ci: build & publish app + bot images to Gitea registry on merge

Add a Gitea Actions workflow (.gitea/workflows/build-images.yml) that fires on
push to main (and workflow_dispatch). On the always-on ubuntu-latest runner it:

  - verifies the host Docker daemon is reachable (socket must be mounted)
  - logs into gitea.whitlocktech.com with a PAT (REGISTRY_USER / REGISTRY_TOKEN)
  - builds & pushes both images from the existing Dockerfiles, each tagged
    :latest and :sha-<7>:
      gitea.whitlocktech.com/<owner>/website-app  (./Dockerfile — server+client)
      gitea.whitlocktech.com/<owner>/website-bot   (./bot/Dockerfile)

Raw docker CLI (no marketplace actions) for portability on self-hosted Gitea;
the shared host daemon gives free layer caching between runs. Registry owner is
lowercased for Docker refs. Deploy (compose image: + pull) is a follow-up.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114TpmrNW4wNXsHq5CR72jQ

.gitea/workflows/build-images.yml

@@ -0,0 +1,87 @@
+# Build and publish the app + bot container images to Gitea's container registry
+# on every merge to main. Production then pulls prebuilt images instead of
+# building on the host.
+#
+# Prerequisites (one-time):
+#   • An always-on Gitea runner with label `ubuntu-latest` whose jobs have the
+#     host Docker socket mounted (/var/run/docker.sock), so `docker build` talks
+#     to the host daemon. This also gives free layer caching between runs.
+#   • Two repo secrets (Settings → Actions → Secrets):
+#       REGISTRY_USER  — the Gitea username that owns the token below
+#       REGISTRY_TOKEN — a Gitea access token with `write:package` (+ read:package)
+#     See the PR description / README for step-by-step token creation.
+#
+# Produces, in gitea.whitlocktech.com/<owner>/ :
+#   website-app:latest  + website-app:sha-<7>
+#   website-bot:latest  + website-bot:sha-<7>
+
+name: Build container images
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch: {}
+
+concurrency:
+  group: images-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY: gitea.whitlocktech.com
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the merged commit
+        uses: actions/checkout@v4
+
+      - name: Derive image refs (registry owner must be lowercase for Docker)
+        run: |
+          set -euo pipefail
+          OWNER="$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')"
+          SHORT_SHA="${GITHUB_SHA:0:7}"
+          echo "APP_IMAGE=${REGISTRY}/${OWNER}/website-app" >> "$GITHUB_ENV"
+          echo "BOT_IMAGE=${REGISTRY}/${OWNER}/website-bot" >> "$GITHUB_ENV"
+          echo "TAG=sha-${SHORT_SHA}" >> "$GITHUB_ENV"
+
+      - name: Verify the Docker daemon is reachable
+        # Fails fast with a clear message if the host socket isn't mounted into
+        # the job container (the one hard runner prerequisite).
+        run: |
+          set -euo pipefail
+          if ! docker info >/dev/null 2>&1; then
+            echo "::error::Docker daemon not reachable. Mount /var/run/docker.sock into the runner's job containers."
+            exit 1
+          fi
+          echo "Docker daemon OK"
+
+      - name: Log in to the Gitea container registry
+        run: |
+          set -euo pipefail
+          echo "${{ secrets.REGISTRY_TOKEN }}" \
+            | docker login "${REGISTRY}" -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      - name: Build & push the app image (server + client)
+        run: |
+          set -euo pipefail
+          docker build -f Dockerfile \
+            -t "${APP_IMAGE}:latest" \
+            -t "${APP_IMAGE}:${TAG}" \
+            .
+          docker push "${APP_IMAGE}:latest"
+          docker push "${APP_IMAGE}:${TAG}"
+
+      - name: Build & push the bot image
+        run: |
+          set -euo pipefail
+          docker build -f bot/Dockerfile \
+            -t "${BOT_IMAGE}:latest" \
+            -t "${BOT_IMAGE}:${TAG}" \
+            .
+          docker push "${BOT_IMAGE}:latest"
+          docker push "${BOT_IMAGE}:${TAG}"
+
+      - name: Log out (clear cached credentials from the runner)
+        if: always()
+        run: docker logout "${REGISTRY}" || true

README.md

@@ -353,6 +353,8 @@ Copy `.env.example` (Compose) or `server/.env.example` (local) and fill in. **`.
 | `CLIENT_ORIGIN` | `http://localhost:5173` | enables CORS in dev only |
 | `LOG_LEVEL` / `FILE_LOG_LEVEL` | `info` / `debug` | console / file verbosity |
 | `LOG_TO_FILE` / `LOG_DIR` / `LOG_FILE` | `true` / `<server>/logs` / `app.log` | log file (bind-mounted to `./logs` in Docker) |
+| `ANNOUNCE_POLL_MS` | `15000` | how often the news-announcement dispatcher sweeps `announce_jobs` for due/retry legs (town crier + Discord) |
+| `TOWNCRIER_DURATION_SEC` | `3600` | how long a news post's in-game town-crier message stays up (≤ `86400`) |
 
 ---
 

client/src/api/client.js

@@ -112,6 +112,10 @@ export const api = {
     deletePost: (id) => req(`/admin/posts/${id}`, { method: 'DELETE' }),
     publishPost: (id, published) =>
       req(`/admin/posts/${id}/publish`, { method: 'PATCH', body: { published } }),
+    // News announcement pipeline (town crier + Discord) status + per-leg retry.
+    getAnnounce: (id) => req(`/admin/posts/${id}/announce`),
+    retryAnnounceLeg: (id, leg) =>
+      req(`/admin/posts/${id}/announce/retry`, { method: 'POST', body: { leg } }),
     uploadImage: (file) => {
       const fd = new FormData()
       fd.append('image', file)

client/src/components/CharacterStats.jsx

@@ -0,0 +1,72 @@
+import { useEffect, useState } from 'react'
+
+// A small stat-tile row for a "My Characters" page: total characters, how many
+// are online right now, and how many game accounts are linked. `scope` is the
+// shard api object (admin or player self-service). Renders nothing until an
+// account is linked, so the empty/link-prompt state below it stands alone.
+//
+// It fetches the same rosters GameAccounts loads; for a personal page that's at
+// most a couple of extra live round-trips, and keeps this presentational bit
+// decoupled from GameAccounts' per-account roster loading.
+
+function Tile({ value, label }) {
+  return (
+    <div className="panel" style={{ padding: 20, textAlign: 'center' }}>
+      <div className="display" style={{ fontSize: '1.6rem', color: 'var(--head)' }}>{value}</div>
+      <div className="sans" style={{ color: 'var(--accent)', fontSize: '0.68rem', fontWeight: 700, letterSpacing: '0.15em', textTransform: 'uppercase', marginTop: 8 }}>
+        {label}
+      </div>
+    </div>
+  )
+}
+
+export default function CharacterStats({ scope }) {
+  const [stats, setStats] = useState(null)
+
+  useEffect(() => {
+    let cancelled = false
+    ;(async () => {
+      try {
+        const accounts = await scope.accounts()
+        const linked = accounts.length
+        if (linked === 0) {
+          if (!cancelled) setStats({ linked: 0 })
+          return
+        }
+        // Roster is a live round-trip and can be unavailable (503); tolerate a
+        // partial result so a restarting shard doesn't blank the whole row.
+        const rosters = await Promise.allSettled(accounts.map((a) => scope.roster(a.account)))
+        let chars = 0
+        let online = 0
+        let complete = true
+        for (const r of rosters) {
+          if (r.status === 'fulfilled') {
+            const cs = r.value.chars || []
+            chars += cs.length
+            online += cs.filter((c) => c.online).length
+          } else {
+            complete = false
+          }
+        }
+        if (!cancelled) setStats({ linked, chars, online, complete })
+      } catch {
+        if (!cancelled) setStats({ error: true })
+      }
+    })()
+    return () => { cancelled = true }
+  }, [scope])
+
+  // Hidden until we know an account is linked (or while first loading).
+  if (!stats || stats.error || stats.linked === 0) return null
+
+  // Counts depend on live rosters; show a dash if none came back.
+  const count = (n) => (stats.complete || stats.chars > 0 ? n : '—')
+
+  return (
+    <section className="grid-3" style={{ gap: 14, marginBottom: 26 }}>
+      <Tile value={count(stats.chars)} label="Characters" />
+      <Tile value={count(stats.online)} label="Online now" />
+      <Tile value={stats.linked} label={stats.linked === 1 ? 'Linked account' : 'Linked accounts'} />
+    </section>
+  )
+}

client/src/components/HeroElement.jsx

@@ -1,4 +1,5 @@
 import { Link } from 'react-router-dom'
+import DOMPurify from 'dompurify'
 
 const MOON_IMAGE = '/assets/img/hero-moon.png'
 
@@ -34,7 +35,19 @@ function TextBlock({ props }) {
   return (
     <div style={{ textAlign: align, textShadow: '0 2px 22px rgba(0,0,0,0.82)' }}>
       {(props.lines || []).map((line, i) => {
-        const Tag = /^(h1|h2|h3|p|span)$/.test(line.tag) ? line.tag : 'p'
+        const Tag = /^(h1|h2|h3|p|span|div)$/.test(line.tag) ? line.tag : 'p'
+        // A rich-text line (e.g. the homepage teaser) carries sanitized HTML;
+        // sanitize again on render as defense in depth. Others render as text.
+        if (line.html) {
+          return (
+            <Tag
+              key={i}
+              className="hero-rich"
+              style={lineStyle(line)}
+              dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(line.text || '') }}
+            />
+          )
+        }
         return (
           <Tag key={i} style={lineStyle(line)}>
             {line.text}

client/src/lib/heroLayout.js

@@ -64,7 +64,7 @@ export function defaultLayout(teaser) {
             { text: 'Private shard project', tag: 'span', fontSize: '0.74rem', color: '#c2d2e6', weight: 700, letterSpacing: '0.22em', transform: 'uppercase', font: 'sans' },
             { text: 'UOMysticmoon', tag: 'h1', fontSize: 'clamp(3rem,8.5vw,5.75rem)', color: 'var(--head)', weight: 600, letterSpacing: '0.02em', lineHeight: 1, font: 'display', marginTop: 14 },
             { text: 'A private Ultima Online world in progress', tag: 'p', fontSize: '1.32rem', color: '#dbe2ea', italic: true, marginTop: 22 },
-            { text: teaser, tag: 'p', fontSize: '1.06rem', color: '#c4cdd8', maxWidth: 600, marginTop: 22 },
+            { text: teaser, tag: 'div', html: true, fontSize: '1.06rem', color: '#c4cdd8', maxWidth: 600, marginTop: 22 },
           ],
         },
       },

client/src/routes/admin/views/AdminCharacters.jsx

@@ -1,15 +1,16 @@
+import CharacterStats from '../../../components/CharacterStats.jsx'
 import GameAccounts from '../../../components/GameAccounts.jsx'
 import VendorSales from '../../../components/VendorSales.jsx'
 import { api } from '../../../api/client.js'
 
 // Staff link their OWN in-game account and view their characters — the same
 // shared component players use, pointed at the staff self-service endpoints.
+// Sits inside the Admin shell, which supplies the "My Characters" page header;
+// stat tiles bring it to parity with the Player Portal's Characters page.
 export default function AdminCharacters() {
   return (
     <section style={{ maxWidth: 760 }}>
-      <p className="sans" style={{ marginTop: 0, marginBottom: 22, color: 'var(--muted)', fontSize: '0.92rem', lineHeight: 1.6 }}>
-        Link your own game account to view your characters, stats, skills and vendors.
-      </p>
+      <CharacterStats scope={api.admin.shard} />
       <GameAccounts scope={api.admin.shard} charTo={(serial) => `/admin/characters/${serial}`} />
       <VendorSales fetchSales={api.admin.shard.sales} />
     </section>

client/src/routes/admin/views/PostEditor.jsx

@@ -1,4 +1,4 @@
-import { lazy, Suspense, useState } from 'react'
+import { lazy, Suspense, useEffect, useState } from 'react'
 import Modal from '../../../components/Modal.jsx'
 import { api } from '../../../api/client.js'
 
@@ -105,6 +105,8 @@ export default function PostEditor({ post, onClose, onSaved }) {
       <div style={{ display: 'flex', flexDirection: 'column', gap: 16 }}>
         {error && <p className="sans" style={{ margin: 0, color: '#d98b84', fontSize: '0.85rem' }}>{error}</p>}
 
+        {isEdit && post.category === 'news' && <AnnouncePanel postId={post.id} />}
+
         <div style={{ display: 'flex', gap: 14, flexWrap: 'wrap' }}>
           <label style={{ flex: '1 1 200px' }}>
             <span className="field-label">Category</span>
@@ -173,3 +175,94 @@ const delStyle = {
   cursor: 'pointer',
   marginRight: 'auto',
 }
+
+// ── Announcement status panel ────────────────────────────────────────────────
+// Shows the town-crier + Discord delivery state for a published news post and
+// offers a per-leg retry (useful after fixing the sidecar / news channel without
+// re-publishing). Only rendered for news posts in edit mode; renders nothing
+// until the post has actually been announced (no job row yet → nothing to show).
+const LEG_META = {
+  towncrier: { label: 'In-game town crier' },
+  discord: { label: 'Discord #news' },
+}
+const STATUS_STYLE = {
+  done: { color: '#7bbf8f', label: 'delivered' },
+  pending: { color: '#d9b84a', label: 'pending' },
+  failed: { color: '#d98b84', label: 'failed' },
+}
+
+function AnnouncePanel({ postId }) {
+  const [job, setJob] = useState(null)
+  const [loading, setLoading] = useState(true)
+  const [retrying, setRetrying] = useState('')
+
+  async function load() {
+    try {
+      setJob(await api.admin.getAnnounce(postId))
+    } catch {
+      setJob(null)
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    load()
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [postId])
+
+  async function retry(leg) {
+    setRetrying(leg)
+    try {
+      setJob(await api.admin.retryAnnounceLeg(postId, leg))
+    } catch {
+      // leave the current state; the row simply didn't change
+    } finally {
+      setRetrying('')
+    }
+  }
+
+  if (loading || !job) return null
+
+  return (
+    <div style={panelStyle}>
+      <span className="field-label" style={{ marginBottom: 2 }}>Announcement</span>
+      {['towncrier', 'discord'].map((leg) => {
+        const status = job[`${leg}_status`]
+        const err = job[`${leg}_last_error`]
+        const s = STATUS_STYLE[status] || STATUS_STYLE.pending
+        return (
+          <div key={leg} style={{ display: 'flex', flexDirection: 'column', gap: 3 }}>
+            <div style={{ display: 'flex', alignItems: 'center', gap: 8 }}>
+              <span className="sans" style={{ fontSize: '0.85rem', minWidth: 140 }}>{LEG_META[leg].label}</span>
+              <span className="sans" style={{ fontSize: '0.8rem', color: s.color, fontWeight: 600 }}>● {s.label}</span>
+              {status !== 'done' && (
+                <button
+                  onClick={() => retry(leg)}
+                  disabled={Boolean(retrying)}
+                  className="pill"
+                  style={{ marginLeft: 'auto', fontSize: '0.75rem', padding: '3px 12px' }}
+                >
+                  {retrying === leg ? 'Retrying…' : 'Retry'}
+                </button>
+              )}
+            </div>
+            {status === 'failed' && err && (
+              <span className="sans" style={{ fontSize: '0.75rem', color: '#d98b84', paddingLeft: 148 }}>{err}</span>
+            )}
+          </div>
+        )
+      })}
+    </div>
+  )
+}
+
+const panelStyle = {
+  display: 'flex',
+  flexDirection: 'column',
+  gap: 8,
+  padding: '12px 14px',
+  borderRadius: 8,
+  border: '1px solid var(--line)',
+  background: 'rgba(255,255,255,0.02)',
+}

client/src/routes/admin/views/SettingsAdmin.jsx

@@ -1,13 +1,21 @@
-import { useEffect, useState } from 'react'
+import { lazy, Suspense, useEffect, useState } from 'react'
 import { Loading, ErrorState } from '../../../components/PageState.jsx'
 import { api } from '../../../api/client.js'
 import { useSite } from '../../../contexts/SiteContext.jsx'
 import EmailDelivery from './EmailDelivery.jsx'
 
+// Lazy-loaded so the heavy rich-text editor stays code-split (matches PostEditor).
+const RichTextEditor = lazy(() => import('../../../components/RichTextEditor.jsx'))
+
 // Editable settings shown on this screen (key -> label + control type).
 const FIELDS = [
   { key: 'site_title', label: 'Site title' },
-  { key: 'homepage_teaser', label: 'Homepage teaser', long: true },
+  {
+    key: 'homepage_teaser',
+    label: 'Homepage teaser',
+    rich: true,
+    help: 'Rich text shown under the hero heading on the portal (when no custom hero layout is published).',
+  },
   { key: 'maintenance_message', label: 'Maintenance message', long: true },
   { key: 'status_message', label: 'Status message' },
   {
@@ -59,10 +67,13 @@ export default function SettingsAdmin() {
   if (loading) return <Loading />
   if (error) return <ErrorState message={error} />
 
-  const set = (k) => (e) => {
-    setValues((v) => ({ ...v, [k]: e.target.value }))
+  // setRaw takes the next value directly (rich editor onChange), set adapts a
+  // DOM change event onto it.
+  const setRaw = (k) => (val) => {
+    setValues((v) => ({ ...v, [k]: val }))
     setSaved(false)
   }
+  const set = (k) => (e) => setRaw(k)(e.target.value)
 
   async function save() {
     setBusy(true)
@@ -82,10 +93,18 @@ export default function SettingsAdmin() {
   return (
     <section style={{ maxWidth: 620 }}>
       <div style={{ display: 'flex', flexDirection: 'column', gap: 18 }}>
-        {FIELDS.map((f) => (
-          <label key={f.key} style={{ display: 'block' }}>
+        {FIELDS.map((f) => {
+          // A rich field can't live inside a <label> (nested toolbar buttons +
+          // contenteditable), so it uses a plain <div> wrapper instead.
+          const Wrap = f.rich ? 'div' : 'label'
+          return (
+          <Wrap key={f.key} style={{ display: 'block' }}>
             <span className="field-label">{f.label}</span>
-            {f.options ? (
+            {f.rich ? (
+              <Suspense fallback={<span className="spin" />}>
+                <RichTextEditor value={values[f.key]} onChange={setRaw(f.key)} variant="post" />
+              </Suspense>
+            ) : f.options ? (
               <select value={values[f.key]} onChange={set(f.key)} className="select">
                 {f.options.map((o) => (
                   <option key={o.value} value={o.value}>
@@ -103,8 +122,9 @@ export default function SettingsAdmin() {
                 {f.help}
               </span>
             )}
-          </label>
-        ))}
+          </Wrap>
+          )
+        })}
         <div style={{ display: 'flex', gap: 10, marginTop: 6, alignItems: 'center' }}>
           <button onClick={save} disabled={busy} className="btn btn-primary btn-sq">
             {busy ? 'Saving…' : 'Save changes'}

client/src/routes/player/PlayerAccount.jsx

@@ -335,7 +335,6 @@ export default function PlayerAccount() {
 
   return (
     <div>
-      <h1 className="display" style={{ margin: '0 0 4px', fontSize: '1.6rem', color: 'var(--head)' }}>Account</h1>
       {loading && <Loading />}
       {error && <ErrorState message={error} />}
       {!loading && !error && account && (

client/src/routes/player/PlayerCharacters.jsx

@@ -8,7 +8,6 @@ import { api } from '../../api/client.js'
 export default function PlayerCharacters() {
   return (
     <div>
-      <h1 className="display" style={{ margin: '0 0 18px', fontSize: '1.6rem', color: 'var(--head)' }}>Your characters</h1>
       <GameAccounts scope={api.player.shard} charTo={(serial) => `/player/char/${serial}`} />
       <VendorSales fetchSales={api.player.shard.sales} />
     </div>

client/src/routes/player/PlayerPortalLayout.jsx

@@ -1,22 +1,65 @@
-import { NavLink, Link, Outlet, useNavigate } from 'react-router-dom'
+import { NavLink, Outlet, useNavigate, useLocation } from 'react-router-dom'
 import MoonDot from '../../components/MoonDot.jsx'
 import { useAuth } from '../../contexts/AuthContext.jsx'
 
-// Shared shell for the logged-in player portal: a header with a nav bar
-// (Characters / Account) and the page content in an <Outlet />. Matches the
-// site's dark theme vocabulary.
-const tab = ({ isActive }) => ({
-  textDecoration: 'none',
+// Shared shell for the logged-in player portal. Uses the same sidebar shell as
+// Admin (icon nav, sticky content header, footer sign-out) so the two logged-in
+// experiences read as one app — the portal just carries fewer nav rows.
+
+// Small inline stroke icons (16px, currentColor) — same frame as AdminLayout.
+function Icon({ children, size = 16 }) {
+  return (
+    <svg
+      width={size}
+      height={size}
+      viewBox="0 0 24 24"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="2"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+      aria-hidden="true"
+      focusable="false"
+    >
+      {children}
+    </svg>
+  )
+}
+const IconUser = () => <Icon><circle cx="12" cy="8" r="4" /><path d="M4 21a8 8 0 0 1 16 0" /></Icon>
+const IconGear = () => <Icon><circle cx="12" cy="12" r="3" /><path d="M12 2v3M12 19v3M2 12h3M19 12h3M4.9 4.9l2.1 2.1M17 17l2.1 2.1M19.1 4.9L17 7M7 17l-2.1 2.1" /></Icon>
+
+const NAV = [
+  { to: '/player', label: 'Characters', end: true, icon: IconUser },
+  { to: '/account', label: 'Account', icon: IconGear },
+]
+
+// The sticky content header mirrors the active page. Character sheets live under
+// /player/char/:serial and keep their own in-page back link.
+const TITLES = {
+  '/player': 'Characters',
+  '/account': 'Account',
+}
+
+const navBtnBase = {
+  textAlign: 'left',
+  borderRadius: 8,
+  padding: '10px 14px',
   fontFamily: 'var(--sans)',
-  fontSize: '0.9rem',
-  padding: '8px 4px',
-  color: isActive ? 'var(--head)' : 'var(--muted)',
-  borderBottom: `2px solid ${isActive ? 'var(--accent)' : 'transparent'}`,
-})
+  fontSize: '0.92rem',
+  textDecoration: 'none',
+  display: 'flex',
+  alignItems: 'center',
+  gap: 10,
+  transition: 'background .15s,color .15s',
+}
 
 export default function PlayerPortalLayout() {
   const { user, logout } = useAuth()
   const navigate = useNavigate()
+  const location = useLocation()
+  const title =
+    TITLES[location.pathname] ||
+    (location.pathname.startsWith('/player/char/') ? 'Character' : 'Player Portal')
 
   async function signOut() {
     await logout()
@@ -24,31 +67,94 @@ export default function PlayerPortalLayout() {
   }
 
   return (
-    <main style={{ minHeight: '100vh', background: 'var(--bg-deep)', color: 'var(--ink)' }}>
-      <header style={{ borderBottom: '1px solid var(--line)' }}>
-        <div style={{ maxWidth: 820, margin: '0 auto', padding: '16px 20px', display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 12, flexWrap: 'wrap' }}>
-          <div style={{ display: 'flex', alignItems: 'center', gap: 12 }}>
-            <MoonDot size={12} glow={0.5} />
+    <div className="admin-grid">
+      {/* Sidebar */}
+      <aside
+        style={{
+          borderRight: '1px solid var(--line)',
+          background: 'var(--bg)',
+          display: 'flex',
+          flexDirection: 'column',
+          position: 'sticky',
+          top: 0,
+          height: '100vh',
+        }}
+      >
+        <div style={{ padding: '22px 22px 18px', borderBottom: '1px solid var(--line-soft)', display: 'flex', alignItems: 'center', gap: 10 }}>
+          <MoonDot />
           <div>
-              <div className="display" style={{ color: 'var(--head)', fontSize: '1.05rem', letterSpacing: '0.04em' }}>UOMysticmoon</div>
-              <div className="sans" style={{ color: 'var(--dim)', fontSize: '0.64rem', letterSpacing: '0.14em', textTransform: 'uppercase' }}>Player Portal</div>
+            <div className="display" style={{ fontSize: '1.02rem', color: 'var(--head)', letterSpacing: '0.03em' }}>
+              UOMysticmoon
+            </div>
+            <div className="sans" style={{ color: 'var(--dim)', fontSize: '0.66rem', letterSpacing: '0.14em', textTransform: 'uppercase' }}>
+              Player Portal
             </div>
           </div>
-          <div style={{ display: 'flex', alignItems: 'center', gap: 16 }}>
-            <span className="sans dim" style={{ fontSize: '0.82rem' }}>{user?.username}</span>
-            <Link to="/" className="sans" style={{ color: 'var(--accent)', fontSize: '0.84rem', textDecoration: 'none' }}>← Site</Link>
-            <button onClick={signOut} className="pill">Sign out</button>
         </div>
-        </div>
-        <nav style={{ maxWidth: 820, margin: '0 auto', padding: '0 20px', display: 'flex', gap: 22 }}>
-          <NavLink to="/player" end style={tab}>Characters</NavLink>
-          <NavLink to="/account" style={tab}>Account</NavLink>
+
+        <nav style={{ flex: 1, padding: '14px 12px', display: 'flex', flexDirection: 'column', gap: 4, overflowY: 'auto' }}>
+          {NAV.map((n) => (
+            <NavLink
+              key={n.to}
+              to={n.to}
+              end={n.end}
+              className="admin-nav-link"
+              style={({ isActive }) => ({
+                ...navBtnBase,
+                background: isActive ? 'var(--blue)' : 'transparent',
+                color: isActive ? 'var(--ink)' : 'var(--muted)',
+                borderLeft: `2px solid ${isActive ? 'var(--accent)' : 'transparent'}`,
+              })}
+            >
+              <n.icon />
+              <span>{n.label}</span>
+            </NavLink>
+          ))}
         </nav>
+
+        <div style={{ padding: '14px 16px', borderTop: '1px solid var(--line-soft)' }}>
+          <div className="sans" style={{ display: 'flex', alignItems: 'center', gap: 8, marginBottom: 12, fontSize: '0.78rem', color: 'var(--muted)' }}>
+            <span style={{ width: 9, height: 9, borderRadius: '50%', background: 'var(--mode-live)', boxShadow: '0 0 8px var(--mode-live)' }} />
+            Signed in as&nbsp;<strong style={{ color: 'var(--ink)' }}>{user?.username}</strong>
+          </div>
+          <button
+            onClick={signOut}
+            className="sans"
+            style={{ display: 'block', width: '100%', textAlign: 'center', border: '1px solid var(--line)', borderRadius: 8, padding: 9, color: 'var(--muted)', background: 'transparent', fontSize: '0.84rem', cursor: 'pointer' }}
+          >
+            Sign out
+          </button>
+        </div>
+      </aside>
+
+      {/* Main */}
+      <main style={{ display: 'flex', flexDirection: 'column', minWidth: 0 }}>
+        <header
+          style={{
+            display: 'flex',
+            alignItems: 'center',
+            justifyContent: 'space-between',
+            gap: 16,
+            padding: '20px 32px',
+            borderBottom: '1px solid var(--line-soft)',
+            background: 'var(--bg)',
+            position: 'sticky',
+            top: 0,
+            zIndex: 10,
+          }}
+        >
+          <h1 className="display" style={{ margin: 0, fontSize: '1.5rem', color: 'var(--head)' }}>
+            {title}
+          </h1>
+          <a href="/" style={{ color: 'var(--accent)', textDecoration: 'none', fontSize: '0.84rem', fontFamily: 'var(--sans)' }}>
+            ← Site
+          </a>
         </header>
 
-      <div style={{ maxWidth: 820, margin: '0 auto', padding: '28px 20px 60px' }}>
+        <div style={{ flex: 1, padding: '30px 32px 60px', maxWidth: 900, width: '100%' }}>
           <Outlet />
         </div>
       </main>
+    </div>
   )
 }

client/src/styles/theme.css

@@ -546,6 +546,20 @@ button[disabled] {
 }
 
 /* ===== Hero canvas editor ===== */
+/* Rich-text hero line (e.g. the homepage teaser). Inherits the line's font/color
+   from its inline style; collapse the editor's outer block margins so spacing is
+   driven by the line's own marginTop rather than a nested <p>. */
+.hero-rich > :first-child {
+  margin-top: 0;
+}
+.hero-rich > :last-child {
+  margin-bottom: 0;
+}
+.hero-rich a {
+  color: inherit;
+  text-decoration: underline;
+}
+
 .hero-el-editable {
   outline: 1px dashed rgba(127, 153, 189, 0.45);
   outline-offset: 2px;

server/.env.example

@@ -88,3 +88,11 @@ CLIENT_ORIGIN=http://localhost:5173
 # encrypted in the DB (see the bot_config table / SECRET_ENC_KEY above).
 BOT_INTERNAL_URL=http://localhost:4100
 BOT_INTERNAL_KEY=dev-only-change-me-bot-key
+
+# News announcement pipeline (published news post -> in-game town crier + Discord
+# #news). The dispatcher is an in-process poller; these tune it. Links in the
+# announcements use APP_BASE_URL (set above), so set that in production too.
+#   ANNOUNCE_POLL_MS       how often the dispatcher sweeps for due/retry legs
+#   TOWNCRIER_DURATION_SEC how long the in-game town-crier message stays up (<= 86400)
+ANNOUNCE_POLL_MS=15000
+TOWNCRIER_DURATION_SEC=3600

server/db/schema.sql

@@ -647,6 +647,37 @@ CREATE TABLE IF NOT EXISTS pages (
   INDEX idx_pages_nav (show_in_nav, nav_group, nav_order)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
 
+-- Announcement pipeline. One row per publish event of a news post; the table
+-- doubles as the job queue (a light in-process poller — utils/announceWorker.js
+-- — sweeps it for due legs). Two INDEPENDENT delivery legs so a Discord outage
+-- never blocks or retries the in-game town-crier leg and vice versa. `status` is
+-- a derived rollup of the two legs (see announceJobs.logic.js): done when both
+-- legs done, failed when both exhausted, partial in between. Each leg tracks its
+-- own attempt count, last error, and next-due time for exponential backoff.
+-- post_id is INT (matches posts.id) and cascades so deleting a post reaps its
+-- jobs. posts.announce_job_id points back at the latest row for admin lookups.
+CREATE TABLE IF NOT EXISTS announce_jobs (
+  id                        INT AUTO_INCREMENT PRIMARY KEY,
+  post_id                   INT NOT NULL,
+  status                    ENUM('pending','partial','done','failed') NOT NULL DEFAULT 'pending',
+
+  towncrier_status          ENUM('pending','done','failed') NOT NULL DEFAULT 'pending',
+  towncrier_attempts        SMALLINT NOT NULL DEFAULT 0,
+  towncrier_last_error      TEXT NULL,
+  towncrier_next_attempt_at DATETIME NULL,
+
+  discord_status            ENUM('pending','done','failed') NOT NULL DEFAULT 'pending',
+  discord_attempts          SMALLINT NOT NULL DEFAULT 0,
+  discord_last_error        TEXT NULL,
+  discord_next_attempt_at   DATETIME NULL,
+
+  created_at                DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at                DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  CONSTRAINT fk_announce_jobs_post FOREIGN KEY (post_id) REFERENCES posts(id) ON DELETE CASCADE,
+  INDEX idx_announce_due (towncrier_status, towncrier_next_attempt_at),
+  INDEX idx_announce_due_discord (discord_status, discord_next_attempt_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
 -- Migrations for databases created before the wiki upgrade. Each statement uses
 -- IF NOT EXISTS so re-running on every boot is a harmless no-op. New installs get
 -- these columns from the CREATE TABLE above; existing installs get them here.
@@ -683,3 +714,13 @@ ALTER TABLE wiki_pages ADD COLUMN IF NOT EXISTS published TINYINT(1) NOT NULL DE
 ALTER TABLE wiki_pages ADD COLUMN IF NOT EXISTS sort_order INT NOT NULL DEFAULT 0;
 ALTER TABLE wiki_pages ADD COLUMN IF NOT EXISTS published_at DATETIME NULL;
 ALTER TABLE wiki_pages ADD FULLTEXT INDEX IF NOT EXISTS idx_wiki_search (title, body);
+
+-- News → town-crier + Discord announcement pipeline. Add the announcement-state
+-- columns to posts on databases created before the pipeline landed. announced_at
+-- is stamped once both legs deliver; announce_job_id points at the announce_jobs
+-- row for the post's admin status panel. Kept as a plain column (not a hard FK)
+-- so the idempotent boot migration never trips over a re-added constraint — the
+-- pointer is resolved in application code and the CASCADE on announce_jobs.post_id
+-- already keeps the two tables consistent.
+ALTER TABLE posts ADD COLUMN IF NOT EXISTS announced_at DATETIME NULL;
+ALTER TABLE posts ADD COLUMN IF NOT EXISTS announce_job_id INT NULL;

server/src/model/announceJobs/announceJobs.db.js

@@ -0,0 +1,68 @@
+const { query } = require('../../utils/db')
+
+const COLS =
+  'id, post_id, status, ' +
+  'towncrier_status, towncrier_attempts, towncrier_last_error, towncrier_next_attempt_at, ' +
+  'discord_status, discord_attempts, discord_last_error, discord_next_attempt_at, ' +
+  'created_at, updated_at'
+
+// Whitelist so a `leg` value can be interpolated into a column name safely — it
+// never comes from raw user input, but keep the guard explicit.
+const LEGS = ['towncrier', 'discord']
+function assertLeg(leg) {
+  if (!LEGS.includes(leg)) throw new Error(`unknown announce leg: ${leg}`)
+}
+
+async function create(postId) {
+  const res = await query('INSERT INTO announce_jobs (post_id) VALUES (?)', [postId])
+  return res.insertId
+}
+
+async function findById(id) {
+  const rows = await query(`SELECT ${COLS} FROM announce_jobs WHERE id = ? LIMIT 1`, [id])
+  return rows[0] || null
+}
+
+async function findByPostId(postId) {
+  const rows = await query(
+    `SELECT ${COLS} FROM announce_jobs WHERE post_id = ? ORDER BY id DESC LIMIT 1`,
+    [postId],
+  )
+  return rows[0] || null
+}
+
+// Jobs with at least one leg that is due now: pending and either never scheduled
+// (next_attempt_at IS NULL — a fresh enqueue) or past its backoff time.
+async function findDue(now = new Date(), limit = 25) {
+  return query(
+    `SELECT ${COLS} FROM announce_jobs
+      WHERE (towncrier_status = 'pending'
+             AND (towncrier_next_attempt_at IS NULL OR towncrier_next_attempt_at <= ?))
+         OR (discord_status = 'pending'
+             AND (discord_next_attempt_at IS NULL OR discord_next_attempt_at <= ?))
+      ORDER BY id ASC
+      LIMIT ?`,
+    [now, now, limit],
+  )
+}
+
+// Update one leg's columns. `fields` uses leg-agnostic keys (status, attempts,
+// lastError, nextAttemptAt); we map them onto the leg-prefixed columns.
+async function updateLeg(id, leg, { status, attempts, lastError, nextAttemptAt }) {
+  assertLeg(leg)
+  await query(
+    `UPDATE announce_jobs SET
+       ${leg}_status = ?,
+       ${leg}_attempts = ?,
+       ${leg}_last_error = ?,
+       ${leg}_next_attempt_at = ?
+     WHERE id = ?`,
+    [status, attempts, lastError ?? null, nextAttemptAt ?? null, id],
+  )
+}
+
+async function setStatus(id, status) {
+  await query('UPDATE announce_jobs SET status = ? WHERE id = ?', [status, id])
+}
+
+module.exports = { LEGS, create, findById, findByPostId, findDue, updateLeg, setStatus }

server/src/model/announceJobs/announceJobs.logic.js

@@ -0,0 +1,127 @@
+// ── Announcement pipeline: pure logic ──────────────────────────────────────
+//
+// No DB, no network — just the decisions the worker and model make, kept here so
+// they are unit-testable in isolation (server/test/announceJobs.test.js):
+//   • buildTownCrierText — turn a post into sidecar-safe town-crier lines
+//   • classifyTownCrier / classifyDiscord — map a dispatch result to done / retry
+//     / terminal, so a data problem fails fast and a transient outage retries
+//   • scheduleAfter — exponential backoff schedule + the attempt cap
+//   • rollupStatus — derive the parent job status from the two legs
+
+const { deriveExcerpt } = require('../../utils/sanitizeHtml')
+
+// Sidecar town-crier caps, mirrored from the admin route validation
+// (admin.routes.js: lines isArray({ max: 8 }), lines.* isLength({ max: 200 })).
+// We pre-truncate to these so a published post never bounces with towncrier.error.
+const MAX_LINES = 8
+const MAX_LINE_LEN = 200
+
+// Backoff between retries, indexed by attempts-so-far. Six attempts spread over
+// ~a couple of hours; after the last one a leg is marked failed and surfaced in
+// the post's admin panel. Shared by both legs.
+const BACKOFF_MS = [30_000, 120_000, 600_000, 1_800_000, 3_600_000, 7_200_000]
+const MAX_ATTEMPTS = BACKOFF_MS.length
+
+// Trim to a hard length, appending an ellipsis only when something was cut.
+function clamp(value, max) {
+  const s = String(value == null ? '' : value)
+    .replace(/\s+/g, ' ')
+    .trim()
+  if (s.length <= max) return s
+  return `${s.slice(0, max - 1).trimEnd()}…`
+}
+
+// The public link that goes in the announcement. News has no per-post route
+// (App.jsx only has the /site/news list), so we link the list — matches the
+// pre-pipeline Discord announce behavior.
+function articleUrl(baseUrl) {
+  return `${String(baseUrl || '').replace(/\/+$/, '')}/site/news`
+}
+
+// Build the town-crier lines: title, a one-line excerpt, then the URL. Each line
+// is clamped to the sidecar's per-line cap and the whole thing to the line-count
+// cap. Falls back to a stripped body excerpt when the post has no excerpt.
+function buildTownCrierText(post, { baseUrl } = {}) {
+  const title = clamp(post.title, MAX_LINE_LEN)
+  const excerptSource = post.excerpt || deriveExcerpt(post.body, MAX_LINE_LEN) || ''
+  const lines = [title]
+  const excerpt = clamp(excerptSource, MAX_LINE_LEN)
+  if (excerpt) lines.push(excerpt)
+  const url = clamp(articleUrl(baseUrl), MAX_LINE_LEN)
+  if (url) lines.push(url)
+  return lines.filter(Boolean).slice(0, MAX_LINES)
+}
+
+// ── Result classification ──────────────────────────────────────────────────
+// Both clients return { ok, status, error }. Map that to one of:
+//   done     — delivered, mark the leg done
+//   retry    — transient (shard restarting, bot down, network); back off + retry
+//   terminal — will never succeed as-is (over caps, bad auth/config); fail now
+
+function classifyTownCrier(result) {
+  if (result && result.ok) return { outcome: 'done' }
+  const status = result ? result.status : 0
+  // 400 = over the line/duration caps (a data problem — do NOT retry).
+  // 401 = token mismatch, 409 = protocol mismatch (both config problems).
+  if (status === 400 || status === 401 || status === 409) {
+    return { outcome: 'terminal', error: legError(result) }
+  }
+  // 503 (shard not connected), 504 (shard timeout), 0 (network/timeout / not
+  // configured yet), and any other 5xx are transient — retry.
+  return { outcome: 'retry', error: legError(result) }
+}
+
+function classifyDiscord(result) {
+  if (result && result.ok) return { outcome: 'done' }
+  // The bot's /internal/announce collapses failures (503 = not connected,
+  // 400 = no news channel configured) without surfacing Discord's own
+  // retry_after, so there is no reliable terminal signal to key on here. Retry
+  // every failure on the shared backoff; a genuine config problem simply
+  // exhausts its attempts and lands as `failed` in the admin panel, where the
+  // per-leg retry button re-runs it after the channel is set.
+  return { outcome: 'retry', error: legError(result) }
+}
+
+function legError(result) {
+  if (!result) return 'no response'
+  if (result.status) {
+    return result.data && result.data.message
+      ? `${result.status}: ${result.data.message}`
+      : result.error || `status ${result.status}`
+  }
+  return result.error || 'request failed'
+}
+
+// Given the number of attempts already made (>= 1), how long to wait before the
+// next one — or null when the cap is reached and the leg should be failed.
+function scheduleAfter(attempts) {
+  if (attempts >= MAX_ATTEMPTS) return null
+  return BACKOFF_MS[Math.min(attempts - 1, BACKOFF_MS.length - 1)]
+}
+
+// Parent job status derived from the two leg statuses:
+//   done    — both legs delivered
+//   failed  — both legs gave up
+//   partial — at least one leg reached a terminal state while the other has not
+//             matched it (still pending/retrying, or the opposite terminal state)
+//   pending — neither leg is terminal yet
+function rollupStatus(towncrierStatus, discordStatus) {
+  if (towncrierStatus === 'done' && discordStatus === 'done') return 'done'
+  if (towncrierStatus === 'failed' && discordStatus === 'failed') return 'failed'
+  const terminal = (s) => s === 'done' || s === 'failed'
+  if (terminal(towncrierStatus) || terminal(discordStatus)) return 'partial'
+  return 'pending'
+}
+
+module.exports = {
+  MAX_LINES,
+  MAX_LINE_LEN,
+  MAX_ATTEMPTS,
+  BACKOFF_MS,
+  buildTownCrierText,
+  articleUrl,
+  classifyTownCrier,
+  classifyDiscord,
+  scheduleAfter,
+  rollupStatus,
+}

server/src/model/announceJobs/announceJobs.model.js

@@ -0,0 +1,116 @@
+// ── Announcement pipeline: orchestration ────────────────────────────────────
+//
+// Sits between the DB rows and the worker: creates jobs on publish, records each
+// leg's outcome, keeps the parent `status` rollup in sync, stamps the post's
+// announced_at when both legs land, and resets a leg for the admin retry button.
+// The pure decisions (backoff, rollup, classification) live in .logic.js.
+
+const db = require('./announceJobs.db')
+const logic = require('./announceJobs.logic')
+const posts = require('../posts/posts.model')
+const log = require('../../utils/logger')('announce')
+
+// Enqueue an announcement for a freshly-published news post: one job row (both
+// legs pending, due immediately) plus a back-pointer on the post so the admin
+// panel can find it. Returns the new job id.
+async function enqueue(postId) {
+  const jobId = await db.create(postId)
+  await posts.linkAnnounceJob(postId, jobId)
+  log.info('announce job enqueued', { jobId, postId })
+  return jobId
+}
+
+// Should publishing this post fire the pipeline? Only on a real transition INTO
+// "published news" — a false→true publish while in news, or a category change
+// into news while already published — and never twice (guarded by the post's
+// existing announce_job_id). Editing an already-announced post does not re-fire.
+function shouldEnqueue(post, { wasPublished, wasNews }) {
+  if (!post || post.category !== 'news' || !post.published) return false
+  if (post.announce_job_id) return false
+  const wasNewsPublished = Boolean(wasPublished) && Boolean(wasNews)
+  return !wasNewsPublished
+}
+
+// Convenience used by the post controller: enqueue iff shouldEnqueue. Never
+// throws — a pipeline hiccup must not break saving/publishing a post.
+async function enqueueIfNeeded(post, transition) {
+  try {
+    if (!shouldEnqueue(post, transition)) return null
+    return await enqueue(post.id)
+  } catch (err) {
+    log.error('enqueueIfNeeded failed', { postId: post && post.id, message: err.message })
+    return null
+  }
+}
+
+// Record a leg's dispatch outcome and refresh the rollup. `outcome` is one of
+// logic.classify*'s results: 'done' | 'retry' | 'terminal'. For 'retry' we bump
+// the attempt count and schedule the next run (or fail the leg once the cap is
+// hit). Returns the updated job row.
+async function recordOutcome(job, leg, { outcome, error }) {
+  const attempts = Number(job[`${leg}_attempts`]) || 0
+
+  if (outcome === 'done') {
+    await db.updateLeg(job.id, leg, { status: 'done', attempts, lastError: null, nextAttemptAt: null })
+  } else if (outcome === 'terminal') {
+    await db.updateLeg(job.id, leg, { status: 'failed', attempts: attempts + 1, lastError: error, nextAttemptAt: null })
+    log.warn('announce leg failed (terminal)', { jobId: job.id, leg, error })
+  } else {
+    const nextAttempts = attempts + 1
+    const delay = logic.scheduleAfter(nextAttempts)
+    if (delay === null) {
+      await db.updateLeg(job.id, leg, { status: 'failed', attempts: nextAttempts, lastError: error, nextAttemptAt: null })
+      log.warn('announce leg failed (retries exhausted)', { jobId: job.id, leg, attempts: nextAttempts, error })
+    } else {
+      const nextAttemptAt = new Date(Date.now() + delay)
+      await db.updateLeg(job.id, leg, { status: 'pending', attempts: nextAttempts, lastError: error, nextAttemptAt })
+      log.info('announce leg retry scheduled', { jobId: job.id, leg, attempts: nextAttempts, nextAttemptAt })
+    }
+  }
+
+  return refreshStatus(job.id)
+}
+
+// Recompute and persist the parent status from the two legs; stamp the post's
+// announced_at the moment both legs have delivered.
+async function refreshStatus(jobId) {
+  const job = await db.findById(jobId)
+  if (!job) return null
+  const status = logic.rollupStatus(job.towncrier_status, job.discord_status)
+  if (status !== job.status) await db.setStatus(jobId, status)
+  job.status = status
+  if (status === 'done') {
+    try {
+      await posts.markAnnounced(job.post_id)
+    } catch (err) {
+      log.warn('markAnnounced failed', { jobId, postId: job.post_id, message: err.message })
+    }
+  }
+  return job
+}
+
+// Admin retry button: reset one leg to pending, clear its error/backoff, and let
+// the worker pick it up on the next tick. Resets the attempt count so a retry
+// after a config fix gets a full budget again.
+async function resetLeg(postId, leg) {
+  if (!db.LEGS.includes(leg)) throw new Error(`unknown announce leg: ${leg}`)
+  const job = await db.findByPostId(postId)
+  if (!job) return null
+  await db.updateLeg(job.id, leg, { status: 'pending', attempts: 0, lastError: null, nextAttemptAt: null })
+  log.info('announce leg reset for retry', { jobId: job.id, postId, leg })
+  return refreshStatus(job.id)
+}
+
+async function getByPostId(postId) {
+  return db.findByPostId(postId)
+}
+
+module.exports = {
+  enqueue,
+  shouldEnqueue,
+  enqueueIfNeeded,
+  recordOutcome,
+  refreshStatus,
+  resetLeg,
+  getByPostId,
+}

server/src/model/posts/posts.db.js

@@ -1,7 +1,7 @@
 const { query } = require('../../utils/db')
 
 const COLS =
-  'id, category, title, slug, excerpt, body, image_url, published, author_id, created_at, updated_at, published_at'
+  'id, category, title, slug, excerpt, body, image_url, published, author_id, created_at, updated_at, published_at, announced_at, announce_job_id'
 
 // Published posts for a category, newest first — public feed.
 async function listPublished(category) {

server/src/model/posts/posts.model.js

@@ -78,6 +78,15 @@ async function setPublished(id, published) {
   return postsDb.findById(id)
 }
 
+// Announcement pipeline back-pointers (see model/announceJobs).
+async function linkAnnounceJob(id, jobId) {
+  await postsDb.update(id, { announce_job_id: jobId })
+}
+
+async function markAnnounced(id, at = new Date()) {
+  await postsDb.update(id, { announced_at: at })
+}
+
 async function remove(id) {
   return postsDb.remove(id)
 }
@@ -103,6 +112,8 @@ module.exports = {
   create,
   update,
   setPublished,
+  linkAnnounceJob,
+  markAnnounced,
   remove,
   counts,
 }

server/src/router/v1/admin/admin.controller.js

@@ -3,36 +3,25 @@ const wiki = require('../../../model/wiki/wiki.model')
 const settings = require('../../../model/settings/settings.model')
 const users = require('../../../model/users/users.model')
 const activity = require('../../../model/activity/activity.model')
-const botInternalClient = require('../../../utils/botInternalClient')
+const announceJobs = require('../../../model/announceJobs/announceJobs.model')
+const { cleanBody } = require('../../../utils/sanitizeHtml')
 
 const log = require('../../../utils/logger')('admin')
 
-// Public base URL for links back to the site — same fallback pattern as
-// sso.controller.js's redirect_uri builder.
-function appBaseUrl(req) {
-  const configured = process.env.APP_BASE_URL
-  if (configured) return configured.replace(/\/+$/, '')
-  return `${req.protocol}://${req.get('host')}`
-}
-
-// Fire-and-forget: announce a news post to Discord the moment it actually
-// transitions from unpublished to published — not on every save or on a
-// no-op re-publish of an already-live post. Never throws (botInternalClient
-// itself never rejects); a bot outage must never break publishing a post.
-function announceIfNewlyPublished(req, post, wasPublished) {
-  if (!post || post.category !== 'news' || !post.published || wasPublished) return
-  const base = appBaseUrl(req)
-  // image_url is stored relative (e.g. "/uploads/xyz.png") — Discord embeds
-  // require an absolute URL.
-  const imageUrl = post.image_url ? new URL(post.image_url, base).toString() : null
-  botInternalClient
-    .announce({
-      title: post.title,
-      excerpt: post.excerpt,
-      url: `${base}/site/news`,
-      imageUrl,
-    })
-    .catch(() => {})
+// Fire the announcement pipeline the moment a post transitions INTO
+// "published news" — a false→true publish while in news, or a category change
+// into news while already published. Enqueues one announce_jobs row whose two
+// legs (in-game town crier + Discord #news) are then delivered with independent
+// retry by the dispatcher worker (utils/announceWorker). Fire-and-forget and
+// self-guarding (enqueueIfNeeded never throws and de-dupes via the post's
+// existing announce_job_id) so a pipeline hiccup never breaks saving a post.
+// Awaited (not fire-and-forget) because enqueue is purely local DB work — one
+// INSERT + a back-pointer UPDATE, no network — so it never blocks on the sidecar
+// or Discord (that happens later in the worker). Awaiting keeps the de-dup guard
+// (post.announce_job_id) reliable against rapid double-publishes. Still guarded:
+// enqueueIfNeeded swallows its own errors, so a pipeline hiccup can't break save.
+async function announceIfNewlyPublished(post, transition) {
+  await announceJobs.enqueueIfNeeded(post, transition)
 }
 
 // ── Dashboard & site mode ─────────────────────────────────────────────
@@ -119,7 +108,7 @@ async function createPost(req, res) {
       author_id: req.user.id,
     })
     await activity.log({ req, action: 'post.create', detail: { id: created.id, category: dbCategory } })
-    announceIfNewlyPublished(req, created, false)
+    await announceIfNewlyPublished(created, { wasPublished: false, wasNews: false })
     return res.status(201).json(created)
   } catch (err) {
     log.error('createPost', err)
@@ -149,7 +138,10 @@ async function updatePost(req, res) {
 
     const updated = await posts.update(id, fields)
     await activity.log({ req, action: 'post.update', detail: { id } })
-    announceIfNewlyPublished(req, updated, Boolean(current.published))
+    await announceIfNewlyPublished(updated, {
+      wasPublished: Boolean(current.published),
+      wasNews: current.category === 'news',
+    })
     return res.json(updated)
   } catch (err) {
     log.error('updatePost', err)
@@ -168,7 +160,10 @@ async function publishPost(req, res) {
       action: 'post.publish',
       detail: { id, published: Boolean(req.body.published) },
     })
-    announceIfNewlyPublished(req, updated, Boolean(current.published))
+    await announceIfNewlyPublished(updated, {
+      wasPublished: Boolean(current.published),
+      wasNews: current.category === 'news',
+    })
     return res.json(updated)
   } catch (err) {
     return res.status(500).json({ message: 'Internal Server Error' })
@@ -186,6 +181,35 @@ async function deletePost(req, res) {
   }
 }
 
+// GET /admin/posts/:id/announce — the announcement job for a post (or null if it
+// was never announced), for the status panel on the post editor.
+async function getAnnounceStatus(req, res) {
+  const id = Number(req.params.id)
+  try {
+    const job = await announceJobs.getByPostId(id)
+    return res.json(job || null)
+  } catch (err) {
+    log.error('getAnnounceStatus', err)
+    return res.status(500).json({ message: 'Internal Server Error' })
+  }
+}
+
+// POST /admin/posts/:id/announce/retry — reset one delivery leg to pending so
+// the dispatcher re-attempts it (e.g. after fixing the news channel / sidecar).
+async function retryAnnounceLeg(req, res) {
+  const id = Number(req.params.id)
+  const leg = req.body.leg
+  try {
+    const job = await announceJobs.resetLeg(id, leg)
+    if (!job) return res.status(404).json({ message: 'No announcement job for this post' })
+    await activity.log({ req, action: 'post.announce.retry', detail: { id, leg } })
+    return res.json(job)
+  } catch (err) {
+    log.error('retryAnnounceLeg', err)
+    return res.status(500).json({ message: 'Internal Server Error' })
+  }
+}
+
 async function uploadImage(req, res) {
   if (!req.file) return res.status(400).json({ message: 'No image uploaded' })
   const imageUrl = `/uploads/${req.file.filename}`
@@ -461,6 +485,12 @@ async function updateSettings(req, res) {
   ) {
     return res.status(400).json({ message: 'Invalid player_registration value' })
   }
+  // The homepage teaser is rich text (HTML) from the shared editor — sanitize it
+  // against the same allowlist as post/wiki bodies so a stored value is safe (the
+  // client re-sanitizes on render as defense in depth).
+  if (typeof updates.homepage_teaser === 'string') {
+    updates.homepage_teaser = cleanBody(updates.homepage_teaser)
+  }
   try {
     await settings.setMany(updates, req.user.id)
     await activity.log({ req, action: 'settings.update', detail: { keys: Object.keys(updates) } })
@@ -594,6 +624,8 @@ module.exports = {
   updatePost,
   publishPost,
   deletePost,
+  getAnnounceStatus,
+  retryAnnounceLeg,
   uploadImage,
   uploadFile,
   listWiki,

server/src/router/v1/admin/admin.routes.js

@@ -348,6 +348,32 @@ adminRouter.delete(
   validate,
   ctrl.deletePost,
 )
+adminRouter.get(
+  '/posts/:id/announce',
+  // #swagger.tags = ['Admin · Posts']
+  // #swagger.summary = 'Get the announcement pipeline status for a post'
+  // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+  // #swagger.parameters['id'] = { in: 'path', required: true, schema: { type: 'integer' }, description: 'Post id.' }
+  /* #swagger.responses[200] = { description: 'The announce job for the post, or null if never announced', content: { "application/json": { schema: { type: "object", nullable: true, additionalProperties: true } } } } */
+  /* #swagger.responses[401] = { description: 'Not authenticated', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  param('id').isInt(),
+  validate,
+  ctrl.getAnnounceStatus,
+)
+adminRouter.post(
+  '/posts/:id/announce/retry',
+  // #swagger.tags = ['Admin · Posts']
+  // #swagger.summary = 'Retry one announcement delivery leg (town crier or Discord)'
+  // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+  // #swagger.parameters['id'] = { in: 'path', required: true, schema: { type: 'integer' }, description: 'Post id.' }
+  /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { type: "object", properties: { leg: { type: "string", enum: ["towncrier", "discord"] } }, required: ["leg"] } } } } */
+  /* #swagger.responses[200] = { description: 'Updated announce job', content: { "application/json": { schema: { type: "object", additionalProperties: true } } } } */
+  /* #swagger.responses[404] = { description: 'No announcement job for this post', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  param('id').isInt(),
+  body('leg').isIn(['towncrier', 'discord']),
+  validate,
+  ctrl.retryAnnounceLeg,
+)
 
 // ── Wiki categories (static paths registered before /wiki/:slug) ───────
 adminRouter.get(

server/src/server.js

@@ -8,6 +8,7 @@ const uoLinkSocket = require('./utils/uoLinkSocket')
 const uoLinkClient = require('./utils/uoLinkClient')
 const uoLinkConfig = require('./model/uoLinkConfig/uoLinkConfig.model')
 const shardBroadcast = require('./utils/shardBroadcast')
+const announceWorker = require('./utils/announceWorker')
 const { ensureSchema, close } = require('./utils/db')
 const { seedDefaults, createInitialAdminFromEnv } = require('../db/seed')
 const settings = require('./model/settings/settings.model')
@@ -92,6 +93,11 @@ async function start() {
     log.warn('uo-link socket failed to start (continuing)', { error: err.message })
   }
 
+  // Start the news-announcement dispatcher: a light in-process poller that pushes
+  // published news posts to the in-game town crier + Discord with independent
+  // retry per leg. No-op until a news post is actually published.
+  announceWorker.start()
+
   setupShutdown(server, internalServer)
 }
 
@@ -129,6 +135,7 @@ function setupShutdown(server, internalServer) {
     closing = true
     log.warn(`${signal} received — shutting down gracefully`)
     botScore.stopSweeper() // stop the bot-store cleanup interval
+    announceWorker.stop() // stop the news-announcement dispatcher poller
     uoLinkSocket.stop() // close the uo-link WS ingest client
     shardBroadcast.closeAll() // end any open shard live-feed SSE streams
     server.close(() => log.info('http server closed'))

server/src/utils/announceWorker.js

@@ -0,0 +1,132 @@
+// ── Announcement dispatcher worker ──────────────────────────────────────────
+//
+// A lightweight, in-process table poller (no Redis/BullMQ in the stack). Every
+// ANNOUNCE_POLL_MS it sweeps announce_jobs for legs that are due — freshly
+// enqueued or past their backoff — and dispatches each one:
+//   • town crier  → uoLinkClient.postTownCrier (sidecar → in-game)
+//   • discord     → botInternalClient.announce (bot → #news channel)
+// Both clients never throw (they return { ok, status, error }); the model turns
+// each result into done / retry / terminal and owns the backoff + rollup. One
+// leg failing never touches the other. Same setInterval + unref + stop() shape
+// as middleware/botScore's sweeper, wired into server.js start/shutdown.
+
+const announceJobs = require('../model/announceJobs/announceJobs.model')
+const announceJobsDb = require('../model/announceJobs/announceJobs.db')
+const logic = require('../model/announceJobs/announceJobs.logic')
+const posts = require('../model/posts/posts.model')
+const uoLinkClient = require('./uoLinkClient')
+const botInternalClient = require('./botInternalClient')
+const log = require('./logger')('announce-worker')
+
+const POLL_MS = Number(process.env.ANNOUNCE_POLL_MS) || 15_000
+const TOWNCRIER_DURATION_SEC = Number(process.env.TOWNCRIER_DURATION_SEC) || 3600
+
+function baseUrl() {
+  return (process.env.APP_BASE_URL || 'http://localhost:5173').replace(/\/+$/, '')
+}
+
+// ── Leg dispatchers ─────────────────────────────────────────────────────────
+// Return the raw client result ({ ok, status, data, error }); classification is
+// the model/logic's job.
+
+async function dispatchTownCrier(post) {
+  const lines = logic.buildTownCrierText(post, { baseUrl: baseUrl() })
+  // Stable id: re-posting `post-<id>` REPLACES the prior town-crier entry rather
+  // than stacking a duplicate, so a retry after a partial failure is safe.
+  return uoLinkClient.postTownCrier({
+    id: `post-${post.id}`,
+    lines,
+    durationSec: TOWNCRIER_DURATION_SEC,
+  })
+}
+
+async function dispatchDiscord(post) {
+  const base = baseUrl()
+  // Stored image paths are relative ("/uploads/x.png"); Discord embeds need an
+  // absolute URL.
+  const imageUrl = post.image_url ? new URL(post.image_url, base).toString() : null
+  return botInternalClient.announce({
+    title: post.title,
+    excerpt: post.excerpt,
+    url: `${base}/site/news`,
+    imageUrl,
+  })
+}
+
+// Process a single due leg of a job: fetch the post, dispatch, classify, record.
+async function processLeg(job, leg) {
+  const post = await posts.getById(job.post_id)
+  if (!post) {
+    // Post was deleted between enqueue and dispatch (the CASCADE usually reaps
+    // the job first, but guard anyway). Nothing to announce — fail the leg.
+    await announceJobs.recordOutcome(job, leg, { outcome: 'terminal', error: 'post no longer exists' })
+    return
+  }
+
+  let result
+  let classification
+  try {
+    if (leg === 'towncrier') {
+      result = await dispatchTownCrier(post)
+      classification = logic.classifyTownCrier(result)
+    } else {
+      result = await dispatchDiscord(post)
+      classification = logic.classifyDiscord(result)
+    }
+  } catch (err) {
+    // Clients shouldn't throw, but if one does, treat it as a transient failure
+    // rather than crashing the tick.
+    log.error('dispatch threw', { jobId: job.id, leg, message: err.message })
+    classification = { outcome: 'retry', error: err.message }
+  }
+
+  await announceJobs.recordOutcome(job, leg, classification)
+}
+
+// One sweep: find due jobs and process each due leg. A job may have both legs due
+// (a fresh enqueue) — process the ones that are actually pending. `job` is a
+// snapshot from the SELECT; recordOutcome re-reads for the rollup, so processing
+// the two legs sequentially off the same snapshot is fine (each leg only writes
+// its own columns).
+async function tick(now = new Date()) {
+  let jobs
+  try {
+    jobs = await announceJobsDb.findDue(now)
+  } catch (err) {
+    log.error('failed to load due jobs', { message: err.message })
+    return
+  }
+  if (!jobs || jobs.length === 0) return
+
+  for (const job of jobs) {
+    if (isLegDue(job, 'towncrier', now)) await processLeg(job, 'towncrier')
+    if (isLegDue(job, 'discord', now)) await processLeg(job, 'discord')
+  }
+}
+
+function isLegDue(job, leg, now) {
+  if (job[`${leg}_status`] !== 'pending') return false
+  const next = job[`${leg}_next_attempt_at`]
+  return next == null || new Date(next) <= now
+}
+
+let timer = null
+
+function start() {
+  if (timer) return timer
+  timer = setInterval(() => {
+    tick().catch((err) => log.error('announce tick failed', { message: err.message }))
+  }, POLL_MS)
+  if (timer.unref) timer.unref() // don't keep the event loop alive (tests, shutdown)
+  log.info('announcement dispatcher started', { pollMs: POLL_MS })
+  return timer
+}
+
+function stop() {
+  if (timer) {
+    clearInterval(timer)
+    timer = null
+  }
+}
+
+module.exports = { start, stop, tick, processLeg, dispatchTownCrier, dispatchDiscord }

server/src/utils/botInternalClient.js

@@ -24,12 +24,21 @@ async function call(path, { method = 'GET', body } = {}) {
       signal: controller.signal,
     })
     if (!res.ok) {
-      return { ok: false, error: `bot responded ${res.status}` }
+      // Include the numeric status + parsed body (if any) so callers — e.g. the
+      // announcement worker — can distinguish 503 (bot down, retry) from a config
+      // error. Non-JSON bodies just leave `data` null.
+      let data = null
+      try {
+        data = await res.json()
+      } catch {
+        // ignore — body already reported via status
       }
-    return { ok: true, data: await res.json() }
+      return { ok: false, status: res.status, data, error: `bot responded ${res.status}` }
+    }
+    return { ok: true, status: res.status, data: await res.json() }
   } catch (err) {
     log.warn('bot internal call failed', { path, message: err.message })
-    return { ok: false, error: err.message }
+    return { ok: false, status: 0, error: err.message }
   } finally {
     clearTimeout(timeout)
   }

server/test/announceJobs.test.js

@@ -0,0 +1,86 @@
+const { test } = require('node:test')
+const assert = require('node:assert/strict')
+
+const logic = require('../src/model/announceJobs/announceJobs.logic')
+
+// ── buildTownCrierText ───────────────────────────────────────────────────────
+test('buildTownCrierText produces title, excerpt, and URL lines', () => {
+  const lines = logic.buildTownCrierText(
+    { id: 7, title: 'Server Update', excerpt: 'Big things afoot.', body: null },
+    { baseUrl: 'https://uom.example' },
+  )
+  assert.deepEqual(lines, ['Server Update', 'Big things afoot.', 'https://uom.example/site/news'])
+})
+
+test('buildTownCrierText falls back to a stripped body when excerpt is empty', () => {
+  const lines = logic.buildTownCrierText(
+    { id: 1, title: 'T', excerpt: '', body: '<p>Hello <b>world</b></p>' },
+    { baseUrl: 'https://uom.example' },
+  )
+  assert.equal(lines[1], 'Hello world')
+})
+
+test('buildTownCrierText clamps each line to the sidecar per-line cap', () => {
+  const longTitle = 'x'.repeat(500)
+  const lines = logic.buildTownCrierText(
+    { id: 1, title: longTitle, excerpt: 'y'.repeat(500), body: null },
+    { baseUrl: 'https://uom.example' },
+  )
+  for (const line of lines) assert.ok(line.length <= logic.MAX_LINE_LEN, `line too long: ${line.length}`)
+  assert.ok(lines[0].endsWith('…'))
+  assert.ok(lines.length <= logic.MAX_LINES)
+})
+
+test('buildTownCrierText omits the excerpt line when there is no excerpt or body', () => {
+  const lines = logic.buildTownCrierText(
+    { id: 1, title: 'Only a title', excerpt: null, body: null },
+    { baseUrl: 'https://uom.example' },
+  )
+  assert.deepEqual(lines, ['Only a title', 'https://uom.example/site/news'])
+})
+
+// ── classifyTownCrier ────────────────────────────────────────────────────────
+test('classifyTownCrier: 2xx is done', () => {
+  assert.equal(logic.classifyTownCrier({ ok: true, status: 200 }).outcome, 'done')
+})
+
+test('classifyTownCrier: over-cap / auth / protocol errors are terminal (no retry)', () => {
+  for (const status of [400, 401, 409]) {
+    assert.equal(logic.classifyTownCrier({ ok: false, status }).outcome, 'terminal', `status ${status}`)
+  }
+})
+
+test('classifyTownCrier: shard-transient and network errors retry', () => {
+  for (const status of [503, 504, 500, 0]) {
+    assert.equal(logic.classifyTownCrier({ ok: false, status }).outcome, 'retry', `status ${status}`)
+  }
+})
+
+// ── classifyDiscord ──────────────────────────────────────────────────────────
+test('classifyDiscord: ok is done, every failure retries', () => {
+  assert.equal(logic.classifyDiscord({ ok: true, status: 200 }).outcome, 'done')
+  for (const status of [400, 503, 0]) {
+    assert.equal(logic.classifyDiscord({ ok: false, status }).outcome, 'retry', `status ${status}`)
+  }
+})
+
+// ── scheduleAfter (backoff) ──────────────────────────────────────────────────
+test('scheduleAfter returns increasing delays then null at the attempt cap', () => {
+  const d1 = logic.scheduleAfter(1)
+  const d2 = logic.scheduleAfter(2)
+  assert.ok(d1 > 0 && d2 > d1, 'delays should grow')
+  // Exhausted once attempts reach MAX_ATTEMPTS.
+  assert.equal(logic.scheduleAfter(logic.MAX_ATTEMPTS), null)
+  assert.equal(logic.scheduleAfter(logic.MAX_ATTEMPTS + 3), null)
+})
+
+// ── rollupStatus ─────────────────────────────────────────────────────────────
+test('rollupStatus derives the parent status from the two legs', () => {
+  assert.equal(logic.rollupStatus('done', 'done'), 'done')
+  assert.equal(logic.rollupStatus('failed', 'failed'), 'failed')
+  assert.equal(logic.rollupStatus('pending', 'pending'), 'pending')
+  // One terminal, the other not matching → partial.
+  assert.equal(logic.rollupStatus('done', 'pending'), 'partial')
+  assert.equal(logic.rollupStatus('pending', 'failed'), 'partial')
+  assert.equal(logic.rollupStatus('done', 'failed'), 'partial')
+})