Architecture

​

Majestic Monolith

​

Domain Model

Organization (status: test | single_meeting | standard | pro | demo | active | suspended)
  ├── parent_id → Organization (self-referential, unlimited depth)
  ├── custom_field_definitions (JSON)
  └── Meeting (preparing → active ⇄ closed; never back to preparing)
        ├── MeetingParticipant (role: participant | chair | secretary | observer)
        │     └── custom_field_values (JSON)
        ├── AgendaItem (ordered by position, has rich text body)
        │     └── Poll (binary | multiple_choice; draft → open → closed)
        │           ├── PollOption
        │           └── Vote (one row per chosen option)
        └── current_agenda_item → AgendaItem (nullable FK)

• An Organization can have a parent Organization and many child Organizations (unlimited nesting). Tree traversal: ancestors, descendants, root, root?, depth, and effective_setting(key) for a setting a child inherits from the nearest ancestor that sets it
• A Meeting belongs to an Organization and has many AgendaItems and MeetingParticipants. The state is the stored status column (preparing → active → closed, reopen closed → active), changed only by explicit transitions; optional starts_on/ends_on/scheduled_at are information only (VOT-432). chair_can_vote and secretary_can_vote booleans control voting eligibility for those roles
• A Poll belongs to an AgendaItem and has many PollOptions and Votes
• A Vote belongs to a Poll, a PollOption, and a MeetingParticipant
• Vote uniqueness is enforced at the database level by the composite unique index (poll_id, meeting_participant_id, poll_option_id): a participant cannot choose the same option twice, and a multi-select poll holds one row per chosen option. The poll’s max_selections caps the rows per participant (Vote#within_max_selections); see Domain model «Vote»

​

Authentication

​

Role-Based Views

​

Authorization

• set_meeting — finds the meeting by slug from params (find_by!(slug:))
• current_participant — resolves the authenticated user’s participant record (exposed as a helper method)
• require_meeting_participant — redirects if user is not a participant
• require_chair — restricts to the chair role
• AgendaItemsController uses both (VOT-184): index needs only require_meeting_participant (any participant or org member), every other action require_secretary_or_chair (secretary, chair or org admin)
• require_secretary_or_chair — restricts to secretary or chair
• org_admin_for_meeting? / org_member_for_meeting? — implicit access through the organisation: an org admin passes require_secretary_or_chair, an org member passes require_meeting_participant; require_chair stays explicit-only. current_participant, current_meeting_role and org_admin_for_meeting? are declared with helper_method, so views can call them. current_participant is nil for an org admin or member without a role and for a «Feilregistrert» participant (it reads only listed rows), so views use safe navigation
• MeetingAccess (app/models/meeting_access.rb, VOT-449) — the one participant / management test behind current_participant, org_admin_for_meeting? and org_member_for_meeting?, shared with the projector’s ProjectorAdmission and ProjectorStreamsChannel
• require_meeting_capability(capability, alert:, fallback:, status:) — the one meeting-STATE guard (VOT-437; status: :see_other lands a refusal back inside a Turbo frame — the secretary’s projector panel, VOT-449): refuses unless @meeting.allows?(capability) (the MeetingCapabilities matrix), for every role, with JSON 422 or a redirect + flash. require_meeting_open_for_mutation (:drive), require_meeting_accepting_votes (:vote) and require_preparing_meeting (:rehearse) delegate to it. Roles say who may act, the matrix says when — see Domain model
• meeting_inactive_message — the refusal text of :vote and :drive (require_meeting_accepting_votes, require_meeting_open_for_mutation), read from the stored state: meetings.already_closed once the meeting is closed, else meetings.not_yet_open. A closed meeting refuses a vote or a retraction with JSON 422 or this flash; the voter and participant views render the closed record instead (VOT-437), and Vote enforces the same rule in the model

• set_organization — finds the organization from slug params
• current_org_member — resolves the authenticated user’s membership record
• org_admin? — checks if user is admin of the org or any ancestor org (cascading access)
• require_org_member — redirects if user is not a member (also checks ancestor membership)
• require_org_admin — redirects if user is not an admin (also checks ancestor admin status)
• require_advanced_features — blocks the organisation settings pages for tiers without advanced features (only demo and pro have them); require_non_demo_single is kept as a backward-compatible alias
• current_organization, current_org_member and org_admin? are helper methods, so views can call them

​

Shared Partials

​

Design System

• Pill shapes for actions — radius-full is 9999px; buttons (.btn-primary, .btn-ghost) and badges use pill radii
• Uppercase labels — small, bold, wide-tracked text for headers, badges, and navigation
• Warm palette — cream surfaces, ochre accents, teal primary throughout
• Layout themes — surface-bright for the app layouts; the projector paints from its own --pj-* token layer, light or dark per screen (VOT-446, see Design System)
• Cards — borderless .s-card with subtle elevation, used for all content sections
• Progress bars — teal fill (.poll-bar-fill) on warm gray track for poll results
• Component classes — .btn-primary, .btn-ghost, .s-card, .s-chip provide reusable styled components

​

Payments

1. The user fills in /signup/paid?tier=X&billing=Y (organisation name, contact name, email), which posts to create_paid
2. The app creates a Stripe Checkout Session with the form data in metadata and redirects to Stripe: subscription mode for standard / pro, a one-time payment for single_meeting
3. The Stripe webhook (checkout.session.completed) provisions the organization with the tier-specific status, creates or reuses the user, assigns admin role, auto-creates a first meeting with the buyer as chair (all paid tiers — single_meeting, standard, pro — via the shared provision_first_meeting helper in StripeWebhooksController, mirroring the free flow), and sends a magic link email. The meeting starts in preparing, and after_login_path lands the buyer (the chair of exactly one meeting) on it, where the chair view offers «Start møte» (VOT-382)

​

Time Zone

• Use Time.current / Date.current, not Time.now / Date.today, so “today” is the Oslo date.
• Machine-readable timestamps (protokoll hash and JSON export) are ISO 8601 with the Oslo offset for their date (+02:00 / +01:00); before VOT-425 they ended in Z. See Protokoll JSON schema.
• The protokoll renderers format the hash’s ISO strings with ProtokollRendererSupport#display_time and the protokoll.time_format locale key, so a hash with UTC strings shows the same local time.
• Recurring jobs (config/recurring.yml) must name their zone. Fugit reads a zone-less schedule in ENV["TZ"] or the app zone, so it would move with DST. Both current jobs say UTC.
• scheduled_at is the only time a user types (datetime-local), read in the app zone. Values typed before VOT-425 were read as UTC; a data migration re-read them as Oslo wall-clock time.

​

Vote Integrity

​

Rate Limiting

• Signed in = a verified signature. A request counts as signed-in only when the session_token cookie’s signature verifies — Rack::Attack::Request#session_discriminator: a signature check only, no database query, and the bucket key is a SHA-256 digest of the token, so the raw token never reaches the cache store. A forged or random cookie stays in the IP bucket. A signed cookie of a logged-out or expired session still verifies and still gets a session bucket, and one account can mint a session per magic link — which is why req/ip/all caps everything an address sends, whatever cookies it carries.
• Projector screens. Only when no session cookie verifies, Rack::Attack::Request#projector_discriminator keys a digest of the signature-verified projector_screen cookie payload (ProjectorCableIdentity.discriminator; never the URL token, never the raw cookie, which changes on every re-issue). Rack::Attack::Request#projector_page_discriminator (only for a request routed to the projector page) and Rack::Attack::Request#projector_cable_discriminator (only for /cable) are also the req/ip / cable/ip gates: a request leaves the IP bucket exactly when it is counted per screen, so a forged, expired or missing cookie stays in the IP bucket and only the projector route leaves it. A screen’s first GET (no cookie yet) counts in req/ip; req/ip/all still counts everything. A restricted screen (participants / management, VOT-449) gets no projector cookie, so its page and cable traffic stay in the viewer’s session buckets and its refusal pages in the IP buckets — see Access levels.
• Routes, not paths. Throttles match on Rack::Attack::Request#routed_to — controller#action as the router resolves the request — so /session.json, a trailing slash or another format suffix cannot dodge a throttle the app would still serve.
• Magic links. The same two limits are enforced in Rack::Attack (magic_link/email, magic_link/ip) and in SessionsController (rate_limit twice, keyed on the address create looks up), so the layers back each other up. The address is read the way Rails reads params[:email] (the query string wins over the body, JSON bodies are parsed) and normalised like User#email; only a plain string is ever looked up or keyed.
• The throttled answer. ThrottledResponse (in the initializer, the throttled_responder) gives a throttled HTML navigation — a GET or HEAD accepting text/html, not /cable — a small self-reloading page: a meta refresh after Retry-After plus 1–5 s of jitter, no script, in the default locale (no user is looked up this early; VOT-475: Norwegian only), locale keys throttled.*. A page Turbo loads itself, such as a refetch, thus recovers unattended. Everything else (JSON, /cable, form posts) keeps the plain-text 429. Both answers carry Retry-After (the seconds left in the wall-clock-aligned window) and Cache-Control: no-store.

​

Content Security Policy

• default-src 'self', object-src 'none', base-uri 'self', connect-src 'self'; fonts and images from 'self', https: and data:.
• script-src 'self' plus a per-request nonce. The importmap tags get the nonce automatically, and script-src is the only nonce directive.
• style-src 'self' https: 'unsafe-inline' with no nonce. About 17 views emit dynamic inline style="..." attributes (bar-chart widths, agenda indentation), which fall under style-src-attr, and a nonce does not cover attributes. A nonce next to 'unsafe-inline' on the same directive makes the browser ignore 'unsafe-inline', so style-src stays out of the nonce directives.
• frame-ancestors 'self' (VOT-455: the organiser’s preview iframes and thumbnails) — the same rule as Rails’ X-Frame-Options: SAMEORIGIN, which stays. frame-src 'self'.
• https://challenges.cloudflare.com is allowed in script-src and frame-src for Turnstile (below); it is always present and harmless while Turnstile is off.

​

Error Monitoring

​

Signup Bot Protection

​

Projector Real-Time Updates

​

Rendering pipeline (VOT-450)

1. Context. Meetings::ProjectorController#show builds one ProjectorContext per request: the meeting data a widget may read, loaded lazily and memoized (nil answers too), so each piece costs at most one query and only when a placed widget asks for it — a clock-only screen loads no meeting data.
2. Resolve. ProjectorLayout.resolve(screen, context) walks the preset’s slots in order. A slot is filled by the first widget of its section’s chain (the widget, then its fallbacks with their default options) that has a renderer and is present?. The primary slot then tries current_item → welcome_message and otherwise becomes the idle region; it never collapses. Another empty slot is a placeholder region when its section says when_empty: placeholder, else it is removed. Once the meeting is closed the primary slot is the record region (closed_record, below) without asking its own chain — unless the screen keeps its own content (VOT-457: its own chain, then the welcome message, the record as the fallback); while a pause runs on a screen with show_pause, the primary slot of every preset but chair_podium is the pause region (system: :pause, VOT-445 — below) in the same way. The closed branch wins over the pause.
3. Collapse. ProjectorLayout::Grid.collapse removes the empty slots from the preset’s base grid (ProjectorLayout::GEOMETRY) so every surviving area stays one rectangle and grid-template-areas stays valid: tracks made only of removed slots are dropped; each remaining removed slot hands its cells to a neighbour sharing its whole edge — its stack neighbour first (main_sidebar side1–4, header_two_columns left/left2 and right/right2, chair_podium rail1–3), then its row neighbour, then its column neighbour; identical adjacent tracks merge. All 61 empty-slot combinations of the six presets (sixteen of them chair_podium’s, with its cue band) are pinned by test/models/projector_layout_grid_test.rb. Each region gets a size hint (band / compact / medium / large / full) from its share of the fr tracks, which drives density (below).
4. Render. meetings/projector/show.html.erb adds the stream sources around the shared canvas partial meetings/projector/_canvas (VOT-455; the organiser’s preview renders the same partial), which renders the bands (meetings/projector/bands/_<band>: _preparing while preparing — the projector-native «Prøvevotering» band since VOT-454 — then _message and, on chair_podium, _pause, VOT-445), then one main.pj-grid with the grid template inline (allowed by style-src 'unsafe-inline') and one section per region carrying data-area, data-widget and data-size-hint, filled by the widget’s partial meetings/projector/widgets/_<key> (or _placeholder). The canvas is styled by app/assets/tailwind/projector.css (.pj-* only, inside @layer components): exactly the viewport, no page scroll, cursor hidden, text scaled by data-text-scale. The clock ticks in the browser (projector_clock_controller.js, Europe/Oslo); nothing polls.

​

Meeting-flow widgets (VOT-451)

• One decision rule. PollDecisionRule holds the threshold and winner arithmetic Poll#decision_result / #winning_options used inline (extracted verbatim; Poll gathers the inputs as before). The projector’s decision words come from MeetingsHelper#poll_decision_label, the same helper poll_decision_badge uses.
• «Avgjort». PollKnockout evaluates the open poll with that rule — the projected outcome and whether the outstanding votes could still change it: sound for every poll, exact for binary and one-seat polls, conservative for multi-seat polls, pure (no query; it reads the counts the live bars already loaded). The knockout widget is for the chair (:chair_support); the only template that places it is the Dirigentskjerm (below).
• Context loaders. ProjectorContext adds the agenda’s running order (next_item / last_item? derived from it — one agenda load), the vote roll (MeetingParticipant.vote_roll of the open poll’s item — one participant load for the grid and the remaining numbers), attendance (one aggregate query), the last result poll, and per poll the decision outcome, the election’s elimination history (from the rounds’ snapshots) and the knockout; per item the elected candidates — only those the chair confirmed, plus the latest round’s winners once the item is settled, so no hall widget names a winner while the round awaits «Bekreft». All memoized.
• Shared result. active_poll (revealed) and last_result render one partial: decision pill, rule line with the leading option’s margin, bars, «Valgt» / «Eliminert etter runde N» (no «Valgt» on a muted result), the item block once, the turnout line. Pills are projector markup (projector_pill), never the admin badges.
• Density by size hint. Server-side, the item introduction renders only at large / full and the rule, restriction and turnout lines and the earlier-eliminated list not at compact / band. Since VOT-446 every length is in canvas units: the projector layout’s html.pj-root sets the root font size from the window (16 px at 1920×1080, 12 px at 1440×900), so the composition scales as a whole and the type tiers have floors; within a region, whole blocks give way in the partial’s DOM order (pj-fit / pj-fill / pj-lines / pj-stack, CSS only) — nothing is cut mid-line. Each region is an inline-size container (container: pj-region), so the agenda flows into two columns in a region at least 75rem wide. test/system/projector_layout_test.rb measures the «Hovedskjerm» at 1440×900 and 1920×1080 (the current agenda row and three more in view, no scrolling, pills ≥ 40 px × the canvas factor), and test/system/projector_legibility_test.rb renders ten surfaces at both sizes in both themes through the cut detector, the floors and the rendered-contrast check.

​

Informational widgets (VOT-452)

• Organisation chain shared with the branding. organization is the meeting’s organisation — the record the projector layout’s projector_brand_style_tag walks for effective_branding (VOT-446; it was organization_style_tag before) — so the logo lookup (organization_logo_url: the effective logo_url, https only, the meeting’s own organisation first) reuses the loaded parents and Organisasjon costs no query beyond the layout’s own (pinned against a clock in test/integration/n1_hot_paths_test.rb).
• One rich-text load. welcome_message reads rich_text_welcome_message once and keeps it only when its plain text is present; it never builds a record. Attachments render through ActionText’s sanitiser and the app’s active_storage/blobs/_blob partial, so an uploaded image is served by the app. An image embedded by its address (a Trix remote image) renders as an <img> pointing at its own host and is loaded from there (allowed by img-src https:) — the same holds for the item description (VOT-451).
• Join target on the canonical host. join_url is the section’s own http(s) url, else the meeting link built with CanonicalUrl.options — the mailers’ host (https under force_ssl), never the request’s, so a phone that scans the code lands where its magic-link session lives.
• QR generated in-process per request. QrCodeSvg (rqrcode, level M, 4-module quiet zone; ≈ 6 ms for a meeting link) and the view helper QrCodeHelper#qr_code_svg produce one inline <svg> with presentation attributes only — no style, no external reference, no CSP change — reused within the request (one per URL) and never cached across requests.
• Logo fallback. The logo <img> (referrerpolicy="no-referrer": the projector URL carries the screen token) sits over an initials tile; projector_logo_controller.js switches to the tile when the image fails and cancels the morph’s data-logo-state change, so a failed logo stays replaced after every refresh.
• The implicit chain reaches the welcome message. A primary slot with nothing to show tries current_item, then welcome_message, then becomes the idle region — so the «Hovedskjerm» shows the welcome message after «Start møte» until the first poll opens.

​

The Dirigentskjerm (VOT-453)

• The chair mirror. The two chair widgets, chair_state («Sakstilstand», the hero) and next_action («Neste handling», the cue band), read the chair’s own derivation: ProjectorContext#chair_state builds ChairState.for(meeting, current_item: context.current_item) lazily, at most once per request, and only when a placed widget asks — a hall screen never builds one (n1_hot_paths_test.rb counts ChairState.new: zero on the «Hovedskjerm», a knockout-only and a «Løpende resultat» screen, one on the Dirigentskjerm, also with «Sakstilstand» in two regions), and a closed meeting’s Dirigentskjerm none (VOT-454). The widgets never derive state from polls or items; voting counts come from the context’s per-poll loaders shared with «Avgjort», result figures from ChairState’s result helpers. ProjectorContext#rendered_at is the request’s time, read once («Sist oppdatert»).
• The cue contract. ChairState#primary_action builds the label of the chair card’s one primary button from the same meetings.chair.* keys and data as the chair partials; the chair view marks that button with data-primary-action (MeetingsHelper#chair_primary_action_data, exactly one per page) and the cue repeats it after «Neste:», with «eller: Ikke bekreft» where decline_action says the card offers it. test/integration/chair_podium_contract_test.rb renders both pages in twenty chair states and holds the key, the words, the decline line and the manual-result labels equal; test/system/projector_chair_podium_test.rb follows a live flow in two browser sessions.
• The connection dot. On the live projector page the connection-status controller sits on the .pj-canvas itself (one per page, as before), so the cue’s dot is its dot target; the controller mirrors the dot’s state into data-connected, which the projector stylesheet colours (only pj-* classes are allowed there) — the one colour source for that dot: the controller’s bg-green-500 / bg-red-500 toggles stay for the voter view’s dot and skip .pj-connection-dot. A closed meeting’s screen is the same page with the same controller (VOT-454); the dead-link page has none.
• Layout. chair_podium is the hero (1.8 fr) beside a rail of three (rail1–rail3, 1 fr), above the cue: a full-width auto row with the band hint. An empty rail slot hands its rows to its stack neighbour; with the whole rail empty the grid is "hero" "cue" and the hero full. The template’s large text (text_scale: large) fits 1440×900: a round titled like its item spends no line on its title, the result’s decision pill sits in the heading, the rule sentence under the bars is whole or left out (the hero is a .pj-fit in priority order since VOT-446, which dropped .pj-chair-fit), and the cue keeps «Sist oppdatert» beside it. While the meeting is preparing the canvas gets an inset amber frame (pj-canvas--rehearsal, a box-shadow inside the canvas padding, so the grid does not move).
• Query cost. Measured on the N+1 guard’s rich meeting, against the same screen with clocks in place of the two chair widgets: about 4 more queries while a round-1 poll is open («Avgjort» already loads the open round), 9 in the ready state and at an election’s result, 11 at a binary result. The count does not grow with the meeting (3 against 30 closed polls on other items and 45 more agenda items give the same count while voting and at a result) and is paid only by Dirigentskjerm screens, at most once per refresh.

​

The closed screen (VOT-454)

• The record region. ProjectorLayout.resolve makes the preset’s primary slot the record region once context.closed? — unless the screen keeps its own content (VOT-457, ProjectorScreen#keeps_own_content_once_closed?: its own chain, then the welcome message, the record as the fallback; the two-thirds weighting only with the record) — a system region (Region#system == :closed_record, like the idle one, not a catalogue widget) whose own chain is not asked, so no tally or poll is loaded for it. meetings/projector/widgets/_closed_record renders it from ProjectorContext#record (the meeting’s MeetingRecord, built once per request and only when a closed meeting is rendered): «Avsluttet», «Møtet er avsluttet», the closing line (with who ended the meeting only on chair_podium, the resolver’s show_actor option), the counts and each item’s outcome in the participant record’s words and order — never a tally, a vote count or the meeting’s title. On the Dirigentskjerm the hero is the record, the rail keeps the clock and the cue shows only «Sist oppdatert» and the dot; no ChairState is built.
• Closed-state rules. The other slots keep their sections: ProjectorWidgets::Base#present? asks closed_content? once the meeting is closed. The meeting-flow widgets that describe what happens now (current_item, next_item, remaining_voters, participant_grid, knockout, chair_state) are hidden_once_closed and answer without a query; active_poll / last_result show the newest closed poll only when it is revealed under their own reveal (poll_on_display ignores a poll left open); agenda drops the current row; next_action renders only its meta (widgets/_cue_meta).
• Reveal-safe record. MeetingRecord’s entries read AgendaItem#announced_result / #announced_elected_candidates: an item whose latest round awaits the chair (Poll#awaiting_decision?, the predicate of the on_confirm reveal) shows no decision, and only confirmed candidates are named — on the participant and voter records as on the projector. The secretary summary and the protokoll keep winning_result.
• Streams and the reopen morph. progress is not subscribed once closed; updates and projector are. «Start møte», «Avslutt møte» and «Gjenåpne møte» reach an open screen through the updates refresh: the refetched page morphs in place (same body classes and data attributes, the record region in or out, the progress source removed or added) — test/system/projector_meeting_states_test.rb drives the cycle on two anonymous screens without a reload.
• Preloaded rounds. The record loads every item with its rounds, options and snapshots, and AgendaItem’s outcome readers read fully preloaded rounds without a query (ties broken by id on both paths), so the closed screens’ query count does not grow with the agenda (below).

​

Cable identity without a login (VOT-443)

• An active session first. An active session → current_user. Since VOT-449 a dead one (expired, idle > 72 h, logged out elsewhere) falls through to the projector cookie, so a logged-in projector on a public screen keeps updating when its session dies. A restricted screen has no cookie identity, so its page connects as its admitted user or not at all.
• Otherwise the projector cookie. A valid one (screen exists, digest matches the current token in constant time, allowed_for?) → projector_screen, with current_user nil. Rotation and deletion are revocation at the next connect; a live socket is not cut, it only ever receives bare refreshes and its next refetch lands on the dead-link page.
• Only ProjectorStreamsChannel. The channel every projector page uses (a Turbo::StreamsChannel subclass that also re-checks the screen — below). Plain Turbo::StreamsChannel refuses a connection without current_user (config/initializers/turbo_streams_channel.rb, VOT-449), so a signed stream name that once reached a projector page cannot be replayed past the screen check. Any future channel that needs a user must check current_user itself.

​

Dead links

​

Access levels (VOT-449)

1. The token. A dead link gets meetings/projector/unavailable (401) first, whatever the level and the viewer — it never reveals a level.
2. The level. public renders for anyone without resuming a session and issues the projector_screen cookie. participants / management resume the session and ask ProjectorAdmission.for(screen, user): an admitted viewer gets the same page (no cookie), an anonymous one meetings/projector/login_required (401), a signed-in one without access meetings/projector/forbidden (403).

​

Rendering limits

• One closed poll per tally widget; no list. A tally widget shows at most one closed poll — the poll on display or the last result — and reads its round number, final badge and eligible-voter count from loaded associations and the tally snapshot (poll_result_snapshots.eligible_voter_count), so 30 closed polls cost the queries of 10, while the meeting runs and once it is closed (test/integration/n1_hot_paths_test.rb). Since VOT-454 no screen lists closed polls.
• The closed screen does not grow with the agenda. The record region and the participant and voter records read the preloaded MeetingRecord, so the «Hovedskjerm», an on_close poll screen, the Dirigentskjerm and «Velkomst» of a closed meeting with 50 agenda items cost the queries of one with 5 (measured: 8 / 8 / 9 / 8 queries; the participant and voter pages 15 / 10).
• Query count independent of the layout. Every widget reads through the request’s ProjectorContext, so placing a widget four times costs no more queries than placing it once; the Bullet guard renders every renderable widget in every preset with one poll open, with none and — VOT-454 — with the meeting closed, plus the option variants (VOT-451), and pins that next_item beside the agenda and knockout beside live bars add no query. Since VOT-452 the rich meeting also carries a welcome message with an image and an inherited https logo, and the informational widgets load no poll, agenda, participant, vote or rich-text data.
• Any browser. The projector is exempt from allow_browser versions: :modern (allow_any_browser?); its CSS needs Safari 16.4 / Chrome 111 / Firefox 128, and an older smart-TV browser renders unstyled rather than getting a 406.
• No third-party requests but images. Inter is served from the app’s own assets, so a venue without internet access beyond the app still gets the design’s type; the QR code is generated in the app. The only requests a screen may make elsewhere are for the organisation’s https logo (Organisasjon; a logo that cannot load falls back to the initials) and for any image embedded by address in rich text (the welcome message, the item description). Browsers send only the origin as referrer (Referrer-Policy: strict-origin-when-cross-origin, the Rails default; the logo <img> sends none), so the projector token never leaks (test/integration/content_security_policy_test.rb).

​

Organiser UI (VOT-455)

• Preview pipeline. Setup params (the editor’s state, or nothing for a saved screen) → ProjectorScreenSetup (the one translator to sections, the same object the save uses) → an unsaved screen (build_unsaved, ProjectorScreen.new(meeting_id:)) → ProjectorPreview::Context (the meeting’s real identity, a fictional flow, one of six scenarios — the sixth, paused, shows a sample pause and message, never the meeting’s real ones) → ProjectorLayout.resolve → the shared canvas partial meetings/projector/_canvas with live: false: no stream source, no connection-status controller, no projector_screen cookie, nothing written or broadcast, Cache-Control: no-store. GET .../projector_screens/preview (new screen) and GET .../projector_screens/:id/preview (saved screen) answer 200 whatever the params hold. The projector page renders the same canvas with live: true beside its stream sources (updates and projector always, progress when the screen needs it).
• Editor transport. Both steps live in one Turbo frame (projector_screen_setup): step navigation posts to step and renders 200 (422 for an invalid step 1) in the frame, carrying the other step’s values as hidden fields; the final save leaves the frame (_top). projector_setup_controller.js debounces form changes (600 ms) and replaces the preview iframe’s document with a GET of the preview URL through contentWindow.location.replace — no session-history entry, so Back leaves the editor; the scenario select refreshes at once. Puma refuses a query string over 10 KB before Rails sees it, so the URL leaves out the hidden option fieldsets and carries each text option trimmed to ProjectorPreview::TEXT_BYTES (300) bytes of UTF-8 on a character boundary, plus preview_truncated=1, which shows «Forhåndsvisningen viser forkortet tekst» over the canvas; the server-built first src (projector_preview_url) applies the same rule, and the save (a POST) keeps every text whole. The «Personvern» card is read from a template in the preview response, so one request per change updates both. projector_region_controller.js shows the chosen widget’s server-rendered option fieldset (the others disabled, so they are not posted) and edits the reserve stack.
• Thumbnails. Each row of the overview carries a lazy (loading="lazy"), CSS-scaled iframe of the screen’s member preview in the default voting scenario — sample data, never the meeting’s votes — out of the tab order and the accessibility tree. The overview itself costs the same for 2 and for 6 screens (badges, summary and QR code are computed in-process).
• Framing. The CSP sends frame-ancestors 'self' (the same rule as Rails’ X-Frame-Options: SAMEORIGIN, which stays) beside the unchanged frame-src 'self' https://challenges.cloudflare.com, so only the app frames its previews. No inline script: both controllers come from the importmap.

​

Meeting Broadcast Streams

​

Self-healing clients

• once the cable connection is healthy again after it was re-established or may have lost messages, with 0–5 s of random jitter (0–1 s if the tab just became visible), so a deploy does not make every client fetch at once;
• about 1 s after the tab becomes visible while the connection is healthy — skipped while a form field has focus.

• a stream source losing its connected attribute (an ordinary drop) — this counts even before the connection as a whole was first seen healthy (a stream is often confirmed before the page’s other subscriptions, so that can take up to a second after the page loads);
• a stream source being confirmed again while it already was connected (each confirm_subscription re-sets the attribute, which the controller sees as a mutation record; a second confirmation means the server-side subscription was created anew);
• the consumer’s connection.webSocket object changing;
• no message at all for 10 s (monitor.refreshedAt; the server pings every 3 s).

• data-keep-typed (application.js): a form or wrapper with this attribute and an id keeps everything it holds once the user has changed one of its fields (input, change, trix-change): a morph of it is cancelled (turbo:before-morph-element, same id in the new render) until a submission from it starts (its answer renders as usual) or the page is left; its removal is never blocked. Until then the server cannot change it either (a lock notice inside it appears with the next render after the save, which the server validates anyway). Marked: Møtedetaljer’s settings form (title, short name, language, dates, voting rights, welcome message), the Prøvekjøring bot console, «Legg til deltaker» and the participant edit form, the CSV import and the CSV editor («Rå»), Saksoppsett’s renumbering tables, the Protokoll export form and the secretary comment on a completed item. Pinned by test/system/secretary_pages_test.rb (the bot count kept through a broadcast, before and after the stage frame has a src).
• Permanent fields: the «Ny sak» / «Rediger» question form (keyed per form, VOT-467/468), the Deltakere search (VOT-473) and the «Direktekontroller» fields on Projektorskjermer (VOT-445).
• A stage that shows a write’s 200 answer (the CSV sync preview, the renumbering preview): its frame src is the POST path, so a refresh used to reload it with a GET of a POST-only route and put «No route matches» on screen. secretary_shell_controller.js keeps such a stage data-turbo-permanent through every refresh morph until the frame navigates on.
• Left as is: Tilpass and the projector editor carry no updates stream and no connection dot (design A11), so nothing refreshes them but their own submit; the confirmation pages (withdraw voting rights, the previews’ own confirm) hold no typed field; a form’s 422 echo is not protected until the user changes a field again (a refresh before that shows the stored values).

​

Deployment

• .kamal/secrets — production (Doppler prd config)
• .kamal/secrets.staging — staging (Doppler stg config)