{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[880eb778] Harden auth: fail-closed votes, mock OAuth gate, Secure cookies.\n\nAlso show the current alias in the top nav and pin durable by rev.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide A — unified diff (full patch):\ndiff --git a/AGENTS.md b/AGENTS.md\nindex babb889d6fbfb1fa7176c9e6b7544ae17b61dd2e..6e0fd8ebb65d665c9c1438e3275971d62b98fd95 100644\n--- a/AGENTS.md\n+++ b/AGENTS.md\n@@ -10,11 +10,11 @@ Single Rust web app **`sorter2-server`**: pairwise voting, rank-centrality ranki\n \n - **Bootstrap script**: `./scripts/cursor-env-install.sh` (also run via `.cursor/environment.json` on Cloud Agent boot) installs Playwright Chromium, Babashka, bbin, `clj-paren-repair`, and warms the RocksDB build.\n - **Rust 1.88+** is required (`rust-toolchain.toml`). The Cloud Dockerfile and `cursor-env-install.sh` install **rustup** 1.88.0 first so `cargo` works while Playwright/Clojure bootstrap continues. Do not rely on `/usr/local/cargo` (often missing or stale).\n-- **RocksDB / `durable`**: Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS=\"-C linker=g++\"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.\n+- **RocksDB / `durable`**: `durable` is an external git dependency (`tommy-mor/durable`, pinned by rev in `server/Cargo.toml`). Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS=\"-C linker=g++\"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.\n - **System packages** for builds: `build-essential`, `g++`, `clang`, `libclang-dev`, `pkg-config`, `libssl-dev`, `openjdk-21-jre-headless` (for `reqwest` / OpenSSL, `librocksdb-sys`, `zstd-sys` / bindgen, and **bbin** / Clojure JVM). The bootstrap sets **`JAVA_HOME`** when Java is present.\n - **Clojure CLI 1.12.0.1530** (used in CI): install from https://clojure.org/guides/install_clojure — needed for `./scripts/clj-test.sh` / Kaocha tests.\n - **Babashka / bbin / clj-paren-repair**: installed by `cursor-env-install.sh` into `~/.local/bin` (bb tasks in `bb.edn`, delimiter repair for Clojure edits).\n-- **Playwright** (Spel browser tests in `test/vote_compare.clj`): Chromium via `clojure -M -e \"(com.microsoft.playwright.CLI/main ...)\"` — run once after clone or use the bootstrap script.\n+- **Playwright** (Spel browser tests in `test/vote_compare.clj` / `test/auth_login.clj`): Chromium via `clojure -M -e \"(com.microsoft.playwright.CLI/main ...)\"` — run once after clone or use the bootstrap script.\n \n ### Commands (see also `TEST.sh`)\n \n@@ -34,13 +34,17 @@ Environment variables (defaults in `server/src/state.rs`):\n - `PORT` — default `8080`\n - `SORTER2_DATA_DIR` — default `./data` (created on startup)\n - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`\n+- `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)\n+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)\n+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)\n \n Health check: `GET /healthz` → `ok`.\n \n-Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Example vote:\n+Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Votes require a session cookie (sign in via `/login`). Example vote:\n \n ```bash\n curl -sf -X POST http://127.0.0.1:8080/ui \\\n+  --cookie \"sorter2_session=...\" \\\n   --data-urlencode '__rpc__={\"action\":\"record_vote\",\"a\":\"alpha\",\"b\":\"beta\",\"ratio_left\":2,\"ratio_right\":1}'\n ```\n \ndiff --git a/Cargo.lock b/Cargo.lock\nindex aa02997ad85777195f135bfd9456bcee0fc9a590..1f8690f3e486d099577a32c2ece48caf57ea7160 100644\n--- a/Cargo.lock\n+++ b/Cargo.lock\n@@ -414,7 +414,7 @@ dependencies = [\n [[package]]\n name = \"durable\"\n version = \"0.2.0\"\n-source = \"git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n+source = \"git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n dependencies = [\n  \"ciborium\",\n  \"durable-derive\",\n@@ -426,7 +426,7 @@ dependencies = [\n [[package]]\n name = \"durable-derive\"\n version = \"0.2.0\"\n-source = \"git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n+source = \"git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n dependencies = [\n  \"proc-macro2\",\n  \"quote\",\ndiff --git a/server/Cargo.toml b/server/Cargo.toml\nindex dfa39beddecfa37dcdeaa602cb30f4b547528fbb..bd88687fb0ba47d68f2c08eb5e11d0e08b7c4398 100644\n--- a/server/Cargo.toml\n+++ b/server/Cargo.toml\n@@ -25,7 +25,7 @@ futures-util = { version = \"0.3\", default-features = false, features = [\"std\"] }\n rand = \"0.8\"\n urlencoding = \"2\"\n url = \"2\"\n-durable = { git = \"https://github.com/tommy-mor/durable.git\", branch = \"main\" }\n+durable = { git = \"https://github.com/tommy-mor/durable.git\", rev = \"a6c14eaa809693140eea0c22b07ef24d8e74adaf\" }\n \n [dev-dependencies]\n reqwest = { version = \"0.12\", features = [\"json\"] }\ndiff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs\nindex b86581b1f337650564274254d840e8a75b49524d..9da62ffbed07eb28729aa3160bf33b07ce0d7945 100644\n--- a/server/src/api/ui_html.rs\n+++ b/server/src/api/ui_html.rs\n@@ -71,10 +71,16 @@ pub async fn post_ui_html(\n                 return resp;\n             }\n             let parent = parent_from_scope(&scope);\n-            let actor = resolve_vote_actor(\n+            let actor = match resolve_vote_actor(\n                 state.projection_store.db(),\n                 session_id_from_jar(&jar).as_deref(),\n-            );\n+            ) {\n+                Ok(actor) => actor,\n+                Err(_) => {\n+                    return vote_auth_redirect(&state, &jar)\n+                        .unwrap_or_else(|| login_redirect_js().into_response());\n+                }\n+            };\n             if let Err(e) = state\n                 .record_vote(&parent, &a, &b, ratio_left, ratio_right, &actor)\n                 .await\ndiff --git a/server/src/auth/config.rs b/server/src/auth/config.rs\nindex a1f042c655bf3e5234eeb87a7d889f64592807fb..a5976af9a52ea207b35ae87bd1fe927c47a477ca 100644\n--- a/server/src/auth/config.rs\n+++ b/server/src/auth/config.rs\n@@ -1,9 +1,42 @@\n pub const AUTH_RETURN_COOKIE: &str = \"sorter2_auth_return\";\n \n+/// Allow `mock_user` on `/auth/github` (test harness only).\n+pub fn mock_oauth_allowed() -> bool {\n+    matches!(\n+        std::env::var(\"SORTER2_ALLOW_MOCK_OAUTH\").as_deref(),\n+        Ok(\"1\") | Ok(\"true\") | Ok(\"TRUE\")\n+    )\n+}\n+\n+/// Set the Secure flag on auth cookies when serving over HTTPS.\n+pub fn cookies_secure() -> bool {\n+    std::env::var(\"SORTER2_BASE_URL\")\n+        .map(|u| u.starts_with(\"https://\"))\n+        .unwrap_or(false)\n+}\n+\n pub fn sanitize_return_to(raw: &str) -> String {\n     let s = raw.trim();\n-    if s.is_empty() || !s.starts_with('/') || s.starts_with(\"//\") {\n+    if s.is_empty() || !s.starts_with('/') || s.starts_with(\"//\") || s.starts_with(\"/\\\\\") {\n+        return \"/\".to_string();\n+    }\n+    // Reject scheme-relative and protocol-smuggling forms.\n+    if s.contains(\"://\") || s.contains('\\\\') {\n         return \"/\".to_string();\n     }\n     s.to_string()\n }\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::*;\n+\n+    #[test]\n+    fn sanitize_return_to_blocks_open_redirects() {\n+        assert_eq!(sanitize_return_to(\"\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"//evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"/\\\\evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"https://evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"/vote?parent=x\"), \"/vote?parent=x\");\n+    }\n+}\ndiff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs\nindex 5ed535ba199fa736f0048c32623b14c3b1e5de2d..d4a85ef52c15dc35148e4c743f0d646cbbdb056d 100644\n--- a/server/src/auth/mod.rs\n+++ b/server/src/auth/mod.rs\n@@ -26,7 +26,7 @@ use crate::{\n     ui_action::UI_RPC_FIELD,\n };\n \n-pub use session::{resolve_vote_actor, session_id_from_jar, VoteActor};\n+pub use session::{nav_pseudonym, resolve_vote_actor, session_id_from_jar, VoteActor};\n \n pub fn base_url_from_env(port: u16) -> String {\n     std::env::var(\"SORTER2_BASE_URL\")\n@@ -168,6 +168,10 @@ pub async fn login_page(\n         \"login · sorter2\",\n         login_body(session.as_ref(), &aliases, &providers),\n         state.views.get_views(\"/login\"),\n+        session\n+            .as_ref()\n+            .filter(|s| !s.pseudonym.trim().is_empty())\n+            .map(|s| s.pseudonym.as_str()),\n     );\n     (jar, Html(markup.into_string())).into_response()\n }\n@@ -222,6 +226,7 @@ pub async fn alias_page(\n             \"choose alias · sorter2\",\n             body,\n             state.views.get_views(\"/login/alias\"),\n+            None,\n         )\n         .into_string(),\n     )\n@@ -237,7 +242,12 @@ pub async fn github_start(\n         .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n     let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());\n     let state_token = session::new_oauth_state();\n-    let url = oauth::authorize_url(&cfg, &state_token, query.mock_user.as_deref());\n+    let mock_user = if config::mock_oauth_allowed() {\n+        query.mock_user.as_deref()\n+    } else {\n+        None\n+    };\n+    let url = oauth::authorize_url(&cfg, &state_token, mock_user);\n     let jar = jar\n         .add(session::oauth_state_cookie_value(&state_token))\n         .add(session::auth_return_cookie_value(&return_to));\ndiff --git a/server/src/auth/session.rs b/server/src/auth/session.rs\nindex 09659240b9455c6fca12db5652e1d31cf8c2acfc..41df030ded3abcafc0ab3887ab769adf103f9aa0 100644\n--- a/server/src/auth/session.rs\n+++ b/server/src/auth/session.rs\n@@ -5,7 +5,7 @@ use durable::{Db, Durability};\n use rand::Rng;\n \n use crate::{\n-    auth::config::AUTH_RETURN_COOKIE,\n+    auth::config::{self, AUTH_RETURN_COOKIE},\n     fetch::now_ms,\n     identity::{DEFAULT_ACTOR_UUID, DEFAULT_PSEUDONYM},\n     storage_dto::{SessionDataV1, SESSION_DATA_VERSION},\n@@ -37,6 +37,7 @@ pub struct VoteActor {\n }\n \n impl VoteActor {\n+    /// Test / bench helper: seed votes as the default pseudonym without a session.\n     pub fn anon() -> Self {\n         Self {\n             pseudonym: DEFAULT_PSEUDONYM.to_string(),\n@@ -70,20 +71,51 @@ fn hex_encode(bytes: &[u8]) -> String {\n     bytes.iter().map(|b| format!(\"{b:02x}\")).collect()\n }\n \n-pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> VoteActor {\n-    let Some(session_id) = session_id else {\n-        return VoteActor::anon();\n-    };\n-    let Ok(Some(session)) = load_session(db, session_id) else {\n-        return VoteActor::anon();\n-    };\n-    if session.expires_at <= now_ms() {\n-        return VoteActor::anon();\n+fn build_cookie(name: &'static str, value: String) -> Cookie<'static> {\n+    let mut builder = Cookie::build((name, value))\n+        .http_only(true)\n+        .same_site(SameSite::Lax)\n+        .path(\"/\");\n+    if config::cookies_secure() {\n+        builder = builder.secure(true);\n+    }\n+    builder.build()\n+}\n+\n+fn clear_cookie(name: &'static str) -> Cookie<'static> {\n+    let mut builder = Cookie::build((name, \"\"))\n+        .http_only(true)\n+        .same_site(SameSite::Lax)\n+        .path(\"/\")\n+        .removal();\n+    if config::cookies_secure() {\n+        builder = builder.secure(true);\n+    }\n+    builder.build()\n+}\n+\n+/// Resolve the vote actor from a live session. Fail-closed: never falls back to anon.\n+pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> Result<VoteActor, &'static str> {\n+    let session_id = session_id.ok_or(\"sign in to vote\")?;\n+    let session = load_valid_session(db, session_id).ok_or(\"session expired\")?;\n+    if !session_has_pseudonym(&session) {\n+        return Err(\"choose an alias first\");\n     }\n     let trust_weight = user_trust_weight(db, &session.uuid).unwrap_or(1.0);\n-    VoteActor {\n+    Ok(VoteActor {\n         pseudonym: session.current_pseudonym,\n         trust_weight,\n+    })\n+}\n+\n+/// Display name for the top nav, if any session is active.\n+pub fn nav_pseudonym(db: &Db, jar: &CookieJar) -> Option<String> {\n+    let session_id = session_id_from_jar(jar)?;\n+    let session = load_valid_session(db, &session_id)?;\n+    if session_has_pseudonym(&session) {\n+        Some(session.current_pseudonym)\n+    } else {\n+        None\n     }\n }\n \n@@ -151,54 +183,27 @@ pub fn destroy_session(db: &Db, session_id: &str) -> Result<(), String> {\n }\n \n pub fn session_cookie_value(session_id: &str) -> Cookie<'static> {\n-    Cookie::build((SESSION_COOKIE, session_id.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(SESSION_COOKIE, session_id.to_string())\n }\n \n pub fn clear_session_cookie() -> Cookie<'static> {\n-    Cookie::build((SESSION_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(SESSION_COOKIE)\n }\n \n pub fn oauth_state_cookie_value(state: &str) -> Cookie<'static> {\n-    Cookie::build((OAUTH_STATE_COOKIE, state.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(OAUTH_STATE_COOKIE, state.to_string())\n }\n \n pub fn clear_oauth_state_cookie() -> Cookie<'static> {\n-    Cookie::build((OAUTH_STATE_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(OAUTH_STATE_COOKIE)\n }\n \n pub fn auth_return_cookie_value(return_to: &str) -> Cookie<'static> {\n-    Cookie::build((AUTH_RETURN_COOKIE, return_to.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(AUTH_RETURN_COOKIE, return_to.to_string())\n }\n \n pub fn clear_auth_return_cookie() -> Cookie<'static> {\n-    Cookie::build((AUTH_RETURN_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(AUTH_RETURN_COOKIE)\n }\n \n pub fn auth_return_from_jar(jar: &CookieJar) -> Option<String> {\n@@ -213,28 +218,35 @@ pub fn oauth_state_from_jar(jar: &CookieJar) -> Option<String> {\n     jar.get(OAUTH_STATE_COOKIE).map(|c| c.value().to_string())\n }\n \n-pub fn actor_uuid_for_vote(db: &Db, session_id: Option<&str>) -> String {\n-    let Some(session_id) = session_id else {\n-        return DEFAULT_ACTOR_UUID.to_string();\n-    };\n-    load_session(db, session_id)\n-        .ok()\n-        .flatten()\n-        .filter(|s| s.expires_at > now_ms())\n-        .map(|s| s.uuid)\n-        .unwrap_or_else(|| DEFAULT_ACTOR_UUID.to_string())\n-}\n-\n #[cfg(test)]\n mod tests {\n     use super::*;\n \n     #[test]\n-    fn missing_session_falls_back_to_anon() {\n+    fn missing_session_is_error() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let db = Db::open(dir.path()).unwrap();\n+        assert_eq!(resolve_vote_actor(&db, None).unwrap_err(), \"sign in to vote\");\n+    }\n+\n+    #[test]\n+    fn session_without_pseudonym_is_error() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let db = Db::open(dir.path()).unwrap();\n+        let (id, _) = create_session(&db, DEFAULT_ACTOR_UUID, \"\").unwrap();\n+        assert_eq!(\n+            resolve_vote_actor(&db, Some(&id)).unwrap_err(),\n+            \"choose an alias first\"\n+        );\n+    }\n+\n+    #[test]\n+    fn session_with_pseudonym_resolves() {\n         let dir = tempfile::tempdir().unwrap();\n         let db = Db::open(dir.path()).unwrap();\n-        let actor = resolve_vote_actor(&db, None);\n-        assert_eq!(actor.pseudonym, DEFAULT_PSEUDONYM);\n+        let (id, _) = create_session(&db, DEFAULT_ACTOR_UUID, \"alice\").unwrap();\n+        let actor = resolve_vote_actor(&db, Some(&id)).unwrap();\n+        assert_eq!(actor.pseudonym, \"alice\");\n         assert_eq!(actor.trust_weight, 1.0);\n     }\n }\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex 46d18b87f1313bf0aeb29955d18f291961057509..3cc3d7bdf55b5cb5d009600f4ade1fcd201a410b 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -4,11 +4,13 @@ use axum::{\n     http::{header, StatusCode, Uri},\n     response::{IntoResponse, Response},\n };\n+use axum_extra::extract::cookie::CookieJar;\n use maud::{html, Markup, DOCTYPE};\n \n use std::collections::HashSet;\n \n use crate::{\n+    auth::nav_pseudonym,\n     fetch::html::entity_section,\n     form_template::template_json_compact,\n     path_types::ItemId,\n@@ -126,7 +128,7 @@ pub fn now_ms() -> i64 {\n     t.as_millis() as i64\n }\n \n-pub(crate) fn layout(title: &str, body: Markup, views: u64) -> Markup {\n+pub(crate) fn layout(title: &str, body: Markup, views: u64, nav_user: Option<&str>) -> Markup {\n     let ver = asset_version();\n     let css_href = format!(\"/static/sorter.css?v={ver}\");\n     let js_src = format!(\"/static/sorter_ui.js?v={ver}\");\n@@ -145,7 +147,15 @@ pub(crate) fn layout(title: &str, body: Markup, views: u64) -> Markup {\n                     span class=\"view-meta muted\" { (views) \" views\" }\n                 }\n                 nav class=\"top-nav\" {\n-                    a href=\"/login\" { \"login\" }\n+                    @if let Some(name) = nav_user {\n+                        span class=\"top-nav-user\" data-testid=\"nav-user\" { (name) }\n+                        a href=\"/login\" { \"account\" }\n+                        form class=\"top-nav-logout\" method=\"post\" action=\"/auth/logout\" data-navigate=\"full\" {\n+                            button type=\"submit\" data-testid=\"nav-logout\" { \"log out\" }\n+                        }\n+                    } @else {\n+                        a href=\"/login\" data-testid=\"nav-login\" { \"login\" }\n+                    }\n                 }\n                 div id=\"errors\" {}\n                 (body)\n@@ -481,10 +491,11 @@ pub fn input_panel(query: &str, error: Option<&str>) -> Markup {\n     }\n }\n \n-async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup {\n+async fn item_page(state: AppState, uri: Uri, item: ItemId, jar: CookieJar) -> Markup {\n     let path = uri.path().to_string();\n     state.views.increment(path.clone());\n     let views = state.views.get_views(&path);\n+    let nav_user = nav_pseudonym(state.projection_store.db(), &jar);\n \n     let tree = state\n         .scope_tree(&item)\n@@ -513,16 +524,24 @@ async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup {\n             (ranking_panel(&item, node, &tree))\n         }\n     };\n-    layout(\"sorter2\", body, views)\n+    layout(\"sorter2\", body, views, nav_user.as_deref())\n }\n \n-pub async fn home(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {\n-    item_page(state, uri, ItemId::root()).await\n+pub async fn home(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    uri: Uri,\n+) -> impl IntoResponse {\n+    item_page(state, uri, ItemId::root(), jar).await\n }\n \n-pub async fn browse(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {\n+pub async fn browse(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    uri: Uri,\n+) -> impl IntoResponse {\n     let item = ItemId::from_browse_uri(uri.path()).unwrap_or(ItemId::root());\n-    item_page(state, uri, item).await\n+    item_page(state, uri, item, jar).await\n }\n \n #[cfg(test)]\ndiff --git a/server/src/html/vote.rs b/server/src/html/vote.rs\nindex 3aa00c417c89a9cab3417c650b50ed7c73f08e20..cadbec188b17a48a63b269c0e2fa2ea8ffedd7ed 100644\n--- a/server/src/html/vote.rs\n+++ b/server/src/html/vote.rs\n@@ -4,11 +4,13 @@ use axum::{\n     extract::{Query, State},\n     response::{Html, IntoResponse},\n };\n+use axum_extra::extract::cookie::CookieJar;\n use maud::{html, Markup};\n use serde::Deserialize;\n use std::collections::HashSet;\n \n use crate::{\n+    auth::nav_pseudonym,\n     fetch::html::entity_section,\n     form_template::template_json_compact,\n     html::{ranking_panel_with_highlights, scope_theme_style, JsBuilder},\n@@ -262,6 +264,7 @@ fn suggest_next(\n \n pub async fn vote_page(\n     State(state): State<AppState>,\n+    jar: CookieJar,\n     Query(q): Query<VoteQuery>,\n ) -> impl IntoResponse {\n     let parent = parse_item_param(&q.parent);\n@@ -329,8 +332,9 @@ pub async fn vote_page(\n     let path = format!(\"/vote?parent={}\", urlencoding::encode(parent.as_str()));\n     state.views.increment(path.clone());\n     let views = state.views.get_views(&path);\n+    let nav_user = nav_pseudonym(state.projection_store.db(), &jar);\n \n-    Html(layout(&title, body, views).into_string()).into_response()\n+    Html(layout(&title, body, views, nav_user.as_deref()).into_string()).into_response()\n }\n \n #[cfg(test)]\ndiff --git a/server/static/sorter.css b/server/static/sorter.css\nindex e66a1e6c1acc473c8ff1ddb1e16e75a82d33741c..257280b6b490c65222e580a325b77351cac6cc6b 100644\n--- a/server/static/sorter.css\n+++ b/server/static/sorter.css\n@@ -34,6 +34,47 @@ body {\n   font-size: 0.75rem;\n }\n \n+.top-nav {\n+  display: flex;\n+  align-items: center;\n+  justify-content: flex-end;\n+  gap: 0.75rem;\n+  padding: 0.5rem 1rem;\n+  font-size: 0.875rem;\n+}\n+\n+.top-nav a {\n+  color: var(--muted);\n+  text-decoration: none;\n+}\n+\n+.top-nav a:hover {\n+  color: var(--fg);\n+}\n+\n+.top-nav-user {\n+  color: var(--fg);\n+  font-weight: 600;\n+}\n+\n+.top-nav-logout {\n+  display: inline;\n+  margin: 0;\n+}\n+\n+.top-nav-logout button {\n+  background: none;\n+  border: none;\n+  padding: 0;\n+  color: var(--muted);\n+  font: inherit;\n+  cursor: pointer;\n+}\n+\n+.top-nav-logout button:hover {\n+  color: var(--fg);\n+}\n+\n .btn-primary {\n   background: var(--accent);\n   color: var(--accent-fg, #0f1115);\ndiff --git a/test/support/harness.clj b/test/support/harness.clj\nindex 3f05951f418258642dcacb4a10ccccc8bfbe8748..4505ece5aa193e826ca61c52f1467d252080d66b 100644\n--- a/test/support/harness.clj\n+++ b/test/support/harness.clj\n@@ -43,6 +43,7 @@\n          \"SORTER2_VIEWS_LOG\" (str data-dir \"/views.jsonl\")\n          \"PORT\" (str app-port)\n          \"SORTER2_BASE_URL\" (str \"http://127.0.0.1:\" app-port)\n+         \"SORTER2_ALLOW_MOCK_OAUTH\" \"1\"\n          \"GITHUB_CLIENT_ID\" \"test-client\"\n          \"GITHUB_CLIENT_SECRET\" \"test-secret\"\n          \"GITHUB_OAUTH_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[c94456ff] Make feed catch-up stable and permission-aware\n\nAnchor implicit feeds to durable ingest order and cover multi-user private-room visibility so concurrent posts are not missed or leaked.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/cli/src/main.rs b/cli/src/main.rs\nindex abb5a55b49f60fe28fbfd4ec02715cb94ea0b4ec..c4f1494df3aedbd8b883aea6249579aa8336abfe 100644\n--- a/cli/src/main.rs\n+++ b/cli/src/main.rs\n@@ -878,6 +878,30 @@ mod tests {\n             \"graph: 4 items, 3/6 pairs (50.0% density), 1 component, connected\"\n         );\n     }\n+\n+    #[test]\n+    fn feed_without_since_uses_logged_in_delegate_from_env() {\n+        let key = \"SLUG_DELEGATE\";\n+        let previous = std::env::var_os(key);\n+        let expected = \"00000000-0000-0000-0000-0000000000ee:test:local/model\";\n+        std::env::set_var(key, expected);\n+\n+        let cli = Cli::try_parse_from([\"slugsocial\", \"feed\"]).expect(\"parse feed\");\n+\n+        match previous {\n+            Some(value) => std::env::set_var(key, value),\n+            None => std::env::remove_var(key),\n+        }\n+        match cli.cmd {\n+            Some(Command::Feed {\n+                delegate, since, ..\n+            }) => {\n+                assert_eq!(delegate.as_deref(), Some(expected));\n+                assert!(since.is_none());\n+            }\n+            _ => panic!(\"expected feed command\"),\n+        }\n+    }\n }\n \n async fn run_scoped(base: &str, room: &str, sub: ScopedCmd) -> Result<()> {\n@@ -1626,7 +1650,15 @@ async fn run() -> Result<()> {\n                 } else {\n                     for p in &resp.posts {\n                         let ago = slug_types::timeago::timeago(now_ms, p.ts);\n-                        println!(\"<post id=\\\"{}\\\" ts=\\\"{}\\\">\", p.id, ago);\n+                        let thread_attr = p\n+                            .thread\n+                            .as_deref()\n+                            .map(|thread| format!(\" thread=\\\"{thread}\\\"\"))\n+                            .unwrap_or_default();\n+                        println!(\n+                            \"<post id=\\\"{}\\\" ts=\\\"{}\\\" room=\\\"{}\\\"{}>\",\n+                            p.id, ago, p.room, thread_attr\n+                        );\n                         print!(\"{}\", p.body);\n                         if !p.body.ends_with('\\n') { println!(); }\n                         println!(\"</post>\");\ndiff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs\nindex afc4f95bef160c1e38ecff2c096d6440cd94e2b3..46d748f918d9b225acc4ecedfe5a1793089407b5 100644\n--- a/server/src/api/rpc.rs\n+++ b/server/src/api/rpc.rs\n@@ -72,6 +72,80 @@ fn can_view_scope(reduced: &ReducerState, scope: &ScopeId, principal: Option<&st\n     }\n }\n \n+/// Build a feed in durable ingest order.\n+///\n+/// An implicit feed boundary is an ingest position, not only its millisecond timestamp. Two users\n+/// can post in the same millisecond, and wall-clock timestamps can move backwards during replay.\n+/// Explicit `since` remains a timestamp query for API compatibility, but scans the whole ordered\n+/// ledger rather than assuming timestamps are monotonic.\n+fn rpc_feed(\n+    reduced: &ReducerState,\n+    viewer: &str,\n+    delegate: Option<String>,\n+    requested_since: Option<i64>,\n+    implicit_anchor: Option<(usize, i64)>,\n+    limit: usize,\n+) -> FeedResponse {\n+    let since = requested_since.or_else(|| implicit_anchor.map(|(_, ts)| ts));\n+    let implicit_anchor_index = requested_since\n+        .is_none()\n+        .then(|| implicit_anchor.map(|(index, _)| index))\n+        .flatten();\n+\n+    let matching: Vec<&str> = reduced\n+        .ingests_ordered\n+        .iter()\n+        .enumerate()\n+        .rev()\n+        .filter(|(index, id)| {\n+            reduced.ingests_by_id.get(id.as_str()).is_some_and(|ing| {\n+                match requested_since {\n+                    Some(cutoff) => ing.ts > cutoff,\n+                    None => implicit_anchor_index.is_none_or(|anchor| *index > anchor),\n+                }\n+            })\n+        })\n+        .map(|(_, id)| id.as_str())\n+        .filter(|id| {\n+            reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n+                let scope = scope_from_room_wire(&ing.room_id);\n+                can_view_scope(reduced, &scope, Some(viewer))\n+            })\n+        })\n+        .filter(|id| !reduced.redacted_posts.contains(*id))\n+        .collect();\n+\n+    let total = matching.len();\n+    let posts = matching\n+        .into_iter()\n+        .take(limit)\n+        .filter_map(|id| reduced.ingests_by_id.get(id))\n+        .map(|ing| {\n+            let scope = scope_from_room_wire(&ing.room_id);\n+            let thread_post_index = reduced.try_thread_post_index_chronological(\n+                &scope,\n+                &ing.thread_tag,\n+                &ing.id,\n+            );\n+            FeedPost {\n+                ts: ing.ts,\n+                id: ing.id.clone(),\n+                room: ing.room_id.clone(),\n+                thread: Some(ing.thread_tag.clone()),\n+                thread_post_index,\n+                body: ing.raw.clone(),\n+            }\n+        })\n+        .collect();\n+\n+    FeedResponse {\n+        delegate,\n+        since,\n+        posts,\n+        total,\n+    }\n+}\n+\n fn principal_from_optional_bearer(headers: &HeaderMap, reduced: &ReducerState) -> Result<Option<String>, RpcErr> {\n     if headers.contains_key(axum::http::header::AUTHORIZATION) {\n         verify_bearer_principal(headers, reduced)\n@@ -1506,60 +1580,27 @@ pub async fn handle_rpc_batch(\n                                         Some(\"this delegate is not bound to your signed-in account\".into()),\n                                     )\n                                 } else {\n-                                    let since_default = reduced\n+                                    let implicit_anchor = reduced\n                                         .ingests_ordered\n                                         .iter()\n+                                        .enumerate()\n                                         .rev()\n-                                        .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                        .find(|ing| {\n-                                            if ing.delegate.as_deref() != Some(delegate_stored.as_str()) {\n-                                                return false;\n-                                            }\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n-                                        })\n-                                        .map(|ing| ing.ts);\n-                                    let since = since.or(since_default);\n-                                    let cutoff = since.unwrap_or(0);\n-                                    let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n-                                    let matching: Vec<&str> = reduced.ingests_ordered.iter().rev()\n-                                        .map(|id| id.as_str())\n-                                        .take_while(|id| reduced.ingests_by_id.get(*id).is_some_and(|ing| ing.ts > cutoff))\n-                                        .filter(|id| {\n-                                            reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n-                                                let scope = scope_from_room_wire(&ing.room_id);\n-                                                can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n+                                        .find_map(|(index, id)| {\n+                                            reduced.ingests_by_id.get(id).and_then(|ing| {\n+                                                (ing.delegate.as_deref()\n+                                                    == Some(delegate_stored.as_str()))\n+                                                .then_some((index, ing.ts))\n                                             })\n-                                        })\n-                                        .filter(|id| !reduced.redacted_posts.contains(*id))\n-                                        .collect();\n-                                    let total = matching.len();\n-                                    let posts: Vec<FeedPost> = matching.into_iter()\n-                                        .take(limit)\n-                                        .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                        .map(|ing| {\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            let thread_post_index = reduced\n-                                                .try_thread_post_index_chronological(\n-                                                    &scope,\n-                                                    &ing.thread_tag,\n-                                                    &ing.id,\n-                                                );\n-                                            FeedPost {\n-                                                ts: ing.ts,\n-                                                id: ing.id.clone(),\n-                                                thread: Some(ing.thread_tag.clone()),\n-                                                thread_post_index,\n-                                                body: ing.raw.clone(),\n-                                            }\n-                                        })\n-                                        .collect();\n-                                    line_ok(RpcResult::Feed(FeedResponse {\n-                                        delegate: Some(delegate_stored),\n+                                        });\n+                                    let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n+                                    line_ok(RpcResult::Feed(rpc_feed(\n+                                        &reduced,\n+                                        &viewer,\n+                                        Some(delegate_stored),\n                                         since,\n-                                        posts,\n-                                        total,\n-                                    }))\n+                                        implicit_anchor,\n+                                        limit,\n+                                    )))\n                                 };\n                                 drop(reduced);\n                                 line\n@@ -1567,60 +1608,25 @@ pub async fn handle_rpc_batch(\n                             None => {\n                                 // Session catch-up: last time *you* posted anything (delegate or not), so revisiting\n                                 // an old chat with only a token still gets a sane cutoff.\n-                                let since_default = reduced\n+                                let implicit_anchor = reduced\n                                     .ingests_ordered\n                                     .iter()\n+                                    .enumerate()\n                                     .rev()\n-                                    .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                    .find(|ing| {\n-                                        if ing.principal != viewer {\n-                                            return false;\n-                                        }\n-                                        let scope = scope_from_room_wire(&ing.room_id);\n-                                        can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n-                                    })\n-                                    .map(|ing| ing.ts);\n-                                let since = since.or(since_default);\n-                                let cutoff = since.unwrap_or(0);\n-                                let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n-                                let matching: Vec<&str> = reduced.ingests_ordered.iter().rev()\n-                                    .map(|id| id.as_str())\n-                                    .take_while(|id| reduced.ingests_by_id.get(*id).is_some_and(|ing| ing.ts > cutoff))\n-                                    .filter(|id| {\n-                                        reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n+                                    .find_map(|(index, id)| {\n+                                        reduced.ingests_by_id.get(id).and_then(|ing| {\n+                                            (ing.principal == viewer).then_some((index, ing.ts))\n                                         })\n-                                    })\n-                                    .filter(|id| !reduced.redacted_posts.contains(*id))\n-                                    .collect();\n-                                let total = matching.len();\n-                                let posts: Vec<FeedPost> = matching.into_iter()\n-                                    .take(limit)\n-                                    .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                    .map(|ing| {\n-                                        let scope = scope_from_room_wire(&ing.room_id);\n-                                        let thread_post_index = reduced\n-                                            .try_thread_post_index_chronological(\n-                                                &scope,\n-                                                &ing.thread_tag,\n-                                                &ing.id,\n-                                            );\n-                                        FeedPost {\n-                                            ts: ing.ts,\n-                                            id: ing.id.clone(),\n-                                            thread: Some(ing.thread_tag.clone()),\n-                                            thread_post_index,\n-                                            body: ing.raw.clone(),\n-                                        }\n-                                    })\n-                                    .collect();\n-                                let line = line_ok(RpcResult::Feed(FeedResponse {\n-                                    delegate: None,\n+                                    });\n+                                let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n+                                let line = line_ok(RpcResult::Feed(rpc_feed(\n+                                    &reduced,\n+                                    &viewer,\n+                                    None,\n                                     since,\n-                                    posts,\n-                                    total,\n-                                }));\n+                                    implicit_anchor,\n+                                    limit,\n+                                )));\n                                 drop(reduced);\n                                 line\n                             }\ndiff --git a/server/tests/integration_rooms.rs b/server/tests/integration_rooms.rs\nindex a3b378267e090a016a7e663f103a0dd9f482690b..e623523ba352ce456674a399542c689505760b78 100644\n--- a/server/tests/integration_rooms.rs\n+++ b/server/tests/integration_rooms.rs\n@@ -1,6 +1,9 @@\n mod support;\n \n use slug_types::room_route_segment;\n+use slugsocial_server::events::{\n+    AgentBound, Event, GrantAdded, GrantRevoked, Ingest, RoomCreated, ThreadCapability,\n+};\n use support::*;\n \n #[tokio::test]\n@@ -473,6 +476,247 @@ async fn test_feed_without_delegate_uses_principal_last_post_including_delegate(\n     );\n }\n \n+#[tokio::test]\n+async fn test_feed_uses_delegate_ingest_position_when_multi_user_timestamps_collide() {\n+    let (addr, _tmp, _log, state, _handle) = create_test_server_with_state().await;\n+    seed_test_identity(&state, \"bob\", \"bobtok\", \"bobsecret\").await;\n+    let client = reqwest::Client::new();\n+    let alice_delegate =\n+        \"00000000-0000-0000-0000-0000000000c1:feedtest:local/alice-model\";\n+    let bob_delegate =\n+        \"00000000-0000-0000-0000-0000000000c2:feedtest:local/bob-model\";\n+\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        for (agent, username) in [\n+            (alice_delegate, \"testuser\"),\n+            (bob_delegate, \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::AgentBound(AgentBound {\n+                ts: 1,\n+                agent: agent.to_string(),\n+                username: username.to_string(),\n+            }));\n+        }\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 100,\n+            id: \"alice-anchor\".into(),\n+            raw: \"alice anchor\".into(),\n+            principal: \"testuser\".into(),\n+            delegate: Some(alice_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 100,\n+            id: \"bob-same-millisecond\".into(),\n+            raw: \"bob same-millisecond change\".into(),\n+            principal: \"bob\".into(),\n+            delegate: Some(bob_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+        // Event-log order remains authoritative even if the wall clock moves backwards.\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 99,\n+            id: \"bob-clock-rollback\".into(),\n+            raw: \"bob change after clock rollback\".into(),\n+            principal: \"bob\".into(),\n+            delegate: Some(bob_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+    }\n+\n+    let feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let posts = feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap();\n+    let ids: Vec<&str> = posts.iter().filter_map(|p| p[\"id\"].as_str()).collect();\n+    assert_eq!(\n+        ids,\n+        [\"bob-clock-rollback\", \"bob-same-millisecond\"],\n+        \"implicit feed cutoff must use append position, not timestamp\"\n+    );\n+}\n+\n+#[tokio::test]\n+async fn test_feed_multi_user_private_room_visibility_and_revoked_anchor_access() {\n+    let (addr, _tmp, _log, state, _handle) = create_test_server_with_state().await;\n+    seed_test_identity(&state, \"bob\", \"bobtok\", \"bobsecret\").await;\n+    seed_test_identity(&state, \"carol\", \"caroltok\", \"carolsecret\").await;\n+    let client = reqwest::Client::new();\n+    let alice_delegate =\n+        \"00000000-0000-0000-0000-0000000000d1:feedtest:local/alice-model\";\n+    let bob_delegate =\n+        \"00000000-0000-0000-0000-0000000000d2:feedtest:local/bob-model\";\n+    let room_alice = \"alice01/alice-room\";\n+    let room_bob = \"bob0001/bob-room\";\n+\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        for (agent, username) in [\n+            (alice_delegate, \"testuser\"),\n+            (bob_delegate, \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::AgentBound(AgentBound {\n+                ts: 1,\n+                agent: agent.to_string(),\n+                username: username.to_string(),\n+            }));\n+        }\n+        for (room_id, slug, owner) in [\n+            (room_alice, \"alice-room\", \"testuser\"),\n+            (room_bob, \"bob-room\", \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::RoomCreated(RoomCreated {\n+                ts: 2,\n+                room_id: room_id.to_string(),\n+                slug: slug.to_string(),\n+                owner: owner.to_string(),\n+            }));\n+            reduced.apply_event(Event::GrantAdded(GrantAdded {\n+                ts: 2,\n+                room_id: room_id.to_string(),\n+                username: owner.to_string(),\n+                capabilities: vec![ThreadCapability::View],\n+                granted_by: owner.to_string(),\n+            }));\n+        }\n+\n+        let mut add_ingest =\n+            |ts, id: &str, raw: &str, principal: &str, delegate: Option<&str>, room: &str| {\n+                reduced.apply_event(Event::Ingest(Ingest {\n+                    ts,\n+                    id: id.into(),\n+                    raw: raw.into(),\n+                    principal: principal.into(),\n+                    delegate: delegate.map(str::to_string),\n+                    room_id: room.into(),\n+                    thread_tag: \"feed-permissions\".into(),\n+                }));\n+            };\n+        add_ingest(10, \"prehistory\", \"must remain before alice anchor\", \"carol\", None, \"public\");\n+        add_ingest(\n+            11,\n+            \"alice-private-anchor\",\n+            \"alice last posted here\",\n+            \"testuser\",\n+            Some(alice_delegate),\n+            room_alice,\n+        );\n+        add_ingest(\n+            12,\n+            \"bob-public-anchor\",\n+            \"bob last posted here\",\n+            \"bob\",\n+            Some(bob_delegate),\n+            \"public\",\n+        );\n+        add_ingest(13, \"alice-room-change\", \"visible only to alice\", \"carol\", None, room_alice);\n+        add_ingest(14, \"bob-room-change\", \"visible only to bob\", \"carol\", None, room_bob);\n+        add_ingest(15, \"public-change\", \"visible to everyone\", \"carol\", None, \"public\");\n+\n+        reduced.apply_event(Event::GrantRevoked(GrantRevoked {\n+            ts: 16,\n+            room_id: room_alice.into(),\n+            username: \"testuser\".into(),\n+            capabilities: vec![ThreadCapability::View],\n+            revoked_by: \"testuser\".into(),\n+        }));\n+    }\n+\n+    let alice_feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let alice_posts = alice_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap();\n+    let alice_ids: Vec<&str> = alice_posts\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(\n+        alice_ids,\n+        [\"public-change\", \"bob-public-anchor\"],\n+        \"revoked private content must be hidden without moving the delegate anchor backwards\"\n+    );\n+    assert!(!alice_ids.contains(&\"prehistory\"));\n+    assert!(\n+        alice_posts\n+            .iter()\n+            .all(|post| post[\"room\"].as_str() == Some(\"public\")),\n+        \"private posts must not leak and every feed post must identify its room\"\n+    );\n+\n+    let bob_bearer = test_bearer_for(\"bobtok\", \"bobsecret\");\n+    let bob_feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&bob_bearer),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": bob_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let bob_ids: Vec<&str> = bob_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap()\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(bob_ids, [\"public-change\", \"bob-room-change\"]);\n+    assert_eq!(\n+        bob_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"][1][\"room\"],\n+        room_bob\n+    );\n+\n+    // Restoring View exposes only changes after the same stable delegate anchor.\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        reduced.apply_event(Event::GrantAdded(GrantAdded {\n+            ts: 17,\n+            room_id: room_alice.into(),\n+            username: \"testuser\".into(),\n+            capabilities: vec![ThreadCapability::View],\n+            granted_by: \"testuser\".into(),\n+        }));\n+    }\n+    let restored = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let restored_ids: Vec<&str> = restored[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap()\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(\n+        restored_ids,\n+        [\"public-change\", \"alice-room-change\", \"bob-public-anchor\"]\n+    );\n+}\n+\n #[tokio::test]\n async fn test_private_room_thread_urls_use_t_segment() {\n     let (addr, _tmp, _log, _handle) = create_test_server().await;\ndiff --git a/server/tests/support/mod.rs b/server/tests/support/mod.rs\nindex 4a620eaa875e7a1145f2a4e82cc4ff2be21d5345..a4320e991763617c1a760efad4b621977e2b74d0 100644\n--- a/server/tests/support/mod.rs\n+++ b/server/tests/support/mod.rs\n@@ -20,8 +20,10 @@ pub fn sha256_hex(s: &str) -> String {\n \n /// Fixed bearer for integration tests (`TokenIssued` seeded into reducer in `create_test_server`).\n pub fn test_bearer() -> String {\n-    let token_id = \"testtok\";\n-    let secret = \"secret\";\n+    test_bearer_for(\"testtok\", \"secret\")\n+}\n+\n+pub fn test_bearer_for(token_id: &str, secret: &str) -> String {\n     format!(\"slug_{token_id}_{secret}\")\n }\n \n@@ -71,19 +73,27 @@ pub async fn rpc_batch(\n }\n \n pub async fn seed_test_token(state: &AppState) {\n+    seed_test_identity(state, \"testuser\", \"testtok\", \"secret\").await;\n+}\n+\n+/// Add a distinct principal and bearer to a running integration-test server.\n+pub async fn seed_test_identity(\n+    state: &AppState,\n+    username: &str,\n+    token_id: &str,\n+    secret: &str,\n+) {\n     let registered = Event::UserRegistered(UserRegistered {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         provider: \"test\".to_string(),\n-        provider_id: \"testuser\".to_string(),\n+        provider_id: username.to_string(),\n     });\n-    let token_id = \"testtok\";\n-    let secret = \"secret\";\n     let salt = \"salt\";\n     let token_hash = sha256_hex(&format!(\"{salt}:{secret}\"));\n     let ev = Event::TokenIssued(TokenIssued {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         token_id: token_id.to_string(),\n         token_hash,\n         salt: salt.to_string(),\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex 211493935d19582607f5c87fb492faf47bdc6f53..cd6f94c60a4e1c3bfbce13bc0404b803f5f57c6d 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -264,6 +264,9 @@ pub struct FeedResponse {\n pub struct FeedPost {\n     pub ts: i64,\n     pub id: String,\n+    /// Permission scope containing the post: `\"public\"` or a private room id.\n+    #[serde(default)]\n+    pub room: String,\n     /// Primary thread tag (without #), if the ingest declared one.\n     #[serde(skip_serializing_if = \"Option::is_none\")]\n     pub thread: Option<String>,\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}