::template_action(&filter.equals, &serde_json::json!(params))
+        .unwrap_or_else(|| filter.equals.clone());
+    let found = value
+        .get("responses")
+        .and_then(|r| r.get(&filter.field))
+        .or_else(|| value.get(&filter.field));
+    match found {
+        Some(serde_json::Value::String(s)) => s == &wanted,
+        Some(other) => other.to_string() == wanted,
+        None => false,
     }
-    Ok(())
 }
 
 #[cfg(feature = "ssr")]
@@ -202,7 +260,14 @@ async fn fetch_resource_value(
                         .await
                         .map_err(|e| ServerFnError::new(e.to_string()))?
                         .ok_or_else(|| ServerFnError::new("resource key not found"))?;
-                    serde_json::from_slice(&bytes).map_err(|e| ServerFnError::new(e.to_string()))?
+                    let value: serde_json::Value =
+                        serde_json::from_slice(&bytes).map_err(|e| ServerFnError::new(e.to_string()))?;
+                    // A state filter holds for one record as well as a
+                    // listing, or naming the key would walk around it.
+                    if !shows_state(resource, &value) || !matches_filter(resource, &value, params) {
+                        return Err(ServerFnError::new("resource key not found"));
+                    }
+                    value
                 }
                 (None, Some(store)) => {
                     use futures::TryStreamExt;
@@ -217,7 +282,9 @@ async fn fetch_resource_value(
                     for key in keys {
                         if let Ok(Some(bytes)) = store.get(&key).await {
                             if let Ok(value) = serde_json::from_slice::<serde_json::Value>(&bytes) {
-                                items.push(value);
+                                if shows_state(resource, &value) && matches_filter(resource, &value, params) {
+                                    items.push(value);
+                                }
                             }
                         }
                     }
@@ -228,9 +295,6 @@ async fn fetch_resource_value(
         ResourceSource::GiteaStarred { username } => {
             fetch_gitea_json(state, &format!("/api/v1/users/{username}/starred"), params).await?
         }
-        ResourceSource::GiteaOrgRepos { org } => {
-            fetch_gitea_json(state, &format!("/api/v1/orgs/{org}/repos"), params).await?
-        }
         ResourceSource::GiteaReleases { owner, repo } => {
             fetch_gitea_json(state, &format!("/api/v1/repos/{owner}/{repo}/releases"), params)
                 .await?
@@ -260,21 +324,20 @@ async fn fetch_gitea_json(
     for (k, v) in params {
         url.query_pairs_mut().append_pair(k, v);
     }
-    let client = openidconnect::reqwest::Client::new();
-    let mut req = client.get(url.clone());
+    let mut req = crate::http::client().get(url.clone());
     if let Ok(token) = std::env::var("GITEA_API_TOKEN") {
         if !token.is_empty() {
             req = req.header("Authorization", format!("token {token}"));
         }
     }
-    let text = req
+    let response = req
         .send()
         .await
         .and_then(|r| r.error_for_status())
-        .map_err(|e| ServerFnError::new(format!("fetching {url}: {e}")))?
-        .text()
+        .map_err(|e| ServerFnError::new(format!("fetching {url}: {e}")))?;
+    let text = crate::http::text(response, crate::http::GITEA_CAP)
         .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
+        .map_err(|e| ServerFnError::new(format!("reading {url}: {e}")))?;
     serde_json::from_str(&text).map_err(|e| ServerFnError::new(e.to_string()))
 }
 
@@ -341,16 +404,17 @@ async fn fetch_url_json(
     for (k, v) in &leftover {
         parsed.query_pairs_mut().append_pair(k, v);
     }
-    let client = openidconnect::reqwest::Client::new();
-    let text = client
+    let response = crate::http::client()
         .get(parsed.clone())
         .send()
         .await
         .and_then(|r| r.error_for_status())
-        .map_err(|e| ServerFnError::new(format!("fetching {parsed}: {e}")))?
-        .text()
+        .map_err(|e| ServerFnError::new(format!("fetching {parsed}: {e}")))?;
+    // Content picks the URL; the cap is what keeps a runaway endpoint
+    // from becoming a runaway allocation here.
+    let text = crate::http::text(response, crate::http::URL_RESOURCE_CAP)
         .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
+        .map_err(|e| ServerFnError::new(format!("reading {parsed}: {e}")))?;
     serde_json::from_str(&text).map_err(|e| ServerFnError::new(e.to_string()))
 }
 
@@ -456,6 +520,58 @@ pub fn apply_jq(
 mod tests {
     use super::*;
 
+    fn spec(yaml: &str) -> crate::content::ResourceSpec {
+        serde_yaml::from_str(yaml).unwrap()
+    }
+
+    fn record(state: &str, responses: serde_json::Value) -> serde_json::Value {
+        serde_json::json!({ "id": "r", "state": state, "responses": responses })
+    }
+
+    // A register that is public by law is public about what was
+    // decided, not about what was withdrawn.
+    #[test]
+    fn a_listing_can_be_narrowed_to_the_states_worth_showing() {
+        let all = spec("source: { kind: kv, bucket: cases }\npublic: true\n");
+        let decided = spec("source: { kind: kv, bucket: cases }\npublic: true\nstates: [approved, refused]\n");
+        for state in ["approved", "refused", "withdrawn", "open"] {
+            assert!(shows_state(&all, &record(state, serde_json::json!({}))));
+        }
+        assert!(shows_state(&decided, &record("approved", serde_json::json!({}))));
+        assert!(shows_state(&decided, &record("refused", serde_json::json!({}))));
+        assert!(!shows_state(&decided, &record("withdrawn", serde_json::json!({}))));
+        // Something that is not an aggregate has no state to filter on
+        // and is left alone.
+        assert!(shows_state(&decided, &serde_json::json!({ "name": "a file" })));
+    }
+
+    // The other half of a record belonging to a record: the
+    // application's page asking for the objections that name it.
+    #[test]
+    fn a_listing_can_be_narrowed_to_the_children_of_one_record() {
+        let children = spec("source: { kind: kv, bucket: objections }\nrequires_group: case_officers\nwhere: { field: case, equals: \"{key}\" }\n");
+        let params = std::collections::HashMap::from([("key".to_string(), "abc123".to_string())]);
+        let mine = record("open", serde_json::json!({ "case": "abc123", "your_objection": "the sun" }));
+        let theirs = record("open", serde_json::json!({ "case": "def456" }));
+        let neither = record("open", serde_json::json!({ "your_objection": "no case named" }));
+        assert!(matches_filter(&children, &mine, &params));
+        assert!(!matches_filter(&children, &theirs, &params));
+        // A record that did not say is not everyone's child.
+        assert!(!matches_filter(&children, &neither, &params));
+        // No filter, no narrowing: every resource written before this
+        // existed still lists its whole bucket.
+        let plain = spec("source: { kind: kv, bucket: objections }\npublic: true\n");
+        assert!(matches_filter(&plain, &theirs, &params));
+    }
+
+    #[test]
+    fn a_filter_can_name_a_value_outright() {
+        let fixed = spec("source: { kind: kv, bucket: cases }\npublic: true\nwhere: { field: which_authority, equals: The county }\n");
+        let params = std::collections::HashMap::new();
+        assert!(matches_filter(&fixed, &record("open", serde_json::json!({ "which_authority": "The county" })), &params));
+        assert!(!matches_filter(&fixed, &record("open", serde_json::json!({ "which_authority": "Fire service" })), &params));
+    }
+
     /// A canned, Gitea-API-shaped fixture - the same fields the real
     /// `/users/{username}/starred` endpoint returns (Gitea 1.27:
     /// `stars_count`, not GitHub's `stargazers_count`; `website` is ""

src/server/mod.rs

@@ -33,6 +33,10 @@ pub struct AppState {
     /// `aggregates` on the same reload. Default = the historical uhhm
     /// look.
     pub site: Arc<ArcSwap<crate::content::SiteConfig>>,
+    /// The access policy compiled from the content above (see
+    /// `access.rs`), swapped with it on every reload. Every server entry
+    /// point decides through this and nothing else.
+    pub access: Arc<ArcSwap<crate::access::Policy>>,
     /// `scheme://host` of the Gitea instance content is loaded from
     /// (see `content::gitea_api_base`) - kept alongside `questions`
     /// rather than re-derived per call, since `resolve_gitea_repo` needs

src/sessions.rs

@@ -0,0 +1,122 @@
+//! Sessions in NATS KV.
+//!
+//! A session used to live in a `MemoryStore`, which meant every
+//! restart signed everybody out: a deploy logged out every desk on
+//! every site, and the only reason that was bearable is that the desks
+//! were three people. This keeps them in the JetStream KV that is
+//! already under everything else here - no new service, no new
+//! dependency, and the same bucket a second instance of a site would
+//! read if there ever is one.
+//!
+//! Expiry is said twice on purpose. The bucket carries a `max_age`, so
+//! NATS collects abandoned sessions without anyone sweeping; and a
+//! record's own `expiry_date` is checked on the way out, because the
+//! bucket's age is a coarse fence and the record's date is the truth.
+#![cfg(feature = "ssr")]
+
+use tower_sessions::session::{Id, Record};
+use tower_sessions::session_store::{Error, Result};
+
+/// How long an untouched session survives in the bucket. Comfortably
+/// longer than any expiry `SessionManagerLayer` will set, so the
+/// record's own date is always what decides; this is only here so a
+/// session nobody ever comes back for does not sit in NATS forever.
+const MAX_AGE: std::time::Duration = std::time::Duration::from_secs(60 * 60 * 24 * 40);
+
+pub const BUCKET: &str = "portal_sessions";
+
+/// A new id is drawn this many times before a collision is reported as
+/// a backend error. Two random `i128`s colliding is not a thing that
+/// happens; this exists so a bucket misbehaving cannot spin forever.
+const ID_ATTEMPTS: usize = 8;
+
+#[derive(Clone)]
+pub struct NatsStore {
+    store: async_nats::jetstream::kv::Store,
+}
+
+impl std::fmt::Debug for NatsStore {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("NatsStore").field("bucket", &BUCKET).finish()
+    }
+}
+
+impl NatsStore {
+    /// Opens the bucket, creating it on first use the way every other
+    /// bucket here is created.
+    pub async fn open(js: &async_nats::jetstream::Context) -> anyhow::Result<Self> {
+        let store = match js.get_key_value(BUCKET).await {
+            Ok(store) => store,
+            Err(_) => {
+                js.create_key_value(async_nats::jetstream::kv::Config {
+                    bucket: BUCKET.to_string(),
+                    max_age: MAX_AGE,
+                    history: 1,
+                    ..Default::default()
+                })
+                .await?
+            }
+        };
+        Ok(Self { store })
+    }
+
+    fn encode(record: &Record) -> Result<Vec<u8>> {
+        serde_json::to_vec(record).map_err(|e| Error::Encode(e.to_string()))
+    }
+}
+
+#[async_trait::async_trait]
+impl tower_sessions::SessionStore for NatsStore {
+    /// `create` draws a fresh id until the bucket accepts one as new.
+    /// `put` would overwrite a stranger's session on a collision;
+    /// `create` refuses, which is the whole difference.
+    async fn create(&self, record: &mut Record) -> Result<()> {
+        for _ in 0..ID_ATTEMPTS {
+            let bytes = Self::encode(record)?;
+            match self.store.create(&record.id.to_string(), bytes.into()).await {
+                Ok(_) => return Ok(()),
+                Err(_) => record.id = Id::default(),
+            }
+        }
+        Err(Error::Backend(format!(
+            "could not find an unused session id in {ID_ATTEMPTS} attempts"
+        )))
+    }
+
+    async fn save(&self, record: &Record) -> Result<()> {
+        let bytes = Self::encode(record)?;
+        self.store
+            .put(&record.id.to_string(), bytes.into())
+            .await
+            .map(|_| ())
+            .map_err(|e| Error::Backend(e.to_string()))
+    }
+
+    async fn load(&self, id: &Id) -> Result<Option<Record>> {
+        let Some(bytes) = self
+            .store
+            .get(&id.to_string())
+            .await
+            .map_err(|e| Error::Backend(e.to_string()))?
+        else {
+            return Ok(None);
+        };
+        let record: Record =
+            serde_json::from_slice(&bytes).map_err(|e| Error::Decode(e.to_string()))?;
+        // An expired record is gone as far as anyone asking is
+        // concerned, whether or not the bucket has collected it yet.
+        if record.expiry_date <= tower_sessions::cookie::time::OffsetDateTime::now_utc() {
+            return Ok(None);
+        }
+        Ok(Some(record))
+    }
+
+    async fn delete(&self, id: &Id) -> Result<()> {
+        // Purge, not delete: a signed-out session should leave no
+        // history in the bucket to read back.
+        self.store
+            .purge(&id.to_string())
+            .await
+            .map_err(|e| Error::Backend(e.to_string()))
+    }
+}

src/upload.rs

@@ -15,7 +15,7 @@ use serde::Serialize;
 
 use crate::server::AppState;
 
-const MAX_UPLOAD_BYTES: usize = 20 * 1024 * 1024;
+pub const MAX_UPLOAD_BYTES: usize = 20 * 1024 * 1024;
 
 #[derive(Clone)]
 pub struct Garage {
@@ -57,13 +57,23 @@ pub struct UploadResponse {
     key: String,
 }
 
-/// POST /upload - streams the first `file` field straight through to
-/// Garage and hands back its object key. Server-side hygiene beyond the
-/// HTML `accept` hint (a UX-only signal, not a boundary): a hard size
-/// cap, and the upload is rejected outright if Garage isn't configured
-/// rather than silently succeeding nowhere.
+/// POST /upload - takes the `file` field, plus the `question` and
+/// `alternative` it belongs to, and hands back its object key.
+///
+/// The two names are not decoration: they are what makes this an
+/// authorized route rather than an open one. An upload is half a
+/// submission, so it asks the policy exactly what the submission will
+/// ask - `Submit` on that page - and it only accepts a page that
+/// actually declares a `type: file` field. Without that, anybody who
+/// could reach the host could put twenty megabytes in the bucket as
+/// often as they liked, on a site whose forms are public.
+///
+/// Server-side hygiene beyond the HTML `accept` hint (a UX signal, not
+/// a boundary): a hard size cap, and a refusal rather than a silent
+/// success when Garage isn't configured.
 pub async fn upload(
     State(state): State<AppState>,
+    session: tower_sessions::Session,
     mut multipart: Multipart,
 ) -> Result<Json<UploadResponse>, (StatusCode, String)> {
     let garage = state.garage.as_ref().ok_or((
@@ -71,41 +81,280 @@ pub async fn upload(
         "uploads are not configured".to_string(),
     ))?;
 
-    while let Some(field) = multipart
+    let mut question_id = String::new();
+    let mut alternative = String::new();
+    let mut file: Option<(String, String, Vec<u8>)> = None;
+
+    while let Some(mut field) = multipart
         .next_field()
         .await
         .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?
     {
-        if field.name() != Some("file") {
-            continue;
+        match field.name() {
+            Some("question") | Some("alternative") => {
+                let name = field.name().unwrap_or_default().to_string();
+                let text = field
+                    .text()
+                    .await
+                    .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?;
+                if name == "question" {
+                    question_id = text;
+                } else {
+                    alternative = text;
+                }
+            }
+            Some("file") => {
+                let content_type = field
+                    .content_type()
+                    .unwrap_or("application/octet-stream")
+                    .to_string();
+                let filename = field.file_name().unwrap_or("upload").to_string();
+                // Chunk by chunk, refused the moment the cap is
+                // crossed: an oversized body is never buffered whole
+                // before being turned away. The route's body limit
+                // (main.rs) is the outer fence.
+                let mut bytes: Vec<u8> = Vec::new();
+                while let Some(chunk) = field
+                    .chunk()
+                    .await
+                    .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?
+                {
+                    if bytes.len() + chunk.len() > MAX_UPLOAD_BYTES {
+                        return Err((StatusCode::PAYLOAD_TOO_LARGE, "file too large".to_string()));
+                    }
+                    bytes.extend_from_slice(&chunk);
+                }
+                file = Some((filename, content_type, bytes));
+            }
+            _ => continue,
         }
-        let content_type = field
-            .content_type()
-            .unwrap_or("application/octet-stream")
-            .to_string();
-        let filename = field.file_name().unwrap_or("upload").to_string();
-        let bytes = field
-            .bytes()
-            .await
-            .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?;
-        if bytes.len() > MAX_UPLOAD_BYTES {
-            return Err((StatusCode::PAYLOAD_TOO_LARGE, "file too large".to_string()));
-        }
-
-        let key = format!("{}-{filename}", uuid::Uuid::new_v4());
-        garage
-            .client
-            .put_object()
-            .bucket(&garage.bucket)
-            .key(&key)
-            .body(ByteStream::from(bytes))
-            .content_type(content_type)
-            .send()
-            .await
-            .map_err(|e| (StatusCode::BAD_GATEWAY, format!("upload failed: {e}")))?;
-
-        return Ok(Json(UploadResponse { key }));
     }
 
-    Err((StatusCode::BAD_REQUEST, "no file field in request".to_string()))
+    let (filename, content_type, bytes) =
+        file.ok_or((StatusCode::BAD_REQUEST, "no file field in request".to_string()))?;
+
+    // Nothing has been written yet. Everything below decides whether
+    // anything will be.
+    if !may_upload(&state, &session, &question_id, &alternative).await {
+        return Err((StatusCode::FORBIDDEN, "not authorized to upload here".to_string()));
+    }
+
+    let key = format!("{}-{filename}", uuid::Uuid::new_v4());
+    garage
+        .client
+        .put_object()
+        .bucket(&garage.bucket)
+        .key(&key)
+        .body(ByteStream::from(bytes))
+        .content_type(content_type)
+        .send()
+        .await
+        .map_err(|e| (StatusCode::BAD_GATEWAY, format!("upload failed: {e}")))?;
+
+    Ok(Json(UploadResponse { key }))
+}
+
+/// Whether this caller may attach a file to that page's alternative:
+/// the alternative has to exist, has to declare a `type: file` field,
+/// and the policy has to let this principal submit that page. The same
+/// question `submit_answer` asks, asked before the bytes land rather
+/// than after.
+async fn may_upload(
+    state: &AppState,
+    session: &tower_sessions::Session,
+    question_id: &str,
+    alternative: &str,
+) -> bool {
+    use crate::auth::{User, SESSION_USER_KEY};
+
+    let questions = state.questions.load();
+    let Some(page) = page_taking_files(&questions, question_id, alternative) else {
+        return false;
+    };
+    let user = session.get::<User>(SESSION_USER_KEY).await.ok().flatten();
+    let principal = crate::access::Principal::from_user(user.as_ref());
+    crate::access::decide_and_publish(
+        &state.nats,
+        &state.access.load(),
+        &principal,
+        crate::access::Action::Submit,
+        &crate::access::Resource::Page { id: page },
+        serde_json::json!({ "alternative": alternative }),
+    )
+    .allow
+}
+
+/// The resolved page id, when that page has an alternative of this
+/// name that is open and actually asks for a file. `None` for a page
+/// that does not exist, an alternative that does not, one that is
+/// disabled, or one that asks for no file at all - an upload that
+/// names none of the site's own file fields is not an upload this site
+/// asked for.
+fn page_taking_files(
+    questions: &std::collections::HashMap<String, crate::content::Question>,
+    question_id: &str,
+    alternative: &str,
+) -> Option<String> {
+    let question = crate::content::resolve_question(questions, question_id)?;
+    question
+        .alternatives
+        .iter()
+        .find(|a| a.name == alternative && !a.disabled)?
+        .features
+        .iter()
+        .any(|f| f.requirements.iter().any(|r| r.kind == "file"))
+        .then(|| question.id.clone())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn questions(yaml: &str) -> std::collections::HashMap<String, crate::content::Question> {
+        crate::content::build_questions(&[("index.yaml".to_string(), yaml.to_string())]).unwrap()
+    }
+
+    const PAGE: &str = "name: Home
+alternatives:
+  - name: Send drawings
+    record_as: enquiries
+    features:
+      - name: Files
+        requirements:
+          - { name: drawings, type: file, optional: true }
+  - name: Just ask
+    features:
+      - name: Words
+        requirements:
+          - { name: question, type: textarea }
+";
+
+    // The bytes are only ever written for a page of this site that
+    // asked for a file. Everything else is somebody using the host as
+    // a disk.
+    #[test]
+    fn an_upload_must_name_a_page_that_asked_for_a_file() {
+        let qs = questions(PAGE);
+        assert_eq!(page_taking_files(&qs, "/", "Send drawings"), Some("/".to_string()));
+        // An alternative on the same page that takes no file.
+        assert_eq!(page_taking_files(&qs, "/", "Just ask"), None);
+        // Names that are not there at all.
+        assert_eq!(page_taking_files(&qs, "/", "Nonexistent"), None);
+        assert_eq!(page_taking_files(&qs, "/nowhere", "Send drawings"), None);
+        assert_eq!(page_taking_files(&qs, "", ""), None);
+    }
+
+    #[test]
+    fn a_closed_alternative_takes_nothing() {
+        let qs = questions(&PAGE.replace("    record_as: enquiries\n", "    record_as: enquiries\n    disabled: true\n"));
+        assert_eq!(page_taking_files(&qs, "/", "Send drawings"), None);
+    }
+}
+
+/// GET /attachment/{bucket}/{record}/{field} - the other half of an
+/// upload. A `type: file` field stores an object key, which on its own
+/// is a string a desk can read and nobody can open; this streams the
+/// object back.
+///
+/// The key is never the credential. It is not even taken from the
+/// caller: the caller names a record, and the key is read out of that
+/// record's own field, so a file can only be fetched through a record
+/// somebody is allowed to see. Guessing keys gets you nowhere, and a
+/// key that leaks out of a desk is not a link to anything.
+pub async fn attachment(
+    State(state): State<AppState>,
+    session: tower_sessions::Session,
+    axum::extract::Path((bucket, record, field)): axum::extract::Path<(String, String, String)>,
+) -> Result<axum::response::Response, (StatusCode, String)> {
+    use axum::response::IntoResponse;
+
+    let garage = state.garage.as_ref().ok_or((
+        StatusCode::SERVICE_UNAVAILABLE,
+        "uploads are not configured".to_string(),
+    ))?;
+
+    // Refusals read the same as a miss all the way down, so this
+    // cannot be used to learn which buckets, records or fields exist.
+    let missing = || (StatusCode::NOT_FOUND, "not found".to_string());
+
+    if !may_read_bucket(&state, &session, &bucket).await {
+        return Err(missing());
+    }
+
+    let store = state.jetstream.get_key_value(&bucket).await.map_err(|_| missing())?;
+    let bytes = store.get(&record).await.map_err(|_| missing())?.ok_or_else(missing)?;
+    let answer: crate::answers::Answer = serde_json::from_slice(&bytes).map_err(|_| missing())?;
+    let key = answer
+        .responses
+        .get(&field)
+        .and_then(|v| v.as_str())
+        .filter(|k| !k.is_empty())
+        .ok_or_else(missing)?;
+
+    let object = garage
+        .client
+        .get_object()
+        .bucket(&garage.bucket)
+        .key(key)
+        .send()
+        .await
+        .map_err(|_| missing())?;
+
+    let content_type = object
+        .content_type()
+        .unwrap_or("application/octet-stream")
+        .to_string();
+    let body = object
+        .body
+        .collect()
+        .await
+        .map_err(|e| (StatusCode::BAD_GATEWAY, format!("reading the file failed: {e}")))?
+        .into_bytes();
+
+    // The stored key is `<uuid>-<original name>`; the person who gets
+    // the file should see the name they sent, not the uuid.
+    let filename = key.split_once('-').map(|(_, rest)| rest).unwrap_or(key);
+    let filename = filename.rsplit('/').next().unwrap_or(filename).replace(['"', '\\'], "");
+    Ok((
+        [
+            (axum::http::header::CONTENT_TYPE, content_type),
+            (
+                axum::http::header::CONTENT_DISPOSITION,
+                format!("attachment; filename=\"{filename}\""),
+            ),
+        ],
+        body,
+    )
+        .into_response())
+}
+
+/// Whether this caller may see this bucket at all: whether any feature
+/// in the loaded content lists it and the policy lets them read that
+/// feature. The desk that shows the record is what grants the file.
+async fn may_read_bucket(
+    state: &AppState,
+    session: &tower_sessions::Session,
+    bucket: &str,
+) -> bool {
+    use crate::auth::{User, SESSION_USER_KEY};
+
+    let user = session.get::<User>(SESSION_USER_KEY).await.ok().flatten();
+    let principal = crate::access::Principal::from_user(user.as_ref());
+    let access = state.access.load();
+    state.questions.load().values().any(|question| {
+        question.alternatives.iter().any(|alternative| {
+            alternative.features.iter().any(|feature| {
+                feature.resource.as_ref().and_then(|r| r.bucket()) == Some(bucket)
+                    && access.allows(
+                        &principal,
+                        crate::access::Action::Read,
+                        &crate::access::Resource::Feature {
+                            page: question.id.clone(),
+                            alternative: alternative.name.clone(),
+                            feature: feature.name.clone(),
+                        },
+                    )
+            })
+        })
+    })
 }

style/main.css

@@ -1120,4 +1120,117 @@ textarea:focus {
     flex-direction: column;
     align-items: flex-start;
   }
-}
+}
+/* A `type: location` field: the map fills the field, and the pin is the
+   centre of it - panning works the same with a finger, a mouse or the
+   arrow keys, and there is nothing to miss by a few pixels. MapLibre
+   draws into .map-canvas after hydration, so the box is reserved up
+   front the way .gesture-wrap reserves its own. */
+.map-wrap {
+  position: relative;
+  width: 100%;
+}
+
+.map-wrap:empty {
+  aspect-ratio: 3 / 2;
+}
+
+.map-canvas {
+  display: block;
+  width: 100%;
+  aspect-ratio: 3 / 2;
+  border: 0.06rem solid var(--line);
+  border-radius: 0.2rem;
+  overflow: hidden;
+}
+
+/* The pin sits over the exact centre of the canvas and takes no
+   pointer events, so every drag goes to the map under it. Its point is
+   the bottom tip, hence the upward shift of its own height. */
+.map-pin {
+  position: absolute;
+  top: 50%;
+  left: 50%;
+  width: 0.9rem;
+  height: 0.9rem;
+  margin: -1.35rem 0 0 -0.45rem;
+  border: 0.18rem solid var(--ink);
+  border-radius: 50% 50% 50% 0;
+  transform: rotate(-45deg);
+  pointer-events: none;
+  background: var(--paper);
+}
+
+.map-readout {
+  margin: 0.3rem 0 0;
+  font-size: 0.85em;
+  color: var(--ink-dim);
+}
+
+/* A stored location in a list: a still image from this origin, never a
+   live map - twenty rows of WebGL would cost more than the page. */
+.map-still {
+  display: block;
+  width: 100%;
+  max-width: 24rem;
+  height: auto;
+  border: 0.06rem solid var(--line);
+  border-radius: 0.2rem;
+}
+
+.map-coords {
+  display: block;
+  margin-top: 0.2rem;
+  font-size: 0.85em;
+}
+
+.answer-field-map .answer-field-value {
+  display: block;
+}
+
+/* Replies that came back by mail, under the record they belong to.
+   They move nothing, so there is no control here - only who wrote,
+   when, and what they said. */
+.answer-notes {
+  list-style: none;
+  margin: 0.4rem 0 0;
+  padding: 0 0 0 0.7rem;
+  border-left: 0.12rem solid var(--line);
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.answer-note-who {
+  font-weight: 600;
+}
+
+.answer-note-time {
+  margin-left: 0.4rem;
+  font-size: 0.85em;
+  color: var(--ink-dim);
+}
+
+.answer-note-text {
+  margin: 0.15rem 0 0;
+  white-space: pre-wrap;
+}
+
+/* A page that is about a place: the map sits under the question, at
+   the width of the text it belongs to. */
+.question-place {
+  margin: 0.8rem 0 0;
+}
+
+.question-place figcaption {
+  margin-top: 0.3rem;
+  font-size: 0.9em;
+  color: var(--ink-dim);
+}
+
+/* A loading slot holds its line's worth of space and says nothing.
+   The words that belong here have not arrived yet, and "loading…" is
+   not one of them. */
+.resource-loading {
+  min-height: 1.4em;
+}

tests/jetstream.rs

@@ -0,0 +1,155 @@
+//! The one test that meets a real JetStream: a submission becomes an
+//! aggregate, a desk move is accepted, an undeclared move is refused,
+//! and the record reads back from its own event log. Everything else
+//! in the suite replays in memory; this is what proves the store, the
+//! event log and the projection agree with each other.
+//!
+//! Runs only when `PORTAL_TEST_NATS_URL` points at a JetStream (CI
+//! starts a throwaway one, see `.gitea/workflows/test.yml`); without
+//! it the test passes as skipped, so `cargo test` stays green offline.
+#![cfg(feature = "ssr")]
+
+use portal::aggregates::{self, parse_aggregates_yaml, TransitionError};
+use portal::answers::{store_answer, Answer};
+use portal::events::store::{ensure_stream, load_events};
+use serde_json::json;
+
+#[tokio::test]
+async fn a_submission_is_created_moved_refused_and_read_back_through_the_real_engine() {
+    let Ok(url) = std::env::var("PORTAL_TEST_NATS_URL") else {
+        eprintln!("skipped: PORTAL_TEST_NATS_URL is not set");
+        return;
+    };
+    let js = async_nats::jetstream::new(async_nats::connect(&url).await.expect("connect"));
+    ensure_stream(&js).await.expect("event stream");
+
+    // A bucket of its own per run, so reruns and parallel runs never
+    // read each other's records.
+    let bucket = format!("it_{}", chrono::Utc::now().timestamp_millis());
+    let schemas = parse_aggregates_yaml(&format!(
+        "aggregates:\n  - bucket: {bucket}\n    initial: open\n    states:\n      open: {{ event: received }}\n      quoted: {{ event: quoted }}\n      won: {{ event: won }}\n      lost: {{ event: lost }}\n    transitions:\n      open: [quoted, lost]\n      quoted: [won, lost]\n"
+    ))
+    .expect("schema");
+    let schema = &schemas[&bucket];
+    let now = chrono::Utc::now().timestamp_millis();
+
+    // The submission: a KV record in the initial state, plus the first event.
+    store_answer(&js, &schemas, &bucket, "rec-1".into(), "/", "Hire us", &json!({"email": "a@b.example"}), now)
+        .await
+        .expect("store");
+    let store = js.get_key_value(&bucket).await.expect("bucket exists");
+    let stored: Answer = serde_json::from_slice(&store.get("rec-1").await.unwrap().expect("record")).unwrap();
+    assert_eq!(stored.state, "open");
+    assert_eq!(stored.responses["email"], "a@b.example");
+
+    // A desk move the machine allows.
+    let moved = aggregates::transition(&js, schema, "rec-1", "quoted", json!({"by": "test"}), now + 1)
+        .await
+        .expect("open -> quoted is declared");
+    assert_eq!(moved.state, "quoted");
+
+    // Moves the machine does not allow are refused, whoever asks.
+    let back = aggregates::transition(&js, schema, "rec-1", "open", json!({}), now + 2).await;
+    assert!(matches!(back, Err(TransitionError::DisallowedTransition { .. })), "{back:?}");
+    let skip = aggregates::transition(&js, schema, "rec-1", "won", json!({}), now + 2).await;
+    assert!(skip.is_ok(), "quoted -> won is declared: {skip:?}");
+    let nobody = aggregates::transition(&js, schema, "rec-9", "quoted", json!({}), now + 3).await;
+    assert!(matches!(nobody, Err(TransitionError::UnknownAggregate)), "{nobody:?}");
+
+    // The record reads back from its own event log, in the state the
+    // accepted moves left it, with a sequence that moved forward.
+    let events = load_events(&js, &bucket, "rec-1").await.expect("events");
+    assert_eq!(events.len(), 3, "received, quoted, won");
+    let replayed = aggregates::replay(schema, "rec-1", &events).expect("replays");
+    assert_eq!(replayed.state, "won");
+    assert!(replayed.sequence > moved.sequence);
+
+    // A reply to the mail this record was sent becomes a note on it,
+    // through the same store the desks read - and moves nothing: the
+    // record is still where the desk left it.
+    let mut record: Answer = serde_json::from_slice(&store.get("rec-1").await.unwrap().expect("record")).unwrap();
+    let state_before_the_note = record.state.clone();
+    let reply = portal::mail::Incoming {
+        v: portal::mail::CONTRACT,
+        id: "mail-1".into(),
+        bucket: bucket.clone(),
+        record: "rec-1".into(),
+        from: "A <A@B.example>".into(),
+        subject: "Re: your enquiry".into(),
+        text: "Thursday suits us.".into(),
+        received_ms: now + 10,
+    };
+    let note = portal::mail::note_for(&reply, &record).expect("the address matches the record");
+    record.notes.push(note);
+    store.put("rec-1", serde_json::to_vec(&record).unwrap().into()).await.expect("note stored");
+
+    let read_back: Answer = serde_json::from_slice(&store.get("rec-1").await.unwrap().expect("record")).unwrap();
+    assert_eq!(read_back.notes.len(), 1);
+    assert_eq!(read_back.notes[0].text, "Thursday suits us.");
+    assert_eq!(read_back.notes[0].from, "a@b.example");
+    assert_eq!(read_back.state, state_before_the_note, "a reply is a note, never a decision");
+    // The same reply read twice adds nothing.
+    assert!(portal::mail::note_for(&reply, &read_back).is_err());
+    // And the event log is untouched by it.
+    let after = load_events(&js, &bucket, "rec-1").await.expect("events");
+    assert_eq!(after.len(), 3, "a note writes no event");
+}
+
+/// A session outlives the process that made it. The `MemoryStore` this
+/// replaced could not: every deploy signed out every desk, and the
+/// only proof that this one does not is a store opened twice against
+/// the same JetStream, as two runs of the binary would.
+#[tokio::test]
+async fn a_session_survives_the_process_that_made_it() {
+    use tower_sessions::session::{Id, Record};
+    use tower_sessions::SessionStore;
+
+    let Ok(url) = std::env::var("PORTAL_TEST_NATS_URL") else {
+        eprintln!("skipped: PORTAL_TEST_NATS_URL is not set");
+        return;
+    };
+    let js = async_nats::jetstream::new(async_nats::connect(&url).await.expect("connect"));
+    let store = portal::sessions::NatsStore::open(&js).await.expect("open");
+
+    let mut record = Record {
+        id: Id::default(),
+        data: Default::default(),
+        expiry_date: tower_sessions::cookie::time::OffsetDateTime::now_utc()
+            + tower_sessions::cookie::time::Duration::hours(1),
+    };
+    record.data.insert("who".into(), json!("ingrid"));
+    store.create(&mut record).await.expect("create");
+
+    // A second store over the same JetStream is what the next boot of
+    // the binary has: nothing carried over in memory.
+    let next_boot = portal::sessions::NatsStore::open(&js).await.expect("reopen");
+    let found = next_boot.load(&record.id).await.expect("load").expect("still there");
+    assert_eq!(found.data.get("who"), Some(&json!("ingrid")));
+
+    // `create` never writes over somebody else's session: asked to
+    // create one whose id is taken, it takes a new id instead.
+    let mut collide = Record { id: record.id, data: Default::default(), expiry_date: record.expiry_date };
+    next_boot.create(&mut collide).await.expect("create beside it");
+    assert_ne!(collide.id, record.id, "an id already in use must not be reused");
+    assert_eq!(
+        next_boot.load(&record.id).await.expect("load").expect("original intact").data.get("who"),
+        Some(&json!("ingrid")),
+        "the original session must be untouched"
+    );
+
+    // An expired record is gone to anyone asking, whatever the bucket
+    // still holds.
+    let stale = Record {
+        id: Id::default(),
+        data: Default::default(),
+        expiry_date: tower_sessions::cookie::time::OffsetDateTime::now_utc()
+            - tower_sessions::cookie::time::Duration::minutes(1),
+    };
+    next_boot.save(&stale).await.expect("save stale");
+    assert!(next_boot.load(&stale.id).await.expect("load stale").is_none());
+
+    // Signing out leaves nothing to read back.
+    next_boot.delete(&record.id).await.expect("delete");
+    assert!(next_boot.load(&record.id).await.expect("load after delete").is_none());
+    next_boot.delete(&collide.id).await.ok();
+}