{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[7caef802] room ui wired up again\n\nSide A — unified diff (full patch):\ndiff --git a/Cargo.lock b/Cargo.lock\nindex e31485f28717993a13e1c4caf7be15b43a97573e..8be6ff8677700ce0a56d4a53b221e25c2bb70507 100644\n--- a/Cargo.lock\n+++ b/Cargo.lock\n@@ -158,6 +158,7 @@ dependencies = [\n  \"axum\",\n  \"axum-core\",\n  \"bytes\",\n+ \"cookie\",\n  \"fastrand\",\n  \"futures-util\",\n  \"http\",\n@@ -300,6 +301,17 @@ version = \"1.0.4\"\n source = \"registry+https://github.com/rust-lang/crates.io-index\"\n checksum = \"b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75\"\n \n+[[package]]\n+name = \"cookie\"\n+version = \"0.18.1\"\n+source = \"registry+https://github.com/rust-lang/crates.io-index\"\n+checksum = \"4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747\"\n+dependencies = [\n+ \"percent-encoding\",\n+ \"time\",\n+ \"version_check\",\n+]\n+\n [[package]]\n name = \"core-foundation\"\n version = \"0.9.4\"\ndiff --git a/plan2.md b/plan2.md\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..1587cbe558eb0a98fbce78566bf5f93b18100e54\n--- /dev/null\n+++ b/plan2.md\n@@ -0,0 +1,190 @@\n+This is a phenomenal synthesis. You stripped away the exact parts of `evaleval` that don't scale to a multi-tenant web application (string-splicing `eval` and in-memory nonce OCAP tracking) and kept the parts that make development lightning fast (embedded declarative payloads, single endpoint routing, and Javascript AST responses). \n+\n+You are entirely right about the **AST substitution in Rust**. Walking a `serde_json::Value` tree to find `{\"$form\": \"field_name\"}` and swapping the node for a String isn't a hack—in Rust, it’s just a completely standard recursive enum visitor. \n+\n+Let’s lock in this exact architecture. It is cohesive, secure, and incredibly ergonomic.\n+\n+Here is what the code actually looks like to execute this vision.\n+\n+---\n+\n+### 1. The Safe AST Substitution\n+\n+This is the exact function that runs in the Web handler before giving the payload to the RPC engine. Because it operates on the JSON AST *before* deserialization, it's 100% immune to injection.\n+\n+```rust\n+use serde_json::Value;\n+use std::collections::HashMap;\n+\n+/// Recursively walk the JSON AST and replace {\"$form\": \"key\"} with the actual form string.\n+fn substitute_form_vars(val: &mut Value, form_data: &HashMap<String, String>) {\n+    match val {\n+        Value::Object(map) => {\n+            // Is this the magic placeholder node? {\"$form\": \"input_name\"}\n+            if map.len() == 1 && map.contains_key(\"$form\") {\n+                if let Some(field_name) = map.get(\"$form\").and_then(|v| v.as_str()) {\n+                    let submitted_text = form_data.get(field_name).map(|s| s.as_str()).unwrap_or(\"\");\n+                    *val = Value::String(submitted_text.to_string());\n+                    return;\n+                }\n+            }\n+            // Otherwise, keep walking the object\n+            for v in map.values_mut() {\n+                substitute_form_vars(v, form_data);\n+            }\n+        }\n+        Value::Array(arr) => {\n+            // Walk arrays\n+            for v in arr.iter_mut() {\n+                substitute_form_vars(v, form_data);\n+            }\n+        }\n+        _ => {} // Primitives stay as is\n+    }\n+}\n+```\n+**Why this rules:** You can write a single, hidden HTML input: \n+`<input type=\"hidden\" name=\"__rpc__\" value=\"base64({\"Ingest\": {\"space\": \"a7f2k\", \"text\": {\"$form\": \"body_input\"}}})\">`\n+When the form submits, the backend safely turns it into standard RPC input.\n+\n+---\n+\n+### 2. The Unified Core RPC Layer\n+\n+You keep exactly one execution layer that strictly enforces your domain constraints (ACLs). Whether the command originated from a CLI script or a web form, they all hit this choke point:\n+\n+```rust\n+// Core execute function, decoupled from HTTP\n+pub async fn execute_rpc(\n+    state: &ReducerState, \n+    principal: &Principal, \n+    command: RpcCommand\n+) -> Result<RpcResponse, ApiError> {\n+    match command {\n+        RpcCommand::Ingest { space, text } => {\n+            // ACLs are checked RIGHT HERE, universally.\n+            if !state.user_has_cap(&space, principal, ThreadCapability::Post) {\n+                return Err(ApiError::Forbidden(\"No post access in this space\".to_string()));\n+            }\n+            // Do the write, apply events...\n+            Ok(RpcResponse::IngestOk { ... })\n+        }\n+        // ...\n+    }\n+}\n+```\n+\n+---\n+\n+### 3. The `DomPatch` Builder Pattern\n+\n+You prefer the Builder pattern over a macro for the response mapping. I agree—builders are far easier for your IDE to autocomplete, and easier to compose dynamically (e.g., iterating over a list of items to append).\n+\n+```rust\n+pub struct DomPatch {\n+    js: String,\n+}\n+\n+impl DomPatch {\n+    pub fn new() -> Self {\n+        Self { js: String::new() }\n+    }\n+\n+    /// Morphs an element using Idiomorph\n+    pub fn morph(mut self, selector: &str, html: &str) -> Self {\n+        let safe_html = serde_json::to_string(html).expect(\"string escaping failed\");\n+        self.js.push_str(&format!(\n+            \"Idiomorph.morph(document.querySelector('{}'), {}, {{morphStyle: 'innerHTML'}});\\n\", \n+            selector, safe_html\n+        ));\n+        self\n+    }\n+\n+    /// Appends raw HTML to an element\n+    pub fn append(mut self, selector: &str, html: &str) -> Self {\n+        let safe_html = serde_json::to_string(html).unwrap();\n+        self.js.push_str(&format!(\n+            \"document.querySelector('{}')?.insertAdjacentHTML('beforeend', {});\\n\", \n+            selector, safe_html\n+        ));\n+        self\n+    }\n+\n+    /// Executes raw javascript\n+    pub fn eval(mut self, code: &str) -> Self {\n+        self.js.push_str(code);\n+        self.js.push('\\n');\n+        self\n+    }\n+\n+    /// Consumes the builder into an HTTP Response with the right content-type\n+    pub fn into_response(self) -> impl axum::response::IntoResponse {\n+        (\n+            axum::http::StatusCode::OK, \n+            [(axum::http::header::CONTENT_TYPE, \"text/javascript\")], \n+            self.js\n+        )\n+    }\n+}\n+```\n+\n+---\n+\n+### 4. The Single Web Handler (`POST /ui/action`)\n+\n+With the pipeline defined, you only ever have to write **one** `POST` handler for the entire Web UI.\n+\n+```rust\n+pub async fn handle_web_action(\n+    State(state): State<AppState>,\n+    headers: HeaderMap,\n+    Form(form_data): Form<HashMap<String, String>>, // Captures everything dynamically\n+) -> impl IntoResponse {\n+    // 1. Authenticate using Bearer / Cookie exactly like the CLI\n+    let principal = match extract_web_session(&headers, &state) {\n+        Ok(p) => p,\n+        Err(_) => return DomPatch::new().eval(\"window.location = '/auth/login';\").into_response(),\n+    };\n+\n+    // 2. Decode the Base64 JSON\n+    let b64 = form_data.get(\"__rpc__\").expect(\"Missing RPC payload in form\");\n+    let decoded = base64::decode(b64).expect(\"Bad b64\");\n+    let mut json_ast: Value = serde_json::from_slice(&decoded).expect(\"Bad JSON\");\n+\n+    // 3. Do AST Substitution!\n+    substitute_form_vars(&mut json_ast, &form_data);\n+\n+    // 4. Parse it strongly into the RPC enum\n+    let command: RpcCommand = serde_json::from_value(json_ast).expect(\"Invalid RpcCommand\");\n+\n+    // 5. Pass it to the core execute function (authz + mutation happens here)\n+    match execute_rpc(&state.reduced.read().await, &principal, command).await {\n+        Ok(RpcResponse::IngestOk { new_ranks }) => {\n+            // Translate the RpcResponse to UI JS snippets\n+            DomPatch::new()\n+                .morph(\"#rank-container\", &render_ranking(&new_ranks))\n+                .eval(\"document.getElementById('ingest-form').reset();\")\n+                .into_response()\n+        }\n+        Ok(_) => DomPatch::new().eval(\"console.log('Action complete');\").into_response(),\n+        Err(e) => {\n+            // Reconcile errors\n+            DomPatch::new()\n+                .morph(\"#error-banner\", &format!(\"<div class='error'>{}</div>\", e.message()))\n+                .into_response()\n+        }\n+    }\n+}\n+```\n+\n+### The Verdict on the Grand Architecture\n+\n+By combining:\n+1. The **Domain-Driven Asymmetry** (Spaces contain Gardens & Threads)\n+2. The **Core RPC Logic** (1 executor, `Vec<RpcCommand>`, strict ACL checks)\n+3. The **Single Web Form Controller** (b64 embedded, `substitute_form_vars()`)\n+4. The **Javascript DomPatch Builder**\n+\n+You have constructed an application architecture that gives you absolute security and data integrity for your CLI AI Agents, while keeping the absolute peak hackability, form simplicity, and lightning-fast JS UI diffing of your `evaleval` Python framework. \n+\n+I'm sold. It is clean, it is uniquely fitted to the mechanics of Rust (`serde`, `enums`), and it solves the URL routing fatigue problem beautifully. This is the exact way to build `slug.social` v2.\n\\ No newline at end of file\ndiff --git a/server/Cargo.toml b/server/Cargo.toml\nindex d527f86532c2856e29f9c6265e54c7235fdf0a8c..18c45777d662b71dc309e1daa4ddb2944da9759d 100644\n--- a/server/Cargo.toml\n+++ b/server/Cargo.toml\n@@ -6,7 +6,7 @@ license = \"MIT\"\n \n [dependencies]\n axum = { version = \"0.7\", features = [\"macros\"] }\n-axum-extra = { version = \"0.9\", features = [\"query\"] }\n+axum-extra = { version = \"0.9\", features = [\"query\", \"cookie\"] }\n bytes = \"1.11.1\"  # pin: RUSTSEC-2026-0007\n tokio = { version = \"1\", features = [\"rt-multi-thread\", \"macros\", \"signal\", \"fs\", \"io-util\"] }\n tokio-stream = { version = \"0.1\", features = [\"sync\"] }\ndiff --git a/server/src/api/auth.rs b/server/src/api/auth.rs\nindex b45ba39419c84af8bf2333fc9b7d47e98525c45f..2524a3ffcb5ea9ef6259cb9bb0bf12119bd840d2 100644\n--- a/server/src/api/auth.rs\n+++ b/server/src/api/auth.rs\n@@ -1,9 +1,11 @@\n use axum::{\n+    body::Body,\n     extract::{Path, Query, State},\n-    http::{HeaderMap, StatusCode},\n-    response::{IntoResponse, Redirect},\n+    http::{header, HeaderMap, HeaderValue, StatusCode},\n+    response::{IntoResponse, Redirect, Response},\n     Form, Json,\n };\n+use axum_extra::extract::cookie::CookieJar;\n use base64::Engine;\n use serde::Deserialize;\n use slug_types::{PendingSessionPollResponse, PendingSessionStartRequest, PendingSessionStartResponse, WhoamiResponse};\n@@ -13,14 +15,47 @@ use tokio::sync::RwLock;\n use crate::{\n     api::helpers::{api_error, now_ms, sha256_hex},\n     events::{Event, GrantAdded, TokenIssued, UserRegistered},\n-    identity::{parse_agent, parse_username},\n     html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},\n+    identity::{parse_agent, parse_username},\n+    reducer::ReducerState,\n     state::{AppState, PendingSession},\n };\n \n /// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).\n const INVITE_BROWSER_AGENT: &str = \"00000000-0000-0000-0000-000000000000:invite:web/join\";\n \n+/// Agent id for `/login` browser OAuth (no CLI); must pass [`parse_agent`].\n+const WEB_BROWSER_AGENT: &str = \"00000000-0000-0000-0000-000000000001:social:web/browser\";\n+\n+/// HttpOnly cookie storing the same `slug_*` bearer string the CLI uses.\n+pub const SLUG_SESSION_COOKIE: &str = \"slug_session\";\n+\n+/// `Set-Cookie` header value (full attribute string).\n+pub fn session_cookie_header_value(bearer: &str) -> HeaderValue {\n+    let s = format!(\n+        \"{SLUG_SESSION_COOKIE}={bearer}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000\"\n+    );\n+    HeaderValue::from_str(&s).expect(\"session cookie value must be ASCII\")\n+}\n+\n+/// Resolve the signed-in username from `Authorization: Bearer` or `slug_session` cookie.\n+pub fn optional_principal(headers: &HeaderMap, jar: &CookieJar, reduced: &ReducerState) -> Option<String> {\n+    if let Ok(u) = verify_bearer_principal(headers, reduced) {\n+        return Some(u);\n+    }\n+    let c = jar.get(SLUG_SESSION_COOKIE)?;\n+    verify_token(reduced, c.value()).ok()\n+}\n+\n+fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str) -> Response {\n+    Response::builder()\n+        .status(StatusCode::TEMPORARY_REDIRECT)\n+        .header(header::LOCATION, format!(\"{public_url}{path_and_query}\"))\n+        .header(header::SET_COOKIE, session_cookie_header_value(bearer))\n+        .body(Body::empty())\n+        .unwrap()\n+}\n+\n async fn apply_invite_redemption(state: &AppState, invite_token: &str, grantee_username: &str) -> Result<(), String> {\n     let now = now_ms();\n     let ga = {\n@@ -306,8 +341,9 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):\n                     tracing::warn!(error = %e, \"invite redemption skipped after oauth\");\n                 }\n             }\n+            let cookie_bearer = bearer.clone();\n             s.complete = Some((username, bearer));\n-            return Redirect::temporary(&format!(\"{public_url}/auth/complete\")).into_response();\n+            return redirect_with_session_cookie(&public_url, \"/\", &cookie_bearer).into_response();\n         }\n     }\n \n@@ -418,7 +454,47 @@ pub async fn post_choose_username(\n         s.complete = Some((canon_user.clone(), bearer.clone()));\n     }\n \n-    auth_signed_in_fragment().into_response()\n+    Response::builder()\n+        .status(StatusCode::OK)\n+        .header(header::CONTENT_TYPE, \"text/html; charset=utf-8\")\n+        .header(header::SET_COOKIE, session_cookie_header_value(&bearer))\n+        .body(Body::from(auth_signed_in_fragment().into_string()))\n+        .unwrap()\n+        .into_response()\n+}\n+\n+/// Start a browser-only OAuth flow (no CLI polling). Sets session cookie on success.\n+pub async fn get_web_login(State(state): State<AppState>) -> impl IntoResponse {\n+    let session = format!(\"p_{}\", uuid::Uuid::new_v4().simple());\n+    let s = PendingSession {\n+        agent: WEB_BROWSER_AGENT.to_string(),\n+        created_ts: now_ms(),\n+        provider: None,\n+        provider_id: None,\n+        redeem_invite: None,\n+        complete: None,\n+    };\n+    state.pending_sessions.write().await.insert(session.clone(), s);\n+    let public_url = std::env::var(\"SLUG_PUBLIC_URL\").unwrap_or_else(|_| \"http://127.0.0.1:8080\".to_string());\n+    Redirect::temporary(&format!(\n+        \"{public_url}/auth/login?session={}\",\n+        urlencoding::encode(&session)\n+    ))\n+    .into_response()\n+}\n+\n+pub async fn get_logout() -> impl IntoResponse {\n+    let clear = format!(\"{SLUG_SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\");\n+    Response::builder()\n+        .status(StatusCode::TEMPORARY_REDIRECT)\n+        .header(header::LOCATION, \"/\")\n+        .header(\n+            header::SET_COOKIE,\n+            HeaderValue::from_str(&clear).expect(\"static cookie clears\"),\n+        )\n+        .body(Body::empty())\n+        .unwrap()\n+        .into_response()\n }\n \n pub async fn post_pending_session(\ndiff --git a/server/src/api/mod.rs b/server/src/api/mod.rs\nindex cb031aecebad1107dfa2898a98fb6084b28ba6e9..5320345a33bbb7b5ab769696a31f70347d019c3e 100644\n--- a/server/src/api/mod.rs\n+++ b/server/src/api/mod.rs\n@@ -1,7 +1,9 @@\n mod auth;\n mod helpers;\n mod rpc;\n+mod stream;\n mod validate;\n+mod web_post;\n \n pub use auth::{\n     get_join_invite,\n@@ -13,6 +15,11 @@ pub use auth::{\n     get_auth_callback,\n     get_auth_complete,\n     get_choose_username,\n+    get_web_login,\n+    get_logout,\n+    optional_principal,\n+    session_cookie_header_value,\n+    SLUG_SESSION_COOKIE,\n };\n \n pub use helpers::{\n@@ -23,8 +30,12 @@ pub use helpers::{\n \n pub use rpc::handle_rpc_batch;\n \n+pub use stream::{get_html_stream, get_stream};\n+\n pub use validate::{normalize_room_and_thread, validate_ingest_document, ValidatedIngest};\n \n+pub use web_post::post_web_ingest;\n+\n #[cfg(test)]\n mod tests {\n     use super::*;\ndiff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs\nindex 7d384e938a526bdf6aa04d1bf21a54d3fcb57d7e..231bf7381cf804144efd0521970b72dd8ffd4213 100644\n--- a/server/src/api/rpc.rs\n+++ b/server/src/api/rpc.rs\n@@ -407,6 +407,22 @@ async fn rpc_post(\n     })\n }\n \n+/// Post forum content using a raw bearer token (CLI `Authorization` header or browser session cookie).\n+pub async fn rpc_post_with_bearer(\n+    state: &AppState,\n+    bearer_token: &str,\n+    room: String,\n+    thread_tag: String,\n+    text: String,\n+) -> Result<RpcResult, RpcErr> {\n+    use axum::http::{header, HeaderMap, HeaderValue};\n+    let mut headers = HeaderMap::new();\n+    let hv = HeaderValue::from_str(&format!(\"Bearer {bearer_token}\"))\n+        .map_err(|_| (\"invalid session token\".into(), None))?;\n+    headers.insert(header::AUTHORIZATION, hv);\n+    rpc_post(state, &headers, room, thread_tag, None, text, false).await\n+}\n+\n async fn rpc_check(\n     state: &AppState,\n     _room: String,\ndiff --git a/server/src/api/web_post.rs b/server/src/api/web_post.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..d7a5780c02281a60d29f27d17b291d6df5580606\n--- /dev/null\n+++ b/server/src/api/web_post.rs\n@@ -0,0 +1,107 @@\n+use axum::{\n+    extract::State,\n+    http::{HeaderMap, StatusCode},\n+    response::{Html, IntoResponse, Redirect},\n+    Form,\n+};\n+use axum_extra::extract::cookie::CookieJar;\n+use serde::Deserialize;\n+use slug_types::RpcResult;\n+\n+use crate::{\n+    api::{\n+        auth::{optional_principal, SLUG_SESSION_COOKIE},\n+        rpc::rpc_post_with_bearer,\n+    },\n+    canonical_path::canonicalize_tag,\n+    html::layout,\n+    state::AppState,\n+};\n+\n+#[derive(Debug, Deserialize)]\n+pub struct WebPostForm {\n+    pub room: String,\n+    pub thread_tag: String,\n+    pub text: String,\n+}\n+\n+fn post_redirect_location(room: &str, thread_tag: &str) -> String {\n+    let tag = canonicalize_tag(thread_tag);\n+    if room.trim() == \"public\" {\n+        format!(\"/t/{tag}\")\n+    } else {\n+        let room = room.trim();\n+        let Some((a, b)) = room.split_once('/') else {\n+            return \"/\".to_string();\n+        };\n+        format!(\"/r/{a}/{b}/{tag}\")\n+    }\n+}\n+\n+pub async fn post_web_ingest(\n+    State(state): State<AppState>,\n+    headers: HeaderMap,\n+    jar: CookieJar,\n+    Form(form): Form<WebPostForm>,\n+) -> impl IntoResponse {\n+    let reduced = state.reduced.read().await;\n+    let Some(username) = optional_principal(&headers, &jar, &reduced) else {\n+        drop(reduced);\n+        return Redirect::temporary(\"/login\").into_response();\n+    };\n+\n+    let bearer = headers\n+        .get(axum::http::header::AUTHORIZATION)\n+        .and_then(|v| v.to_str().ok())\n+        .and_then(|s| s.strip_prefix(\"Bearer \").map(|t| t.trim().to_string()))\n+        .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string()));\n+\n+    drop(reduced);\n+\n+    let Some(bearer) = bearer else {\n+        return Redirect::temporary(\"/login\").into_response();\n+    };\n+\n+    let room = form.room.trim().to_string();\n+    let thread_tag = form.thread_tag.trim().to_string();\n+    let text = form.text.clone();\n+\n+    if text.trim().is_empty() {\n+        return error_page(\n+            \"empty post\",\n+            \"Write something in the text area (DSL / prose).\",\n+            &username,\n+        )\n+        .into_response();\n+    }\n+\n+    match rpc_post_with_bearer(&state, &bearer, room.clone(), thread_tag.clone(), text).await {\n+        Ok(RpcResult::PostOk { .. }) => {\n+            Redirect::to(&post_redirect_location(&room, &thread_tag)).into_response()\n+        }\n+        Ok(_) => error_page(\"unexpected response\", \"Post did not return PostOk.\", &username).into_response(),\n+        Err((msg, hint)) => error_page(\n+            &msg,\n+            hint.as_deref().unwrap_or(\"\"),\n+            &username,\n+        )\n+        .into_response(),\n+    }\n+}\n+\n+fn error_page(title: &str, detail: &str, user: &str) -> impl IntoResponse {\n+    use maud::html;\n+    let body = html! {\n+        nav class=\"breadcrumb\" {\n+            a href=\"/\" { \"slug.social\" }\n+        }\n+        h1 { \"could not post\" }\n+        p { (title) }\n+        @if !detail.is_empty() {\n+            pre class=\"muted\" { (detail) }\n+        }\n+        p class=\"muted\" { \"signed in as @\" (user) \" · \" a href=\"/\" { \"home\" } }\n+    };\n+    let page = layout(\"post error — slug.social\", \"view-thread\", body, None);\n+    (StatusCode::BAD_REQUEST, Html(page.into_string()))\n+}\ndiff --git a/server/src/html/forum.rs b/server/src/html/forum.rs\nindex 228a120065dbacd8a308ba6e8bfc6ab111877c4b..8dfcd6b23a18e1571c4f0b3b60c865fa8f576f2f 100644\n--- a/server/src/html/forum.rs\n+++ b/server/src/html/forum.rs\n@@ -1,21 +1,24 @@\n use axum::{\n     extract::{Path, Query, State},\n-    http::{header, StatusCode},\n+    http::{header, HeaderMap, StatusCode},\n     response::{Html, IntoResponse, Response},\n };\n-use serde::Deserialize;\n+use axum_extra::extract::cookie::CookieJar;\n use maud::{html, Markup};\n+use serde::Deserialize;\n \n use crate::{\n+    api::optional_principal,\n     canonical_path::canonicalize_tag,\n+    events::ThreadCapability,\n     reducer::{ReducerState, ScopeId},\n     state::AppState,\n     timeago,\n };\n \n use super::{\n-    authorship_address, bc_threads, cli_panel, layout, now_ms,\n-    recency_class, render_linkified_with_embeds,\n+    authorship_address, bc_segment, bc_threads, cli_panel, layout, now_ms, recency_class,\n+    render_linkified_with_embeds,\n };\n \n #[derive(Clone)]\n@@ -26,17 +29,72 @@ struct ThreadRow {\n     ingests: usize,\n }\n \n-/// Collect thread rows from reducer state (unsorted).\n-fn collect_thread_rows(reduced: &ReducerState, now: i64) -> Vec<ThreadRow> {\n+/// URL prefix for thread pages: public `/t/…` or room `/r/{short}/{slug}/…`.\n+#[derive(Clone)]\n+pub struct ThreadNav {\n+    pub room_wire: String,\n+    scope: ScopeId,\n+    path_prefix: String,\n+}\n+\n+impl ThreadNav {\n+    pub fn public() -> Self {\n+        Self {\n+            room_wire: \"public\".into(),\n+            scope: ScopeId::Public,\n+            path_prefix: \"/t\".into(),\n+        }\n+    }\n+\n+    /// `room_id` wire form `shortid/slug`.\n+    pub fn from_room_id(room_id: &str) -> Option<Self> {\n+        let (short, slug) = room_id.split_once('/')?;\n+        if short.is_empty() || slug.is_empty() {\n+            return None;\n+        }\n+        Some(Self {\n+            room_wire: room_id.to_string(),\n+            scope: ScopeId::Room(room_id.to_string()),\n+            path_prefix: format!(\"/r/{short}/{slug}\"),\n+        })\n+    }\n+\n+    fn scope(&self) -> ScopeId {\n+        self.scope.clone()\n+    }\n+\n+    fn thread_url(&self, tag: &str) -> String {\n+        format!(\"{}/{}\", self.path_prefix, tag)\n+    }\n+\n+    fn thread_page_url(&self, tag: &str, offset: usize) -> String {\n+        let base = self.thread_url(tag);\n+        if offset == 0 {\n+            base\n+        } else {\n+            format!(\"{base}?offset={offset}\")\n+        }\n+    }\n+\n+    fn post_url(&self, tag: &str, idx: usize) -> String {\n+        format!(\"{}/{}/{}\", self.path_prefix, tag, idx)\n+    }\n+\n+    fn expand_url(&self, tag: &str, idx: usize) -> String {\n+        format!(\"{}/{}/{}/expand\", self.path_prefix, tag, idx)\n+    }\n+}\n+\n+fn collect_thread_rows_for_scope(reduced: &ReducerState, scope: &ScopeId, now: i64) -> Vec<ThreadRow> {\n     let _ = now;\n     reduced\n         .forum_threads\n         .iter()\n-        .filter(|((scope, _), _)| scope == &ScopeId::Public)\n+        .filter(|((s, _), _)| s == scope)\n         .map(|((_, tag), thread)| {\n             let ingests = reduced\n                 .ingests_by_scope_thread\n-                .get(&(ScopeId::Public, tag.clone()))\n+                .get(&(scope.clone(), tag.clone()))\n                 .map(|q| q.len())\n                 .unwrap_or(0);\n             ThreadRow {\n@@ -49,16 +107,46 @@ fn collect_thread_rows(reduced: &ReducerState, now: i64) -> Vec<ThreadRow> {\n         .collect()\n }\n \n-/// Render the thread feed div (id=\"thread-feed\"). Used by both index() and SSE broadcast.\n-fn render_thread_feed(rows: &[ThreadRow], now: i64) -> Markup {\n+fn rooms_for_user(reduced: &ReducerState, username: &str) -> Vec<String> {\n+    let mut v: Vec<String> = reduced\n+        .grants\n+        .iter()\n+        .filter(|(rid, m)| reduced.rooms.contains(*rid) && m.contains_key(username))\n+        .map(|(rid, _)| rid.clone())\n+        .collect();\n+    v.sort();\n+    v\n+}\n+\n+fn user_can_view_room(reduced: &ReducerState, room_id: &str, username: Option<&str>) -> bool {\n+    if !reduced.rooms.contains(room_id) {\n+        return false;\n+    }\n+    let Some(u) = username else {\n+        return false;\n+    };\n+    reduced.user_has_cap(room_id, u, ThreadCapability::View)\n+        || reduced.user_has_cap(room_id, u, ThreadCapability::Post)\n+        || reduced.user_has_cap(room_id, u, ThreadCapability::Manage)\n+}\n+\n+fn user_can_post_room(reduced: &ReducerState, room_id: &str, username: &str) -> bool {\n+    reduced.user_has_cap(room_id, username, ThreadCapability::Post)\n+}\n+\n+/// `feed_id` is e.g. `thread-feed` (public bump list, SSE) or `room-thread-feed`.\n+fn render_thread_feed(nav: Option<&ThreadNav>, feed_id: &str, rows: &[ThreadRow], now: i64) -> Markup {\n     html! {\n-        div id=\"thread-feed\" {\n+        div id=(feed_id) {\n             @if rows.is_empty() {\n                 p class=\"muted\" { \"no threads yet\" }\n             } @else {\n                 ul class=\"thread-feed\" {\n                     @for r in rows {\n-                        @let thread_href = format!(\"/t/{}\", r.tag);\n+                        @let thread_href = nav\n+                            .as_ref()\n+                            .map(|n| n.thread_url(&r.tag))\n+                            .unwrap_or_else(|| format!(\"/t/{}\", r.tag));\n                         @let hover = timeago::rfc3339_utc(r.last_ts);\n                         @let ago = timeago::timeago(now, r.last_ts);\n                         @let age_cls = recency_class(now, r.last_ts);\n@@ -83,36 +171,148 @@ fn render_thread_feed(rows: &[ThreadRow], now: i64) -> Markup {\n     }\n }\n \n+fn auth_strip(\n+    headers: &HeaderMap,\n+    jar: &CookieJar,\n+    reduced: &ReducerState,\n+) -> Markup {\n+    match optional_principal(headers, jar, reduced) {\n+        Some(u) => html! {\n+            p class=\"muted auth-strip\" {\n+                \"@\" (u)\n+                \" · \"\n+                a href=\"/logout\" { \"log out\" }\n+            }\n+        },\n+        None => html! {\n+            p class=\"muted auth-strip\" {\n+                a href=\"/login\" { \"log in\" }\n+            }\n+        },\n+    }\n+}\n+\n+fn bc_room(nav: &ThreadNav, room_slug: &str, thread_tag: Option<&str>) -> Markup {\n+    html! {\n+        a href=\"/\" { \"slug.social\" }\n+        @if let Some(t) = thread_tag {\n+            (bc_segment(\n+                &format!(\"r / {room_slug}\"),\n+                &nav.path_prefix,\n+                false,\n+            ))\n+            (bc_segment(&format!(\"#{t}\"), &nav.thread_url(t), true))\n+        } @else {\n+            (bc_segment(\n+                &format!(\"r / {room_slug}\"),\n+                &nav.path_prefix,\n+                true,\n+            ))\n+        }\n+    }\n+}\n+\n+fn compose_form(nav: &ThreadNav, thread_tag: &str, show: bool) -> Markup {\n+    if !show {\n+        return html! {};\n+    }\n+    html! {\n+        section class=\"compose\" {\n+            h3 { \"reply\" }\n+            p class=\"muted\" { \"Uses the same ingest DSL as the CLI. You must be logged in.\" }\n+            form method=\"POST\" action=\"/post\" {\n+                input type=\"hidden\" name=\"room\" value=(nav.room_wire.clone());\n+                input type=\"hidden\" name=\"thread_tag\" value=(thread_tag);\n+                textarea name=\"text\" rows=\"8\" cols=\"80\" placeholder=\"prose or ~/items and votes…\" {}\n+                p {\n+                    button type=\"submit\" { \"post\" }\n+                }\n+            }\n+        }\n+    }\n+}\n+\n+fn new_thread_form_public(show: bool) -> Markup {\n+    if !show {\n+        return html! {};\n+    }\n+    html! {\n+        section class=\"compose\" {\n+            h3 { \"new public thread\" }\n+            p class=\"muted\" { \"Set thread tag and body. Example: start with a title line or use the CLI-shaped DSL.\" }\n+            form method=\"POST\" action=\"/post\" {\n+                input type=\"hidden\" name=\"room\" value=\"public\";\n+                label for=\"new-thread-tag\" { \"thread tag\" }\n+                input type=\"text\" id=\"new-thread-tag\" name=\"thread_tag\" pattern=\"[a-z0-9_\\\\-]{1,64}\" placeholder=\"my-topic\";\n+                label for=\"new-thread-text\" { \"text\" }\n+                textarea id=\"new-thread-text\" name=\"text\" rows=\"6\" placeholder=\"#my-topic\\n\\nYour first post…\" {}\n+                p { button type=\"submit\" { \"create / post\" } }\n+            }\n+        }\n+    }\n+}\n \n-/// Returns the current thread feed HTML fragment for SSE broadcast.\n-/// selector: `#thread-feed`\n+/// Returns the current public thread feed HTML fragment for SSE (`#thread-feed`).\n pub async fn thread_feed_html(state: &AppState) -> String {\n     let now = now_ms();\n+    let nav = ThreadNav::public();\n     let mut rows = {\n         let reduced = state.reduced.read().await;\n-        collect_thread_rows(&reduced, now)\n+        collect_thread_rows_for_scope(&reduced, &ScopeId::Public, now)\n     };\n     rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));\n-    render_thread_feed(&rows, now).into_string()\n+    render_thread_feed(Some(&nav), \"thread-feed\", &rows, now).into_string()\n }\n \n-pub async fn index(State(state): State<AppState>) -> impl IntoResponse {\n+/// Home: private rooms (signed-in), then public bump-ordered threads.\n+pub async fn home(\n+    State(state): State<AppState>,\n+    headers: HeaderMap,\n+    jar: CookieJar,\n+) -> impl IntoResponse {\n     let now = now_ms();\n-    let mut rows: Vec<ThreadRow> = {\n-        let reduced = state.reduced.read().await;\n-        collect_thread_rows(&reduced, now)\n-    };\n-    // Bump order: most recently active first.\n-    rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));\n+    let reduced = state.reduced.read().await;\n+    let user = optional_principal(&headers, &jar, &reduced);\n+    let room_ids = user\n+        .as_ref()\n+        .map(|u| rooms_for_user(&reduced, u))\n+        .unwrap_or_default();\n+    let mut public_rows = collect_thread_rows_for_scope(&reduced, &ScopeId::Public, now);\n+    drop(reduced);\n+    public_rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));\n+\n+    let nav = ThreadNav::public();\n+    let reduced_read = state.reduced.read().await;\n+    let strip = auth_strip(&headers, &jar, &reduced_read);\n+    let show_forms = user.is_some();\n+    drop(reduced_read);\n \n     let page = layout(\n         \"slug.social\",\n         \"view-thread\",\n         html! {\n+            (strip)\n             nav class=\"breadcrumb\" { (bc_threads(None)) }\n+            @if !room_ids.is_empty() {\n+                h2 { \"your rooms\" }\n+                ul class=\"thread-feed\" {\n+                    @for rid in &room_ids {\n+                        @if let Some(nav_r) = ThreadNav::from_room_id(rid) {\n+                            @let slug = if let Some((_, s)) = rid.split_once('/') { s } else { rid.as_str() };\n+                            li {\n+                                a href=(nav_r.path_prefix) {\n+                                    (slug)\n+                                    span class=\"muted\" { \" · \" (rid) }\n+                                }\n+                            }\n+                        }\n+                    }\n+                }\n+            }\n+            h2 { \"public threads\" }\n             p class=\"muted\" { \"dark = time-ordered · light = vote-ranked\" }\n-            h2 { \"threads\" }\n-            (render_thread_feed(&rows, now))\n+            (render_thread_feed(Some(&nav), \"thread-feed\", &public_rows, now))\n+            (new_thread_form_public(show_forms))\n             (cli_panel(\"npx slugsocial forum\"))\n         },\n         None,\n@@ -127,9 +327,13 @@ pub struct ThreadViewQuery {\n \n const PAGE_SIZE: usize = 10;\n \n-fn render_thread_paginator(tag: &str, offset: usize, total: usize, top: bool) -> Markup {\n+fn render_thread_paginator(nav: &ThreadNav, tag: &str, offset: usize, total: usize, top: bool) -> Markup {\n     let newer_offset = offset.checked_add(PAGE_SIZE).filter(|&o| o < total);\n-    let older_offset = if offset > 0 { Some(offset.saturating_sub(PAGE_SIZE)) } else { None };\n+    let older_offset = if offset > 0 {\n+        Some(offset.saturating_sub(PAGE_SIZE))\n+    } else {\n+        None\n+    };\n     let latest_offset = total.saturating_sub(PAGE_SIZE);\n     let on_latest = offset >= latest_offset;\n     let (id, scroll_href, scroll_label) = if top {\n@@ -141,7 +345,7 @@ fn render_thread_paginator(tag: &str, offset: usize, total: usize, top: bool) ->\n         div class=\"thread-paginator\" id=(id) {\n             a href=(scroll_href) class=\"post-nav-btn\" { (scroll_label) }\n             @if let Some(o) = older_offset {\n-                a href=(format!(\"/t/{tag}?offset={o}\")) class=\"post-nav-btn\" { \"← older\" }\n+                a href=(nav.thread_page_url(tag, o)) class=\"post-nav-btn\" { \"← older\" }\n             } @else {\n                 span class=\"post-nav-btn disabled\" { \"← older\" }\n             }\n@@ -149,37 +353,38 @@ fn render_thread_paginator(tag: &str, offset: usize, total: usize, top: bool) ->\n                 (offset + 1) \"–\" (total.min(offset + PAGE_SIZE)) \" / \" (total)\n             }\n             @if let Some(o) = newer_offset {\n-                a href=(format!(\"/t/{tag}?offset={o}\")) class=\"post-nav-btn\" { \"newer →\" }\n+                a href=(nav.thread_page_url(tag, o)) class=\"post-nav-btn\" { \"newer →\" }\n             } @else {\n                 span class=\"post-nav-btn disabled\" { \"newer →\" }\n             }\n             @if !on_latest {\n-                a href=(format!(\"/t/{tag}?offset={latest_offset}\")) class=\"post-nav-btn\" { \"latest\" }\n+                a href=(nav.thread_page_url(tag, latest_offset)) class=\"post-nav-btn\" { \"latest\" }\n             }\n         }\n     }\n }\n \n-/// Thread view — `/t/:tag` — dark, paginated.\n-pub async fn thread_view(\n-    State(state): State<AppState>,\n-    Path(tag): Path<String>,\n-    Query(q): Query<ThreadViewQuery>,\n+async fn thread_view_inner(\n+    state: AppState,\n+    tag: String,\n+    q: ThreadViewQuery,\n+    nav: ThreadNav,\n+    headers: HeaderMap,\n+    jar: CookieJar,\n ) -> impl IntoResponse {\n     let tag = canonicalize_tag(&tag);\n+    let scope = nav.scope();\n \n-    // Newest-first queue → chronological for the page.\n     let all_ids: Vec<String> = {\n         let reduced = state.reduced.read().await;\n         reduced\n             .ingests_by_scope_thread\n-            .get(&(ScopeId::Public, tag.clone()))\n+            .get(&(scope.clone(), tag.clone()))\n             .map(|q| q.iter().rev().cloned().collect())\n             .unwrap_or_default()\n     };\n \n     let total = all_ids.len();\n-    // Default: first page (oldest posts first, like a book).\n     let offset = q.offset.unwrap_or(0);\n     let page_ids: Vec<String> = all_ids.into_iter().skip(offset).take(PAGE_SIZE).collect();\n \n@@ -189,18 +394,49 @@ pub async fn thread_view(\n             .iter()\n             .filter_map(|id| reduced.ingests_by_id.get(id).cloned())\n             .collect::<Vec<_>>();\n-        let subtitle: Option<String> = None;\n-        (ingests, subtitle)\n+        (ingests, None::<String>)\n+    };\n+\n+    let reduced = state.reduced.read().await;\n+    let user = optional_principal(&headers, &jar, &reduced);\n+    let sc = nav.scope();\n+    let show_compose = match &sc {\n+        ScopeId::Public => user.is_some(),\n+        ScopeId::Room(rid) => user\n+            .as_ref()\n+            .map(|u| user_can_post_room(&reduced, rid, u))\n+            .unwrap_or(false),\n     };\n+    let strip = auth_strip(&headers, &jar, &reduced);\n+    drop(reduced);\n \n     let now = now_ms();\n-    let paginator_top = render_thread_paginator(&tag, offset, total, true);\n-    let paginator_bot = render_thread_paginator(&tag, offset, total, false);\n+    let paginator_top = render_thread_paginator(&nav, &tag, offset, total, true);\n+    let paginator_bot = render_thread_paginator(&nav, &tag, offset, total, false);\n+\n+    let bc: Markup = match &sc {\n+        ScopeId::Public => bc_threads(Some(&tag)),\n+        ScopeId::Room(rid) => {\n+            let slug = if let Some((_, s)) = rid.split_once('/') {\n+                s\n+            } else {\n+                rid.as_str()\n+            };\n+            bc_room(&nav, slug, Some(&tag))\n+        }\n+    };\n+\n+    let cli = match &sc {\n+        ScopeId::Public => format!(\"npx slugsocial forum {tag}\"),\n+        ScopeId::Room(r) => format!(\"npx slugsocial private {r} forum {tag}\"),\n+    };\n+\n     let page = layout(\n         &format!(\"#{tag}\"),\n         \"view-thread\",\n         html! {\n-            nav class=\"breadcrumb\" { (bc_threads(Some(&tag))) }\n+            (strip)\n+            nav class=\"breadcrumb\" { (bc) }\n             h2 { \"#\" (tag) @if let Some(sub) = &subtitle { \": \" (sub) } }\n             p class=\"muted\" { \"top=oldest · bottom=newest\" }\n             @if display_ingests.is_empty() {\n@@ -209,7 +445,7 @@ pub async fn thread_view(\n                 (paginator_top)\n                 @for (i, ing) in display_ingests.iter().enumerate() {\n                     @let post_idx = offset + i;\n-                    @let post_href = format!(\"/t/{tag}/{post_idx}\");\n+                    @let post_href = nav.post_url(&tag, post_idx);\n                     @let hover = timeago::rfc3339_utc(ing.ts);\n                     @let ago = timeago::timeago(now, ing.ts);\n                     @let truncated = ing.raw.len() > 2000;\n@@ -222,8 +458,9 @@ pub async fn thread_view(\n                         }\n                         (render_linkified_with_embeds(display_body))\n                         @if truncated {\n+                            @let exp = nav.expand_url(&tag, post_idx);\n                             a href=\"#\" class=\"show-full-link\"\n-                              onclick=(format!(\"fetch('/t/{tag}/{post_idx}/expand').then(r=>r.text()).then(eval);return false\")) {\n+                              onclick=(format!(\"fetch('{exp}').then(r=>r.text()).then(eval);return false\")) {\n                                 \"[show full post]\"\n                             }\n                         }\n@@ -231,34 +468,171 @@ pub async fn thread_view(\n                 }\n                 (paginator_bot)\n             }\n-            (cli_panel(&format!(\"npx slugsocial forum {tag}\")))\n+            (compose_form(&nav, &tag, show_compose))\n+            (cli_panel(&cli))\n         },\n         None,\n     );\n     Html(page.into_string()).into_response()\n }\n \n-/// Single-post view — `/t/:tag/:index` — shows one ingest at full length.\n-pub async fn thread_post_view(\n+/// Thread view — `/t/:tag`\n+pub async fn thread_view(\n     State(state): State<AppState>,\n-    Path((tag, index_str)): Path<(String, String)>,\n+    Path(tag): Path<String>,\n+    Query(q): Query<ThreadViewQuery>,\n+    headers: HeaderMap,\n+    jar: CookieJar,\n ) -> impl IntoResponse {\n-    let tag = canonicalize_tag(&tag);\n+    thread_view_inner(state, tag, q, ThreadNav::public(), headers, jar).await\n+}\n+\n+/// Room thread — `/r/:short/:slug/:tag`\n+pub async fn room_thread_view(\n+    State(state): State<AppState>,\n+    Path((room_short, room_slug, tag)): Path<(String, String, String)>,\n+    Query(q): Query<ThreadViewQuery>,\n+    headers: HeaderMap,\n+    jar: CookieJar,\n+) -> impl IntoResponse {\n+    let room_id = format!(\"{room_short}/{room_slug}\");\n+    let reduced = state.reduced.read().await;\n+    let user = optional_principal(&headers, &jar, &reduced);\n+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {\n+        drop(reduced);\n+        return room_forbidden_page().into_response();\n+    }\n+    drop(reduced);\n+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {\n+        return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n+    };\n+    thread_view_inner(state, tag, q, nav, headers, jar)\n+        .await\n+        .into_response()\n+}\n+\n+fn room_forbidden_page() -> impl IntoResponse {\n+    let body = html! {\n+        nav class=\"breadcrumb\" { a href=\"/\" { \"slug.social\" } }\n+        h1 { \"private room\" }\n+        p { \"Log in with an account that has been granted access to this room.\" }\n+        p { a href=\"/login\" { \"log in\" } \" · \" a href=\"/\" { \"home\" } }\n+    };\n+    let page = layout(\"private room — slug.social\", \"view-thread\", body, None);\n+    (StatusCode::FORBIDDEN, Html(page.into_string()))\n+}\n+\n+/// Private room index — `/r/:short/:slug`\n+pub async fn room_page(\n+    State(state): State<AppState>,\n+    Path((room_short, room_slug)): Path<(String, String)>,\n+    headers: HeaderMap,\n+    jar: CookieJar,\n+) -> impl IntoResponse {\n+    let room_id = format!(\"{room_short}/{room_slug}\");\n     let now = now_ms();\n+    let reduced = state.reduced.read().await;\n+    if !reduced.rooms.contains(&room_id) {\n+        drop(reduced);\n+        return (StatusCode::NOT_FOUND, \"room not found\").into_response();\n+    }\n+    let user = optional_principal(&headers, &jar, &reduced);\n+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {\n+        drop(reduced);\n+        return room_forbidden_page().into_response();\n+    }\n+    let scope = ScopeId::Room(room_id.clone());\n+    let mut rows = collect_thread_rows_for_scope(&reduced, &scope, now);\n+    let strip = auth_strip(&headers, &jar, &reduced);\n+    let show_new = user\n+        .as_ref()\n+        .map(|u| user_can_post_room(&reduced, &room_id, u))\n+        .unwrap_or(false);\n+    drop(reduced);\n+    rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));\n+\n+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {\n+        return (StatusCode::NOT_FOUND, \"room not found\").into_response();\n+    };\n+    let slug_display = room_slug.as_str();\n+    let cli = format!(\"npx slugsocial private {room_id} forum\");\n+\n+    let page = layout(\n+        &format!(\"room {slug_display} — slug.social\"),\n+        \"view-thread\",\n+        html! {\n+            (strip)\n+            nav class=\"breadcrumb\" { (bc_room(&nav, slug_display, None)) }\n+            h2 { (slug_display) }\n+            p class=\"muted\" { (room_id) }\n+            h3 { \"threads\" }\n+            (render_thread_feed(Some(&nav), \"room-thread-feed\", &rows, now))\n+            @if show_new {\n+                (new_thread_form_for_room(&nav, show_new))\n+            }\n+            (cli_panel(&cli))\n+        },\n+        None,\n+    );\n+    Html(page.into_string()).into_response()\n+}\n+\n+fn new_thread_form_for_room(nav: &ThreadNav, show: bool) -> Markup {\n+    if !show {\n+        return html! {};\n+    }\n+    html! {\n+        section class=\"compose\" {\n+            h3 { \"new thread in this room\" }\n+            form method=\"POST\" action=\"/post\" {\n+                input type=\"hidden\" name=\"room\" value=(nav.room_wire.clone());\n+                label for=\"room-new-tag\" { \"thread tag\" }\n+                input type=\"text\" id=\"room-new-tag\" name=\"thread_tag\" pattern=\"[a-z0-9_\\\\-]{1,64}\" required;\n+                textarea name=\"text\" rows=\"6\" placeholder=\"First post body…\" required {}\n+                p { button type=\"submit\" { \"post\" } }\n+            }\n+        }\n+    }\n+}\n+\n+async fn thread_post_view_inner(\n+    state: AppState,\n+    tag: String,\n+    index_str: String,\n+    nav: ThreadNav,\n+) -> impl IntoResponse {\n+    let tag = canonicalize_tag(&tag);\n     let index: usize = index_str.parse().unwrap_or(0);\n+    let scope = nav.scope();\n+    let now = now_ms();\n     let (ing, subtitle) = {\n         let reduced = state.reduced.read().await;\n-        let ing = reduced.ingests_by_scope_thread.get(&(ScopeId::Public, tag.clone()))\n+        let ing = reduced\n+            .ingests_by_scope_thread\n+            .get(&(scope.clone(), tag.clone()))\n             .and_then(|q| q.iter().rev().nth(index))\n             .and_then(|id| reduced.ingests_by_id.get(id).cloned());\n-        let subtitle: Option<String> = None;\n-        (ing, subtitle)\n+        (ing, None::<String>)\n     };\n+\n+    let sc = nav.scope();\n+    let bc: Markup = match &sc {\n+        ScopeId::Public => bc_threads(Some(&tag)),\n+        ScopeId::Room(rid) => {\n+            let slug = if let Some((_, s)) = rid.split_once('/') {\n+                s\n+            } else {\n+                rid.as_str()\n+            };\n+            bc_room(&nav, slug, Some(&tag))\n+        }\n+    };\n+\n     let page = layout(\n         &format!(\"#{tag} / post #{index}\"),\n         \"view-thread\",\n         html! {\n-            nav class=\"breadcrumb\" { (bc_threads(Some(&tag))) }\n+            nav class=\"breadcrumb\" { (bc) }\n             h2 { \"#\" (tag) @if let Some(sub) = &subtitle { \": \" (sub) } \" / post #\" (index) }\n             @if let Some(ing) = ing {\n                 @let hover = timeago::rfc3339_utc(ing.ts);\n@@ -280,21 +654,51 @@ pub async fn thread_post_view(\n     Html(page.into_string()).into_response()\n }\n \n-/// Inline expand handler — `/t/:tag/:id/expand`\n-/// Returns a JS snippet that morphs the truncated post into its full version.\n-pub async fn thread_post_expand(\n+pub async fn thread_post_view(\n     State(state): State<AppState>,\n     Path((tag, index_str)): Path<(String, String)>,\n+) -> impl IntoResponse {\n+    thread_post_view_inner(state, tag, index_str, ThreadNav::public()).await\n+}\n+\n+pub async fn room_thread_post_view(\n+    State(state): State<AppState>,\n+    Path((room_short, room_slug, tag, index_str)): Path<(String, String, String, String)>,\n+    headers: HeaderMap,\n+    jar: CookieJar,\n+) -> impl IntoResponse {\n+    let room_id = format!(\"{room_short}/{room_slug}\");\n+    let reduced = state.reduced.read().await;\n+    let user = optional_principal(&headers, &jar, &reduced);\n+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {\n+        drop(reduced);\n+        return room_forbidden_page().into_response();\n+    }\n+    drop(reduced);\n+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {\n+        return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n+    };\n+    thread_post_view_inner(state, tag, index_str, nav)\n+        .await\n+        .into_response()\n+}\n+\n+async fn thread_post_expand_inner(\n+    state: AppState,\n+    tag: String,\n+    index_str: String,\n+    nav: ThreadNav,\n ) -> impl IntoResponse {\n     let tag = canonicalize_tag(&tag);\n     let index: usize = index_str.parse().unwrap_or(0);\n     let now = now_ms();\n+    let scope = nav.scope();\n \n     let ing = {\n         let reduced = state.reduced.read().await;\n         reduced\n             .ingests_by_scope_thread\n-            .get(&(ScopeId::Public, tag.clone()))\n+            .get(&(scope.clone(), tag.clone()))\n             .and_then(|q| q.iter().rev().nth(index))\n             .and_then(|id| reduced.ingests_by_id.get(id).cloned())\n     };\n@@ -303,7 +707,7 @@ pub async fn thread_post_expand(\n         return (StatusCode::NOT_FOUND, \"post not found\").into_response();\n     };\n \n-    let post_href = format!(\"/t/{tag}/{index}\");\n+    let post_href = nav.post_url(&tag, index);\n     let hover = timeago::rfc3339_utc(ing.ts);\n     let ago = timeago::timeago(now, ing.ts);\n \n@@ -319,7 +723,6 @@ pub async fn thread_post_expand(\n     };\n \n     let full_html_str = full_html.into_string();\n-    // Escape backticks and backslashes for JS template literal\n     let escaped = full_html_str\n         .replace('\\\\', \"\\\\\\\\\")\n         .replace('`', \"\\\\`\")\n@@ -334,7 +737,36 @@ pub async fn thread_post_expand(\n     Response::builder()\n         .status(StatusCode::OK)\n         .header(header::CONTENT_TYPE, \"text/javascript; charset=utf-8\")\n-        .body(js)\n+        .body(axum::body::Body::from(js))\n         .unwrap()\n         .into_response()\n }\n+\n+pub async fn thread_post_expand(\n+    State(state): State<AppState>,\n+    Path((tag, index_str)): Path<(String, String)>,\n+) -> impl IntoResponse {\n+    thread_post_expand_inner(state, tag, index_str, ThreadNav::public()).await\n+}\n+\n+pub async fn room_thread_post_expand(\n+    State(state): State<AppState>,\n+    Path((room_short, room_slug, tag, index_str)): Path<(String, String, String, String)>,\n+    headers: HeaderMap,\n+    jar: CookieJar,\n+) -> impl IntoResponse {\n+    let room_id = format!(\"{room_short}/{room_slug}\");\n+    let reduced = state.reduced.read().await;\n+    let user = optional_principal(&headers, &jar, &reduced);\n+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {\n+        drop(reduced);\n+        return (StatusCode::FORBIDDEN, \"forbidden\").into_response();\n+    }\n+    drop(reduced);\n+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {\n+        return (StatusCode::NOT_FOUND, \"not found\").into_response();\n+    };\n+    thread_post_expand_inner(state, tag, index_str, nav)\n+        .await\n+        .into_response()\n+}\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex 9c5af9654c7010d2cdb100e4cf63ba63e77c8c57..26e86124aae7cd878c92e1dc927e19d9fd2feaba 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -16,7 +16,10 @@ use breadcrumb_path::OntologyPath;\n \n pub use auth::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page};\n pub use editor::{editor_check, editor_page};\n-pub use forum::{index, thread_feed_html, thread_post_expand, thread_post_view, thread_view};\n+pub use forum::{\n+    home, room_page, room_thread_post_expand, room_thread_post_view, room_thread_view, thread_feed_html,\n+    thread_post_expand, thread_post_view, thread_view,\n+};\n pub use garden::{garden_index, ontology_path};\n pub use search::{search_page, search_results_fragment};\n \ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex bf2f73d4d0f26a357961e88c52c3b4f72626af81..b074cc31b94f23d1d566513392d7da3c02653c97 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -16,7 +16,7 @@ pub mod state;\n pub mod timeago;\n \n use axum::Router;\n-use axum::routing::post;\n+use axum::routing::{get, post};\n use tower_http::trace::TraceLayer;\n \n use crate::state::AppState;\n@@ -25,17 +25,48 @@ pub use reducer::ReducerState;\n \n pub fn create_app(state: AppState) -> Router {\n     Router::new()\n-        .route(\"/healthz\", axum::routing::get(|| async { \"ok\" }))\n-        .route(\"/static/:filename\", axum::routing::get(crate::html::serve_theme_css))\n-        .route(\"/join/:token\", axum::routing::get(api::get_join_invite))\n-        .route(\"/auth/login\", axum::routing::get(api::get_auth_login))\n-        .route(\"/auth/callback\", axum::routing::get(api::get_auth_callback))\n-        .route(\"/auth/complete\", axum::routing::get(api::get_auth_complete))\n-        .route(\"/auth/choose-username\", axum::routing::get(api::get_choose_username))\n-        .route(\"/auth/choose-username\", axum::routing::post(api::post_choose_username))\n-        .route(\"/api/v0/pending-session\", axum::routing::post(api::post_pending_session))\n-        .route(\"/api/v0/pending-session/:id\", axum::routing::get(api::get_pending_session))\n-        .route(\"/api/v0/whoami\", axum::routing::get(api::get_whoami))\n+        .route(\"/healthz\", get(|| async { \"ok\" }))\n+        .route(\"/static/:filename\", get(crate::html::serve_theme_css))\n+        .route(\"/\", get(crate::html::home))\n+        .route(\"/login\", get(api::get_web_login))\n+        .route(\"/logout\", get(api::get_logout))\n+        .route(\"/post\", post(api::post_web_ingest))\n+        .route(\"/sse\", get(api::get_html_stream))\n+        .route(\"/stream\", get(api::get_stream))\n+        .route(\"/search\", get(crate::html::search_page))\n+        .route(\"/search/results\", get(crate::html::search_results_fragment))\n+        .route(\"/try\", get(crate::html::editor_page))\n+        .route(\"/try/check\", post(crate::html::editor_check))\n+        .route(\"/~\", get(crate::html::garden_index))\n+        .route(\"/~/*path\", get(crate::html::ontology_path))\n+        .route(\n+            \"/t/:tag/:index/expand\",\n+            get(crate::html::thread_post_expand),\n+        )\n+        .route(\"/t/:tag/:index\", get(crate::html::thread_post_view))\n+        .route(\"/t/:tag\", get(crate::html::thread_view))\n+        .route(\n+            \"/r/:room_short/:room_slug/:thread_tag/:index/expand\",\n+            get(crate::html::room_thread_post_expand),\n+        )\n+        .route(\n+            \"/r/:room_short/:room_slug/:thread_tag/:index\",\n+            get(crate::html::room_thread_post_view),\n+        )\n+        .route(\n+            \"/r/:room_short/:room_slug/:thread_tag\",\n+            get(crate::html::room_thread_view),\n+        )\n+        .route(\"/r/:room_short/:room_slug\", get(crate::html::room_page))\n+        .route(\"/join/:token\", get(api::get_join_invite))\n+        .route(\"/auth/login\", get(api::get_auth_login))\n+        .route(\"/auth/callback\", get(api::get_auth_callback))\n+        .route(\"/auth/complete\", get(api::get_auth_complete))\n+        .route(\"/auth/choose-username\", get(api::get_choose_username))\n+        .route(\"/auth/choose-username\", post(api::post_choose_username))\n+        .route(\"/api/v0/pending-session\", post(api::post_pending_session))\n+        .route(\"/api/v0/pending-session/:id\", get(api::get_pending_session))\n+        .route(\"/api/v0/whoami\", get(api::get_whoami))\n         .route(\"/api/v0/rpc\", post(api::handle_rpc_batch))\n         .with_state(state)\n         .layer(TraceLayer::new_for_http())\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[9e20d06c] Add sorterc dev tool for offline DSL compile and JSONL lint.\n\nIntroduce a workspace-only binary that validates .sorter files into ranking JSON and scans events.jsonl for corrupt or unreplayable ingests.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/Cargo.lock b/Cargo.lock\nindex bf8153d9c723af97122c9ffdd4a7cfe82e853bb6..a07734f089b466440c3ae6fc1087ce85fc24ce62 100644\n--- a/Cargo.lock\n+++ b/Cargo.lock\n@@ -1826,6 +1826,17 @@ dependencies = [\n  \"windows-sys 0.60.2\",\n ]\n \n+[[package]]\n+name = \"sorterc\"\n+version = \"0.0.1\"\n+dependencies = [\n+ \"anyhow\",\n+ \"clap\",\n+ \"serde\",\n+ \"serde_json\",\n+ \"slugsocial-server\",\n+]\n+\n [[package]]\n name = \"spin\"\n version = \"0.9.8\"\ndiff --git a/Cargo.toml b/Cargo.toml\nindex 149cbf07901eab57c593184ff8719a75d530f1da..25337acdd61e44b20f354c78fed4a88caf896280 100644\n--- a/Cargo.toml\n+++ b/Cargo.toml\n@@ -1,5 +1,5 @@\n [workspace]\n-members = [\"server\", \"cli\"]\n+members = [\"server\", \"cli\", \"sorterc\"]\n resolver = \"2\"\n \n \ndiff --git a/agents.md b/agents.md\nindex d8b801e454fdf37e7ac6038b91a69f83b0746d59..ce646ed3cd7123be4732dccec4a6800467e651e7 100644\n--- a/agents.md\n+++ b/agents.md\n@@ -93,6 +93,17 @@ SLUG_GOOGLE_CLIENT_SECRET=mock\n \n After OAuth completes, the pending-session poll returns a `slug_…` bearer token for API calls.\n \n+### Dev-only offline tooling\n+\n+**`sorterc`** — workspace binary, not published via npm. Compiles `.sorter` files and lints `events.jsonl` without a server:\n+\n+```\n+cargo run -p sorterc -- compile path/to/doc.sorter [--base events.jsonl] [--room public] [--pretty]\n+cargo run -p sorterc -- scan path/to/events.jsonl [--pretty]\n+```\n+\n+`compile` validates DSL, simulates ingest against empty (or `--base`) reducer state, and prints JSON rankings. `scan` reports corrupt JSONL lines and ingests that fail DSL replay.\n+\n ### Testing\n \n - **Rust tests:** `cargo nextest run --workspace` (163 tests; requires `cargo-nextest`)\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex c1d477d21aea03aff00e6f0689b0b4379d0d68d2..ad8e31099c807fb5844acb16cd5086a2f19327a7 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -10,6 +10,7 @@ pub mod form_template;\n pub mod html;\n pub mod identity;\n pub mod middleware;\n+pub mod offline;\n pub mod path_types;\n pub mod ranking;\n pub mod reducer;\ndiff --git a/server/src/offline.rs b/server/src/offline.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..54ad0ded096a305ef8454ab2cdd1c3af71b14f5d\n--- /dev/null\n+++ b/server/src/offline.rs\n@@ -0,0 +1,333 @@\n+//! Offline `.sorter` compilation and JSONL diagnostics (no network, no auth).\n+\n+use std::collections::HashSet;\n+use std::path::Path;\n+\n+use serde::Serialize;\n+use slug_types::{CheckScopeRanking, RankComponent, RankRow, paths::GardenItemUrl};\n+\n+use crate::{\n+    api::{resolve_item, validate_ingest_document},\n+    dsl,\n+    events::{Event, Ingest},\n+    path_types::ItemId,\n+    reducer::{ReducerState, ScopeId, scope_from_room_wire},\n+    scope_rank::build_children_rankings,\n+};\n+\n+#[derive(Debug, Clone, Serialize)]\n+pub struct CompileStats {\n+    pub items: usize,\n+    pub votes: usize,\n+    pub prose_blocks: usize,\n+}\n+\n+#[derive(Debug, Serialize)]\n+pub struct CompileResult {\n+    pub ok: bool,\n+    pub threads: Vec<String>,\n+    pub rankings: Vec<CheckScopeRanking>,\n+    pub stats: CompileStats,\n+}\n+\n+#[derive(Debug, Clone, Serialize)]\n+pub struct CompileError {\n+    pub ok: bool,\n+    pub error: String,\n+    #[serde(skip_serializing_if = \"Option::is_none\")]\n+    pub hint: Option<String>,\n+}\n+\n+#[derive(Debug, Clone, Serialize)]\n+pub struct BadJsonLine {\n+    pub line: usize,\n+    pub message: String,\n+}\n+\n+#[derive(Debug, Clone, Serialize)]\n+pub struct MalformedIngest {\n+    pub line: usize,\n+    pub id: String,\n+    pub room_id: String,\n+    pub thread_tag: String,\n+    pub reason: String,\n+}\n+\n+#[derive(Debug, Clone, Serialize)]\n+pub struct ScanResult {\n+    pub ok: bool,\n+    pub path: String,\n+    pub total_lines: usize,\n+    pub parsed_events: usize,\n+    pub bad_json_lines: Vec<BadJsonLine>,\n+    pub malformed_ingests: Vec<MalformedIngest>,\n+    pub skipped_ingests: usize,\n+}\n+\n+fn document_stats(doc: &dsl::Document) -> CompileStats {\n+    let mut items = 0usize;\n+    let mut votes = 0usize;\n+    let mut prose_blocks = 0usize;\n+    for stmt in &doc.statements {\n+        match stmt {\n+            dsl::Stmt::Item { .. } => items += 1,\n+            dsl::Stmt::Vote { .. } => votes += 1,\n+            dsl::Stmt::Prose { .. } => prose_blocks += 1,\n+        }\n+    }\n+    CompileStats {\n+        items,\n+        votes,\n+        prose_blocks,\n+    }\n+}\n+\n+fn threads_in_document(text: &str) -> Vec<String> {\n+    let mut out = HashSet::new();\n+    for line in text.lines() {\n+        let trimmed = line.trim();\n+        if !trimmed.starts_with('#') {\n+            continue;\n+        }\n+        let rest = trimmed.trim_start_matches('#').trim();\n+        if rest.is_empty() {\n+            continue;\n+        }\n+        let tag = rest.split_whitespace().next().unwrap_or(rest);\n+        let tag = tag.split(':').next().unwrap_or(tag).trim();\n+        if tag.is_empty() {\n+            continue;\n+        }\n+        out.insert(format!(\"#{}\", crate::canonical_path::canonicalize_tag(tag)));\n+    }\n+    let mut tags: Vec<String> = out.into_iter().collect();\n+    tags.sort();\n+    tags\n+}\n+\n+fn voted_parent_scopes(doc: &dsl::Document) -> Vec<ItemId> {\n+    let mut parents = HashSet::new();\n+    for stmt in &doc.statements {\n+        if let dsl::Stmt::Vote { item1, item2, .. } = stmt {\n+            if let (Ok(a), Ok(b)) = (resolve_item(item1), resolve_item(item2)) {\n+                if let Some(p) = a.parent() {\n+                    parents.insert(p);\n+                }\n+                if let Some(p) = b.parent() {\n+                    parents.insert(p);\n+                }\n+            }\n+        }\n+    }\n+    let mut out: Vec<ItemId> = parents.into_iter().collect();\n+    out.sort();\n+    out\n+}\n+\n+fn rankings_for_simulated(\n+    simulated: &ReducerState,\n+    scope: &ScopeId,\n+    room_wire: &str,\n+    doc: &dsl::Document,\n+) -> Vec<CheckScopeRanking> {\n+    voted_parent_scopes(doc)\n+        .iter()\n+        .map(|parent| {\n+            let scoped_content = simulated\n+                .content_for_scope(&scope)\n+                .unwrap_or_else(|| simulated.public());\n+            let scoped = build_children_rankings(scoped_content, parent);\n+            let components: Vec<RankComponent> = scoped\n+                .component_rankings\n+                .into_iter()\n+                .map(|comp| RankComponent {\n+                    pairs: comp.pairs,\n+                    ranking: comp\n+                        .ranked\n+                        .into_iter()\n+                        .map(|r| RankRow {\n+                            item: GardenItemUrl::from_stored(&r.item, room_wire),\n+                            score: r.score,\n+                            percent: None,\n+                        })\n+                        .collect(),\n+                })\n+                .collect();\n+            CheckScopeRanking {\n+                parent: GardenItemUrl::from_stored(parent, room_wire).into_inner(),\n+                components,\n+                unranked_items: scoped\n+                    .unranked_items\n+                    .into_iter()\n+                    .map(|it| GardenItemUrl::from_stored(&it, room_wire))\n+                    .collect(),\n+            }\n+        })\n+        .collect()\n+}\n+\n+/// Validate and simulate one `.sorter` document against optional base reducer state.\n+pub fn compile_document(\n+    base: &ReducerState,\n+    room: &str,\n+    text: &str,\n+) -> Result<CompileResult, CompileError> {\n+    let room_key = room.trim();\n+    let scope = scope_from_room_wire(room_key);\n+    let validated = validate_ingest_document(base, text, &scope).map_err(|(_, message, hint)| {\n+        CompileError {\n+            ok: false,\n+            error: message,\n+            hint,\n+        }\n+    })?;\n+\n+    let event = Event::Ingest(Ingest {\n+        ts: validated.ts,\n+        id: uuid::Uuid::new_v4().to_string(),\n+        raw: validated.raw_text.clone(),\n+        principal: \"offline\".to_string(),\n+        delegate: None,\n+        room_id: room_key.to_string(),\n+        thread_tag: \"offline\".to_string(),\n+    });\n+\n+    let mut simulated = base.clone();\n+    simulated.apply_event(event);\n+\n+    Ok(CompileResult {\n+        ok: true,\n+        threads: threads_in_document(text),\n+        rankings: rankings_for_simulated(&simulated, &scope, room_key, &validated.doc),\n+        stats: document_stats(&validated.doc),\n+    })\n+}\n+\n+fn ingest_parse_error(raw: &str) -> Option<String> {\n+    dsl::parse_full(raw).err().map(|e| e.to_string())\n+}\n+\n+fn load_events_from_jsonl(path: &Path) -> Result<(Vec<(usize, Event)>, Vec<BadJsonLine>), std::io::Error> {\n+    let text = std::fs::read_to_string(path)?;\n+    let mut events = Vec::new();\n+    let mut bad_json_lines = Vec::new();\n+    for (idx, line) in text.lines().enumerate() {\n+        let line_no = idx + 1;\n+        let trimmed = line.trim();\n+        if trimmed.is_empty() {\n+            continue;\n+        }\n+        match serde_json::from_str::<Event>(trimmed) {\n+            Ok(ev) => events.push((line_no, ev)),\n+            Err(e) => bad_json_lines.push(BadJsonLine {\n+                line: line_no,\n+                message: e.to_string(),\n+            }),\n+        }\n+    }\n+    Ok((events, bad_json_lines))\n+}\n+\n+/// Replay a JSONL event log into reducer state (same rules as server boot).\n+pub fn load_reducer_from_jsonl(path: &Path) -> Result<(ReducerState, Vec<BadJsonLine>), std::io::Error> {\n+    let (events, bad_json_lines) = load_events_from_jsonl(path)?;\n+    let mut state = ReducerState::default();\n+    for (_line_no, ev) in events {\n+        state.apply_event(ev);\n+    }\n+    Ok((state, bad_json_lines))\n+}\n+\n+/// Scan an events.jsonl for corrupt JSON lines and ingests that fail DSL replay.\n+pub fn scan_jsonl(path: &Path) -> Result<ScanResult, std::io::Error> {\n+    let text = std::fs::read_to_string(path)?;\n+    let total_lines = text.lines().count();\n+    let (events, bad_json_lines) = load_events_from_jsonl(path)?;\n+\n+    let mut malformed_ingests = Vec::new();\n+    let mut skipped_ingests = 0usize;\n+    let mut state = ReducerState::default();\n+    let parsed_events = events.len();\n+\n+    for (line_no, ev) in events {\n+        if let Event::Ingest(ref ing) = ev {\n+            if let Some(reason) = ingest_parse_error(&ing.raw) {\n+                malformed_ingests.push(MalformedIngest {\n+                    line: line_no,\n+                    id: ing.id.clone(),\n+                    room_id: ing.room_id.clone(),\n+                    thread_tag: ing.thread_tag.clone(),\n+                    reason,\n+                });\n+            }\n+            let before = state.ingests_by_id.len();\n+            state.apply_event(ev);\n+            if state.ingests_by_id.len() == before {\n+                skipped_ingests += 1;\n+            }\n+        } else {\n+            state.apply_event(ev);\n+        }\n+    }\n+\n+    let ok = bad_json_lines.is_empty() && malformed_ingests.is_empty() && skipped_ingests == 0;\n+\n+    Ok(ScanResult {\n+        ok,\n+        path: path.display().to_string(),\n+        total_lines,\n+        parsed_events,\n+        bad_json_lines,\n+        malformed_ingests,\n+        skipped_ingests,\n+    })\n+}\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::*;\n+\n+    const TUTORIAL: &str = include_str!(\"../tests/fixtures/tutorial.sorter\");\n+\n+    #[test]\n+    fn compile_tutorial_fixture_emits_rankings() {\n+        let result = compile_document(&ReducerState::default(), \"public\", TUTORIAL).unwrap();\n+        assert!(result.ok);\n+        assert!(!result.threads.is_empty());\n+        assert!(result.stats.items >= 6);\n+        assert!(result.stats.votes >= 6);\n+        assert!(!result.rankings.is_empty());\n+    }\n+\n+    #[test]\n+    fn compile_rejects_vote_on_missing_item() {\n+        let err = compile_document(\n+            &ReducerState::default(),\n+            \"public\",\n+            \"{ reason }\\n~/missing/a 2:1 ~/missing/b\",\n+        )\n+        .unwrap_err();\n+        assert!(!err.ok);\n+        assert!(err.error.contains(\"undefined\"));\n+    }\n+\n+    #[test]\n+    fn scan_empty_jsonl_is_ok() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let path = dir.path().join(\"events.jsonl\");\n+        std::fs::write(&path, \"\").unwrap();\n+        let report = scan_jsonl(&path).unwrap();\n+        assert!(report.ok);\n+        assert!(report.bad_json_lines.is_empty());\n+    }\n+\n+    #[test]\n+    fn scan_reports_bad_json_line() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let path = dir.path().join(\"events.jsonl\");\n+        std::fs::write(&path, \"{not json}\\n\").unwrap();\n+        let report = scan_jsonl(&path).unwrap();\n+        assert!(!report.ok);\n+        assert_eq!(report.bad_json_lines.len(), 1);\n+    }\n+}\ndiff --git a/sorterc/Cargo.toml b/sorterc/Cargo.toml\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..92d477aff9b53291fb1a266db83065c1c800791d\n--- /dev/null\n+++ b/sorterc/Cargo.toml\n@@ -0,0 +1,18 @@\n+[package]\n+name = \"sorterc\"\n+version = \"0.0.1\"\n+edition = \"2021\"\n+license = \"MIT\"\n+publish = false\n+description = \"Offline .sorter compiler and events.jsonl linter (dev only)\"\n+\n+[[bin]]\n+name = \"sorterc\"\n+path = \"src/main.rs\"\n+\n+[dependencies]\n+anyhow = \"1\"\n+clap = { version = \"4\", features = [\"derive\"] }\n+serde = { version = \"1\", features = [\"derive\"] }\n+serde_json = \"1\"\n+slugsocial-server = { path = \"../server\" }\ndiff --git a/sorterc/readme.md b/sorterc/readme.md\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..1ebcc3fc935541ea9e47e0458ec67a750fe19fff\n--- /dev/null\n+++ b/sorterc/readme.md\n@@ -0,0 +1,92 @@\n+# sorterc\n+\n+Dev-only offline tooling for the slug `.sorter` DSL and `events.jsonl` event log.\n+\n+`sorterc` is **not** published via npm and does not talk to slug.social. It reuses the same parser, validator, and ranking code as the server, but runs entirely on local files.\n+\n+## Build\n+\n+From the repo root:\n+\n+```bash\n+cargo build -p sorterc\n+cargo run -p sorterc -- --help\n+```\n+\n+## Commands\n+\n+### `compile` — evaluate a `.sorter` document\n+\n+Reads a `.sorter` file (or `-` for stdin), validates the DSL, simulates one ingest against reducer state, and prints JSON rankings to stdout.\n+\n+```bash\n+cargo run -p sorterc -- compile path/to/doc.sorter\n+cargo run -p sorterc -- compile path/to/doc.sorter --pretty\n+cargo run -p sorterc -- compile - --pretty                    # stdin\n+cargo run -p sorterc -- compile doc.sorter --base events.jsonl  # seed garden from log\n+cargo run -p sorterc -- compile doc.sorter --room public         # default room\n+```\n+\n+**Flags**\n+\n+| Flag | Description |\n+|------|-------------|\n+| `--base PATH` | Replay an `events.jsonl` first, then compile against that garden state |\n+| `--room ID` | Room wire id (`public` or private room id). Default: `public` |\n+| `--pretty` | Pretty-print JSON |\n+\n+**Success output** (shape):\n+\n+```json\n+{\n+  \"ok\": true,\n+  \"threads\": [\"#my-thread\"],\n+  \"rankings\": [ … ],\n+  \"stats\": { \"items\": 3, \"votes\": 2, \"prose_blocks\": 5 }\n+}\n+```\n+\n+Rankings use the same structure as the server's dry-run check: parent scope, connected components, scores, unranked items.\n+\n+**Error output** exits with code 1:\n+\n+```json\n+{\n+  \"ok\": false,\n+  \"error\": \"parse error\",\n+  \"hint\": \"…\"\n+}\n+```\n+\n+### `scan` — lint an `events.jsonl`\n+\n+Reads a JSONL event log and reports problems without starting a server.\n+\n+```bash\n+cargo run -p sorterc -- scan events.jsonl\n+cargo run -p sorterc -- scan events.jsonl --pretty\n+```\n+\n+Reports:\n+\n+- **bad JSON lines** — lines that are not valid JSON\n+- **malformed ingests** — ingest events whose `raw` DSL fails to parse\n+- **skipped ingests** — ingests dropped during replay (same behavior as server boot)\n+\n+Exits 0 when clean, 1 when any issue is found.\n+\n+## Typical uses\n+\n+- Iterate on `.sorter` files in an editor and pipe through `compile` to see rankings instantly\n+- Verify a downloaded or edited `events.jsonl` before uploading to Fly\n+- Debug \"malformed ingest\" warnings from production boot logs\n+- CI or pre-commit checks on fixture docs (no OAuth, no network)\n+\n+## What it does not do\n+\n+- Post to slug.social or append to a live log\n+- Authenticate users or bind agents\n+- Run browser/UI tests\n+- Replace `slugsocial public check` for operators who want the full RPC path against a running server\n+\n+For live server dry-run against current garden state, use `npx slugsocial public check` or `POST /try/check` in the browser.\ndiff --git a/sorterc/src/main.rs b/sorterc/src/main.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..71382c180085cb0ad71043c852f8db5d3a48a284\n--- /dev/null\n+++ b/sorterc/src/main.rs\n@@ -0,0 +1,117 @@\n+use std::path::{Path, PathBuf};\n+\n+use anyhow::{bail, Context, Result};\n+use clap::{Parser, Subcommand};\n+use slugsocial_server::{\n+    offline::{self, CompileError, CompileResult, ScanResult},\n+    reducer::ReducerState,\n+};\n+\n+#[derive(Parser)]\n+#[command(\n+    name = \"sorterc\",\n+    about = \"Offline .sorter compiler and events.jsonl linter (dev only)\",\n+    version\n+)]\n+struct Cli {\n+    #[command(subcommand)]\n+    cmd: Command,\n+}\n+\n+#[derive(Subcommand)]\n+enum Command {\n+    /// Parse and simulate a .sorter document; emit ranking JSON to stdout.\n+    Compile {\n+        /// `.sorter` file, or `-` for stdin.\n+        file: PathBuf,\n+        /// Room wire id (`public` or private room id).\n+        #[arg(long, default_value = \"public\")]\n+        room: String,\n+        /// Optional events.jsonl to replay before compiling (seed garden state).\n+        #[arg(long)]\n+        base: Option<PathBuf>,\n+        /// Pretty-print JSON.\n+        #[arg(long)]\n+        pretty: bool,\n+    },\n+    /// Scan an events.jsonl for corrupt JSON lines and malformed ingests.\n+    Scan {\n+        file: PathBuf,\n+        #[arg(long)]\n+        pretty: bool,\n+    },\n+}\n+\n+fn read_input(path: &Path) -> Result<String> {\n+    if path.as_os_str() == \"-\" {\n+        use std::io::Read;\n+        let mut buf = String::new();\n+        std::io::stdin().read_to_string(&mut buf)?;\n+        Ok(buf)\n+    } else {\n+        std::fs::read_to_string(path)\n+            .with_context(|| format!(\"read {}\", path.display()))\n+    }\n+}\n+\n+fn load_base_state(base: Option<&Path>) -> Result<ReducerState> {\n+    let Some(path) = base else {\n+        return Ok(ReducerState::default());\n+    };\n+    let (state, bad_lines) = offline::load_reducer_from_jsonl(path)\n+        .with_context(|| format!(\"load base jsonl {}\", path.display()))?;\n+    if !bad_lines.is_empty() {\n+        bail!(\n+            \"base jsonl has {} corrupt line(s); fix or omit --base\",\n+            bad_lines.len()\n+        );\n+    }\n+    Ok(state)\n+}\n+\n+fn print_json<T: serde::Serialize>(value: &T, pretty: bool) -> Result<()> {\n+    if pretty {\n+        println!(\"{}\", serde_json::to_string_pretty(value)?);\n+    } else {\n+        println!(\"{}\", serde_json::to_string(value)?);\n+    }\n+    Ok(())\n+}\n+\n+fn run_compile(file: PathBuf, room: String, base: Option<PathBuf>, pretty: bool) -> Result<()> {\n+    let text = read_input(&file)?;\n+    let base_state = load_base_state(base.as_deref())?;\n+    match offline::compile_document(&base_state, &room, &text) {\n+        Ok(result) => {\n+            print_json::<CompileResult>(&result, pretty)?;\n+            Ok(())\n+        }\n+        Err(err) => {\n+            print_json::<CompileError>(&err, pretty)?;\n+            std::process::exit(1);\n+        }\n+    }\n+}\n+\n+fn run_scan(file: PathBuf, pretty: bool) -> Result<()> {\n+    let report = offline::scan_jsonl(&file)\n+        .with_context(|| format!(\"scan {}\", file.display()))?;\n+    print_json::<ScanResult>(&report, pretty)?;\n+    if !report.ok {\n+        std::process::exit(1);\n+    }\n+    Ok(())\n+}\n+\n+fn main() -> Result<()> {\n+    let cli = Cli::parse();\n+    match cli.cmd {\n+        Command::Compile {\n+            file,\n+            room,\n+            base,\n+            pretty,\n+        } => run_compile(file, room, base, pretty),\n+        Command::Scan { file, pretty } => run_scan(file, pretty),\n+    }\n+}\n","role":"user"}],"model":"~x-ai/grok-latest"}