diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 5228bf3..a44b443 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -18,7 +18,7 @@ on:
       - .gitea/workflows/deploy.yml
 
 env:
-  PORTAL_RELEASE: v0.2.2
+  PORTAL_RELEASE: v0.2.3
   INSTANCE: uhhm-portal
 
 jobs:
diff --git a/README.md b/README.md
index ceecd15..df28dac 100644
--- a/README.md
+++ b/README.md
@@ -212,6 +212,13 @@ review resource's transitions — fireable by whoever holds one specific
 record's `?chain=` link plus its matching email (the unsubscribe
 pattern).
 
+**Attended buckets** (lint-enforced): every `record_as` bucket must be
+read by some `kv` resource in this repo (a desk or listing) — or its
+`aggregates.yaml` entry must carry `attended_by: <who/what consumes
+it>` naming the automation that does. A bucket nothing reads fails
+lint, so no publicly collected answer can land where no one will ever
+see it.
+
 ## Routing: the tree is the router
 
 The `questions/` directory tree is the URL tree — `index.yaml` names