{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[8f69c309] Require Reddit OAuth when credentials are set and refresh on 401/403.\n\nAvoid falling back to the public www.reddit.com API from cloud IPs, which\nreturns Reddit's network-security block page. Also pin SORTER2_BASE_URL in fly.toml.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide A — unified diff (full patch):\ndiff --git a/fly.toml b/fly.toml\nindex f0c6a39f643c204987debc177234d95a8ef44b65..ca7e0088a7efd7d58d29d808f8d89080b2bff233 100644\n--- a/fly.toml\n+++ b/fly.toml\n@@ -5,6 +5,7 @@ primary_region = \"iad\"\n   dockerfile = \"Dockerfile\"\n \n [env]\n+  SORTER2_BASE_URL = \"https://reddit.sorter.social\"\n   SORTER2_DATA_DIR = \"/data\"\n   SORTER2_EVENT_LOG = \"/data/events.jsonl\"\n   PORT = \"8080\"\ndiff --git a/server/src/reddit.rs b/server/src/reddit.rs\nindex a874814f8927192ee62cab2d0db1efd27dcd57b7..f409764c1e1f36216f1b08107043c2eab905694c 100644\n--- a/server/src/reddit.rs\n+++ b/server/src/reddit.rs\n@@ -283,26 +283,35 @@ async fn reddit_worker(\n         );\n         tokio::time::sleep(current_delay).await;\n \n-        if let Some(c) = &creds {\n-            oauth = ensure_oauth_token(&client, &oauth_token_base, c, oauth.take()).await;\n-        }\n-\n-        let token = oauth.as_ref().map(|t| t.access_token.as_str());\n-        let fetch_base = if token.is_some() {\n-            tracing::debug!(\n-                item = %fetch_id,\n-                base = %oauth_api_base,\n-                \"reddit fetch using OAuth bearer\"\n-            );\n-            &oauth_api_base\n-        } else {\n-            &api_base\n-        };\n-        let url = match kind {\n-            FetchKind::SelfEntity => map_item_to_reddit_api(&fetch_id, fetch_base),\n-            FetchKind::Children => map_children_url(&fetch_id, fetch_base),\n+        let outcome = match &creds {\n+            Some(c) => {\n+                // OAuth is required when credentials are configured — never fall\n+                // back to the public www.reddit.com JSON endpoints (cloud IPs\n+                // get blocked with a 403 HTML interstitial).\n+                fetch_with_oauth(\n+                    &client,\n+                    &oauth_token_base,\n+                    &oauth_api_base,\n+                    c,\n+                    &mut oauth,\n+                    &fetch_id,\n+                    kind,\n+                )\n+                .await\n+            }\n+            None => {\n+                let url = match kind {\n+                    FetchKind::SelfEntity => map_item_to_reddit_api(&fetch_id, &api_base),\n+                    FetchKind::Children => map_children_url(&fetch_id, &api_base),\n+                };\n+                match do_fetch(&client, &url, &fetch_id, None).await {\n+                    Ok(FetchOutcome::AuthRejected { status, detail }) => {\n+                        Err(format!(\"Reddit API {status}: {detail}\"))\n+                    }\n+                    other => other,\n+                }\n+            }\n         };\n-        let outcome = do_fetch(&client, &url, &fetch_id, token).await;\n \n         match outcome {\n             Ok(FetchOutcome::Payload(payload)) => {\n@@ -342,6 +351,12 @@ async fn reddit_worker(\n                 current_delay = (current_delay * 2).min(Duration::from_secs(60));\n                 notify(done, FetchJobResult::RateLimited { reset_secs });\n             }\n+            Ok(FetchOutcome::AuthRejected { status, detail }) => {\n+                let e = format!(\"Reddit API {status}: {detail}\");\n+                tracing::warn!(item = %fetch_id, err = %e, \"reddit fetch auth rejected\");\n+                current_delay = (current_delay * 2).min(Duration::from_secs(60));\n+                notify(done, FetchJobResult::Failed(e));\n+            }\n             Err(e) => {\n                 tracing::warn!(item = %fetch_id, err = %e, \"reddit fetch failed\");\n                 current_delay = (current_delay * 2).min(Duration::from_secs(60));\n@@ -357,6 +372,60 @@ enum FetchOutcome {\n     Payload(Value),\n     NotFound,\n     RateLimited { reset_secs: u64 },\n+    /// Bearer rejected — caller should drop the cached token and retry once.\n+    AuthRejected { status: StatusCode, detail: String },\n+}\n+\n+async fn fetch_with_oauth(\n+    client: &Client,\n+    oauth_token_base: &str,\n+    oauth_api_base: &str,\n+    creds: &RedditCredentials,\n+    oauth: &mut Option<OAuthToken>,\n+    fetch_id: &ItemId,\n+    kind: FetchKind,\n+) -> Result<FetchOutcome, String> {\n+    for attempt in 0..2 {\n+        let force_refresh = attempt > 0;\n+        *oauth = Some(\n+            ensure_oauth_token(client, oauth_token_base, creds, oauth.take(), force_refresh)\n+                .await?,\n+        );\n+        let token = oauth\n+            .as_ref()\n+            .expect(\"token set above\")\n+            .access_token\n+            .clone();\n+\n+        tracing::debug!(\n+            item = %fetch_id,\n+            base = %oauth_api_base,\n+            attempt,\n+            \"reddit fetch using OAuth bearer\"\n+        );\n+\n+        let url = match kind {\n+            FetchKind::SelfEntity => map_item_to_reddit_api(fetch_id, oauth_api_base),\n+            FetchKind::Children => map_children_url(fetch_id, oauth_api_base),\n+        };\n+        match do_fetch(client, &url, fetch_id, Some(&token)).await? {\n+            FetchOutcome::AuthRejected { status, detail } if attempt == 0 => {\n+                tracing::warn!(\n+                    item = %fetch_id,\n+                    %status,\n+                    %detail,\n+                    \"reddit OAuth rejected; refreshing token and retrying\"\n+                );\n+                *oauth = None;\n+                continue;\n+            }\n+            FetchOutcome::AuthRejected { status, detail } => {\n+                return Err(format!(\"Reddit API {status}: {detail}\"));\n+            }\n+            other => return Ok(other),\n+        }\n+    }\n+    unreachable!(\"loop always returns\")\n }\n \n async fn ensure_oauth_token(\n@@ -364,35 +433,35 @@ async fn ensure_oauth_token(\n     oauth_base: &str,\n     creds: &RedditCredentials,\n     existing: Option<OAuthToken>,\n-) -> Option<OAuthToken> {\n-    if let Some(t) = existing {\n-        if Instant::now() < t.expires_at - Duration::from_secs(60) {\n-            tracing::debug!(\"reddit OAuth token still valid\");\n-            return Some(t);\n+    force_refresh: bool,\n+) -> Result<OAuthToken, String> {\n+    if !force_refresh {\n+        if let Some(t) = existing {\n+            if Instant::now() < t.expires_at - Duration::from_secs(60) {\n+                tracing::debug!(\"reddit OAuth token still valid\");\n+                return Ok(t);\n+            }\n         }\n     }\n \n     let url = format!(\"{}/api/v1/access_token\", oauth_base.trim_end_matches('/'));\n-    tracing::debug!(%url, \"reddit OAuth token request\");\n+    tracing::debug!(%url, force_refresh, \"reddit OAuth token request\");\n \n     let resp = client\n         .post(&url)\n         .basic_auth(&creds.client_id, Some(&creds.client_secret))\n         .form(&[(\"grant_type\", \"client_credentials\")])\n         .send()\n-        .await;\n-\n-    let resp = match resp {\n-        Ok(r) => r,\n-        Err(e) => {\n-            tracing::warn!(\"reddit OAuth token request failed: {e}\");\n-            return None;\n-        }\n-    };\n+        .await\n+        .map_err(|e| format!(\"Reddit OAuth token request failed: {e}\"))?;\n \n     if !resp.status().is_success() {\n-        tracing::warn!(\"reddit OAuth token HTTP {}\", resp.status());\n-        return None;\n+        let status = resp.status();\n+        let body = resp.text().await.unwrap_or_default();\n+        return Err(format!(\n+            \"Reddit OAuth token HTTP {status}: {}\",\n+            truncate_for_error(&body)\n+        ));\n     }\n \n     #[derive(Deserialize)]\n@@ -401,21 +470,40 @@ async fn ensure_oauth_token(\n         expires_in: u64,\n     }\n \n-    let body: TokenResponse = match resp.json().await {\n-        Ok(b) => b,\n-        Err(e) => {\n-            tracing::warn!(\"reddit OAuth token parse failed: {e}\");\n-            return None;\n-        }\n-    };\n+    let body: TokenResponse = resp\n+        .json()\n+        .await\n+        .map_err(|e| format!(\"Reddit OAuth token parse failed: {e}\"))?;\n \n-    tracing::debug!(expires_in = body.expires_in, \"reddit OAuth token acquired\");\n-    Some(OAuthToken {\n+    tracing::info!(expires_in = body.expires_in, \"reddit OAuth token acquired\");\n+    Ok(OAuthToken {\n         access_token: body.access_token,\n         expires_at: Instant::now() + Duration::from_secs(body.expires_in),\n     })\n }\n \n+fn truncate_for_error(body: &str) -> String {\n+    let compact: String = body.split_whitespace().collect::<Vec<_>>().join(\" \");\n+    if compact.is_empty() {\n+        return \"(empty body)\".into();\n+    }\n+    // Prefer the human-readable block message over dumping Reddit's CSS.\n+    if let Some(idx) = compact.find(\"You've been blocked\") {\n+        let slice: String = compact.chars().skip(idx).take(160).collect();\n+        return if compact.chars().count() > idx + 160 {\n+            format!(\"{slice}…\")\n+        } else {\n+            slice\n+        };\n+    }\n+    let chars: String = compact.chars().take(200).collect();\n+    if compact.chars().count() > 200 {\n+        format!(\"{chars}…\")\n+    } else {\n+        chars\n+    }\n+}\n+\n async fn do_fetch(\n     client: &Client,\n     url: &str,\n@@ -460,15 +548,16 @@ async fn do_fetch(\n \n     if !status.is_success() {\n         let body = resp.text().await.unwrap_or_default();\n+        let detail = truncate_for_error(&body);\n         tracing::debug!(\n             item = %id,\n             %status,\n             body_len = body.len(),\n-            body_prefix = %body.chars().take(240).collect::<String>(),\n+            %detail,\n             \"reddit non-success body\"\n         );\n         if status == StatusCode::FORBIDDEN || status == StatusCode::UNAUTHORIZED {\n-            return Err(format!(\"Reddit API {status}: {body}\"));\n+            return Ok(FetchOutcome::AuthRejected { status, detail });\n         }\n         return Ok(FetchOutcome::NotFound);\n     }\n@@ -716,6 +805,15 @@ fn reddit_direct_image_url(url: &str) -> bool {\n mod tests {\n     use super::*;\n \n+    #[test]\n+    fn truncate_error_prefers_block_message() {\n+        let html = r#\"<style>.x{color:red}</style><div>You've been blocked by network security. To continue, log in</div>\"#;\n+        let msg = truncate_for_error(html);\n+        assert!(msg.starts_with(\"You've been blocked\"));\n+        assert!(msg.len() < 200);\n+        assert!(!msg.contains(\".x{color\"));\n+    }\n+\n     #[test]\n     fn map_subreddit_about_url() {\n         let id = ItemId::from_url(\"https://reddit.com/r/rust\").unwrap();\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[b7626603] Remove browser sentinel delegates so multi-user votes work.\n\nShared WEB_BROWSER_AGENT bound on first vote and blocked every later human; browser posts now use no delegate, matching forum UI.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/cli/src/main.rs b/cli/src/main.rs\nindex 70435b412188a151c5e89e842a5de57f7480ddf2..a4a22724fc9e27879951f520a9241d5832982a70 100644\n--- a/cli/src/main.rs\n+++ b/cli/src/main.rs\n@@ -1645,8 +1645,8 @@ async fn run() -> Result<()> {\n                     tokio::time::sleep(std::time::Duration::from_millis(poll_interval_ms)).await;\n                     let poll: PendingSessionPollResponse =\n                         expect_json(client.get(&poll_url).send().await?).await?;\n-                    if !poll.agent.trim().is_empty() {\n-                        agent_out = Some(poll.agent.clone());\n+                    if let Some(a) = poll.agent.as_deref().map(str::trim).filter(|s| !s.is_empty()) {\n+                        agent_out = Some(a.to_string());\n                     }\n                     if poll.complete {\n                         token_out = poll.token;\ndiff --git a/server/src/api/auth.rs b/server/src/api/auth.rs\nindex bfddcce4dc1a77571d297648dd840e6c5bc194f8..01c02f50c19bcd62c7f1717f9b927f203c3164d0 100644\n--- a/server/src/api/auth.rs\n+++ b/server/src/api/auth.rs\n@@ -29,12 +29,6 @@ use crate::{\n     write_cmd::WriteCmd,\n };\n \n-/// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).\n-const INVITE_BROWSER_AGENT: &str = \"00000000-0000-0000-0000-000000000000:invite:web/join\";\n-\n-/// Agent id for `/login` browser OAuth (no CLI); must pass [`parse_agent`].\n-pub const WEB_BROWSER_AGENT: &str = \"00000000-0000-0000-0000-000000000001:social:web/browser\";\n-\n /// HttpOnly cookie storing the same `slug_*` bearer string the CLI uses.\n pub const SLUG_SESSION_COOKIE: &str = \"slug_session\";\n \n@@ -282,7 +276,7 @@ pub async fn get_join_invite(\n     let session = format!(\"p_{}\", uuid::Uuid::new_v4().simple());\n     let redirect_next = safe_local_redirect(q.next.as_deref().or(q.redirect.as_deref()));\n     let s = PendingSession {\n-        agent: INVITE_BROWSER_AGENT.to_string(),\n+        agent: None,\n         created_ts: now_ms(),\n         provider: None,\n         provider_id: None,\n@@ -549,7 +543,7 @@ pub async fn post_choose_username(\n     };\n \n     let sessions = pending_sessions(&state);\n-    let (provider, provider_id, agent) = {\n+    let (provider, provider_id) = {\n         let sessions_read = sessions.read().await;\n         let Some(s) = sessions_read.get(&form.session) else {\n             return api_error(StatusCode::NOT_FOUND, \"unknown session\", None).into_response();\n@@ -560,14 +554,9 @@ pub async fn post_choose_username(\n         let Some(provider_id) = s.provider_id.clone() else {\n             return js_form_error_fragment(&form.session, \"oauth not completed\").into_response();\n         };\n-        (provider, provider_id, s.agent.clone())\n+        (provider, provider_id)\n     };\n \n-    if let Err(msg) = parse_agent(&agent) {\n-        return js_form_error_fragment(&form.session, &format!(\"invalid agent format — {msg}\"))\n-            .into_response();\n-    }\n-\n     let redeem_invite = {\n         let sessions_read = sessions.read().await;\n         sessions_read\n@@ -637,7 +626,8 @@ pub async fn get_web_login(\n     let redirect_next = safe_local_redirect(q.next.as_deref().or(q.redirect.as_deref()))\n         .or_else(|| Some(\"/\".to_string()));\n     let s = PendingSession {\n-        agent: WEB_BROWSER_AGENT.to_string(),\n+        // Humans sign in via the website with no AI delegate.\n+        agent: None,\n         created_ts: now_ms(),\n         provider: None,\n         provider_id: None,\n@@ -698,7 +688,7 @@ pub async fn post_pending_session(\n     );\n     let poll_url = format!(\"/api/v0/pending-session/{session}\");\n     let s = PendingSession {\n-        agent: agent_naked,\n+        agent: Some(agent_naked),\n         created_ts: now_ms(),\n         provider: None,\n         provider_id: None,\ndiff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs\nindex 578e5844e86f7c2666c8e37ef9fa90c01d20d134..57a0139928b09034122398f8f3362cbdbcc5862e 100644\n--- a/server/src/api/ui_html.rs\n+++ b/server/src/api/ui_html.rs\n@@ -276,7 +276,7 @@ async fn dispatch_ui_action(\n                 &session.bearer,\n                 room.clone(),\n                 thread_tag.clone(),\n-                Some(crate::api::auth::WEB_BROWSER_AGENT.to_string()),\n+                None,\n                 text,\n             )\n             .await\ndiff --git a/server/src/state.rs b/server/src/state.rs\nindex 648ab5304764a329fcabbbbcd3782b94e3e005a8..8ea84dcf9b1df8f8037e913cdd94e5908e6d5d55 100644\n--- a/server/src/state.rs\n+++ b/server/src/state.rs\n@@ -21,7 +21,8 @@ pub struct InviteState {\n \n #[derive(Debug, Clone)]\n pub struct PendingSession {\n-    pub agent: String,\n+    /// CLI `identity start` delegate (`uuid:rig:model`). `None` for browser `/login` and `/join`.\n+    pub agent: Option<String>,\n     pub created_ts: i64,\n     pub provider: Option<String>,\n     pub provider_id: Option<String>,\ndiff --git a/server/tests/integration_ui.rs b/server/tests/integration_ui.rs\nindex d242abff5769cc704b3c8070d7456e5788c31a45..22b16c87d5ecdb5272a017af70b5353d8c39c6e8 100644\n--- a/server/tests/integration_ui.rs\n+++ b/server/tests/integration_ui.rs\n@@ -418,6 +418,99 @@ async fn test_web_login_carries_vote_pair_next_into_pending_session() {\n     let sessions = state.pending_sessions.read().await;\n     let pending = sessions.get(&session).expect(\"pending session\");\n     assert_eq!(pending.redirect_next.as_deref(), Some(next));\n+    assert_eq!(\n+        pending.agent, None,\n+        \"browser /login must not invent a sentinel delegate\"\n+    );\n+}\n+\n+#[tokio::test]\n+async fn test_vote_compare_two_users_both_succeed_without_delegate() {\n+    let (addr, _tmp, _log, state, _handle) = create_test_server_with_state().await;\n+    let client = reqwest::Client::new();\n+    let alice = test_bearer();\n+    let bob = seed_user_token(&state, \"bob\", \"bobtok\", \"bobsecret\").await;\n+\n+    // Define items first (votes require existing item bodies).\n+    let seed = ui_post_ingest_rpc(\n+        \"public\",\n+        \"multi-vote\",\n+        \"~/multi-a {alpha}\\n~/multi-b {beta}\\n\",\n+    );\n+    let seed_resp = client\n+        .post(format!(\"http://{addr}/ui\"))\n+        .header(\"Authorization\", format!(\"Bearer {alice}\"))\n+        .form(&[(\"__rpc__\", seed.as_str())])\n+        .send()\n+        .await\n+        .unwrap();\n+    assert_eq!(seed_resp.status(), reqwest::StatusCode::OK);\n+    let seed_js = seed_resp.text().await.unwrap();\n+    assert!(\n+        !seed_js.contains(\"auth-error\"),\n+        \"item seed must succeed, got: {seed_js}\"\n+    );\n+\n+    for (bearer, left, right, explanation) in [\n+        (&alice, \"3\", \"1\", \"alice prefers a\"),\n+        (&bob, \"1\", \"3\", \"bob prefers b\"),\n+    ] {\n+        let rpc = ui_vote_compare_post_rpc(\n+            \"public\",\n+            \"multi-vote\",\n+            \"~/multi-a\",\n+            \"~/multi-b\",\n+            left,\n+            right,\n+            explanation,\n+        );\n+        let resp = client\n+            .post(format!(\"http://{addr}/ui\"))\n+            .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n+            .form(&[(\"__rpc__\", rpc.as_str())])\n+            .send()\n+            .await\n+            .unwrap();\n+        assert_eq!(resp.status(), reqwest::StatusCode::OK);\n+        let js = resp.text().await.unwrap();\n+        assert!(\n+            !js.contains(\"delegate already bound\"),\n+            \"human vote must not hit shared-sentinel AgentBound ({explanation}), got: {js}\"\n+        );\n+        assert!(\n+            !js.contains(\"auth-error\"),\n+            \"human vote must succeed ({explanation}), got: {js}\"\n+        );\n+        assert!(\n+            js.contains(\"vote-edge-history-region\"),\n+            \"vote should morph edge history ({explanation}), got: {js}\"\n+        );\n+    }\n+\n+    let reduced = state.reduced.read().await;\n+    let human_votes: Vec<_> = reduced\n+        .ingests_ordered\n+        .iter()\n+        .filter_map(|id| reduced.ingests_by_id.get(id))\n+        .filter(|ing| ing.raw.contains(\"prefers\"))\n+        .collect();\n+    assert_eq!(human_votes.len(), 2, \"expected two vote ingests\");\n+    let mut principals: Vec<&str> = human_votes.iter().map(|i| i.principal.as_str()).collect();\n+    principals.sort();\n+    assert_eq!(principals, [\"bob\", \"testuser\"]);\n+    for ing in &human_votes {\n+        assert!(\n+            ing.delegate.is_none(),\n+            \"browser votes must have no delegate, principal={} delegate={:?}\",\n+            ing.principal,\n+            ing.delegate\n+        );\n+    }\n+    assert!(\n+        reduced.agent_bindings.is_empty(),\n+        \"human votes must not create AgentBound entries: {:?}\",\n+        reduced.agent_bindings\n+    );\n }\n \n #[tokio::test]\ndiff --git a/server/tests/support/mod.rs b/server/tests/support/mod.rs\nindex 4a620eaa875e7a1145f2a4e82cc4ff2be21d5345..a5306fa2c4c9fda47e43fc0de42407b66e23eced 100644\n--- a/server/tests/support/mod.rs\n+++ b/server/tests/support/mod.rs\n@@ -70,20 +70,25 @@ pub async fn rpc_batch(\n     response.json().await.unwrap()\n }\n \n-pub async fn seed_test_token(state: &AppState) {\n+/// Seed a user + bearer into reducer state (not appended to the event log).\n+/// Returns the `slug_<token_id>_<secret>` bearer string.\n+pub async fn seed_user_token(\n+    state: &AppState,\n+    username: &str,\n+    token_id: &str,\n+    secret: &str,\n+) -> String {\n     let registered = Event::UserRegistered(UserRegistered {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         provider: \"test\".to_string(),\n-        provider_id: \"testuser\".to_string(),\n+        provider_id: username.to_string(),\n     });\n-    let token_id = \"testtok\";\n-    let secret = \"secret\";\n     let salt = \"salt\";\n     let token_hash = sha256_hex(&format!(\"{salt}:{secret}\"));\n     let ev = Event::TokenIssued(TokenIssued {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         token_id: token_id.to_string(),\n         token_hash,\n         salt: salt.to_string(),\n@@ -92,6 +97,11 @@ pub async fn seed_test_token(state: &AppState) {\n     let mut r = state.reduced.write().await;\n     r.apply_event(registered);\n     r.apply_event(ev);\n+    format!(\"slug_{token_id}_{secret}\")\n+}\n+\n+pub async fn seed_test_token(state: &AppState) {\n+    let _ = seed_user_token(state, \"testuser\", \"testtok\", \"secret\").await;\n }\n \n pub async fn create_test_server_with_state() -> (\ndiff --git a/test/oauth.clj b/test/oauth.clj\nindex 3cbf496005e906ad6c579d44ac8c4055ee60d063..6911ac34a55707acda9f9ce091c079964649a252 100644\n--- a/test/oauth.clj\n+++ b/test/oauth.clj\n@@ -186,8 +186,9 @@\n               (:token poll-json))))))))\n \n (defn fetch-bearer-token!\n-  \"Simulate browser OAuth + username choice; returns `slug_…` bearer token.\n-   Ingest `--delegate` must match this agent string for `AgentBound` on first write.\"\n+  \"Simulate CLI identity OAuth + username choice; returns `slug_…` bearer token.\n+   Pass `:agent` (default local/dev) when the test will CLI-ingest with `--delegate`\n+   so first write can `AgentBound`. Browser UI posts use no delegate.\"\n   [base-url & {:keys [username agent] :or {username \"intuser\" agent default-agent}}]\n   (let [token (complete-registration! base-url :username username :agent agent)]\n     (when-not (str/starts-with? token \"slug_\")\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex 211493935d19582607f5c87fb492faf47bdc6f53..0c4295b15908ea7a2303dac4c42015ded51e4d73 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -535,7 +535,9 @@ pub struct PendingSessionStartResponse {\n pub struct PendingSessionPollResponse {\n     pub ok: bool,\n     pub complete: bool,\n-    pub agent: String,\n+    /// Present for CLI identity sessions; omitted for browser `/login` / `/join` (no delegate).\n+    #[serde(default, skip_serializing_if = \"Option::is_none\")]\n+    pub agent: Option<String>,\n     #[serde(skip_serializing_if = \"Option::is_none\")]\n     pub user: Option<String>,\n     #[serde(skip_serializing_if = \"Option::is_none\")]\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}