{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[52f5c51c] Add Reddit OAuth linking and make UUID the only account identity.\n\nOAuth providers only attach to a session UUID (first link creates the\nprincipal); linked providers stay private on the account page.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide A — unified diff (full patch):\ndiff --git a/AGENTS.md b/AGENTS.md\nindex 6e0fd8ebb65d665c9c1438e3275971d62b98fd95..e9cc3173dbeb21ad0fc090ca7b407b027c7820a9 100644\n--- a/AGENTS.md\n+++ b/AGENTS.md\n@@ -35,8 +35,11 @@ Environment variables (defaults in `server/src/state.rs`):\n - `SORTER2_DATA_DIR` — default `./data` (created on startup)\n - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`\n - `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)\n-- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)\n-- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)\n+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth linking (optional)\n+- `REDDIT_CLIENT_ID` / `REDDIT_CLIENT_SECRET` (or `REDDIT_APP_*`) — Reddit API import + OAuth linking (optional)\n+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` and `/auth/reddit` (tests only)\n+\n+Identity: UUID is canonical. OAuth providers only *link* to a UUID (first link creates the principal). Linked providers are private to the account owner.\n \n Health check: `GET /healthz` → `ok`.\n \ndiff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs\nindex 5906f93b13853421e96a3c37bc9d8202a47842bf..c706ae8045a811e5941f5f6c72da88f42a403a82 100644\n--- a/server/src/auth/mod.rs\n+++ b/server/src/auth/mod.rs\n@@ -1,4 +1,8 @@\n-//! GitHub OAuth login, session cookies, and vote actor resolution.\n+//! OAuth linking, session cookies, and vote actor resolution.\n+//!\n+//! Canonical identity is a UUID. OAuth providers only *link* to that UUID\n+//! (first link creates the principal; later links attach while logged in).\n+//! Which providers are linked is private to the account owner.\n \n pub mod config;\n pub mod identity;\n@@ -22,7 +26,9 @@ use crate::{\n     form_template::template_json_compact,\n     html::layout,\n     state::AppState,\n-    storage_schema::{oauth_link_owner, pseudonym_owner, Store, StoreFields},\n+    storage_schema::{\n+        linked_providers_for_uuid, oauth_link_owner, pseudonym_owner, Store, StoreFields,\n+    },\n     ui_action::UI_RPC_FIELD,\n };\n \n@@ -53,10 +59,12 @@ fn new_actor_uuid() -> String {\n pub struct LoginQuery {\n     #[serde(default)]\n     pub return_to: Option<String>,\n+    #[serde(default)]\n+    pub error: Option<String>,\n }\n \n #[derive(Debug, Deserialize)]\n-pub struct GitHubStartQuery {\n+pub struct OAuthStartQuery {\n     #[serde(default)]\n     pub return_to: Option<String>,\n     #[serde(default)]\n@@ -72,15 +80,22 @@ fn return_from_query_or_jar(jar: &CookieJar, query: Option<&str>) -> String {\n         .unwrap_or_else(|| \"/\".to_string())\n }\n \n-fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, String)> {\n+/// Available OAuth link targets: `(provider_key, label, start_href)`.\n+fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, &'static str, String)> {\n     let mut out = Vec::new();\n+    let enc = urlencoding::encode(return_to);\n     if oauth::GitHubConfig::from_env(base_url).is_some() {\n         out.push((\n-            \"GitHub\",\n-            format!(\n-                \"/auth/github?return_to={}\",\n-                urlencoding::encode(return_to)\n-            ),\n+            \"github\",\n+            oauth::provider_label(\"github\"),\n+            format!(\"/auth/github?return_to={enc}\"),\n+        ));\n+    }\n+    if oauth::RedditConfig::from_env(base_url).is_some() {\n+        out.push((\n+            \"reddit\",\n+            oauth::provider_label(\"reddit\"),\n+            format!(\"/auth/reddit?return_to={enc}\"),\n         ));\n     }\n     out\n@@ -125,23 +140,41 @@ fn alias_claim_forms(return_to: &str, submit_label: &str) -> Result<Markup, Stat\n     })\n }\n \n-fn signed_out_body(providers: &[(&str, String)]) -> Markup {\n+fn login_error_message(code: Option<&str>) -> Option<&'static str> {\n+    match code {\n+        Some(\"oauth_taken\") => {\n+            Some(\"that OAuth account is already linked to a different sorter2 account\")\n+        }\n+        Some(\"oauth_failed\") => Some(\"OAuth failed — try again\"),\n+        _ => None,\n+    }\n+}\n+\n+fn signed_out_body(\n+    providers: &[(&str, &str, String)],\n+    error: Option<&str>,\n+) -> Markup {\n     html! {\n         main class=\"panel login-page\" {\n             section class=\"login-section\" {\n                 h1 { \"sign in\" }\n-                p class=\"muted\" { \"link an account to vote under a lasting alias\" }\n+                p class=\"muted\" {\n+                    \"link an OAuth account to create your identity, then claim an alias to vote\"\n+                }\n+                @if let Some(msg) = login_error_message(error) {\n+                    p class=\"alias-bad\" data-testid=\"login-error\" { (msg) }\n+                }\n                 @if providers.is_empty() {\n                     p class=\"muted\" {\n-                        \"OAuth is not configured. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET.\"\n+                        \"OAuth is not configured. Set GitHub and/or Reddit client credentials.\"\n                     }\n                 } @else {\n                     ul class=\"oauth-provider-list\" {\n-                        @for (name, href) in providers {\n+                        @for (key, label, href) in providers {\n                             li {\n                                 a href=(href) class=\"btn-primary oauth-provider\"\n-                                    data-testid=(format!(\"oauth-{}\", name.to_lowercase())) {\n-                                    (format!(\"Continue with {name}\"))\n+                                    data-testid=(format!(\"oauth-{key}\")) {\n+                                    (format!(\"Link {label}\"))\n                                 }\n                             }\n                         }\n@@ -156,7 +189,10 @@ fn signed_out_body(providers: &[(&str, String)]) -> Markup {\n fn account_body(\n     actor: &session::SessionActor,\n     aliases: &[String],\n-    providers: &[(&str, String)],\n+    // Provider keys already linked to this UUID (private).\n+    linked: &[String],\n+    // Providers available to link: not yet attached.\n+    unlinkable: &[(&str, &str, String)],\n     claim_forms: Markup,\n ) -> Markup {\n     let current = actor.pseudonym.trim();\n@@ -212,16 +248,29 @@ fn account_body(\n                 (claim_forms)\n             }\n \n-            @if !providers.is_empty() {\n-                section class=\"login-section\" {\n-                    h2 { \"linked sign-in\" }\n-                    p class=\"muted small\" { \"sign in again with the same provider to return to this account\" }\n+            section class=\"login-section\" {\n+                h2 { \"linked sign-in\" }\n+                p class=\"muted small\" {\n+                    \"private to you — linking more providers raises trust weight without publishing which accounts you use\"\n+                }\n+                @if linked.is_empty() {\n+                    p class=\"muted\" data-testid=\"linked-providers-empty\" { \"none yet\" }\n+                } @else {\n+                    ul class=\"linked-provider-list\" data-testid=\"linked-providers\" {\n+                        @for key in linked {\n+                            li data-testid=(format!(\"linked-{key}\")) {\n+                                (oauth::provider_label(key))\n+                            }\n+                        }\n+                    }\n+                }\n+                @if !unlinkable.is_empty() {\n                     ul class=\"oauth-provider-list\" {\n-                        @for (name, href) in providers {\n+                        @for (key, label, href) in unlinkable {\n                             li {\n                                 a href=(href) class=\"btn-secondary oauth-provider\"\n-                                    data-testid=(format!(\"oauth-relink-{}\", name.to_lowercase())) {\n-                                    (format!(\"Re-link {name}\"))\n+                                    data-testid=(format!(\"oauth-link-{key}\")) {\n+                                    (format!(\"Link {label}\"))\n                                 }\n                             }\n                         }\n@@ -243,12 +292,21 @@ fn account_body(\n fn login_body(\n     session: Option<&session::SessionActor>,\n     aliases: &[String],\n-    providers: &[(&str, String)],\n+    linked: &[String],\n+    providers: &[(&str, &str, String)],\n     claim_forms: Option<Markup>,\n+    error: Option<&str>,\n ) -> Markup {\n     match (session, claim_forms) {\n-        (Some(actor), Some(forms)) => account_body(actor, aliases, providers, forms),\n-        _ => signed_out_body(providers),\n+        (Some(actor), Some(forms)) => {\n+            let unlinkable: Vec<_> = providers\n+                .iter()\n+                .filter(|(key, _, _)| !linked.iter().any(|p| p == key))\n+                .cloned()\n+                .collect();\n+            account_body(actor, aliases, linked, &unlinkable, forms)\n+        }\n+        _ => signed_out_body(providers, error),\n     }\n }\n \n@@ -268,6 +326,10 @@ pub async fn login_page(\n         .as_ref()\n         .map(|s| alias_list(db, &s.uuid))\n         .unwrap_or_default();\n+    let linked = session\n+        .as_ref()\n+        .map(|s| linked_providers_for_uuid(db, &s.uuid).unwrap_or_default())\n+        .unwrap_or_default();\n     let providers = oauth_providers(&base_url_from_env(state.cfg.port), &return_to);\n \n     let claim_forms = if session.is_some() {\n@@ -282,7 +344,14 @@ pub async fn login_page(\n         } else {\n             \"login · sorter2\"\n         },\n-        login_body(session.as_ref(), &aliases, &providers, claim_forms),\n+        login_body(\n+            session.as_ref(),\n+            &aliases,\n+            &linked,\n+            &providers,\n+            claim_forms,\n+            query.error.as_deref(),\n+        ),\n         state.views.get_views(\"/login\"),\n         session\n             .as_ref()\n@@ -302,7 +371,6 @@ pub async fn alias_page(\n     let db = state.projection_store.db();\n     let session = session::load_valid_session(db, &session_id).ok_or(StatusCode::UNAUTHORIZED)?;\n     if session::session_has_pseudonym(&session) {\n-        // Already onboarded — manage aliases on the account page.\n         return Ok(Redirect::to(\"/login\").into_response());\n     }\n \n@@ -331,7 +399,7 @@ pub async fn alias_page(\n pub async fn github_start(\n     State(state): State<AppState>,\n     jar: CookieJar,\n-    Query(query): Query<GitHubStartQuery>,\n+    Query(query): Query<OAuthStartQuery>,\n ) -> Result<Response, StatusCode> {\n     let cfg = oauth::GitHubConfig::from_env(&base_url_from_env(state.cfg.port))\n         .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n@@ -342,7 +410,28 @@ pub async fn github_start(\n     } else {\n         None\n     };\n-    let url = oauth::authorize_url(&cfg, &state_token, mock_user);\n+    let url = oauth::github_authorize_url(&cfg, &state_token, mock_user);\n+    let jar = jar\n+        .add(session::oauth_state_cookie_value(&state_token))\n+        .add(session::auth_return_cookie_value(&return_to));\n+    Ok((jar, Redirect::temporary(&url)).into_response())\n+}\n+\n+pub async fn reddit_start(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    Query(query): Query<OAuthStartQuery>,\n+) -> Result<Response, StatusCode> {\n+    let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+    let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());\n+    let state_token = session::new_oauth_state();\n+    let mock_user = if config::mock_oauth_allowed() {\n+        query.mock_user.as_deref()\n+    } else {\n+        None\n+    };\n+    let url = oauth::reddit_authorize_url(&cfg, &state_token, mock_user);\n     let jar = jar\n         .add(session::oauth_state_cookie_value(&state_token))\n         .add(session::auth_return_cookie_value(&return_to));\n@@ -355,6 +444,13 @@ pub struct OAuthCallbackQuery {\n     pub state: String,\n }\n \n+/// Link `provider:provider_id` to a UUID.\n+///\n+/// - Logged in + new provider → attach to session UUID\n+/// - Logged in + already ours → no-op\n+/// - Logged in + owned by someone else → conflict\n+/// - Logged out + known link → resume that UUID\n+/// - Logged out + unknown → create principal + first link\n async fn finish_oauth_login(\n     state: &AppState,\n     jar: CookieJar,\n@@ -364,11 +460,41 @@ async fn finish_oauth_login(\n     let db = state.projection_store.db();\n     let return_to = return_from_query_or_jar(&jar, None);\n \n-    let uuid = match oauth_link_owner(db, provider, &provider_id)\n-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?\n-    {\n-        Some(existing) => existing,\n-        None => {\n+    let existing_owner = oauth_link_owner(db, provider, &provider_id)\n+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+    let session_uuid = session::session_id_from_jar(&jar)\n+        .as_deref()\n+        .and_then(|id| session::load_valid_session(db, id))\n+        .map(|s| s.uuid);\n+    let linking_while_logged_in = session_uuid.is_some();\n+\n+    let uuid = match (session_uuid, existing_owner) {\n+        (Some(session_uuid), Some(owner)) if owner == session_uuid => session_uuid,\n+        (Some(_), Some(_)) => {\n+            return Ok((\n+                jar.add(session::clear_oauth_state_cookie()),\n+                \"/login?error=oauth_taken\".into(),\n+            ));\n+        }\n+        (Some(session_uuid), None) => {\n+            let ts = now_ms();\n+            state\n+                .append_identity_events(vec![Event::OauthLinked {\n+                    uuid: session_uuid.clone(),\n+                    provider: provider.to_string(),\n+                    provider_id,\n+                    ts,\n+                }])\n+                .await\n+                .map_err(|e| {\n+                    tracing::warn!(err = %e, \"oauth link append failed\");\n+                    StatusCode::INTERNAL_SERVER_ERROR\n+                })?;\n+            session_uuid\n+        }\n+        (None, Some(owner)) => owner,\n+        (None, None) => {\n             let uuid = new_actor_uuid();\n             let ts = now_ms();\n             state\n@@ -409,6 +535,9 @@ async fn finish_oauth_login(\n             \"/login/alias?return_to={}\",\n             urlencoding::encode(&return_to)\n         )\n+    } else if linking_while_logged_in {\n+        // Additional link while already in an account → stay on account page.\n+        \"/login\".to_string()\n     } else {\n         return_to\n     };\n@@ -434,22 +563,57 @@ pub async fn github_callback(\n         .build()\n         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n \n-    let token = oauth::exchange_code(&client, &cfg, &query.code)\n+    let token = oauth::github_exchange_code(&client, &cfg, &query.code)\n         .await\n         .map_err(|e| {\n             tracing::warn!(err = %e, \"github oauth token exchange failed\");\n             StatusCode::BAD_GATEWAY\n         })?;\n-    let user = oauth::fetch_user(&client, &cfg.api_base, &token)\n+    let user = oauth::github_fetch_user(&client, &cfg.api_base, &token)\n         .await\n         .map_err(|e| {\n             tracing::warn!(err = %e, \"github user fetch failed\");\n             StatusCode::BAD_GATEWAY\n         })?;\n \n-    let provider = \"github\";\n-    let provider_id = oauth::provider_id(&user);\n-    let (jar, dest) = finish_oauth_login(&state, jar, provider, provider_id).await?;\n+    let (jar, dest) =\n+        finish_oauth_login(&state, jar, \"github\", oauth::github_provider_id(&user)).await?;\n+    Ok((jar, Redirect::to(&dest)).into_response())\n+}\n+\n+pub async fn reddit_callback(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    Query(query): Query<OAuthCallbackQuery>,\n+) -> Result<Response, StatusCode> {\n+    let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+\n+    let expected_state = session::oauth_state_from_jar(&jar).ok_or(StatusCode::BAD_REQUEST)?;\n+    if expected_state != query.state {\n+        return Err(StatusCode::BAD_REQUEST);\n+    }\n+\n+    let client = Client::builder()\n+        .timeout(std::time::Duration::from_secs(15))\n+        .build()\n+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+    let token = oauth::reddit_exchange_code(&client, &cfg, &query.code)\n+        .await\n+        .map_err(|e| {\n+            tracing::warn!(err = %e, \"reddit oauth token exchange failed\");\n+            StatusCode::BAD_GATEWAY\n+        })?;\n+    let user = oauth::reddit_fetch_user(&client, &cfg, &token)\n+        .await\n+        .map_err(|e| {\n+            tracing::warn!(err = %e, \"reddit user fetch failed\");\n+            StatusCode::BAD_GATEWAY\n+        })?;\n+\n+    let (jar, dest) =\n+        finish_oauth_login(&state, jar, \"reddit\", oauth::reddit_provider_id(&user)).await?;\n     Ok((jar, Redirect::to(&dest)).into_response())\n }\n \ndiff --git a/server/src/auth/oauth.rs b/server/src/auth/oauth.rs\nindex b80078fee0c5acd905b9125d29454e46c4e0d066..369b1527d9032cf312a07819279e0f988ef4a36e 100644\n--- a/server/src/auth/oauth.rs\n+++ b/server/src/auth/oauth.rs\n@@ -1,8 +1,15 @@\n-//! GitHub OAuth (raw reqwest, same style as reddit.rs).\n+//! OAuth providers (GitHub + Reddit). Provider accounts only *link* to a UUID;\n+//! the UUID is the canonical identity. Which providers are linked is private.\n \n use reqwest::Client;\n use serde::Deserialize;\n \n+use crate::reddit::{\n+    default_user_agent, reddit_oauth_api_base, reddit_oauth_token_base,\n+};\n+\n+// ── GitHub ──────────────────────────────────────────────────────────────────\n+\n #[derive(Debug, Clone)]\n pub struct GitHubConfig {\n     pub client_id: String,\n@@ -40,7 +47,7 @@ impl GitHubConfig {\n }\n \n #[derive(Debug, Deserialize)]\n-struct TokenResponse {\n+struct GitHubTokenResponse {\n     access_token: String,\n }\n \n@@ -50,7 +57,7 @@ pub struct GitHubUser {\n     pub login: String,\n }\n \n-pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n+pub fn github_authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n     let mut url = format!(\n         \"{}/login/oauth/authorize?client_id={}&redirect_uri={}&scope=read:user&state={}\",\n         cfg.oauth_base.trim_end_matches('/'),\n@@ -65,7 +72,7 @@ pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -\n     url\n }\n \n-pub async fn exchange_code(\n+pub async fn github_exchange_code(\n     client: &Client,\n     cfg: &GitHubConfig,\n     code: &str,\n@@ -90,14 +97,14 @@ pub async fn exchange_code(\n         return Err(format!(\"github token HTTP {}\", resp.status()));\n     }\n \n-    let body: TokenResponse = resp\n+    let body: GitHubTokenResponse = resp\n         .json()\n         .await\n         .map_err(|e| format!(\"github token parse failed: {e}\"))?;\n     Ok(body.access_token)\n }\n \n-pub async fn fetch_user(\n+pub async fn github_fetch_user(\n     client: &Client,\n     api_base: &str,\n     access_token: &str,\n@@ -120,10 +127,149 @@ pub async fn fetch_user(\n         .map_err(|e| format!(\"github user parse failed: {e}\"))\n }\n \n-pub fn provider_id(user: &GitHubUser) -> String {\n+pub fn github_provider_id(user: &GitHubUser) -> String {\n     user.id.to_string()\n }\n \n+// ── Reddit ──────────────────────────────────────────────────────────────────\n+\n+#[derive(Debug, Clone)]\n+pub struct RedditConfig {\n+    pub client_id: String,\n+    pub client_secret: String,\n+    pub redirect_uri: String,\n+    /// Host for `/api/v1/authorize` (www.reddit.com in production).\n+    pub authorize_base: String,\n+    /// Host for `POST /api/v1/access_token`.\n+    pub token_base: String,\n+    /// Host for bearer `GET /api/v1/me` (oauth.reddit.com).\n+    pub api_base: String,\n+    pub user_agent: String,\n+}\n+\n+/// Authorize page base; defaults to the same host as token POSTs.\n+pub fn reddit_authorize_base() -> String {\n+    std::env::var(\"REDDIT_OAUTH_AUTHORIZE_BASE\")\n+        .or_else(|_| std::env::var(\"REDDIT_OAUTH_BASE\"))\n+        .unwrap_or_else(|_| \"https://www.reddit.com\".into())\n+}\n+\n+impl RedditConfig {\n+    pub fn from_env(base_url: &str) -> Option<Self> {\n+        let client_id = std::env::var(\"REDDIT_CLIENT_ID\")\n+            .or_else(|_| std::env::var(\"REDDIT_APP_ID\"))\n+            .ok()?;\n+        let client_secret = std::env::var(\"REDDIT_CLIENT_SECRET\")\n+            .or_else(|_| std::env::var(\"REDDIT_APP_SECRET\"))\n+            .ok()?;\n+        if client_id.is_empty() || client_secret.is_empty() {\n+            return None;\n+        }\n+        let base = base_url.trim_end_matches('/');\n+        Some(Self {\n+            client_id,\n+            client_secret,\n+            redirect_uri: format!(\"{base}/auth/reddit/callback\"),\n+            authorize_base: reddit_authorize_base(),\n+            token_base: reddit_oauth_token_base(),\n+            api_base: reddit_oauth_api_base(),\n+            user_agent: default_user_agent(),\n+        })\n+    }\n+}\n+\n+#[derive(Debug, Deserialize)]\n+struct RedditTokenResponse {\n+    access_token: String,\n+}\n+\n+#[derive(Debug, Deserialize)]\n+pub struct RedditUser {\n+    /// Stable id (`t2_…`); never use `name` as identity.\n+    pub id: String,\n+    pub name: String,\n+}\n+\n+pub fn reddit_authorize_url(cfg: &RedditConfig, state: &str, mock_user: Option<&str>) -> String {\n+    let mut url = format!(\n+        \"{}/api/v1/authorize?client_id={}&response_type=code&state={}&redirect_uri={}&duration=temporary&scope=identity\",\n+        cfg.authorize_base.trim_end_matches('/'),\n+        urlencoding::encode(&cfg.client_id),\n+        urlencoding::encode(state),\n+        urlencoding::encode(&cfg.redirect_uri),\n+    );\n+    if let Some(user) = mock_user {\n+        url.push_str(\"&mock_user=\");\n+        url.push_str(&urlencoding::encode(user));\n+    }\n+    url\n+}\n+\n+pub async fn reddit_exchange_code(\n+    client: &Client,\n+    cfg: &RedditConfig,\n+    code: &str,\n+) -> Result<String, String> {\n+    let resp = client\n+        .post(format!(\n+            \"{}/api/v1/access_token\",\n+            cfg.token_base.trim_end_matches('/')\n+        ))\n+        .header(\"User-Agent\", &cfg.user_agent)\n+        .basic_auth(&cfg.client_id, Some(&cfg.client_secret))\n+        .form(&[\n+            (\"grant_type\", \"authorization_code\"),\n+            (\"code\", code),\n+            (\"redirect_uri\", cfg.redirect_uri.as_str()),\n+        ])\n+        .send()\n+        .await\n+        .map_err(|e| format!(\"reddit token request failed: {e}\"))?;\n+\n+    if !resp.status().is_success() {\n+        let status = resp.status();\n+        let body = resp.text().await.unwrap_or_default();\n+        return Err(format!(\"reddit token HTTP {status}: {body}\"));\n+    }\n+\n+    let body: RedditTokenResponse = resp\n+        .json()\n+        .await\n+        .map_err(|e| format!(\"reddit token parse failed: {e}\"))?;\n+    Ok(body.access_token)\n+}\n+\n+pub async fn reddit_fetch_user(\n+    client: &Client,\n+    cfg: &RedditConfig,\n+    access_token: &str,\n+) -> Result<RedditUser, String> {\n+    let resp = client\n+        .get(format!(\n+            \"{}/api/v1/me\",\n+            cfg.api_base.trim_end_matches('/')\n+        ))\n+        .header(\"User-Agent\", &cfg.user_agent)\n+        .bearer_auth(access_token)\n+        .send()\n+        .await\n+        .map_err(|e| format!(\"reddit user request failed: {e}\"))?;\n+\n+    if !resp.status().is_success() {\n+        return Err(format!(\"reddit user HTTP {}\", resp.status()));\n+    }\n+\n+    resp.json()\n+        .await\n+        .map_err(|e| format!(\"reddit user parse failed: {e}\"))\n+}\n+\n+pub fn reddit_provider_id(user: &RedditUser) -> String {\n+    user.id.clone()\n+}\n+\n+// ── Shared helpers ──────────────────────────────────────────────────────────\n+\n pub fn validate_pseudonym(raw: &str) -> Result<String, &'static str> {\n     let trimmed = raw.trim();\n     if trimmed.is_empty() {\n@@ -144,3 +290,12 @@ pub fn validate_pseudonym(raw: &str) -> Result<String, &'static str> {\n pub fn sanitize_pseudonym(login: &str) -> String {\n     validate_pseudonym(login).unwrap_or_else(|_| \"user\".to_string())\n }\n+\n+/// Display name for a provider key (`github` → `GitHub`). Never show provider ids.\n+pub fn provider_label(provider: &str) -> &'static str {\n+    match provider {\n+        \"github\" => \"GitHub\",\n+        \"reddit\" => \"Reddit\",\n+        _ => \"OAuth\",\n+    }\n+}\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex 84f2565b105fb302241b949af64bd5e49916eab2..0d948af1457504fdbd34d0b14261f65ac58da0ec 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -47,6 +47,8 @@ pub fn create_app(state: AppState) -> Router {\n         .route(\"/login/alias\", get(crate::auth::alias_page))\n         .route(\"/auth/github\", get(crate::auth::github_start))\n         .route(\"/auth/github/callback\", get(crate::auth::github_callback))\n+        .route(\"/auth/reddit\", get(crate::auth::reddit_start))\n+        .route(\"/auth/reddit/callback\", get(crate::auth::reddit_callback))\n         .route(\"/auth/logout\", post(crate::auth::logout))\n         .route(\"/auth/switch\", post(crate::auth::switch_pseudonym))\n         .route(\"/ui\", post(crate::api::ui_html::post_ui_html))\ndiff --git a/server/src/projection_apply.rs b/server/src/projection_apply.rs\nindex 4fb4b48ee0a53b7f673fae0c9731eed5acc33332..f50458c2ff3c447a3cfd28adb298e6883a2da4e9 100644\n--- a/server/src/projection_apply.rs\n+++ b/server/src/projection_apply.rs\n@@ -4,6 +4,8 @@\n //! child links, recent-vote appends) plus a cursor advance, all committed in\n //! one atomic `DisableWal` batch.\n \n+use std::collections::HashMap;\n+\n use crate::{\n     event_log::EventLogError,\n     events::{Event, EventRecord},\n@@ -44,6 +46,8 @@ pub fn apply_records(\n     let db = projection_store.db();\n     let mut batch = db.batch();\n     let mut last_seq = 0u64;\n+    // Weight reads must see earlier writes in this same batch.\n+    let mut pending_weights: HashMap<String, f64> = HashMap::new();\n \n     for record in records {\n         match &record.event {\n@@ -85,6 +89,7 @@ pub fn apply_records(\n                 ensure_path_writes(&mut batch, &parsed);\n             }\n             Event::PrincipalCreated { uuid, .. } => {\n+                pending_weights.insert(uuid.clone(), BASE_TRUST_WEIGHT);\n                 batch.write(\n                     Store::root()\n                         .user_weights()\n@@ -112,17 +117,25 @@ pub fn apply_records(\n                     }\n                 } else {\n                     batch.write(Store::root().oauth_links().key(&link_key).set(uuid));\n-                    let current = Store::root()\n-                        .user_weights()\n-                        .key(&uuid.clone())\n-                        .get(db)\n-                        .map_err(|e| EventLogError::Apply(e.to_string()))?\n+                    let current = pending_weights\n+                        .get(uuid)\n+                        .copied()\n+                        .or_else(|| {\n+                            Store::root()\n+                                .user_weights()\n+                                .key(&uuid.clone())\n+                                .get(db)\n+                                .ok()\n+                                .flatten()\n+                        })\n                         .unwrap_or(BASE_TRUST_WEIGHT);\n+                    let next = trust_weight_after_link(current);\n+                    pending_weights.insert(uuid.clone(), next);\n                     batch.write(\n                         Store::root()\n                             .user_weights()\n                             .key(&uuid.clone())\n-                            .set(&trust_weight_after_link(current)),\n+                            .set(&next),\n                     );\n                 }\n             }\n@@ -205,6 +218,15 @@ mod tests {\n                 ),\n                 record(\n                     3,\n+                    Event::OauthLinked {\n+                        uuid: uuid.into(),\n+                        provider: \"reddit\".into(),\n+                        provider_id: \"t2_abc\".into(),\n+                        ts,\n+                    },\n+                ),\n+                record(\n+                    4,\n                     Event::PseudonymClaimed {\n                         uuid: uuid.into(),\n                         pseudonym: \"octocat\".into(),\n@@ -219,8 +241,12 @@ mod tests {\n             oauth_link_owner(store.db(), \"github\", \"42\").unwrap(),\n             Some(uuid.to_string())\n         );\n+        assert_eq!(\n+            crate::storage_schema::linked_providers_for_uuid(store.db(), uuid).unwrap(),\n+            vec![\"github\".to_string(), \"reddit\".to_string()]\n+        );\n         assert_eq!(resolve_actor_uuid(store.db(), \"octocat\").unwrap(), uuid);\n-        assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 1.5);\n+        assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 2.0);\n         let aliases = Store::root()\n             .user_pseudonyms()\n             .key(&uuid.to_string())\ndiff --git a/server/src/storage_schema.rs b/server/src/storage_schema.rs\nindex b942810afd96d3bf01b7765718303a39be4ef8d2..dac6f8e6080e3f5683c24dbb8861f5a981d456c4 100644\n--- a/server/src/storage_schema.rs\n+++ b/server/src/storage_schema.rs\n@@ -103,6 +103,25 @@ pub fn oauth_link_owner(db: &Db, provider: &str, provider_id: &str) -> durable::\n         .get(db)\n }\n \n+/// Provider names linked to a UUID (`github`, `reddit`, …). Private — for the\n+/// account owner's page only; never expose which providers are linked publicly.\n+pub fn linked_providers_for_uuid(db: &Db, uuid: &str) -> durable::Result<Vec<String>> {\n+    let mut providers = Vec::new();\n+    for (key, owner) in Store::root().oauth_links().iter(db)? {\n+        if owner != uuid {\n+            continue;\n+        }\n+        let Some((provider, _)) = key.split_once(':') else {\n+            continue;\n+        };\n+        if !providers.iter().any(|p| p == provider) {\n+            providers.push(provider.to_string());\n+        }\n+    }\n+    providers.sort();\n+    Ok(providers)\n+}\n+\n pub const RECENT_VOTES_CAP: u64 = 200;\n \n fn id_key(id: &ItemId) -> String {\ndiff --git a/test/support/harness.clj b/test/support/harness.clj\nindex 4505ece5aa193e826ca61c52f1467d252080d66b..741024aab1d14269e225791189633287980ae2e4 100644\n--- a/test/support/harness.clj\n+++ b/test/support/harness.clj\n@@ -48,12 +48,15 @@\n          \"GITHUB_CLIENT_SECRET\" \"test-secret\"\n          \"GITHUB_OAUTH_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n          \"GITHUB_API_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n+         ;; Reddit import fixtures + Reddit OAuth on reddit-port.\n          \"REDDIT_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_CLIENT_ID\" \"test-reddit\"\n+         \"REDDIT_CLIENT_SECRET\" \"test-reddit-secret\"\n          \"REDDIT_OAUTH_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n-         \"REDDIT_CLIENT_ID\" \"\"\n-         \"REDDIT_CLIENT_SECRET\" \"\"\n-         \"REDDIT_APP_ID\" \"\"\n-         \"REDDIT_APP_SECRET\" \"\"}))\n+         \"REDDIT_OAUTH_AUTHORIZE_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_OAUTH_TOKEN_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_OAUTH_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_USER_AGENT\" \"web:sorter2-test:v0 (by /u/test)\"}))\n \n (defn with-auth-servers\n   \"Start mock Reddit + mock OAuth + release sorter2-server.\ndiff --git a/test/support/mock_oauth.clj b/test/support/mock_oauth.clj\nindex 909d7a7be8b159ea54a122d69c46af3db3318118..5ba7e9be3cf6d2226648e9609a09ed45f306930f 100644\n--- a/test/support/mock_oauth.clj\n+++ b/test/support/mock_oauth.clj\n@@ -1,5 +1,5 @@\n (ns test.support.mock-oauth\n-  \"In-process HTTP stub for GitHub OAuth (authorize, token, /user).\"\n+  \"In-process HTTP stub for GitHub + Reddit OAuth (authorize, token, user).\"\n   (:require [clojure.string :as str])\n   (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n            [java.net InetSocketAddress URLDecoder]))\n@@ -12,11 +12,14 @@\n                 (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n           (str/split query #\"&\"))))\n \n-(defn- parse-mock-user [raw]\n+(defn- parse-mock-user\n+  \"GitHub-style `id:login` (numeric id). Reddit-style `t2_xxx:name`.\"\n+  [raw]\n   (let [s (or raw \"1002:newbie\")\n         [id login] (str/split s #\":\" 2)]\n-    {:id (Long/parseLong id)\n-     :login (or login \"newbie\")}))\n+    {:id id\n+     :login (or login \"newbie\")\n+     :numeric? (re-matches #\"\\d+\" id)}))\n \n (defn- send-json [^HttpExchange ex status body]\n   (let [bytes (.getBytes body \"UTF-8\")]\n@@ -31,9 +34,10 @@\n   (.sendResponseHeaders ex 302 -1)\n   (.close (.getResponseBody ex)))\n \n-(defn- read-form-code [^HttpExchange ex]\n+(defn- read-form [^HttpExchange ex]\n   (let [body (slurp (.getInputStream ex))]\n-    (query-param body \"code\")))\n+    {:code (query-param body \"code\")\n+     :grant (query-param body \"grant_type\")}))\n \n (defn- bearer-token [^HttpExchange ex]\n   (some-> (.getRequestHeaders ex)\n@@ -44,8 +48,18 @@\n   (when (str/starts-with? token \"mock:\")\n     (parse-mock-user (subs token 5))))\n \n+(defn- authorize-redirect [exchange query]\n+  (let [redirect-uri (query-param query \"redirect_uri\")\n+        state (query-param query \"state\")\n+        mock-user (query-param query \"mock_user\")\n+        user (parse-mock-user mock-user)\n+        code (str \"mock:\" (:id user) \":\" (:login user))\n+        loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+                 \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+    (send-redirect exchange loc)))\n+\n (defn start-mock-oauth\n-  \"Start mock GitHub OAuth on `port`. Returns a zero-arg `stop` function.\"\n+  \"Start mock GitHub + Reddit OAuth on `port`. Returns a zero-arg `stop` function.\"\n   [port]\n   (let [server (HttpServer/create (InetSocketAddress. \"127.0.0.1\" port) 0)\n         handler\n@@ -53,28 +67,45 @@\n           (handle [^HttpExchange exchange]\n             (let [uri (.getRequestURI exchange)\n                   path (.getPath uri)\n-                  query (.getQuery uri)]\n+                  query (.getQuery uri)\n+                  method (.getRequestMethod exchange)]\n               (cond\n+                ;; GitHub authorize\n                 (str/ends-with? path \"/login/oauth/authorize\")\n-                (let [redirect-uri (query-param query \"redirect_uri\")\n-                      state (query-param query \"state\")\n-                      mock-user (query-param query \"mock_user\")\n-                      user (parse-mock-user mock-user)\n-                      code (str \"mock:\" (:id user) \":\" (:login user))\n-                      loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n-                               \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n-                  (send-redirect exchange loc))\n+                (authorize-redirect exchange query)\n+\n+                ;; Reddit authorize\n+                (str/ends-with? path \"/api/v1/authorize\")\n+                (authorize-redirect exchange query)\n \n-                (str/ends-with? path \"/login/oauth/access_token\")\n-                (let [code (or (read-form-code exchange) \"mock:1002:newbie\")]\n+                ;; GitHub token\n+                (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n+                (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n                   (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n \n+                ;; Reddit token (client_credentials for import + authorization_code for login)\n+                (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+                (let [form (read-form exchange)\n+                      grant (or (:grant form) \"\")\n+                      code (or (:code form) \"mock:t2_test:redditor\")]\n+                  (if (= grant \"client_credentials\")\n+                    (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+                    (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+                ;; GitHub user\n                 (= path \"/user\")\n                 (let [token (bearer-token exchange)\n-                      user (or (parse-token-user token) {:id 1002 :login \"newbie\"})]\n+                      user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n                   (send-json exchange 200\n                              (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n \n+                ;; Reddit /api/v1/me\n+                (str/ends-with? path \"/api/v1/me\")\n+                (let [token (bearer-token exchange)\n+                      user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n+                  (send-json exchange 200\n+                             (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n                 :else\n                 (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))))]\n     (.createContext server \"/\" handler)\ndiff --git a/test/support/mock_reddit.clj b/test/support/mock_reddit.clj\nindex 5efa92db3e1f79b8f423a2f1adcbda959123c1ad..a630cf0938722193e9af88382d60e777ff371be4 100644\n--- a/test/support/mock_reddit.clj\n+++ b/test/support/mock_reddit.clj\n@@ -1,14 +1,56 @@\n (ns test.support.mock-reddit\n-  \"In-process HTTP stub for Reddit API fixtures (`test/fixtures/reddit/`).\"\n+  \"In-process HTTP stub for Reddit API fixtures + OAuth login endpoints.\"\n   (:require [clojure.java.io :as io]\n             [clojure.string :as str])\n   (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n-           [java.net InetSocketAddress]))\n+           [java.net InetSocketAddress URLDecoder]))\n \n (defn fixtures-dir\n   ([] (fixtures-dir (System/getProperty \"user.dir\")))\n   ([root] (str root \"/test/fixtures/reddit\")))\n \n+(defn- query-param [query key]\n+  (when query\n+    (some (fn [pair]\n+            (let [[k v] (str/split pair \"=\" 2)]\n+              (when (= k key)\n+                (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n+          (str/split query #\"&\"))))\n+\n+(defn- parse-mock-user [raw]\n+  (let [s (or raw \"t2_test:redditor\")\n+        [id login] (str/split s #\":\" 2)]\n+    {:id id :login (or login \"redditor\")}))\n+\n+(defn- send-bytes [^HttpExchange ex status ^bytes body content-type]\n+  (.set (.getResponseHeaders ex) \"Content-Type\" content-type)\n+  (.sendResponseHeaders ex status (alength body))\n+  (doto (.getResponseBody ex)\n+    (.write body)\n+    (.close)))\n+\n+(defn- send-json [^HttpExchange ex status body]\n+  (send-bytes ex status (.getBytes body \"UTF-8\") \"application/json\"))\n+\n+(defn- send-redirect [^HttpExchange ex location]\n+  (.set (.getResponseHeaders ex) \"Location\" location)\n+  (.sendResponseHeaders ex 302 -1)\n+  (.close (.getResponseBody ex)))\n+\n+(defn- read-form [^HttpExchange ex]\n+  (let [body (slurp (.getInputStream ex))]\n+    {:code (query-param body \"code\")\n+     :grant (query-param body \"grant_type\")}))\n+\n+(defn- bearer-token [^HttpExchange ex]\n+  (some-> (.getRequestHeaders ex)\n+          (.getFirst \"Authorization\")\n+          (str/replace #\"^[Bb]earer \" \"\")))\n+\n+(defn- parse-token-user [token]\n+  (when (str/starts-with? token \"mock:\")\n+    (parse-mock-user (subs token 5))))\n+\n (defn start-mock-reddit\n   \"Start a mock Reddit API on `port`. Returns a zero-arg `stop` function.\"\n   ([port] (start-mock-reddit port (fixtures-dir)))\n@@ -19,15 +61,38 @@\n          handler\n          (proxy [HttpHandler] []\n            (handle [^HttpExchange exchange]\n-             ;; `/r/<sub>/about.json` → subreddit entity; `/r/<sub>.json` → listing.\n-             (let [path (.getPath (.getRequestURI exchange))\n-                   body (if (str/includes? path \"/about\")\n-                          about\n-                          listing)]\n-               (.sendResponseHeaders exchange 200 (alength body))\n-               (let [out (.getResponseBody exchange)]\n-                 (.write out body)\n-                 (.close out)))))]\n+             (let [uri (.getRequestURI exchange)\n+                   path (.getPath uri)\n+                   query (.getQuery uri)\n+                   method (.getRequestMethod exchange)]\n+               (cond\n+                 (str/ends-with? path \"/api/v1/authorize\")\n+                 (let [redirect-uri (query-param query \"redirect_uri\")\n+                       state (query-param query \"state\")\n+                       user (parse-mock-user (query-param query \"mock_user\"))\n+                       code (str \"mock:\" (:id user) \":\" (:login user))\n+                       loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+                                \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+                   (send-redirect exchange loc))\n+\n+                 (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+                 (let [form (read-form exchange)\n+                       grant (or (:grant form) \"\")\n+                       code (or (:code form) \"mock:t2_test:redditor\")]\n+                   (if (= grant \"client_credentials\")\n+                     (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+                     (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+                 (str/ends-with? path \"/api/v1/me\")\n+                 (let [user (or (parse-token-user (bearer-token exchange))\n+                                {:id \"t2_test\" :login \"redditor\"})]\n+                   (send-json exchange 200\n+                              (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n+                 ;; `/r/<sub>/about.json` → subreddit entity; `/r/<sub>.json` → listing.\n+                 :else\n+                 (let [body (if (str/includes? path \"/about\") about listing)]\n+                   (send-bytes exchange 200 body \"application/json\"))))))]\n      (.createContext server \"/\" handler)\n      (.setExecutor server nil)\n      (.start server)\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[08565bea] Tokenize prose refs for garden URL links (#147)\n\n* Tokenize prose refs for garden URL links\n\nCo-authored-by: tommy <thmorriss@gmail.com>\n\n* Stop prose URLs at line boundaries\n\nCo-authored-by: tommy <thmorriss@gmail.com>\n\n* Require braced DSL item bodies\n\nCo-authored-by: tommy <thmorriss@gmail.com>\n\n---------\n\nCo-authored-by: Cursor Agent <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/server/src/dsl.rs b/server/src/dsl.rs\nindex 4203c2f59dd8825d7a91513c4023f3ccd37f1efc..b3c785674560a0b42a7f4c3aa13d80cd350f485b 100644\n--- a/server/src/dsl.rs\n+++ b/server/src/dsl.rs\n@@ -1,7 +1,5 @@\n use std::collections::HashMap;\n \n-use rand::Rng;\n-\n /// Parsed DSL document.\n #[derive(Debug, Clone, PartialEq, Eq)]\n pub struct Document {\n@@ -39,31 +37,57 @@ pub enum DslError {\n /// Matches the legacy Python parser behavior:\n /// - Supports toggle markers (open == close), e.g. ```...```\n /// - Supports nested markers (open != close), e.g. { ... { ... } ... }\n+#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n+pub enum BlockKind {\n+    CodeFence,\n+    DoubleBrace,\n+    Brace,\n+}\n+\n+#[derive(Debug, Clone, PartialEq, Eq)]\n+struct MaskedBlock {\n+    kind: BlockKind,\n+}\n+\n #[derive(Debug, Default, Clone)]\n pub struct BlockMasker {\n     pub replacements: HashMap<String, String>,\n+    blocks: HashMap<String, MaskedBlock>,\n+    next_id: u32,\n }\n \n impl BlockMasker {\n     pub fn new() -> Self {\n         Self {\n             replacements: HashMap::new(),\n+            blocks: HashMap::new(),\n+            next_id: 0,\n         }\n     }\n \n-    fn new_token(&mut self) -> String {\n-        let mut rng = rand::thread_rng();\n-        let n: u32 = rng.gen();\n-        let token = format!(\"__BLOCK_{:08x}__\", n);\n-        // Extremely unlikely collision; if it happens, regenerate.\n-        if self.replacements.contains_key(&token) {\n-            return self.new_token();\n+    fn new_token(&mut self, haystack: &str) -> String {\n+        loop {\n+            let token = format!(\"__BLOCK_{:08x}__\", self.next_id);\n+            self.next_id = self.next_id.wrapping_add(1);\n+            if !self.replacements.contains_key(&token) && !haystack.contains(&token) {\n+                return token;\n+            }\n         }\n-        token\n     }\n \n     /// Replace outermost balanced blocks with tokens.\n     pub fn mask(&mut self, text: &str, open_marker: &str, close_marker: &str) -> String {\n+        self.mask_kind(text, open_marker, close_marker, BlockKind::Brace)\n+    }\n+\n+    /// Replace outermost balanced blocks with typed deterministic tokens.\n+    pub fn mask_kind(\n+        &mut self,\n+        text: &str,\n+        open_marker: &str,\n+        close_marker: &str,\n+        kind: BlockKind,\n+    ) -> String {\n         if text.is_empty() {\n             return text.to_string();\n         }\n@@ -97,9 +121,10 @@ impl BlockMasker {\n                     // Found end of outermost block\n                     let s = start_idx.max(0) as usize;\n                     let original_block = &text[s..i];\n-                    let token = self.new_token();\n+                    let token = self.new_token(text);\n                     self.replacements\n                         .insert(token.clone(), original_block.to_string());\n+                    self.blocks.insert(token.clone(), MaskedBlock { kind });\n                     result_parts.push(token);\n                     current_idx = i;\n                 }\n@@ -176,13 +201,22 @@ impl BlockMasker {\n         }\n         token.to_string()\n     }\n+\n+    pub fn block_kind(&self, token: &str) -> Option<BlockKind> {\n+        self.blocks.get(token).map(|b| b.kind)\n+    }\n }\n \n fn mask_all(mut masker: BlockMasker, text: &str) -> (BlockMasker, String) {\n     // Mask hierarchy: Code -> Double Brace -> Single Brace.\n-    let t = masker.mask(text, \"```\", \"```\");\n-    let t = masker.mask(&t, \"{{\", \"}}\");\n-    let t = masker.mask(&t, \"{\", \"}\");\n+    let t = masker.mask_kind(text, \"```\", \"```\", BlockKind::CodeFence);\n+    let t = masker.mask_kind(&t, \"{{\", \"}}\", BlockKind::DoubleBrace);\n+    let t = masker.mask_kind(&t, \"{\", \"}\", BlockKind::Brace);\n+    (masker, t)\n+}\n+\n+fn mask_code_fences(mut masker: BlockMasker, text: &str) -> (BlockMasker, String) {\n+    let t = masker.mask_kind(text, \"```\", \"```\", BlockKind::CodeFence);\n     (masker, t)\n }\n \n@@ -253,7 +287,34 @@ fn skip_ws(s: &str, mut i: usize) -> usize {\n     i\n }\n \n-fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n+#[derive(Debug, Clone, PartialEq, Eq)]\n+pub enum ProseToken {\n+    Text(String),\n+    ItemRef(String),\n+}\n+\n+fn trim_prose_item_ref_end(s: &str, mut end: usize) -> usize {\n+    while end > 0 {\n+        let Some((idx, c)) = s[..end].char_indices().next_back() else {\n+            break;\n+        };\n+        if matches!(\n+            c,\n+            '.' | ',' | ';' | ':' | '!' | '?' | ')' | ']' | '}' | '\"' | '\\''\n+        ) {\n+            end = idx;\n+        } else {\n+            break;\n+        }\n+    }\n+    end\n+}\n+\n+fn parse_item_name_at_with_mode(\n+    s: &str,\n+    i: usize,\n+    trim_trailing_punctuation: bool,\n+) -> Option<(String, usize)> {\n     let bytes = s.as_bytes();\n     if i >= bytes.len() {\n         return None;\n@@ -263,6 +324,9 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n     if s[i..].starts_with(\"https://\") || s[i..].starts_with(\"http://\") {\n         let mut j = i;\n         while j < bytes.len() {\n+            if trim_trailing_punctuation && bytes[j] == b'\\n' {\n+                break;\n+            }\n             if bytes[j..].starts_with(b\"__BLOCK_\") || is_ws_byte(bytes[j]) {\n                 break;\n             }\n@@ -271,6 +335,12 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n         if j <= i {\n             return None;\n         }\n+        if trim_trailing_punctuation {\n+            j = trim_prose_item_ref_end(s, j);\n+            if j <= i {\n+                return None;\n+            }\n+        }\n         return Some((s[i..j].to_string(), j));\n     }\n \n@@ -296,6 +366,12 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n         if j <= i + 2 {\n             return None;\n         }\n+        if trim_trailing_punctuation {\n+            j = trim_prose_item_ref_end(s, j);\n+            if j <= i + 2 {\n+                return None;\n+            }\n+        }\n         let raw = &s[i..j];\n         if !is_item_name(raw) {\n             return None;\n@@ -336,6 +412,46 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n     Some((format!(\"~/{}\", name), j))\n }\n \n+fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n+    parse_item_name_at_with_mode(s, i, false)\n+}\n+\n+pub fn parse_prose_item_ref_at(s: &str, i: usize) -> Option<(String, usize)> {\n+    parse_item_name_at_with_mode(s, i, true)\n+}\n+\n+pub fn tokenize_prose_item_refs(text: &str) -> Vec<ProseToken> {\n+    if text.is_empty() {\n+        return Vec::new();\n+    }\n+    let (masker, masked) = mask_code_fences(BlockMasker::new(), text);\n+    let mut tokens = Vec::new();\n+    let mut text_start = 0usize;\n+    let mut i = 0usize;\n+\n+    while i < masked.len() {\n+        if let Some((raw, end)) = parse_prose_item_ref_at(&masked, i) {\n+            if text_start < i {\n+                tokens.push(ProseToken::Text(masker.unmask(&masked[text_start..i])));\n+            }\n+            tokens.push(ProseToken::ItemRef(masker.unmask(&raw)));\n+            i = end;\n+            text_start = i;\n+            continue;\n+        }\n+\n+        let Some((_, c)) = masked[i..].char_indices().next() else {\n+            break;\n+        };\n+        i += c.len_utf8();\n+    }\n+\n+    if text_start < masked.len() {\n+        tokens.push(ProseToken::Text(masker.unmask(&masked[text_start..])));\n+    }\n+    tokens\n+}\n+\n fn parse_block_token_at(s: &str, i: usize) -> Option<(String, usize)> {\n     let bytes = s.as_bytes();\n     if i >= bytes.len() {\n@@ -401,6 +517,12 @@ fn parse_block_prefixed_statement(\n     tail: &str,\n     masker: &BlockMasker,\n ) -> Result<Stmt, DslError> {\n+    if masker.block_kind(block_token) == Some(BlockKind::CodeFence) {\n+        return Err(DslError::Parse(\n+            \"vote explanations must use `{ ... }`; code fences belong inside body blocks\"\n+                .to_string(),\n+        ));\n+    }\n     // vote: block item_ref comparison item_ref\n     let s = tail.trim_start();\n     if s.is_empty() {\n@@ -462,6 +584,11 @@ fn parse_item_definition_statement(stripped: &str, masker: &BlockMasker) -> Resu\n     }\n \n     if let Some((tok, end)) = parse_block_token_at(stripped, i) {\n+        if masker.block_kind(&tok) == Some(BlockKind::CodeFence) {\n+            return Err(DslError::Parse(\n+                \"item bodies must use `{ ... }`; code fences belong inside body blocks\".to_string(),\n+            ));\n+        }\n         let body = masker.extract_body(&tok);\n         let tail = stripped[end..].trim();\n         if !tail.is_empty() {\n@@ -572,6 +699,10 @@ pub fn parse_full(text: &str) -> Result<Document, DslError> {\n \n             if let Some((tok, end)) = parse_block_token_at(stripped, 0) {\n                 if stripped[end..].trim().is_empty() {\n+                    if masker.block_kind(&tok) == Some(BlockKind::CodeFence) {\n+                        prose_buffer.push(line);\n+                        continue;\n+                    }\n                     pending_block = Some(tok);\n                     continue;\n                 }\n@@ -619,6 +750,70 @@ mod tests {\n         assert_eq!(roundtrip, input);\n     }\n \n+    #[test]\n+    fn blockmasker_tokens_are_deterministic_and_typed() {\n+        let input = \"x ```code``` y {body}\";\n+        let (masker, masked) = mask_all(BlockMasker::new(), input);\n+        assert!(masked.contains(\"__BLOCK_00000000__\"));\n+        assert!(masked.contains(\"__BLOCK_00000001__\"));\n+        assert_eq!(\n+            masker.block_kind(\"__BLOCK_00000000__\"),\n+            Some(BlockKind::CodeFence)\n+        );\n+        assert_eq!(\n+            masker.block_kind(\"__BLOCK_00000001__\"),\n+            Some(BlockKind::Brace)\n+        );\n+        assert_eq!(masker.unmask(&masked), input);\n+    }\n+\n+    #[test]\n+    fn prose_tokenizer_finds_tilde_dash_and_raw_url_refs() {\n+        let tokens =\n+            tokenize_prose_item_refs(\"see ~/a/b then -/example.com/x and https://Example.com/A/B.\");\n+        assert_eq!(\n+            tokens,\n+            vec![\n+                ProseToken::Text(\"see \".to_string()),\n+                ProseToken::ItemRef(\"~/a/b\".to_string()),\n+                ProseToken::Text(\" then \".to_string()),\n+                ProseToken::ItemRef(\"-/example.com/x\".to_string()),\n+                ProseToken::Text(\" and \".to_string()),\n+                ProseToken::ItemRef(\"https://Example.com/A/B\".to_string()),\n+                ProseToken::Text(\".\".to_string()),\n+            ]\n+        );\n+    }\n+\n+    #[test]\n+    fn prose_tokenizer_stops_raw_urls_at_newlines() {\n+        let tokens = tokenize_prose_item_refs(\"https://example.com/a/b.\\n-/example.com/a/b\");\n+        assert_eq!(\n+            tokens,\n+            vec![\n+                ProseToken::ItemRef(\"https://example.com/a/b\".to_string()),\n+                ProseToken::Text(\".\\n\".to_string()),\n+                ProseToken::ItemRef(\"-/example.com/a/b\".to_string()),\n+            ]\n+        );\n+    }\n+\n+    #[test]\n+    fn prose_tokenizer_does_not_linkify_inside_code_fences() {\n+        let tokens = tokenize_prose_item_refs(\n+            \"before ```json\\n{\\\"url\\\":\\\"https://example.com\\\"}\\n``` after ~/x\",\n+        );\n+        assert_eq!(\n+            tokens,\n+            vec![\n+                ProseToken::Text(\n+                    \"before ```json\\n{\\\"url\\\":\\\"https://example.com\\\"}\\n``` after \".to_string()\n+                ),\n+                ProseToken::ItemRef(\"~/x\".to_string()),\n+            ]\n+        );\n+    }\n+\n     #[test]\n     fn parse_item_with_body_strips_outer_braces() {\n         let input = \"~/rust { Systems language }\";\n@@ -633,8 +828,8 @@ mod tests {\n     }\n \n     #[test]\n-    fn parse_item_with_fenced_json_body_preserves_braces() {\n-        let input = \"~/item/in/url ```json\\n{\\\"test\\\": true}\\n```\";\n+    fn parse_item_with_braced_fenced_json_body_preserves_braces() {\n+        let input = \"~/item/in/url {\\n```json\\n{\\\"test\\\": true}\\n```\\n}\";\n         let doc = parse_full(input).unwrap();\n         assert_eq!(\n             doc.statements,\n@@ -645,6 +840,51 @@ mod tests {\n         );\n     }\n \n+    #[test]\n+    fn parse_rejects_singleton_fenced_json_item_body() {\n+        let input = \"~/item/in/url ```json\\n{\\\"test\\\": true}\\n```\";\n+        let err = parse_full(input).unwrap_err().to_string();\n+        assert!(\n+            err.contains(\"item bodies must use\"),\n+            \"unexpected error: {err}\"\n+        );\n+    }\n+\n+    #[test]\n+    fn parse_keeps_standalone_code_fence_as_prose() {\n+        let input = \"```json\\n{\\\"test\\\": true}\\n```\";\n+        let doc = parse_full(input).unwrap();\n+        assert_eq!(\n+            doc.statements,\n+            vec![Stmt::Prose {\n+                text: input.to_string(),\n+            }]\n+        );\n+    }\n+\n+    #[test]\n+    fn parse_rejects_code_fence_vote_explanation() {\n+        let input = \"```json\\n{\\\"why\\\": true}\\n```\\n~/a 2:1 ~/b\";\n+        let err = parse_full(input).unwrap_err().to_string();\n+        assert!(\n+            err.contains(\"vote explanations must start\"),\n+            \"unexpected error: {err}\"\n+        );\n+    }\n+\n+    #[test]\n+    fn parse_raw_url_item_with_braced_fenced_json_body() {\n+        let input = \"https://example.com/itembody/slug {\\n```json\\n{\\\"test\\\": true}\\n```\\n}\";\n+        let doc = parse_full(input).unwrap();\n+        assert_eq!(\n+            doc.statements,\n+            vec![Stmt::Item {\n+                title: \"https://example.com/itembody/slug\".to_string(),\n+                body: Some(\"```json\\n{\\\"test\\\": true}\\n```\".to_string()),\n+            }]\n+        );\n+    }\n+\n     #[test]\n     fn parse_vote_ratio_and_symbols() {\n         let d1 = parse_full(\"{because}\\n~/a 3:1 ~/b\").unwrap();\ndiff --git a/server/src/external_resolver.rs b/server/src/external_resolver.rs\nindex 8481f1fbff1c4265da182a225f539f97d6829002..04bc3de32b6df1aefe197d942db67de2cbdbde4f 100644\n--- a/server/src/external_resolver.rs\n+++ b/server/src/external_resolver.rs\n@@ -256,7 +256,7 @@ fn children_to_dsl(children: &[ResolvedChild]) -> String {\n             .filter(|s| !s.trim().is_empty())\n             .unwrap_or(child.title.as_str());\n         if body.trim_start().starts_with(\"```\") {\n-            out.push_str(&format!(\"{} {}\\n\\n\", child.url, body.trim()));\n+            out.push_str(&format!(\"{} {{\\n{}\\n}}\\n\\n\", child.url, body.trim()));\n         } else {\n             out.push_str(&format!(\n                 \"{} {{\\n{}\\n}}\\n\\n\",\n@@ -378,7 +378,8 @@ mod tests {\n             title: \"#1 title\".into(),\n             body: Some(\"```json\\n{\\\"test\\\": true}\\n```\".into()),\n         }]);\n-        assert!(dsl.contains(\"https://github.com/o/r/issues/1 ```json\"));\n+        assert!(dsl.contains(\"https://github.com/o/r/issues/1 {\\n```json\"));\n         assert!(dsl.contains(\"{\\\"test\\\": true}\"));\n+        assert!(dsl.contains(\"```\\n}\\n\"));\n     }\n }\ndiff --git a/server/src/html/breadcrumb_path.rs b/server/src/html/breadcrumb_path.rs\nindex 3e949ce2cb70de3f024f46af773a93f3f8852260..e48612d7d3c4df52c161499a11865d4caca607aa 100644\n--- a/server/src/html/breadcrumb_path.rs\n+++ b/server/src/html/breadcrumb_path.rs\n@@ -88,16 +88,12 @@ impl ExternalOntologyPath {\n             .filter(|x| !x.is_empty())\n             .map(|x| x.to_string())\n             .collect();\n-        let segments = if segments == [\".\"] {\n-            vec![]\n-        } else {\n-            segments\n-        };\n+        let segments = if segments == [\".\"] { vec![] } else { segments };\n         Self { item, segments }\n     }\n \n     pub(super) fn is_root(&self) -> bool {\n-        self.segments.len() <= 1\n+        self.segments.is_empty()\n     }\n \n     pub(super) fn segments(&self) -> &[String] {\n@@ -108,3 +104,28 @@ impl ExternalOntologyPath {\n         self.item.as_str()\n     }\n }\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::*;\n+\n+    #[test]\n+    fn external_root_and_host_paths_are_distinct() {\n+        let root = ExternalOntologyPath::from_input(\"\");\n+        assert!(root.is_root());\n+        assert!(root.segments().is_empty());\n+\n+        let host = ExternalOntologyPath::from_input(\"example.com\");\n+        assert!(!host.is_root());\n+        assert_eq!(host.segments(), &[\"example.com\".to_string()]);\n+    }\n+\n+    #[test]\n+    fn external_path_keeps_each_url_segment_for_breadcrumbs() {\n+        let path = ExternalOntologyPath::from_input(\"https://example.com/a/b\");\n+        assert_eq!(\n+            path.segments(),\n+            &[\"example.com\".to_string(), \"a\".to_string(), \"b\".to_string()]\n+        );\n+    }\n+}\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex 8876a1a00a16ee3bf7a371f7a5ca27b5862b62cc..d5877eeb3632ed5d770f23a04cb4d1881209bc74 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -20,27 +20,30 @@ mod search;\n pub mod ui_action;\n use breadcrumb_path::{ExternalOntologyPath, OntologyPath};\n \n-pub use auth::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page};\n+pub use auth::{\n+    auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment,\n+    choose_username_page,\n+};\n pub use editor::{editor_check, editor_page};\n pub use forum::{\n     home, room_page, room_thread_post_view, room_thread_view, thread_feed_html,\n     thread_feed_html_for_room, thread_feed_region_markup, thread_post_view, thread_view, ThreadNav,\n };\n \n+pub use forum::user_profile_page;\n pub(crate) use forum::{\n     fragment_new_thread_slot, login_to_post_hint_markup, room_members_section_markup,\n     thread_ui_collapse_redacted_post, thread_ui_expand_post_full, thread_ui_expand_redacted_post,\n     user_can_post_room, user_can_view_room,\n };\n+pub(crate) use garden::{encode_pin_cookie_value, vote_compare_post_success_js, GARDEN_PIN_COOKIE};\n pub use garden::{\n     external_garden_index, external_ontology_path, garden_index, ontology_path,\n-    room_external_garden_index, room_external_ontology_path, room_garden_index,\n-    room_ontology_path, room_vote_compare_page, vote_compare_page,\n+    room_external_garden_index, room_external_ontology_path, room_garden_index, room_ontology_path,\n+    room_vote_compare_page, vote_compare_page,\n };\n-pub(crate) use garden::{encode_pin_cookie_value, vote_compare_post_success_js, GARDEN_PIN_COOKIE};\n pub use routing::RouteContext;\n pub use search::{search_page, search_results_fragment};\n-pub use forum::user_profile_page;\n pub use ui_action::{parse_html_ui_from_form, HtmlUiAction, HtmlUiParseError, UI_RPC_FIELD};\n \n /// Public profile URL path for a stored username (no `@`).\n@@ -107,8 +110,8 @@ pub struct ThemeForm {\n pub async fn post_theme(Form(form): Form<ThemeForm>) -> impl IntoResponse {\n     let theme = normalize_theme(&form.theme);\n     let next = sanitize_theme_next(form.next.as_deref());\n-    let loc = HeaderValue::try_from(next.as_str())\n-        .unwrap_or_else(|_| HeaderValue::from_static(\"/\"));\n+    let loc =\n+        HeaderValue::try_from(next.as_str()).unwrap_or_else(|_| HeaderValue::from_static(\"/\"));\n     Response::builder()\n         .status(StatusCode::SEE_OTHER)\n         .header(header::LOCATION, loc)\n@@ -179,7 +182,9 @@ pub(crate) struct JsQueryBuilder {\n \n impl JsBuilder {\n     pub(crate) fn new() -> Self {\n-        Self { snippets: Vec::new() }\n+        Self {\n+            snippets: Vec::new(),\n+        }\n     }\n \n     pub(crate) fn morph_selector(self, selector: &str, markup: Markup) -> Self {\n@@ -195,7 +200,12 @@ impl JsBuilder {\n         self.qs(selector).morph_inner(markup)\n     }\n \n-    pub(crate) fn morph_expr(mut self, expr: &str, markup: Markup, morph_style: Option<&str>) -> Self {\n+    pub(crate) fn morph_expr(\n+        mut self,\n+        expr: &str,\n+        markup: Markup,\n+        morph_style: Option<&str>,\n+    ) -> Self {\n         let html = js_string_literal(&markup.into_string());\n         let opts = morph_style\n             .map(|style| format!(\", {{morphStyle: {}}}\", js_string_literal(style)))\n@@ -217,7 +227,11 @@ impl JsBuilder {\n         self.qs(&format!(\"#{id}\"))\n     }\n \n-    pub(crate) fn if_current_path_matches(mut self, path: &str, f: impl FnOnce(JsBuilder) -> JsBuilder) -> Self {\n+    pub(crate) fn if_current_path_matches(\n+        mut self,\n+        path: &str,\n+        f: impl FnOnce(JsBuilder) -> JsBuilder,\n+    ) -> Self {\n         let inner = f(JsBuilder::new()).build();\n         self.snippets.push(format!(\n             \"var __slugHere = window.location.pathname + window.location.search; var __slugPath = {path}; if (__slugHere === __slugPath || __slugHere.indexOf(__slugPath + '?') === 0) {{ {inner} }}\",\n@@ -226,7 +240,11 @@ impl JsBuilder {\n         self\n     }\n \n-    pub(crate) fn if_current_path_not_matches(mut self, path: &str, f: impl FnOnce(JsBuilder) -> JsBuilder) -> Self {\n+    pub(crate) fn if_current_path_not_matches(\n+        mut self,\n+        path: &str,\n+        f: impl FnOnce(JsBuilder) -> JsBuilder,\n+    ) -> Self {\n         let inner = f(JsBuilder::new()).build();\n         self.snippets.push(format!(\n             \"var __slugHere = window.location.pathname + window.location.search; var __slugPath = {path}; if (!(__slugHere === __slugPath || __slugHere.indexOf(__slugPath + '?') === 0)) {{ {inner} }}\",\n@@ -301,7 +319,17 @@ pub(super) fn layout(\n     garden_room_wire: Option<&str>,\n     garden_path_prefix: Option<&str>,\n ) -> Markup {\n-    layout_embed_controls(title, view, body, views, theme, theme_next, garden_room_wire, garden_path_prefix, true)\n+    layout_embed_controls(\n+        title,\n+        view,\n+        body,\n+        views,\n+        theme,\n+        theme_next,\n+        garden_room_wire,\n+        garden_path_prefix,\n+        true,\n+    )\n }\n \n /// Minimal document shell: no bottom controls, no garden HUD data attributes (`data-garden-room` /\n@@ -315,15 +343,7 @@ pub(super) fn layout_full_bleed_chromeless(\n     theme_next: &str,\n ) -> Markup {\n     layout_embed_controls(\n-        title,\n-        view,\n-        body,\n-        views,\n-        theme,\n-        theme_next,\n-        None,\n-        None,\n-        false,\n+        title, view, body, views, theme, theme_next, None, None, false,\n     )\n }\n \n@@ -545,7 +565,58 @@ fn item_body_title_snippet(body: &str) -> Option<String> {\n     Some(format!(\"{truncated}{ellipsis}\"))\n }\n \n-/// Replace ~/path slugs in raw text with clickable links.\n+fn garden_href_for_item_ref(\n+    raw_ref: &str,\n+    garden_prefix: &str,\n+) -> Option<(crate::path_types::ItemId, String)> {\n+    let key = slug_types::canonicalize_item(raw_ref);\n+    let id = crate::path_types::ItemId::parse(&key)?;\n+    let href = if let Some(tail) = id.tilde_tail() {\n+        if tail.is_empty() {\n+            garden_prefix.trim_end_matches('/').to_string()\n+        } else {\n+            format!(\"{}/{}\", garden_prefix.trim_end_matches('/'), tail)\n+        }\n+    } else if id.as_str().starts_with(\"https://\") || id.as_str().starts_with(\"http://\") {\n+        let display = id.display_path();\n+        let rest = display.strip_prefix(\"-/\").unwrap_or(display.as_str());\n+        let ext_prefix = format!(\"{}-\", garden_prefix.trim_end_matches('~'));\n+        format!(\"{}/{}\", ext_prefix, rest)\n+    } else {\n+        return None;\n+    };\n+    Some((id, href))\n+}\n+\n+fn push_item_ref_anchor(\n+    out: &mut String,\n+    raw_ref: &str,\n+    garden_prefix: &str,\n+    item_bodies: Option<&HashMap<crate::path_types::ItemId, String>>,\n+) -> bool {\n+    let Some((id, href)) = garden_href_for_item_ref(raw_ref, garden_prefix) else {\n+        return false;\n+    };\n+    out.push_str(r#\"<a href=\"\"#);\n+    out.push_str(&escape_html(&href));\n+    out.push('\"');\n+    out.push_str(r#\" class=\"pre-link\"\"#);\n+    if let Some(bodies) = item_bodies {\n+        if let Some(body) = bodies.get(&id) {\n+            if let Some(snippet) = item_body_title_snippet(body) {\n+                out.push_str(r#\" title=\"\"#);\n+                out.push_str(&escape_html(&snippet));\n+                out.push('\"');\n+            }\n+        }\n+    }\n+    out.push('>');\n+    out.push_str(&escape_html(raw_ref));\n+    out.push_str(\"</a>\");\n+    true\n+}\n+\n+/// Replace item refs in raw prose with clickable garden links.\n ///\n /// When `item_bodies` is set, matching ontology items get a `title` attribute with a truncated\n /// body preview for native browser tooltips (forum posts, item pages).\n@@ -554,53 +625,16 @@ pub(super) fn linkify_slugs_with_prefix(\n     garden_prefix: &str,\n     item_bodies: Option<&HashMap<crate::path_types::ItemId, String>>,\n ) -> String {\n-    let escaped = escape_html(raw);\n-    let mut out = String::with_capacity(escaped.len() + 64);\n-    let mut i = 0;\n-    let s = escaped.as_str();\n-    while i < s.len() {\n-        let rest = &s[i..];\n-        if let Some(after_tilde) = rest.strip_prefix(\"~/\") {\n-            let path_len = after_tilde\n-                .chars()\n-                .take_while(|c| c.is_ascii_alphanumeric() || *c == '_' || *c == '-' || *c == '/')\n-                .map(|c| c.len_utf8())\n-                .sum::<usize>();\n-            if path_len > 0 {\n-                let path = &after_tilde[..path_len];\n-                out.push_str(r#\"<a href=\"\"#);\n-                out.push_str(&escape_html(garden_prefix.trim_end_matches('/')));\n-                out.push('/');\n-                out.push_str(path);\n-                out.push('\"');\n-                out.push_str(r#\" class=\"pre-link\"\"#);\n-                if let Some(bodies) = item_bodies {\n-                    let tilde_ref = format!(\"~/{}\", path);\n-                    let key = slug_types::canonicalize_item(&tilde_ref);\n-                    if let Some(id) = crate::path_types::ItemId::parse(&key) {\n-                        if let Some(body) = bodies.get(&id) {\n-                            if let Some(snippet) = item_body_title_snippet(body) {\n-                                out.push_str(r#\" title=\"\"#);\n-                                out.push_str(&escape_html(&snippet));\n-                                out.push('\"');\n-                            }\n-                        }\n-                    }\n+    let mut out = String::with_capacity(raw.len() + 64);\n+    for token in crate::dsl::tokenize_prose_item_refs(raw) {\n+        match token {\n+            crate::dsl::ProseToken::Text(text) => out.push_str(&escape_html(&text)),\n+            crate::dsl::ProseToken::ItemRef(raw_ref) => {\n+                if !push_item_ref_anchor(&mut out, &raw_ref, garden_prefix, item_bodies) {\n+                    out.push_str(&escape_html(&raw_ref));\n                 }\n-                out.push('>');\n-                out.push_str(\"~/\");\n-                out.push_str(path);\n-                out.push_str(\"</a>\");\n-                i += 2 + path_len;\n-                continue;\n             }\n         }\n-        if let Some((j, c)) = rest.char_indices().next() {\n-            out.push(c);\n-            i += j + c.len_utf8();\n-        } else {\n-            break;\n-        }\n     }\n     out\n }\n@@ -638,7 +672,13 @@ fn spotify_embed_src(url: &str) -> Option<EmbedFrame> {\n     if !(host == \"open.spotify.com\" || host == \"www.open.spotify.com\") {\n         return None;\n     }\n-    let path = tail.split('#').next().unwrap_or(tail).split('?').next().unwrap_or(tail);\n+    let path = tail\n+        .split('#')\n+        .next()\n+        .unwrap_or(tail)\n+        .split('?')\n+        .next()\n+        .unwrap_or(tail);\n     let mut segs: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();\n     if segs.first().is_some_and(|s| s.starts_with(\"intl-\")) {\n         segs.remove(0);\n@@ -670,8 +710,16 @@ fn youtube_embed_src(url: &str) -> Option<EmbedFrame> {\n     let host = host.to_lowercase();\n \n     let video_id = if host == \"youtu.be\" || host == \"www.youtu.be\" {\n-        clean_media_id(tail.split(['?', '#']).next().unwrap_or(tail).trim_matches('/'))\n-    } else if matches!(host.as_str(), \"youtube.com\" | \"www.youtube.com\" | \"m.youtube.com\" | \"music.youtube.com\") {\n+        clean_media_id(\n+            tail.split(['?', '#'])\n+                .next()\n+                .unwrap_or(tail)\n+                .trim_matches('/'),\n+        )\n+    } else if matches!(\n+        host.as_str(),\n+        \"youtube.com\" | \"www.youtube.com\" | \"m.youtube.com\" | \"music.youtube.com\"\n+    ) {\n         let path = format!(\"/{}\", tail.split('#').next().unwrap_or(tail));\n         if path.starts_with(\"/watch\") {\n             clean_media_id(&query_param(url, \"v\")?)\n@@ -745,10 +793,7 @@ pub(super) fn render_linkified_with_embeds_in_scope(\n /// CLI strings are embedded in a single-quoted JS literal; they must never need escaping.\n fn assert_cli_panel_cmd_js_single_quote_safe(s: &str) {\n     assert!(\n-        !s.contains('\\\\')\n-            && !s.contains('\\'')\n-            && !s.contains('\\n')\n-            && !s.contains('\\r'),\n+        !s.contains('\\\\') && !s.contains('\\'') && !s.contains('\\n') && !s.contains('\\r'),\n         \"cli_panel cmd must not contain `\\\\`, `'`, or newlines (got {s:?})\"\n     );\n }\n@@ -805,15 +850,40 @@ mod linkify_title_tests {\n         let mut bodies = HashMap::new();\n         let key = ItemId::parse(&slug_types::canonicalize_item(\"~/foo/bar\")).unwrap();\n         bodies.insert(key, \"Hello  world\\nline\".to_string());\n-        let html = linkify_slugs_with_prefix(\n-            \"see ~/foo/bar ok\",\n-            \"/r/x/~\",\n-            Some(&bodies),\n-        );\n+        let html = linkify_slugs_with_prefix(\"see ~/foo/bar ok\", \"/r/x/~\", Some(&bodies));\n         assert!(html.contains(\"title=\\\"Hello world line\\\"\"));\n         assert!(html.contains(\"href=\\\"/r/x/~/foo/bar\\\"\"));\n     }\n \n+    #[test]\n+    fn raw_url_links_to_public_external_garden_page() {\n+        let html = linkify_slugs_with_prefix(\"see https://example.com/z.\", \"/~\", None);\n+        assert!(html\n+            .contains(r#\"<a href=\"/-/example.com/z\" class=\"pre-link\">https://example.com/z</a>.\"#));\n+    }\n+\n+    #[test]\n+    fn dash_ref_links_to_room_external_garden_page_with_title() {\n+        let mut bodies = HashMap::new();\n+        let key = ItemId::parse(&slug_types::canonicalize_item(\"-/example.com/z\")).unwrap();\n+        bodies.insert(key, \"External body\\npreview\".to_string());\n+        let html =\n+            linkify_slugs_with_prefix(\"see -/example.com/z\", \"/r/9ab12cdroom/~\", Some(&bodies));\n+        assert!(html.contains(r#\"href=\"/r/9ab12cdroom/-/example.com/z\"\"#));\n+        assert!(html.contains(r#\"title=\"External body preview\"\"#));\n+    }\n+\n+    #[test]\n+    fn code_fence_urls_are_not_linkified() {\n+        let html = linkify_slugs_with_prefix(\n+            \"```json\\n{\\\"url\\\":\\\"https://example.com/z\\\"}\\n```\\nthen https://example.com/a\",\n+            \"/~\",\n+            None,\n+        );\n+        assert!(!html.contains(r#\"href=\"/-/example.com/z\"\"#));\n+        assert!(html.contains(r#\"href=\"/-/example.com/a\"\"#));\n+    }\n+\n     #[test]\n     fn no_title_when_body_missing_or_empty() {\n         let html = linkify_slugs_with_prefix(\"x ~/a/b y\", \"/~\", Some(&HashMap::new()));\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}