{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[9acdf18a] feat: add RoomList RPC command and CLI room list subcommand\n\nReturns all rooms the authenticated principal has a grant in.\nIncludes integration tests proving per-user isolation: users only\nsee rooms they have been explicitly granted, not all rooms in the system.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\nSide A — unified diff (full patch):\ndiff --git a/bb.edn b/bb.edn\nindex f7c53eb2d5def514a8f2c480ac420416205db14e..8dc6a5be7321de198cbb5939842a33b8c5d52625 100644\n--- a/bb.edn\n+++ b/bb.edn\n@@ -47,16 +47,18 @@\n                                            \"RUST_LOG\"      \"info\"})})))}\n \n   test\n-  {:doc \"Full test suite: integration + auth + grants + invites\"\n+  {:doc \"Full test suite: integration + auth + grants + invites + room-list\"\n    :requires ([test.integration :as integration]\n               [test.auth :as auth]\n               [test.grants :as grants]\n-              [test.invites :as invites])\n+              [test.invites :as invites]\n+              [test.room-list :as room-list])\n    :task (do\n            (integration/integration)\n            (auth/auth-test)\n            (grants/grants-test)\n-           (invites/invites-test))}\n+           (invites/invites-test)\n+           (room-list/room-list-test))}\n \n   walkthrough-fixture\n   {:doc \"Run local server + mock OAuth + seeded walkthrough data for manual browser demos\"\ndiff --git a/cli/src/main.rs b/cli/src/main.rs\nindex 69492cb5417a0a19c38f8cacbeadd103bd905b6f..b008cf377bb360aaae666d2dfd4b5e13dedb204a 100644\n--- a/cli/src/main.rs\n+++ b/cli/src/main.rs\n@@ -219,6 +219,12 @@ enum RoomCmd {\n         #[arg(long)]\n         json: bool,\n     },\n+    /// List rooms the authenticated user has access to\n+    List {\n+        /// Output as JSON for agent parsing\n+        #[arg(long)]\n+        json: bool,\n+    },\n }\n \n #[derive(Subcommand, Debug)]\n@@ -1319,6 +1325,38 @@ async fn main() -> Result<()> {\n                     _ => return Err(anyhow!(\"unexpected RPC result\")),\n                 }\n             }\n+            RoomCmd::List { json } => {\n+                let client = http_client()?;\n+                let bearer = effective_bearer().ok_or_else(|| {\n+                    anyhow!(\n+                        \"no bearer token: run `slugsocial identity start --rig <rig> --model <model>` \\\n+                         then `slugsocial identity poll <session>`, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token\"\n+                    )\n+                })?;\n+                let batch = send_rpc(\n+                    &client,\n+                    base,\n+                    Some(&bearer),\n+                    vec![RpcCommand::RoomList],\n+                )\n+                .await?;\n+                match rpc_line_ok(&batch.results[0])? {\n+                    RpcResult::RoomList(resp) => {\n+                        if json {\n+                            println!(\"{}\", serde_json::to_string_pretty(&resp)?);\n+                        } else {\n+                            if resp.rooms.is_empty() {\n+                                println!(\"no rooms\");\n+                            } else {\n+                                for room in &resp.rooms {\n+                                    println!(\"{room}\");\n+                                }\n+                            }\n+                        }\n+                    }\n+                    _ => return Err(anyhow!(\"unexpected RPC result\")),\n+                }\n+            }\n         },\n \n         Command::Healthz { json } => {\ndiff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs\nindex ed4800e7cbdeaf04e72192c191e71354e603c1fe..f1ee6d35b95a1a28490823e907b8f4dc5c091b94 100644\n--- a/server/src/api/rpc.rs\n+++ b/server/src/api/rpc.rs\n@@ -1345,6 +1345,25 @@ pub async fn handle_rpc_batch(\n                     }\n                 }\n             }\n+            RpcCommand::RoomList => {\n+                let principal = {\n+                    let reduced = state.reduced.read().await;\n+                    verify_bearer_principal(&headers, &*reduced)\n+                };\n+                match principal {\n+                    Err((_, m)) => line_err(m, None),\n+                    Ok(principal) => {\n+                        let reduced = state.reduced.read().await;\n+                        let rooms: Vec<String> = reduced\n+                            .grants\n+                            .iter()\n+                            .filter(|(_, members)| members.contains_key(&principal))\n+                            .map(|(room, _)| room.clone())\n+                            .collect();\n+                        line_ok(RpcResult::RoomList(RoomListResponse { rooms }))\n+                    }\n+                }\n+            }\n             RpcCommand::RoomRevoke {\n                 room,\n                 username,\ndiff --git a/test/room_list.clj b/test/room_list.clj\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..a089a722ac8d5f822f47d5511a46f671d61d46cf\n--- /dev/null\n+++ b/test/room_list.clj\n@@ -0,0 +1,158 @@\n+(ns test.room-list\n+  \"Room list integration test: list rooms user has access to via POST /api/v0/rpc.\n+\n+  Covers:\n+  - user with no rooms -> empty list\n+  - user with one room -> list contains that room\n+  - user with multiple rooms -> list contains all rooms\"\n+  (:require [babashka.fs :as fs]\n+            [cheshire.core :as json]\n+            [clojure.set :as set]\n+            [test.common :as common]\n+            [test.oauth :as oauth]))\n+\n+(def ^:private counts (atom {:pass 0 :fail 0}))\n+\n+(defn- assert! [pred msg]\n+  (common/test-assert! counts pred msg))\n+\n+(defn- bearer [token] {\"Authorization\" (str \"Bearer \" token)})\n+\n+(defn- rpc-batch! [base-url token cmds]\n+  (let [resp (oauth/http-post-json (str base-url \"/api/v0/rpc\") cmds :headers (bearer token))]\n+    {:status (:status resp)\n+     :parsed (json/parse-string (:body resp) false)}))\n+\n+(defn- rpc-line-ok? [parsed]\n+  (true? (get-in parsed [\"results\" 0 \"ok\"])))\n+\n+(defn- register-user! [base-url session-agent username]\n+  (oauth/complete-registration! base-url\n+                                :agent session-agent\n+                                :username username\n+                                :assert! (fn [pred msg] (assert! pred msg))))\n+\n+(defn room-list-test [& _args]\n+  (println \"\\n━━━ room list integration check ━━━\\n\")\n+  (reset! counts {:pass 0 :fail 0})\n+\n+  (println \"building server binary…\")\n+  (common/letlocals\n+   (bind build (common/run-cargo-build-release! [\"slugsocial-server\"]))\n+   (assert! (zero? (:exit build)) \"cargo build succeeds\")\n+   (bind server-bin \"target/release/slugsocial-server\")\n+\n+   (bind tmp-dir (str (fs/create-temp-dir {:prefix \"slug-room-list-\"})))\n+   (bind slug-port (common/pick-port))\n+   (bind google-port (common/pick-port))\n+   (bind base-url (str \"http://127.0.0.1:\" slug-port))\n+   (bind google-url (str \"http://127.0.0.1:\" google-port))\n+\n+   (bind !server (atom nil))\n+   (bind !google (atom nil))\n+\n+   (bind server-env (common/slug-server-env tmp-dir base-url google-url slug-port))\n+   (try\n+     (println (str \"starting mock google on :\" google-port))\n+     (reset! !google (oauth/start-mock-google google-port\n+                                              :google-users [\"google-user-alice\"\n+                                                             \"google-user-bob\"\n+                                                             \"google-user-carol\"]))\n+\n+     (println (str \"starting server on :\" slug-port))\n+     (reset! !server (common/start-server server-bin server-env))\n+     (assert! (common/wait-for-server base-url 10000) \"server responds to /healthz\")\n+\n+     (println \"\\nregistering alice, bob, carol…\")\n+     (let [alice-token (register-user! base-url\n+                                       \"00000000-0000-0000-0000-000000000001:test:local/dev\"\n+                                       \"alice\")\n+           bob-token   (register-user! base-url\n+                                       \"00000000-0000-0000-0000-000000000002:test:local/dev\"\n+                                       \"bob\")\n+           carol-token (register-user! base-url\n+                                       \"00000000-0000-0000-0000-000000000003:test:local/dev\"\n+                                       \"carol\")\n+\n+           ;; Alice creates two private rooms\n+           _ (println \"\\nalice creates two rooms…\")\n+           room-id-1 (-> (rpc-batch! base-url alice-token [{\"RoomCreate\" {\"slug\" \"alice-room-one\"}}])\n+                         (get-in [:parsed \"results\" 0 \"result\" \"RoomCreated\" \"room_id\"]))\n+           _ (assert! (some? room-id-1) \"alice room-one created\")\n+           room-id-2 (-> (rpc-batch! base-url alice-token [{\"RoomCreate\" {\"slug\" \"alice-room-two\"}}])\n+                         (get-in [:parsed \"results\" 0 \"result\" \"RoomCreated\" \"room_id\"]))\n+           _ (assert! (some? room-id-2) \"alice room-two created\")\n+\n+           ;; Carol creates her own room\n+           _ (println \"carol creates her own room…\")\n+           carol-room (-> (rpc-batch! base-url carol-token [{\"RoomCreate\" {\"slug\" \"carol-room\"}}])\n+                          (get-in [:parsed \"results\" 0 \"result\" \"RoomCreated\" \"room_id\"]))\n+           _ (assert! (some? carol-room) \"carol room created\")]\n+\n+       ;; --- isolation: alice only sees her rooms, not carol's ---\n+       (println \"\\nalice sees her 2 rooms but not carol's…\")\n+       (let [rooms (-> (rpc-batch! base-url alice-token [\"RoomList\"])\n+                       (get-in [:parsed \"results\" 0 \"result\" \"RoomList\" \"rooms\"])\n+                       set)]\n+         (assert! (= #{room-id-1 room-id-2} rooms)\n+                  \"alice sees exactly her 2 rooms\")\n+         (assert! (not (contains? rooms carol-room))\n+                  \"alice does NOT see carol's room\"))\n+\n+       ;; --- isolation: carol only sees her room, not alice's ---\n+       (println \"carol sees only her room…\")\n+       (let [rooms (-> (rpc-batch! base-url carol-token [\"RoomList\"])\n+                       (get-in [:parsed \"results\" 0 \"result\" \"RoomList\" \"rooms\"])\n+                       set)]\n+         (assert! (= #{carol-room} rooms)\n+                  \"carol sees exactly her own room\")\n+         (assert! (not (contains? rooms room-id-1))\n+                  \"carol does NOT see alice's room-one\")\n+         (assert! (not (contains? rooms room-id-2))\n+                  \"carol does NOT see alice's room-two\"))\n+\n+       ;; --- bob sees nothing yet: alice has 3 rooms total but bob is in none ---\n+       (println \"bob (no grants) sees no rooms despite 3 existing…\")\n+       (let [rooms (-> (rpc-batch! base-url bob-token [\"RoomList\"])\n+                       (get-in [:parsed \"results\" 0 \"result\" \"RoomList\" \"rooms\"]))]\n+         (assert! (zero? (count rooms))\n+                  \"bob sees 0 rooms even though 3 exist in the system\"))\n+\n+       ;; --- partial grant: alice grants bob room-one only ---\n+       (println \"\\nalice grants bob view on room-one only…\")\n+       (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token\n+                                                   [{\"RoomGrant\" {\"room\" room-id-1\n+                                                                  \"username\" \"bob\"\n+                                                                  \"capabilities\" [\"view\"]}}])))\n+                \"grant ok\")\n+\n+       ;; bob sees room-one but NOT room-two or carol's room\n+       (println \"bob sees room-one but not room-two or carol's room…\")\n+       (let [rooms (-> (rpc-batch! base-url bob-token [\"RoomList\"])\n+                       (get-in [:parsed \"results\" 0 \"result\" \"RoomList\" \"rooms\"])\n+                       set)]\n+         (assert! (= #{room-id-1} rooms)\n+                  \"bob sees exactly room-one\")\n+         (assert! (not (contains? rooms room-id-2))\n+                  \"bob does NOT see alice's room-two (not granted)\")\n+         (assert! (not (contains? rooms carol-room))\n+                  \"bob does NOT see carol's room (not granted)\"))\n+\n+       ;; alice's view is unchanged\n+       (println \"alice's view unchanged after granting bob…\")\n+       (let [rooms (-> (rpc-batch! base-url alice-token [\"RoomList\"])\n+                       (get-in [:parsed \"results\" 0 \"result\" \"RoomList\" \"rooms\"])\n+                       set)]\n+         (assert! (= #{room-id-1 room-id-2} rooms)\n+                  \"alice still sees exactly her 2 rooms after granting bob\")))\n+\n+     (finally\n+       (when-some [s @!server] (common/kill-server s))\n+       (when-some [g @!google] ((:stop-fn g)))\n+       (fs/delete-tree tmp-dir)))\n+\n+   (bind {pass :pass fail :fail} @counts)\n+   (if (zero? fail)\n+     (println (str \"\\n\" common/ansi-green \"━━━ \" pass \" room list checks passed ━━━\" common/ansi-reset \"\\n\"))\n+     (do (println (str \"\\n\" common/ansi-red \"━━━ \" fail \" room list checks FAILED ━━━\" common/ansi-reset \"\\n\"))\n+         (System/exit 1)))))\ndiff --git a/test/runner.clj b/test/runner.clj\nindex b5c5f1f839d51487e4dee00952c2339b586b7a97..365372a7d11ab7968aa981f9b246543e25decfea 100644\n--- a/test/runner.clj\n+++ b/test/runner.clj\n@@ -4,13 +4,15 @@\n             [test.auth :as auth]\n             [test.grants :as grants]\n             [test.invites :as invites]\n+            [test.room-list :as room-list]\n             [test.browser-sse :as browser-sse]))\n \n (defn run-core! []\n   (integration/integration)\n   (auth/auth-test)\n   (grants/grants-test)\n-  (invites/invites-test))\n+  (invites/invites-test)\n+  (room-list/room-list-test))\n \n (defn -main [& args]\n   (if (= [\"browser-sse\"] (vec args))\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex bb8586f1734f77d95598a9294bdb0de2d55bf715..341fff7be7f9b28abc79c738d84804f743ce5657 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -260,6 +260,11 @@ pub struct RoomAuditResponse {\n     pub grants: Vec<RoomAuditEntry>,\n }\n \n+#[derive(Debug, Serialize, Deserialize)]\n+pub struct RoomListResponse {\n+    pub rooms: Vec<String>,\n+}\n+\n #[derive(Debug, Serialize, Deserialize)]\n #[serde(transparent)]\n pub struct RpcBatch(pub Vec<RpcCommand>);\n@@ -342,6 +347,8 @@ pub enum RpcCommand {\n     RoomAudit {\n         room: String,\n     },\n+    /// List rooms the authenticated principal has access to.\n+    RoomList,\n     GetGlobalRank {\n         room: String,\n         #[serde(default)]\n@@ -419,6 +426,7 @@ pub enum RpcResult {\n         max_uses: usize,\n     },\n     RoomAudit(RoomAuditResponse),\n+    RoomList(RoomListResponse),\n     GrantOk {},\n     GlobalRank(GlobalRankResponse),\n     Pair(PairResponse),\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[8f69c309] Require Reddit OAuth when credentials are set and refresh on 401/403.\n\nAvoid falling back to the public www.reddit.com API from cloud IPs, which\nreturns Reddit's network-security block page. Also pin SORTER2_BASE_URL in fly.toml.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/fly.toml b/fly.toml\nindex f0c6a39f643c204987debc177234d95a8ef44b65..ca7e0088a7efd7d58d29d808f8d89080b2bff233 100644\n--- a/fly.toml\n+++ b/fly.toml\n@@ -5,6 +5,7 @@ primary_region = \"iad\"\n   dockerfile = \"Dockerfile\"\n \n [env]\n+  SORTER2_BASE_URL = \"https://reddit.sorter.social\"\n   SORTER2_DATA_DIR = \"/data\"\n   SORTER2_EVENT_LOG = \"/data/events.jsonl\"\n   PORT = \"8080\"\ndiff --git a/server/src/reddit.rs b/server/src/reddit.rs\nindex a874814f8927192ee62cab2d0db1efd27dcd57b7..f409764c1e1f36216f1b08107043c2eab905694c 100644\n--- a/server/src/reddit.rs\n+++ b/server/src/reddit.rs\n@@ -283,26 +283,35 @@ async fn reddit_worker(\n         );\n         tokio::time::sleep(current_delay).await;\n \n-        if let Some(c) = &creds {\n-            oauth = ensure_oauth_token(&client, &oauth_token_base, c, oauth.take()).await;\n-        }\n-\n-        let token = oauth.as_ref().map(|t| t.access_token.as_str());\n-        let fetch_base = if token.is_some() {\n-            tracing::debug!(\n-                item = %fetch_id,\n-                base = %oauth_api_base,\n-                \"reddit fetch using OAuth bearer\"\n-            );\n-            &oauth_api_base\n-        } else {\n-            &api_base\n-        };\n-        let url = match kind {\n-            FetchKind::SelfEntity => map_item_to_reddit_api(&fetch_id, fetch_base),\n-            FetchKind::Children => map_children_url(&fetch_id, fetch_base),\n+        let outcome = match &creds {\n+            Some(c) => {\n+                // OAuth is required when credentials are configured — never fall\n+                // back to the public www.reddit.com JSON endpoints (cloud IPs\n+                // get blocked with a 403 HTML interstitial).\n+                fetch_with_oauth(\n+                    &client,\n+                    &oauth_token_base,\n+                    &oauth_api_base,\n+                    c,\n+                    &mut oauth,\n+                    &fetch_id,\n+                    kind,\n+                )\n+                .await\n+            }\n+            None => {\n+                let url = match kind {\n+                    FetchKind::SelfEntity => map_item_to_reddit_api(&fetch_id, &api_base),\n+                    FetchKind::Children => map_children_url(&fetch_id, &api_base),\n+                };\n+                match do_fetch(&client, &url, &fetch_id, None).await {\n+                    Ok(FetchOutcome::AuthRejected { status, detail }) => {\n+                        Err(format!(\"Reddit API {status}: {detail}\"))\n+                    }\n+                    other => other,\n+                }\n+            }\n         };\n-        let outcome = do_fetch(&client, &url, &fetch_id, token).await;\n \n         match outcome {\n             Ok(FetchOutcome::Payload(payload)) => {\n@@ -342,6 +351,12 @@ async fn reddit_worker(\n                 current_delay = (current_delay * 2).min(Duration::from_secs(60));\n                 notify(done, FetchJobResult::RateLimited { reset_secs });\n             }\n+            Ok(FetchOutcome::AuthRejected { status, detail }) => {\n+                let e = format!(\"Reddit API {status}: {detail}\");\n+                tracing::warn!(item = %fetch_id, err = %e, \"reddit fetch auth rejected\");\n+                current_delay = (current_delay * 2).min(Duration::from_secs(60));\n+                notify(done, FetchJobResult::Failed(e));\n+            }\n             Err(e) => {\n                 tracing::warn!(item = %fetch_id, err = %e, \"reddit fetch failed\");\n                 current_delay = (current_delay * 2).min(Duration::from_secs(60));\n@@ -357,6 +372,60 @@ enum FetchOutcome {\n     Payload(Value),\n     NotFound,\n     RateLimited { reset_secs: u64 },\n+    /// Bearer rejected — caller should drop the cached token and retry once.\n+    AuthRejected { status: StatusCode, detail: String },\n+}\n+\n+async fn fetch_with_oauth(\n+    client: &Client,\n+    oauth_token_base: &str,\n+    oauth_api_base: &str,\n+    creds: &RedditCredentials,\n+    oauth: &mut Option<OAuthToken>,\n+    fetch_id: &ItemId,\n+    kind: FetchKind,\n+) -> Result<FetchOutcome, String> {\n+    for attempt in 0..2 {\n+        let force_refresh = attempt > 0;\n+        *oauth = Some(\n+            ensure_oauth_token(client, oauth_token_base, creds, oauth.take(), force_refresh)\n+                .await?,\n+        );\n+        let token = oauth\n+            .as_ref()\n+            .expect(\"token set above\")\n+            .access_token\n+            .clone();\n+\n+        tracing::debug!(\n+            item = %fetch_id,\n+            base = %oauth_api_base,\n+            attempt,\n+            \"reddit fetch using OAuth bearer\"\n+        );\n+\n+        let url = match kind {\n+            FetchKind::SelfEntity => map_item_to_reddit_api(fetch_id, oauth_api_base),\n+            FetchKind::Children => map_children_url(fetch_id, oauth_api_base),\n+        };\n+        match do_fetch(client, &url, fetch_id, Some(&token)).await? {\n+            FetchOutcome::AuthRejected { status, detail } if attempt == 0 => {\n+                tracing::warn!(\n+                    item = %fetch_id,\n+                    %status,\n+                    %detail,\n+                    \"reddit OAuth rejected; refreshing token and retrying\"\n+                );\n+                *oauth = None;\n+                continue;\n+            }\n+            FetchOutcome::AuthRejected { status, detail } => {\n+                return Err(format!(\"Reddit API {status}: {detail}\"));\n+            }\n+            other => return Ok(other),\n+        }\n+    }\n+    unreachable!(\"loop always returns\")\n }\n \n async fn ensure_oauth_token(\n@@ -364,35 +433,35 @@ async fn ensure_oauth_token(\n     oauth_base: &str,\n     creds: &RedditCredentials,\n     existing: Option<OAuthToken>,\n-) -> Option<OAuthToken> {\n-    if let Some(t) = existing {\n-        if Instant::now() < t.expires_at - Duration::from_secs(60) {\n-            tracing::debug!(\"reddit OAuth token still valid\");\n-            return Some(t);\n+    force_refresh: bool,\n+) -> Result<OAuthToken, String> {\n+    if !force_refresh {\n+        if let Some(t) = existing {\n+            if Instant::now() < t.expires_at - Duration::from_secs(60) {\n+                tracing::debug!(\"reddit OAuth token still valid\");\n+                return Ok(t);\n+            }\n         }\n     }\n \n     let url = format!(\"{}/api/v1/access_token\", oauth_base.trim_end_matches('/'));\n-    tracing::debug!(%url, \"reddit OAuth token request\");\n+    tracing::debug!(%url, force_refresh, \"reddit OAuth token request\");\n \n     let resp = client\n         .post(&url)\n         .basic_auth(&creds.client_id, Some(&creds.client_secret))\n         .form(&[(\"grant_type\", \"client_credentials\")])\n         .send()\n-        .await;\n-\n-    let resp = match resp {\n-        Ok(r) => r,\n-        Err(e) => {\n-            tracing::warn!(\"reddit OAuth token request failed: {e}\");\n-            return None;\n-        }\n-    };\n+        .await\n+        .map_err(|e| format!(\"Reddit OAuth token request failed: {e}\"))?;\n \n     if !resp.status().is_success() {\n-        tracing::warn!(\"reddit OAuth token HTTP {}\", resp.status());\n-        return None;\n+        let status = resp.status();\n+        let body = resp.text().await.unwrap_or_default();\n+        return Err(format!(\n+            \"Reddit OAuth token HTTP {status}: {}\",\n+            truncate_for_error(&body)\n+        ));\n     }\n \n     #[derive(Deserialize)]\n@@ -401,21 +470,40 @@ async fn ensure_oauth_token(\n         expires_in: u64,\n     }\n \n-    let body: TokenResponse = match resp.json().await {\n-        Ok(b) => b,\n-        Err(e) => {\n-            tracing::warn!(\"reddit OAuth token parse failed: {e}\");\n-            return None;\n-        }\n-    };\n+    let body: TokenResponse = resp\n+        .json()\n+        .await\n+        .map_err(|e| format!(\"Reddit OAuth token parse failed: {e}\"))?;\n \n-    tracing::debug!(expires_in = body.expires_in, \"reddit OAuth token acquired\");\n-    Some(OAuthToken {\n+    tracing::info!(expires_in = body.expires_in, \"reddit OAuth token acquired\");\n+    Ok(OAuthToken {\n         access_token: body.access_token,\n         expires_at: Instant::now() + Duration::from_secs(body.expires_in),\n     })\n }\n \n+fn truncate_for_error(body: &str) -> String {\n+    let compact: String = body.split_whitespace().collect::<Vec<_>>().join(\" \");\n+    if compact.is_empty() {\n+        return \"(empty body)\".into();\n+    }\n+    // Prefer the human-readable block message over dumping Reddit's CSS.\n+    if let Some(idx) = compact.find(\"You've been blocked\") {\n+        let slice: String = compact.chars().skip(idx).take(160).collect();\n+        return if compact.chars().count() > idx + 160 {\n+            format!(\"{slice}…\")\n+        } else {\n+            slice\n+        };\n+    }\n+    let chars: String = compact.chars().take(200).collect();\n+    if compact.chars().count() > 200 {\n+        format!(\"{chars}…\")\n+    } else {\n+        chars\n+    }\n+}\n+\n async fn do_fetch(\n     client: &Client,\n     url: &str,\n@@ -460,15 +548,16 @@ async fn do_fetch(\n \n     if !status.is_success() {\n         let body = resp.text().await.unwrap_or_default();\n+        let detail = truncate_for_error(&body);\n         tracing::debug!(\n             item = %id,\n             %status,\n             body_len = body.len(),\n-            body_prefix = %body.chars().take(240).collect::<String>(),\n+            %detail,\n             \"reddit non-success body\"\n         );\n         if status == StatusCode::FORBIDDEN || status == StatusCode::UNAUTHORIZED {\n-            return Err(format!(\"Reddit API {status}: {body}\"));\n+            return Ok(FetchOutcome::AuthRejected { status, detail });\n         }\n         return Ok(FetchOutcome::NotFound);\n     }\n@@ -716,6 +805,15 @@ fn reddit_direct_image_url(url: &str) -> bool {\n mod tests {\n     use super::*;\n \n+    #[test]\n+    fn truncate_error_prefers_block_message() {\n+        let html = r#\"<style>.x{color:red}</style><div>You've been blocked by network security. To continue, log in</div>\"#;\n+        let msg = truncate_for_error(html);\n+        assert!(msg.starts_with(\"You've been blocked\"));\n+        assert!(msg.len() < 200);\n+        assert!(!msg.contains(\".x{color\"));\n+    }\n+\n     #[test]\n     fn map_subreddit_about_url() {\n         let id = ItemId::from_url(\"https://reddit.com/r/rust\").unwrap();\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}