{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[52f5c51c] Add Reddit OAuth linking and make UUID the only account identity.\n\nOAuth providers only attach to a session UUID (first link creates the\nprincipal); linked providers stay private on the account page.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide A — unified diff (full patch):\ndiff --git a/AGENTS.md b/AGENTS.md\nindex 6e0fd8ebb65d665c9c1438e3275971d62b98fd95..e9cc3173dbeb21ad0fc090ca7b407b027c7820a9 100644\n--- a/AGENTS.md\n+++ b/AGENTS.md\n@@ -35,8 +35,11 @@ Environment variables (defaults in `server/src/state.rs`):\n - `SORTER2_DATA_DIR` — default `./data` (created on startup)\n - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`\n - `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)\n-- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)\n-- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)\n+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth linking (optional)\n+- `REDDIT_CLIENT_ID` / `REDDIT_CLIENT_SECRET` (or `REDDIT_APP_*`) — Reddit API import + OAuth linking (optional)\n+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` and `/auth/reddit` (tests only)\n+\n+Identity: UUID is canonical. OAuth providers only *link* to a UUID (first link creates the principal). Linked providers are private to the account owner.\n \n Health check: `GET /healthz` → `ok`.\n \ndiff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs\nindex 5906f93b13853421e96a3c37bc9d8202a47842bf..c706ae8045a811e5941f5f6c72da88f42a403a82 100644\n--- a/server/src/auth/mod.rs\n+++ b/server/src/auth/mod.rs\n@@ -1,4 +1,8 @@\n-//! GitHub OAuth login, session cookies, and vote actor resolution.\n+//! OAuth linking, session cookies, and vote actor resolution.\n+//!\n+//! Canonical identity is a UUID. OAuth providers only *link* to that UUID\n+//! (first link creates the principal; later links attach while logged in).\n+//! Which providers are linked is private to the account owner.\n \n pub mod config;\n pub mod identity;\n@@ -22,7 +26,9 @@ use crate::{\n     form_template::template_json_compact,\n     html::layout,\n     state::AppState,\n-    storage_schema::{oauth_link_owner, pseudonym_owner, Store, StoreFields},\n+    storage_schema::{\n+        linked_providers_for_uuid, oauth_link_owner, pseudonym_owner, Store, StoreFields,\n+    },\n     ui_action::UI_RPC_FIELD,\n };\n \n@@ -53,10 +59,12 @@ fn new_actor_uuid() -> String {\n pub struct LoginQuery {\n     #[serde(default)]\n     pub return_to: Option<String>,\n+    #[serde(default)]\n+    pub error: Option<String>,\n }\n \n #[derive(Debug, Deserialize)]\n-pub struct GitHubStartQuery {\n+pub struct OAuthStartQuery {\n     #[serde(default)]\n     pub return_to: Option<String>,\n     #[serde(default)]\n@@ -72,15 +80,22 @@ fn return_from_query_or_jar(jar: &CookieJar, query: Option<&str>) -> String {\n         .unwrap_or_else(|| \"/\".to_string())\n }\n \n-fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, String)> {\n+/// Available OAuth link targets: `(provider_key, label, start_href)`.\n+fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, &'static str, String)> {\n     let mut out = Vec::new();\n+    let enc = urlencoding::encode(return_to);\n     if oauth::GitHubConfig::from_env(base_url).is_some() {\n         out.push((\n-            \"GitHub\",\n-            format!(\n-                \"/auth/github?return_to={}\",\n-                urlencoding::encode(return_to)\n-            ),\n+            \"github\",\n+            oauth::provider_label(\"github\"),\n+            format!(\"/auth/github?return_to={enc}\"),\n+        ));\n+    }\n+    if oauth::RedditConfig::from_env(base_url).is_some() {\n+        out.push((\n+            \"reddit\",\n+            oauth::provider_label(\"reddit\"),\n+            format!(\"/auth/reddit?return_to={enc}\"),\n         ));\n     }\n     out\n@@ -125,23 +140,41 @@ fn alias_claim_forms(return_to: &str, submit_label: &str) -> Result<Markup, Stat\n     })\n }\n \n-fn signed_out_body(providers: &[(&str, String)]) -> Markup {\n+fn login_error_message(code: Option<&str>) -> Option<&'static str> {\n+    match code {\n+        Some(\"oauth_taken\") => {\n+            Some(\"that OAuth account is already linked to a different sorter2 account\")\n+        }\n+        Some(\"oauth_failed\") => Some(\"OAuth failed — try again\"),\n+        _ => None,\n+    }\n+}\n+\n+fn signed_out_body(\n+    providers: &[(&str, &str, String)],\n+    error: Option<&str>,\n+) -> Markup {\n     html! {\n         main class=\"panel login-page\" {\n             section class=\"login-section\" {\n                 h1 { \"sign in\" }\n-                p class=\"muted\" { \"link an account to vote under a lasting alias\" }\n+                p class=\"muted\" {\n+                    \"link an OAuth account to create your identity, then claim an alias to vote\"\n+                }\n+                @if let Some(msg) = login_error_message(error) {\n+                    p class=\"alias-bad\" data-testid=\"login-error\" { (msg) }\n+                }\n                 @if providers.is_empty() {\n                     p class=\"muted\" {\n-                        \"OAuth is not configured. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET.\"\n+                        \"OAuth is not configured. Set GitHub and/or Reddit client credentials.\"\n                     }\n                 } @else {\n                     ul class=\"oauth-provider-list\" {\n-                        @for (name, href) in providers {\n+                        @for (key, label, href) in providers {\n                             li {\n                                 a href=(href) class=\"btn-primary oauth-provider\"\n-                                    data-testid=(format!(\"oauth-{}\", name.to_lowercase())) {\n-                                    (format!(\"Continue with {name}\"))\n+                                    data-testid=(format!(\"oauth-{key}\")) {\n+                                    (format!(\"Link {label}\"))\n                                 }\n                             }\n                         }\n@@ -156,7 +189,10 @@ fn signed_out_body(providers: &[(&str, String)]) -> Markup {\n fn account_body(\n     actor: &session::SessionActor,\n     aliases: &[String],\n-    providers: &[(&str, String)],\n+    // Provider keys already linked to this UUID (private).\n+    linked: &[String],\n+    // Providers available to link: not yet attached.\n+    unlinkable: &[(&str, &str, String)],\n     claim_forms: Markup,\n ) -> Markup {\n     let current = actor.pseudonym.trim();\n@@ -212,16 +248,29 @@ fn account_body(\n                 (claim_forms)\n             }\n \n-            @if !providers.is_empty() {\n-                section class=\"login-section\" {\n-                    h2 { \"linked sign-in\" }\n-                    p class=\"muted small\" { \"sign in again with the same provider to return to this account\" }\n+            section class=\"login-section\" {\n+                h2 { \"linked sign-in\" }\n+                p class=\"muted small\" {\n+                    \"private to you — linking more providers raises trust weight without publishing which accounts you use\"\n+                }\n+                @if linked.is_empty() {\n+                    p class=\"muted\" data-testid=\"linked-providers-empty\" { \"none yet\" }\n+                } @else {\n+                    ul class=\"linked-provider-list\" data-testid=\"linked-providers\" {\n+                        @for key in linked {\n+                            li data-testid=(format!(\"linked-{key}\")) {\n+                                (oauth::provider_label(key))\n+                            }\n+                        }\n+                    }\n+                }\n+                @if !unlinkable.is_empty() {\n                     ul class=\"oauth-provider-list\" {\n-                        @for (name, href) in providers {\n+                        @for (key, label, href) in unlinkable {\n                             li {\n                                 a href=(href) class=\"btn-secondary oauth-provider\"\n-                                    data-testid=(format!(\"oauth-relink-{}\", name.to_lowercase())) {\n-                                    (format!(\"Re-link {name}\"))\n+                                    data-testid=(format!(\"oauth-link-{key}\")) {\n+                                    (format!(\"Link {label}\"))\n                                 }\n                             }\n                         }\n@@ -243,12 +292,21 @@ fn account_body(\n fn login_body(\n     session: Option<&session::SessionActor>,\n     aliases: &[String],\n-    providers: &[(&str, String)],\n+    linked: &[String],\n+    providers: &[(&str, &str, String)],\n     claim_forms: Option<Markup>,\n+    error: Option<&str>,\n ) -> Markup {\n     match (session, claim_forms) {\n-        (Some(actor), Some(forms)) => account_body(actor, aliases, providers, forms),\n-        _ => signed_out_body(providers),\n+        (Some(actor), Some(forms)) => {\n+            let unlinkable: Vec<_> = providers\n+                .iter()\n+                .filter(|(key, _, _)| !linked.iter().any(|p| p == key))\n+                .cloned()\n+                .collect();\n+            account_body(actor, aliases, linked, &unlinkable, forms)\n+        }\n+        _ => signed_out_body(providers, error),\n     }\n }\n \n@@ -268,6 +326,10 @@ pub async fn login_page(\n         .as_ref()\n         .map(|s| alias_list(db, &s.uuid))\n         .unwrap_or_default();\n+    let linked = session\n+        .as_ref()\n+        .map(|s| linked_providers_for_uuid(db, &s.uuid).unwrap_or_default())\n+        .unwrap_or_default();\n     let providers = oauth_providers(&base_url_from_env(state.cfg.port), &return_to);\n \n     let claim_forms = if session.is_some() {\n@@ -282,7 +344,14 @@ pub async fn login_page(\n         } else {\n             \"login · sorter2\"\n         },\n-        login_body(session.as_ref(), &aliases, &providers, claim_forms),\n+        login_body(\n+            session.as_ref(),\n+            &aliases,\n+            &linked,\n+            &providers,\n+            claim_forms,\n+            query.error.as_deref(),\n+        ),\n         state.views.get_views(\"/login\"),\n         session\n             .as_ref()\n@@ -302,7 +371,6 @@ pub async fn alias_page(\n     let db = state.projection_store.db();\n     let session = session::load_valid_session(db, &session_id).ok_or(StatusCode::UNAUTHORIZED)?;\n     if session::session_has_pseudonym(&session) {\n-        // Already onboarded — manage aliases on the account page.\n         return Ok(Redirect::to(\"/login\").into_response());\n     }\n \n@@ -331,7 +399,7 @@ pub async fn alias_page(\n pub async fn github_start(\n     State(state): State<AppState>,\n     jar: CookieJar,\n-    Query(query): Query<GitHubStartQuery>,\n+    Query(query): Query<OAuthStartQuery>,\n ) -> Result<Response, StatusCode> {\n     let cfg = oauth::GitHubConfig::from_env(&base_url_from_env(state.cfg.port))\n         .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n@@ -342,7 +410,28 @@ pub async fn github_start(\n     } else {\n         None\n     };\n-    let url = oauth::authorize_url(&cfg, &state_token, mock_user);\n+    let url = oauth::github_authorize_url(&cfg, &state_token, mock_user);\n+    let jar = jar\n+        .add(session::oauth_state_cookie_value(&state_token))\n+        .add(session::auth_return_cookie_value(&return_to));\n+    Ok((jar, Redirect::temporary(&url)).into_response())\n+}\n+\n+pub async fn reddit_start(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    Query(query): Query<OAuthStartQuery>,\n+) -> Result<Response, StatusCode> {\n+    let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+    let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());\n+    let state_token = session::new_oauth_state();\n+    let mock_user = if config::mock_oauth_allowed() {\n+        query.mock_user.as_deref()\n+    } else {\n+        None\n+    };\n+    let url = oauth::reddit_authorize_url(&cfg, &state_token, mock_user);\n     let jar = jar\n         .add(session::oauth_state_cookie_value(&state_token))\n         .add(session::auth_return_cookie_value(&return_to));\n@@ -355,6 +444,13 @@ pub struct OAuthCallbackQuery {\n     pub state: String,\n }\n \n+/// Link `provider:provider_id` to a UUID.\n+///\n+/// - Logged in + new provider → attach to session UUID\n+/// - Logged in + already ours → no-op\n+/// - Logged in + owned by someone else → conflict\n+/// - Logged out + known link → resume that UUID\n+/// - Logged out + unknown → create principal + first link\n async fn finish_oauth_login(\n     state: &AppState,\n     jar: CookieJar,\n@@ -364,11 +460,41 @@ async fn finish_oauth_login(\n     let db = state.projection_store.db();\n     let return_to = return_from_query_or_jar(&jar, None);\n \n-    let uuid = match oauth_link_owner(db, provider, &provider_id)\n-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?\n-    {\n-        Some(existing) => existing,\n-        None => {\n+    let existing_owner = oauth_link_owner(db, provider, &provider_id)\n+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+    let session_uuid = session::session_id_from_jar(&jar)\n+        .as_deref()\n+        .and_then(|id| session::load_valid_session(db, id))\n+        .map(|s| s.uuid);\n+    let linking_while_logged_in = session_uuid.is_some();\n+\n+    let uuid = match (session_uuid, existing_owner) {\n+        (Some(session_uuid), Some(owner)) if owner == session_uuid => session_uuid,\n+        (Some(_), Some(_)) => {\n+            return Ok((\n+                jar.add(session::clear_oauth_state_cookie()),\n+                \"/login?error=oauth_taken\".into(),\n+            ));\n+        }\n+        (Some(session_uuid), None) => {\n+            let ts = now_ms();\n+            state\n+                .append_identity_events(vec![Event::OauthLinked {\n+                    uuid: session_uuid.clone(),\n+                    provider: provider.to_string(),\n+                    provider_id,\n+                    ts,\n+                }])\n+                .await\n+                .map_err(|e| {\n+                    tracing::warn!(err = %e, \"oauth link append failed\");\n+                    StatusCode::INTERNAL_SERVER_ERROR\n+                })?;\n+            session_uuid\n+        }\n+        (None, Some(owner)) => owner,\n+        (None, None) => {\n             let uuid = new_actor_uuid();\n             let ts = now_ms();\n             state\n@@ -409,6 +535,9 @@ async fn finish_oauth_login(\n             \"/login/alias?return_to={}\",\n             urlencoding::encode(&return_to)\n         )\n+    } else if linking_while_logged_in {\n+        // Additional link while already in an account → stay on account page.\n+        \"/login\".to_string()\n     } else {\n         return_to\n     };\n@@ -434,22 +563,57 @@ pub async fn github_callback(\n         .build()\n         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n \n-    let token = oauth::exchange_code(&client, &cfg, &query.code)\n+    let token = oauth::github_exchange_code(&client, &cfg, &query.code)\n         .await\n         .map_err(|e| {\n             tracing::warn!(err = %e, \"github oauth token exchange failed\");\n             StatusCode::BAD_GATEWAY\n         })?;\n-    let user = oauth::fetch_user(&client, &cfg.api_base, &token)\n+    let user = oauth::github_fetch_user(&client, &cfg.api_base, &token)\n         .await\n         .map_err(|e| {\n             tracing::warn!(err = %e, \"github user fetch failed\");\n             StatusCode::BAD_GATEWAY\n         })?;\n \n-    let provider = \"github\";\n-    let provider_id = oauth::provider_id(&user);\n-    let (jar, dest) = finish_oauth_login(&state, jar, provider, provider_id).await?;\n+    let (jar, dest) =\n+        finish_oauth_login(&state, jar, \"github\", oauth::github_provider_id(&user)).await?;\n+    Ok((jar, Redirect::to(&dest)).into_response())\n+}\n+\n+pub async fn reddit_callback(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    Query(query): Query<OAuthCallbackQuery>,\n+) -> Result<Response, StatusCode> {\n+    let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+\n+    let expected_state = session::oauth_state_from_jar(&jar).ok_or(StatusCode::BAD_REQUEST)?;\n+    if expected_state != query.state {\n+        return Err(StatusCode::BAD_REQUEST);\n+    }\n+\n+    let client = Client::builder()\n+        .timeout(std::time::Duration::from_secs(15))\n+        .build()\n+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+    let token = oauth::reddit_exchange_code(&client, &cfg, &query.code)\n+        .await\n+        .map_err(|e| {\n+            tracing::warn!(err = %e, \"reddit oauth token exchange failed\");\n+            StatusCode::BAD_GATEWAY\n+        })?;\n+    let user = oauth::reddit_fetch_user(&client, &cfg, &token)\n+        .await\n+        .map_err(|e| {\n+            tracing::warn!(err = %e, \"reddit user fetch failed\");\n+            StatusCode::BAD_GATEWAY\n+        })?;\n+\n+    let (jar, dest) =\n+        finish_oauth_login(&state, jar, \"reddit\", oauth::reddit_provider_id(&user)).await?;\n     Ok((jar, Redirect::to(&dest)).into_response())\n }\n \ndiff --git a/server/src/auth/oauth.rs b/server/src/auth/oauth.rs\nindex b80078fee0c5acd905b9125d29454e46c4e0d066..369b1527d9032cf312a07819279e0f988ef4a36e 100644\n--- a/server/src/auth/oauth.rs\n+++ b/server/src/auth/oauth.rs\n@@ -1,8 +1,15 @@\n-//! GitHub OAuth (raw reqwest, same style as reddit.rs).\n+//! OAuth providers (GitHub + Reddit). Provider accounts only *link* to a UUID;\n+//! the UUID is the canonical identity. Which providers are linked is private.\n \n use reqwest::Client;\n use serde::Deserialize;\n \n+use crate::reddit::{\n+    default_user_agent, reddit_oauth_api_base, reddit_oauth_token_base,\n+};\n+\n+// ── GitHub ──────────────────────────────────────────────────────────────────\n+\n #[derive(Debug, Clone)]\n pub struct GitHubConfig {\n     pub client_id: String,\n@@ -40,7 +47,7 @@ impl GitHubConfig {\n }\n \n #[derive(Debug, Deserialize)]\n-struct TokenResponse {\n+struct GitHubTokenResponse {\n     access_token: String,\n }\n \n@@ -50,7 +57,7 @@ pub struct GitHubUser {\n     pub login: String,\n }\n \n-pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n+pub fn github_authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n     let mut url = format!(\n         \"{}/login/oauth/authorize?client_id={}&redirect_uri={}&scope=read:user&state={}\",\n         cfg.oauth_base.trim_end_matches('/'),\n@@ -65,7 +72,7 @@ pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -\n     url\n }\n \n-pub async fn exchange_code(\n+pub async fn github_exchange_code(\n     client: &Client,\n     cfg: &GitHubConfig,\n     code: &str,\n@@ -90,14 +97,14 @@ pub async fn exchange_code(\n         return Err(format!(\"github token HTTP {}\", resp.status()));\n     }\n \n-    let body: TokenResponse = resp\n+    let body: GitHubTokenResponse = resp\n         .json()\n         .await\n         .map_err(|e| format!(\"github token parse failed: {e}\"))?;\n     Ok(body.access_token)\n }\n \n-pub async fn fetch_user(\n+pub async fn github_fetch_user(\n     client: &Client,\n     api_base: &str,\n     access_token: &str,\n@@ -120,10 +127,149 @@ pub async fn fetch_user(\n         .map_err(|e| format!(\"github user parse failed: {e}\"))\n }\n \n-pub fn provider_id(user: &GitHubUser) -> String {\n+pub fn github_provider_id(user: &GitHubUser) -> String {\n     user.id.to_string()\n }\n \n+// ── Reddit ──────────────────────────────────────────────────────────────────\n+\n+#[derive(Debug, Clone)]\n+pub struct RedditConfig {\n+    pub client_id: String,\n+    pub client_secret: String,\n+    pub redirect_uri: String,\n+    /// Host for `/api/v1/authorize` (www.reddit.com in production).\n+    pub authorize_base: String,\n+    /// Host for `POST /api/v1/access_token`.\n+    pub token_base: String,\n+    /// Host for bearer `GET /api/v1/me` (oauth.reddit.com).\n+    pub api_base: String,\n+    pub user_agent: String,\n+}\n+\n+/// Authorize page base; defaults to the same host as token POSTs.\n+pub fn reddit_authorize_base() -> String {\n+    std::env::var(\"REDDIT_OAUTH_AUTHORIZE_BASE\")\n+        .or_else(|_| std::env::var(\"REDDIT_OAUTH_BASE\"))\n+        .unwrap_or_else(|_| \"https://www.reddit.com\".into())\n+}\n+\n+impl RedditConfig {\n+    pub fn from_env(base_url: &str) -> Option<Self> {\n+        let client_id = std::env::var(\"REDDIT_CLIENT_ID\")\n+            .or_else(|_| std::env::var(\"REDDIT_APP_ID\"))\n+            .ok()?;\n+        let client_secret = std::env::var(\"REDDIT_CLIENT_SECRET\")\n+            .or_else(|_| std::env::var(\"REDDIT_APP_SECRET\"))\n+            .ok()?;\n+        if client_id.is_empty() || client_secret.is_empty() {\n+            return None;\n+        }\n+        let base = base_url.trim_end_matches('/');\n+        Some(Self {\n+            client_id,\n+            client_secret,\n+            redirect_uri: format!(\"{base}/auth/reddit/callback\"),\n+            authorize_base: reddit_authorize_base(),\n+            token_base: reddit_oauth_token_base(),\n+            api_base: reddit_oauth_api_base(),\n+            user_agent: default_user_agent(),\n+        })\n+    }\n+}\n+\n+#[derive(Debug, Deserialize)]\n+struct RedditTokenResponse {\n+    access_token: String,\n+}\n+\n+#[derive(Debug, Deserialize)]\n+pub struct RedditUser {\n+    /// Stable id (`t2_…`); never use `name` as identity.\n+    pub id: String,\n+    pub name: String,\n+}\n+\n+pub fn reddit_authorize_url(cfg: &RedditConfig, state: &str, mock_user: Option<&str>) -> String {\n+    let mut url = format!(\n+        \"{}/api/v1/authorize?client_id={}&response_type=code&state={}&redirect_uri={}&duration=temporary&scope=identity\",\n+        cfg.authorize_base.trim_end_matches('/'),\n+        urlencoding::encode(&cfg.client_id),\n+        urlencoding::encode(state),\n+        urlencoding::encode(&cfg.redirect_uri),\n+    );\n+    if let Some(user) = mock_user {\n+        url.push_str(\"&mock_user=\");\n+        url.push_str(&urlencoding::encode(user));\n+    }\n+    url\n+}\n+\n+pub async fn reddit_exchange_code(\n+    client: &Client,\n+    cfg: &RedditConfig,\n+    code: &str,\n+) -> Result<String, String> {\n+    let resp = client\n+        .post(format!(\n+            \"{}/api/v1/access_token\",\n+            cfg.token_base.trim_end_matches('/')\n+        ))\n+        .header(\"User-Agent\", &cfg.user_agent)\n+        .basic_auth(&cfg.client_id, Some(&cfg.client_secret))\n+        .form(&[\n+            (\"grant_type\", \"authorization_code\"),\n+            (\"code\", code),\n+            (\"redirect_uri\", cfg.redirect_uri.as_str()),\n+        ])\n+        .send()\n+        .await\n+        .map_err(|e| format!(\"reddit token request failed: {e}\"))?;\n+\n+    if !resp.status().is_success() {\n+        let status = resp.status();\n+        let body = resp.text().await.unwrap_or_default();\n+        return Err(format!(\"reddit token HTTP {status}: {body}\"));\n+    }\n+\n+    let body: RedditTokenResponse = resp\n+        .json()\n+        .await\n+        .map_err(|e| format!(\"reddit token parse failed: {e}\"))?;\n+    Ok(body.access_token)\n+}\n+\n+pub async fn reddit_fetch_user(\n+    client: &Client,\n+    cfg: &RedditConfig,\n+    access_token: &str,\n+) -> Result<RedditUser, String> {\n+    let resp = client\n+        .get(format!(\n+            \"{}/api/v1/me\",\n+            cfg.api_base.trim_end_matches('/')\n+        ))\n+        .header(\"User-Agent\", &cfg.user_agent)\n+        .bearer_auth(access_token)\n+        .send()\n+        .await\n+        .map_err(|e| format!(\"reddit user request failed: {e}\"))?;\n+\n+    if !resp.status().is_success() {\n+        return Err(format!(\"reddit user HTTP {}\", resp.status()));\n+    }\n+\n+    resp.json()\n+        .await\n+        .map_err(|e| format!(\"reddit user parse failed: {e}\"))\n+}\n+\n+pub fn reddit_provider_id(user: &RedditUser) -> String {\n+    user.id.clone()\n+}\n+\n+// ── Shared helpers ──────────────────────────────────────────────────────────\n+\n pub fn validate_pseudonym(raw: &str) -> Result<String, &'static str> {\n     let trimmed = raw.trim();\n     if trimmed.is_empty() {\n@@ -144,3 +290,12 @@ pub fn validate_pseudonym(raw: &str) -> Result<String, &'static str> {\n pub fn sanitize_pseudonym(login: &str) -> String {\n     validate_pseudonym(login).unwrap_or_else(|_| \"user\".to_string())\n }\n+\n+/// Display name for a provider key (`github` → `GitHub`). Never show provider ids.\n+pub fn provider_label(provider: &str) -> &'static str {\n+    match provider {\n+        \"github\" => \"GitHub\",\n+        \"reddit\" => \"Reddit\",\n+        _ => \"OAuth\",\n+    }\n+}\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex 84f2565b105fb302241b949af64bd5e49916eab2..0d948af1457504fdbd34d0b14261f65ac58da0ec 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -47,6 +47,8 @@ pub fn create_app(state: AppState) -> Router {\n         .route(\"/login/alias\", get(crate::auth::alias_page))\n         .route(\"/auth/github\", get(crate::auth::github_start))\n         .route(\"/auth/github/callback\", get(crate::auth::github_callback))\n+        .route(\"/auth/reddit\", get(crate::auth::reddit_start))\n+        .route(\"/auth/reddit/callback\", get(crate::auth::reddit_callback))\n         .route(\"/auth/logout\", post(crate::auth::logout))\n         .route(\"/auth/switch\", post(crate::auth::switch_pseudonym))\n         .route(\"/ui\", post(crate::api::ui_html::post_ui_html))\ndiff --git a/server/src/projection_apply.rs b/server/src/projection_apply.rs\nindex 4fb4b48ee0a53b7f673fae0c9731eed5acc33332..f50458c2ff3c447a3cfd28adb298e6883a2da4e9 100644\n--- a/server/src/projection_apply.rs\n+++ b/server/src/projection_apply.rs\n@@ -4,6 +4,8 @@\n //! child links, recent-vote appends) plus a cursor advance, all committed in\n //! one atomic `DisableWal` batch.\n \n+use std::collections::HashMap;\n+\n use crate::{\n     event_log::EventLogError,\n     events::{Event, EventRecord},\n@@ -44,6 +46,8 @@ pub fn apply_records(\n     let db = projection_store.db();\n     let mut batch = db.batch();\n     let mut last_seq = 0u64;\n+    // Weight reads must see earlier writes in this same batch.\n+    let mut pending_weights: HashMap<String, f64> = HashMap::new();\n \n     for record in records {\n         match &record.event {\n@@ -85,6 +89,7 @@ pub fn apply_records(\n                 ensure_path_writes(&mut batch, &parsed);\n             }\n             Event::PrincipalCreated { uuid, .. } => {\n+                pending_weights.insert(uuid.clone(), BASE_TRUST_WEIGHT);\n                 batch.write(\n                     Store::root()\n                         .user_weights()\n@@ -112,17 +117,25 @@ pub fn apply_records(\n                     }\n                 } else {\n                     batch.write(Store::root().oauth_links().key(&link_key).set(uuid));\n-                    let current = Store::root()\n-                        .user_weights()\n-                        .key(&uuid.clone())\n-                        .get(db)\n-                        .map_err(|e| EventLogError::Apply(e.to_string()))?\n+                    let current = pending_weights\n+                        .get(uuid)\n+                        .copied()\n+                        .or_else(|| {\n+                            Store::root()\n+                                .user_weights()\n+                                .key(&uuid.clone())\n+                                .get(db)\n+                                .ok()\n+                                .flatten()\n+                        })\n                         .unwrap_or(BASE_TRUST_WEIGHT);\n+                    let next = trust_weight_after_link(current);\n+                    pending_weights.insert(uuid.clone(), next);\n                     batch.write(\n                         Store::root()\n                             .user_weights()\n                             .key(&uuid.clone())\n-                            .set(&trust_weight_after_link(current)),\n+                            .set(&next),\n                     );\n                 }\n             }\n@@ -205,6 +218,15 @@ mod tests {\n                 ),\n                 record(\n                     3,\n+                    Event::OauthLinked {\n+                        uuid: uuid.into(),\n+                        provider: \"reddit\".into(),\n+                        provider_id: \"t2_abc\".into(),\n+                        ts,\n+                    },\n+                ),\n+                record(\n+                    4,\n                     Event::PseudonymClaimed {\n                         uuid: uuid.into(),\n                         pseudonym: \"octocat\".into(),\n@@ -219,8 +241,12 @@ mod tests {\n             oauth_link_owner(store.db(), \"github\", \"42\").unwrap(),\n             Some(uuid.to_string())\n         );\n+        assert_eq!(\n+            crate::storage_schema::linked_providers_for_uuid(store.db(), uuid).unwrap(),\n+            vec![\"github\".to_string(), \"reddit\".to_string()]\n+        );\n         assert_eq!(resolve_actor_uuid(store.db(), \"octocat\").unwrap(), uuid);\n-        assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 1.5);\n+        assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 2.0);\n         let aliases = Store::root()\n             .user_pseudonyms()\n             .key(&uuid.to_string())\ndiff --git a/server/src/storage_schema.rs b/server/src/storage_schema.rs\nindex b942810afd96d3bf01b7765718303a39be4ef8d2..dac6f8e6080e3f5683c24dbb8861f5a981d456c4 100644\n--- a/server/src/storage_schema.rs\n+++ b/server/src/storage_schema.rs\n@@ -103,6 +103,25 @@ pub fn oauth_link_owner(db: &Db, provider: &str, provider_id: &str) -> durable::\n         .get(db)\n }\n \n+/// Provider names linked to a UUID (`github`, `reddit`, …). Private — for the\n+/// account owner's page only; never expose which providers are linked publicly.\n+pub fn linked_providers_for_uuid(db: &Db, uuid: &str) -> durable::Result<Vec<String>> {\n+    let mut providers = Vec::new();\n+    for (key, owner) in Store::root().oauth_links().iter(db)? {\n+        if owner != uuid {\n+            continue;\n+        }\n+        let Some((provider, _)) = key.split_once(':') else {\n+            continue;\n+        };\n+        if !providers.iter().any(|p| p == provider) {\n+            providers.push(provider.to_string());\n+        }\n+    }\n+    providers.sort();\n+    Ok(providers)\n+}\n+\n pub const RECENT_VOTES_CAP: u64 = 200;\n \n fn id_key(id: &ItemId) -> String {\ndiff --git a/test/support/harness.clj b/test/support/harness.clj\nindex 4505ece5aa193e826ca61c52f1467d252080d66b..741024aab1d14269e225791189633287980ae2e4 100644\n--- a/test/support/harness.clj\n+++ b/test/support/harness.clj\n@@ -48,12 +48,15 @@\n          \"GITHUB_CLIENT_SECRET\" \"test-secret\"\n          \"GITHUB_OAUTH_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n          \"GITHUB_API_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n+         ;; Reddit import fixtures + Reddit OAuth on reddit-port.\n          \"REDDIT_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_CLIENT_ID\" \"test-reddit\"\n+         \"REDDIT_CLIENT_SECRET\" \"test-reddit-secret\"\n          \"REDDIT_OAUTH_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n-         \"REDDIT_CLIENT_ID\" \"\"\n-         \"REDDIT_CLIENT_SECRET\" \"\"\n-         \"REDDIT_APP_ID\" \"\"\n-         \"REDDIT_APP_SECRET\" \"\"}))\n+         \"REDDIT_OAUTH_AUTHORIZE_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_OAUTH_TOKEN_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_OAUTH_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_USER_AGENT\" \"web:sorter2-test:v0 (by /u/test)\"}))\n \n (defn with-auth-servers\n   \"Start mock Reddit + mock OAuth + release sorter2-server.\ndiff --git a/test/support/mock_oauth.clj b/test/support/mock_oauth.clj\nindex 909d7a7be8b159ea54a122d69c46af3db3318118..5ba7e9be3cf6d2226648e9609a09ed45f306930f 100644\n--- a/test/support/mock_oauth.clj\n+++ b/test/support/mock_oauth.clj\n@@ -1,5 +1,5 @@\n (ns test.support.mock-oauth\n-  \"In-process HTTP stub for GitHub OAuth (authorize, token, /user).\"\n+  \"In-process HTTP stub for GitHub + Reddit OAuth (authorize, token, user).\"\n   (:require [clojure.string :as str])\n   (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n            [java.net InetSocketAddress URLDecoder]))\n@@ -12,11 +12,14 @@\n                 (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n           (str/split query #\"&\"))))\n \n-(defn- parse-mock-user [raw]\n+(defn- parse-mock-user\n+  \"GitHub-style `id:login` (numeric id). Reddit-style `t2_xxx:name`.\"\n+  [raw]\n   (let [s (or raw \"1002:newbie\")\n         [id login] (str/split s #\":\" 2)]\n-    {:id (Long/parseLong id)\n-     :login (or login \"newbie\")}))\n+    {:id id\n+     :login (or login \"newbie\")\n+     :numeric? (re-matches #\"\\d+\" id)}))\n \n (defn- send-json [^HttpExchange ex status body]\n   (let [bytes (.getBytes body \"UTF-8\")]\n@@ -31,9 +34,10 @@\n   (.sendResponseHeaders ex 302 -1)\n   (.close (.getResponseBody ex)))\n \n-(defn- read-form-code [^HttpExchange ex]\n+(defn- read-form [^HttpExchange ex]\n   (let [body (slurp (.getInputStream ex))]\n-    (query-param body \"code\")))\n+    {:code (query-param body \"code\")\n+     :grant (query-param body \"grant_type\")}))\n \n (defn- bearer-token [^HttpExchange ex]\n   (some-> (.getRequestHeaders ex)\n@@ -44,8 +48,18 @@\n   (when (str/starts-with? token \"mock:\")\n     (parse-mock-user (subs token 5))))\n \n+(defn- authorize-redirect [exchange query]\n+  (let [redirect-uri (query-param query \"redirect_uri\")\n+        state (query-param query \"state\")\n+        mock-user (query-param query \"mock_user\")\n+        user (parse-mock-user mock-user)\n+        code (str \"mock:\" (:id user) \":\" (:login user))\n+        loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+                 \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+    (send-redirect exchange loc)))\n+\n (defn start-mock-oauth\n-  \"Start mock GitHub OAuth on `port`. Returns a zero-arg `stop` function.\"\n+  \"Start mock GitHub + Reddit OAuth on `port`. Returns a zero-arg `stop` function.\"\n   [port]\n   (let [server (HttpServer/create (InetSocketAddress. \"127.0.0.1\" port) 0)\n         handler\n@@ -53,28 +67,45 @@\n           (handle [^HttpExchange exchange]\n             (let [uri (.getRequestURI exchange)\n                   path (.getPath uri)\n-                  query (.getQuery uri)]\n+                  query (.getQuery uri)\n+                  method (.getRequestMethod exchange)]\n               (cond\n+                ;; GitHub authorize\n                 (str/ends-with? path \"/login/oauth/authorize\")\n-                (let [redirect-uri (query-param query \"redirect_uri\")\n-                      state (query-param query \"state\")\n-                      mock-user (query-param query \"mock_user\")\n-                      user (parse-mock-user mock-user)\n-                      code (str \"mock:\" (:id user) \":\" (:login user))\n-                      loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n-                               \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n-                  (send-redirect exchange loc))\n+                (authorize-redirect exchange query)\n+\n+                ;; Reddit authorize\n+                (str/ends-with? path \"/api/v1/authorize\")\n+                (authorize-redirect exchange query)\n \n-                (str/ends-with? path \"/login/oauth/access_token\")\n-                (let [code (or (read-form-code exchange) \"mock:1002:newbie\")]\n+                ;; GitHub token\n+                (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n+                (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n                   (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n \n+                ;; Reddit token (client_credentials for import + authorization_code for login)\n+                (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+                (let [form (read-form exchange)\n+                      grant (or (:grant form) \"\")\n+                      code (or (:code form) \"mock:t2_test:redditor\")]\n+                  (if (= grant \"client_credentials\")\n+                    (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+                    (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+                ;; GitHub user\n                 (= path \"/user\")\n                 (let [token (bearer-token exchange)\n-                      user (or (parse-token-user token) {:id 1002 :login \"newbie\"})]\n+                      user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n                   (send-json exchange 200\n                              (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n \n+                ;; Reddit /api/v1/me\n+                (str/ends-with? path \"/api/v1/me\")\n+                (let [token (bearer-token exchange)\n+                      user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n+                  (send-json exchange 200\n+                             (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n                 :else\n                 (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))))]\n     (.createContext server \"/\" handler)\ndiff --git a/test/support/mock_reddit.clj b/test/support/mock_reddit.clj\nindex 5efa92db3e1f79b8f423a2f1adcbda959123c1ad..a630cf0938722193e9af88382d60e777ff371be4 100644\n--- a/test/support/mock_reddit.clj\n+++ b/test/support/mock_reddit.clj\n@@ -1,14 +1,56 @@\n (ns test.support.mock-reddit\n-  \"In-process HTTP stub for Reddit API fixtures (`test/fixtures/reddit/`).\"\n+  \"In-process HTTP stub for Reddit API fixtures + OAuth login endpoints.\"\n   (:require [clojure.java.io :as io]\n             [clojure.string :as str])\n   (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n-           [java.net InetSocketAddress]))\n+           [java.net InetSocketAddress URLDecoder]))\n \n (defn fixtures-dir\n   ([] (fixtures-dir (System/getProperty \"user.dir\")))\n   ([root] (str root \"/test/fixtures/reddit\")))\n \n+(defn- query-param [query key]\n+  (when query\n+    (some (fn [pair]\n+            (let [[k v] (str/split pair \"=\" 2)]\n+              (when (= k key)\n+                (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n+          (str/split query #\"&\"))))\n+\n+(defn- parse-mock-user [raw]\n+  (let [s (or raw \"t2_test:redditor\")\n+        [id login] (str/split s #\":\" 2)]\n+    {:id id :login (or login \"redditor\")}))\n+\n+(defn- send-bytes [^HttpExchange ex status ^bytes body content-type]\n+  (.set (.getResponseHeaders ex) \"Content-Type\" content-type)\n+  (.sendResponseHeaders ex status (alength body))\n+  (doto (.getResponseBody ex)\n+    (.write body)\n+    (.close)))\n+\n+(defn- send-json [^HttpExchange ex status body]\n+  (send-bytes ex status (.getBytes body \"UTF-8\") \"application/json\"))\n+\n+(defn- send-redirect [^HttpExchange ex location]\n+  (.set (.getResponseHeaders ex) \"Location\" location)\n+  (.sendResponseHeaders ex 302 -1)\n+  (.close (.getResponseBody ex)))\n+\n+(defn- read-form [^HttpExchange ex]\n+  (let [body (slurp (.getInputStream ex))]\n+    {:code (query-param body \"code\")\n+     :grant (query-param body \"grant_type\")}))\n+\n+(defn- bearer-token [^HttpExchange ex]\n+  (some-> (.getRequestHeaders ex)\n+          (.getFirst \"Authorization\")\n+          (str/replace #\"^[Bb]earer \" \"\")))\n+\n+(defn- parse-token-user [token]\n+  (when (str/starts-with? token \"mock:\")\n+    (parse-mock-user (subs token 5))))\n+\n (defn start-mock-reddit\n   \"Start a mock Reddit API on `port`. Returns a zero-arg `stop` function.\"\n   ([port] (start-mock-reddit port (fixtures-dir)))\n@@ -19,15 +61,38 @@\n          handler\n          (proxy [HttpHandler] []\n            (handle [^HttpExchange exchange]\n-             ;; `/r/<sub>/about.json` → subreddit entity; `/r/<sub>.json` → listing.\n-             (let [path (.getPath (.getRequestURI exchange))\n-                   body (if (str/includes? path \"/about\")\n-                          about\n-                          listing)]\n-               (.sendResponseHeaders exchange 200 (alength body))\n-               (let [out (.getResponseBody exchange)]\n-                 (.write out body)\n-                 (.close out)))))]\n+             (let [uri (.getRequestURI exchange)\n+                   path (.getPath uri)\n+                   query (.getQuery uri)\n+                   method (.getRequestMethod exchange)]\n+               (cond\n+                 (str/ends-with? path \"/api/v1/authorize\")\n+                 (let [redirect-uri (query-param query \"redirect_uri\")\n+                       state (query-param query \"state\")\n+                       user (parse-mock-user (query-param query \"mock_user\"))\n+                       code (str \"mock:\" (:id user) \":\" (:login user))\n+                       loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+                                \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+                   (send-redirect exchange loc))\n+\n+                 (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+                 (let [form (read-form exchange)\n+                       grant (or (:grant form) \"\")\n+                       code (or (:code form) \"mock:t2_test:redditor\")]\n+                   (if (= grant \"client_credentials\")\n+                     (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+                     (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+                 (str/ends-with? path \"/api/v1/me\")\n+                 (let [user (or (parse-token-user (bearer-token exchange))\n+                                {:id \"t2_test\" :login \"redditor\"})]\n+                   (send-json exchange 200\n+                              (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n+                 ;; `/r/<sub>/about.json` → subreddit entity; `/r/<sub>.json` → listing.\n+                 :else\n+                 (let [body (if (str/includes? path \"/about\") about listing)]\n+                   (send-bytes exchange 200 body \"application/json\"))))))]\n      (.createContext server \"/\" handler)\n      (.setExecutor server nil)\n      (.start server)\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[23c8134e] Fix /-/ external garden index; resolvers/ + GitHub import cards (#150)\n\n* Fix external garden root listing; add resolvers/ with GitHub cards\n\nThe public and room external index pages queried children of a bogus\nhttps://./ parent, so /-/ always looked empty. Collect host-only https\nroots from all Web items and item_children edges so ghost parents from\nadd_child_edge appear.\n\nMove GitHub resolver into server/src/resolvers/ with default_external.rs\nand a try_render_resolver_item_body hook. Resolver ingests now store\nslug-github-card fenced JSON; render_item_body_in_scope shows a small\nGitHub article card (with legacy support for schema-less json fences on\ngithub.com URLs). Styling in theme_default.css; agents.md updated.\n\nCo-authored-by: tommy <thmorriss@gmail.com>\n\n* Vote compare: GitHub cards in columns, layout CSS, tests\n\nPass item_bodies into vote_compare_item_card for linkified tooltips on\nnon-card bodies; clone item_bodies before dropping reducer read guard.\n\nAdd layout rules so rich cards sit in the grid corners (default + retro).\n\nUnit test on vote_compare_item_card; integration GET /vote/compare with\ningested slug-github-card bodies. agents.md clarifies compare columns.\n\nCo-authored-by: tommy <thmorriss@gmail.com>\n\n---------\n\nCo-authored-by: Cursor Agent <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/agents.md b/agents.md\nindex 7508234d9b04223d0e64cfe69fedbebd06a256b5..d8b801e454fdf37e7ac6038b91a69f83b0746d59 100644\n--- a/agents.md\n+++ b/agents.md\n@@ -42,7 +42,7 @@ Strict **CSP** that blocks `eval` would break the current app. Other projects ma\n \n - **`VoteComparePost`:** On success returns **`text/javascript`** that **morphs** **`#vote-edge-history-region`** (recomputed **`<ul>`** — ratios match **`left`/`right`** query order, bullets, sorted by strength toward **`left`** then newer) and **`.vote-compare-nav`** (fresh next-pair link). The compare **`GET`** page uses **`layout_full_bleed_chromeless`** (no breadcrumbs, no **`#controls`**, no **`slug-pin-hud`**; **`view-vote-compare-fullscreen`** full-width **`body`**). **`__rpc__`** carries **`form_action: \"/ui\"`**; **`thread_tag`** and ratio fields come from the same form as **`$form`** holes.\n \n-- **`ResolveExternal`:** GitHub resolver buttons are browser actions through **`POST /ui`**. Success responses morph **`#external-resolver-status`** then redirect to the sanitized shareable **`GET`** page so imported children render through the normal page path; errors morph the same status region. Resolver results are durable system ingests, while cooldown state is RAM-only.\n+- **`ResolveExternal`:** GitHub resolver buttons are browser actions through **`POST /ui`**. Success responses morph **`#external-resolver-status`** then redirect to the sanitized shareable **`GET`** page so imported children render through the normal page path; errors morph the same status region. Resolver results are durable system ingests, while cooldown state is RAM-only. Implementation lives under **`server/src/resolvers/`** (GitHub resolver + import card JSON); ontology item pages and the **`GET /vote/compare`** left/right columns use **`render_item_body_in_scope`** in **`server/src/html/mod.rs`**, which calls **`server/src/resolvers/mod.rs::try_render_resolver_item_body`** before falling back to the usual **`<pre>`** linkified view.\n \n - **Garden pin / compare voting:** Cookie **`slug_garden_pin`** via **`set_garden_pin`**. Pairwise UI: **`GET /vote/compare?…`** / **`GET /r/:room_key/vote/compare?…`** (fullscreen **`GET`** page: no HUD; other garden pages). HUD (**`#slug-pin-hud`**): only when **`layout`** passes garden metadata on **`body`**; the label is **`POST /ui`** **`set_garden_pin`** **`clear:true`** (**`slug_ui.js`**), not a permalink to the item.\n \ndiff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs\nindex 4b0214d18b173cd506d09176104f461dc4c4f208..c9eb8e242072e41fcf70da838bdf02dd4c838db8 100644\n--- a/server/src/api/ui_html.rs\n+++ b/server/src/api/ui_html.rs\n@@ -18,7 +18,7 @@ use crate::{\n         rpc::{rpc_post_redact, rpc_post_with_bearer, rpc_room_delete},\n     },\n     canonical_path::canonicalize_tag,\n-    external_resolver::resolve_github_children,\n+    resolvers::resolve_github_children,\n     html::vote_compare_post_success_js,\n     html::{\n         external_resolver_status_markup, fragment_new_thread_slot, login_to_post_hint_markup,\ndiff --git a/server/src/external_resolver.rs b/server/src/external_resolver.rs\ndeleted file mode 100644\nindex a5812250fed7613950b5417f396f886a55fafccf..0000000000000000000000000000000000000000\n--- a/server/src/external_resolver.rs\n+++ /dev/null\n@@ -1,630 +0,0 @@\n-use async_trait::async_trait;\n-use serde_json::Value;\n-use tokio::sync::oneshot;\n-\n-use crate::{path_types::ItemId, state::AppState, write_cmd::WriteCmd};\n-\n-const GITHUB_SYSTEM_PRINCIPAL: &str = \"system:github-resolver\";\n-const GITHUB_RESOLVER_COOLDOWN_MS: i64 = 15_000;\n-const GITHUB_MAX_PAGES: usize = 3;\n-\n-fn now_ms() -> i64 {\n-    use std::time::{SystemTime, UNIX_EPOCH};\n-    SystemTime::now()\n-        .duration_since(UNIX_EPOCH)\n-        .unwrap_or_default()\n-        .as_millis() as i64\n-}\n-\n-#[derive(Debug, Clone, PartialEq, Eq)]\n-pub struct ResolvedChild {\n-    pub url: String,\n-    pub title: String,\n-    pub body: Option<String>,\n-}\n-\n-#[async_trait]\n-pub trait ExternalResolver: Send + Sync {\n-    /// e.g. `\"github.com\"`\n-    fn domain_match(&self) -> &'static str;\n-\n-    /// Normalizes URLs (e.g. stripping fragments); extend per-domain later.\n-    fn normalize(&self, path: &str) -> String;\n-\n-    /// Fetches body when missing; GitHub hook lands here in a follow-up.\n-    async fn fetch_body(&self, item: &ItemId) -> Result<String, String>;\n-}\n-\n-#[derive(Clone)]\n-pub struct GitHubResolver {\n-    client: reqwest::Client,\n-    api_base_url: String,\n-    token: Option<String>,\n-}\n-\n-impl GitHubResolver {\n-    pub fn from_env() -> Self {\n-        let api_base_url = std::env::var(\"SLUG_GITHUB_API_BASE_URL\")\n-            .ok()\n-            .filter(|s| !s.trim().is_empty())\n-            .unwrap_or_else(|| \"https://api.github.com\".to_string());\n-        let token = std::env::var(\"SLUG_GITHUB_TOKEN\")\n-            .ok()\n-            .filter(|s| !s.trim().is_empty());\n-        Self {\n-            client: reqwest::Client::new(),\n-            api_base_url: api_base_url.trim_end_matches('/').to_string(),\n-            token,\n-        }\n-    }\n-\n-    pub fn can_resolve_children(&self, item: &ItemId) -> bool {\n-        github_segments(item).is_some()\n-    }\n-\n-    pub async fn list_children(&self, item: &ItemId) -> Result<Vec<ResolvedChild>, String> {\n-        let segments = github_segments(item).ok_or_else(|| \"not a GitHub URL\".to_string())?;\n-        match segments.as_slice() {\n-            [] => Ok(vec![]),\n-            [owner] => self.list_repos(owner).await,\n-            [owner, repo] => Ok(github_repo_sections(owner, repo)),\n-            [owner, repo, section] if section == \"issues\" => self.list_issues(owner, repo).await,\n-            [owner, repo, section] if section == \"pulls\" => self.list_pulls(owner, repo).await,\n-            [owner, repo, section] if section == \"commits\" => self.list_commits(owner, repo).await,\n-            [owner, repo, section] if section == \"releases\" => {\n-                self.list_releases(owner, repo).await\n-            }\n-            _ => Ok(vec![]),\n-        }\n-    }\n-\n-    async fn get_json(&self, path: &str) -> Result<Value, String> {\n-        let url = format!(\"{}/{}\", self.api_base_url, path.trim_start_matches('/'));\n-        let mut req = self\n-            .client\n-            .get(url)\n-            .header(reqwest::header::USER_AGENT, \"slugsocial-github-resolver\");\n-        if let Some(token) = &self.token {\n-            req = req.bearer_auth(token);\n-        }\n-        let resp = req\n-            .send()\n-            .await\n-            .map_err(|e| format!(\"GitHub request failed: {e}\"))?;\n-        let status = resp.status();\n-        if !status.is_success() {\n-            return Err(format!(\"GitHub request returned {status}\"));\n-        }\n-        resp.json::<Value>()\n-            .await\n-            .map_err(|e| format!(\"GitHub response JSON failed: {e}\"))\n-    }\n-\n-    async fn get_json_array_pages(&self, path: &str) -> Result<Vec<Value>, String> {\n-        let sep = if path.contains('?') { '&' } else { '?' };\n-        let mut out = Vec::new();\n-        for page in 1..=GITHUB_MAX_PAGES {\n-            let value = self.get_json(&format!(\"{path}{sep}page={page}\")).await?;\n-            let arr = value\n-                .as_array()\n-                .ok_or_else(|| \"GitHub paged response was not an array\".to_string())?;\n-            let n = arr.len();\n-            out.extend(arr.iter().cloned());\n-            if n < 100 {\n-                break;\n-            }\n-        }\n-        Ok(out)\n-    }\n-\n-    async fn list_repos(&self, owner: &str) -> Result<Vec<ResolvedChild>, String> {\n-        let arr = self\n-            .get_json_array_pages(&format!(\n-                \"/users/{owner}/repos?per_page=100&sort=updated&type=owner\"\n-            ))\n-            .await?;\n-        let mut out = Vec::new();\n-        for repo in &arr {\n-            let name = repo\n-                .get(\"name\")\n-                .and_then(|v| v.as_str())\n-                .unwrap_or_default();\n-            if name.is_empty() {\n-                continue;\n-            }\n-            let full_name = repo\n-                .get(\"full_name\")\n-                .and_then(|v| v.as_str())\n-                .map(|s| s.to_ascii_lowercase())\n-                .unwrap_or_else(|| format!(\"{owner}/{name}\").to_ascii_lowercase());\n-            out.push(ResolvedChild {\n-                url: format!(\"https://github.com/{full_name}\"),\n-                title: full_name.clone(),\n-                body: Some(github_repo_body(repo)),\n-            });\n-        }\n-        out.sort_by(|a, b| a.url.cmp(&b.url));\n-        Ok(out)\n-    }\n-\n-    async fn list_issues(&self, owner: &str, repo: &str) -> Result<Vec<ResolvedChild>, String> {\n-        let arr = self\n-            .get_json_array_pages(&format!(\n-                \"/repos/{owner}/{repo}/issues?state=open&per_page=100\"\n-            ))\n-            .await?;\n-        let mut out = Vec::new();\n-        for issue in &arr {\n-            if issue.get(\"pull_request\").is_some() {\n-                continue;\n-            }\n-            let Some(number) = issue.get(\"number\").and_then(|v| v.as_i64()) else {\n-                continue;\n-            };\n-            let title = issue\n-                .get(\"title\")\n-                .and_then(|v| v.as_str())\n-                .unwrap_or(\"Untitled issue\");\n-            out.push(ResolvedChild {\n-                url: format!(\"https://github.com/{owner}/{repo}/issues/{number}\"),\n-                title: format!(\"#{number} {title}\"),\n-                body: Some(github_issue_body(issue, \"issue\")),\n-            });\n-        }\n-        out.sort_by(|a, b| a.url.cmp(&b.url));\n-        Ok(out)\n-    }\n-\n-    async fn list_pulls(&self, owner: &str, repo: &str) -> Result<Vec<ResolvedChild>, String> {\n-        let arr = self\n-            .get_json_array_pages(&format!(\n-                \"/repos/{owner}/{repo}/pulls?state=open&per_page=100\"\n-            ))\n-            .await?;\n-        let mut out = Vec::new();\n-        for pull in &arr {\n-            let Some(number) = pull.get(\"number\").and_then(|v| v.as_i64()) else {\n-                continue;\n-            };\n-            let title = pull\n-                .get(\"title\")\n-                .and_then(|v| v.as_str())\n-                .unwrap_or(\"Untitled pull request\");\n-            out.push(ResolvedChild {\n-                url: format!(\"https://github.com/{owner}/{repo}/pulls/{number}\"),\n-                title: format!(\"#{number} {title}\"),\n-                body: Some(github_issue_body(pull, \"pull request\")),\n-            });\n-        }\n-        out.sort_by(|a, b| a.url.cmp(&b.url));\n-        Ok(out)\n-    }\n-\n-    async fn list_commits(&self, owner: &str, repo: &str) -> Result<Vec<ResolvedChild>, String> {\n-        let arr = self\n-            .get_json_array_pages(&format!(\"/repos/{owner}/{repo}/commits?per_page=100\"))\n-            .await?;\n-        let mut out = Vec::new();\n-        for commit in &arr {\n-            let Some(sha) = github_string(commit, \"sha\") else {\n-                continue;\n-            };\n-            let short = sha.chars().take(7).collect::<String>();\n-            let title = commit\n-                .get(\"commit\")\n-                .and_then(|c| c.get(\"message\"))\n-                .and_then(|v| v.as_str())\n-                .and_then(|m| m.lines().next())\n-                .filter(|s| !s.trim().is_empty())\n-                .unwrap_or(\"commit\");\n-            let url = github_string(commit, \"html_url\")\n-                .map(|s| s.to_string())\n-                .unwrap_or_else(|| format!(\"https://github.com/{owner}/{repo}/commit/{sha}\"));\n-            out.push(ResolvedChild {\n-                url,\n-                title: format!(\"{short} {title}\"),\n-                body: Some(github_commit_body(commit)),\n-            });\n-        }\n-        out.sort_by(|a, b| a.url.cmp(&b.url));\n-        Ok(out)\n-    }\n-\n-    async fn list_releases(&self, owner: &str, repo: &str) -> Result<Vec<ResolvedChild>, String> {\n-        let arr = self\n-            .get_json_array_pages(&format!(\"/repos/{owner}/{repo}/releases?per_page=100\"))\n-            .await?;\n-        let mut out = Vec::new();\n-        for release in &arr {\n-            let Some(tag) = github_string(release, \"tag_name\") else {\n-                continue;\n-            };\n-            let title = github_string(release, \"name\").unwrap_or(tag);\n-            let url = github_string(release, \"html_url\")\n-                .map(|s| s.to_string())\n-                .unwrap_or_else(|| format!(\"https://github.com/{owner}/{repo}/releases/tag/{tag}\"));\n-            out.push(ResolvedChild {\n-                url,\n-                title: title.to_string(),\n-                body: Some(github_release_body(release)),\n-            });\n-        }\n-        out.sort_by(|a, b| a.url.cmp(&b.url));\n-        Ok(out)\n-    }\n-}\n-\n-fn github_segments(item: &ItemId) -> Option<Vec<String>> {\n-    let url = url::Url::parse(item.as_str()).ok()?;\n-    if url.host_str()?.eq_ignore_ascii_case(\"github.com\") {\n-        Some(\n-            url.path_segments()\n-                .map(|segments| {\n-                    segments\n-                        .filter(|s| !s.is_empty())\n-                        .map(|s| s.to_ascii_lowercase())\n-                        .collect::<Vec<_>>()\n-                })\n-                .unwrap_or_default(),\n-        )\n-    } else {\n-        None\n-    }\n-}\n-\n-fn github_repo_sections(owner: &str, repo: &str) -> Vec<ResolvedChild> {\n-    [\n-        (\"issues\", \"GitHub issues for this repository.\"),\n-        (\"pulls\", \"GitHub pull requests for this repository.\"),\n-        (\"commits\", \"GitHub commits for this repository.\"),\n-        (\"releases\", \"GitHub releases for this repository.\"),\n-    ]\n-    .into_iter()\n-    .map(|(section, body)| ResolvedChild {\n-        url: format!(\"https://github.com/{owner}/{repo}/{section}\"),\n-        title: section.to_string(),\n-        body: Some(body.to_string()),\n-    })\n-    .collect()\n-}\n-\n-fn resolver_thread_tag(item: &ItemId) -> String {\n-    let tail = item\n-        .display_path()\n-        .trim_start_matches(\"-/\")\n-        .replace('/', \":\")\n-        .replace('?', \":\");\n-    format!(\"import:{tail}\")\n-}\n-\n-fn sanitize_body(s: &str) -> String {\n-    s.replace('{', \"(\")\n-        .replace('}', \")\")\n-        .replace(\"```\", \"` ` `\")\n-        .chars()\n-        .take(4_000)\n-        .collect()\n-}\n-\n-fn github_string<'a>(value: &'a Value, key: &str) -> Option<&'a str> {\n-    value\n-        .get(key)\n-        .and_then(|v| v.as_str())\n-        .filter(|s| !s.trim().is_empty())\n-}\n-\n-fn github_user_login(value: &Value) -> Option<&str> {\n-    value\n-        .get(\"user\")\n-        .and_then(|u| u.get(\"login\"))\n-        .and_then(|v| v.as_str())\n-        .filter(|s| !s.trim().is_empty())\n-}\n-\n-fn github_labels(value: &Value) -> Vec<String> {\n-    value\n-        .get(\"labels\")\n-        .and_then(|v| v.as_array())\n-        .into_iter()\n-        .flat_map(|labels| labels.iter())\n-        .filter_map(|label| label.get(\"name\").and_then(|v| v.as_str()))\n-        .filter(|name| !name.trim().is_empty())\n-        .map(|name| name.to_string())\n-        .collect()\n-}\n-\n-fn github_repo_body(repo: &Value) -> String {\n-    let full_name = github_string(repo, \"full_name\")\n-        .or_else(|| github_string(repo, \"name\"))\n-        .unwrap_or(\"GitHub repository\");\n-    let mut lines = vec![full_name.to_string()];\n-    if let Some(desc) = github_string(repo, \"description\") {\n-        lines.push(String::new());\n-        lines.push(desc.to_string());\n-    }\n-    if let Some(url) = github_string(repo, \"html_url\") {\n-        lines.push(String::new());\n-        lines.push(format!(\"Source: {url}\"));\n-    }\n-    if let Some(lang) = github_string(repo, \"language\") {\n-        lines.push(format!(\"Language: {lang}\"));\n-    }\n-    lines.join(\"\\n\")\n-}\n-\n-fn github_issue_body(issue: &Value, kind: &str) -> String {\n-    let number = issue\n-        .get(\"number\")\n-        .and_then(|v| v.as_i64())\n-        .map(|n| format!(\"#{n} \"))\n-        .unwrap_or_default();\n-    let title = github_string(issue, \"title\").unwrap_or(\"Untitled\");\n-    let state = github_string(issue, \"state\").unwrap_or(\"unknown\");\n-    let mut lines = vec![format!(\"{kind} {number}{title}\")];\n-    lines.push(format!(\"State: {state}\"));\n-    if let Some(author) = github_user_login(issue) {\n-        lines.push(format!(\"Author: @{author}\"));\n-    }\n-    let labels = github_labels(issue);\n-    if !labels.is_empty() {\n-        lines.push(format!(\"Labels: {}\", labels.join(\", \")));\n-    }\n-    if let Some(url) = github_string(issue, \"html_url\") {\n-        lines.push(format!(\"Source: {url}\"));\n-    }\n-    if let Some(body) = github_string(issue, \"body\") {\n-        lines.push(String::new());\n-        lines.push(body.to_string());\n-    }\n-    lines.join(\"\\n\")\n-}\n-\n-fn github_commit_body(commit: &Value) -> String {\n-    let sha = github_string(commit, \"sha\").unwrap_or(\"unknown\");\n-    let short = sha.chars().take(7).collect::<String>();\n-    let commit_obj = commit.get(\"commit\");\n-    let message = commit_obj\n-        .and_then(|c| c.get(\"message\"))\n-        .and_then(|v| v.as_str())\n-        .unwrap_or(\"commit\");\n-    let mut lines = vec![format!(\"commit {short}\")];\n-    if let Some(author) = commit_obj\n-        .and_then(|c| c.get(\"author\"))\n-        .and_then(|a| a.get(\"name\"))\n-        .and_then(|v| v.as_str())\n-        .filter(|s| !s.trim().is_empty())\n-    {\n-        lines.push(format!(\"Author: {author}\"));\n-    }\n-    if let Some(login) = github_user_login(commit) {\n-        lines.push(format!(\"GitHub user: @{login}\"));\n-    }\n-    if let Some(date) = commit_obj\n-        .and_then(|c| c.get(\"author\"))\n-        .and_then(|a| a.get(\"date\"))\n-        .and_then(|v| v.as_str())\n-    {\n-        lines.push(format!(\"Date: {date}\"));\n-    }\n-    if let Some(url) = github_string(commit, \"html_url\") {\n-        lines.push(format!(\"Source: {url}\"));\n-    }\n-    lines.push(String::new());\n-    lines.push(message.to_string());\n-    lines.join(\"\\n\")\n-}\n-\n-fn github_release_body(release: &Value) -> String {\n-    let tag = github_string(release, \"tag_name\").unwrap_or(\"untagged\");\n-    let title = github_string(release, \"name\").unwrap_or(tag);\n-    let mut lines = vec![format!(\"release {title}\")];\n-    lines.push(format!(\"Tag: {tag}\"));\n-    if release\n-        .get(\"draft\")\n-        .and_then(|v| v.as_bool())\n-        .unwrap_or(false)\n-    {\n-        lines.push(\"Draft: yes\".to_string());\n-    }\n-    if release\n-        .get(\"prerelease\")\n-        .and_then(|v| v.as_bool())\n-        .unwrap_or(false)\n-    {\n-        lines.push(\"Prerelease: yes\".to_string());\n-    }\n-    if let Some(author) = github_user_login(release) {\n-        lines.push(format!(\"Author: @{author}\"));\n-    }\n-    if let Some(published) = github_string(release, \"published_at\") {\n-        lines.push(format!(\"Published: {published}\"));\n-    }\n-    if let Some(url) = github_string(release, \"html_url\") {\n-        lines.push(format!(\"Source: {url}\"));\n-    }\n-    if let Some(body) = github_string(release, \"body\") {\n-        lines.push(String::new());\n-        lines.push(body.to_string());\n-    }\n-    lines.join(\"\\n\")\n-}\n-\n-fn children_to_dsl(children: &[ResolvedChild]) -> String {\n-    let mut out = String::new();\n-    for child in children {\n-        let body = child\n-            .body\n-            .as_deref()\n-            .filter(|s| !s.trim().is_empty())\n-            .unwrap_or(child.title.as_str());\n-        if body.trim_start().starts_with(\"```\") {\n-            out.push_str(&format!(\"{} {{\\n{}\\n}}\\n\\n\", child.url, body.trim()));\n-        } else {\n-            out.push_str(&format!(\n-                \"{} {{\\n{}\\n}}\\n\\n\",\n-                child.url,\n-                sanitize_body(body)\n-            ));\n-        }\n-    }\n-    out\n-}\n-\n-pub async fn resolve_github_children(\n-    state: &AppState,\n-    room: &str,\n-    item: &ItemId,\n-) -> Result<usize, String> {\n-    if !state.github_resolver.can_resolve_children(item) {\n-        return Err(\"no GitHub resolver for this item\".to_string());\n-    }\n-\n-    let key = format!(\"github:{}:{}\", room.trim(), item.as_str());\n-    let now = now_ms();\n-    {\n-        let mut runs = state.resolver_runs.write().await;\n-        if let Some(last) = runs.get(&key) {\n-            let remaining = GITHUB_RESOLVER_COOLDOWN_MS - (now - *last);\n-            if remaining > 0 {\n-                return Err(format!(\n-                    \"GitHub resolver cooldown: try again in {}s\",\n-                    (remaining + 999) / 1000\n-                ));\n-            }\n-        }\n-        runs.insert(key, now);\n-    }\n-\n-    let children = state.github_resolver.list_children(item).await?;\n-    if children.is_empty() {\n-        return Ok(0);\n-    }\n-    let text = children_to_dsl(&children);\n-    let thread_tag = resolver_thread_tag(item);\n-    let (tx, rx) = oneshot::channel();\n-    state\n-        .write_tx\n-        .send(WriteCmd::SystemIngest {\n-            room: room.to_string(),\n-            thread_tag,\n-            text,\n-            principal: GITHUB_SYSTEM_PRINCIPAL.to_string(),\n-            reply: tx,\n-        })\n-        .await\n-        .map_err(|_| \"writer unavailable\".to_string())?;\n-    rx.await\n-        .map_err(|_| \"writer dropped\".to_string())?\n-        .map_err(|(msg, hint)| hint.map_or(msg.clone(), |h| format!(\"{msg}: {h}\")))?;\n-    Ok(children.len())\n-}\n-\n-/// Placeholder until other domain-specific resolvers exist.\n-pub struct DefaultExternalResolver;\n-\n-#[async_trait]\n-impl ExternalResolver for DefaultExternalResolver {\n-    fn domain_match(&self) -> &'static str {\n-        \"\"\n-    }\n-\n-    fn normalize(&self, path: &str) -> String {\n-        path.to_string()\n-    }\n-\n-    async fn fetch_body(&self, _item: &ItemId) -> Result<String, String> {\n-        Err(\"external fetch not implemented\".to_string())\n-    }\n-}\n-\n-#[cfg(test)]\n-mod tests {\n-    use super::*;\n-\n-    #[test]\n-    fn github_segments_parse_normalized_url() {\n-        let item = ItemId::parse(\"https://github.com/Sortersocial/Slug/issues\").unwrap();\n-        assert_eq!(\n-            github_segments(&item),\n-            Some(vec![\n-                \"sortersocial\".to_string(),\n-                \"slug\".to_string(),\n-                \"issues\".to_string()\n-            ])\n-        );\n-    }\n-\n-    #[test]\n-    fn repo_sections_are_direct_children() {\n-        let sections = github_repo_sections(\"sortersocial\", \"slug\");\n-        let urls: Vec<String> = sections.into_iter().map(|c| c.url).collect();\n-        assert!(urls.contains(&\"https://github.com/sortersocial/slug/issues\".to_string()));\n-        assert!(urls.contains(&\"https://github.com/sortersocial/slug/pulls\".to_string()));\n-    }\n-\n-    #[test]\n-    fn children_to_dsl_contains_item_bodies() {\n-        let dsl = children_to_dsl(&[ResolvedChild {\n-            url: \"https://github.com/o/r/issues/1\".into(),\n-            title: \"#1 title\".into(),\n-            body: Some(\"body with {braces}\".into()),\n-        }]);\n-        assert!(dsl.contains(\"https://github.com/o/r/issues/1\"));\n-        assert!(dsl.contains(\"body with (braces)\"));\n-    }\n-\n-    #[test]\n-    fn children_to_dsl_preserves_fenced_json_bodies() {\n-        let dsl = children_to_dsl(&[ResolvedChild {\n-            url: \"https://github.com/o/r/issues/1\".into(),\n-            title: \"#1 title\".into(),\n-            body: Some(\"```json\\n{\\\"test\\\": true}\\n```\".into()),\n-        }]);\n-        assert!(dsl.contains(\"https://github.com/o/r/issues/1 {\\n```json\"));\n-        assert!(dsl.contains(\"{\\\"test\\\": true}\"));\n-        assert!(dsl.contains(\"```\\n}\\n\"));\n-    }\n-\n-    #[test]\n-    fn github_issue_body_is_readable_text_not_json_dump() {\n-        let issue = serde_json::json!({\n-            \"number\": 12,\n-            \"title\": \"Render children\",\n-            \"state\": \"open\",\n-            \"html_url\": \"https://github.com/o/r/issues/12\",\n-            \"user\": {\"login\": \"octo\"},\n-            \"labels\": [{\"name\": \"bug\"}],\n-            \"body\": \"The issue body.\"\n-        });\n-        let body = github_issue_body(&issue, \"issue\");\n-        assert!(body.contains(\"issue #12 Render children\"));\n-        assert!(body.contains(\"Author: @octo\"));\n-        assert!(body.contains(\"The issue body.\"));\n-        assert!(!body.trim_start().starts_with(\"```json\"));\n-    }\n-\n-    #[test]\n-    fn github_commit_and_release_bodies_are_readable() {\n-        let commit = serde_json::json!({\n-            \"sha\": \"abcdef123456\",\n-            \"html_url\": \"https://github.com/o/r/commit/abcdef123456\",\n-            \"author\": {\"login\": \"octo\"},\n-            \"commit\": {\n-                \"message\": \"Fix vote page\\n\\nDetails here.\",\n-                \"author\": {\"name\": \"Octo Dev\", \"date\": \"2026-05-17T00:00:00Z\"}\n-            }\n-        });\n-        let release = serde_json::json!({\n-            \"tag_name\": \"v1.2.3\",\n-            \"name\": \"Release 1.2.3\",\n-            \"html_url\": \"https://github.com/o/r/releases/tag/v1.2.3\",\n-            \"author\": {\"login\": \"octo\"},\n-            \"prerelease\": true,\n-            \"body\": \"Release notes.\"\n-        });\n-        assert!(github_commit_body(&commit).contains(\"commit abcdef1\"));\n-        assert!(github_commit_body(&commit).contains(\"Fix vote page\"));\n-        assert!(github_release_body(&release).contains(\"release Release 1.2.3\"));\n-        assert!(github_release_body(&release).contains(\"Prerelease: yes\"));\n-    }\n-}\ndiff --git a/server/src/html/garden.rs b/server/src/html/garden.rs\nindex 9ca66e7c5860d428e95abf5df518fc1e7b4f6332..e2dc6e5529d4a3126723d0dea75931d0738b6c83 100644\n--- a/server/src/html/garden.rs\n+++ b/server/src/html/garden.rs\n@@ -7,7 +7,7 @@ use axum_extra::extract::cookie::CookieJar;\n use maud::html;\n use serde::Deserialize;\n use serde_json::json;\n-use std::collections::HashSet;\n+use std::collections::{HashMap, HashSet};\n \n use base64::{engine::general_purpose::URL_SAFE_NO_PAD as B64_ENGINE, Engine as _};\n \n@@ -21,8 +21,8 @@ use crate::{\n     path_types::ItemId,\n     reducer::{ContentState, ReducerState, ScopeId},\n     scope_rank::{\n-        build_children_rankings, build_rankings_for_item_set, resolve_scope_recursive,\n-        suggest_next_pair_in_pool, ChildrenRankings,\n+        build_children_rankings, build_rankings_for_item_set, external_root_host_items,\n+        resolve_scope_recursive, suggest_next_pair_in_pool, ChildrenRankings,\n     },\n     state::AppState,\n     timeago,\n@@ -33,7 +33,7 @@ use super::{\n     breadcrumb_path::{ExternalOntologyPath, OntologyPath},\n     cli_panel,\n     forum::ThreadNav,\n-    layout, layout_full_bleed_chromeless, now_ms, ratio_pct, render_linkified_with_embeds_in_scope,\n+    layout, layout_full_bleed_chromeless, now_ms, ratio_pct, render_item_body_in_scope,\n     theme_from_jar, theme_next_from_uri,\n };\n \n@@ -358,6 +358,7 @@ fn vote_compare_item_card(\n     item: &ItemId,\n     body: Option<&String>,\n     side_class: &str,\n+    item_bodies: Option<&HashMap<ItemId, String>>,\n ) -> maud::Markup {\n     html! {\n         div class=(format!(\"vote-compare-side {side_class}\")) {\n@@ -366,10 +367,10 @@ fn vote_compare_item_card(\n             }\n             @if let Some(body) = body.filter(|b| !b.trim().is_empty()) {\n                 div class=\"vote-compare-item-body\" {\n-                    (render_linkified_with_embeds_in_scope(\n+                    (render_item_body_in_scope(\n                         body,\n                         nav.garden_root_url(),\n-                        None,\n+                        item_bodies,\n                     ))\n                 }\n             } @else {\n@@ -678,10 +679,11 @@ pub async fn external_garden_index(\n ) -> impl IntoResponse {\n     let nav = ThreadNav::public();\n     let ext_path = ExternalOntologyPath::from_input(\"\");\n-    let parent = ItemId::parse(\"https://.\").unwrap();\n     let child_rankings = {\n         let reduced = state.reduced.read().await;\n-        build_children_rankings(reduced.public(), &parent)\n+        let content = reduced.public();\n+        let hosts = external_root_host_items(content);\n+        build_rankings_for_item_set(content, &hosts)\n     };\n \n     let url_key = canonical_view_url(&uri);\n@@ -812,9 +814,11 @@ pub async fn room_external_garden_index(\n         return room_not_found_page(&jar, &uri).into_response();\n     }\n     let ext_path = ExternalOntologyPath::from_input(\"\");\n-    let parent = ItemId::parse(\"https://.\").unwrap();\n-    let child_rankings =\n-        build_children_rankings(content_for_garden_view(&reduced, &nav.scope()), &parent);\n+    let child_rankings = {\n+        let content = content_for_garden_view(&reduced, &nav.scope());\n+        let hosts = external_root_host_items(content);\n+        build_rankings_for_item_set(content, &hosts)\n+    };\n     drop(reduced);\n \n     let url_key = canonical_view_url(&uri);\n@@ -1334,7 +1338,7 @@ async fn render_scope_view(\n                 }\n                 @if let Some(body) = &model.body {\n                     div class=\"ont-item-content\" {\n-                        (render_linkified_with_embeds_in_scope(\n+                        (render_item_body_in_scope(\n                             body,\n                             nav.garden_root_url(),\n                             Some(&scope_content.item_bodies),\n@@ -1592,6 +1596,7 @@ async fn vote_compare_inner(\n     let edge_history = vote_edge_history_markup(content, &left, &right);\n     let left_body = content.item_bodies.get(&left).cloned();\n     let right_body = content.item_bodies.get(&right).cloned();\n+    let item_bodies_for_cards = content.item_bodies.clone();\n     let next_pair = suggest_next_vote_pair(content, &left, &right);\n     drop(reduced);\n \n@@ -1623,9 +1628,21 @@ async fn vote_compare_inner(\n     section class=\"vote-compare-shell\" {\n         h2 { \"compare\" }\n         div class=\"vote-compare-pair\" {\n-            (vote_compare_item_card(&nav, &left, left_body.as_ref(), \"vote-compare-left\"))\n+            (vote_compare_item_card(\n+                &nav,\n+                &left,\n+                left_body.as_ref(),\n+                \"vote-compare-left\",\n+                Some(&item_bodies_for_cards),\n+            ))\n             span class=\"vote-compare-vs\" { \"vs\" }\n-            (vote_compare_item_card(&nav, &right, right_body.as_ref(), \"vote-compare-right\"))\n+            (vote_compare_item_card(\n+                &nav,\n+                &right,\n+                right_body.as_ref(),\n+                \"vote-compare-right\",\n+                Some(&item_bodies_for_cards),\n+            ))\n         }\n         (vote_compare_nav_markup(&nav, next_pair.as_ref(), &left, &right, q.thread.as_deref()))\n         div id=\"vote-edge-history-region\" {\n@@ -2020,6 +2037,40 @@ mod tests {\n         assert!(items.contains(\"https://slug.social/~/topic/b\"));\n     }\n \n+    #[test]\n+    fn vote_compare_item_card_renders_github_import_markup() {\n+        use crate::html::forum::ThreadNav;\n+        use super::vote_compare_item_card;\n+        use crate::path_types::ItemId;\n+\n+        let nav = ThreadNav::public();\n+        let item = ItemId::parse(\"https://github.com/o/r/issues/1\").unwrap();\n+        let json = serde_json::json!({\n+            \"v\": 1,\n+            \"schema\": \"slug_github_import\",\n+            \"kind\": \"issue\",\n+            \"url\": \"https://github.com/o/r/issues/1\",\n+            \"headline\": \"#1 Compare card\",\n+            \"sublines\": [\"State: open\"],\n+        });\n+        let body = format!(\"```slug-github-card\\n{}\\n```\", json.to_string());\n+        let html = vote_compare_item_card(\n+            &nav,\n+            &item,\n+            Some(&body),\n+            \"vote-compare-left\",\n+            None,\n+        )\n+        .into_string();\n+        assert!(\n+            html.contains(\"github-import-card\"),\n+            \"expected rich GitHub card markup, got: {html}\"\n+        );\n+        assert!(html.contains(\"item-body-rich\"));\n+        assert!(html.contains(\"vote-compare-left\"));\n+        assert!(html.contains(\"#1 Compare card\"));\n+    }\n+\n     #[test]\n     fn external_source_href_maps_youtube_path_identity_back_to_watch_url() {\n         assert_eq!(\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex a1b929625acbd5298c0cf62f3ca0892079edcb2a..3b23e19a8b35aa4c0b0480e29de7d46ad57ab276 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -793,6 +793,20 @@ pub(super) fn render_linkified_with_embeds_in_scope(\n     }\n }\n \n+/// Item page / thread body: resolver-specific rich HTML, else linkified `<pre>` + media embeds.\n+pub(super) fn render_item_body_in_scope(\n+    raw: &str,\n+    garden_prefix: &str,\n+    item_bodies: Option<&HashMap<crate::path_types::ItemId, String>>,\n+) -> Markup {\n+    if let Some(m) = crate::resolvers::try_render_resolver_item_body(raw) {\n+        return html! {\n+            div class=\"item-body-rich\" { (m) }\n+        };\n+    }\n+    render_linkified_with_embeds_in_scope(raw, garden_prefix, item_bodies)\n+}\n+\n /// CLI strings are embedded in a single-quoted JS literal; they must never need escaping.\n fn assert_cli_panel_cmd_js_single_quote_safe(s: &str) {\n     assert!(\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex 84e94bbec144eae77de68482385941cd2c5845eb..c1d477d21aea03aff00e6f0689b0b4379d0d68d2 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -5,7 +5,7 @@ pub mod canonical_path;\n pub mod dsl;\n pub mod event_log;\n pub mod events;\n-pub mod external_resolver;\n+pub mod resolvers;\n pub mod form_template;\n pub mod html;\n pub mod identity;\n@@ -51,7 +51,7 @@ pub fn create_app_state(cfg: AppConfig) -> AppState {\n         write_tx,\n         views,\n         resolver_runs: Arc::new(RwLock::new(HashMap::new())),\n-        github_resolver: Arc::new(crate::external_resolver::GitHubResolver::from_env()),\n+        github_resolver: Arc::new(crate::resolvers::GitHubResolver::from_env()),\n     };\n     tokio::spawn(crate::api::write_actor::writer_actor(\n         write_rx,\ndiff --git a/server/src/resolvers/default_external.rs b/server/src/resolvers/default_external.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..d37c222abcee3c20b22189b2822da9e9a6ff0515\n--- /dev/null\n+++ b/server/src/resolvers/default_external.rs\n@@ -0,0 +1,22 @@\n+use async_trait::async_trait;\n+\n+use crate::path_types::ItemId;\n+use super::github::ExternalResolver;\n+\n+/// Placeholder until other domain-specific resolvers exist.\n+pub struct DefaultExternalResolver;\n+\n+#[async_trait]\n+impl ExternalResolver for DefaultExternalResolver {\n+    fn domain_match(&self) -> &'static str {\n+        \"\"\n+    }\n+\n+    fn normalize(&self, path: &str) -> String {\n+        path.to_string()\n+    }\n+\n+    async fn fetch_body(&self, _item: &ItemId) -> Result<String, String> {\n+        Err(\"external fetch not implemented\".to_string())\n+    }\n+}\ndiff --git a/server/src/resolvers/github.rs b/server/src/resolvers/github.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..5a9c0c38ff01ca5894f7dc62c1008371dacb0cf1\n--- /dev/null\n+++ b/server/src/resolvers/github.rs\n@@ -0,0 +1,755 @@\n+use async_trait::async_trait;\n+use maud::html;\n+use serde::{Deserialize, Serialize};\n+use serde_json::Value;\n+use tokio::sync::oneshot;\n+\n+use crate::{path_types::ItemId, state::AppState, write_cmd::WriteCmd};\n+\n+pub const SLUG_GITHUB_SCHEMA: &str = \"slug_github_import\";\n+\n+const GITHUB_SYSTEM_PRINCIPAL: &str = \"system:github-resolver\";\n+const GITHUB_RESOLVER_COOLDOWN_MS: i64 = 15_000;\n+const GITHUB_MAX_PAGES: usize = 3;\n+\n+fn now_ms() -> i64 {\n+    use std::time::{SystemTime, UNIX_EPOCH};\n+    SystemTime::now()\n+        .duration_since(UNIX_EPOCH)\n+        .unwrap_or_default()\n+        .as_millis() as i64\n+}\n+\n+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n+#[serde(rename_all = \"snake_case\")]\n+pub enum GithubImportKind {\n+    Repo,\n+    RepoSection,\n+    Issue,\n+    Pull,\n+    Commit,\n+    Release,\n+}\n+\n+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n+pub struct GithubImportCard {\n+    pub v: u32,\n+    #[serde(default)]\n+    pub schema: String,\n+    pub kind: GithubImportKind,\n+    pub url: String,\n+    pub headline: String,\n+    #[serde(default)]\n+    pub sublines: Vec<String>,\n+    #[serde(default)]\n+    pub excerpt: Option<String>,\n+}\n+\n+impl GithubImportCard {\n+    fn new(kind: GithubImportKind, url: String, headline: String) -> Self {\n+        Self {\n+            v: 1,\n+            schema: SLUG_GITHUB_SCHEMA.to_string(),\n+            kind,\n+            url,\n+            headline,\n+            sublines: Vec::new(),\n+            excerpt: None,\n+        }\n+    }\n+}\n+\n+#[derive(Debug, Clone, PartialEq, Eq)]\n+pub struct ResolvedChild {\n+    pub url: String,\n+    pub title: String,\n+    pub card: GithubImportCard,\n+}\n+\n+#[async_trait]\n+pub trait ExternalResolver: Send + Sync {\n+    /// e.g. `\"github.com\"`\n+    fn domain_match(&self) -> &'static str;\n+\n+    /// Normalizes URLs (e.g. stripping fragments); extend per-domain later.\n+    fn normalize(&self, path: &str) -> String;\n+\n+    /// Fetches body when missing; GitHub hook lands here in a follow-up.\n+    async fn fetch_body(&self, item: &ItemId) -> Result<String, String>;\n+}\n+\n+#[derive(Clone)]\n+pub struct GitHubResolver {\n+    client: reqwest::Client,\n+    api_base_url: String,\n+    token: Option<String>,\n+}\n+\n+impl GitHubResolver {\n+    pub fn from_env() -> Self {\n+        let api_base_url = std::env::var(\"SLUG_GITHUB_API_BASE_URL\")\n+            .ok()\n+            .filter(|s| !s.trim().is_empty())\n+            .unwrap_or_else(|| \"https://api.github.com\".to_string());\n+        let token = std::env::var(\"SLUG_GITHUB_TOKEN\")\n+            .ok()\n+            .filter(|s| !s.trim().is_empty());\n+        Self {\n+            client: reqwest::Client::new(),\n+            api_base_url: api_base_url.trim_end_matches('/').to_string(),\n+            token,\n+        }\n+    }\n+\n+    pub fn can_resolve_children(&self, item: &ItemId) -> bool {\n+        github_segments(item).is_some()\n+    }\n+\n+    pub async fn list_children(&self, item: &ItemId) -> Result<Vec<ResolvedChild>, String> {\n+        let segments = github_segments(item).ok_or_else(|| \"not a GitHub URL\".to_string())?;\n+        match segments.as_slice() {\n+            [] => Ok(vec![]),\n+            [owner] => self.list_repos(owner).await,\n+            [owner, repo] => Ok(github_repo_sections(owner, repo)),\n+            [owner, repo, section] if section == \"issues\" => self.list_issues(owner, repo).await,\n+            [owner, repo, section] if section == \"pulls\" => self.list_pulls(owner, repo).await,\n+            [owner, repo, section] if section == \"commits\" => self.list_commits(owner, repo).await,\n+            [owner, repo, section] if section == \"releases\" => {\n+                self.list_releases(owner, repo).await\n+            }\n+            _ => Ok(vec![]),\n+        }\n+    }\n+\n+    async fn get_json(&self, path: &str) -> Result<Value, String> {\n+        let url = format!(\"{}/{}\", self.api_base_url, path.trim_start_matches('/'));\n+        let mut req = self\n+            .client\n+            .get(url)\n+            .header(reqwest::header::USER_AGENT, \"slugsocial-github-resolver\");\n+        if let Some(token) = &self.token {\n+            req = req.bearer_auth(token);\n+        }\n+        let resp = req\n+            .send()\n+            .await\n+            .map_err(|e| format!(\"GitHub request failed: {e}\"))?;\n+        let status = resp.status();\n+        if !status.is_success() {\n+            return Err(format!(\"GitHub request returned {status}\"));\n+        }\n+        resp.json::<Value>()\n+            .await\n+            .map_err(|e| format!(\"GitHub response JSON failed: {e}\"))\n+    }\n+\n+    async fn get_json_array_pages(&self, path: &str) -> Result<Vec<Value>, String> {\n+        let sep = if path.contains('?') { '&' } else { '?' };\n+        let mut out = Vec::new();\n+        for page in 1..=GITHUB_MAX_PAGES {\n+            let value = self.get_json(&format!(\"{path}{sep}page={page}\")).await?;\n+            let arr = value\n+                .as_array()\n+                .ok_or_else(|| \"GitHub paged response was not an array\".to_string())?;\n+            let n = arr.len();\n+            out.extend(arr.iter().cloned());\n+            if n < 100 {\n+                break;\n+            }\n+        }\n+        Ok(out)\n+    }\n+\n+    async fn list_repos(&self, owner: &str) -> Result<Vec<ResolvedChild>, String> {\n+        let arr = self\n+            .get_json_array_pages(&format!(\n+                \"/users/{owner}/repos?per_page=100&sort=updated&type=owner\"\n+            ))\n+            .await?;\n+        let mut out = Vec::new();\n+        for repo in &arr {\n+            let name = repo\n+                .get(\"name\")\n+                .and_then(|v| v.as_str())\n+                .unwrap_or_default();\n+            if name.is_empty() {\n+                continue;\n+            }\n+            let full_name = repo\n+                .get(\"full_name\")\n+                .and_then(|v| v.as_str())\n+                .map(|s| s.to_ascii_lowercase())\n+                .unwrap_or_else(|| format!(\"{owner}/{name}\").to_ascii_lowercase());\n+            let url = format!(\"https://github.com/{full_name}\");\n+            let mut card = card_for_repo(repo, &url);\n+            card.headline = full_name.clone();\n+            out.push(ResolvedChild {\n+                url,\n+                title: full_name,\n+                card,\n+            });\n+        }\n+        out.sort_by(|a, b| a.url.cmp(&b.url));\n+        Ok(out)\n+    }\n+\n+    async fn list_issues(&self, owner: &str, repo: &str) -> Result<Vec<ResolvedChild>, String> {\n+        let arr = self\n+            .get_json_array_pages(&format!(\n+                \"/repos/{owner}/{repo}/issues?state=open&per_page=100\"\n+            ))\n+            .await?;\n+        let mut out = Vec::new();\n+        for issue in &arr {\n+            if issue.get(\"pull_request\").is_some() {\n+                continue;\n+            }\n+            let Some(number) = issue.get(\"number\").and_then(|v| v.as_i64()) else {\n+                continue;\n+            };\n+            let title = issue\n+                .get(\"title\")\n+                .and_then(|v| v.as_str())\n+                .unwrap_or(\"Untitled issue\");\n+            let url = format!(\"https://github.com/{owner}/{repo}/issues/{number}\");\n+            let card = card_for_issue(issue, &url, GithubImportKind::Issue);\n+            out.push(ResolvedChild {\n+                url: url.clone(),\n+                title: format!(\"#{number} {title}\"),\n+                card,\n+            });\n+        }\n+        out.sort_by(|a, b| a.url.cmp(&b.url));\n+        Ok(out)\n+    }\n+\n+    async fn list_pulls(&self, owner: &str, repo: &str) -> Result<Vec<ResolvedChild>, String> {\n+        let arr = self\n+            .get_json_array_pages(&format!(\n+                \"/repos/{owner}/{repo}/pulls?state=open&per_page=100\"\n+            ))\n+            .await?;\n+        let mut out = Vec::new();\n+        for pull in &arr {\n+            let Some(number) = pull.get(\"number\").and_then(|v| v.as_i64()) else {\n+                continue;\n+            };\n+            let title = pull\n+                .get(\"title\")\n+                .and_then(|v| v.as_str())\n+                .unwrap_or(\"Untitled pull request\");\n+            let url = format!(\"https://github.com/{owner}/{repo}/pulls/{number}\");\n+            let card = card_for_issue(pull, &url, GithubImportKind::Pull);\n+            out.push(ResolvedChild {\n+                url: url.clone(),\n+                title: format!(\"#{number} {title}\"),\n+                card,\n+            });\n+        }\n+        out.sort_by(|a, b| a.url.cmp(&b.url));\n+        Ok(out)\n+    }\n+\n+    async fn list_commits(&self, owner: &str, repo: &str) -> Result<Vec<ResolvedChild>, String> {\n+        let arr = self\n+            .get_json_array_pages(&format!(\"/repos/{owner}/{repo}/commits?per_page=100\"))\n+            .await?;\n+        let mut out = Vec::new();\n+        for commit in &arr {\n+            let Some(sha) = github_string(commit, \"sha\") else {\n+                continue;\n+            };\n+            let short = sha.chars().take(7).collect::<String>();\n+            let title = commit\n+                .get(\"commit\")\n+                .and_then(|c| c.get(\"message\"))\n+                .and_then(|v| v.as_str())\n+                .and_then(|m| m.lines().next())\n+                .filter(|s| !s.trim().is_empty())\n+                .unwrap_or(\"commit\");\n+            let url = github_string(commit, \"html_url\")\n+                .map(|s| s.to_string())\n+                .unwrap_or_else(|| format!(\"https://github.com/{owner}/{repo}/commit/{sha}\"));\n+            let card = card_for_commit(commit, &url, &short, title);\n+            out.push(ResolvedChild {\n+                url: url.clone(),\n+                title: format!(\"{short} {title}\"),\n+                card,\n+            });\n+        }\n+        out.sort_by(|a, b| a.url.cmp(&b.url));\n+        Ok(out)\n+    }\n+\n+    async fn list_releases(&self, owner: &str, repo: &str) -> Result<Vec<ResolvedChild>, String> {\n+        let arr = self\n+            .get_json_array_pages(&format!(\"/repos/{owner}/{repo}/releases?per_page=100\"))\n+            .await?;\n+        let mut out = Vec::new();\n+        for release in &arr {\n+            let Some(tag) = github_string(release, \"tag_name\") else {\n+                continue;\n+            };\n+            let title = github_string(release, \"name\").unwrap_or(tag);\n+            let url = github_string(release, \"html_url\")\n+                .map(|s| s.to_string())\n+                .unwrap_or_else(|| format!(\"https://github.com/{owner}/{repo}/releases/tag/{tag}\"));\n+            let card = card_for_release(release, &url, title);\n+            out.push(ResolvedChild {\n+                url: url.clone(),\n+                title: title.to_string(),\n+                card,\n+            });\n+        }\n+        out.sort_by(|a, b| a.url.cmp(&b.url));\n+        Ok(out)\n+    }\n+}\n+\n+fn github_segments(item: &ItemId) -> Option<Vec<String>> {\n+    let url = url::Url::parse(item.as_str()).ok()?;\n+    if url.host_str()?.eq_ignore_ascii_case(\"github.com\") {\n+        Some(\n+            url.path_segments()\n+                .map(|segments| {\n+                    segments\n+                        .filter(|s| !s.is_empty())\n+                        .map(|s| s.to_ascii_lowercase())\n+                        .collect::<Vec<_>>()\n+                })\n+                .unwrap_or_default(),\n+        )\n+    } else {\n+        None\n+    }\n+}\n+\n+fn title_case_segment(seg: &str) -> String {\n+    let mut c = seg.chars();\n+    match c.next() {\n+        None => String::new(),\n+        Some(f) => f.to_uppercase().chain(c).collect(),\n+    }\n+}\n+\n+fn github_repo_sections(owner: &str, repo: &str) -> Vec<ResolvedChild> {\n+    [\n+        (\"issues\", \"GitHub issues for this repository.\"),\n+        (\"pulls\", \"GitHub pull requests for this repository.\"),\n+        (\"commits\", \"GitHub commits for this repository.\"),\n+        (\"releases\", \"GitHub releases for this repository.\"),\n+    ]\n+    .into_iter()\n+    .map(|(section, blurb)| {\n+        let url = format!(\"https://github.com/{owner}/{repo}/{section}\");\n+        let mut card = GithubImportCard::new(\n+            GithubImportKind::RepoSection,\n+            url.clone(),\n+            format!(\"{owner}/{repo} — {}\", title_case_segment(section)),\n+        );\n+        card.excerpt = Some(blurb.to_string());\n+        ResolvedChild {\n+            url,\n+            title: section.to_string(),\n+            card,\n+        }\n+    })\n+    .collect()\n+}\n+\n+fn resolver_thread_tag(item: &ItemId) -> String {\n+    let tail = item\n+        .display_path()\n+        .trim_start_matches(\"-/\")\n+        .replace('/', \":\")\n+        .replace('?', \":\");\n+    format!(\"import:{tail}\")\n+}\n+\n+fn children_to_dsl(children: &[ResolvedChild]) -> String {\n+    let mut out = String::new();\n+    for child in children {\n+        let json = serde_json::to_string(&child.card).unwrap_or_else(|_| \"{}\".to_string());\n+        let inner = format!(\"```slug-github-card\\n{json}\\n```\");\n+        out.push_str(&format!(\"{} {{\\n{}\\n}}\\n\\n\", child.url, inner));\n+    }\n+    out\n+}\n+\n+fn card_for_repo(repo: &Value, fallback_url: &str) -> GithubImportCard {\n+    let url = github_string(repo, \"html_url\")\n+        .map(|s| s.to_string())\n+        .filter(|s| !s.is_empty())\n+        .unwrap_or_else(|| fallback_url.to_string());\n+    let full_name = github_string(repo, \"full_name\")\n+        .or_else(|| github_string(repo, \"name\"))\n+        .unwrap_or(\"repository\");\n+    let mut card = GithubImportCard::new(GithubImportKind::Repo, url, full_name.to_string());\n+    if let Some(lang) = github_string(repo, \"language\") {\n+        card.sublines.push(format!(\"Language: {lang}\"));\n+    }\n+    if let Some(desc) = github_string(repo, \"description\") {\n+        card.excerpt = Some(desc.to_string());\n+    }\n+    card\n+}\n+\n+fn excerpt_from_github_body(body: Option<&str>) -> Option<String> {\n+    let b = body?.trim();\n+    if b.is_empty() {\n+        return None;\n+    }\n+    let max = 1200usize;\n+    if b.len() <= max {\n+        Some(b.to_string())\n+    } else {\n+        Some(format!(\"{}…\", b.chars().take(max).collect::<String>()))\n+    }\n+}\n+\n+fn card_for_issue(v: &Value, url: &str, kind: GithubImportKind) -> GithubImportCard {\n+    let number = v.get(\"number\").and_then(|n| n.as_i64());\n+    let title = github_string(v, \"title\").unwrap_or(\"Untitled\");\n+    let state = github_string(v, \"state\").unwrap_or(\"unknown\");\n+    let headline = match number {\n+        Some(n) => format!(\"#{n} {title}\"),\n+        None => title.to_string(),\n+    };\n+    let mut card = GithubImportCard::new(kind, url.to_string(), headline);\n+    card.sublines.push(format!(\"State: {state}\"));\n+    if let Some(a) = github_user_login(v) {\n+        card.sublines.push(format!(\"Author: @{a}\"));\n+    }\n+    let labels = github_labels(v);\n+    if !labels.is_empty() {\n+        card.sublines\n+            .push(format!(\"Labels: {}\", labels.join(\", \")));\n+    }\n+    card.excerpt = excerpt_from_github_body(github_string(v, \"body\"));\n+    card\n+}\n+\n+fn card_for_commit(v: &Value, url: &str, short_sha: &str, subject: &str) -> GithubImportCard {\n+    let headline = format!(\"{short_sha} {subject}\");\n+    let mut card = GithubImportCard::new(GithubImportKind::Commit, url.to_string(), headline);\n+    if let Some(name) = v\n+        .get(\"commit\")\n+        .and_then(|c| c.get(\"author\"))\n+        .and_then(|a| a.get(\"name\"))\n+        .and_then(|n| n.as_str())\n+        .filter(|s| !s.trim().is_empty())\n+    {\n+        card.sublines.push(format!(\"Author: {name}\"));\n+    }\n+    if let Some(login) = github_user_login(v) {\n+        card.sublines.push(format!(\"GitHub: @{login}\"));\n+    }\n+    if let Some(date) = v\n+        .get(\"commit\")\n+        .and_then(|c| c.get(\"author\"))\n+        .and_then(|a| a.get(\"date\"))\n+        .and_then(|d| d.as_str())\n+    {\n+        card.sublines.push(format!(\"Date: {date}\"));\n+    }\n+    if let Some(msg) = v\n+        .get(\"commit\")\n+        .and_then(|c| c.get(\"message\"))\n+        .and_then(|m| m.as_str())\n+    {\n+        card.excerpt = excerpt_from_github_body(Some(msg));\n+    }\n+    card\n+}\n+\n+fn card_for_release(v: &Value, url: &str, title: &str) -> GithubImportCard {\n+    let tag = github_string(v, \"tag_name\").unwrap_or(\"untagged\");\n+    let mut card = GithubImportCard::new(\n+        GithubImportKind::Release,\n+        url.to_string(),\n+        format!(\"Release — {title}\"),\n+    );\n+    card.sublines.push(format!(\"Tag: {tag}\"));\n+    if v.get(\"draft\").and_then(|b| b.as_bool()).unwrap_or(false) {\n+        card.sublines.push(\"Draft: yes\".to_string());\n+    }\n+    if v.get(\"prerelease\")\n+        .and_then(|b| b.as_bool())\n+        .unwrap_or(false)\n+    {\n+        card.sublines.push(\"Prerelease: yes\".to_string());\n+    }\n+    if let Some(a) = github_user_login(v) {\n+        card.sublines.push(format!(\"Author: @{a}\"));\n+    }\n+    if let Some(pub_at) = github_string(v, \"published_at\") {\n+        card.sublines.push(format!(\"Published: {pub_at}\"));\n+    }\n+    card.excerpt = excerpt_from_github_body(github_string(v, \"body\"));\n+    card\n+}\n+\n+fn github_string<'a>(value: &'a Value, key: &str) -> Option<&'a str> {\n+    value\n+        .get(key)\n+        .and_then(|v| v.as_str())\n+        .filter(|s| !s.trim().is_empty())\n+}\n+\n+fn github_user_login(value: &Value) -> Option<&str> {\n+    value\n+        .get(\"user\")\n+        .and_then(|u| u.get(\"login\"))\n+        .and_then(|v| v.as_str())\n+        .filter(|s| !s.trim().is_empty())\n+}\n+\n+fn github_labels(value: &Value) -> Vec<String> {\n+    value\n+        .get(\"labels\")\n+        .and_then(|v| v.as_array())\n+        .into_iter()\n+        .flat_map(|labels| labels.iter())\n+        .filter_map(|label| label.get(\"name\").and_then(|v| v.as_str()))\n+        .filter(|name| !name.trim().is_empty())\n+        .map(|name| name.to_string())\n+        .collect()\n+}\n+\n+pub async fn resolve_github_children(\n+    state: &AppState,\n+    room: &str,\n+    item: &ItemId,\n+) -> Result<usize, String> {\n+    if !state.github_resolver.can_resolve_children(item) {\n+        return Err(\"no GitHub resolver for this item\".to_string());\n+    }\n+\n+    let key = format!(\"github:{}:{}\", room.trim(), item.as_str());\n+    let now = now_ms();\n+    {\n+        let mut runs = state.resolver_runs.write().await;\n+        if let Some(last) = runs.get(&key) {\n+            let remaining = GITHUB_RESOLVER_COOLDOWN_MS - (now - *last);\n+            if remaining > 0 {\n+                return Err(format!(\n+                    \"GitHub resolver cooldown: try again in {}s\",\n+                    (remaining + 999) / 1000\n+                ));\n+            }\n+        }\n+        runs.insert(key, now);\n+    }\n+\n+    let children = state.github_resolver.list_children(item).await?;\n+    if children.is_empty() {\n+        return Ok(0);\n+    }\n+    let text = children_to_dsl(&children);\n+    let thread_tag = resolver_thread_tag(item);\n+    let (tx, rx) = oneshot::channel();\n+    state\n+        .write_tx\n+        .send(WriteCmd::SystemIngest {\n+            room: room.to_string(),\n+            thread_tag,\n+            text,\n+            principal: GITHUB_SYSTEM_PRINCIPAL.to_string(),\n+            reply: tx,\n+        })\n+        .await\n+        .map_err(|_| \"writer unavailable\".to_string())?;\n+    rx.await\n+        .map_err(|_| \"writer dropped\".to_string())?\n+        .map_err(|(msg, hint)| hint.map_or(msg.clone(), |h| format!(\"{msg}: {h}\")))?;\n+    Ok(children.len())\n+}\n+\n+fn extract_fence<'a>(body: &'a str, lang: &str) -> Option<&'a str> {\n+    let b = body.trim();\n+    let prefix = format!(\"```{lang}\");\n+    let rest = b.strip_prefix(prefix.as_str())?;\n+    let rest = rest\n+        .strip_prefix('\\n')\n+        .or_else(|| rest.strip_prefix('\\r'))\n+        .unwrap_or(rest);\n+    let end = rest.find(\"\\n```\")?;\n+    Some(rest[..end].trim())\n+}\n+\n+fn parse_github_import_from_body(body: &str) -> Option<GithubImportCard> {\n+    let trimmed = body.trim();\n+    if let Some(json) = extract_fence(trimmed, \"slug-github-card\") {\n+        let c: GithubImportCard = serde_json::from_str(json).ok()?;\n+        return (c.v == 1 && (c.schema.is_empty() || c.schema == SLUG_GITHUB_SCHEMA)).then_some(c);\n+    }\n+    if let Some(json) = extract_fence(trimmed, \"json\") {\n+        if let Ok(c) = serde_json::from_str::<GithubImportCard>(json) {\n+            if c.v == 1\n+                && (c.schema == SLUG_GITHUB_SCHEMA\n+                    || (c.schema.is_empty() && c.url.contains(\"github.com\")))\n+            {\n+                return Some(c);\n+            }\n+        }\n+    }\n+    if trimmed.starts_with('{') {\n+        let c: GithubImportCard = serde_json::from_str(trimmed).ok()?;\n+        return (c.v == 1\n+            && (c.schema == SLUG_GITHUB_SCHEMA\n+                || (c.schema.is_empty() && c.url.contains(\"github.com\"))))\n+        .then_some(c);\n+    }\n+    None\n+}\n+\n+fn kind_badge(kind: &GithubImportKind) -> &'static str {\n+    match kind {\n+        GithubImportKind::Repo => \"GitHub · repository\",\n+        GithubImportKind::RepoSection => \"GitHub · tree\",\n+        GithubImportKind::Issue => \"GitHub · issue\",\n+        GithubImportKind::Pull => \"GitHub · pull request\",\n+        GithubImportKind::Commit => \"GitHub · commit\",\n+        GithubImportKind::Release => \"GitHub · release\",\n+    }\n+}\n+\n+fn render_github_card(card: &GithubImportCard) -> maud::Markup {\n+    html! {\n+        article.github-import-card {\n+            header.github-import-card__hdr {\n+                span class=\"github-import-card__badge\" { (kind_badge(&card.kind)) }\n+                h3.github-import-card__title { (card.headline.as_str()) }\n+            }\n+            @if !card.sublines.is_empty() {\n+                ul.github-import-card__meta {\n+                    @for line in &card.sublines {\n+                        li { (line.as_str()) }\n+                    }\n+                }\n+            }\n+            @if let Some(ex) = &card.excerpt {\n+                div.github-import-card__excerpt {\n+                    @for block in ex.split(\"\\n\\n\") {\n+                        @if !block.trim().is_empty() {\n+                            p { (block) }\n+                        }\n+                    }\n+                }\n+            }\n+            p.github-import-card__link {\n+                a href=(card.url.as_str()) rel=\"noopener noreferrer\" target=\"_blank\" {\n+                    \"Open on GitHub\"\n+                }\n+            }\n+        }\n+    }\n+}\n+\n+/// Rich HTML for bodies that contain a [`GithubImportCard`] fence (or equivalent JSON).\n+pub fn try_render_github_import_markup(raw: &str) -> Option<maud::Markup> {\n+    let card = parse_github_import_from_body(raw)?;\n+    Some(render_github_card(&card))\n+}\n+\n+#[async_trait]\n+impl ExternalResolver for GitHubResolver {\n+    fn domain_match(&self) -> &'static str {\n+        \"github.com\"\n+    }\n+\n+    fn normalize(&self, path: &str) -> String {\n+        path.to_string()\n+    }\n+\n+    async fn fetch_body(&self, _item: &ItemId) -> Result<String, String> {\n+        Err(\"GitHub fetch_body not implemented\".to_string())\n+    }\n+}\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::*;\n+\n+    #[test]\n+    fn github_segments_parse_normalized_url() {\n+        let item = ItemId::parse(\"https://github.com/Sortersocial/Slug/issues\").unwrap();\n+        assert_eq!(\n+            github_segments(&item),\n+            Some(vec![\n+                \"sortersocial\".to_string(),\n+                \"slug\".to_string(),\n+                \"issues\".to_string()\n+            ])\n+        );\n+    }\n+\n+    #[test]\n+    fn repo_sections_are_direct_children() {\n+        let sections = github_repo_sections(\"sortersocial\", \"slug\");\n+        let urls: Vec<String> = sections.into_iter().map(|c| c.url).collect();\n+        assert!(urls.contains(&\"https://github.com/sortersocial/slug/issues\".to_string()));\n+        assert!(urls.contains(&\"https://github.com/sortersocial/slug/pulls\".to_string()));\n+    }\n+\n+    #[test]\n+    fn children_to_dsl_wraps_slug_github_card() {\n+        let dsl = children_to_dsl(&[ResolvedChild {\n+            url: \"https://github.com/o/r/issues/1\".into(),\n+            title: \"#1 title\".into(),\n+            card: GithubImportCard::new(\n+                GithubImportKind::Issue,\n+                \"https://github.com/o/r/issues/1\".into(),\n+                \"#1 title\".into(),\n+            ),\n+        }]);\n+        assert!(dsl.contains(\"https://github.com/o/r/issues/1\"));\n+        assert!(dsl.contains(\"```slug-github-card\"));\n+        assert!(dsl.contains(\"\\\"schema\\\":\\\"slug_github_import\\\"\"));\n+    }\n+\n+    #[test]\n+    fn parse_accepts_slug_github_fence() {\n+        let card = GithubImportCard::new(\n+            GithubImportKind::Repo,\n+            \"https://github.com/o/r\".into(),\n+            \"o/r\".into(),\n+        );\n+        let body = format!(\"```slug-github-card\\n{}\\n```\\n\", serde_json::to_string(&card).unwrap());\n+        let parsed = parse_github_import_from_body(&body).expect(\"parses\");\n+        assert_eq!(parsed, card);\n+    }\n+\n+    #[test]\n+    fn parse_accepts_schema_json_fence() {\n+        let card = GithubImportCard::new(\n+            GithubImportKind::Issue,\n+            \"https://github.com/o/r/issues/2\".into(),\n+            \"#2 hi\".into(),\n+        );\n+        let json = serde_json::to_string(&card).unwrap();\n+        let body = format!(\"```json\\n{json}\\n```\");\n+        let parsed = parse_github_import_from_body(&body).expect(\"parses json fence\");\n+        assert_eq!(parsed.headline, \"#2 hi\");\n+    }\n+\n+    #[test]\n+    fn issue_card_includes_author_and_excerpt() {\n+        let issue = serde_json::json!({\n+            \"number\": 12,\n+            \"title\": \"Render children\",\n+            \"state\": \"open\",\n+            \"html_url\": \"https://github.com/o/r/issues/12\",\n+            \"user\": {\"login\": \"octo\"},\n+            \"labels\": [{\"name\": \"bug\"}],\n+            \"body\": \"The issue body.\"\n+        });\n+        let card = card_for_issue(\n+            &issue,\n+            \"https://github.com/o/r/issues/12\",\n+            GithubImportKind::Issue,\n+        );\n+        assert!(card.sublines.iter().any(|l| l.contains(\"@octo\")));\n+        assert_eq!(card.excerpt.as_deref(), Some(\"The issue body.\").as_deref());\n+    }\n+}\ndiff --git a/server/src/resolvers/mod.rs b/server/src/resolvers/mod.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..3e4caad081acdd2f89cba9f661de43996d6470f3\n--- /dev/null\n+++ b/server/src/resolvers/mod.rs\n@@ -0,0 +1,18 @@\n+//! Domain resolvers (GitHub, …) and matching HTML renderers for imported item bodies.\n+//!\n+//! Resolver output is ingested as DSL; bodies may embed a `slug-github-card` fenced JSON\n+//! envelope that [`crate::html::render_item_body_in_scope`] renders instead of a raw `<pre>`.\n+\n+pub mod github;\n+pub mod default_external;\n+\n+pub use default_external::DefaultExternalResolver;\n+pub use github::{\n+    resolve_github_children, try_render_github_import_markup, ExternalResolver, GitHubResolver,\n+    GithubImportCard, GithubImportKind, ResolvedChild,\n+};\n+\n+/// Extension point: add more `try_render_*` calls here as new resolvers ship.\n+pub fn try_render_resolver_item_body(raw: &str) -> Option<maud::Markup> {\n+    github::try_render_github_import_markup(raw)\n+}\ndiff --git a/server/src/scope_rank.rs b/server/src/scope_rank.rs\nindex 06c560b8eff09b34896d3935d3917fb28f602bc6..2361b2be5ae6b8e1813b6b7ebd5bbf317429b6ad 100644\n--- a/server/src/scope_rank.rs\n+++ b/server/src/scope_rank.rs\n@@ -162,6 +162,45 @@ pub fn build_children_rankings(content: &ContentState, parent: &ItemId) -> Child\n     build_rankings_for_item_set(content, &items)\n }\n \n+/// Host-only `https://…` roots for the external garden index (`/-/`).\n+///\n+/// Includes every `https://host` ancestor of any [`ItemId::Web`] item that appears in\n+/// `content.items`, as a parent key in `item_children`, or as a child in `item_children`\n+/// (so implied “ghost” parents created only via [`ReducerState::add_child_edge`] still show up).\n+pub fn external_root_host_items(content: &ContentState) -> Vec<ItemId> {\n+    let mut hosts: HashSet<ItemId> = HashSet::new();\n+\n+    let mut consider = |id: ItemId| {\n+        let id = id.normalized_storage();\n+        if !matches!(&id, ItemId::Web(_)) {\n+            return;\n+        }\n+        let mut cur = id;\n+        while let Some(p) = cur.parent() {\n+            cur = p.normalized_storage();\n+        }\n+        if matches!(cur, ItemId::Web(_)) {\n+            hosts.insert(cur);\n+        }\n+    };\n+\n+    for it in &content.items {\n+        consider(it.clone());\n+    }\n+    for parent in content.item_children.keys() {\n+        consider(parent.clone());\n+    }\n+    for set in content.item_children.values() {\n+        for ch in set {\n+            consider(ch.clone());\n+        }\n+    }\n+\n+    let mut out: Vec<ItemId> = hosts.into_iter().collect();\n+    out.sort();\n+    out\n+}\n+\n pub fn is_pair_voted_in_group(group: &GroupState, a: &ItemId, b: &ItemId) -> bool {\n     let Some(&a_idx) = group.item_to_idx.get(a) else {\n         return false;\n@@ -305,4 +344,29 @@ mod tests {\n         assert!(next.0 == c || next.1 == c);\n         assert_ne!(canonical_pair(&next.0, &next.1), canonical_pair(&a, &b));\n     }\n+\n+    #[test]\n+    fn external_root_hosts_include_ghost_chain_hosts() {\n+        use crate::reducer::ContentState;\n+        let gh = ItemId::parse(\"https://github.com\").unwrap();\n+        let org = ItemId::parse(\"https://github.com/org\").unwrap();\n+        let repo = ItemId::parse(\"https://github.com/org/rep\").unwrap();\n+        let mut item_children: HashMap<ItemId, HashSet<ItemId>> = HashMap::new();\n+        item_children.entry(gh.clone()).or_default().insert(org.clone());\n+        item_children.entry(org.clone()).or_default().insert(repo.clone());\n+        let mut items = HashSet::new();\n+        items.insert(repo.clone());\n+        let content = ContentState {\n+            ranking_group: crate::reducer::GroupState::new(),\n+            items,\n+            item_bodies: HashMap::new(),\n+            item_children,\n+            item_votes: HashMap::new(),\n+            item_snippets: HashMap::new(),\n+            item_threads: HashMap::new(),\n+            rank_history: HashMap::new(),\n+        };\n+        let roots = external_root_host_items(&content);\n+        assert_eq!(roots, vec![gh]);\n+    }\n }\ndiff --git a/server/src/state.rs b/server/src/state.rs\nindex 48298e2e66456268d23a6462536eb32bfeb5f29b..648ab5304764a329fcabbbbcd3782b94e3e005a8 100644\n--- a/server/src/state.rs\n+++ b/server/src/state.rs\n@@ -4,7 +4,7 @@ use std::sync::Arc;\n use tokio::sync::{broadcast, mpsc, RwLock};\n \n use crate::{\n-    event_log::EventLog, events::ThreadCapability, external_resolver::GitHubResolver,\n+    event_log::EventLog, events::ThreadCapability, resolvers::GitHubResolver,\n     reducer::ReducerState, write_cmd::WriteCmd,\n };\n \ndiff --git a/server/static/theme_default.css b/server/static/theme_default.css\nindex 184e11a590e7019773f7f0abfa41e79161556c71..7ea5f502f9b0b6341ce56d60ae883479070760d6 100644\n--- a/server/static/theme_default.css\n+++ b/server/static/theme_default.css\n@@ -1023,6 +1023,23 @@ body.view-vote-compare .vote-compare-shell > h2 {\n   line-height: 1.35;\n   padding: 8px 10px;\n }\n+.vote-compare-item-body .item-body-rich {\n+  min-width: 0;\n+  text-align: start;\n+}\n+.vote-compare-right .vote-compare-item-body .item-body-rich {\n+  display: flex;\n+  flex-direction: column;\n+  align-items: flex-end;\n+}\n+.vote-compare-item-body .item-body-rich article.github-import-card {\n+  box-sizing: border-box;\n+  width: 100%;\n+  max-width: min(100%, 420px);\n+}\n+.vote-compare-right .vote-compare-item-body .item-body-rich article.github-import-card {\n+  margin-left: auto;\n+}\n .vote-compare-item-body-empty {\n   font-size: 12px;\n   margin: 8px 0 0;\n@@ -1675,3 +1692,47 @@ body.view-ontology-light .rank-history-cause {\n body.view-ontology-light .rank-history-vote {\n   margin-top: 6px;\n }\n+\n+/* GitHub resolver import cards (rich bodies on -/ garden + vote compare) */\n+article.github-import-card {\n+  border: 1px solid var(--lo);\n+  background: var(--g2);\n+  border-radius: 6px;\n+  padding: 12px 14px;\n+  margin: 8px 0;\n+  max-width: 100%;\n+}\n+.github-import-card__hdr {\n+  margin-bottom: 6px;\n+}\n+.github-import-card__badge {\n+  display: block;\n+  font-size: 0.78em;\n+  color: var(--muted);\n+  margin-bottom: 4px;\n+}\n+.github-import-card__title {\n+  margin: 0;\n+  font-size: 1.05em;\n+  font-weight: 600;\n+}\n+ul.github-import-card__meta {\n+  margin: 8px 0 0 1.1em;\n+  padding: 0;\n+  font-size: 0.9em;\n+}\n+.github-import-card__meta li {\n+  margin: 2px 0;\n+}\n+.github-import-card__excerpt {\n+  margin-top: 10px;\n+  font-size: 0.92em;\n+  white-space: pre-wrap;\n+}\n+.github-import-card__excerpt p {\n+  margin: 6px 0;\n+}\n+.github-import-card__link {\n+  margin-top: 12px;\n+  font-size: 0.95em;\n+}\ndiff --git a/server/static/theme_retro.css b/server/static/theme_retro.css\nindex 6747f59eb1ec5c335029fe92d4e5c55b3125a210..d366be6fc8e8fcbc8122b8954b1e356ee36e6bc9 100644\n--- a/server/static/theme_retro.css\n+++ b/server/static/theme_retro.css\n@@ -278,3 +278,20 @@ body.view-ontology .vote-compare-item-body pre {\n   border: 1px solid #ccc;\n   padding: 0.5rem 0.65rem;\n }\n+body.view-ontology .vote-compare-item-body .item-body-rich {\n+  min-width: 0;\n+  text-align: start;\n+}\n+body.view-ontology .vote-compare-right .vote-compare-item-body .item-body-rich {\n+  display: flex;\n+  flex-direction: column;\n+  align-items: flex-end;\n+}\n+body.view-ontology .vote-compare-item-body .item-body-rich article.github-import-card {\n+  box-sizing: border-box;\n+  width: 100%;\n+  max-width: min(100%, 420px);\n+}\n+body.view-ontology .vote-compare-right .vote-compare-item-body .item-body-rich article.github-import-card {\n+  margin-left: auto;\n+}\ndiff --git a/server/static/theme_retro_craft.css b/server/static/theme_retro_craft.css\nindex 55d984a6dd70ebeadeca7baef86b844955f1d78c..d5bc384437f05f001924630947457d416772e950 100644\n--- a/server/static/theme_retro_craft.css\n+++ b/server/static/theme_retro_craft.css\n@@ -907,6 +907,23 @@ body.view-ontology .vote-compare-item-body pre {\n   line-height: 1.35;\n   padding: 0.55rem 0.65rem;\n }\n+body.view-ontology .vote-compare-item-body .item-body-rich {\n+  min-width: 0;\n+  text-align: start;\n+}\n+body.view-ontology .vote-compare-right .vote-compare-item-body .item-body-rich {\n+  display: flex;\n+  flex-direction: column;\n+  align-items: flex-end;\n+}\n+body.view-ontology .vote-compare-item-body .item-body-rich article.github-import-card {\n+  box-sizing: border-box;\n+  width: 100%;\n+  max-width: min(100%, 420px);\n+}\n+body.view-ontology .vote-compare-right .vote-compare-item-body .item-body-rich article.github-import-card {\n+  margin-left: auto;\n+}\n body.view-ontology .vote-compare-item-body-empty {\n   font-size: 0.78rem;\n   margin: 0.45rem 0 0;\ndiff --git a/server/tests/integration.rs b/server/tests/integration.rs\nindex fb0b9335440181d4d50104d37926b0b2eeeb602a..d979000292b6a39db7c7b54f2b804adb9cd39369 100644\n--- a/server/tests/integration.rs\n+++ b/server/tests/integration.rs\n@@ -3,7 +3,7 @@ use sha2::{Digest, Sha256};\n use slug_types::{room_route_segment, ItemId};\n use slugsocial_server::{\n     event_log::EventLog,\n-    events::{Event, TokenIssued, UserRegistered},\n+    events::{Event, Ingest, TokenIssued, UserRegistered},\n     middleware::canonical_view_url,\n     spawn_writer_actor_for_test,\n     state::{AppConfig, AppState},\n@@ -1614,6 +1614,71 @@ async fn test_view_counts_increment_and_display() {\n     );\n }\n \n+#[tokio::test]\n+async fn test_vote_compare_renders_github_import_cards() {\n+    let (addr, _tmp, _log, state, _handle) = create_test_server_with_state().await;\n+    let client = reqwest::Client::new();\n+\n+    let raw = \"@00000000-0000-0000-0000-000000000000:test:local/test\\n\\\n+https://github.com/ghvotehi/a/issues/9 {\\n\\\n+```slug-github-card\\n\\\n+{\\\"v\\\":1,\\\"schema\\\":\\\"slug_github_import\\\",\\\"kind\\\":\\\"issue\\\",\\\"url\\\":\\\"https://github.com/ghvotehi/a/issues/9\\\",\\\"headline\\\":\\\"#9 Left corner\\\",\\\"sublines\\\":[\\\"State: open\\\"]}\\n\\\n+```\\n\\\n+}\\n\\\n+\\n\\\n+https://github.com/ghvotehi/a/issues/10 {\\n\\\n+```slug-github-card\\n\\\n+{\\\"v\\\":1,\\\"schema\\\":\\\"slug_github_import\\\",\\\"kind\\\":\\\"issue\\\",\\\"url\\\":\\\"https://github.com/ghvotehi/a/issues/10\\\",\\\"headline\\\":\\\"#10 Right corner\\\",\\\"sublines\\\":[\\\"State: open\\\"]}\\n\\\n+```\\n\\\n+}\\n\";\n+\n+    {\n+        let mut w = state.reduced.write().await;\n+        w.apply_event(Event::Ingest(Ingest {\n+            ts: 10,\n+            id: \"ing-vote-github-cards\".to_string(),\n+            raw: raw.to_string(),\n+            principal: \"testuser\".to_string(),\n+            delegate: Some(\n+                \"00000000-0000-0000-0000-000000000000:test:local/test\".to_string(),\n+            ),\n+            room_id: \"public\".to_string(),\n+            thread_tag: \"gh-vote-cards\".to_string(),\n+        }));\n+    }\n+\n+    let left = ItemId::parse(\"https://github.com/ghvotehi/a/issues/9\")\n+        .unwrap()\n+        .normalized_storage()\n+        .to_storage_string();\n+    let right = ItemId::parse(\"https://github.com/ghvotehi/a/issues/10\")\n+        .unwrap()\n+        .normalized_storage()\n+        .to_storage_string();\n+    let q = format!(\n+        \"/vote/compare?left={}&right={}\",\n+        urlencoding::encode(&left),\n+        urlencoding::encode(&right)\n+    );\n+    let resp = client\n+        .get(format!(\"http://{addr}{q}\"))\n+        .send()\n+        .await\n+        .unwrap();\n+    assert!(resp.status().is_success(), \"{}\", resp.status());\n+    let body = resp.text().await.unwrap();\n+    let n_cards = body.matches(\"github-import-card\").count();\n+    assert!(\n+        n_cards >= 2,\n+        \"expected two GitHub import cards on vote compare, count={n_cards}, snippet={}\",\n+        body.chars().take(1500).collect::<String>()\n+    );\n+    assert!(body.contains(\"vote-compare-left\"));\n+    assert!(body.contains(\"vote-compare-right\"));\n+    assert!(body.contains(\"#9 Left corner\"));\n+    assert!(body.contains(\"#10 Right corner\"));\n+}\n+\n #[tokio::test]\n async fn test_search_handles_multibyte_unicode() {\n     // HTML search pages are offline during the auth-v3 refactor.\n","role":"user"}],"model":"openai/gpt-chat-latest"}