From c89a63bd289c7ffdedebff6eb974a2cb583f6c95 Mon Sep 17 00:00:00 2001
From: TheMeinerLP <github@themeinerlp.dev>
Date: Sun, 23 Aug 2026 16:37:09 +0200
Subject: [PATCH] feat(console): let a guild say where its protocols should go
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A guild has been able to publish to several destinations in several
formats since the export-target API landed, and none of it was reachable
from the interface: `document_target` on Bot Settings still looked like
the only answer, when it is now the fallback for a guild that configures
nothing else.

Adds a Destinations page to the Admin View over the CRUD routes, a
write-only credential control, and — on the recording page — the list of
what one meeting was actually published as.

The decisions live in two pure modules and are tested without mounting
anything: which formats are offered and why `pdf` and `confluence` are
absent rather than disabled, what each format will accept as an address,
which destination Discord announces, what may be done to a credential,
and how a partly-published meeting reads.
---
 console/app/components/ExportTargetForm.vue   | 331 +++++++++
 console/app/components/ExportTargetSecret.vue | 202 ++++++
 console/app/pages/admin/destinations.vue      | 636 ++++++++++++++++++
 console/app/pages/recordings/[id].vue         | 143 +++-
 console/app/utils/exportTargets.ts            | 634 +++++++++++++++++
 console/app/utils/navigation.ts               |  11 +
 console/app/utils/sessionDocuments.ts         | 256 +++++++
 console/app/utils/settings.ts                 |  28 +
 console/i18n/README.md                        |   9 +
 console/i18n/locales/de.json                  | 112 ++-
 console/i18n/locales/en.json                  | 112 ++-
 console/test/exportTargets.spec.ts            | 542 +++++++++++++++
 console/test/i18n.spec.ts                     |   3 +
 console/test/navigation.spec.ts               |  20 +
 console/test/sessionDocuments.spec.ts         | 248 +++++++
 console/test/settings.spec.ts                 |  16 +
 16 files changed, 3288 insertions(+), 15 deletions(-)
 create mode 100644 console/app/components/ExportTargetForm.vue
 create mode 100644 console/app/components/ExportTargetSecret.vue
 create mode 100644 console/app/pages/admin/destinations.vue
 create mode 100644 console/app/utils/exportTargets.ts
 create mode 100644 console/app/utils/sessionDocuments.ts
 create mode 100644 console/test/exportTargets.spec.ts
 create mode 100644 console/test/sessionDocuments.spec.ts

diff --git a/console/app/components/ExportTargetForm.vue b/console/app/components/ExportTargetForm.vue
new file mode 100644
index 0000000..8d87145
--- /dev/null
+++ b/console/app/components/ExportTargetForm.vue
@@ -0,0 +1,331 @@
+<script setup lang="ts">
+/**
+ * The form that adds a destination, and the one that changes it.
+ *
+ * One component for both, because they are the same four fields and a
+ * second copy would be a second place for the address rules to drift.
+ * What differs is stated as two props and nothing else: `mode` decides the
+ * heading and whether the name may be typed, and `taken` decides which
+ * names collide.
+ *
+ * **It shows what this format needs, never the union of every field.**
+ * Outline wants a collection and offers the picker Bot Settings already
+ * has for `document_target`; the two object-store formats want a key
+ * prefix, which has no directory to browse and is therefore typed. Which
+ * of the two a format wants is `~/utils/exportTargets`' answer, so adding
+ * a format is adding an entry there rather than a branch here.
+ *
+ * **There is no credential field, and that is the point.** A `PUT` on a
+ * destination does not touch its secret — the API gives the credential a
+ * route of its own precisely so that renaming a destination cannot clear
+ * it — so a password box on this form would either lie about what Save
+ * does or wipe a token every time somebody corrected a typo.
+ * `TargetDraft` has no field for one, so the mistake is unrepresentable
+ * rather than merely avoided. `ExportTargetSecret` is the control that
+ * does write it.
+ *
+ * **A name cannot be changed here, because the API cannot change one.**
+ * `update_target` reads the name from the stored row and ignores whatever
+ * the body says, so that "publish to Wiki" cannot stop meaning what the
+ * person who set it up thought it meant. Rendering an editable box over a
+ * value that will be discarded is the interface promising something the
+ * API refuses, so on an edit the name is read-only and one sentence says
+ * what renaming actually is.
+ *
+ * Every decision above is `~/utils/exportTargets`'; what is left in this
+ * file is markup, the token bindings and which complaint is on screen yet.
+ */
+import UiSelect from '~/components/ui/UiSelect.vue'
+import { singleChoices, type NamedRow } from '~/utils/directory'
+import {
+  type DraftField,
+  type TargetDraft,
+  draftProblems,
+  formatChoices,
+  formatSpec,
+  problemFor,
+} from '~/utils/exportTargets'
+import type { UiOption } from '~/utils/uiOption'
+
+const props = withDefaults(
+  defineProps<{
+    mode: 'add' | 'edit'
+    initial: TargetDraft
+    /** Names this guild already uses, this destination's own excluded. */
+    taken?: readonly string[]
+    /** Outline's collections, for the one format that addresses one. */
+    collections?: readonly NamedRow[]
+    /** The collections could not be read. Decoration failing, not the
+     *  form failing: the field falls back to asking for an id. */
+    collectionsFailed?: boolean
+    busy?: boolean
+  }>(),
+  { taken: () => [], collections: () => [], collectionsFailed: false, busy: false },
+)
+
+const emit = defineEmits<{ submit: [TargetDraft]; cancel: [] }>()
+
+const { t } = useI18n()
+const say = useSay()
+
+const base = useId()
+const draft = ref<TargetDraft>({ ...props.initial })
+
+/** Whether Save has been pressed on a draft that was not ready. Before
+ *  that, only a field somebody has actually touched complains — a form
+ *  that objects to an empty name before anybody has typed in it is a form
+ *  that opens shouting. */
+const attempted = ref(false)
+const dirty = ref<Partial<Record<DraftField, boolean>>>({})
+
+/** The reader stepped around the collection picker to type an id. */
+const manual = ref(false)
+
+// A form re-opened on a different destination is a different form. Without
+// this, closing one row and opening the next would edit the first one's
+// values under the second one's heading.
+watch(
+  () => props.initial,
+  (initial) => {
+    draft.value = { ...initial }
+    attempted.value = false
+    dirty.value = {}
+    manual.value = false
+  },
+)
+
+const spec = computed(() => formatSpec(draft.value.format))
+const wantsCollection = computed(() => spec.value?.targetKind === 'collection')
+
+/** Whether there is a list to pick from at all. An empty select would say
+ *  "this installation has no collections", which is a claim, and the wrong
+ *  one when the request merely failed. */
+const pickerAvailable = computed(
+  () => wantsCollection.value && !props.collectionsFailed && props.collections.length > 0,
+)
+const picking = computed(() => pickerAvailable.value && !manual.value)
+
+const formatOptions = computed(() => formatChoices(t, props.initial.format))
+
+/** The collections, plus the stored id when the copy has no row for it.
+ *  Dropping it would render as though nothing were configured and rewrite
+ *  the destination on the next save — `~/utils/directory`'s rule. */
+const collectionOptions = computed<UiOption[]>(() =>
+  singleChoices(props.collections, draft.value.target).choices.map((choice) => ({
+    value: choice.id,
+    label: choice.label,
+    detail: choice.resolved ? choice.id : t('admin.destinations.unresolvedCollection'),
+  })),
+)
+
+const problems = computed(() => draftProblems(draft.value, props.taken))
+const ready = computed(() => problems.value.length === 0)
+
+/** The complaint about one field, once it is the reader's to see. */
+function complaint(field: DraftField) {
+  if (!attempted.value && !dirty.value[field]) return null
+  return problemFor(problems.value, field)
+}
+
+function touch(field: DraftField) {
+  dirty.value = { ...dirty.value, [field]: true }
+}
+
+/** Switching format changes what the address field means, so a value
+ *  typed for the old one is cleared rather than carried into a field it
+ *  cannot be valid in. Except on the format the destination arrived with:
+ *  going back to it should give the stored address back. */
+function chooseFormat(name: string | null) {
+  if (name === null) return
+  draft.value = {
+    ...draft.value,
+    format: name,
+    target: name === props.initial.format ? props.initial.target : '',
+  }
+  touch('format')
+  manual.value = false
+}
+
+function submit() {
+  attempted.value = true
+  if (!ready.value || props.busy) return
+  emit('submit', { ...draft.value })
+}
+</script>
+
+<template>
+  <form
+    class="rounded-xl border p-4"
+    :style="{ borderColor: 'var(--border)', background: 'var(--surface-raised)' }"
+    @submit.prevent="submit"
+  >
+    <h3 class="text-sm font-semibold">
+      {{ mode === 'add' ? $t('admin.destinations.addHeading') : $t('admin.destinations.editHeading') }}
+    </h3>
+
+    <div class="mt-4 flex flex-col gap-4">
+      <!-- The name. Typed once, on the way in, and read-only afterwards:
+           the API keeps the stored name on a PUT whatever the body says. -->
+      <div>
+        <label class="block text-sm font-medium" :for="`${base}-name`">
+          {{ $t('admin.destinations.nameLabel') }}
+        </label>
+        <input
+          :id="`${base}-name`"
+          v-model="draft.name"
+          type="text"
+          :readonly="mode === 'edit'"
+          :aria-invalid="complaint('name') ? 'true' : undefined"
+          class="mt-1 w-full rounded-lg border px-3 py-2 text-sm transition-colors read-only:opacity-60"
+          :style="{
+            borderColor: complaint('name') ? 'var(--danger)' : 'var(--control-border)',
+            background: 'var(--surface)',
+            color: 'var(--text)',
+          }"
+          @input="touch('name')"
+        >
+        <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
+          {{ mode === 'edit'
+            ? $t('admin.destinations.nameLockedNote')
+            : $t('admin.destinations.nameHint') }}
+        </p>
+        <p v-if="complaint('name')" class="mt-1 text-xs" :style="{ color: 'var(--danger)' }">
+          {{ say(complaint('name')) }}
+        </p>
+      </div>
+
+      <!-- The format. Three rows, and a fourth only when this destination
+           already stores something else. -->
+      <div>
+        <span class="block text-sm font-medium">{{ $t('admin.destinations.formatLabel') }}</span>
+        <div class="mt-1">
+          <UiSelect
+            :options="formatOptions"
+            :model-value="draft.format"
+            :label="$t('admin.destinations.formatLabel')"
+            :invalid="Boolean(complaint('format'))"
+            @update:model-value="chooseFormat"
+          />
+        </div>
+        <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
+          {{ $t('admin.destinations.formatHint') }}
+        </p>
+        <!-- Where the absent formats are accounted for. One sentence in
+             place of two inert rows, so their absence reads as a fact
+             about this deployment rather than as a list that failed to
+             render — the same answer `video_consent_offered` gets on the
+             consent card. -->
+        <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
+          {{ $t('admin.destinations.formatsNote') }}
+        </p>
+        <p v-if="complaint('format')" class="mt-1 text-xs" :style="{ color: 'var(--danger)' }">
+          {{ say(complaint('format')) }}
+        </p>
+      </div>
+
+      <!-- Where it writes. One field, and which field it is belongs to the
+           format rather than to this template. -->
+      <div>
+        <label
+          v-if="!picking"
+          class="block text-sm font-medium"
+          :for="`${base}-target`"
+        >
+          {{ $t(spec?.targetLabelKey ?? 'admin.destinations.prefixLabel') }}
+        </label>
+        <span v-else class="block text-sm font-medium">
+          {{ $t(spec?.targetLabelKey ?? 'admin.destinations.collectionLabel') }}
+        </span>
+
+        <div v-if="picking" class="mt-1">
+          <UiSelect
+            :options="collectionOptions"
+            :model-value="draft.target"
+            :label="$t('admin.destinations.collectionLabel')"
+            :placeholder="$t('admin.destinations.collectionChoose')"
+            :invalid="Boolean(complaint('target'))"
+            @update:model-value="(id) => { draft.target = id ?? ''; touch('target') }"
+          />
+        </div>
+        <input
+          v-else
+          :id="`${base}-target`"
+          v-model="draft.target"
+          type="text"
+          spellcheck="false"
+          :aria-invalid="complaint('target') ? 'true' : undefined"
+          class="mt-1 w-full rounded-lg border px-3 py-2 font-mono text-sm transition-colors"
+          :style="{
+            borderColor: complaint('target') ? 'var(--danger)' : 'var(--control-border)',
+            background: 'var(--surface)',
+            color: 'var(--text)',
+          }"
+          @input="touch('target')"
+        >
+
+        <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
+          {{ $t(spec?.targetHintKey ?? 'admin.destinations.prefixHint') }}
+        </p>
+        <!-- Why a field that should have been a picker is a text box. The
+             list being unreadable must never stop a destination being
+             configured: asking for an id is what this always did. -->
+        <p
+          v-if="wantsCollection && collectionsFailed"
+          class="mt-1 text-xs"
+          :style="{ color: 'var(--text-muted)' }"
+        >
+          {{ $t('admin.destinations.collectionsUnavailable') }}
+        </p>
+        <button
+          v-if="wantsCollection && pickerAvailable"
+          type="button"
+          class="mt-1 text-xs font-medium transition-colors hover:underline"
+          :style="{ color: 'var(--action)' }"
+          @click="manual = !manual"
+        >
+          {{ manual
+            ? $t('admin.destinations.collectionBackToPicker')
+            : $t('admin.destinations.collectionManual') }}
+        </button>
+        <p v-if="complaint('target')" class="mt-1 text-xs" :style="{ color: 'var(--danger)' }">
+          {{ say(complaint('target')) }}
+        </p>
+      </div>
+
+      <!-- Whether it publishes at all. A checkbox rather than a second
+           button, because it is part of what is being saved. -->
+      <div>
+        <label class="flex items-center gap-2 text-sm">
+          <input v-model="draft.enabled" type="checkbox">
+          {{ $t('admin.destinations.enabledLabel') }}
+        </label>
+        <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
+          {{ $t('admin.destinations.enabledHint') }}
+        </p>
+      </div>
+    </div>
+
+    <div class="mt-4 flex flex-wrap items-center gap-2">
+      <!-- Disabled while the request runs rather than replaced: a control
+           that unmounts itself when pressed drops the keyboard to the top
+           of the document. -->
+      <button
+        type="submit"
+        class="rounded-lg px-3 py-1.5 text-sm font-medium transition-colors disabled:opacity-60"
+        :style="{ background: 'var(--action)', color: 'var(--action-contrast)' }"
+        :disabled="busy"
+      >
+        {{ busy ? $t('admin.destinations.saving') : $t('admin.destinations.save') }}
+      </button>
+      <button
+        type="button"
+        class="rounded-lg border px-3 py-1.5 text-sm transition-colors disabled:opacity-60"
+        :style="{ borderColor: 'var(--control-border)', color: 'var(--text)' }"
+        :disabled="busy"
+        @click="emit('cancel')"
+      >
+        {{ $t('admin.destinations.cancel') }}
+      </button>
+    </div>
+  </form>
+</template>
diff --git a/console/app/components/ExportTargetSecret.vue b/console/app/components/ExportTargetSecret.vue
new file mode 100644
index 0000000..47a079b
--- /dev/null
+++ b/console/app/components/ExportTargetSecret.vue
@@ -0,0 +1,202 @@
+<script setup lang="ts">
+/**
+ * A destination's credential: written, never read, and honest about both.
+ *
+ * The API has one route that writes a credential and none that returns
+ * one. `ExportTarget` carries `has_secret` and nothing else about it, and
+ * `ExportTargetStore.secret_for` — the one method that can produce the
+ * value — is deliberately absent from the port the console's handlers can
+ * reach. So this control cannot show a credential, and the interface must
+ * not imply that it could.
+ *
+ * **Three properties, and each of them is a failure somewhere else that
+ * this file exists to not repeat.**
+ *
+ * - **No reveal, and no mask either.** A masked value is a value: it says
+ *   how long the token is and what its first characters are, and it
+ *   promises a "show" button that this API cannot serve. What is on screen
+ *   is one sentence — a credential is stored, or none is — and a sentence
+ *   saying that there is no way to read it back.
+ * - **The input does not exist until somebody asks for it.** An empty
+ *   password box rendered beside a configured credential is an invitation
+ *   to save the form and silently clear it, which is the exact failure the
+ *   API split this onto its own route to prevent. Here the box appears
+ *   only after a deliberate press, and closing it discards what was typed.
+ *   The destination form beside this one has no credential field at all.
+ * - **Clearing is its own act, and it is confirmed.** `{"secret": null}`
+ *   is a different request from `{"secret": "…"}`, and it is irreversible
+ *   in the strongest sense available: nothing anywhere can read back what
+ *   was there to put it back. Two presses, and the second one says what it
+ *   costs.
+ *
+ * The states and the words are `~/utils/exportTargets.secretState`; this
+ * file is the markup, the focus and which of the two panels is open.
+ */
+import { type ExportTarget, canSubmitSecret, secretState } from '~/utils/exportTargets'
+
+const props = withDefaults(
+  defineProps<{ target: ExportTarget; busy?: boolean }>(),
+  { busy: false },
+)
+
+const emit = defineEmits<{ store: [string]; clear: [] }>()
+
+const base = useId()
+const state = computed(() => secretState(props.target))
+
+/** Which panel is open. Never both: "type a new credential" and "throw the
+ *  old one away" are opposite intentions, and a reader who has one of them
+ *  in front of them should not be one mis-click from the other. */
+const open = ref<'none' | 'typing' | 'clearing'>('none')
+const typed = ref('')
+const field = ref<HTMLInputElement | null>(null)
+
+/** What was typed never outlives the panel. There is nothing to come back
+ *  to: the value cannot be read back from anywhere, so a half-typed
+ *  credential left in a hidden input is only a credential sitting in the
+ *  page for longer than anybody meant it to. */
+function close() {
+  open.value = 'none'
+  typed.value = ''
+}
+
+// A destination that arrives with a credential newly stored is a different
+// destination as far as this control is concerned, so nothing typed
+// survives the answer coming back.
+watch(() => props.target.id, close)
+watch(() => props.target.hasSecret, close)
+
+function startTyping() {
+  open.value = 'typing'
+  typed.value = ''
+  void nextTick(() => field.value?.focus())
+}
+
+function store() {
+  if (!canSubmitSecret(typed.value) || props.busy) return
+  emit('store', typed.value)
+}
+</script>
+
+<template>
+  <section
+    class="rounded-lg border p-3"
+    :style="{ borderColor: 'var(--border)' }"
+  >
+    <h4 class="text-sm font-semibold">{{ $t('admin.destinations.secretHeading') }}</h4>
+
+    <!-- What is known about the credential, which is whether there is one.
+         Never how long it is, never its first characters, never a row of
+         dots standing in for it: a mask is a value, and a value would have
+         to have come from somewhere. -->
+    <p class="mt-1 text-sm" :style="{ color: 'var(--text)' }">{{ $t(state.statusKey) }}</p>
+    <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
+      {{ $t('admin.destinations.secretNeverShown') }}
+    </p>
+    <!-- Said here rather than left to be discovered: none of the three
+         formats this deployment publishes reads a stored credential today,
+         and a control that let somebody believe it did would be a control
+         that quietly does nothing. -->
+    <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
+      {{ $t('admin.destinations.secretUnused') }}
+    </p>
+
+    <div v-if="open === 'none'" class="mt-3 flex flex-wrap items-center gap-2">
+      <button
+        type="button"
+        class="rounded-lg border px-3 py-1.5 text-sm transition-colors disabled:opacity-60"
+        :style="{ borderColor: 'var(--control-border)', color: 'var(--text)' }"
+        :disabled="busy"
+        @click="startTyping"
+      >
+        {{ $t(state.actionKey) }}
+      </button>
+      <button
+        v-if="state.canClear"
+        type="button"
+        class="rounded-lg border px-3 py-1.5 text-sm transition-colors disabled:opacity-60"
+        :style="{ borderColor: 'var(--danger)', color: 'var(--danger)' }"
+        :disabled="busy"
+        @click="open = 'clearing'"
+      >
+        {{ $t('admin.destinations.secretClear') }}
+      </button>
+    </div>
+
+    <!-- The box, and it exists only because somebody pressed for it. -->
+    <form v-else-if="open === 'typing'" class="mt-3" @submit.prevent="store">
+      <label class="block text-sm font-medium" :for="`${base}-secret`">
+        {{ $t('admin.destinations.secretInputLabel') }}
+      </label>
+      <input
+        :id="`${base}-secret`"
+        ref="field"
+        v-model="typed"
+        type="password"
+        autocomplete="new-password"
+        spellcheck="false"
+        class="mt-1 w-full rounded-lg border px-3 py-2 font-mono text-sm transition-colors"
+        :style="{
+          borderColor: 'var(--control-border)',
+          background: 'var(--surface)',
+          color: 'var(--text)',
+        }"
+      >
+      <div class="mt-2 flex flex-wrap items-center gap-2">
+        <!-- Refused while empty, because an empty box must not read as a
+             way to clear one. The API answers 400 to it as well. -->
+        <button
+          type="submit"
+          class="rounded-lg px-3 py-1.5 text-sm font-medium transition-colors disabled:opacity-60"
+          :style="{ background: 'var(--action)', color: 'var(--action-contrast)' }"
+          :disabled="busy || !canSubmitSecret(typed)"
+        >
+          {{ busy ? $t('admin.destinations.secretSaving') : $t('admin.destinations.secretSave') }}
+        </button>
+        <button
+          type="button"
+          class="rounded-lg border px-3 py-1.5 text-sm transition-colors disabled:opacity-60"
+          :style="{ borderColor: 'var(--control-border)', color: 'var(--text)' }"
+          :disabled="busy"
+          @click="close"
+        >
+          {{ $t('admin.destinations.cancel') }}
+        </button>
+      </div>
+    </form>
+
+    <!-- Clearing, confirmed, and told what it costs. -->
+    <div
+      v-else
+      class="mt-3 rounded-lg border p-3"
+      :style="{ borderColor: 'var(--danger)' }"
+    >
+      <p class="text-sm font-semibold">
+        {{ $t('admin.destinations.secretClearConfirmHeading') }}
+      </p>
+      <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
+        {{ $t('admin.destinations.secretClearConfirmBody') }}
+      </p>
+      <div class="mt-2 flex flex-wrap items-center gap-2">
+        <button
+          type="button"
+          class="rounded-lg px-3 py-1.5 text-sm font-medium transition-colors disabled:opacity-60"
+          :style="{ background: 'var(--danger)', color: 'var(--danger-contrast)' }"
+          :disabled="busy"
+          @click="emit('clear')"
+        >
+          {{ $t('admin.destinations.secretClearConfirm') }}
+        </button>
+        <button
+          type="button"
+          class="rounded-lg border px-3 py-1.5 text-sm transition-colors disabled:opacity-60"
+          :style="{ borderColor: 'var(--control-border)', color: 'var(--text)' }"
+          :disabled="busy"
+          @click="close"
+        >
+          {{ $t('admin.destinations.cancel') }}
+        </button>
+      </div>
+    </div>
+  </section>
+</template>
diff --git a/console/app/pages/admin/destinations.vue b/console/app/pages/admin/destinations.vue
new file mode 100644
index 0000000..9401a2e
--- /dev/null
+++ b/console/app/pages/admin/destinations.vue
@@ -0,0 +1,636 @@
+<script setup lang="ts">
+/**
+ * Where a guild's protocols go.
+ *
+ * A guild has been able to publish to several destinations in several
+ * formats since #144, and none of it was reachable from the interface:
+ * `document_target` on Bot Settings still looked like the only answer, and
+ * it is now the *fallback* for a guild that configures nothing here. This
+ * page is what makes the difference visible, and it says which of the two
+ * is actually in force rather than leaving them looking like rival
+ * settings — see `fallbackNote`.
+ *
+ * Everything that is a *decision* lives in `~/utils/exportTargets` and is
+ * tested there: which formats are offered and why two are absent, what a
+ * format will accept as an address, which destination Discord announces,
+ * what may be done to a credential, and what is wrong with a draft. What
+ * is left in this file is layout, request plumbing and which panel is
+ * open. The guild picker is not reimplemented either — it is the same
+ * functions Bot Settings and the Queue use, remembered choice included, so
+ * switching servers on one admin page carries to the others.
+ *
+ * Three things this page refuses to do, all three on purpose:
+ *
+ * - **It never renders a box for a credential beside a credential.** The
+ *   destination form has no secret field at all; `ExportTargetSecret` is a
+ *   separate control with its own request, and its input does not exist
+ *   until somebody deliberately opens it. An empty password box saved with
+ *   the rest of a form is how a working token gets wiped by somebody
+ *   correcting a typo in a name.
+ * - **It never offers a format a save would refuse.** `pdf` and
+ *   `confluence` are not built and the API answers 400 to either; they are
+ *   absent from the picker rather than present and inert, and one sentence
+ *   under it says which formats this deployment publishes. The argument,
+ *   and the two precedents it had to choose between, are at the top of
+ *   `~/utils/exportTargets`.
+ * - **It never re-reads a guild's destinations under another guild's
+ *   heading.** The answer travels with the guild it belongs to, the way
+ *   the queue page's figures do: a list that lingers for a few hundred
+ *   milliseconds is long enough to be acted on.
+ */
+import UiDisclosureList from '~/components/ui/UiDisclosureList.vue'
+import UiPagination from '~/components/ui/UiPagination.vue'
+import UiSelect from '~/components/ui/UiSelect.vue'
+import { parseCollections } from '~/utils/directory'
+import {
+  type ExportTarget,
+  type TargetDraft,
+  describeTargetError,
+  draftBody,
+  draftOf,
+  emptyDraft,
+  enabledLabelKey,
+  fallbackNote,
+  orderTargets,
+  parseTargets,
+  primaryTarget,
+  takenNames,
+  targetPath,
+  targetSecretPath,
+  targetSummary,
+  targetsPath,
+} from '~/utils/exportTargets'
+import type { Message } from '~/utils/message'
+import { PAGE_SIZE } from '~/utils/paging'
+import {
+  chooseGuild,
+  guildOptions,
+  parseGuilds,
+  readSelectedGuild,
+  writeSelectedGuild,
+} from '~/utils/settings'
+import { paginationView } from '~/utils/uiPagination'
+
+const { t } = useI18n()
+const api = useApi()
+const say = useSay()
+
+useHead(() => ({ title: t('admin.destinations.title') }))
+
+const { data: guildData, error: guildError } = await useAsyncData(
+  'destinations-guilds',
+  async () => parseGuilds(await api('/guilds')),
+)
+
+const guilds = computed(() => guildData.value ?? [])
+
+// Server-side there is no browser and therefore no remembered choice, so
+// the first render picks the first guild. The remembered one is applied
+// after hydration -- the same trade the sidebar and the other admin pages
+// make: a correct first paint for everybody, and one repaint for the
+// person who has two guilds and last worked on the second.
+const selected = ref<string | null>(chooseGuild(guilds.value, null))
+
+onMounted(() => {
+  selected.value = chooseGuild(guilds.value, readSelectedGuild(window.localStorage))
+})
+
+function chooseGuildFromMenu(guildId: string | null) {
+  // The dropdown's model is nullable so that a page resetting a filter has
+  // a way to say so. This page has no such state: there is always a guild
+  // being configured.
+  if (guildId === null) return
+  selected.value = guildId
+  if (import.meta.client) writeSelectedGuild(window.localStorage, guildId)
+}
+
+const guildChoices = computed(() => guildOptions(guilds.value))
+
+// The guild the rows belong to travels *with* the rows rather than in a
+// ref of its own. A ref set inside the fetcher would be null after
+// hydration -- the server ran the fetch, the client did not.
+const {
+  data: targetData,
+  error: targetError,
+  status: targetStatus,
+  refresh,
+} = await useAsyncData(
+  'destinations-targets',
+  async () => {
+    const guildId = selected.value
+    if (!guildId) return { guildId: null as string | null, targets: [] as ExportTarget[] }
+    return { guildId, targets: parseTargets(await api(targetsPath(guildId))) }
+  },
+  { watch: [selected] },
+)
+
+/** Nothing is shown while the answer on hand belongs to another guild. */
+const targets = computed(() =>
+  targetData.value && targetData.value.guildId === selected.value
+    ? orderTargets(targetData.value.targets)
+    : [],
+)
+
+/**
+ * Outline's collections, for the one format that addresses one.
+ *
+ * Decoration, exactly as on Bot Settings: if this refuses, the collection
+ * field falls back to asking for an id and one sentence says why. A page
+ * that could not be used because a name list is down would be worse than
+ * one that asks for ids.
+ */
+const { data: collectionData, error: collectionError } = await useAsyncData(
+  'destinations-collections',
+  async () => parseCollections(await api('/outline/collections')),
+)
+
+const collections = computed(() => collectionData.value?.collections ?? [])
+
+const primary = computed(() => primaryTarget(targets.value))
+
+const page = ref(1)
+
+const view = computed(() => paginationView(page.value, targets.value.length, PAGE_SIZE))
+const shown = computed(() =>
+  targets.value.slice((view.value.page - 1) * PAGE_SIZE, view.value.page * PAGE_SIZE),
+)
+
+/**
+ * The list's rows.
+ *
+ * No `selected` is handed to `UiDisclosureList`, so no checkbox column is
+ * rendered: this list has no bulk action. Removing several destinations at
+ * once is not something anybody has asked for, and a column of ticks over
+ * an action that does not exist is a control that reads as broken.
+ *
+ * The destination travels on the row rather than being looked back up by
+ * index, which is what the list being generic in its row type is for — a
+ * second array indexed in parallel is how one name ends up beside another
+ * destination's controls the first time the two stop being the same
+ * length.
+ */
+const rows = computed(() => shown.value.map((target) => ({ id: String(target.id), target })))
+
+/* -------------------------------------------------------------------- */
+/* Which panel is open, and what happened last                           */
+/* -------------------------------------------------------------------- */
+
+const adding = ref(false)
+/** The destination whose form is open, by id. */
+const editing = ref<number | null>(null)
+/** The destination whose removal is being confirmed, by id. */
+const removing = ref<number | null>(null)
+/** The destination a request is running against, or `'new'`. One at a
+ *  time: every write here re-reads the whole list afterwards, and two in
+ *  flight would race over which answer wins. */
+const busy = ref<number | 'new' | null>(null)
+/** What the last write did, or why it did not. */
+const outcome = ref<{ tone: 'good' | 'bad'; message: Message } | null>(null)
+
+function closePanels() {
+  adding.value = false
+  editing.value = null
+  removing.value = null
+}
+
+// A page number belongs to a list, and switching servers is a different
+// list: page four of the previous guild's destinations is not page four of
+// this one's. An open form belongs to a destination, and that destination
+// is not on screen any more either.
+watch(selected, () => {
+  page.value = 1
+  outcome.value = null
+  closePanels()
+})
+
+/**
+ * Runs one write, then re-reads the list.
+ *
+ * Re-read rather than patched in place: the API answers a write with the
+ * stored row, and the *rest* of the list can have changed under a second
+ * administrator in another tab. It is one request against a guild's own
+ * destinations, of which there are a handful.
+ */
+async function write(
+  who: number | 'new',
+  request: () => Promise<unknown>,
+  done: string,
+): Promise<void> {
+  if (busy.value !== null) return
+  busy.value = who
+  outcome.value = null
+  try {
+    await request()
+    await refresh()
+    closePanels()
+    outcome.value = { tone: 'good', message: { key: done } }
+  } catch (error) {
+    outcome.value = { tone: 'bad', message: describeTargetError(error) }
+  } finally {
+    busy.value = null
+  }
+}
+
+const guildId = computed(() => selected.value ?? '')
+
+function create(draft: TargetDraft) {
+  void write(
+    'new',
+    () => api(targetsPath(guildId.value), { method: 'POST', body: draftBody(draft) }),
+    'admin.destinations.savedCreated',
+  )
+}
+
+function update(target: ExportTarget, draft: TargetDraft) {
+  void write(
+    target.id,
+    () =>
+      api(targetPath(guildId.value, target.id), {
+        method: 'PUT',
+        // The stored `config` travels back out untouched: this page never
+        // edits it, and sending `{}` would erase whatever a format that
+        // needs one had put there.
+        body: draftBody(draft, target.config),
+      }),
+    'admin.destinations.savedUpdated',
+  )
+}
+
+/** Switching one on or off is the same `PUT` with one field flipped, so it
+ *  goes through the same path rather than growing an endpoint of its own. */
+function setEnabled(target: ExportTarget, enabled: boolean) {
+  void write(
+    target.id,
+    () =>
+      api(targetPath(guildId.value, target.id), {
+        method: 'PUT',
+        body: draftBody({ ...draftOf(target), enabled }, target.config),
+      }),
+    enabled ? 'admin.destinations.savedEnabled' : 'admin.destinations.savedDisabled',
+  )
+}
+
+function remove(target: ExportTarget) {
+  void write(
+    target.id,
+    () => api(targetPath(guildId.value, target.id), { method: 'DELETE' }),
+    'admin.destinations.savedDeleted',
+  )
+}
+
+function storeSecret(target: ExportTarget, secret: string) {
+  void write(
+    target.id,
+    () =>
+      api(targetSecretPath(guildId.value, target.id), { method: 'PUT', body: { secret } }),
+    'admin.destinations.secretSaved',
+  )
+}
+
+/** `null` is how the API is told to forget a credential, and it is a
+ *  different request from writing one. See `ExportTargetSecret`. */
+function clearSecret(target: ExportTarget) {
+  void write(
+    target.id,
+    () =>
+      api(targetSecretPath(guildId.value, target.id), {
+        method: 'PUT',
+        body: { secret: null },
+      }),
+    'admin.destinations.secretCleared',
+  )
+}
+
+function startEditing(id: number) {
+  outcome.value = null
+  adding.value = false
+  removing.value = null
+  editing.value = editing.value === id ? null : id
+}
+
+function startAdding() {
+  outcome.value = null
+  editing.value = null
+  removing.value = null
+  adding.value = true
+}
+</script>
+
+<template>
+  <div class="mx-auto flex max-w-4xl flex-col gap-4">
+    <header>
+      <h1 class="text-2xl font-semibold">{{ $t('admin.destinations.title') }}</h1>
+      <p class="mt-1 max-w-3xl text-sm" :style="{ color: 'var(--text-muted)' }">
+        {{ $t('admin.destinations.intro') }}
+      </p>
+    </header>
+
+    <!-- The list of servers itself could not be read. Asked before "you
+         administer none", because an empty list and an unread list look
+         identical and only one of them is a statement about this person. -->
+    <section
+      v-if="guildError"
+      class="rounded-2xl border p-6"
+      :style="{ borderColor: 'var(--danger)' }"
+    >
+      <p class="text-sm font-medium">{{ $t('admin.destinations.serversFailed') }}</p>
+      <p class="mt-1 text-sm" :style="{ color: 'var(--text-muted)' }">
+        {{ say(describeTargetError(guildError)) }}
+      </p>
+    </section>
+
+    <!-- Nobody administers anything. The endpoints answer 404 to this
+         person for every guild, so there is nothing to show and one
+         paragraph saying how that changes. -->
+    <section
+      v-else-if="guilds.length === 0"
+      class="rounded-2xl border p-6"
+      :style="{ borderColor: 'var(--border)', background: 'var(--surface)' }"
+    >
+      <h2 class="text-base font-semibold">{{ $t('admin.destinations.noGuildsHeading') }}</h2>
+      <p class="mt-2 max-w-3xl text-sm" :style="{ color: 'var(--text-muted)' }">
+        {{ $t('admin.destinations.noGuildsBody') }}
+      </p>
+      <i18n-t
+        keypath="admin.destinations.noGuildsRole"
+        tag="p"
+        class="mt-2 max-w-3xl text-sm"
+        :style="{ color: 'var(--text-muted)' }"
+      >
+        <template #setting>
+          <code>admin_role_id</code>
+        </template>
+      </i18n-t>
+    </section>
+
+    <template v-else>
+      <!-- The switcher scopes the whole page, so it sits above everything
+           it scopes and outside the list it changes. -->
+      <section
+        class="rounded-2xl border p-4"
+        :style="{ borderColor: 'var(--border)', background: 'var(--surface)' }"
+      >
+        <span class="block text-sm font-medium">{{ $t('admin.destinations.whichServer') }}</span>
+        <div class="mt-1 max-w-md">
+          <UiSelect
+            :options="guildChoices"
+            :model-value="selected"
+            :label="$t('admin.destinations.whichServer')"
+            @update:model-value="chooseGuildFromMenu"
+          />
+        </div>
+      </section>
+
+      <!-- What the last write did, good or bad, said once and near the
+           list it changed. -->
+      <p
+        v-if="outcome"
+        role="status"
+        class="rounded-lg border px-3 py-2 text-sm"
+        :style="{
+          borderColor: outcome.tone === 'good' ? 'var(--positive)' : 'var(--danger)',
+          color: 'var(--text)',
+        }"
+      >
+        {{ say(outcome.message) }}
+      </p>
+
+      <div
+        v-if="targetStatus === 'pending' && !targetError"
+        aria-busy="true"
+      >
+        <p class="sr-only">{{ $t('admin.destinations.loading') }}</p>
+        <div
+          class="h-40 animate-pulse rounded-2xl border motion-reduce:animate-none"
+          :style="{ borderColor: 'var(--border)', background: 'var(--surface)' }"
+        />
+      </div>
+
+      <section
+        v-else-if="targetError"
+        class="rounded-2xl border p-6"
+        :style="{ borderColor: 'var(--danger)' }"
+      >
+        <p class="text-sm font-medium">{{ $t('admin.destinations.loadFailed') }}</p>
+        <p class="mt-1 text-sm" :style="{ color: 'var(--text-muted)' }">
+          {{ say(describeTargetError(targetError)) }}
+        </p>
+        <button
+          type="button"
+          class="mt-3 rounded-lg px-3 py-1.5 text-sm font-medium transition-colors hover:bg-[var(--surface-raised)] disabled:opacity-60"
+          :style="{ color: 'var(--action)' }"
+          :disabled="targetStatus === 'pending'"
+          @click="refresh()"
+        >
+          {{ $t('error.retry') }}
+        </button>
+      </section>
+
+      <template v-else>
+        <section
+          class="rounded-2xl border p-4"
+          :style="{ borderColor: 'var(--border)', background: 'var(--surface)' }"
+        >
+          <!-- Which one Discord announces, said above the list rather than
+               left to be inferred from the order. It is the one fact on
+               this page with a consequence outside it. -->
+          <p
+            v-if="primary"
+            class="mb-3 text-xs"
+            :style="{ color: 'var(--text-muted)' }"
+          >
+            {{ $t('admin.destinations.primaryNote') }}
+          </p>
+
+          <UiDisclosureList :rows="rows" :label="$t('admin.destinations.listLabel')">
+            <template #row="{ row }">
+              <span class="flex flex-wrap items-center gap-2">
+                <span class="font-medium">{{ row.target.name }}</span>
+                <span
+                  class="rounded-full px-2 py-0.5 text-xs"
+                  :style="row.target.enabled
+                    ? { background: 'var(--positive)', color: 'var(--positive-contrast)' }
+                    : { background: 'var(--surface-sunken)', color: 'var(--text-muted)' }"
+                >{{ $t(enabledLabelKey(row.target)) }}</span>
+                <span
+                  v-if="primary && primary.id === row.target.id"
+                  class="rounded-full px-2 py-0.5 text-xs"
+                  :style="{ background: 'var(--surface-sunken)', color: 'var(--text)' }"
+                >{{ $t('admin.destinations.primaryBadge') }}</span>
+                <span
+                  v-if="row.target.hasSecret"
+                  class="rounded-full px-2 py-0.5 text-xs"
+                  :style="{ background: 'var(--surface-sunken)', color: 'var(--text-muted)' }"
+                >{{ $t('admin.destinations.secretHeading') }}</span>
+                <span class="block w-full truncate text-xs" :style="{ color: 'var(--text-muted)' }">
+                  {{ say(targetSummary(row.target)) }}
+                </span>
+              </span>
+            </template>
+
+            <template #actions="{ row }">
+              <div class="flex flex-col gap-3">
+                <div class="flex flex-wrap items-center gap-2">
+                  <button
+                    type="button"
+                    class="rounded-lg border px-3 py-1.5 text-sm transition-colors disabled:opacity-60"
+                    :style="{ borderColor: 'var(--control-border)', color: 'var(--text)' }"
+                    :disabled="busy !== null"
+                    @click="startEditing(row.target.id)"
+                  >
+                    {{ $t('admin.destinations.edit') }}
+                  </button>
+                  <button
+                    type="button"
+                    class="rounded-lg border px-3 py-1.5 text-sm transition-colors disabled:opacity-60"
+                    :style="{ borderColor: 'var(--control-border)', color: 'var(--text)' }"
+                    :disabled="busy !== null"
+                    @click="setEnabled(row.target, !row.target.enabled)"
+                  >
+                    {{ row.target.enabled
+                      ? $t('admin.destinations.disable')
+                      : $t('admin.destinations.enable') }}
+                  </button>
+                  <button
+                    type="button"
+                    class="rounded-lg border px-3 py-1.5 text-sm transition-colors disabled:opacity-60"
+                    :style="{ borderColor: 'var(--danger)', color: 'var(--danger)' }"
+                    :disabled="busy !== null"
+                    @click="removing = removing === row.target.id ? null : row.target.id"
+                  >
+                    {{ $t('admin.destinations.delete') }}
+                  </button>
+                </div>
+
+                <!-- Removing, confirmed, and told what it does not do.
+                     Nothing already published is deleted, and somebody
+                     about to press this should not have to guess. -->
+                <div
+                  v-if="removing === row.target.id"
+                  class="rounded-lg border p-3"
+                  :style="{ borderColor: 'var(--danger)' }"
+                >
+                  <p class="text-sm font-semibold">
+                    {{ $t('admin.destinations.deleteConfirmHeading') }}
+                  </p>
+                  <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
+                    {{ $t('admin.destinations.deleteConfirmBody') }}
+                  </p>
+                  <div class="mt-2 flex flex-wrap items-center gap-2">
+                    <button
+                      type="button"
+                      class="rounded-lg px-3 py-1.5 text-sm font-medium transition-colors disabled:opacity-60"
+                      :style="{ background: 'var(--danger)', color: 'var(--danger-contrast)' }"
+                      :disabled="busy !== null"
+                      @click="remove(row.target)"
+                    >
+                      {{ $t('admin.destinations.deleteConfirm') }}
+                    </button>
+                    <button
+                      type="button"
+                      class="rounded-lg border px-3 py-1.5 text-sm transition-colors disabled:opacity-60"
+                      :style="{ borderColor: 'var(--control-border)', color: 'var(--text)' }"
+                      :disabled="busy !== null"
+                      @click="removing = null"
+                    >
+                      {{ $t('admin.destinations.cancel') }}
+                    </button>
+                  </div>
+                </div>
+
+                <ExportTargetForm
+                  v-if="editing === row.target.id"
+                  mode="edit"
+                  :initial="draftOf(row.target)"
+                  :taken="takenNames(targets, row.target.id)"
+                  :collections="collections"
+                  :collections-failed="Boolean(collectionError)"
+                  :busy="busy === row.target.id"
+                  @submit="(draft) => update(row.target, draft)"
+                  @cancel="editing = null"
+                />
+
+                <!-- Written, never read. Its own control and its own
+                     request, so that saving the form above cannot touch
+                     it. -->
+                <ExportTargetSecret
+                  :target="row.target"
+                  :busy="busy === row.target.id"
+                  @store="(secret) => storeSecret(row.target, secret)"
+                  @clear="clearSecret(row.target)"
+                />
+              </div>
+            </template>
+          </UiDisclosureList>
+
+          <!-- The empty list already says "there is nothing in this list";
+               this says why that is not a fault and what happens instead. -->
+          <div
+            v-if="targets.length === 0"
+            class="mt-3 rounded-lg border border-dashed p-3"
+            :style="{ borderColor: 'var(--border)' }"
+          >
+            <p class="text-sm font-medium">{{ $t('admin.destinations.emptyHeading') }}</p>
+            <p class="mt-1 text-sm" :style="{ color: 'var(--text-muted)' }">
+              {{ $t('admin.destinations.emptyNote') }}
+            </p>
+          </div>
+
+          <UiPagination
+            v-if="view.count > 1"
+            class="mt-4"
+            :page="view.page"
+            :total="targets.length"
+            :label="$t('admin.destinations.pagerLabel')"
+            @update:page="(next) => (page = next)"
+          />
+
+          <div class="mt-4">
+            <ExportTargetForm
+              v-if="adding"
+              mode="add"
+              :initial="emptyDraft()"
+              :taken="takenNames(targets)"
+              :collections="collections"
+              :collections-failed="Boolean(collectionError)"
+              :busy="busy === 'new'"
+              @submit="create"
+              @cancel="adding = false"
+            />
+            <button
+              v-else
+              type="button"
+              class="rounded-lg px-3 py-1.5 text-sm font-medium transition-colors disabled:opacity-60"
+              :style="{ background: 'var(--action)', color: 'var(--action-contrast)' }"
+              :disabled="busy !== null"
+              @click="startAdding"
+            >
+              {{ $t('admin.destinations.add') }}
+            </button>
+          </div>
+        </section>
+
+        <!-- The other half of the answer, on the page where the question
+             is asked. `document_target` and these destinations are not
+             rival settings: one replaces the other, and which of them is
+             in force right now is what this says. -->
+        <section
+          class="rounded-2xl border p-4"
+          :style="{ borderColor: 'var(--border)', background: 'var(--surface)' }"
+        >
+          <h2 class="text-base font-semibold">{{ $t('admin.destinations.fallbackHeading') }}</h2>
+          <p class="mt-1 max-w-3xl text-sm" :style="{ color: 'var(--text-muted)' }">
+            {{ say(fallbackNote(targets)) }}
+          </p>
+          <NuxtLink
+            to="/admin/bot-settings"
+            class="mt-2 inline-block text-sm font-medium transition-colors hover:underline"
+            :style="{ color: 'var(--action)' }"
+          >
+            {{ $t('admin.destinations.fallbackLink') }}
+          </NuxtLink>
+        </section>
+      </template>
+    </template>
+  </div>
+</template>
diff --git a/console/app/pages/recordings/[id].vue b/console/app/pages/recordings/[id].vue
index 114ff12..dbb14b6 100644
--- a/console/app/pages/recordings/[id].vue
+++ b/console/app/pages/recordings/[id].vue
@@ -50,6 +50,12 @@ import {
   type RecordedSession,
 } from '~/utils/recordings'
 import { recordingTabQuery, recordingTabs } from '~/utils/recordingTabs'
+import {
+  parseSessionDocuments,
+  publishedProtocols,
+  sessionDocumentsPath,
+  type SessionDocument,
+} from '~/utils/sessionDocuments'
 import { transcriptAudioErased, transcriptPath, type SessionTranscript } from '~/utils/transcript'
 import type { SessionName } from '~/utils/sessionNaming'
 import { ApiError } from '~/utils/apiError'
@@ -61,6 +67,17 @@ interface Recording {
    *  The session is authoritative for the page's existence; a transcript
    *  that failed is one tab's problem and not five. */
   transcript: SessionTranscript | null
+  /**
+   * Every destination this meeting reached, or `null` when the listing
+   * could not be read.
+   *
+   * `null` and `[]` are deliberately different answers. An empty list is
+   * a real state — a meeting still being transcribed, a guild that has
+   * configured nowhere to publish — and drawing a failed read as one
+   * would tell somebody their meeting was published nowhere when in fact
+   * nobody asked. See `~/utils/sessionDocuments`.
+   */
+  documents: SessionDocument[] | null
 }
 
 const { t } = useI18n()
@@ -77,7 +94,7 @@ const { data, status, error, refresh } = await useAsyncData<Recording>(
     // In parallel. They are two independent reads behind the same
     // authorisation, and doing them one after the other would double the
     // wait for no answer either of them needs from the other.
-    const [session, transcript] = await Promise.all([
+    const [session, transcript, documents] = await Promise.all([
       api<RecordedSession>(`/sessions/${encodeURIComponent(sessionId)}`),
       // Swallowed on purpose, and only here: a transcript that cannot be
       // read must not take down the audio, the tags or the metadata. What
@@ -86,8 +103,14 @@ const { data, status, error, refresh } = await useAsyncData<Recording>(
       // — "the words could not be read" covers both, and the session's own
       // 404 is what decides whether this recording is anybody's at all.
       api<SessionTranscript>(transcriptPath(sessionId)).catch(() => null),
+      // Swallowed for the same reason, and `null` rather than `[]`: the
+      // difference between "nothing was published" and "where this went
+      // could not be read" is the whole point of this list existing.
+      api(sessionDocumentsPath(sessionId))
+        .then(parseSessionDocuments)
+        .catch(() => null),
     ])
-    return { session, transcript }
+    return { session, transcript, documents }
   },
   { watch: [id] },
 )
@@ -111,6 +134,23 @@ const session = computed<RecordedSession | null>(() => {
   return renamed.value === null ? found : { ...found, ...renamed.value }
 })
 const transcript = computed<SessionTranscript | null>(() => data.value?.transcript ?? null)
+
+/** The listing could not be read, as opposed to being empty. Only ever
+ *  true once the page itself has loaded, so it does not flash during the
+ *  first render. */
+const documentsFailed = computed(() => data.value !== null && data.value?.documents === null)
+
+/**
+ * What this meeting was published as, and how that squares with the one
+ * link the Discord announcement carries.
+ *
+ * `~/utils/sessionDocuments` decides all of it, including the state this
+ * section exists for: documents with no announced link means the
+ * destination Sturnus announces produced nothing while the others did.
+ */
+const protocols = computed(() =>
+  publishedProtocols(session.value?.document_url, data.value?.documents ?? []),
+)
 const length = computed(() => (session.value ? sessionLength(session.value) : null))
 const naming = computed(() => (session.value ? recordingNaming(session.value) : null))
 
@@ -336,27 +376,112 @@ function onRenamed(name: SessionName) {
               <MultiTrackPlayer v-else :session="session" />
             </section>
 
+            <!-- Where the meeting went. A section of its own, because it
+                 is a list now: a guild may publish to several
+                 destinations, each is written independently, and one
+                 failing while the others succeed is a state this page has
+                 to be able to show. A single "Open the protocol" button
+                 could only ever show the first of them and would imply it
+                 was the whole story. -->
             <section
               class="rounded-2xl border p-5"
               :style="{ borderColor: 'var(--border)', background: 'var(--surface)' }"
             >
-              <h2 class="text-base font-semibold">{{ $t('recordings.aboutHeading') }}</h2>
+              <h2 class="text-base font-semibold">{{ $t('recordings.protocolsHeading') }}</h2>
 
-              <div class="mt-3 flex flex-wrap items-center gap-3">
+              <!-- The listing failed. Say so, and fall back to the one
+                   link the session itself carries rather than drawing an
+                   unread list as an empty one. -->
+              <template v-if="documentsFailed">
+                <p class="mt-1 text-sm" :style="{ color: 'var(--text-muted)' }">
+                  {{ $t('recordings.protocolsFailed') }}
+                </p>
                 <a
                   v-if="hasProtocol(session)"
                   :href="session.document_url ?? ''"
                   target="_blank"
                   rel="noreferrer"
-                  class="rounded-lg px-3 py-1.5 text-sm font-medium transition-colors hover:bg-[var(--surface-raised)]"
+                  class="mt-2 inline-block rounded-lg px-3 py-1.5 text-sm font-medium transition-colors hover:bg-[var(--surface-raised)]"
+                  :style="{ color: 'var(--action)' }"
+                >
+                  {{ $t('recordings.openProtocol') }}
+                </a>
+              </template>
+
+              <template v-else>
+                <p class="mt-1 text-sm" :style="{ color: 'var(--text-muted)' }">
+                  {{ say(protocols.summary) }}
+                </p>
+                <!-- The two answers disagree, and this says which way.
+                     Never a diagnosis: the retry sweep is still running,
+                     and a destination not yet retried looks exactly like
+                     one that will never work. -->
+                <p
+                  v-if="protocols.note"
+                  class="mt-2 rounded-lg border border-dashed p-3 text-sm"
+                  :style="{ borderColor: 'var(--border)', color: 'var(--text-muted)' }"
+                >
+                  {{ say(protocols.note) }}
+                </p>
+
+                <!-- The single link of a meeting published before this
+                     server named destinations of its own. There is no row
+                     carrying it, so it is rendered on its own. -->
+                <a
+                  v-if="protocols.state === 'announcedOnly' && protocols.announced"
+                  :href="protocols.announced"
+                  target="_blank"
+                  rel="noreferrer"
+                  class="mt-2 inline-block rounded-lg px-3 py-1.5 text-sm font-medium transition-colors hover:bg-[var(--surface-raised)]"
                   :style="{ color: 'var(--action)' }"
                 >
                   {{ $t('recordings.openProtocol') }}
                 </a>
-                <span v-else class="text-sm" :style="{ color: 'var(--text-muted)' }">
-                  {{ $t('recordings.noProtocolWritten') }}
-                </span>
-              </div>
+
+                <ul v-else-if="protocols.rows.length > 0" class="mt-3 flex flex-col gap-2">
+                  <li
+                    v-for="row in protocols.rows"
+                    :key="row.id"
+                    class="rounded-lg border p-3"
+                    :style="{ borderColor: 'var(--border)' }"
+                  >
+                    <div class="flex flex-wrap items-baseline justify-between gap-2">
+                      <span class="text-sm font-medium">{{ say(row.label) }}</span>
+                      <span
+                        v-if="row.at"
+                        class="text-xs tabular-nums"
+                        :style="{ color: 'var(--text-muted)' }"
+                      >{{ say(row.at) }}</span>
+                    </div>
+                    <a
+                      :href="row.url"
+                      target="_blank"
+                      rel="noreferrer"
+                      class="mt-1 inline-block text-sm font-medium transition-colors hover:underline"
+                      :style="{ color: 'var(--action)' }"
+                    >
+                      {{ $t('recordings.openProtocol') }}
+                    </a>
+                    <!-- The destination is gone and the document is not.
+                         Removing a destination is "stop publishing here",
+                         never "forget what was published". -->
+                    <p
+                      v-if="row.orphaned"
+                      class="mt-1 text-xs"
+                      :style="{ color: 'var(--text-muted)' }"
+                    >
+                      {{ $t('recordings.protocolOrphaned') }}
+                    </p>
+                  </li>
+                </ul>
+              </template>
+            </section>
+
+            <section
+              class="rounded-2xl border p-5"
+              :style="{ borderColor: 'var(--border)', background: 'var(--surface)' }"
+            >
+              <h2 class="text-base font-semibold">{{ $t('recordings.aboutHeading') }}</h2>
 
               <!-- What somebody wrote about the meeting, shown where a
                    listener wants it and edited on `details`. The rest of
diff --git a/console/app/utils/exportTargets.ts b/console/app/utils/exportTargets.ts
new file mode 100644
index 0000000..9812142
--- /dev/null
+++ b/console/app/utils/exportTargets.ts
@@ -0,0 +1,634 @@
+/**
+ * Where a guild publishes its protocols, as far as the console is allowed
+ * to decide it.
+ *
+ * `document_target` used to be the whole answer: one Outline collection
+ * per guild, one document per meeting, configured as a text field on Bot
+ * Settings beside twenty other text fields. A guild can now name several
+ * destinations in several formats, and none of that was reachable from the
+ * interface. This module holds every decision the destinations page makes,
+ * so that the page itself is layout and request plumbing — the rule the
+ * rest of `app/utils` already follows, and the reason those rules can be
+ * tested without mounting anything.
+ *
+ * Four things here are worth arguing for rather than reading past.
+ *
+ * **1. The formats this console offers are the three the API accepts, and
+ * `pdf` and `confluence` are absent rather than disabled.** They are
+ * specified and deliberately not built (`sturnus.application.
+ * export_formats`, spec §3.4), and configuring one answers 400. The
+ * console has two precedents for an option it cannot honour, and they
+ * point opposite ways. The account menu renders two-factor authentication
+ * as an inert "coming soon" row, because that is a *promise to the reader
+ * about their own account* sitting in a menu of things to read, and an
+ * absent row would read as an oversight. `video_consent_offered` goes the
+ * other way: when a guild has no video policy the option is **absent** —
+ * not greyed — and one sentence beside the control says the server records
+ * audio only.
+ *
+ * This is the second case, twice over. It is a *form field*, and a
+ * dropdown exists to be chosen from and saved; a row inside it that a save
+ * would refuse is not a promise, it is a trap laid under the cursor of
+ * somebody deciding. And more decisively: **which formats exist is the
+ * deployment's answer and this console cannot see it.** `supported_formats`
+ * is a registry in the API process, there is no endpoint that reads it
+ * out, and `apiError.ts` deliberately keeps nothing from a failed response
+ * but its status — so the `{"supported": [...]}` a 400 carries never
+ * reaches a page. A "PDF — coming soon" row would therefore be this
+ * console asserting a fact about a build it cannot inspect, and on the day
+ * `pdf` is added to that registry — which `export_formats` promises needs
+ * no change anywhere else — the console would still be calling it
+ * unavailable until somebody remembered to edit a second list. So the list
+ * below is a belief, it is stated as one, and {@link formatChoices} defers
+ * to the stored value whenever the two disagree.
+ *
+ * **2. A stored format this console has never heard of is still rendered,
+ * and still choosable while editing that destination.** Exactly the rule
+ * `~/utils/directory` applies to a channel id with no row in the mirror:
+ * an option that is not rendered is a configuration nobody can remove from
+ * this page, and a picker that silently dropped `pdf` would rewrite it to
+ * `outline` the next time somebody renamed the destination.
+ *
+ * **3. The first enabled destination is the one Discord announces.**
+ * `sturnus.application.exporting.destinations_for` orders by id, oldest
+ * first, and `session.document_url` is stamped from that one alone. That
+ * is not a detail of the page's sorting — it is which link lands in the
+ * channel — so {@link orderTargets} sorts by id and never by name, and
+ * {@link primaryTarget} says which one it is out loud.
+ *
+ * **4. The credential is write-only, and this module offers no shape that
+ * could carry one.** {@link ExportTarget} has `hasSecret` and nothing else
+ * about it, because the API's read model has `has_secret` and nothing else
+ * about it; {@link TargetDraft} — what the destination form edits and
+ * submits — has no secret field at all, which is what makes it impossible
+ * for saving a rename to clear a token. See {@link secretState}.
+ *
+ * Every sentence here is a translation key or a {@link Message}, never
+ * prose: a pure function returns data. See `i18n/README.md`.
+ */
+import type { Message } from './message'
+import type { UiOption } from './uiOption'
+
+/* -------------------------------------------------------------------- */
+/* What the API sends                                                    */
+/* -------------------------------------------------------------------- */
+
+/**
+ * One destination, as the console sees it.
+ *
+ * `id` is a number and `guildId` is a string, and the difference is the
+ * API's rather than an inconsistency: a Discord snowflake exceeds
+ * JavaScript's safe integer range, where a JSON number silently loses its
+ * last digits, and this row's own key is a `SERIAL` that will not reach
+ * 2^53.
+ *
+ * **There is nowhere here to put a credential.** `hasSecret` is the whole
+ * of what any response says about one, and this interface is shaped that
+ * way on purpose: a field that *could* hold a token is a field somebody
+ * eventually binds to an input.
+ */
+export interface ExportTarget {
+  id: number
+  guildId: string
+  format: string
+  name: string
+  target: string
+  /** Whatever else a format needs. None of the three formats this
+   *  deployment publishes needs anything, so it is read, carried and
+   *  never edited — dropping it would send `{}` back on the next rename
+   *  and erase a key some later format put there. */
+  config: Record<string, unknown>
+  /** That a credential is stored. Never the credential. */
+  hasSecret: boolean
+  enabled: boolean
+  /** ISO-8601, or `null` when the API sent something unreadable. */
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function asText(value: unknown): string | null {
+  if (value === null || value === undefined) return null
+  return typeof value === 'string' ? value : String(value)
+}
+
+/**
+ * One destination from a payload, or `null` when it has no id.
+ *
+ * Tolerant of everything else, the way `parseDirectory` is: a row with no
+ * name is kept and shows as its own id, because a destination that exists
+ * and renders as a blank is one nobody can switch off. A row with no id is
+ * dropped, because nothing can be done to it — every write addresses it by
+ * that id.
+ */
+export function parseTarget(payload: unknown): ExportTarget | null {
+  if (!isRecord(payload)) return null
+  // `null` is checked before the conversion, because `Number(null)` is 0
+  // and 0 is a safe integer -- a row with a null id would otherwise become
+  // a destination every write addressed as `/export-targets/0`.
+  if (payload.id === null || payload.id === undefined) return null
+  const id = Number(payload.id)
+  if (!Number.isSafeInteger(id)) return null
+  return {
+    id,
+    guildId: asText(payload.guild_id) ?? '',
+    format: asText(payload.format) ?? '',
+    name: asText(payload.name) ?? '',
+    target: asText(payload.target) ?? '',
+    config: isRecord(payload.config) ? payload.config : {},
+    hasSecret: payload.has_secret === true,
+    // Absent is false rather than true. A destination this console cannot
+    // tell the state of is better drawn as switched off — the reader then
+    // switches it on and learns the truth — than drawn as publishing when
+    // it is not.
+    enabled: payload.enabled === true,
+    createdAt: asText(payload.created_at),
+    updatedAt: asText(payload.updated_at),
+  }
+}
+
+/** Every destination in a listing, in the order the API sent them. */
+export function parseTargets(payload: unknown): ExportTarget[] {
+  if (!isRecord(payload) || !Array.isArray(payload.targets)) return []
+  const targets: ExportTarget[] = []
+  for (const raw of payload.targets) {
+    const target = parseTarget(raw)
+    if (target !== null) targets.push(target)
+  }
+  return targets
+}
+
+/* -------------------------------------------------------------------- */
+/* The formats this console believes the deployment builds               */
+/* -------------------------------------------------------------------- */
+
+export const FORMAT_OUTLINE = 'outline'
+export const FORMAT_MARKDOWN = 'markdown'
+export const FORMAT_HTML = 'html'
+
+/**
+ * What a format's `target` column is.
+ *
+ * `collection` is an Outline collection id, and the page already has a
+ * picker over those names — the same one Bot Settings uses for
+ * `document_target`. `prefix` is a key prefix in the object store, which
+ * has no directory to browse and is therefore typed.
+ */
+export type TargetKind = 'collection' | 'prefix'
+
+export interface FormatSpec {
+  name: string
+  /** What this format is called, under `common.*` rather than under this
+   *  page's own namespace. It is the one string two pages have to say —
+   *  the destinations page names it in a picker, and the recording page
+   *  names it beside a published document — and two copies of a word are
+   *  two words that drift. Everything else here is only ever rendered by
+   *  the destinations page and is keyed there. */
+  labelKey: string
+  /** One sentence saying what this format produces and where it lands. */
+  noteKey: string
+  targetKind: TargetKind
+  /** The label over the field that holds `target`. Every format calls it
+   *  something different, because it *is* something different: a
+   *  collection is a place in Outline, a prefix is part of an object key. */
+  targetLabelKey: string
+  targetHintKey: string
+  /** Whether this format's documents can be read back through the console.
+   *  True for the object-store family, whose bytes this deployment holds;
+   *  false for Outline, whose document lives in Outline. Mirrors
+   *  `routes_documents._is_readable`. */
+  readable: boolean
+}
+
+/**
+ * The three formats, in the registry's own order.
+ *
+ * A belief about the deployment and not a fact about it — see the note at
+ * the top of this module for why the console cannot have the fact, and why
+ * `pdf` and `confluence` are absent from here rather than present and
+ * inert.
+ */
+export const EXPORT_FORMATS: readonly FormatSpec[] = [
+  {
+    name: FORMAT_OUTLINE,
+    labelKey: 'common.formatOutline',
+    noteKey: 'admin.destinations.formatOutlineNote',
+    targetKind: 'collection',
+    targetLabelKey: 'admin.destinations.collectionLabel',
+    targetHintKey: 'admin.destinations.collectionHint',
+    readable: false,
+  },
+  {
+    name: FORMAT_MARKDOWN,
+    labelKey: 'common.formatMarkdown',
+    noteKey: 'admin.destinations.formatMarkdownNote',
+    targetKind: 'prefix',
+    targetLabelKey: 'admin.destinations.prefixLabel',
+    targetHintKey: 'admin.destinations.prefixHint',
+    readable: true,
+  },
+  {
+    name: FORMAT_HTML,
+    labelKey: 'common.formatHtml',
+    noteKey: 'admin.destinations.formatHtmlNote',
+    targetKind: 'prefix',
+    targetLabelKey: 'admin.destinations.prefixLabel',
+    targetHintKey: 'admin.destinations.prefixHint',
+    readable: true,
+  },
+] as const
+
+/** The spec for a format, or `null` for one this console does not know. */
+export function formatSpec(name: string): FormatSpec | null {
+  return EXPORT_FORMATS.find((entry) => entry.name === name) ?? null
+}
+
+/**
+ * An Outline collection id, and an object-store prefix.
+ *
+ * Both are the `target_pattern` of the matching entry in
+ * `sturnus.application.export_formats`, anchored the way Python's
+ * `fullmatch` anchors them. **A second copy of a rule the API enforces,
+ * and it is a courtesy rather than a control** — exactly what
+ * `navigation.ts` says about hiding an admin section. The API refuses a
+ * bad target whatever this file thinks; what this buys is that the reason
+ * is legible beside the field instead of arriving as a bare 400 that
+ * `apiError` has stripped of its explanation.
+ */
+const OUTLINE_TARGET = /^[^\s/][^\s]*$/
+const OBJECT_PREFIX = /^[A-Za-z0-9_-]+(?:[./][A-Za-z0-9_-]+)*$/
+
+/** Whether a format can address that target at all. Unknown formats accept
+ *  anything non-empty: this console has no pattern for a format it has
+ *  never heard of, and inventing one would refuse a target the deployment
+ *  is perfectly happy with. */
+export function acceptsTarget(format: string, target: string): boolean {
+  const spec = formatSpec(format)
+  if (spec === null) return target.trim() !== ''
+  return spec.targetKind === 'collection'
+    ? OUTLINE_TARGET.test(target)
+    : OBJECT_PREFIX.test(target)
+}
+
+/**
+ * The rows of the format dropdown.
+ *
+ * The three this console knows, plus — when a destination already stores a
+ * format that is not among them — that one, labelled with its own raw
+ * name. Never dropped: a picker that omitted the stored value would render
+ * as though `outline` were chosen and rewrite the destination to `outline`
+ * on the next save, which is `directory.ts`'s argument for keeping an
+ * unresolved id in the list, applied to a word instead of a snowflake.
+ *
+ * Takes a translator rather than returning keys, the way
+ * `recordingTabs(label)` does: a `UiOption.label` is text by contract, and
+ * the raw name of an unknown format is text that no key exists for.
+ */
+export function formatChoices(
+  label: (key: string) => string,
+  stored: string | null = null,
+): UiOption[] {
+  const options: UiOption[] = EXPORT_FORMATS.map((entry) => ({
+    value: entry.name,
+    label: label(entry.labelKey),
+    detail: label(entry.noteKey),
+  }))
+  const held = (stored ?? '').trim()
+  if (held !== '' && formatSpec(held) === null) {
+    options.push({
+      value: held,
+      label: held,
+      detail: label('admin.destinations.formatUnknownDetail'),
+    })
+  }
+  return options
+}
+
+/* -------------------------------------------------------------------- */
+/* Ordering, and which one Discord announces                             */
+/* -------------------------------------------------------------------- */
+
+/**
+ * The destinations in the order they publish: by id, oldest first.
+ *
+ * Not by name, and the difference is not cosmetic.
+ * `sturnus.application.exporting.destinations_for` sorts by id precisely
+ * so that the primary destination does not move when somebody renames one,
+ * and `session.document_url` — the link the Discord announcement carries —
+ * is stamped from the primary alone. A page that listed these
+ * alphabetically would show a reader a first row that is not the first
+ * destination, which is the one thing about this list that has a
+ * consequence outside the page.
+ */
+export function orderTargets(targets: readonly ExportTarget[]): ExportTarget[] {
+  return [...targets].sort((a, b) => a.id - b.id)
+}
+
+/**
+ * The destination whose document the Discord announcement links, or `null`
+ * when a guild has none.
+ *
+ * Enabled, and oldest, and nothing else. Deliberately **not** filtered
+ * against {@link EXPORT_FORMATS}: whether the deployment can publish a
+ * given format is the deployment's answer, and a console that skipped a
+ * row because it personally does not know the word `pdf` would name the
+ * wrong destination as the announced one on the very deployment where it
+ * matters.
+ */
+export function primaryTarget(targets: readonly ExportTarget[]): ExportTarget | null {
+  return orderTargets(targets).find((target) => target.enabled) ?? null
+}
+
+/** How many of these are switched on. */
+export function enabledTargetCount(targets: readonly ExportTarget[]): number {
+  return targets.reduce((total, target) => (target.enabled ? total + 1 : total), 0)
+}
+
+/**
+ * What the page says about `document_target` on Bot Settings, given what
+ * this guild has configured.
+ *
+ * Said **here**, on the page somebody configures destinations on, rather
+ * than only over on Bot Settings — because that is where the two settings
+ * look like rivals and where the answer is needed. And it is a function of
+ * the guild's state rather than one fixed sentence, because the fallback
+ * is genuinely in force for one of these guilds and genuinely dead for the
+ * other: `destinations_for` **replaces** the fallback with the configured
+ * destinations rather than joining them, so a guild that enables one
+ * destination here has silently stopped using `document_target` and should
+ * be told so on the screen where it happened.
+ */
+export function fallbackNote(targets: readonly ExportTarget[]): Message {
+  const enabled = enabledTargetCount(targets)
+  return enabled === 0
+    ? { key: 'admin.destinations.fallbackInUse' }
+    : { key: 'admin.destinations.fallbackReplaced', params: { count: enabled } }
+}
+
+/* -------------------------------------------------------------------- */
+/* One destination, said out loud                                        */
+/* -------------------------------------------------------------------- */
+
+/** The subtitle under a destination's name in the list: what it publishes
+ *  and where, with the format named in words where this console has a word
+ *  for it and by its raw name where it does not. */
+export function targetSummary(target: ExportTarget): Message {
+  const spec = formatSpec(target.format)
+  return {
+    key: spec === null
+      ? 'admin.destinations.rowUnknownFormat'
+      : 'admin.destinations.rowSummary',
+    params: { format: spec === null ? target.format : { key: spec.labelKey }, target: target.target },
+  }
+}
+
+/** Whether this destination is publishing, in words. Switched off is a
+ *  configured destination that is not being written to, which is a
+ *  different thing from one that does not exist — the API keeps disabled
+ *  rows for exactly that reason. */
+export function enabledLabelKey(target: ExportTarget): string {
+  return target.enabled ? 'admin.destinations.stateEnabled' : 'admin.destinations.stateDisabled'
+}
+
+/* -------------------------------------------------------------------- */
+/* The credential                                                        */
+/* -------------------------------------------------------------------- */
+
+/**
+ * What the secret control may do to a destination, and what it may say.
+ *
+ * The whole of the design is in what is *not* here. There is no `value`,
+ * no `masked`, no `reveal`: `PUT .../secret` is the only route that writes
+ * a credential and no route anywhere returns one, so a control that
+ * offered to show it would be offering something the API cannot serve.
+ *
+ * `canClear` is separate from `canReplace` because clearing is a separate
+ * act with a separate request body (`{"secret": null}`), and because the
+ * alternative — a password box rendered empty beside a configured
+ * credential, saved along with the rest of the form — silently wipes a
+ * token every time somebody corrects a typo in a name. `TargetDraft` has
+ * no secret field at all, so that failure is not merely avoided here, it
+ * is unrepresentable.
+ */
+export interface SecretState {
+  /** Whether a credential is stored. The only thing known about it. */
+  stored: boolean
+  statusKey: string
+  /** Storing the first one, or replacing the one that is there. */
+  actionKey: string
+  /** Only where there is something to clear. */
+  canClear: boolean
+}
+
+export function secretState(target: ExportTarget): SecretState {
+  return {
+    stored: target.hasSecret,
+    statusKey: target.hasSecret
+      ? 'admin.destinations.secretStored'
+      : 'admin.destinations.secretNone',
+    actionKey: target.hasSecret
+      ? 'admin.destinations.secretReplace'
+      : 'admin.destinations.secretSet',
+    canClear: target.hasSecret,
+  }
+}
+
+/**
+ * Whether a typed credential may be submitted.
+ *
+ * Empty is refused here as well as by the API, which answers 400 to `""` —
+ * and refusing it in the control is what stops "save an empty box" from
+ * looking like a way to clear one. Clearing has its own button, and it is
+ * the only way.
+ */
+export function canSubmitSecret(typed: string): boolean {
+  return typed !== ''
+}
+
+/* -------------------------------------------------------------------- */
+/* The form                                                              */
+/* -------------------------------------------------------------------- */
+
+/**
+ * What the destination form edits.
+ *
+ * Four fields, and the absence of a fifth is the point — see
+ * {@link SecretState}. `config` is not here either: none of the three
+ * formats needs anything in it, and a JSON box on a page nobody has a
+ * reason to type JSON into is a way to break a destination rather than a
+ * way to configure one. The page carries the stored `config` through
+ * unedited.
+ */
+export interface TargetDraft {
+  format: string
+  name: string
+  target: string
+  enabled: boolean
+}
+
+/** A blank destination, ready to be added. Outline first because it is
+ *  what every guild configured before this page existed, and enabled
+ *  because somebody adding a destination is adding one to publish to. */
+export function emptyDraft(): TargetDraft {
+  return { format: FORMAT_OUTLINE, name: '', target: '', enabled: true }
+}
+
+/** An existing destination, ready to be edited. */
+export function draftOf(target: ExportTarget): TargetDraft {
+  return {
+    format: target.format,
+    name: target.name,
+    target: target.target,
+    enabled: target.enabled,
+  }
+}
+
+/** Which field a complaint is about, so the page can put it beside that
+ *  field rather than in a list of grievances at the bottom. */
+export type DraftField = 'name' | 'format' | 'target'
+
+export interface DraftProblem {
+  field: DraftField
+  message: Message
+}
+
+/**
+ * What is wrong with a draft, in the order the fields are read.
+ *
+ * Every rule here is one `routes_exports._requested_target` already
+ * enforces, plus the name collision `create_target` refuses with a 409.
+ * Restating them is deliberate and is the courtesy argued for above
+ * {@link acceptsTarget}: `apiError` keeps nothing of a refusal but its
+ * status, so a check that only the API makes is a check whose reason the
+ * reader never sees.
+ *
+ * `taken` is the names this guild already uses. On an edit it excludes the
+ * destination's own name — the API reads the name from the stored row on a
+ * `PUT` and ignores whatever the body says, so a rename is a create plus a
+ * delete rather than an edit, and complaining that a destination collides
+ * with itself would refuse a save that changes something else.
+ */
+export function draftProblems(
+  draft: TargetDraft,
+  taken: readonly string[] = [],
+): DraftProblem[] {
+  const problems: DraftProblem[] = []
+  const name = draft.name.trim()
+
+  if (name === '') {
+    problems.push({ field: 'name', message: { key: 'admin.destinations.nameEmpty' } })
+  } else if (taken.some((held) => held.trim() === name)) {
+    problems.push({ field: 'name', message: { key: 'admin.destinations.nameTaken' } })
+  }
+
+  if (draft.format.trim() === '') {
+    problems.push({ field: 'format', message: { key: 'admin.destinations.formatEmpty' } })
+  }
+
+  if (draft.target.trim() === '') {
+    problems.push({ field: 'target', message: { key: 'admin.destinations.targetEmpty' } })
+  } else if (!acceptsTarget(draft.format, draft.target)) {
+    const spec = formatSpec(draft.format)
+    problems.push({
+      field: 'target',
+      message: {
+        key: spec?.targetKind === 'prefix'
+          ? 'admin.destinations.targetNotPrefix'
+          : 'admin.destinations.targetNotCollection',
+      },
+    })
+  }
+
+  return problems
+}
+
+/** The complaint about one field, or `null`. */
+export function problemFor(
+  problems: readonly DraftProblem[],
+  field: DraftField,
+): Message | null {
+  return problems.find((problem) => problem.field === field)?.message ?? null
+}
+
+/** Whether a draft may be submitted at all. */
+export function isDraftReady(draft: TargetDraft, taken: readonly string[] = []): boolean {
+  return draftProblems(draft, taken).length === 0
+}
+
+/** The body a create or an update sends. Trimmed the way the API trims,
+ *  and carrying the stored `config` through untouched. */
+export function draftBody(
+  draft: TargetDraft,
+  config: Record<string, unknown> = {},
+): Record<string, unknown> {
+  return {
+    format: draft.format.trim(),
+    name: draft.name.trim(),
+    target: draft.target.trim(),
+    config,
+    enabled: draft.enabled,
+  }
+}
+
+/** The names a guild already uses, optionally excluding one destination —
+ *  the one being edited. */
+export function takenNames(
+  targets: readonly ExportTarget[],
+  except: number | null = null,
+): string[] {
+  return targets.filter((target) => target.id !== except).map((target) => target.name)
+}
+
+/* -------------------------------------------------------------------- */
+/* Where the requests go                                                 */
+/* -------------------------------------------------------------------- */
+
+export function targetsPath(guildId: string): string {
+  return `/guilds/${encodeURIComponent(guildId)}/export-targets`
+}
+
+export function targetPath(guildId: string, targetId: number): string {
+  return `${targetsPath(guildId)}/${targetId}`
+}
+
+export function targetSecretPath(guildId: string, targetId: number): string {
+  return `${targetPath(guildId, targetId)}/secret`
+}
+
+/* -------------------------------------------------------------------- */
+/* When a write does not work                                            */
+/* -------------------------------------------------------------------- */
+
+/**
+ * Why a write failed, from its status and nothing else.
+ *
+ * The status is all there is: `apiError.sanitiseFetchError` keeps nothing
+ * from a failed response but that, on purpose, so that no page can
+ * accidentally render an internal hostname out of a `$fetch` error. It is
+ * enough for every refusal these routes have, because each status means
+ * exactly one thing here — including the 400, which after
+ * {@link draftProblems} has passed can only mean that this console's list
+ * of formats and the deployment's registry disagree.
+ */
+export function describeTargetError(error: unknown): Message {
+  const held = (error as { status?: unknown } | null)?.status
+  const status = typeof held === 'number' ? held : null
+  switch (status) {
+    case 400:
+      return { key: 'admin.destinations.errorRefused' }
+    case 401:
+      return { key: 'admin.destinations.errorSession' }
+    case 404:
+      return { key: 'admin.destinations.errorGone' }
+    case 409:
+      return { key: 'admin.destinations.errorDuplicate' }
+    case 0:
+    case null:
+      return { key: 'admin.destinations.errorUnreachable' }
+    default:
+      return { key: 'admin.destinations.errorStatus', params: { status: String(status) } }
+  }
+}
diff --git a/console/app/utils/navigation.ts b/console/app/utils/navigation.ts
index 815c30e..5c208ff 100644
--- a/console/app/utils/navigation.ts
+++ b/console/app/utils/navigation.ts
@@ -93,6 +93,17 @@ export const ADMIN_VIEW: NavSection = {
       icon: 'M12 8a4 4 0 1 0 0 8 4 4 0 0 0 0-8Zm9.4 4a7.4 7.4 0 0 0-.1-1.2l2-1.6-2-3.4-2.4 1a7.6 7.6 0 0 0-2-1.2L16.5 3h-4l-.4 2.6c-.7.3-1.4.7-2 1.2l-2.4-1-2 3.4 2 1.6a7.4 7.4 0 0 0 0 2.4l-2 1.6 2 3.4 2.4-1c.6.5 1.3.9 2 1.2l.4 2.6h4l.4-2.6c.7-.3 1.4-.7 2-1.2l2.4 1 2-3.4-2-1.6c.1-.4.1-.8.1-1.2Z',
       adminOnly: true,
     },
+    {
+      to: '/admin/destinations',
+      labelKey: 'nav.destinations',
+      // One node branching into three: a protocol leaving for several
+      // places at once, which is the whole of what this page configures.
+      // Deliberately not a document glyph — the recordings entry above is
+      // already about documents, and this page is about *where they go*
+      // rather than about what is in them.
+      icon: 'M18 16.08a2.9 2.9 0 0 0-1.96.77L8.91 12.7c.06-.23.09-.46.09-.7s-.03-.47-.09-.7l7.05-4.11c.54.5 1.25.81 2.04.81a3 3 0 1 0-3-3c0 .24.04.47.09.7L8.04 9.81A2.98 2.98 0 0 0 6 9a3 3 0 0 0 0 6c.79 0 1.5-.31 2.04-.81l7.12 4.16c-.05.21-.08.43-.08.65a2.92 2.92 0 1 0 2.92-2.92Z',
+      adminOnly: true,
+    },
     {
       // Renamed from `/admin/user-settings`, which read as "settings for
       // users" and is in fact a roster of other people's consent. The old
diff --git a/console/app/utils/sessionDocuments.ts b/console/app/utils/sessionDocuments.ts
new file mode 100644
index 0000000..a4a35ad
--- /dev/null
+++ b/console/app/utils/sessionDocuments.ts
@@ -0,0 +1,256 @@
+/**
+ * What one meeting was actually published as, and where.
+ *
+ * A session used to have *a* protocol: `session.document_url`, one Outline
+ * document, one link on the recording page. Since #144 a guild may name
+ * several destinations, and `sturnus.application.exporting.publish_session`
+ * writes to each of them independently — **surviving each destination's own
+ * failure and recording only the ones that succeeded**. So a meeting can
+ * now be published to two places out of three, and the recording page has
+ * to be able to say that rather than showing one link and implying it is
+ * the whole story.
+ *
+ * **The partial publish is legible, and this module is where it is read.**
+ * A participant cannot see how many destinations their guild configured —
+ * that listing is administrator-only and answers 404 to them — so this
+ * page can never say "one of three failed". What it *can* see is a
+ * disagreement between two answers it is given, and one of them is exact:
+ *
+ * - `session.document_url` is stamped **from the primary destination
+ *   alone** (`worker._publish_session_documents`), and the primary is the
+ *   guild's oldest enabled destination. It is also the link the Discord
+ *   announcement carries.
+ * - `GET /api/sessions/{id}/documents` lists every destination that
+ *   produced a document, the primary included.
+ *
+ * So a session with documents and **no** `document_url` is a session whose
+ * announced destination did not produce one while others did. That is the
+ * partial failure, it is a fact rather than an inference, and
+ * {@link publishedProtocols} names it. The reverse — a `document_url` that
+ * is not among the listed documents — is the legacy `document_target`
+ * publish, which writes no `session_document` row at all, and is the state
+ * of every meeting recorded before this table existed.
+ *
+ * **Nothing here diagnoses.** The states below say which of two answers
+ * disagree and stop; they never say a destination is broken, because a
+ * destination that has not been retried yet and one that will never work
+ * look identical from here and the retry sweep is still running. That is
+ * the same discipline `~/utils/queue` applies to its derived figures.
+ *
+ * Keys and {@link Message}s, never prose — see `i18n/README.md`.
+ */
+import { formatSpec } from './exportTargets'
+import type { Instant, Message } from './message'
+
+/* -------------------------------------------------------------------- */
+/* What the API sends                                                    */
+/* -------------------------------------------------------------------- */
+
+/** One published protocol, as `routes_documents.document_json` sends it. */
+export interface SessionDocument {
+  /** `null` for a document whose destination has since been removed. The
+   *  row survives that on purpose: the document still exists in the other
+   *  system and this link is what somebody follows when they go looking
+   *  for last quarter's minutes. */
+  targetId: number | null
+  /** The format name — `outline`, `markdown`, `html`. A plain string,
+   *  because a deployment may publish a format this console has never
+   *  heard of and a document that renders as nothing is worse than one
+   *  that renders as its own raw name. */
+  provider: string
+  url: string
+  createdAt: string | null
+  /** Whether this deployment holds the bytes and can serve them back.
+   *  False for an Outline document, whose `url` points at Outline. */
+  readable: boolean
+  mediaType: string | null
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function asText(value: unknown): string | null {
+  if (value === null || value === undefined) return null
+  return typeof value === 'string' ? value : String(value)
+}
+
+/**
+ * The documents in a listing, oldest first, dropping any that carries no
+ * URL.
+ *
+ * A row with no URL is a row with nothing to click, and this list exists
+ * to be clicked: the console cannot serve an Outline document itself and
+ * cannot address an object-store one except through the URL the worker
+ * recorded. Everything else is tolerated — a provider this console has no
+ * word for renders as its own name, and an unreadable `created_at` renders
+ * as no date rather than taking the row down with it.
+ */
+export function parseSessionDocuments(payload: unknown): SessionDocument[] {
+  if (!isRecord(payload) || !Array.isArray(payload.documents)) return []
+  const documents: SessionDocument[] = []
+  for (const raw of payload.documents) {
+    if (!isRecord(raw)) continue
+    const url = asText(raw.url)
+    if (!url || url.trim() === '') continue
+    const targetId = Number(raw.target_id)
+    documents.push({
+      targetId: Number.isSafeInteger(targetId) && raw.target_id !== null ? targetId : null,
+      provider: asText(raw.provider) ?? '',
+      url,
+      createdAt: asText(raw.created_at),
+      readable: raw.readable === true,
+      mediaType: asText(raw.media_type),
+    })
+  }
+  return documents
+}
+
+/* -------------------------------------------------------------------- */
+/* One row of the list                                                   */
+/* -------------------------------------------------------------------- */
+
+export interface ProtocolRow {
+  /** Stable and unique within the list, for `v-for`. Built from the
+   *  destination where there is one and from the URL where there is not:
+   *  every document whose destination has been removed carries a `null`
+   *  `target_id`, and a guild that removed two of them would otherwise
+   *  have two rows keyed alike. */
+  id: string
+  /** What the document is, in words this console has — or its raw
+   *  provider name, where it has none. */
+  label: Message
+  url: string
+  /** When it was published, or `null` when the API sent a date this
+   *  console could not read. */
+  at: Instant | null
+  /** True where this deployment serves the bytes itself, so the link stays
+   *  inside the console and under the session's own authorisation rule.
+   *  False where the link leaves for Outline. */
+  internal: boolean
+  /** The destination this was published to has been removed. The document
+   *  is still there and the link still works; nothing new will be
+   *  published here. */
+  orphaned: boolean
+}
+
+/** One document, ready to render. */
+export function protocolRow(document: SessionDocument): ProtocolRow {
+  const spec = formatSpec(document.provider)
+  const at = document.createdAt === null ? null : new Date(document.createdAt)
+  return {
+    id: document.targetId === null ? `url:${document.url}` : `target:${document.targetId}`,
+    label: spec === null
+      ? { key: 'recordings.protocolUnknownFormat', params: { format: document.provider } }
+      : { key: 'recordings.protocolFormat', params: { format: { key: spec.labelKey } } },
+    url: document.url,
+    at: at !== null && !Number.isNaN(at.getTime()) ? { at, format: 'utcMoment' } : null,
+    internal: document.readable,
+    orphaned: document.targetId === null,
+  }
+}
+
+/* -------------------------------------------------------------------- */
+/* What the section as a whole says                                      */
+/* -------------------------------------------------------------------- */
+
+/**
+ * How the two answers stand relative to each other.
+ *
+ * - `none` — nothing was published, and nothing claims to have been.
+ * - `announcedOnly` — a protocol link exists and no destination recorded
+ *   one. The legacy `document_target` publish, which writes no
+ *   `session_document` row: every meeting from before destinations
+ *   existed is this.
+ * - `complete` — the announced link is among the destinations listed.
+ * - `announcedElsewhere` — destinations produced documents and the
+ *   announced link is not one of them.
+ * - `announcedMissing` — destinations produced documents and **nothing was
+ *   announced**. The partial publish: the destination whose link Discord
+ *   carries did not produce one, and these did.
+ */
+export type PublishState =
+  | 'none'
+  | 'announcedOnly'
+  | 'complete'
+  | 'announcedElsewhere'
+  | 'announcedMissing'
+
+export interface ProtocolsView {
+  state: PublishState
+  rows: ProtocolRow[]
+  /** `session.document_url`, trimmed, or `null`. Rendered on its own only
+   *  in `announcedOnly`, where there is no row carrying it. */
+  announced: string | null
+  /** The heading's sentence: how many destinations hold this meeting. */
+  summary: Message
+  /** What is worth saying beyond the count, or `null` when the two answers
+   *  agree and there is nothing to explain. */
+  note: Message | null
+}
+
+/**
+ * What this session's protocols are, as a section of the recording page.
+ *
+ * Takes the announced URL rather than the whole session, so that this can
+ * be asked without a session at all — the property being decided is a
+ * relation between two strings and a list, and nothing about it needs a
+ * ninety-minute meeting to stand next to it.
+ */
+export function publishedProtocols(
+  announcedUrl: string | null | undefined,
+  documents: readonly SessionDocument[],
+): ProtocolsView {
+  const announced = (announcedUrl ?? '').trim() === '' ? null : (announcedUrl ?? '').trim()
+  const rows = documents.map(protocolRow)
+  const count = rows.length
+
+  if (count === 0) {
+    return announced === null
+      ? {
+          state: 'none',
+          rows,
+          announced,
+          summary: { key: 'recordings.noProtocolWritten' },
+          note: null,
+        }
+      : {
+          state: 'announcedOnly',
+          rows,
+          announced,
+          summary: { key: 'recordings.protocolsAnnouncedOnly' },
+          note: { key: 'recordings.protocolsAnnouncedOnlyNote' },
+        }
+  }
+
+  if (announced === null) {
+    return {
+      state: 'announcedMissing',
+      rows,
+      announced,
+      summary: { key: 'recordings.protocolsCount', params: { count } },
+      note: { key: 'recordings.protocolsAnnouncedMissing', params: { count } },
+    }
+  }
+
+  const carries = rows.some((row) => row.url === announced)
+  return {
+    state: carries ? 'complete' : 'announcedElsewhere',
+    rows,
+    announced,
+    summary: { key: 'recordings.protocolsCount', params: { count } },
+    note: carries ? null : { key: 'recordings.protocolsAnnouncedElsewhere' },
+  }
+}
+
+/** Whether the section has anything at all to show. A meeting still being
+ *  transcribed has not published anywhere yet, and that is an ordinary
+ *  state rather than a failure. */
+export function hasPublished(view: ProtocolsView): boolean {
+  return view.state !== 'none'
+}
+
+/** Where the listing lives. */
+export function sessionDocumentsPath(sessionId: string): string {
+  return `/sessions/${encodeURIComponent(sessionId)}/documents`
+}
diff --git a/console/app/utils/settings.ts b/console/app/utils/settings.ts
index c51512c..30194c7 100644
--- a/console/app/utils/settings.ts
+++ b/console/app/utils/settings.ts
@@ -421,9 +421,37 @@ export function summariseValue(value: string, limit = 120): string {
   return flat.length <= limit ? flat : `${flat.slice(0, limit)}…`
 }
 
+/**
+ * Keys whose meaning changed when something else in the console arrived,
+ * and the sentence that says so.
+ *
+ * One entry so far. `document_target` looked like *the* answer to "where
+ * do this server's protocols go" and is now the **fallback** for a guild
+ * that has configured no destination of its own: `destinations_for`
+ * replaces it with the configured ones rather than joining them. A reader
+ * of this field who has not seen `/admin/destinations` would otherwise set
+ * a collection here and watch nothing publish into it. The Destinations
+ * page says the same thing from its own side, and states which of the two
+ * is in force for the guild being looked at — which this cannot, because a
+ * hint under a settings key knows nothing about that guild's destinations.
+ *
+ * English, like the rest of this module's hints, and for the same stated
+ * reason: this page is awaiting the sweep that translates all four admin
+ * pages together. It goes through `$t` the day that lands.
+ */
+const KEY_NOTES: Record<string, string> = {
+  document_target:
+    'Used only while this server has no destination switched on under Destinations — '
+    + 'a destination there replaces this setting rather than adding to it.',
+}
+
 /** The notes under a field: what is enforced, and what it falls back to. */
 export function fieldHints(view: SettingView): string[] {
   const hints: string[] = []
+  const note = KEY_NOTES[view.key]
+  if (note !== undefined) {
+    hints.push(note)
+  }
   if (view.required) {
     hints.push('Required — there is no default, so it must always have a value.')
   }
diff --git a/console/i18n/README.md b/console/i18n/README.md
index f5030a2..8f66390 100644
--- a/console/i18n/README.md
+++ b/console/i18n/README.md
@@ -45,6 +45,7 @@ matches the file that renders it:
 | `calendar.*`       | `pages/calendar.vue`, the heatmap and the timeline   |
 | `settings.*`       | `pages/settings.vue` — a person's own settings        |
 | `admin.settings.*` | `pages/admin/bot-settings.vue`                        |
+| `admin.destinations.*` | `pages/admin/destinations.vue`, `utils/exportTargets.ts`, the two `ExportTarget*` components |
 | `admin.consents.*` | `pages/admin/consents.vue`                            |
 | `admin.queue.*`    | `pages/admin/queue.vue`                               |
 | `admin.reporting.*`| `pages/admin/reporting.vue`                           |
@@ -76,6 +77,14 @@ scope on a roster row — so that the sweep has less to do rather than more.
 New strings on that page go through `$t` from now on; the existing ones move
 when the sweep reaches them.
 
+`admin.destinations.*` is the one administrative namespace that is complete
+from the start, because the page under it is new: nothing on
+`/admin/destinations` was ever hard-coded English, so there is nothing there
+for the sweep to reach. Three of its strings are not in it — a format's
+name (`common.formatOutline` and its two neighbours) lives in `common.*`,
+because the recording page has to say the same three words beside a
+published document and two copies of a word are two words that drift.
+
 `ui.*` is the one namespace that does not name a page. It serves
 `app/components/ui/*` — the six shared controls every page is about to be
 built out of — and the gallery at `/dev/ui` that renders them. They are keyed
diff --git a/console/i18n/locales/de.json b/console/i18n/locales/de.json
index d07eb85..e63c72c 100644
--- a/console/i18n/locales/de.json
+++ b/console/i18n/locales/de.json
@@ -7,7 +7,10 @@
     "durationMinutes": "{count} Min.",
     "durationHours": "{count} Std.",
     "durationHoursMinutes": "{hours} Std. {minutes} Min.",
-    "durationMinutesSeconds": "{minutes} Min. {seconds} Sek."
+    "durationMinutesSeconds": "{minutes} Min. {seconds} Sek.",
+    "formatOutline": "Outline-Dokument",
+    "formatMarkdown": "Markdown-Datei",
+    "formatHtml": "HTML-Seite"
   },
   "nav": {
     "sections": "Bereiche",
@@ -20,7 +23,8 @@
     "botSettings": "Bot-Einstellungen",
     "queue": "Warteschlange",
     "reporting": "Auswertung",
-    "consents": "Einwilligungen"
+    "consents": "Einwilligungen",
+    "destinations": "Ziele"
   },
   "auth": {
     "signIn": "Anmelden",
@@ -362,7 +366,17 @@
     "nameSaveUnreachable": "Das konnte nicht gespeichert werden: Die Konsole hat den Server nicht erreicht.",
     "nameSaveGone": "Diese Aufnahme lässt sich nicht mehr benennen.",
     "nameSaveRefused": "Der Server hat diesen Text abgelehnt. Ein Titel muss auf eine Zeile passen, und keines der beiden Felder darf unsichtbare Steuerzeichen enthalten.",
-    "nameSaveFailed": "Das konnte nicht gespeichert werden. Es wurde nichts geändert."
+    "nameSaveFailed": "Das konnte nicht gespeichert werden. Es wurde nichts geändert.",
+    "protocolsHeading": "Wohin diese Besprechung veröffentlicht wurde",
+    "protocolsCount": "An ein Ziel veröffentlicht. | An {count} Ziele veröffentlicht.",
+    "protocolsAnnouncedOnly": "An ein Ziel veröffentlicht.",
+    "protocolsAnnouncedOnlyNote": "Sturnus hat neben diesem Link kein Ziel vermerkt — entweder liegt die Besprechung vor den eigenen Zielen dieses Servers, oder sie wurde über die eine Outline-Sammlung aus den Bot-Einstellungen veröffentlicht. Es gibt einen Link und sonst nichts aufzuzählen.",
+    "protocolsAnnouncedMissing": "Sturnus kündigt je Besprechung einen Protokoll-Link in Discord an; für diese wurde keiner angekündigt, während das Ziel unten sehr wohl ein Dokument erzeugt hat. | Sturnus kündigt je Besprechung einen Protokoll-Link in Discord an; für diese wurde keiner angekündigt, während die {count} Ziele unten sehr wohl ein Dokument erzeugt haben.",
+    "protocolsAnnouncedElsewhere": "Der in Discord angekündigte Link gehört zu keinem der Ziele unten.",
+    "protocolFormat": "Als {format}",
+    "protocolUnknownFormat": "Als {format} — ein Format, das diese Konsole nicht kennt",
+    "protocolOrphaned": "Das Ziel, an das hier veröffentlicht wurde, ist inzwischen entfernt worden. Das Dokument existiert weiter und dieser Link funktioniert weiter; neu veröffentlicht wird hier nichts mehr.",
+    "protocolsFailed": "Wohin diese Besprechung veröffentlicht wurde, konnte nicht gelesen werden. Was oben bereits verlinkt ist, bleibt davon unberührt."
   },
   "calendar": {
     "loadingYear": "Kalender für {year} wird geladen.",
@@ -579,6 +593,98 @@
       "groupOther": "Alles Weitere",
       "groupNeedsAttention": "{group} · {count} fehlt | {group} · {count} fehlen",
       "groupOtherNote": "Diese Schlüssel gehören zu keiner der Gruppen oben: sie sind zur API hinzugekommen, nachdem diese Gruppen entstanden sind, und diese Seite zeigt lieber einen Schlüssel ohne Gruppe, als ihn stillschweigend wegzulassen. Sonst unterscheidet sie nichts — setzen, leeren und wirksam werden funktionieren wie bei jedem anderen Schlüssel hier."
+    },
+    "destinations": {
+      "title": "Ziele",
+      "intro": "Wohin dieser Server seine Protokolle veröffentlicht. Eine Besprechung kann an mehrere Ziele in mehreren Formaten gehen; jedes wird für sich geschrieben, ein nicht erreichbares Ziel nimmt die anderen also nicht mit.",
+      "whichServer": "Welcher Server",
+      "noGuildsHeading": "Hier gibt es noch nichts",
+      "noGuildsBody": "Diese Seite legt fest, wohin ein Discord-Server seine Protokolle veröffentlicht, und steht den Administratoren eines Servers offen, auf dem Sturnus läuft. Derzeit wird keiner davon von diesem Konto administriert.",
+      "noGuildsRole": "Administratoren sind die Mitglieder mit der Discord-Rolle, die der Server in seiner Einstellung {setting} nennt. Wer sie schon hat, kann sie weitergeben — Sturnus spiegelt die Mitgliedschaft aus Discord, die Änderung erreicht diese Konsole also von selbst.",
+      "loading": "Die Ziele dieses Servers werden gelesen…",
+      "loadFailed": "Die Ziele dieses Servers konnten nicht gelesen werden.",
+      "serversFailed": "Die von diesem Konto administrierten Server konnten nicht gelesen werden, es gibt also noch nichts zu konfigurieren.",
+      "listLabel": "Ziele dieses Servers",
+      "pagerLabel": "Seiten der Ziele",
+      "emptyHeading": "Dieser Server hat kein eigenes Ziel",
+      "emptyNote": "Hier ist nichts kaputt. Ein Ziel muss angelegt werden, und bis dahin veröffentlicht dieser Server weiter dorthin, wohin die Bot-Einstellungen zeigen.",
+      "add": "Ziel hinzufügen",
+      "addHeading": "Ein neues Ziel",
+      "editHeading": "Dieses Ziel ändern",
+      "nameLabel": "Name",
+      "nameHint": "Wie dieses Ziel hier heißt. Der Name wird nirgends veröffentlicht; er unterscheidet zwei Ziele auf dieser Seite.",
+      "nameLockedNote": "Ein Name lässt sich hier nicht ändern. Sturnus spricht ein gespeichertes Ziel über seinen Namen an — umbenennen heißt also, ein Ziel anzulegen und dieses zu entfernen, wofür die beiden Aktionen unten da sind.",
+      "formatLabel": "Format",
+      "formatHint": "Was geschrieben wird und was es forttransportiert. Das Format entscheidet beides: Ein Outline-Dokument und eine Markdown-Datei sind nicht derselbe Text mit anderer Endung.",
+      "formatOutlineNote": "Wird in einer Sammlung in Outline angelegt",
+      "formatMarkdownNote": "Von Sturnus gespeichert, über diese Konsole lesbar",
+      "formatHtmlNote": "Von Sturnus gespeichert, über diese Konsole lesbar",
+      "formatUnknownDetail": "Hier konfiguriert, und kein Format, das diese Konsole kennt",
+      "formatsNote": "Das sind die Formate, die diese Installation veröffentlicht. PDF und Confluence sind spezifiziert und nicht gebaut, deshalb stehen sie hier gar nicht erst zur Wahl, statt zur Wahl zu stehen und dann abgelehnt zu werden — eine Wahlmöglichkeit, die das Speichern zurückweist, nimmt auch denen daneben die Glaubwürdigkeit.",
+      "collectionLabel": "Outline-Sammlung",
+      "collectionHint": "Die Sammlung, in der jedes Protokoll angelegt wird. Dieselbe Liste, die die Bot-Einstellungen für ihr eigenes document_target anbieten.",
+      "collectionsUnavailable": "Die Outline-Sammlungen konnten nicht gelesen werden, deshalb wird hier nach einer Sammlungs-ID gefragt.",
+      "collectionChoose": "Sammlung wählen",
+      "collectionManual": "Sammlungs-ID von Hand eingeben",
+      "collectionBackToPicker": "Stattdessen aus der Liste wählen",
+      "unresolvedCollection": "Zu dieser ID gibt es keine Sammlung in der Kopie, die Sturnus von Outline hält. Vielleicht wurde sie dort gelöscht, vielleicht ist die Kopie noch nicht nachgezogen — so oder so ist dieses Ziel damit konfiguriert.",
+      "prefixLabel": "Schlüsselpräfix",
+      "prefixHint": "Wo im eigenen Speicher von Sturnus die Datei angelegt wird. Buchstaben, Ziffern, Punkt, Bindestrich, Unterstrich und / dazwischen; Besprechung und Ziel werden angehängt.",
+      "enabledLabel": "An dieses Ziel veröffentlichen",
+      "enabledHint": "Ein Ziel abzuschalten heißt nicht, seine Konfiguration zu vergessen. Es bleibt stehen, und es wird nichts mehr dorthin veröffentlicht.",
+      "stateEnabled": "Veröffentlicht",
+      "stateDisabled": "Abgeschaltet",
+      "rowSummary": "{format}, nach {target}",
+      "rowUnknownFormat": "{format}, nach {target} — ein Format, das diese Konsole nicht kennt. Ob es veröffentlicht werden kann, beantwortet diese Installation selbst.",
+      "primaryBadge": "In Discord angekündigt",
+      "primaryNote": "Eingeschaltete Ziele werden der Reihe nach beschrieben, das älteste zuerst, und der Link, den Sturnus in Discord postet, ist der des ersten. Er wandert nicht, wenn ein Ziel umbenannt wird.",
+      "save": "Speichern",
+      "saving": "Wird gespeichert…",
+      "cancel": "Abbrechen",
+      "edit": "Ändern",
+      "delete": "Entfernen",
+      "deleteConfirmHeading": "Dieses Ziel entfernen?",
+      "deleteConfirmBody": "Nichts bereits Veröffentlichtes wird gelöscht. Jedes hier geschriebene Protokoll bleibt, wo es ist, und sein Link funktioniert weiter; Sturnus veröffentlicht nur nichts mehr dorthin.",
+      "deleteConfirm": "Ja, entfernen",
+      "enable": "Einschalten",
+      "disable": "Abschalten",
+      "savedCreated": "Hinzugefügt.",
+      "savedUpdated": "Gespeichert.",
+      "savedDeleted": "Entfernt.",
+      "savedEnabled": "Eingeschaltet.",
+      "savedDisabled": "Abgeschaltet.",
+      "secretHeading": "Zugangsdaten",
+      "secretStored": "Für dieses Ziel sind Zugangsdaten gespeichert.",
+      "secretNone": "Es sind keine Zugangsdaten gespeichert.",
+      "secretSet": "Zugangsdaten speichern",
+      "secretReplace": "Zugangsdaten ersetzen",
+      "secretNeverShown": "Sturnus zeigt gespeicherte Zugangsdaten nirgends an, hier ebenso wenig: Keine Route gibt sie zurück. Ersetzen und Löschen sind das Einzige, was damit möglich ist, und beides hat eine eigene Schaltfläche — ein leeres Feld neben gespeicherten Zugangsdaten ist der Weg, auf dem sie beim Korrigieren eines Tippfehlers verschwinden.",
+      "secretUnused": "Keines der Formate oben liest bisher gespeicherte Zugangsdaten: Outline wird mit dem Outline-Token dieser Installation veröffentlicht, und die beiden Dateiformate werden in deren eigenen Speicher geschrieben. Was hier hinterlegt wird, bleibt für die Ziele aufgehoben, die es lesen werden.",
+      "secretInputLabel": "Neue Zugangsdaten",
+      "secretSave": "Hinterlegen",
+      "secretSaving": "Wird hinterlegt…",
+      "secretClear": "Gespeicherte Zugangsdaten löschen",
+      "secretClearConfirmHeading": "Diese Zugangsdaten löschen?",
+      "secretClearConfirmBody": "Danach sind sie nicht wiederherstellbar — Sturnus hält keine Kopie, die irgendetwas zurücklesen könnte. An dieses Ziel wird weiter ohne Zugangsdaten veröffentlicht, bis neue hinterlegt werden.",
+      "secretClearConfirm": "Ja, löschen",
+      "secretSaved": "Hinterlegt.",
+      "secretCleared": "Gelöscht.",
+      "nameEmpty": "Ein Ziel braucht einen Namen.",
+      "nameTaken": "Dieser Server hat bereits ein Ziel mit diesem Namen.",
+      "formatEmpty": "Ein Format wählen.",
+      "targetEmpty": "Ein Ziel braucht einen Ort, an den es schreibt.",
+      "targetNotCollection": "Eine Outline-Sammlungs-ID: ohne Leerzeichen darin und ohne Schrägstrich davor.",
+      "targetNotPrefix": "Buchstaben, Ziffern, Punkt, Bindestrich und Unterstrich, getrennt durch / — kein Schrägstrich davor, keiner dahinter und kein „..“.",
+      "errorRefused": "Sturnus hat dieses Ziel zurückgewiesen. Diese Konsole bietet die Formate an, von denen sie annimmt, dass diese Installation sie baut; eine Zurückweisung heißt also, dass deren eigene Liste davon abweicht.",
+      "errorSession": "Die Sitzung ist abgelaufen. Erneut anmelden und noch einmal versuchen — es wurde nichts geschrieben.",
+      "errorGone": "Sturnus kennt diesen Server oder dieses Ziel nicht mehr, oder dieses Konto administriert ihn nicht mehr — die Antwort ist auf alle drei dieselbe. Seite neu laden.",
+      "errorDuplicate": "Dieser Server hat bereits ein Ziel mit diesem Namen.",
+      "errorUnreachable": "Die API war nicht erreichbar. Es wurde nichts geschrieben; Verbindung prüfen und noch einmal versuchen.",
+      "errorStatus": "Sturnus hat mit {status} geantwortet und keinen Grund genannt. Was dabei geschrieben wurde, falls überhaupt etwas, ist nicht bekannt.",
+      "fallbackHeading": "Und die Einstellung, die dadurch ersetzt wird",
+      "fallbackInUse": "Hier ist kein Ziel eingeschaltet, deshalb veröffentlicht dieser Server weiterhin dorthin, wohin document_target in den Bot-Einstellungen zeigt: ein Outline-Dokument je Besprechung. Ein hier eingeschaltetes Ziel übernimmt das vollständig.",
+      "fallbackReplaced": "Dieser Server veröffentlicht an das eine Ziel oben, und document_target in den Bot-Einstellungen wird dafür nicht mehr benutzt — die Ziele hier ersetzen jene Einstellung, statt sie zu ergänzen. | Dieser Server veröffentlicht an die {count} Ziele oben, und document_target in den Bot-Einstellungen wird dafür nicht mehr benutzt — die Ziele hier ersetzen jene Einstellung, statt sie zu ergänzen.",
+      "fallbackLink": "Bot-Einstellungen öffnen"
     }
   },
   "ui": {
diff --git a/console/i18n/locales/en.json b/console/i18n/locales/en.json
index c6aca18..1126f7f 100644
--- a/console/i18n/locales/en.json
+++ b/console/i18n/locales/en.json
@@ -7,7 +7,10 @@
     "durationMinutes": "{count} min",
     "durationHours": "{count} h",
     "durationHoursMinutes": "{hours} h {minutes} min",
-    "durationMinutesSeconds": "{minutes} min {seconds} s"
+    "durationMinutesSeconds": "{minutes} min {seconds} s",
+    "formatOutline": "Outline document",
+    "formatMarkdown": "Markdown file",
+    "formatHtml": "HTML page"
   },
   "nav": {
     "sections": "Sections",
@@ -20,7 +23,8 @@
     "botSettings": "Bot Settings",
     "queue": "Queue",
     "reporting": "Reporting",
-    "consents": "Consents"
+    "consents": "Consents",
+    "destinations": "Destinations"
   },
   "auth": {
     "signIn": "Sign in",
@@ -362,7 +366,17 @@
     "nameSaveUnreachable": "This could not be saved: the console could not reach the server.",
     "nameSaveGone": "This recording is no longer yours to name.",
     "nameSaveRefused": "The server refused this text. A title has to fit on one line, and neither field may carry invisible control characters.",
-    "nameSaveFailed": "This could not be saved. Nothing was changed."
+    "nameSaveFailed": "This could not be saved. Nothing was changed.",
+    "protocolsHeading": "Where this meeting was published",
+    "protocolsCount": "Published to one destination. | Published to {count} destinations.",
+    "protocolsAnnouncedOnly": "Published to one destination.",
+    "protocolsAnnouncedOnlyNote": "Sturnus recorded no destination beside this link — either the meeting predates this server naming destinations of its own, or it was published by the single Outline collection named on Bot Settings. There is one link, and nothing else to list.",
+    "protocolsAnnouncedMissing": "Sturnus announces one protocol link per meeting in Discord, and none was announced for this one, while the destination below did produce a document. | Sturnus announces one protocol link per meeting in Discord, and none was announced for this one, while the {count} destinations below did produce a document.",
+    "protocolsAnnouncedElsewhere": "The link announced in Discord is not one of the destinations below.",
+    "protocolFormat": "As {format}",
+    "protocolUnknownFormat": "As {format}, which is a format this console does not know",
+    "protocolOrphaned": "The destination this went to has since been removed. The document is still there and this link still works; nothing new is published here.",
+    "protocolsFailed": "Where this meeting was published could not be read. Anything already linked above is unaffected."
   },
   "calendar": {
     "loadingYear": "Loading the calendar for {year}.",
@@ -579,6 +593,98 @@
       "groupOther": "Everything else",
       "groupNeedsAttention": "{group} · {count} to set | {group} · {count} to set",
       "groupOtherNote": "These keys are in none of the groups above: they reached the API after those groups were written, and this page would rather show a key it cannot file than quietly leave it out. Nothing else about them is different — each is set, cleared and takes effect exactly as every other key here does."
+    },
+    "destinations": {
+      "title": "Destinations",
+      "intro": "Where this server publishes its protocols. A meeting can go to several destinations in several formats; each is written on its own, so one destination being unreachable does not lose the others.",
+      "whichServer": "Which server",
+      "noGuildsHeading": "There is nothing here for you yet",
+      "noGuildsBody": "This page says where one Discord server publishes its protocols, and it is open to the administrators of a server where Sturnus is running. You administer none of them right now.",
+      "noGuildsRole": "Administrators are the members holding the Discord role that server names in its {setting} setting. Somebody who already has it can grant you that role — Sturnus mirrors the membership from Discord, so the change reaches this console on its own.",
+      "loading": "Reading this server’s destinations…",
+      "loadFailed": "This server’s destinations could not be read.",
+      "serversFailed": "The servers you administer could not be read, so there is nothing to configure yet.",
+      "listLabel": "Destinations of this server",
+      "pagerLabel": "Pages of destinations",
+      "emptyHeading": "This server has no destination of its own",
+      "emptyNote": "Nothing here is broken. A destination is something somebody adds, and until one is added this server keeps publishing where Bot Settings says.",
+      "add": "Add a destination",
+      "addHeading": "A new destination",
+      "editHeading": "Change this destination",
+      "nameLabel": "Name",
+      "nameHint": "What this destination is called here. It is published nowhere; it is what tells two destinations apart on this page.",
+      "nameLockedNote": "A name cannot be changed here. Sturnus addresses a stored destination by its name, so renaming one means adding a destination and removing this one — which is what the two actions below are for.",
+      "formatLabel": "Format",
+      "formatHint": "What is written and what carries it away. A format decides both: an Outline document and a Markdown file are not the same text with a different extension.",
+      "formatOutlineNote": "Created in a collection in Outline",
+      "formatMarkdownNote": "Stored by Sturnus, read through this console",
+      "formatHtmlNote": "Stored by Sturnus, read through this console",
+      "formatUnknownDetail": "Configured here, and not a format this console knows",
+      "formatsNote": "These are the formats this deployment publishes. PDF and Confluence are specified and not built, so they are not offered here rather than offered and then refused — a choice that a save rejects teaches people not to trust the choices beside it.",
+      "collectionLabel": "Outline collection",
+      "collectionHint": "The collection each protocol is created in. The same list Bot Settings offers for its own document_target.",
+      "collectionsUnavailable": "The Outline collections could not be read, so this asks for a collection id.",
+      "collectionChoose": "Choose a collection",
+      "collectionManual": "Enter a collection id by hand",
+      "collectionBackToPicker": "Choose from the list instead",
+      "unresolvedCollection": "This id matches no collection in the copy Sturnus made of Outline. It may have been deleted there, or the copy may not have caught up — either way it is still what this destination is configured with.",
+      "prefixLabel": "Key prefix",
+      "prefixHint": "Where in Sturnus’s own store the file is written. Letters, digits, dot, dash, underscore, and / between them; the meeting and the destination are appended.",
+      "enabledLabel": "Publish to this destination",
+      "enabledHint": "Switching a destination off is not forgetting how it was configured. It stays here, and nothing is published to it.",
+      "stateEnabled": "Publishing",
+      "stateDisabled": "Switched off",
+      "rowSummary": "{format}, into {target}",
+      "rowUnknownFormat": "{format}, into {target} — a format this console does not know. Whether it can be published is this deployment’s own answer.",
+      "primaryBadge": "Announced in Discord",
+      "primaryNote": "Enabled destinations are written oldest first, and the link Sturnus posts in Discord is the first one’s. It does not move when a destination is renamed.",
+      "save": "Save",
+      "saving": "Saving…",
+      "cancel": "Cancel",
+      "edit": "Change",
+      "delete": "Remove",
+      "deleteConfirmHeading": "Remove this destination?",
+      "deleteConfirmBody": "Nothing already published is deleted. Every protocol written here stays where it is and its link keeps working; Sturnus stops publishing to it and nothing else.",
+      "deleteConfirm": "Yes, remove it",
+      "enable": "Switch on",
+      "disable": "Switch off",
+      "savedCreated": "Added.",
+      "savedUpdated": "Saved.",
+      "savedDeleted": "Removed.",
+      "savedEnabled": "Switched on.",
+      "savedDisabled": "Switched off.",
+      "secretHeading": "Credential",
+      "secretStored": "A credential is stored for this destination.",
+      "secretNone": "No credential is stored.",
+      "secretSet": "Store a credential",
+      "secretReplace": "Replace the credential",
+      "secretNeverShown": "Sturnus never shows a stored credential, here or anywhere: no route returns one. Replacing it and clearing it are the only two things that can be done to it, and each has a button of its own — an empty box rendered beside a stored credential is how one gets wiped by somebody correcting a typo in a name.",
+      "secretUnused": "None of the formats above reads a stored credential yet: Outline is published with this deployment’s own Outline token, and the two file formats are written into this deployment’s own store. One set here is kept for the destinations that will read it.",
+      "secretInputLabel": "New credential",
+      "secretSave": "Store it",
+      "secretSaving": "Storing…",
+      "secretClear": "Clear the stored credential",
+      "secretClearConfirmHeading": "Clear this credential?",
+      "secretClearConfirmBody": "It cannot be recovered afterwards — Sturnus holds no copy that anything can read back. Publishing to this destination carries on with no credential until another is stored.",
+      "secretClearConfirm": "Yes, clear it",
+      "secretSaved": "Stored.",
+      "secretCleared": "Cleared.",
+      "nameEmpty": "A destination needs a name.",
+      "nameTaken": "This server already has a destination with that name.",
+      "formatEmpty": "Choose a format.",
+      "targetEmpty": "A destination needs somewhere to write to.",
+      "targetNotCollection": "An Outline collection id: no spaces in it, and no slash at the front.",
+      "targetNotPrefix": "Letters, digits, dot, dash and underscore, separated by / — no slash at the front, none at the end, and no “..”.",
+      "errorRefused": "Sturnus refused that destination. This console offers the formats it believes this deployment builds, so a refusal here means the deployment’s own list differs from it.",
+      "errorSession": "Your session has ended. Sign in again, then retry — nothing was written.",
+      "errorGone": "Sturnus no longer knows this server or this destination, or you no longer administer it — it answers the same way to all three. Reload the page.",
+      "errorDuplicate": "This server already has a destination with that name.",
+      "errorUnreachable": "Could not reach the API. Nothing was written; check the connection and retry.",
+      "errorStatus": "Sturnus answered {status} and did not say why. What was written, if anything, is not known.",
+      "fallbackHeading": "And the setting these replace",
+      "fallbackInUse": "No destination here is switched on, so this server still publishes where document_target on Bot Settings points: one Outline document per meeting. Switching one on here takes over from that setting completely.",
+      "fallbackReplaced": "This server publishes to the one destination above, and document_target on Bot Settings is no longer used for it — the destinations here replace that setting rather than adding to it. | This server publishes to the {count} destinations above, and document_target on Bot Settings is no longer used for them — the destinations here replace that setting rather than adding to it.",
+      "fallbackLink": "Open Bot Settings"
     }
   },
   "ui": {
diff --git a/console/test/exportTargets.spec.ts b/console/test/exportTargets.spec.ts
new file mode 100644
index 0000000..6f366b4
--- /dev/null
+++ b/console/test/exportTargets.spec.ts
@@ -0,0 +1,542 @@
+/**
+ * Where a guild publishes, and the four properties of that page that are
+ * invisible in a screenshot.
+ *
+ * Every one of these is a decision the API also makes, restated on the
+ * console side so that a reader gets the reason rather than a bare status —
+ * `apiError` keeps nothing of a refusal but its number. A test that only
+ * checked the happy path would leave all four free to drift out of step
+ * with `sturnus.console.routes_exports`.
+ */
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  EXPORT_FORMATS,
+  FORMAT_HTML,
+  FORMAT_MARKDOWN,
+  FORMAT_OUTLINE,
+  acceptsTarget,
+  canSubmitSecret,
+  describeTargetError,
+  draftBody,
+  draftOf,
+  draftProblems,
+  emptyDraft,
+  enabledLabelKey,
+  enabledTargetCount,
+  fallbackNote,
+  formatChoices,
+  formatSpec,
+  isDraftReady,
+  orderTargets,
+  parseTarget,
+  parseTargets,
+  primaryTarget,
+  problemFor,
+  secretState,
+  takenNames,
+  targetPath,
+  targetSecretPath,
+  targetSummary,
+  targetsPath,
+  type ExportTarget,
+} from '../app/utils/exportTargets'
+import type { Message } from '../app/utils/message'
+
+/** Read rather than imported, the way `palette.spec.ts` reads the
+ *  stylesheet: what ships is the file, so the file is what is checked. */
+function messages(locale: 'en' | 'de'): Record<string, unknown> {
+  return JSON.parse(readFileSync(resolve(process.cwd(), `i18n/locales/${locale}.json`), 'utf8'))
+}
+
+/** Whether a dotted key resolves to a string in a locale file. */
+function translated(bundle: Record<string, unknown>, key: string): boolean {
+  let node: unknown = bundle
+  for (const part of key.split('.')) {
+    if (typeof node !== 'object' || node === null) return false
+    node = (node as Record<string, unknown>)[part]
+  }
+  return typeof node === 'string' && node.trim() !== ''
+}
+
+const EN = messages('en')
+const DE = messages('de')
+
+/** Every key a message tree names, including the nested ones. */
+function keysIn(message: Message): string[] {
+  const found = [message.key]
+  for (const value of Object.values(message.params ?? {})) {
+    if (typeof value === 'object' && value !== null && 'key' in value) {
+      found.push(...keysIn(value as Message))
+    }
+  }
+  return found
+}
+
+function target(over: Partial<ExportTarget> = {}): ExportTarget {
+  return {
+    id: 1,
+    guildId: '1289374650912837465',
+    format: FORMAT_OUTLINE,
+    name: 'Wiki',
+    target: 'c0ffee',
+    config: {},
+    hasSecret: false,
+    enabled: true,
+    createdAt: '2026-08-01T10:00:00+00:00',
+    updatedAt: '2026-08-01T10:00:00+00:00',
+    ...over,
+  }
+}
+
+describe('reading what the API sent', () => {
+  it('keeps the guild as a string and the destination id as a number', () => {
+    // The API's own asymmetry, and it is not an inconsistency: a Discord
+    // snowflake exceeds `Number.MAX_SAFE_INTEGER`, so anything that
+    // round-trips through a JavaScript number hands back an id ending in
+    // other digits. The destination's own key is a `SERIAL`.
+    const parsed = parseTarget({
+      id: 7,
+      guild_id: '1289374650912837465',
+      format: 'markdown',
+      name: 'Bucket',
+      target: 'minutes/2026',
+      config: { note: 'kept' },
+      has_secret: false,
+      enabled: true,
+      created_at: '2026-08-01T10:00:00+00:00',
+      updated_at: '2026-08-02T10:00:00+00:00',
+    })!
+    expect(parsed.id).toBe(7)
+    expect(parsed.guildId).toBe('1289374650912837465')
+  })
+
+  it('never produces a field a credential could sit in', () => {
+    // The property the whole feature rests on. `ExportTarget` carries
+    // `has_secret` and nothing else about the credential, and a shape here
+    // that *could* hold a token is a shape somebody eventually binds to an
+    // input.
+    const parsed = parseTarget({ id: 1, has_secret: true, secret: 'tok_live_do_not_render' })!
+    expect(Object.keys(parsed)).not.toContain('secret')
+    expect(Object.values(parsed)).not.toContain('tok_live_do_not_render')
+    expect(parsed.hasSecret).toBe(true)
+  })
+
+  it('carries an unknown key in `config` through untouched', () => {
+    // The page never edits it, so it has to survive a rename: dropping it
+    // would send `{}` back on the next save and erase whatever a later
+    // format put there.
+    const parsed = parseTarget({ id: 1, config: { space: 'ENG', parent: 42 } })!
+    expect(parsed.config).toEqual({ space: 'ENG', parent: 42 })
+  })
+
+  it('treats a destination with no `enabled` as switched off', () => {
+    // A destination this console cannot tell the state of is better drawn
+    // as off — the reader switches it on and learns the truth — than drawn
+    // as publishing when it is not.
+    expect(parseTarget({ id: 1 })!.enabled).toBe(false)
+  })
+
+  it('drops a row whose id is null rather than reading it as nought', () => {
+    // `Number(null)` is 0, and 0 is a safe integer. Left unchecked, such a
+    // row would become a destination every write addressed as
+    // `/export-targets/0`.
+    expect(parseTarget({ id: null })).toBeNull()
+    expect(parseTarget({ id: 'seven' })).toBeNull()
+    expect(parseTarget({ id: 1.5 })).toBeNull()
+  })
+
+  it('drops a row with no id and keeps a row with no name', () => {
+    // Nothing can be done to a row with no id: every write addresses it by
+    // that id. A row with no name is a destination that renders as blank,
+    // and one nobody can switch off is worse than one with an empty label.
+    const parsed = parseTargets({ targets: [{ name: 'nameless' }, { id: 3 }] })
+    expect(parsed.map((row) => row.id)).toEqual([3])
+    expect(parsed[0]!.name).toBe('')
+  })
+
+  it('answers an empty list for a payload of the wrong shape', () => {
+    for (const payload of [null, undefined, 'no', 42, {}, { targets: 'no' }]) {
+      expect(parseTargets(payload)).toEqual([])
+    }
+  })
+})
+
+describe('which formats are offered', () => {
+  it('offers exactly the three this deployment builds', () => {
+    // `pdf` and `confluence` are specified and deliberately not built, and
+    // configuring one answers 400 with the list of what may be configured
+    // instead. An option a save refuses is not an option.
+    expect(EXPORT_FORMATS.map((entry) => entry.name)).toEqual([
+      FORMAT_OUTLINE,
+      FORMAT_MARKDOWN,
+      FORMAT_HTML,
+    ])
+  })
+
+  it('offers no row for a format the API would refuse', () => {
+    // The argument, stated as an assertion: absent, not disabled. The
+    // opposite choice — an inert "PDF (coming soon)" row — is what the
+    // account menu does for two-factor authentication, and the reason it
+    // is wrong here is that this is a form field and the console cannot
+    // see the deployment's registry to know when the row would stop being
+    // true.
+    const values = formatChoices((key) => key).map((option) => option.value)
+    expect(values).not.toContain('pdf')
+    expect(values).not.toContain('confluence')
+    expect(formatSpec('pdf')).toBeNull()
+  })
+
+  it('offers a stored format it has never heard of, rather than dropping it', () => {
+    // The day this deployment adds `pdf` to its registry, a destination
+    // configured for it must survive being renamed. A picker that omitted
+    // the stored value would render as though `outline` were chosen and
+    // rewrite the destination to `outline` on the next save.
+    const values = formatChoices((key) => key, 'pdf').map((option) => option.value)
+    expect(values).toEqual([FORMAT_OUTLINE, FORMAT_MARKDOWN, FORMAT_HTML, 'pdf'])
+  })
+
+  it('does not add a second row for a stored format it does know', () => {
+    const values = formatChoices((key) => key, FORMAT_HTML).map((option) => option.value)
+    expect(values).toEqual([FORMAT_OUTLINE, FORMAT_MARKDOWN, FORMAT_HTML])
+  })
+
+  it('labels a stored unknown format with its own raw name', () => {
+    // There is no key for a word this console has never seen, and
+    // inventing a friendly one would be the console guessing at somebody
+    // else's release note.
+    const row = formatChoices((key) => key, 'confluence').at(-1)!
+    expect(row.label).toBe('confluence')
+  })
+
+  it('asks each format for a different address, and says so differently', () => {
+    // Outline wants a collection id and the object store wants a key
+    // prefix. A form that showed the union of every field would ask for
+    // both.
+    expect(formatSpec(FORMAT_OUTLINE)!.targetKind).toBe('collection')
+    expect(formatSpec(FORMAT_MARKDOWN)!.targetKind).toBe('prefix')
+    expect(formatSpec(FORMAT_HTML)!.targetKind).toBe('prefix')
+  })
+
+  it('knows which formats this deployment can serve back and which it cannot', () => {
+    // An Outline document's bytes live in Outline; the object-store ones
+    // are served under the session's own rule. `routes_documents` decides
+    // the same thing from the same registry.
+    expect(formatSpec(FORMAT_OUTLINE)!.readable).toBe(false)
+    expect(formatSpec(FORMAT_MARKDOWN)!.readable).toBe(true)
+    expect(formatSpec(FORMAT_HTML)!.readable).toBe(true)
+  })
+})
+
+describe('what a format will accept as an address', () => {
+  it('takes an Outline collection id and refuses whitespace in it', () => {
+    // The API's `_OUTLINE_TARGET`. What it excludes is a paste that went
+    // wrong; the failure otherwise is an unexplained 404 from Outline.
+    expect(acceptsTarget(FORMAT_OUTLINE, 'c0ffee-1234')).toBe(true)
+    expect(acceptsTarget(FORMAT_OUTLINE, 'two words')).toBe(false)
+    expect(acceptsTarget(FORMAT_OUTLINE, ' leading')).toBe(false)
+    expect(acceptsTarget(FORMAT_OUTLINE, '/slashfirst')).toBe(false)
+    expect(acceptsTarget(FORMAT_OUTLINE, '')).toBe(false)
+  })
+
+  it('takes an object-store prefix and refuses one that could traverse', () => {
+    // The API's `_OBJECT_PREFIX`. `..` cannot appear because a dot may not
+    // follow a dot; a leading slash is a key nobody meant to write.
+    expect(acceptsTarget(FORMAT_MARKDOWN, 'minutes/2026')).toBe(true)
+    expect(acceptsTarget(FORMAT_HTML, 'a_b-c.d/e')).toBe(true)
+    expect(acceptsTarget(FORMAT_MARKDOWN, '../secrets')).toBe(false)
+    expect(acceptsTarget(FORMAT_MARKDOWN, '/leading')).toBe(false)
+    expect(acceptsTarget(FORMAT_MARKDOWN, 'trailing/')).toBe(false)
+    expect(acceptsTarget(FORMAT_MARKDOWN, 'a b')).toBe(false)
+  })
+
+  it('accepts anything non-empty for a format it has no pattern for', () => {
+    // This console has no pattern for a format it has never heard of, and
+    // inventing one would refuse a target the deployment is perfectly
+    // happy with.
+    expect(acceptsTarget('pdf', 'whatever a pdf target is')).toBe(true)
+    expect(acceptsTarget('pdf', '  ')).toBe(false)
+  })
+})
+
+describe('the order the destinations publish in', () => {
+  const first = target({ id: 3, name: 'Wiki' })
+  const second = target({ id: 9, name: 'Archive' })
+  const third = target({ id: 12, name: 'Bucket' })
+
+  it('is by id and never by name', () => {
+    // Not cosmetic. `destinations_for` sorts by id precisely so the
+    // primary does not move when somebody renames one, and
+    // `session.document_url` — the link the Discord announcement carries —
+    // is stamped from the primary alone. Alphabetical order would show a
+    // reader a first row that is not the first destination.
+    expect(orderTargets([third, first, second]).map((row) => row.id)).toEqual([3, 9, 12])
+  })
+
+  it('names the oldest enabled destination as the one Discord announces', () => {
+    expect(primaryTarget([third, first, second])!.id).toBe(3)
+  })
+
+  it('skips a switched-off destination when naming the announced one', () => {
+    // `enabled_for` is what the worker reads, so a disabled row is not in
+    // the running at all.
+    const off = { ...first, enabled: false }
+    expect(primaryTarget([third, off, second])!.id).toBe(9)
+  })
+
+  it('names none when every destination is switched off', () => {
+    expect(primaryTarget([{ ...first, enabled: false }])).toBeNull()
+    expect(primaryTarget([])).toBeNull()
+  })
+
+  it('does not skip a format it has never heard of when naming the announced one', () => {
+    // Whether the deployment can publish `pdf` is the deployment's answer.
+    // A console that skipped this row because it does not know the word
+    // would name the wrong destination as the announced one on exactly the
+    // deployment where it matters.
+    const exotic = target({ id: 1, format: 'pdf' })
+    expect(primaryTarget([first, exotic])!.id).toBe(1)
+  })
+
+  it('counts the ones that are switched on', () => {
+    expect(enabledTargetCount([first, { ...second, enabled: false }, third])).toBe(2)
+  })
+})
+
+describe('what the page says about `document_target`', () => {
+  it('says the Bot Settings fallback is what publishes, when nothing here is enabled', () => {
+    // The two settings look like rivals, and this is where somebody
+    // configuring destinations reads which of them is in force.
+    expect(fallbackNote([]).key).toBe('admin.destinations.fallbackInUse')
+    expect(fallbackNote([target({ enabled: false })]).key).toBe(
+      'admin.destinations.fallbackInUse',
+    )
+  })
+
+  it('says the fallback has been replaced once anything here is enabled', () => {
+    // `destinations_for` **replaces** the fallback rather than joining it,
+    // so enabling one destination here silently stops `document_target`
+    // being used. That has to be said on the screen where it happened.
+    const note = fallbackNote([target(), target({ id: 2, name: 'Bucket' })])
+    expect(note.key).toBe('admin.destinations.fallbackReplaced')
+    expect(note.params?.count).toBe(2)
+  })
+})
+
+describe('the credential', () => {
+  it('offers no way to read one back', () => {
+    // There is no route that returns a secret, so a control that offered
+    // to show one would be offering something the API cannot serve.
+    const state = secretState(target({ hasSecret: true }))
+    expect(Object.keys(state)).toEqual(['stored', 'statusKey', 'actionKey', 'canClear'])
+    expect(Object.keys(state)).not.toContain('value')
+  })
+
+  it('says which of "store" and "replace" this is', () => {
+    expect(secretState(target({ hasSecret: false })).actionKey).toBe(
+      'admin.destinations.secretSet',
+    )
+    expect(secretState(target({ hasSecret: true })).actionKey).toBe(
+      'admin.destinations.secretReplace',
+    )
+  })
+
+  it('offers clearing only where there is something to clear', () => {
+    expect(secretState(target({ hasSecret: true })).canClear).toBe(true)
+    expect(secretState(target({ hasSecret: false })).canClear).toBe(false)
+  })
+
+  it('refuses to submit an empty credential', () => {
+    // The API answers 400 to `""`, and refusing it here is what stops
+    // "save an empty box" from looking like a way to clear one. Clearing
+    // has its own button and it is the only way.
+    expect(canSubmitSecret('')).toBe(false)
+    expect(canSubmitSecret('tok')).toBe(true)
+  })
+
+  it('is not a field of the thing the destination form submits', () => {
+    // The failure this prevents: an empty password box beside a configured
+    // credential, saved along with the rest of the form, silently wiping a
+    // token every time somebody corrects a typo in a name. It is not
+    // merely avoided, it is unrepresentable — there is no field.
+    expect(Object.keys(emptyDraft()).sort()).toEqual(['enabled', 'format', 'name', 'target'])
+    expect(Object.keys(draftBody(emptyDraft())).sort()).toEqual([
+      'config',
+      'enabled',
+      'format',
+      'name',
+      'target',
+    ])
+  })
+})
+
+describe('what is wrong with a draft', () => {
+  it('is happy with a complete one', () => {
+    expect(draftProblems({ format: FORMAT_OUTLINE, name: 'Wiki', target: 'c0ffee', enabled: true }))
+      .toEqual([])
+    expect(isDraftReady(draftOf(target()))).toBe(true)
+  })
+
+  it('refuses a name that is blank or only spaces', () => {
+    // `_BAD_NAME` in the API: a non-empty string after stripping.
+    expect(problemFor(draftProblems({ ...emptyDraft(), target: 'c0ffee' }), 'name')?.key).toBe(
+      'admin.destinations.nameEmpty',
+    )
+    const spaces = draftProblems({ ...emptyDraft(), name: '   ', target: 'c0ffee' })
+    expect(problemFor(spaces, 'name')?.key).toBe('admin.destinations.nameEmpty')
+  })
+
+  it('refuses a name this guild already uses', () => {
+    // The API answers 409, because a create that upserted would let a typo
+    // redirect a guild's protocols with nothing said.
+    const problems = draftProblems(
+      { format: FORMAT_OUTLINE, name: 'Wiki', target: 'c0ffee', enabled: true },
+      ['Wiki', 'Archive'],
+    )
+    expect(problemFor(problems, 'name')?.key).toBe('admin.destinations.nameTaken')
+  })
+
+  it('does not complain that a destination collides with its own name', () => {
+    // A `PUT` reads the name from the stored row and ignores the body, so
+    // renaming is a create plus a delete. Complaining here would refuse a
+    // save that changes something else entirely.
+    const stored = target({ id: 4, name: 'Wiki' })
+    const others = target({ id: 5, name: 'Archive' })
+    expect(takenNames([stored, others], 4)).toEqual(['Archive'])
+    expect(isDraftReady(draftOf(stored), takenNames([stored, others], 4))).toBe(true)
+  })
+
+  it('names the field each complaint is about', () => {
+    // So the page can put it beside that field rather than in a list of
+    // grievances at the bottom.
+    const problems = draftProblems({ format: '', name: '', target: '', enabled: true })
+    expect(problems.map((problem) => problem.field)).toEqual(['name', 'format', 'target'])
+  })
+
+  it('says the address is wrong in the words of the format that refused it', () => {
+    // "Not a collection id" and "not an object prefix" are different
+    // sentences, because they are different mistakes.
+    const outline = draftProblems({
+      format: FORMAT_OUTLINE, name: 'Wiki', target: 'two words', enabled: true,
+    })
+    expect(problemFor(outline, 'target')?.key).toBe('admin.destinations.targetNotCollection')
+    const markdown = draftProblems({
+      format: FORMAT_MARKDOWN, name: 'Bucket', target: '../up', enabled: true,
+    })
+    expect(problemFor(markdown, 'target')?.key).toBe('admin.destinations.targetNotPrefix')
+  })
+
+  it('trims what it sends, the way the API trims what it stores', () => {
+    // So that a value read straight back from the API equals the draft and
+    // the form does not look unsaved the moment it was saved.
+    const body = draftBody(
+      { format: ' outline ', name: '  Wiki  ', target: ' c0ffee ', enabled: false },
+      { space: 'ENG' },
+    )
+    expect(body).toEqual({
+      format: 'outline', name: 'Wiki', target: 'c0ffee', config: { space: 'ENG' }, enabled: false,
+    })
+  })
+})
+
+describe('where the requests go', () => {
+  it('escapes the guild in every path', () => {
+    // A guild id reaches this from a picker and from local storage, and a
+    // path built by concatenation is a path somebody eventually puts a
+    // slash into.
+    expect(targetsPath('a/b')).toBe('/guilds/a%2Fb/export-targets')
+    expect(targetPath('17', 4)).toBe('/guilds/17/export-targets/4')
+    expect(targetSecretPath('17', 4)).toBe('/guilds/17/export-targets/4/secret')
+  })
+
+  it('writes the credential to a path of its own', () => {
+    // Not a field on the destination. A `PUT` on the target that also took
+    // the secret would clear it on every rename.
+    expect(targetSecretPath('17', 4)).not.toBe(targetPath('17', 4))
+  })
+})
+
+describe('when a write does not work', () => {
+  it.each([
+    [400, 'admin.destinations.errorRefused'],
+    [401, 'admin.destinations.errorSession'],
+    [404, 'admin.destinations.errorGone'],
+    [409, 'admin.destinations.errorDuplicate'],
+    [0, 'admin.destinations.errorUnreachable'],
+    [500, 'admin.destinations.errorStatus'],
+  ])('explains a %s', (status, key) => {
+    expect(describeTargetError({ status }).key).toBe(key)
+  })
+
+  it('treats an error carrying no status as unreachable', () => {
+    // Nothing but `ApiError` should reach here, and that always has one —
+    // but a page that threw something else must not render `undefined` at
+    // somebody.
+    expect(describeTargetError(new Error('nope')).key).toBe(
+      'admin.destinations.errorUnreachable',
+    )
+  })
+
+  it('writes an unexplained status as a string rather than as a quantity', () => {
+    // `i18n/README.md` draws that line: 500 is not five hundred of
+    // anything, and a locale that grouped it would render `500` as `500`
+    // in English and as `500` in German only by luck.
+    expect(describeTargetError({ status: 503 }).params?.status).toBe('503')
+  })
+})
+
+describe('the sentences this module names', () => {
+  /** Every key any function here can return, gathered by calling them. */
+  const KEYS = [
+    ...EXPORT_FORMATS.flatMap((entry) => [
+      entry.labelKey, entry.noteKey, entry.targetLabelKey, entry.targetHintKey,
+    ]),
+    'admin.destinations.formatUnknownDetail',
+    enabledLabelKey(target()),
+    enabledLabelKey(target({ enabled: false })),
+    ...keysIn(targetSummary(target())),
+    ...keysIn(targetSummary(target({ format: 'pdf' }))),
+    ...keysIn(fallbackNote([])),
+    ...keysIn(fallbackNote([target()])),
+    ...Object.values(secretState(target({ hasSecret: true }))).filter(
+      (value): value is string => typeof value === 'string',
+    ),
+    ...Object.values(secretState(target({ hasSecret: false }))).filter(
+      (value): value is string => typeof value === 'string',
+    ),
+    ...draftProblems({ format: '', name: '', target: '', enabled: true })
+      .flatMap((problem) => keysIn(problem.message)),
+    ...draftProblems(
+      { format: FORMAT_OUTLINE, name: 'Wiki', target: 'two words', enabled: true },
+      ['Wiki'],
+    ).flatMap((problem) => keysIn(problem.message)),
+    ...draftProblems({
+      format: FORMAT_MARKDOWN, name: 'Bucket', target: '../up', enabled: true,
+    }).flatMap((problem) => keysIn(problem.message)),
+    ...[400, 401, 404, 409, 0, 500].flatMap((status) =>
+      keysIn(describeTargetError({ status }))),
+  ]
+
+  it('names every one of them with a key rather than with English', () => {
+    // A sentence that slipped in here would render identically in English
+    // and be untranslatable in German, which is the failure that shows up
+    // only for a reader who does not speak English.
+    //
+    // `common.*` is admitted for exactly one thing: a format's name, which
+    // the recording page has to say as well and which therefore has no
+    // single home. Everything else on this page is this page's.
+    for (const key of KEYS) {
+      expect(key).toMatch(/^(admin\.destinations|common)\.[a-z][A-Za-z]*$/)
+    }
+  })
+
+  it.each(['en', 'de'])('has a %s translation for every one of them', (locale) => {
+    const bundle = locale === 'en' ? EN : DE
+    for (const key of KEYS) {
+      expect(translated(bundle, key), `${key} is untranslated in ${locale}`).toBe(true)
+    }
+  })
+})
diff --git a/console/test/i18n.spec.ts b/console/test/i18n.spec.ts
index 4e7970a..575b1c3 100644
--- a/console/test/i18n.spec.ts
+++ b/console/test/i18n.spec.ts
@@ -64,6 +64,9 @@ const IDENTICAL_BY_RIGHT: Record<string, string> = {
   'recordings.solo': 'the word every mixing desk prints on that button, in German too',
   'settings.appearance.system':
     'German calls the operating system "das System" too, and this label names it',
+  'admin.destinations.nameLabel': '"Name" is the same word in German, and this label is that word',
+  'admin.destinations.formatLabel':
+    'German borrowed "Format" unchanged; "Dateityp" would name something narrower than this field',
 }
 
 describe('the two locale files', () => {
diff --git a/console/test/navigation.spec.ts b/console/test/navigation.spec.ts
index 88c9ed7..11e962d 100644
--- a/console/test/navigation.spec.ts
+++ b/console/test/navigation.spec.ts
@@ -119,6 +119,19 @@ describe('who is offered the Admin View', () => {
     expect(entry.to).toBe('/admin/consents')
   })
 
+  it('offers the destinations to an administrator', () => {
+    expect(visibleEntries(ADMIN).map((e) => e.labelKey)).toContain('nav.destinations')
+  })
+
+  it('hides the destinations from somebody who administers nothing', () => {
+    // Every route under `/api/guilds/{id}/export-targets` answers 404 to a
+    // non-administrator — the same answer it gives for a guild that does
+    // not exist — so an entry left visible would offer a page that can
+    // only ever refuse them.
+    expect(visibleEntries(PARTICIPANT).map((e) => e.labelKey)).not.toContain('nav.destinations')
+    expect(visibleEntries(null).map((e) => e.labelKey)).not.toContain('nav.destinations')
+  })
+
   it('offers the queue to an administrator', () => {
     expect(visibleEntries(ADMIN).map((e) => e.labelKey)).toContain('nav.queue')
   })
@@ -155,8 +168,15 @@ describe('who is offered the Admin View', () => {
     // Reporting is last because it is the only entry nothing is ever
     // wrong on: it is read on a schedule, or when somebody asks how much
     // this server actually uses Sturnus, and never in a hurry.
+    //
+    // Destinations sits second, next to the configuration it is part of:
+    // where a guild's protocols go was a text field on Bot Settings until
+    // it became a page, and `document_target` is still the fallback for a
+    // guild that configures nothing here. Two adjacent entries is what
+    // stops them reading as rival settings.
     expect(ADMIN_VIEW.entries.map((e) => e.labelKey)).toEqual([
       'nav.botSettings',
+      'nav.destinations',
       'nav.consents',
       'nav.queue',
       'nav.reporting',
diff --git a/console/test/sessionDocuments.spec.ts b/console/test/sessionDocuments.spec.ts
new file mode 100644
index 0000000..4033566
--- /dev/null
+++ b/console/test/sessionDocuments.spec.ts
@@ -0,0 +1,248 @@
+/**
+ * What one meeting was published as, and the five ways the two answers can
+ * stand relative to each other.
+ *
+ * The states are the whole point of this module. A recording page that
+ * rendered one "Open protocol" link would be telling a reader that a
+ * meeting reaching two destinations out of three had reached its
+ * destination — and a page that rendered a bare list would be telling them
+ * nothing about the one that did not arrive. Neither of those failures is
+ * visible in a screenshot of a healthy session, which is why they are
+ * checked here rather than looked at.
+ */
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  hasPublished,
+  parseSessionDocuments,
+  protocolRow,
+  publishedProtocols,
+  sessionDocumentsPath,
+  type SessionDocument,
+} from '../app/utils/sessionDocuments'
+import type { Message } from '../app/utils/message'
+
+function messages(locale: 'en' | 'de'): Record<string, unknown> {
+  return JSON.parse(readFileSync(resolve(process.cwd(), `i18n/locales/${locale}.json`), 'utf8'))
+}
+
+function translated(bundle: Record<string, unknown>, key: string): boolean {
+  let node: unknown = bundle
+  for (const part of key.split('.')) {
+    if (typeof node !== 'object' || node === null) return false
+    node = (node as Record<string, unknown>)[part]
+  }
+  return typeof node === 'string' && node.trim() !== ''
+}
+
+const EN = messages('en')
+const DE = messages('de')
+
+function keysIn(message: Message): string[] {
+  const found = [message.key]
+  for (const value of Object.values(message.params ?? {})) {
+    if (typeof value === 'object' && value !== null && 'key' in value) {
+      found.push(...keysIn(value as Message))
+    }
+  }
+  return found
+}
+
+function document(over: Partial<SessionDocument> = {}): SessionDocument {
+  return {
+    targetId: 3,
+    provider: 'outline',
+    url: 'https://outline.example/doc/abc',
+    createdAt: '2026-08-20T09:15:00+00:00',
+    readable: false,
+    mediaType: 'text/markdown; charset=utf-8',
+    ...over,
+  }
+}
+
+const OUTLINE_DOC = document()
+const MARKDOWN_DOC = document({
+  targetId: 9,
+  provider: 'markdown',
+  url: '/api/sessions/4711/documents/9',
+  readable: true,
+})
+
+describe('reading the listing', () => {
+  it('keeps a document whose destination has been removed', () => {
+    // `target_id` is `ON DELETE SET NULL`, and the row survives on
+    // purpose: the document still exists in the other system, and the link
+    // is what somebody follows when they go looking for last quarter's
+    // minutes.
+    const [row] = parseSessionDocuments({
+      documents: [{ target_id: null, provider: 'outline', url: 'https://outline.example/x' }],
+    })
+    expect(row!.targetId).toBeNull()
+    expect(protocolRow(row!).orphaned).toBe(true)
+  })
+
+  it('drops a row with no URL', () => {
+    // This list exists to be clicked, and the console can address neither
+    // an Outline document nor a stored one except through the URL the
+    // worker recorded.
+    expect(parseSessionDocuments({ documents: [{ target_id: 1, provider: 'html' }] })).toEqual([])
+    expect(parseSessionDocuments({ documents: [{ target_id: 1, url: '  ' }] })).toEqual([])
+  })
+
+  it('keeps a provider it has never heard of', () => {
+    // A deployment may publish a format this console does not know, and a
+    // document that renders as nothing is worse than one that renders as
+    // its own raw name.
+    const [row] = parseSessionDocuments({
+      documents: [{ target_id: 1, provider: 'pdf', url: 'https://example/x.pdf' }],
+    })
+    const rendered = protocolRow(row!)
+    expect(rendered.label.key).toBe('recordings.protocolUnknownFormat')
+    expect(rendered.label.params?.format).toBe('pdf')
+  })
+
+  it('answers an empty list for a payload of the wrong shape', () => {
+    for (const payload of [null, undefined, 'no', 7, {}, { documents: 'no' }]) {
+      expect(parseSessionDocuments(payload)).toEqual([])
+    }
+  })
+})
+
+describe('one row', () => {
+  it('says whether the link stays inside the console', () => {
+    // An object-store protocol is served under the session's own rule; an
+    // Outline one lives in Outline and the link leaves.
+    expect(protocolRow(MARKDOWN_DOC).internal).toBe(true)
+    expect(protocolRow(OUTLINE_DOC).internal).toBe(false)
+  })
+
+  it('dates it as an instant rather than as a string', () => {
+    // `i18n/README.md`: a date is a moment plus the name of a format, and
+    // the locale decides the month names and the order of the parts.
+    const row = protocolRow(OUTLINE_DOC)
+    expect(row.at?.format).toBe('utcMoment')
+    expect(row.at?.at.toISOString()).toBe('2026-08-20T09:15:00.000Z')
+  })
+
+  it('renders with no date rather than an unreadable one', () => {
+    expect(protocolRow(document({ createdAt: 'the other day' })).at).toBeNull()
+    expect(protocolRow(document({ createdAt: null })).at).toBeNull()
+  })
+
+  it('gives two orphaned documents keys of their own', () => {
+    // Postgres treats nulls as distinct in a unique index, so the rows
+    // whose destination has been removed accumulate. Two rows keyed alike
+    // is a `v-for` that renders one of them.
+    const first = protocolRow(document({ targetId: null, url: 'https://a' }))
+    const second = protocolRow(document({ targetId: null, url: 'https://b' }))
+    expect(first.id).not.toBe(second.id)
+  })
+})
+
+describe('how the two answers stand', () => {
+  it('says nothing was published when nothing claims to have been', () => {
+    // A meeting still being transcribed, or a guild that has configured
+    // nowhere to publish. An ordinary state and not a failure.
+    const view = publishedProtocols(null, [])
+    expect(view.state).toBe('none')
+    expect(hasPublished(view)).toBe(false)
+  })
+
+  it('reads a lone announced link as the destination that records no row', () => {
+    // The legacy `document_target` publish writes no `session_document`
+    // row at all, so every meeting from before destinations existed is
+    // this — and it is not a failure.
+    const view = publishedProtocols('https://outline.example/doc/abc', [])
+    expect(view.state).toBe('announcedOnly')
+    expect(view.announced).toBe('https://outline.example/doc/abc')
+    expect(view.note).not.toBeNull()
+  })
+
+  it('says nothing extra when the announced link is among the destinations', () => {
+    // The healthy case, and the one that must not be decorated with a
+    // caveat: a note on every session is a note nobody reads on the one
+    // session that has something wrong with it.
+    const view = publishedProtocols(OUTLINE_DOC.url, [OUTLINE_DOC, MARKDOWN_DOC])
+    expect(view.state).toBe('complete')
+    expect(view.note).toBeNull()
+    expect(view.summary.params?.count).toBe(2)
+  })
+
+  it('reports a publish that reached some destinations and was never announced', () => {
+    // **The partial failure, and it is a fact rather than an inference.**
+    // `session.document_url` is stamped from the primary destination
+    // alone, and `publish_session` records only the destinations that
+    // succeeded — so documents with no announced link is exactly "the one
+    // Discord announces did not produce a document, and these did".
+    const view = publishedProtocols(null, [MARKDOWN_DOC])
+    expect(view.state).toBe('announcedMissing')
+    expect(view.note?.key).toBe('recordings.protocolsAnnouncedMissing')
+    expect(view.rows.map((row) => row.url)).toEqual([MARKDOWN_DOC.url])
+  })
+
+  it('says so when the announced link is not one of the listed destinations', () => {
+    const view = publishedProtocols('https://outline.example/elsewhere', [MARKDOWN_DOC])
+    expect(view.state).toBe('announcedElsewhere')
+    expect(view.note?.key).toBe('recordings.protocolsAnnouncedElsewhere')
+  })
+
+  it('treats a blank announced link as no announced link', () => {
+    // `document_url` arrives as `""` from nothing in particular, and a
+    // page that compared it literally would report every session as
+    // "announced elsewhere".
+    expect(publishedProtocols('   ', [MARKDOWN_DOC]).state).toBe('announcedMissing')
+    expect(publishedProtocols('   ', []).state).toBe('none')
+  })
+
+  it('never diagnoses a destination, only the disagreement', () => {
+    // The retry sweep is still running, and a destination that has not
+    // been retried yet looks exactly like one that will never work. The
+    // same discipline `~/utils/queue` applies to its derived figures.
+    const view = publishedProtocols(null, [MARKDOWN_DOC])
+    for (const key of keysIn(view.note!)) {
+      expect(key).not.toMatch(/failed|broken|error/i)
+    }
+  })
+})
+
+describe('where the listing lives', () => {
+  it('is relative to the API base, and escapes the session id', () => {
+    // `useApi` prepends the base, which differs between a server render
+    // and the browser. A session id reaches this from the address bar.
+    expect(sessionDocumentsPath('4711')).toBe('/sessions/4711/documents')
+    expect(sessionDocumentsPath('a/b')).toBe('/sessions/a%2Fb/documents')
+  })
+})
+
+describe('the sentences this module names', () => {
+  const KEYS = [
+    ...keysIn(protocolRow(OUTLINE_DOC).label),
+    ...keysIn(protocolRow(document({ provider: 'pdf' })).label),
+    ...[
+      publishedProtocols(null, []),
+      publishedProtocols('https://a', []),
+      publishedProtocols(OUTLINE_DOC.url, [OUTLINE_DOC]),
+      publishedProtocols(null, [MARKDOWN_DOC]),
+      publishedProtocols('https://elsewhere', [MARKDOWN_DOC]),
+    ].flatMap((view) => [
+      ...keysIn(view.summary),
+      ...(view.note === null ? [] : keysIn(view.note)),
+    ]),
+  ]
+
+  it('names every one of them with a key rather than with English', () => {
+    for (const key of KEYS) {
+      expect(key).toMatch(/^(recordings|common)\.[a-z][A-Za-z]*$/)
+    }
+  })
+
+  it.each(['en', 'de'])('has a %s translation for every one of them', (locale) => {
+    const bundle = locale === 'en' ? EN : DE
+    for (const key of KEYS) {
+      expect(translated(bundle, key), `${key} is untranslated in ${locale}`).toBe(true)
+    }
+  })
+})
diff --git a/console/test/settings.spec.ts b/console/test/settings.spec.ts
index 7eebbb3..1521fc8 100644
--- a/console/test/settings.spec.ts
+++ b/console/test/settings.spec.ts
@@ -499,6 +499,22 @@ describe('the hints beside a field', () => {
       200,
     )
   })
+
+  it('says that `document_target` is now a fallback rather than the answer', () => {
+    // It looked like *the* answer to "where do this server's protocols
+    // go" and is now what a guild with no destination of its own falls
+    // back to — `destinations_for` replaces it rather than joining it. A
+    // reader who has not seen the Destinations page would otherwise set a
+    // collection here and watch nothing publish into it.
+    const hints = fieldHints(view({ key: 'document_target' })).join(' ')
+    expect(hints).toContain('Destinations')
+    expect(hints).toContain('replaces this setting')
+  })
+
+  it('says nothing extra beside a key that has not changed meaning', () => {
+    // The note is one key's, not a paragraph every field grew.
+    expect(fieldHints(view({ key: 'timezone' }))).toEqual([])
+  })
 })
 
 describe('shortening a value for display', () => {