{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[880eb778] Harden auth: fail-closed votes, mock OAuth gate, Secure cookies.\n\nAlso show the current alias in the top nav and pin durable by rev.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide A — unified diff (full patch):\ndiff --git a/AGENTS.md b/AGENTS.md\nindex babb889d6fbfb1fa7176c9e6b7544ae17b61dd2e..6e0fd8ebb65d665c9c1438e3275971d62b98fd95 100644\n--- a/AGENTS.md\n+++ b/AGENTS.md\n@@ -10,11 +10,11 @@ Single Rust web app **`sorter2-server`**: pairwise voting, rank-centrality ranki\n \n - **Bootstrap script**: `./scripts/cursor-env-install.sh` (also run via `.cursor/environment.json` on Cloud Agent boot) installs Playwright Chromium, Babashka, bbin, `clj-paren-repair`, and warms the RocksDB build.\n - **Rust 1.88+** is required (`rust-toolchain.toml`). The Cloud Dockerfile and `cursor-env-install.sh` install **rustup** 1.88.0 first so `cargo` works while Playwright/Clojure bootstrap continues. Do not rely on `/usr/local/cargo` (often missing or stale).\n-- **RocksDB / `durable`**: Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS=\"-C linker=g++\"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.\n+- **RocksDB / `durable`**: `durable` is an external git dependency (`tommy-mor/durable`, pinned by rev in `server/Cargo.toml`). Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS=\"-C linker=g++\"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.\n - **System packages** for builds: `build-essential`, `g++`, `clang`, `libclang-dev`, `pkg-config`, `libssl-dev`, `openjdk-21-jre-headless` (for `reqwest` / OpenSSL, `librocksdb-sys`, `zstd-sys` / bindgen, and **bbin** / Clojure JVM). The bootstrap sets **`JAVA_HOME`** when Java is present.\n - **Clojure CLI 1.12.0.1530** (used in CI): install from https://clojure.org/guides/install_clojure — needed for `./scripts/clj-test.sh` / Kaocha tests.\n - **Babashka / bbin / clj-paren-repair**: installed by `cursor-env-install.sh` into `~/.local/bin` (bb tasks in `bb.edn`, delimiter repair for Clojure edits).\n-- **Playwright** (Spel browser tests in `test/vote_compare.clj`): Chromium via `clojure -M -e \"(com.microsoft.playwright.CLI/main ...)\"` — run once after clone or use the bootstrap script.\n+- **Playwright** (Spel browser tests in `test/vote_compare.clj` / `test/auth_login.clj`): Chromium via `clojure -M -e \"(com.microsoft.playwright.CLI/main ...)\"` — run once after clone or use the bootstrap script.\n \n ### Commands (see also `TEST.sh`)\n \n@@ -34,13 +34,17 @@ Environment variables (defaults in `server/src/state.rs`):\n - `PORT` — default `8080`\n - `SORTER2_DATA_DIR` — default `./data` (created on startup)\n - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`\n+- `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)\n+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)\n+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)\n \n Health check: `GET /healthz` → `ok`.\n \n-Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Example vote:\n+Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Votes require a session cookie (sign in via `/login`). Example vote:\n \n ```bash\n curl -sf -X POST http://127.0.0.1:8080/ui \\\n+  --cookie \"sorter2_session=...\" \\\n   --data-urlencode '__rpc__={\"action\":\"record_vote\",\"a\":\"alpha\",\"b\":\"beta\",\"ratio_left\":2,\"ratio_right\":1}'\n ```\n \ndiff --git a/Cargo.lock b/Cargo.lock\nindex aa02997ad85777195f135bfd9456bcee0fc9a590..1f8690f3e486d099577a32c2ece48caf57ea7160 100644\n--- a/Cargo.lock\n+++ b/Cargo.lock\n@@ -414,7 +414,7 @@ dependencies = [\n [[package]]\n name = \"durable\"\n version = \"0.2.0\"\n-source = \"git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n+source = \"git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n dependencies = [\n  \"ciborium\",\n  \"durable-derive\",\n@@ -426,7 +426,7 @@ dependencies = [\n [[package]]\n name = \"durable-derive\"\n version = \"0.2.0\"\n-source = \"git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n+source = \"git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n dependencies = [\n  \"proc-macro2\",\n  \"quote\",\ndiff --git a/server/Cargo.toml b/server/Cargo.toml\nindex dfa39beddecfa37dcdeaa602cb30f4b547528fbb..bd88687fb0ba47d68f2c08eb5e11d0e08b7c4398 100644\n--- a/server/Cargo.toml\n+++ b/server/Cargo.toml\n@@ -25,7 +25,7 @@ futures-util = { version = \"0.3\", default-features = false, features = [\"std\"] }\n rand = \"0.8\"\n urlencoding = \"2\"\n url = \"2\"\n-durable = { git = \"https://github.com/tommy-mor/durable.git\", branch = \"main\" }\n+durable = { git = \"https://github.com/tommy-mor/durable.git\", rev = \"a6c14eaa809693140eea0c22b07ef24d8e74adaf\" }\n \n [dev-dependencies]\n reqwest = { version = \"0.12\", features = [\"json\"] }\ndiff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs\nindex b86581b1f337650564274254d840e8a75b49524d..9da62ffbed07eb28729aa3160bf33b07ce0d7945 100644\n--- a/server/src/api/ui_html.rs\n+++ b/server/src/api/ui_html.rs\n@@ -71,10 +71,16 @@ pub async fn post_ui_html(\n                 return resp;\n             }\n             let parent = parent_from_scope(&scope);\n-            let actor = resolve_vote_actor(\n+            let actor = match resolve_vote_actor(\n                 state.projection_store.db(),\n                 session_id_from_jar(&jar).as_deref(),\n-            );\n+            ) {\n+                Ok(actor) => actor,\n+                Err(_) => {\n+                    return vote_auth_redirect(&state, &jar)\n+                        .unwrap_or_else(|| login_redirect_js().into_response());\n+                }\n+            };\n             if let Err(e) = state\n                 .record_vote(&parent, &a, &b, ratio_left, ratio_right, &actor)\n                 .await\ndiff --git a/server/src/auth/config.rs b/server/src/auth/config.rs\nindex a1f042c655bf3e5234eeb87a7d889f64592807fb..a5976af9a52ea207b35ae87bd1fe927c47a477ca 100644\n--- a/server/src/auth/config.rs\n+++ b/server/src/auth/config.rs\n@@ -1,9 +1,42 @@\n pub const AUTH_RETURN_COOKIE: &str = \"sorter2_auth_return\";\n \n+/// Allow `mock_user` on `/auth/github` (test harness only).\n+pub fn mock_oauth_allowed() -> bool {\n+    matches!(\n+        std::env::var(\"SORTER2_ALLOW_MOCK_OAUTH\").as_deref(),\n+        Ok(\"1\") | Ok(\"true\") | Ok(\"TRUE\")\n+    )\n+}\n+\n+/// Set the Secure flag on auth cookies when serving over HTTPS.\n+pub fn cookies_secure() -> bool {\n+    std::env::var(\"SORTER2_BASE_URL\")\n+        .map(|u| u.starts_with(\"https://\"))\n+        .unwrap_or(false)\n+}\n+\n pub fn sanitize_return_to(raw: &str) -> String {\n     let s = raw.trim();\n-    if s.is_empty() || !s.starts_with('/') || s.starts_with(\"//\") {\n+    if s.is_empty() || !s.starts_with('/') || s.starts_with(\"//\") || s.starts_with(\"/\\\\\") {\n+        return \"/\".to_string();\n+    }\n+    // Reject scheme-relative and protocol-smuggling forms.\n+    if s.contains(\"://\") || s.contains('\\\\') {\n         return \"/\".to_string();\n     }\n     s.to_string()\n }\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::*;\n+\n+    #[test]\n+    fn sanitize_return_to_blocks_open_redirects() {\n+        assert_eq!(sanitize_return_to(\"\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"//evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"/\\\\evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"https://evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"/vote?parent=x\"), \"/vote?parent=x\");\n+    }\n+}\ndiff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs\nindex 5ed535ba199fa736f0048c32623b14c3b1e5de2d..d4a85ef52c15dc35148e4c743f0d646cbbdb056d 100644\n--- a/server/src/auth/mod.rs\n+++ b/server/src/auth/mod.rs\n@@ -26,7 +26,7 @@ use crate::{\n     ui_action::UI_RPC_FIELD,\n };\n \n-pub use session::{resolve_vote_actor, session_id_from_jar, VoteActor};\n+pub use session::{nav_pseudonym, resolve_vote_actor, session_id_from_jar, VoteActor};\n \n pub fn base_url_from_env(port: u16) -> String {\n     std::env::var(\"SORTER2_BASE_URL\")\n@@ -168,6 +168,10 @@ pub async fn login_page(\n         \"login · sorter2\",\n         login_body(session.as_ref(), &aliases, &providers),\n         state.views.get_views(\"/login\"),\n+        session\n+            .as_ref()\n+            .filter(|s| !s.pseudonym.trim().is_empty())\n+            .map(|s| s.pseudonym.as_str()),\n     );\n     (jar, Html(markup.into_string())).into_response()\n }\n@@ -222,6 +226,7 @@ pub async fn alias_page(\n             \"choose alias · sorter2\",\n             body,\n             state.views.get_views(\"/login/alias\"),\n+            None,\n         )\n         .into_string(),\n     )\n@@ -237,7 +242,12 @@ pub async fn github_start(\n         .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n     let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());\n     let state_token = session::new_oauth_state();\n-    let url = oauth::authorize_url(&cfg, &state_token, query.mock_user.as_deref());\n+    let mock_user = if config::mock_oauth_allowed() {\n+        query.mock_user.as_deref()\n+    } else {\n+        None\n+    };\n+    let url = oauth::authorize_url(&cfg, &state_token, mock_user);\n     let jar = jar\n         .add(session::oauth_state_cookie_value(&state_token))\n         .add(session::auth_return_cookie_value(&return_to));\ndiff --git a/server/src/auth/session.rs b/server/src/auth/session.rs\nindex 09659240b9455c6fca12db5652e1d31cf8c2acfc..41df030ded3abcafc0ab3887ab769adf103f9aa0 100644\n--- a/server/src/auth/session.rs\n+++ b/server/src/auth/session.rs\n@@ -5,7 +5,7 @@ use durable::{Db, Durability};\n use rand::Rng;\n \n use crate::{\n-    auth::config::AUTH_RETURN_COOKIE,\n+    auth::config::{self, AUTH_RETURN_COOKIE},\n     fetch::now_ms,\n     identity::{DEFAULT_ACTOR_UUID, DEFAULT_PSEUDONYM},\n     storage_dto::{SessionDataV1, SESSION_DATA_VERSION},\n@@ -37,6 +37,7 @@ pub struct VoteActor {\n }\n \n impl VoteActor {\n+    /// Test / bench helper: seed votes as the default pseudonym without a session.\n     pub fn anon() -> Self {\n         Self {\n             pseudonym: DEFAULT_PSEUDONYM.to_string(),\n@@ -70,20 +71,51 @@ fn hex_encode(bytes: &[u8]) -> String {\n     bytes.iter().map(|b| format!(\"{b:02x}\")).collect()\n }\n \n-pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> VoteActor {\n-    let Some(session_id) = session_id else {\n-        return VoteActor::anon();\n-    };\n-    let Ok(Some(session)) = load_session(db, session_id) else {\n-        return VoteActor::anon();\n-    };\n-    if session.expires_at <= now_ms() {\n-        return VoteActor::anon();\n+fn build_cookie(name: &'static str, value: String) -> Cookie<'static> {\n+    let mut builder = Cookie::build((name, value))\n+        .http_only(true)\n+        .same_site(SameSite::Lax)\n+        .path(\"/\");\n+    if config::cookies_secure() {\n+        builder = builder.secure(true);\n+    }\n+    builder.build()\n+}\n+\n+fn clear_cookie(name: &'static str) -> Cookie<'static> {\n+    let mut builder = Cookie::build((name, \"\"))\n+        .http_only(true)\n+        .same_site(SameSite::Lax)\n+        .path(\"/\")\n+        .removal();\n+    if config::cookies_secure() {\n+        builder = builder.secure(true);\n+    }\n+    builder.build()\n+}\n+\n+/// Resolve the vote actor from a live session. Fail-closed: never falls back to anon.\n+pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> Result<VoteActor, &'static str> {\n+    let session_id = session_id.ok_or(\"sign in to vote\")?;\n+    let session = load_valid_session(db, session_id).ok_or(\"session expired\")?;\n+    if !session_has_pseudonym(&session) {\n+        return Err(\"choose an alias first\");\n     }\n     let trust_weight = user_trust_weight(db, &session.uuid).unwrap_or(1.0);\n-    VoteActor {\n+    Ok(VoteActor {\n         pseudonym: session.current_pseudonym,\n         trust_weight,\n+    })\n+}\n+\n+/// Display name for the top nav, if any session is active.\n+pub fn nav_pseudonym(db: &Db, jar: &CookieJar) -> Option<String> {\n+    let session_id = session_id_from_jar(jar)?;\n+    let session = load_valid_session(db, &session_id)?;\n+    if session_has_pseudonym(&session) {\n+        Some(session.current_pseudonym)\n+    } else {\n+        None\n     }\n }\n \n@@ -151,54 +183,27 @@ pub fn destroy_session(db: &Db, session_id: &str) -> Result<(), String> {\n }\n \n pub fn session_cookie_value(session_id: &str) -> Cookie<'static> {\n-    Cookie::build((SESSION_COOKIE, session_id.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(SESSION_COOKIE, session_id.to_string())\n }\n \n pub fn clear_session_cookie() -> Cookie<'static> {\n-    Cookie::build((SESSION_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(SESSION_COOKIE)\n }\n \n pub fn oauth_state_cookie_value(state: &str) -> Cookie<'static> {\n-    Cookie::build((OAUTH_STATE_COOKIE, state.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(OAUTH_STATE_COOKIE, state.to_string())\n }\n \n pub fn clear_oauth_state_cookie() -> Cookie<'static> {\n-    Cookie::build((OAUTH_STATE_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(OAUTH_STATE_COOKIE)\n }\n \n pub fn auth_return_cookie_value(return_to: &str) -> Cookie<'static> {\n-    Cookie::build((AUTH_RETURN_COOKIE, return_to.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(AUTH_RETURN_COOKIE, return_to.to_string())\n }\n \n pub fn clear_auth_return_cookie() -> Cookie<'static> {\n-    Cookie::build((AUTH_RETURN_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(AUTH_RETURN_COOKIE)\n }\n \n pub fn auth_return_from_jar(jar: &CookieJar) -> Option<String> {\n@@ -213,28 +218,35 @@ pub fn oauth_state_from_jar(jar: &CookieJar) -> Option<String> {\n     jar.get(OAUTH_STATE_COOKIE).map(|c| c.value().to_string())\n }\n \n-pub fn actor_uuid_for_vote(db: &Db, session_id: Option<&str>) -> String {\n-    let Some(session_id) = session_id else {\n-        return DEFAULT_ACTOR_UUID.to_string();\n-    };\n-    load_session(db, session_id)\n-        .ok()\n-        .flatten()\n-        .filter(|s| s.expires_at > now_ms())\n-        .map(|s| s.uuid)\n-        .unwrap_or_else(|| DEFAULT_ACTOR_UUID.to_string())\n-}\n-\n #[cfg(test)]\n mod tests {\n     use super::*;\n \n     #[test]\n-    fn missing_session_falls_back_to_anon() {\n+    fn missing_session_is_error() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let db = Db::open(dir.path()).unwrap();\n+        assert_eq!(resolve_vote_actor(&db, None).unwrap_err(), \"sign in to vote\");\n+    }\n+\n+    #[test]\n+    fn session_without_pseudonym_is_error() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let db = Db::open(dir.path()).unwrap();\n+        let (id, _) = create_session(&db, DEFAULT_ACTOR_UUID, \"\").unwrap();\n+        assert_eq!(\n+            resolve_vote_actor(&db, Some(&id)).unwrap_err(),\n+            \"choose an alias first\"\n+        );\n+    }\n+\n+    #[test]\n+    fn session_with_pseudonym_resolves() {\n         let dir = tempfile::tempdir().unwrap();\n         let db = Db::open(dir.path()).unwrap();\n-        let actor = resolve_vote_actor(&db, None);\n-        assert_eq!(actor.pseudonym, DEFAULT_PSEUDONYM);\n+        let (id, _) = create_session(&db, DEFAULT_ACTOR_UUID, \"alice\").unwrap();\n+        let actor = resolve_vote_actor(&db, Some(&id)).unwrap();\n+        assert_eq!(actor.pseudonym, \"alice\");\n         assert_eq!(actor.trust_weight, 1.0);\n     }\n }\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex 46d18b87f1313bf0aeb29955d18f291961057509..3cc3d7bdf55b5cb5d009600f4ade1fcd201a410b 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -4,11 +4,13 @@ use axum::{\n     http::{header, StatusCode, Uri},\n     response::{IntoResponse, Response},\n };\n+use axum_extra::extract::cookie::CookieJar;\n use maud::{html, Markup, DOCTYPE};\n \n use std::collections::HashSet;\n \n use crate::{\n+    auth::nav_pseudonym,\n     fetch::html::entity_section,\n     form_template::template_json_compact,\n     path_types::ItemId,\n@@ -126,7 +128,7 @@ pub fn now_ms() -> i64 {\n     t.as_millis() as i64\n }\n \n-pub(crate) fn layout(title: &str, body: Markup, views: u64) -> Markup {\n+pub(crate) fn layout(title: &str, body: Markup, views: u64, nav_user: Option<&str>) -> Markup {\n     let ver = asset_version();\n     let css_href = format!(\"/static/sorter.css?v={ver}\");\n     let js_src = format!(\"/static/sorter_ui.js?v={ver}\");\n@@ -145,7 +147,15 @@ pub(crate) fn layout(title: &str, body: Markup, views: u64) -> Markup {\n                     span class=\"view-meta muted\" { (views) \" views\" }\n                 }\n                 nav class=\"top-nav\" {\n-                    a href=\"/login\" { \"login\" }\n+                    @if let Some(name) = nav_user {\n+                        span class=\"top-nav-user\" data-testid=\"nav-user\" { (name) }\n+                        a href=\"/login\" { \"account\" }\n+                        form class=\"top-nav-logout\" method=\"post\" action=\"/auth/logout\" data-navigate=\"full\" {\n+                            button type=\"submit\" data-testid=\"nav-logout\" { \"log out\" }\n+                        }\n+                    } @else {\n+                        a href=\"/login\" data-testid=\"nav-login\" { \"login\" }\n+                    }\n                 }\n                 div id=\"errors\" {}\n                 (body)\n@@ -481,10 +491,11 @@ pub fn input_panel(query: &str, error: Option<&str>) -> Markup {\n     }\n }\n \n-async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup {\n+async fn item_page(state: AppState, uri: Uri, item: ItemId, jar: CookieJar) -> Markup {\n     let path = uri.path().to_string();\n     state.views.increment(path.clone());\n     let views = state.views.get_views(&path);\n+    let nav_user = nav_pseudonym(state.projection_store.db(), &jar);\n \n     let tree = state\n         .scope_tree(&item)\n@@ -513,16 +524,24 @@ async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup {\n             (ranking_panel(&item, node, &tree))\n         }\n     };\n-    layout(\"sorter2\", body, views)\n+    layout(\"sorter2\", body, views, nav_user.as_deref())\n }\n \n-pub async fn home(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {\n-    item_page(state, uri, ItemId::root()).await\n+pub async fn home(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    uri: Uri,\n+) -> impl IntoResponse {\n+    item_page(state, uri, ItemId::root(), jar).await\n }\n \n-pub async fn browse(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {\n+pub async fn browse(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    uri: Uri,\n+) -> impl IntoResponse {\n     let item = ItemId::from_browse_uri(uri.path()).unwrap_or(ItemId::root());\n-    item_page(state, uri, item).await\n+    item_page(state, uri, item, jar).await\n }\n \n #[cfg(test)]\ndiff --git a/server/src/html/vote.rs b/server/src/html/vote.rs\nindex 3aa00c417c89a9cab3417c650b50ed7c73f08e20..cadbec188b17a48a63b269c0e2fa2ea8ffedd7ed 100644\n--- a/server/src/html/vote.rs\n+++ b/server/src/html/vote.rs\n@@ -4,11 +4,13 @@ use axum::{\n     extract::{Query, State},\n     response::{Html, IntoResponse},\n };\n+use axum_extra::extract::cookie::CookieJar;\n use maud::{html, Markup};\n use serde::Deserialize;\n use std::collections::HashSet;\n \n use crate::{\n+    auth::nav_pseudonym,\n     fetch::html::entity_section,\n     form_template::template_json_compact,\n     html::{ranking_panel_with_highlights, scope_theme_style, JsBuilder},\n@@ -262,6 +264,7 @@ fn suggest_next(\n \n pub async fn vote_page(\n     State(state): State<AppState>,\n+    jar: CookieJar,\n     Query(q): Query<VoteQuery>,\n ) -> impl IntoResponse {\n     let parent = parse_item_param(&q.parent);\n@@ -329,8 +332,9 @@ pub async fn vote_page(\n     let path = format!(\"/vote?parent={}\", urlencoding::encode(parent.as_str()));\n     state.views.increment(path.clone());\n     let views = state.views.get_views(&path);\n+    let nav_user = nav_pseudonym(state.projection_store.db(), &jar);\n \n-    Html(layout(&title, body, views).into_string()).into_response()\n+    Html(layout(&title, body, views, nav_user.as_deref()).into_string()).into_response()\n }\n \n #[cfg(test)]\ndiff --git a/server/static/sorter.css b/server/static/sorter.css\nindex e66a1e6c1acc473c8ff1ddb1e16e75a82d33741c..257280b6b490c65222e580a325b77351cac6cc6b 100644\n--- a/server/static/sorter.css\n+++ b/server/static/sorter.css\n@@ -34,6 +34,47 @@ body {\n   font-size: 0.75rem;\n }\n \n+.top-nav {\n+  display: flex;\n+  align-items: center;\n+  justify-content: flex-end;\n+  gap: 0.75rem;\n+  padding: 0.5rem 1rem;\n+  font-size: 0.875rem;\n+}\n+\n+.top-nav a {\n+  color: var(--muted);\n+  text-decoration: none;\n+}\n+\n+.top-nav a:hover {\n+  color: var(--fg);\n+}\n+\n+.top-nav-user {\n+  color: var(--fg);\n+  font-weight: 600;\n+}\n+\n+.top-nav-logout {\n+  display: inline;\n+  margin: 0;\n+}\n+\n+.top-nav-logout button {\n+  background: none;\n+  border: none;\n+  padding: 0;\n+  color: var(--muted);\n+  font: inherit;\n+  cursor: pointer;\n+}\n+\n+.top-nav-logout button:hover {\n+  color: var(--fg);\n+}\n+\n .btn-primary {\n   background: var(--accent);\n   color: var(--accent-fg, #0f1115);\ndiff --git a/test/support/harness.clj b/test/support/harness.clj\nindex 3f05951f418258642dcacb4a10ccccc8bfbe8748..4505ece5aa193e826ca61c52f1467d252080d66b 100644\n--- a/test/support/harness.clj\n+++ b/test/support/harness.clj\n@@ -43,6 +43,7 @@\n          \"SORTER2_VIEWS_LOG\" (str data-dir \"/views.jsonl\")\n          \"PORT\" (str app-port)\n          \"SORTER2_BASE_URL\" (str \"http://127.0.0.1:\" app-port)\n+         \"SORTER2_ALLOW_MOCK_OAUTH\" \"1\"\n          \"GITHUB_CLIENT_ID\" \"test-client\"\n          \"GITHUB_CLIENT_SECRET\" \"test-secret\"\n          \"GITHUB_OAUTH_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[c59951f5] fixed canonical item paths business\n\nSide B — unified diff (full patch):\ndiff --git a/server/src/html/breadcrumb_path.rs b/server/src/html/breadcrumb_path.rs\nindex 12ad2c84faf2fbb693015d4552e45b5c54d587b9..c8a3937923161a6ff248bd77e87eff0dc6fe9ab0 100644\n--- a/server/src/html/breadcrumb_path.rs\n+++ b/server/src/html/breadcrumb_path.rs\n@@ -1,4 +1,4 @@\n-use crate::path_types::CanonicalItemUrl;\n+use crate::path_types::{tilde_http_path_to_canonical, CanonicalItemUrl};\n \n /// Semantic view of an ontology path for rendering and routing decisions.\n pub(super) struct OntologyPath {\n@@ -11,16 +11,7 @@ impl OntologyPath {\n     /// Path is the `*path` segment from `/~/*path` (e.g. `topic/a`). Always treat it as under `~/`\n     /// so it canonicalizes to `https://slug.social/~/…`, not the non-tilde site path.\n     pub(super) fn from_input(path: &str) -> Self {\n-        let p = path.trim_start_matches('/');\n-        let raw = if p.starts_with(\"http://\") || p.starts_with(\"https://\") {\n-            p.to_string()\n-        } else if p.is_empty() {\n-            \"~/\".to_string()\n-        } else {\n-            format!(\"~/{}\", p)\n-        };\n-        let canonical = CanonicalItemUrl::parse(&raw)\n-            .unwrap_or_else(|| CanonicalItemUrl::parse(\"~/\").unwrap());\n+        let canonical = tilde_http_path_to_canonical(path);\n         Self::from_canonical(canonical)\n     }\n \n@@ -37,7 +28,7 @@ impl OntologyPath {\n     }\n \n     pub(super) fn root() -> Self {\n-        Self::from_canonical(CanonicalItemUrl::parse(\"~/\").unwrap())\n+        Self::from_canonical(CanonicalItemUrl::ontology_root())\n     }\n \n     pub(super) fn is_root(&self) -> bool {\ndiff --git a/server/src/html/garden.rs b/server/src/html/garden.rs\nindex d58d9b46f575eb6b7e4971086b07dda75ca2f645..319feb15a6b68d2b5df98b4289fedbc9bdd048d3 100644\n--- a/server/src/html/garden.rs\n+++ b/server/src/html/garden.rs\n@@ -459,6 +459,8 @@ struct ItemPageViewModel {\n     item: String,\n     body: Option<String>,\n     sibling_rank: Option<SiblingRank>,\n+    /// False at the tilde ontology root (`~/`): sibling-rank footnote does not apply.\n+    item_has_parent: bool,\n     child_rankings: ChildrenRankings,\n     rank_history: Vec<RankHistoryEntryView>,\n     /// Forum threads that mention or vote on this item.\n@@ -470,11 +472,12 @@ fn build_sibling_rank(\n     scope: &ScopeId,\n     item: &CanonicalItemUrl,\n ) -> Option<SiblingRank> {\n+    let item = item.clone().normalized_storage();\n     let content = reduced\n         .content_for_scope(scope)\n         .unwrap_or_else(|| reduced.public());\n     let group = &content.ranking_group;\n-    let parent = item.parent()?;\n+    let parent = item.parent()?.normalized_storage();\n     let siblings: Vec<CanonicalItemUrl> = content\n         .item_children\n         .get(&parent)\n@@ -492,7 +495,7 @@ fn build_sibling_rank(\n     if scoped_idxs.is_empty() {\n         return None;\n     }\n-    let current_idx = *group.item_to_idx.get(item)?;\n+    let current_idx = *group.item_to_idx.get(&item)?;\n     if !scoped_idxs.contains(&current_idx) {\n         return None;\n     }\n@@ -520,7 +523,7 @@ fn build_sibling_rank(\n         .filter_map(|li| local_to_global.get(*li).copied())\n         .collect();\n     let ranked = ranked_items_subset(group, &comp_global, 10000, 1e-8);\n-    let position = ranked.iter().position(|r| &r.item == item)? + 1;\n+    let position = ranked.iter().position(|r| r.item == item)? + 1;\n     Some(SiblingRank {\n         position,\n         component_size: ranked.len(),\n@@ -597,7 +600,9 @@ fn build_item_page_view_model(\n         .content_for_scope(scope)\n         .unwrap_or_else(|| reduced.public());\n     let item_key = CanonicalItemUrl::parse(item)\n-        .unwrap_or_else(|| CanonicalItemUrl::parse(\"~/\").unwrap());\n+        .unwrap_or_else(|| CanonicalItemUrl::parse(\"~/\").unwrap())\n+        .normalized_storage();\n+    let item_has_parent = item_key.parent().is_some();\n     let child_rankings = build_children_rankings(content, &item_key);\n \n     let rank_history = build_rank_history(reduced, scope, item_key.as_str());\n@@ -617,6 +622,7 @@ fn build_item_page_view_model(\n             .cloned()\n             .or_else(|| reduced.public().item_bodies.get(&item_key).cloned()),\n         sibling_rank: build_sibling_rank(reduced, scope, &item_key),\n+        item_has_parent,\n         child_rankings,\n         rank_history,\n         threads,\n@@ -652,7 +658,7 @@ async fn render_scope_view(\n                             (format!(\"#{} of {}\", rank.position, rank.component_size))\n                         }\n                         span class=\"muted\" { (format!(\"({} siblings)\", rank.sibling_total)) }\n-                    } @else {\n+                    } @else if model.item_has_parent {\n                         span class=\"muted\" { \"unranked among siblings\" }\n                     }\n                 }\n@@ -815,6 +821,18 @@ mod tests {\n         }));\n     }\n \n+    fn apply_ingest_room(state: &mut ReducerState, ts: i64, room_id: &str, raw: &str) {\n+        state.apply_event(Event::Ingest(Ingest {\n+            ts,\n+            id: format!(\"ing-{ts}\"),\n+            raw: raw.to_string(),\n+            principal: \"testuser\".to_string(),\n+            delegate: Some(\"00000000-0000-0000-0000-000000000000:test:local/test\".to_string()),\n+            room_id: room_id.to_string(),\n+            thread_tag: String::new(),\n+        }));\n+    }\n+\n     #[test]\n     fn item_page_model_includes_body_and_unranked_without_votes() {\n         let mut reduced = ReducerState::default();\n@@ -885,4 +903,85 @@ mod tests {\n                 || model.child_rankings.unranked_items.contains(&CanonicalItemUrl(\"https://slug.social/~/topic/kid2\".to_string()))\n         );\n     }\n+\n+    #[test]\n+    fn item_page_room_scope_root_lists_top_level_children() {\n+        let mut reduced = ReducerState::default();\n+        apply_ingest_room(\n+            &mut reduced,\n+            1,\n+            \"9ab12cd/my-room\",\n+            \"@00000000-0000-0000-0000-000000000000:test:local/test\\n~/t1 {a}\\n~/t2 {b}\\n\",\n+        );\n+        use crate::path_types::CanonicalItemUrl;\n+        let root = CanonicalItemUrl::ontology_root();\n+        let model = build_item_page_view_model(\n+            &reduced,\n+            &ScopeId::Room(\"9ab12cd/my-room\".to_string()),\n+            root.as_str(),\n+        );\n+        assert!(!model.item_has_parent);\n+        assert_eq!(model.child_rankings.unranked_items.len(), 2);\n+        let set: std::collections::HashSet<&str> = model\n+            .child_rankings\n+            .unranked_items\n+            .iter()\n+            .map(|u| u.as_str())\n+            .collect();\n+        assert!(set.contains(\"https://slug.social/~/t1\"));\n+        assert!(set.contains(\"https://slug.social/~/t2\"));\n+    }\n+\n+    /// Top-level `~/a` vs `~/b` votes form one ranked component under the ontology root.\n+    #[test]\n+    fn item_page_room_scope_root_shows_ranked_child_group() {\n+        let mut reduced = ReducerState::default();\n+        apply_ingest_room(\n+            &mut reduced,\n+            1,\n+            \"9ab12cd/my-room\",\n+            \"@00000000-0000-0000-0000-000000000000:test:local/test\\n\\\n+             ~/a {a}\\n~/b {b}\\n~/a 2:1 ~/b {because}\\n\",\n+        );\n+        use crate::path_types::CanonicalItemUrl;\n+        let root = CanonicalItemUrl::ontology_root();\n+        let model = build_item_page_view_model(\n+            &reduced,\n+            &ScopeId::Room(\"9ab12cd/my-room\".to_string()),\n+            root.as_str(),\n+        );\n+        assert_eq!(model.child_rankings.component_rankings.len(), 1);\n+        assert_eq!(model.child_rankings.component_rankings[0].pairs, 1);\n+        let names: Vec<&str> = model.child_rankings.component_rankings[0]\n+            .ranked\n+            .iter()\n+            .map(|r| r.item.as_str())\n+            .collect();\n+        assert_eq!(\n+            names,\n+            vec![\"https://slug.social/~/a\", \"https://slug.social/~/b\"]\n+        );\n+        assert!(model.child_rankings.unranked_items.is_empty());\n+    }\n+\n+    /// Legacy `https://slug.social/~/` spelling still resolves children under the real root key.\n+    #[test]\n+    fn item_page_model_normalizes_legacy_tilde_root_storage_url() {\n+        let mut reduced = ReducerState::default();\n+        apply_ingest(\n+            &mut reduced,\n+            1,\n+            \"@00000000-0000-0000-0000-000000000000:test:local/test\\n~/x {x}\\n\",\n+        );\n+        let model = build_item_page_view_model(\n+            &reduced,\n+            &ScopeId::Public,\n+            \"https://slug.social/~/\",\n+        );\n+        assert_eq!(model.child_rankings.unranked_items.len(), 1);\n+        assert_eq!(\n+            model.child_rankings.unranked_items[0].as_str(),\n+            \"https://slug.social/~/x\"\n+        );\n+    }\n }\ndiff --git a/server/src/path_types.rs b/server/src/path_types.rs\nindex 4c8075bbd488f1b9a5eda9e03ced83f6238c6d5e..361a9d446c9043cbdea5f060db2e8633c2fd9bf9 100644\n--- a/server/src/path_types.rs\n+++ b/server/src/path_types.rs\n@@ -1,3 +1,5 @@\n //! Re-exports — implementations live in `slug-types` (`paths` module).\n \n-pub use slug_types::paths::{CanonicalItemUrl, RelativePath, TildePath};\n+pub use slug_types::paths::{\n+    tilde_http_path_to_canonical, CanonicalItemUrl, RelativePath, TildeHttpPathTail, TildePath,\n+};\ndiff --git a/server/src/scope_rank.rs b/server/src/scope_rank.rs\nindex dc640848232b7e79142bfeeea3003c9023f84854..d656b2f0a0a3623ca6b234b746beaaca8ae6017d 100644\n--- a/server/src/scope_rank.rs\n+++ b/server/src/scope_rank.rs\n@@ -149,9 +149,10 @@ pub fn build_rankings_for_item_set(content: &ContentState, items_in_scope: &[Can\n /// Build connected-component rankings for direct children of parent_scope.\n /// Matches the HTML garden view: multiple components, isolates, no-vote items.\n pub fn build_children_rankings(content: &ContentState, parent: &CanonicalItemUrl) -> ChildrenRankings {\n+    let parent = parent.clone().normalized_storage();\n     let items: Vec<CanonicalItemUrl> = content\n         .item_children\n-        .get(parent)\n+        .get(&parent)\n         .map(|s| s.iter().cloned().collect())\n         .unwrap_or_default();\n     build_rankings_for_item_set(content, &items)\ndiff --git a/server/tests/integration.rs b/server/tests/integration.rs\nindex f9c218378f6a173e56ae1cec797b3c492986eac0..d4c5bfe9c6f1c71dc61878bd8c5e729b1b7c69ef 100644\n--- a/server/tests/integration.rs\n+++ b/server/tests/integration.rs\n@@ -704,6 +704,62 @@ async fn test_private_room_post_links_use_private_garden_routes() {\n     assert!(garden_body.contains(&format!(\"/r/{room_short}/{room_slug}/t/garden-thread\")));\n }\n \n+#[tokio::test]\n+async fn test_private_room_garden_root_lists_top_level_tilde_children() {\n+    let (addr, _tmp, _log, _handle) = create_test_server().await;\n+    let client = reqwest::Client::builder()\n+        .redirect(reqwest::redirect::Policy::none())\n+        .build()\n+        .unwrap();\n+    let bearer = test_bearer();\n+\n+    let create = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&bearer),\n+        serde_json::json!([{\n+            \"RoomCreate\": { \"slug\": \"garden-root-list\" }\n+        }]),\n+    )\n+    .await;\n+    let room_id = create[\"results\"][0][\"result\"][\"RoomCreated\"][\"room_id\"]\n+        .as_str()\n+        .unwrap()\n+        .to_string();\n+    let (room_short, room_slug) = room_id.split_once('/').unwrap();\n+\n+    let rpc = ui_post_ingest_rpc(\n+        &room_id,\n+        \"ing\",\n+        \"~/test1 {wow}\\n~/test2 {wow2}\\n~/test1 2:1 ~/test2 {because}\\n\",\n+    );\n+    let post = client\n+        .post(format!(\"http://{addr}/ui\"))\n+        .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n+        .form(&[(\"__rpc__\", rpc.as_str())])\n+        .send()\n+        .await\n+        .unwrap();\n+    assert_eq!(post.status(), reqwest::StatusCode::OK);\n+\n+    let root_page = client\n+        .get(format!(\"http://{addr}/r/{room_short}/{room_slug}/~\"))\n+        .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n+        .send()\n+        .await\n+        .unwrap();\n+    assert!(root_page.status().is_success());\n+    let body = root_page.text().await.unwrap();\n+    assert!(\n+        body.contains(\"ranked child groups\"),\n+        \"expected garden child panel: {}\",\n+        body.len()\n+    );\n+    assert!(body.contains(\"~/test1\"));\n+    assert!(body.contains(\"~/test2\"));\n+    assert!(body.contains(\"ordering 1\"));\n+}\n+\n #[tokio::test]\n async fn test_post_check_returns_targeted_js_error_for_missing_thread_tag() {\n     let (addr, _tmp, _log, _handle) = create_test_server().await;\ndiff --git a/test/browser_public_garden.clj b/test/browser_public_garden.clj\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..7bea08e1cf2c8f5b1a94b0640a46e9ba5607b19b\n--- /dev/null\n+++ b/test/browser_public_garden.clj\n@@ -0,0 +1,100 @@\n+(ns test.browser-public-garden\n+  \"Regression: ingest ontology items in the public room via RPC, then open /~ in the browser\n+   and assert ranked + unranked paths appear (HTML garden index — not JSON API).\"\n+  (:require [babashka.fs :as fs]\n+            [cheshire.core :as json]\n+            [clojure.string :as str]\n+            [clojure.test :refer [deftest is]]\n+            [com.blockether.spel.core :as core]\n+            [com.blockether.spel.locator :as locator]\n+            [com.blockether.spel.page :as page]\n+            [test.common :as common]\n+            [test.oauth :as oauth]))\n+\n+(defn- wait-for-text [pg selector expected timeout-ms]\n+  (let [deadline (+ (System/currentTimeMillis) timeout-ms)]\n+    (loop []\n+      (let [text (locator/text-content (page/locator pg selector))]\n+        (if (and (string? text) (str/includes? text expected))\n+          true\n+          (if (< (System/currentTimeMillis) deadline)\n+            (do (Thread/sleep 200) (recur))\n+            false))))))\n+\n+(defn public-garden-flow! []\n+  (println \"\\n━━━ browser public room garden index (RPC seed + GET /~) ━━━\\n\")\n+\n+  (common/letlocals\n+   (bind build (common/run-cargo-build-release! [\"slugsocial-server\"]))\n+   (is (zero? (:exit build)) \"cargo build succeeds\")\n+   (bind server-bin \"target/release/slugsocial-server\")\n+\n+   (bind tmp-dir (str (fs/create-temp-dir {:prefix \"slug-browser-pub-garden-\"})))\n+   (bind slug-port (common/pick-port))\n+   (bind google-port (common/pick-port))\n+   (bind base-url (str \"http://127.0.0.1:\" slug-port))\n+   (bind google-url (str \"http://127.0.0.1:\" google-port))\n+\n+   (bind !server (atom nil))\n+   (bind !google (atom nil))\n+   (bind server-env (common/slug-server-env tmp-dir base-url google-url slug-port))\n+   (try\n+     (reset! !google (oauth/start-mock-google google-port\n+                                              :google-users [\"google-user-alice\"]))\n+     (reset! !server (common/start-server server-bin server-env))\n+     (is (common/wait-for-server base-url 10000) \"server responds to /healthz\")\n+\n+     (let [alice-token (oauth/fetch-bearer-token! base-url :username \"alice\")\n+           thread-tag \"browser-pub-garden\"\n+           ;; Ranked pair at root + one isolate so both panels are exercised.\n+           raw (str \"# \" thread-tag \"\\n\\n\"\n+                    \"~/br-pub-a {alpha}\\n\"\n+                    \"~/br-pub-b {beta}\\n\"\n+                    \"~/br-pub-c {gamma}\\n\"\n+                    \"~/br-pub-a 2:1 ~/br-pub-b {browser regression vote}\\n\")\n+           post-resp (oauth/http-post-json\n+                      (str base-url \"/api/v0/rpc\")\n+                      [{\"Post\" {\"room\" \"public\"\n+                                \"thread_tag\" thread-tag\n+                                \"text\" raw\n+                                \"return_rank_diff\" false}}]\n+                      :headers {\"Authorization\" (str \"Bearer \" alice-token)})\n+           post-json (json/parse-string (:body post-resp) false)\n+           _ (is (true? (get-in post-json [\"results\" 0 \"ok\"])) \"seed public post via rpc\")\n+           rank-resp (oauth/http-post-json\n+                      (str base-url \"/api/v0/rpc\")\n+                      [{\"GetGardenRank\" {\"room\" \"public\"\n+                                         \"parent_path\" \"~\"\n+                                         \"depth\" 1}}])\n+           rank-json (json/parse-string (:body rank-resp) false)\n+           _ (is (true? (get-in rank-json [\"results\" 0 \"ok\"])) \"GetGardenRank ok\")\n+           comps (get-in rank-json [\"results\" 0 \"result\" \"GardenRank\" \"components\"])\n+           _ (is (pos? (count comps)) \"rank API reports at least one component\")]\n+       (core/with-playwright [pw]\n+         (core/with-browser [browser (core/launch-chromium pw {:headless true :channel \"chrome\"})]\n+           (core/with-context [ctx (core/new-context browser)]\n+             (core/with-page [pg (core/new-page-from-context ctx)]\n+               (page/navigate pg (str base-url \"/login\"))\n+               (is (wait-for-text pg \"body\" \"@alice\" 15000) \"alice session after login\")\n+               (page/navigate pg (str base-url \"/~\"))\n+               (is (wait-for-text pg \"body\" \"paths\" 15000) \"public garden index shows paths heading\")\n+               (is (wait-for-text pg \"body\" \"ordering\" 10000)\n+                   \"ranked child group meta visible\")\n+               (is (wait-for-text pg \"body\" \"~/br-pub-a\" 10000) \"ranked list shows ~/br-pub-a\")\n+               (is (wait-for-text pg \"body\" \"~/br-pub-b\" 10000) \"ranked list shows ~/br-pub-b\")\n+               (is (wait-for-text pg \"body\" \"unranked\" 10000) \"unranked section present\")\n+               (is (wait-for-text pg \"body\" \"~/br-pub-c\" 10000)\n+                   \"unranked list shows ~/br-pub-c\"))))))\n+\n+     (finally\n+       (when-some [s @!server] (common/kill-server s))\n+       (when-some [g @!google] ((:stop-fn g)))\n+       (fs/delete-tree tmp-dir)))\n+\n+   nil))\n+\n+(defn public-garden-browser-test [& _args]\n+  (public-garden-flow!))\n+\n+(deftest browser-public-garden-index-check\n+  (public-garden-flow!))\ndiff --git a/tests.edn b/tests.edn\nindex 56fdfa4f29383ad305fd8068783e4efe2ed334a0..6e96432ba766461b4233c75dc48db2633483e5e0 100644\n--- a/tests.edn\n+++ b/tests.edn\n@@ -16,7 +16,8 @@\n    :ns-patterns [\"^test\\\\.browser-sse$\"\n                  \"^test\\\\.browser-ui-morph$\"\n                  \"^test\\\\.browser-post-redact$\"\n-                 \"^test\\\\.browser-room-delete$\"]\n+                 \"^test\\\\.browser-room-delete$\"\n+                 \"^test\\\\.browser-public-garden$\"]\n    :kaocha.filter/skip-meta [:skip]\n    :parallel? false}]\n  :plugins [:kaocha.plugin/junit-xml]\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex 8cea90238ef6207d65ecdb2903b8958fafb213d2..edbb923e4d7d41ad82dfc254c3bd697562383527 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -4,8 +4,9 @@ pub mod paths;\n pub mod timeago;\n \n pub use paths::{\n-    canonicalize_item, canonicalize_tag, item_parent_path, item_path_segments, CanonicalItemUrl,\n-    ForumThreadUrl, GardenItemUrl, RelativePath, TildeOntologyPath, TildePath,\n+    canonicalize_item, canonicalize_tag, item_parent_path, item_path_segments, normalize_slug_ontology_storage_url,\n+    CanonicalItemUrl, ForumThreadUrl, GardenItemUrl, RelativePath, SLUG_TILDE_ONTOLOGY_ROOT,\n+    TildeHttpPathTail, TildeOntologyPath, TildePath, tilde_http_path_to_canonical,\n };\n \n /// Max characters returned for a garden item body unless `full=true` / `--full` (API + CLI).\ndiff --git a/types/src/paths.rs b/types/src/paths.rs\nindex 668323ed777f360f2838a0dfe6eae68905d1183b..8971f599a7ebcf399f60c306d35ee28d0f581194 100644\n--- a/types/src/paths.rs\n+++ b/types/src/paths.rs\n@@ -1,5 +1,13 @@\n //! Canonical paths, storage ids, and JSON href newtypes. All normalization and\n //! room-aware URL rules for items live here.\n+//!\n+//! ## String kinds (parse in this module only)\n+//!\n+//! - **[`canonicalize_item`] / [`CanonicalItemUrl`]** — graph storage key and DSL form; tilde\n+//!   ontology root is always [`SLUG_TILDE_ONTOLOGY_ROOT`] (no `…/~/` trailing slash only).\n+//! - **[`TildeHttpPathTail`]** — capture from `GET /~/*path` or `…/r/…/~/…` (the `*path` segment).\n+//! - **`-/…` wire form** — external items; see [`canonicalize_item`] dash branch.\n+//! - **[`GardenItemUrl`], [`ForumThreadUrl`]** — JSON / browser href surfaces.\n \n use std::borrow::Borrow;\n use std::fmt;\n@@ -7,6 +15,23 @@ use std::ops::Deref;\n \n use serde::{Deserialize, Serialize};\n \n+// ---------------------------------------------------------------------------\n+// Slug tilde ontology (single storage form for `~/`)\n+// ---------------------------------------------------------------------------\n+\n+/// Canonical absolute URL for the tilde ontology **root** (`~/` in UI). Used as the\n+/// `item_children` parent key for top-level items and must match [`CanonicalItemUrl::ontology_root`].\n+pub const SLUG_TILDE_ONTOLOGY_ROOT: &str = \"https://slug.social/~\";\n+\n+/// Collapse legacy or parser variants of the ontology root to [`SLUG_TILDE_ONTOLOGY_ROOT`].\n+pub fn normalize_slug_ontology_storage_url(s: &str) -> String {\n+    if s == \"https://slug.social/~/\" {\n+        SLUG_TILDE_ONTOLOGY_ROOT.to_string()\n+    } else {\n+        s.to_string()\n+    }\n+}\n+\n // ---------------------------------------------------------------------------\n // Normalization (moved from server `canonical_path`)\n // ---------------------------------------------------------------------------\n@@ -89,6 +114,9 @@ pub fn canonicalize_item(input: &str) -> String {\n         .join(\"/\");\n \n     if is_tilde {\n+        if tail.is_empty() {\n+            return SLUG_TILDE_ONTOLOGY_ROOT.to_string();\n+        }\n         format!(\"https://slug.social/~/{}\", tail)\n     } else if tail.is_empty() {\n         \"https://slug.social\".to_string()\n@@ -173,7 +201,7 @@ impl CanonicalItemUrl {\n         if c.is_empty() {\n             None\n         } else {\n-            Some(Self(c))\n+            Some(Self(normalize_slug_ontology_storage_url(&c)))\n         }\n     }\n \n@@ -181,8 +209,19 @@ impl CanonicalItemUrl {\n         &self.0\n     }\n \n+    /// Collapses legacy slug ontology root spellings so [`HashMap`] keys match the reducer graph.\n+    pub fn normalized_storage(self) -> Self {\n+        Self(normalize_slug_ontology_storage_url(self.as_str()))\n+    }\n+\n     pub fn tilde_tail(&self) -> Option<&str> {\n-        self.0.strip_prefix(\"https://slug.social/~/\")\n+        if let Some(tail) = self.0.strip_prefix(\"https://slug.social/~/\") {\n+            return Some(tail);\n+        }\n+        if self.0 == SLUG_TILDE_ONTOLOGY_ROOT || self.0 == \"https://slug.social/~/\" {\n+            return Some(\"\");\n+        }\n+        None\n     }\n \n     pub fn last_segment(&self) -> &str {\n@@ -193,7 +232,7 @@ impl CanonicalItemUrl {\n     }\n \n     pub fn ontology_root() -> Self {\n-        Self(\"https://slug.social/~\".to_string())\n+        Self(SLUG_TILDE_ONTOLOGY_ROOT.to_string())\n     }\n \n     pub fn parent(&self) -> Option<Self> {\n@@ -234,9 +273,13 @@ impl CanonicalItemUrl {\n \n     /// `-/` representation for external `https://…` items, `~/…` for slug ontology, else unchanged.\n     pub fn display_path(&self) -> String {\n-        if let Some(tail) = self.0.strip_prefix(\"https://slug.social/~/\") {\n-            format!(\"~/{}\", tail)\n-        } else if let Some(tail) = self.0.strip_prefix(\"https://\") {\n+        if let Some(tail) = self.tilde_tail() {\n+            if tail.is_empty() {\n+                return \"~/\".to_string();\n+            }\n+            return format!(\"~/{}\", tail);\n+        }\n+        if let Some(tail) = self.0.strip_prefix(\"https://\") {\n             if tail.starts_with(\"slug.social\") {\n                 self.0.clone()\n             } else {\n@@ -276,6 +319,37 @@ impl CanonicalItemUrl {\n     }\n }\n \n+/// HTTP route capture: path segment after `~/` in `GET /~/*path` or `…/r/…/~/…` (empty = ontology root).\n+#[derive(Debug, Clone, PartialEq, Eq, Hash)]\n+pub struct TildeHttpPathTail(pub String);\n+\n+impl TildeHttpPathTail {\n+    pub fn new(path_segment: &str) -> Self {\n+        Self(path_segment.trim_start_matches('/').to_string())\n+    }\n+\n+    pub fn as_str(&self) -> &str {\n+        &self.0\n+    }\n+\n+    pub fn to_canonical(&self) -> CanonicalItemUrl {\n+        tilde_http_path_to_canonical(self.as_str())\n+    }\n+}\n+\n+/// Map the router's tilde tail (e.g. `topic/a`, or empty for root) to a [`CanonicalItemUrl`].\n+pub fn tilde_http_path_to_canonical(path_segment: &str) -> CanonicalItemUrl {\n+    let p = path_segment.trim_start_matches('/');\n+    let raw = if p.starts_with(\"http://\") || p.starts_with(\"https://\") {\n+        p.to_string()\n+    } else if p.is_empty() {\n+        \"~/\".to_string()\n+    } else {\n+        format!(\"~/{}\", p)\n+    };\n+    CanonicalItemUrl::parse(&raw).unwrap_or_else(|| CanonicalItemUrl::ontology_root())\n+}\n+\n impl fmt::Display for CanonicalItemUrl {\n     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {\n         self.0.fmt(f)\n@@ -557,6 +631,44 @@ mod tests {\n     fn canonical_parent_root_is_none() {\n         let root = CanonicalItemUrl::parse(\"~/\").unwrap();\n         assert!(root.parent().is_none());\n+        assert_eq!(root.as_str(), SLUG_TILDE_ONTOLOGY_ROOT);\n+        assert_eq!(root, CanonicalItemUrl::ontology_root());\n+    }\n+\n+    #[test]\n+    fn tilde_ontology_root_unifies_forms() {\n+        assert_eq!(canonicalize_item(\"~/\"), SLUG_TILDE_ONTOLOGY_ROOT);\n+        assert_eq!(\n+            normalize_slug_ontology_storage_url(\"https://slug.social/~/\"),\n+            SLUG_TILDE_ONTOLOGY_ROOT.to_string()\n+        );\n+        assert_eq!(\n+            CanonicalItemUrl::parse(\"https://slug.social/~/\")\n+                .unwrap()\n+                .as_str(),\n+            SLUG_TILDE_ONTOLOGY_ROOT\n+        );\n+        let legacy = CanonicalItemUrl(\"https://slug.social/~/\".to_string());\n+        assert_eq!(legacy.normalized_storage().as_str(), SLUG_TILDE_ONTOLOGY_ROOT);\n+    }\n+\n+    #[test]\n+    fn tilde_http_path_tail_maps_router_segment() {\n+        assert_eq!(\n+            TildeHttpPathTail::new(\"\").to_canonical(),\n+            CanonicalItemUrl::ontology_root()\n+        );\n+        assert_eq!(\n+            tilde_http_path_to_canonical(\"topic/x\").as_str(),\n+            \"https://slug.social/~/topic/x\"\n+        );\n+    }\n+\n+    #[test]\n+    fn display_path_slug_ontology_root() {\n+        let r = CanonicalItemUrl::ontology_root();\n+        assert_eq!(r.display_path(), \"~/\");\n+        assert_eq!(r.tilde_tail(), Some(\"\"));\n     }\n \n     #[test]\n","role":"user"}],"model":"openai/gpt-chat-latest"}