{"messages":[{"content":"You are ranking individual git commits to an open source project.\nCompare these two commits. Decide which commit contributed more.\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[00be3a29] invite system\n\nSide A — unified diff (full patch):\ndiff --git a/bb.edn b/bb.edn\nindex 50be8232847e672b3f273a2fb25ddd1d12adb7e2..818f850765370d12d58f239e287764fc3649d78b 100644\n--- a/bb.edn\n+++ b/bb.edn\n@@ -47,14 +47,16 @@\n                                            \"RUST_LOG\"      \"info\"})})))}\n \n   test\n-  {:doc \"Full test suite: integration + auth + grants\"\n+  {:doc \"Full test suite: integration + auth + grants + invites\"\n    :requires ([test.integration :as integration]\n               [test.auth :as auth]\n-              [test.grants :as grants])\n+              [test.grants :as grants]\n+              [test.invites :as invites])\n    :task (do\n            (integration/integration)\n            (auth/auth-test)\n-           (grants/grants-test))}\n+           (grants/grants-test)\n+           (invites/invites-test))}\n \n   perf\n   {:doc \"Performance test: concurrent HTTP requests to detect blocking I/O\"\ndiff --git a/cli/src/main.rs b/cli/src/main.rs\nindex e5833b0b93d8e667b94c574ba2b0f8cb758ff3df..8eda9f485bd1f7392f1e34be27176c21e20354eb 100644\n--- a/cli/src/main.rs\n+++ b/cli/src/main.rs\n@@ -105,6 +105,23 @@ enum ScopedCmd {\n         #[arg(long)]\n         json: bool,\n     },\n+\n+    /// Mint a shareable invite link (24h TTL, in-memory until redeemed). Requires Manage on the room.\n+    InviteLink {\n+        /// Comma-separated: view, post, vote, add_item, manage\n+        #[arg(long = \"caps\", value_delimiter = ',')]\n+        caps: Vec<String>,\n+        #[arg(long, default_value_t = 1)]\n+        uses: usize,\n+        #[arg(long)]\n+        json: bool,\n+    },\n+\n+    /// List principals granted access in this room (requires View or Manage)\n+    Audit {\n+        #[arg(long)]\n+        json: bool,\n+    },\n }\n \n #[derive(Subcommand, Debug)]\n@@ -514,17 +531,35 @@ fn print_thread(resp: &ThreadDetailResponse) {\n         .duration_since(std::time::UNIX_EPOCH)\n         .unwrap_or_default()\n         .as_millis() as i64;\n-    if resp.total > resp.posts.len() {\n-        let end = resp.offset + resp.posts.len();\n-        eprintln!(\"# showing {}-{} of {} posts  (--offset N --limit N to paginate)\", resp.offset, end.saturating_sub(1), resp.total);\n+    if resp.total > resp.items.len() {\n+        let end = resp.offset + resp.items.len();\n+        eprintln!(\n+            \"# showing {}-{} of {} rows  (--offset N --limit N to paginate)\",\n+            resp.offset,\n+            end.saturating_sub(1),\n+            resp.total\n+        );\n     }\n-    for (i, post) in resp.posts.iter().enumerate() {\n-        let timeago = slug_types::timeago::timeago_compact(now_ms, post.ts);\n-        let body = &post.body.trim();\n-        println!(\"<post index=\\\"{}\\\" timeago=\\\"{}\\\">\", post.index, timeago);\n-        println!(\"{}\", body);\n-        println!(\"</post>\");\n-        if i + 1 < resp.posts.len() {\n+    for (i, item) in resp.items.iter().enumerate() {\n+        match item {\n+            ThreadItem::Post {\n+                index,\n+                ts,\n+                body,\n+                ..\n+            } => {\n+                let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);\n+                let body = body.trim();\n+                println!(\"<post index=\\\"{}\\\" timeago=\\\"{}\\\">\", index, timeago);\n+                println!(\"{}\", body);\n+                println!(\"</post>\");\n+            }\n+            ThreadItem::System { ts, text } => {\n+                let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);\n+                println!(\"<system timeago=\\\"{}\\\">{}</system>\", timeago, text.trim());\n+            }\n+        }\n+        if i + 1 < resp.items.len() {\n             println!();\n             println!();\n         }\n@@ -1036,6 +1071,95 @@ async fn run_scoped(base: &str, room: &str, sub: ScopedCmd) -> Result<()> {\n                 }\n             }\n         },\n+        ScopedCmd::InviteLink { caps, uses, json } => {\n+            let caps: Vec<String> = caps\n+                .into_iter()\n+                .flat_map(|s| {\n+                    s.split(',')\n+                        .map(|p| p.trim().to_lowercase())\n+                        .filter(|p| !p.is_empty())\n+                        .collect::<Vec<_>>()\n+                })\n+                .collect();\n+            if caps.is_empty() {\n+                return Err(anyhow!(\"--caps is required (e.g. --caps view,post,vote)\"));\n+            }\n+            let bearer = effective_bearer().ok_or_else(|| {\n+                anyhow!(\n+                    \"no bearer token: run `slugsocial identity start --rig <rig> --model <model>` \\\n+                     then `slugsocial identity poll <session>`, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token\"\n+                )\n+            })?;\n+            let batch = send_rpc(\n+                &client,\n+                base,\n+                Some(&bearer),\n+                vec![RpcCommand::RoomMintInvite {\n+                    room: room.to_string(),\n+                    capabilities: caps,\n+                    max_uses: uses,\n+                }],\n+            )\n+            .await?;\n+            match rpc_line_ok(&batch.results[0])? {\n+                RpcResult::RoomInviteMinted {\n+                    invite_url,\n+                    expires_at_ms,\n+                    max_uses,\n+                } => {\n+                    if json {\n+                        println!(\n+                            \"{}\",\n+                            serde_json::to_string_pretty(&serde_json::json!({\n+                                \"invite_url\": invite_url,\n+                                \"expires_at_ms\": expires_at_ms,\n+                                \"max_uses\": max_uses,\n+                            }))?\n+                        );\n+                    } else {\n+                        println!(\"{invite_url}\");\n+                        println!(\"(Expires in 24 hours. Max uses: {max_uses})\");\n+                    }\n+                }\n+                _ => return Err(anyhow!(\"unexpected RPC result\")),\n+            }\n+        }\n+        ScopedCmd::Audit { json } => {\n+            let bearer = effective_bearer().ok_or_else(|| {\n+                anyhow!(\n+                    \"no bearer token: run `slugsocial identity start --rig <rig> --model <model>` \\\n+                     then `slugsocial identity poll <session>`, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token\"\n+                )\n+            })?;\n+            let batch = send_rpc(\n+                &client,\n+                base,\n+                Some(&bearer),\n+                vec![RpcCommand::RoomAudit {\n+                    room: room.to_string(),\n+                }],\n+            )\n+            .await?;\n+            match rpc_line_ok(&batch.results[0])? {\n+                RpcResult::RoomAudit(resp) => {\n+                    if json {\n+                        println!(\"{}\", serde_json::to_string_pretty(&resp)?);\n+                    } else {\n+                        println!(\"room {}\", resp.room);\n+                        if resp.grants.is_empty() {\n+                            println!(\"(no grants recorded)\");\n+                        } else {\n+                            let w_user = resp.grants.iter().map(|g| g.username.len()).max().unwrap_or(0);\n+                            for g in &resp.grants {\n+                                let caps = g.capabilities.join(\", \");\n+                                println!(\"{:<width$}  {}\", g.username, caps, width = w_user.max(8));\n+                            }\n+                        }\n+                    }\n+                }\n+                _ => return Err(anyhow!(\"unexpected RPC result\")),\n+            }\n+        }\n         ScopedCmd::Check { file, json } => {\n             let mut text = String::new();\n             match file {\ndiff --git a/server/src/api/auth.rs b/server/src/api/auth.rs\nindex 995ce4a61d29b024c399c656134f541ecfd880cf..b45ba39419c84af8bf2333fc9b7d47e98525c45f 100644\n--- a/server/src/api/auth.rs\n+++ b/server/src/api/auth.rs\n@@ -12,12 +12,61 @@ use tokio::sync::RwLock;\n \n use crate::{\n     api::helpers::{api_error, now_ms, sha256_hex},\n-    events::{Event, TokenIssued, UserRegistered},\n+    events::{Event, GrantAdded, TokenIssued, UserRegistered},\n     identity::{parse_agent, parse_username},\n     html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},\n     state::{AppState, PendingSession},\n };\n \n+/// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).\n+const INVITE_BROWSER_AGENT: &str = \"00000000-0000-0000-0000-000000000000:invite:web/join\";\n+\n+async fn apply_invite_redemption(state: &AppState, invite_token: &str, grantee_username: &str) -> Result<(), String> {\n+    let now = now_ms();\n+    let ga = {\n+        let mut invites = state.invites.write().await;\n+        let Some(inv) = invites.get_mut(invite_token) else {\n+            return Err(\"invite not found\".into());\n+        };\n+        if now > inv.expires_at_ms {\n+            invites.remove(invite_token);\n+            return Err(\"invite expired\".into());\n+        }\n+        if inv.current_uses >= inv.max_uses {\n+            return Err(\"invite exhausted\".into());\n+        }\n+        inv.current_uses += 1;\n+        Event::GrantAdded(GrantAdded {\n+            ts: now,\n+            room_id: inv.room_id.clone(),\n+            username: grantee_username.to_string(),\n+            capabilities: inv.capabilities.clone(),\n+            granted_by: inv.inviter.clone(),\n+        })\n+    };\n+\n+    match state.event_log.append(&ga).await {\n+        Ok(()) => {\n+            let mut reduced = state.reduced.write().await;\n+            reduced.apply_event(ga);\n+            let mut invites = state.invites.write().await;\n+            if let Some(inv) = invites.get(invite_token) {\n+                if inv.current_uses >= inv.max_uses {\n+                    invites.remove(invite_token);\n+                }\n+            }\n+            Ok(())\n+        }\n+        Err(e) => {\n+            let mut invites = state.invites.write().await;\n+            if let Some(inv) = invites.get_mut(invite_token) {\n+                inv.current_uses = inv.current_uses.saturating_sub(1);\n+            }\n+            Err(format!(\"{e}\"))\n+        }\n+    }\n+}\n+\n fn pending_sessions(state: &AppState) -> Arc<RwLock<HashMap<String, PendingSession>>> {\n     state.pending_sessions.clone()\n }\n@@ -115,6 +164,42 @@ pub struct AuthLoginQuery {\n     pub session: String,\n }\n \n+pub async fn get_join_invite(Path(token): Path<String>, State(state): State<AppState>) -> impl IntoResponse {\n+    let token = token.trim().to_string();\n+    if token.is_empty() {\n+        return api_error(StatusCode::NOT_FOUND, \"invite invalid or expired\", None).into_response();\n+    }\n+    let now = now_ms();\n+    let valid = {\n+        let invites = state.invites.read().await;\n+        match invites.get(&token) {\n+            None => false,\n+            Some(inv) => now <= inv.expires_at_ms && inv.current_uses < inv.max_uses,\n+        }\n+    };\n+    if !valid {\n+        return api_error(StatusCode::NOT_FOUND, \"invite invalid or expired\", None).into_response();\n+    }\n+\n+    let session = format!(\"p_{}\", uuid::Uuid::new_v4().simple());\n+    let s = PendingSession {\n+        agent: INVITE_BROWSER_AGENT.to_string(),\n+        created_ts: now_ms(),\n+        provider: None,\n+        provider_id: None,\n+        redeem_invite: Some(token),\n+        complete: None,\n+    };\n+    state.pending_sessions.write().await.insert(session.clone(), s);\n+\n+    let public_url = std::env::var(\"SLUG_PUBLIC_URL\").unwrap_or_else(|_| \"http://127.0.0.1:8080\".to_string());\n+    Redirect::temporary(&format!(\n+        \"{public_url}/auth/login?session={}\",\n+        urlencoding::encode(&session)\n+    ))\n+    .into_response()\n+}\n+\n pub async fn get_auth_login(Query(q): Query<AuthLoginQuery>, State(state): State<AppState>) -> impl IntoResponse {\n     // Redirect to Google auth endpoint.\n     let sessions = pending_sessions(&state);\n@@ -205,6 +290,7 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):\n         s.provider = Some(\"google\".to_string());\n         s.provider_id = Some(sub.clone());\n         if let Some(username) = existing {\n+            let invite_tok = s.redeem_invite.clone();\n             let (bearer, token_event) = issue_token_for_user(&username);\n             // append token event\n             let ev = Event::TokenIssued(token_event);\n@@ -215,6 +301,11 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):\n                 let mut reduced = reduced_arc.write().await;\n                 reduced.apply_event(ev);\n             }\n+            if let Some(tok) = invite_tok {\n+                if let Err(e) = apply_invite_redemption(&state, &tok, &username).await {\n+                    tracing::warn!(error = %e, \"invite redemption skipped after oauth\");\n+                }\n+            }\n             s.complete = Some((username, bearer));\n             return Redirect::temporary(&format!(\"{public_url}/auth/complete\")).into_response();\n         }\n@@ -310,6 +401,16 @@ pub async fn post_choose_username(\n         reduced.apply_event(ti_ev.clone());\n     }\n \n+    // Redeem invite (if any) before marking the session complete.\n+    if let Some(tok) = {\n+        let sessions_read = sessions.read().await;\n+        sessions_read.get(&form.session).and_then(|s| s.redeem_invite.clone())\n+    } {\n+        if let Err(e) = apply_invite_redemption(&state, &tok, &canon_user).await {\n+            tracing::warn!(error = %e, \"invite redemption skipped after registration\");\n+        }\n+    }\n+\n     // Mark complete for polling.\n     {\n         let mut sessions_write = sessions.write().await;\n@@ -339,6 +440,7 @@ pub async fn post_pending_session(\n         created_ts: now_ms(),\n         provider: None,\n         provider_id: None,\n+        redeem_invite: None,\n         complete: None,\n     };\n     let sessions = pending_sessions(&state);\ndiff --git a/server/src/api/mod.rs b/server/src/api/mod.rs\nindex a1ea432932cdca0e42dc7377f0a25075fd5644c0..cb031aecebad1107dfa2898a98fb6084b28ba6e9 100644\n--- a/server/src/api/mod.rs\n+++ b/server/src/api/mod.rs\n@@ -4,6 +4,7 @@ mod rpc;\n mod validate;\n \n pub use auth::{\n+    get_join_invite,\n     get_pending_session,\n     get_whoami,\n     post_pending_session,\ndiff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs\nindex 11a76ed7a02aae588edadb7a87a43660f5669d9e..f6bbc3df71909a2da7403cd46fe4ea6ca130c692 100644\n--- a/server/src/api/rpc.rs\n+++ b/server/src/api/rpc.rs\n@@ -13,12 +13,14 @@ use slug_types::*;\n use crate::{\n     canonical_path::{canonicalize_item, canonicalize_tag},\n     dsl,\n-    events::{AgentBound, Event, GrantAdded, Ingest, RoomCreated, ThreadCapability, ThreadVisibility},\n+    events::{\n+        AgentBound, Event, GrantAdded, Ingest, RoomCreated, ThreadCapability, ThreadVisibility,\n+    },\n     identity::{parse_agent, parse_username},\n     path_types::CanonicalItemUrl,\n     ranking::{connected_components_from_voted_pairs, ranked_items_subset},\n     reducer::{scope_from_room_wire, ReducerState, ScopeId},\n-    state::AppState,\n+    state::{AppState, InviteState},\n };\n \n use super::auth::verify_bearer_principal;\n@@ -142,6 +144,27 @@ fn gen_short_id() -> String {\n     (0..7).map(|_| ALPHABET[rng.gen_range(0..ALPHABET.len())] as char).collect()\n }\n \n+fn gen_invite_token() -> String {\n+    use rand::Rng;\n+    const ALPHABET: &[u8] = b\"0123456789abcdefghijklmnopqrstuvwxyz\";\n+    let mut rng = rand::thread_rng();\n+    let tail: String = (0..16).map(|_| ALPHABET[rng.gen_range(0..ALPHABET.len())] as char).collect();\n+    format!(\"inv_{tail}\")\n+}\n+\n+const INVITE_TTL_MS: i64 = 86_400_000;\n+\n+fn capability_wire(c: ThreadCapability) -> String {\n+    match c {\n+        ThreadCapability::View => \"view\",\n+        ThreadCapability::Post => \"post\",\n+        ThreadCapability::Vote => \"vote\",\n+        ThreadCapability::AddItem => \"add_item\",\n+        ThreadCapability::Manage => \"manage\",\n+    }\n+    .to_string()\n+}\n+\n fn build_rank_response_for_content(\n     content: &crate::reducer::ContentState,\n     parent: Option<&str>,\n@@ -512,7 +535,7 @@ fn rpc_forum_thread_detail(\n             None => Err((\"post not found\".into(), None)),\n             Some((idx, ing)) => Ok(ThreadDetailResponse {\n                 thread: format!(\"#{}\", tag),\n-                posts: vec![PostRow {\n+                items: vec![ThreadItem::Post {\n                     id: ing.id.clone(),\n                     index: idx,\n                     ts: ing.ts,\n@@ -543,7 +566,7 @@ fn rpc_forum_thread_detail(\n \n     let total = filtered.len();\n     const MAX_BODY: usize = 2000;\n-    let posts: Vec<PostRow> = filtered\n+    let items: Vec<ThreadItem> = filtered\n         .into_iter()\n         .skip(offset)\n         .take(limit)\n@@ -553,7 +576,7 @@ fn rpc_forum_thread_detail(\n             } else {\n                 (ing.raw.clone(), false)\n             };\n-            PostRow {\n+            ThreadItem::Post {\n                 id: ing.id.clone(),\n                 index: idx,\n                 ts: ing.ts,\n@@ -566,7 +589,7 @@ fn rpc_forum_thread_detail(\n \n     Ok(ThreadDetailResponse {\n         thread: format!(\"#{}\", tag),\n-        posts,\n+        items,\n         total,\n         offset,\n     })\n@@ -1007,7 +1030,7 @@ pub async fn handle_rpc_batch(\n             RpcCommand::RoomGrant {\n                 room,\n                 username,\n-                capability,\n+                capabilities,\n             } => {\n                 let principal = {\n                     let reduced = state.reduced.read().await;\n@@ -1022,6 +1045,8 @@ pub async fn handle_rpc_batch(\n                         };\n                         if !can_manage {\n                             line_err(\"requires Manage capability\", None)\n+                        } else if capabilities.is_empty() {\n+                            line_err(\"capabilities must not be empty\", None)\n                         } else {\n                             match parse_username(&username) {\n                                 Err(msg) => line_err(\"invalid username\", Some(msg)),\n@@ -1033,14 +1058,18 @@ pub async fn handle_rpc_batch(\n                                     if !user_exists {\n                                         line_err(format!(\"user @{target} not found\"), None)\n                                     } else {\n-                                        match parse_capability(&capability) {\n+                                        let caps: Result<Vec<ThreadCapability>, String> = capabilities\n+                                            .iter()\n+                                            .map(|c| parse_capability(c.trim()))\n+                                            .collect();\n+                                        match caps {\n                                             Err(msg) => line_err(msg, None),\n-                                            Ok(cap) => {\n+                                            Ok(caps) => {\n                                                 let ga_ev = Event::GrantAdded(GrantAdded {\n                                                     ts: now_ms(),\n                                                     room_id: room,\n                                                     username: target,\n-                                                    capabilities: vec![cap],\n+                                                    capabilities: caps,\n                                                     granted_by: principal,\n                                                 });\n                                                 if let Err(e) = state.event_log.append(&ga_ev).await {\n@@ -1059,6 +1088,114 @@ pub async fn handle_rpc_batch(\n                     }\n                 }\n             }\n+            RpcCommand::RoomMintInvite {\n+                room,\n+                capabilities,\n+                max_uses,\n+            } => {\n+                let principal = {\n+                    let reduced = state.reduced.read().await;\n+                    verify_bearer_principal(&headers, &*reduced)\n+                };\n+                match principal {\n+                    Err((_, m)) => line_err(m, None),\n+                    Ok(principal) => {\n+                        let can_manage = {\n+                            let reduced = state.reduced.read().await;\n+                            reduced.user_has_cap(&room, &principal, ThreadCapability::Manage)\n+                        };\n+                        if !can_manage {\n+                            line_err(\"requires Manage capability\", None)\n+                        } else if capabilities.is_empty() {\n+                            line_err(\"capabilities must not be empty\", None)\n+                        } else {\n+                            match capabilities\n+                                .iter()\n+                                .map(|c| parse_capability(c.trim()))\n+                                .collect::<Result<Vec<ThreadCapability>, String>>()\n+                            {\n+                                Err(msg) => line_err(msg, None),\n+                                Ok(caps) => {\n+                                    let max_uses = max_uses.max(1).min(100_000);\n+                                    let now = now_ms();\n+                                    let expires_at_ms = now + INVITE_TTL_MS;\n+                                    let token = loop {\n+                                        let t = gen_invite_token();\n+                                        let taken = {\n+                                            let invites = state.invites.read().await;\n+                                            invites.contains_key(&t)\n+                                        };\n+                                        if !taken {\n+                                            break t;\n+                                        }\n+                                    };\n+                                    let inv = InviteState {\n+                                        room_id: room.clone(),\n+                                        capabilities: caps,\n+                                        expires_at_ms,\n+                                        max_uses,\n+                                        current_uses: 0,\n+                                        inviter: principal,\n+                                    };\n+                                    state.invites.write().await.insert(token.clone(), inv);\n+                                    let public_url = std::env::var(\"SLUG_PUBLIC_URL\")\n+                                        .unwrap_or_else(|_| \"http://127.0.0.1:8080\".to_string());\n+                                    let invite_url = format!(\"{public_url}/join/{token}\");\n+                                    line_ok(RpcResult::RoomInviteMinted {\n+                                        invite_url,\n+                                        expires_at_ms: Some(expires_at_ms),\n+                                        max_uses,\n+                                    })\n+                                }\n+                            }\n+                        }\n+                    }\n+                }\n+            }\n+            RpcCommand::RoomAudit { room } => {\n+                let principal = {\n+                    let reduced = state.reduced.read().await;\n+                    verify_bearer_principal(&headers, &*reduced)\n+                };\n+                match principal {\n+                    Err((_, m)) => line_err(m, None),\n+                    Ok(principal) => {\n+                        let reduced = state.reduced.read().await;\n+                        if !reduced.rooms.contains_key(&room) {\n+                            line_err(\"unknown room\", None)\n+                        } else {\n+                            let can_audit = reduced.user_has_cap(&room, &principal, ThreadCapability::View)\n+                                || reduced.user_has_cap(&room, &principal, ThreadCapability::Manage);\n+                            if !can_audit {\n+                                line_err(\"requires View or Manage capability\", None)\n+                            } else {\n+                                let grants: Vec<RoomAuditEntry> = reduced\n+                                    .grants\n+                                    .get(&room)\n+                                    .map(|m| {\n+                                        let mut v: Vec<RoomAuditEntry> = m\n+                                            .iter()\n+                                            .map(|(username, caps)| {\n+                                                let mut c: Vec<String> =\n+                                                    caps.iter().copied().map(capability_wire).collect();\n+                                                c.sort();\n+                                                RoomAuditEntry {\n+                                                    username: username.clone(),\n+                                                    capabilities: c,\n+                                                }\n+                                            })\n+                                            .collect();\n+                                        v.sort_by(|a, b| a.username.cmp(&b.username));\n+                                        v\n+                                    })\n+                                    .unwrap_or_default();\n+                                line_ok(RpcResult::RoomAudit(RoomAuditResponse { room, grants }))\n+                            }\n+                        }\n+                    }\n+                }\n+            }\n+            RpcCommand::RoomRevoke { .. } => line_err(\"RoomRevoke is not implemented yet\", None),\n             RpcCommand::GetGlobalRank {\n                 room,\n                 limit,\ndiff --git a/server/src/events.rs b/server/src/events.rs\nindex 125005d89ade7b22c9b6d997f0ed81781df5e7ec..9e60f2c218f5c871a93e855e415dd984e3a017c5 100644\n--- a/server/src/events.rs\n+++ b/server/src/events.rs\n@@ -26,6 +26,8 @@ pub enum Event {\n     RoomCreated(RoomCreated),\n     GrantAdded(GrantAdded),\n     GrantRevoked(GrantRevoked),\n+    InviteMinted(InviteMinted),\n+    InviteRedeemed(InviteRedeemed),\n     /// Ingest of a DSL+prose body. Identity and routing live in event metadata.\n     Ingest(Ingest),\n }\n@@ -82,6 +84,25 @@ pub struct GrantRevoked {\n     pub revoked_by: String,\n }\n \n+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n+pub struct InviteMinted {\n+    pub ts: i64,\n+    pub token: String,\n+    pub room_id: String,\n+    pub capabilities: Vec<ThreadCapability>,\n+    pub inviter: String,\n+    pub max_uses: u32,\n+    #[serde(default, skip_serializing_if = \"Option::is_none\")]\n+    pub expires_ts_ms: Option<i64>,\n+}\n+\n+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n+pub struct InviteRedeemed {\n+    pub ts: i64,\n+    pub token: String,\n+    pub username: String,\n+}\n+\n #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n pub struct Ingest {\n     /// Unix timestamp in milliseconds.\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex d00b56d909e1fabd1d122d054dd02785e13e0bd8..bf2f73d4d0f26a357961e88c52c3b4f72626af81 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -27,6 +27,7 @@ pub fn create_app(state: AppState) -> Router {\n     Router::new()\n         .route(\"/healthz\", axum::routing::get(|| async { \"ok\" }))\n         .route(\"/static/:filename\", axum::routing::get(crate::html::serve_theme_css))\n+        .route(\"/join/:token\", axum::routing::get(api::get_join_invite))\n         .route(\"/auth/login\", axum::routing::get(api::get_auth_login))\n         .route(\"/auth/callback\", axum::routing::get(api::get_auth_callback))\n         .route(\"/auth/complete\", axum::routing::get(api::get_auth_complete))\ndiff --git a/server/src/reducer.rs b/server/src/reducer.rs\nindex 118cb19f4df4a083df2878ca7a1424f3d63de851..5190d0a7ee3d545a786a68fef483322aafdce7f9 100644\n--- a/server/src/reducer.rs\n+++ b/server/src/reducer.rs\n@@ -3,7 +3,7 @@ use std::collections::{HashMap, HashSet, VecDeque};\n use serde::{Deserialize, Serialize};\n \n use crate::canonical_path::canonicalize_tag;\n-use crate::events::{Event, Ingest, ThreadCapability};\n+use crate::events::{Event, Ingest, ThreadCapability, ThreadVisibility};\n use crate::path_types::CanonicalItemUrl;\n \n #[derive(Debug, Clone, Hash, PartialEq, Eq, PartialOrd, Ord)]\n@@ -156,6 +156,41 @@ pub struct RoomState {\n     pub visibility: crate::events::ThreadVisibility,\n }\n \n+/// Durable invite link state (from [`crate::events::InviteMinted`] / [`crate::events::InviteRedeemed`]).\n+#[derive(Debug, Clone)]\n+pub struct ActiveInviteState {\n+    pub room_id: String,\n+    pub capabilities: HashSet<ThreadCapability>,\n+    pub inviter: String,\n+    pub uses_remaining: u32,\n+    pub expires_ts_ms: Option<i64>,\n+}\n+\n+#[derive(Clone, Debug)]\n+pub enum RoomTimelineKind {\n+    RoomCreated {\n+        owner: String,\n+        slug: String,\n+        visibility: ThreadVisibility,\n+    },\n+    GrantAdded {\n+        username: String,\n+        granted_by: String,\n+        capabilities: Vec<ThreadCapability>,\n+    },\n+    GrantRevoked {\n+        username: String,\n+        revoked_by: String,\n+        capabilities: Vec<ThreadCapability>,\n+    },\n+}\n+\n+#[derive(Clone, Debug)]\n+pub struct RoomTimelineEntry {\n+    pub ts: i64,\n+    pub kind: RoomTimelineKind,\n+}\n+\n #[derive(Debug, Clone)]\n pub struct ForumThreadState {\n     pub last_activity_ts: i64,\n@@ -210,6 +245,10 @@ pub struct ReducerState {\n     pub ingests_ordered: Vec<String>,\n     /// room_id → username → capabilities\n     pub grants: HashMap<String, HashMap<String, HashSet<ThreadCapability>>>,\n+    /// room_id → chronological room admin lines (for thread UI).\n+    pub room_timeline: HashMap<String, Vec<RoomTimelineEntry>>,\n+    /// Invite token → active invite (absent when fully consumed or never minted).\n+    pub invites: HashMap<String, ActiveInviteState>,\n }\n \n impl ReducerState {\n@@ -225,6 +264,20 @@ impl ReducerState {\n             .unwrap_or(false)\n     }\n \n+    /// Invite link is present, not expired, and has uses left.\n+    pub fn invite_token_active(&self, token: &str, now_ms: i64) -> Option<&ActiveInviteState> {\n+        let inv = self.invites.get(token)?;\n+        if inv.uses_remaining == 0 {\n+            return None;\n+        }\n+        if let Some(exp) = inv.expires_ts_ms {\n+            if now_ms > exp {\n+                return None;\n+            }\n+        }\n+        Some(inv)\n+    }\n+\n     pub fn content_for_scope_mut(&mut self, scope: ScopeId) -> &mut ContentState {\n         self.content.entry(scope).or_default()\n     }\n@@ -356,6 +409,17 @@ impl ReducerState {\n                         visibility: rc.visibility,\n                     },\n                 );\n+                self.room_timeline\n+                    .entry(rc.room_id.clone())\n+                    .or_default()\n+                    .push(RoomTimelineEntry {\n+                        ts: rc.ts,\n+                        kind: RoomTimelineKind::RoomCreated {\n+                            owner: rc.owner.clone(),\n+                            slug: rc.slug.clone(),\n+                            visibility: rc.visibility,\n+                        },\n+                    });\n             }\n             Event::Ingest(mut ing) => {\n                 ing.thread_tag = canonicalize_tag(&ing.thread_tag);\n@@ -525,18 +589,31 @@ impl ReducerState {\n                 nav!(self.actor_last_post_ts, keypath(ing.principal.clone()), setval(ing.ts));\n             }\n             Event::GrantAdded(ga) => {\n+                let room_id = ga.room_id.clone();\n                 let caps = self.grants\n                     .entry(ga.room_id)\n                     .or_default()\n-                    .entry(ga.username)\n+                    .entry(ga.username.clone())\n                     .or_default();\n-                for cap in ga.capabilities {\n+                for cap in ga.capabilities.iter().copied() {\n                     caps.insert(cap);\n                 }\n+                self.room_timeline\n+                    .entry(room_id)\n+                    .or_default()\n+                    .push(RoomTimelineEntry {\n+                        ts: ga.ts,\n+                        kind: RoomTimelineKind::GrantAdded {\n+                            username: ga.username.clone(),\n+                            granted_by: ga.granted_by.clone(),\n+                            capabilities: ga.capabilities.clone(),\n+                        },\n+                    });\n             }\n             Event::GrantRevoked(gr) => {\n+                let room_id = gr.room_id.clone();\n                 if let Some(room_grants) = self.grants.get_mut(&gr.room_id) {\n-                    let username = gr.username;\n+                    let username = gr.username.clone();\n                     if let Some(caps) = room_grants.get_mut(&username) {\n                         for cap in &gr.capabilities {\n                             caps.remove(cap);\n@@ -549,6 +626,37 @@ impl ReducerState {\n                         self.grants.remove(&gr.room_id);\n                     }\n                 }\n+                self.room_timeline\n+                    .entry(room_id)\n+                    .or_default()\n+                    .push(RoomTimelineEntry {\n+                        ts: gr.ts,\n+                        kind: RoomTimelineKind::GrantRevoked {\n+                            username: gr.username.clone(),\n+                            revoked_by: gr.revoked_by.clone(),\n+                            capabilities: gr.capabilities.clone(),\n+                        },\n+                    });\n+            }\n+            Event::InviteMinted(im) => {\n+                self.invites.insert(\n+                    im.token.clone(),\n+                    ActiveInviteState {\n+                        room_id: im.room_id.clone(),\n+                        capabilities: im.capabilities.iter().copied().collect(),\n+                        inviter: im.inviter.clone(),\n+                        uses_remaining: im.max_uses,\n+                        expires_ts_ms: im.expires_ts_ms,\n+                    },\n+                );\n+            }\n+            Event::InviteRedeemed(ir) => {\n+                if let Some(inv) = self.invites.get_mut(&ir.token) {\n+                    inv.uses_remaining = inv.uses_remaining.saturating_sub(1);\n+                    if inv.uses_remaining == 0 {\n+                        self.invites.remove(&ir.token);\n+                    }\n+                }\n             }\n         }\n     }\n@@ -570,6 +678,8 @@ impl Default for ReducerState {\n             actor_last_post_ts: HashMap::new(),\n             ingests_ordered: Vec::new(),\n             grants: HashMap::new(),\n+            room_timeline: HashMap::new(),\n+            invites: HashMap::new(),\n         }\n     }\n }\ndiff --git a/server/src/state.rs b/server/src/state.rs\nindex b1ff2330903780cbe0cdf35964cb166eb2423d7d..628fd5921b34ba53ac0ca6b6fd33957ca09129b9 100644\n--- a/server/src/state.rs\n+++ b/server/src/state.rs\n@@ -1,8 +1,20 @@\n+use std::collections::HashMap;\n use std::sync::Arc;\n \n use tokio::sync::{broadcast, RwLock};\n \n-use crate::{event_log::EventLog, reducer::ReducerState};\n+use crate::{event_log::EventLog, events::ThreadCapability, reducer::ReducerState};\n+\n+/// Ephemeral invite link (24h TTL, in-memory only; not written to the event log).\n+#[derive(Debug, Clone)]\n+pub struct InviteState {\n+    pub room_id: String,\n+    pub capabilities: Vec<ThreadCapability>,\n+    pub expires_at_ms: i64,\n+    pub max_uses: usize,\n+    pub current_uses: usize,\n+    pub inviter: String,\n+}\n \n #[derive(Debug, Clone)]\n pub struct PendingSession {\n@@ -10,6 +22,8 @@ pub struct PendingSession {\n     pub created_ts: i64,\n     pub provider: Option<String>,\n     pub provider_id: Option<String>,\n+    /// When set, successful OAuth completion redeems this invite token and appends [`crate::events::GrantAdded`].\n+    pub redeem_invite: Option<String>,\n     pub complete: Option<(String /*username*/, String /*bearer*/ )>,\n }\n \n@@ -42,7 +56,9 @@ pub struct AppState {\n     pub cfg: Arc<AppConfig>,\n     pub event_log: Arc<EventLog>,\n     pub reduced: Arc<RwLock<ReducerState>>,\n-    pub pending_sessions: Arc<RwLock<std::collections::HashMap<String, PendingSession>>>,\n+    pub pending_sessions: Arc<RwLock<HashMap<String, PendingSession>>>,\n+    /// Ephemeral invite tokens (`inv_…`) until expiry or exhaustion.\n+    pub invites: Arc<RwLock<HashMap<String, InviteState>>>,\n     /// Broadcast channel for SSE live-streaming. Capacity = 64 events.\n     pub stream_tx: broadcast::Sender<StreamEvent>,\n     /// Broadcast channel for web SSE HTML fragments (poem pattern). Capacity = 64.\n@@ -58,7 +74,8 @@ impl AppState {\n             cfg: Arc::new(cfg),\n             event_log: Arc::new(event_log),\n             reduced: Arc::new(RwLock::new(ReducerState::default())),\n-            pending_sessions: Arc::new(RwLock::new(std::collections::HashMap::new())),\n+            pending_sessions: Arc::new(RwLock::new(HashMap::new())),\n+            invites: Arc::new(RwLock::new(HashMap::new())),\n             stream_tx,\n             html_tx,\n         }\ndiff --git a/server/src/timeline.rs b/server/src/timeline.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..251158943ab36d3015268e35f6bdd01c3f42ab3b\n--- /dev/null\n+++ b/server/src/timeline.rs\n@@ -0,0 +1,153 @@\n+//! Room admin lines merged into forum thread views.\n+\n+use crate::{\n+    canonical_path::canonicalize_tag,\n+    reducer::{ReducerState, RoomTimelineEntry, RoomTimelineKind},\n+};\n+\n+fn cap_label(c: crate::events::ThreadCapability) -> &'static str {\n+    use crate::events::ThreadCapability::*;\n+    match c {\n+        View => \"view\",\n+        Post => \"post\",\n+        Vote => \"vote\",\n+        AddItem => \"add_item\",\n+        Manage => \"manage\",\n+    }\n+}\n+\n+fn caps_list(caps: &[crate::events::ThreadCapability]) -> String {\n+    let mut v: Vec<_> = caps.iter().map(|c| cap_label(*c)).collect();\n+    v.sort();\n+    v.join(\", \")\n+}\n+\n+/// Human-readable system line for the thread feed.\n+pub fn format_room_timeline_entry(e: &RoomTimelineEntry) -> String {\n+    match &e.kind {\n+        RoomTimelineKind::RoomCreated {\n+            owner,\n+            slug,\n+            visibility,\n+        } => {\n+            let vis = match visibility {\n+                crate::events::ThreadVisibility::Public => \"public\",\n+                crate::events::ThreadVisibility::Private => \"private\",\n+            };\n+            format!(\"@{owner} created room #{slug} ({vis})\")\n+        }\n+        RoomTimelineKind::GrantAdded {\n+            username,\n+            granted_by,\n+            capabilities,\n+        } => {\n+            format!(\n+                \"@{granted_by} granted @{} {}\",\n+                username,\n+                caps_list(capabilities)\n+            )\n+        }\n+        RoomTimelineKind::GrantRevoked {\n+            username,\n+            revoked_by,\n+            capabilities,\n+        } => {\n+            format!(\n+                \"@{revoked_by} revoked @{} {}\",\n+                username,\n+                caps_list(capabilities)\n+            )\n+        }\n+    }\n+}\n+\n+#[derive(Clone, Debug)]\n+pub enum MergedThreadRow {\n+    System { ts: i64, text: String },\n+    Post {\n+        index: usize,\n+        id: String,\n+        ts: i64,\n+        principal: String,\n+        raw: String,\n+    },\n+}\n+\n+/// Merge room admin lines with thread ingests for one room + tag. Oldest first.\n+/// `actor_prefix` filters posts only (system lines always included).\n+pub fn merge_thread_rows(\n+    reduced: &ReducerState,\n+    room_wire: &str,\n+    thread_tag: &str,\n+    since: Option<i64>,\n+    before: Option<i64>,\n+    actor_prefix: &str,\n+) -> Vec<MergedThreadRow> {\n+    let scope = crate::reducer::scope_from_room_wire(room_wire);\n+    let tag = canonicalize_tag(thread_tag);\n+    let key = (scope.clone(), tag.clone());\n+\n+    let mut rows: Vec<MergedThreadRow> = Vec::new();\n+\n+    if let Some(entries) = reduced.room_timeline.get(room_wire.trim()) {\n+        for e in entries {\n+            if since.map_or(true, |s| e.ts >= s) && before.map_or(true, |b| e.ts < b) {\n+                rows.push(MergedThreadRow::System {\n+                    ts: e.ts,\n+                    text: format_room_timeline_entry(e),\n+                });\n+            }\n+        }\n+    }\n+\n+    let all_ids: Vec<String> = reduced\n+        .ingests_by_scope_thread\n+        .get(&key)\n+        .map(|q| q.iter().rev().cloned().collect())\n+        .unwrap_or_default();\n+\n+    for (idx, id) in all_ids.into_iter().enumerate() {\n+        let Some(ing) = reduced.ingests_by_id.get(&id) else {\n+            continue;\n+        };\n+        if since.map_or(true, |s| ing.ts >= s) && before.map_or(true, |b| ing.ts < b) {\n+            if !actor_prefix.is_empty()\n+                && !ing\n+                    .principal\n+                    .to_lowercase()\n+                    .starts_with(actor_prefix)\n+            {\n+                continue;\n+            }\n+            rows.push(MergedThreadRow::Post {\n+                index: idx,\n+                id: ing.id.clone(),\n+                ts: ing.ts,\n+                principal: ing.principal.clone(),\n+                raw: ing.raw.clone(),\n+            });\n+        }\n+    }\n+\n+    rows.sort_by(|a, b| {\n+        let ta = match a {\n+            MergedThreadRow::System { ts, .. } | MergedThreadRow::Post { ts, .. } => *ts,\n+        };\n+        let tb = match b {\n+            MergedThreadRow::System { ts, .. } | MergedThreadRow::Post { ts, .. } => *ts,\n+        };\n+        ta.cmp(&tb)\n+    });\n+    rows\n+}\n+\n+/// Public forum thread (`room_wire == \"public\"`): same merge (timeline usually empty).\n+pub fn merge_public_thread_rows(\n+    reduced: &ReducerState,\n+    thread_tag: &str,\n+    since: Option<i64>,\n+    before: Option<i64>,\n+    actor_prefix: &str,\n+) -> Vec<MergedThreadRow> {\n+    merge_thread_rows(reduced, \"public\", thread_tag, since, before, actor_prefix)\n+}\ndiff --git a/test/grants.bb b/test/grants.bb\nindex 10ef0f08ce1c3945e5f1634314e6aebcf6810cd2..4ded5ce92576cdea653cce0ba8a751be4374731a 100644\n--- a/test/grants.bb\n+++ b/test/grants.bb\n@@ -105,7 +105,7 @@\n        ;; Alice grants bob View only.\n        (println \"\\nalice grants bob View only…\")\n        (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token\n-                                                   [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capability\" \"view\"}}])))\n+                                                   [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capabilities\" [\"view\"]}}])))\n                 \"grant View RPC ok\")\n \n        (println \"\\nbob (View only) tries to post prose…\")\n@@ -117,7 +117,7 @@\n        ;; Alice grants bob Post.\n        (println \"\\nalice grants bob Post…\")\n        (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token\n-                                                   [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capability\" \"post\"}}])))\n+                                                   [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capabilities\" [\"post\"]}}])))\n                 \"grant Post RPC ok\")\n \n        (println \"\\nbob (View + Post) posts prose…\")\n@@ -143,7 +143,7 @@\n        ;; Alice grants bob Vote.\n        (println \"\\nalice grants bob Vote…\")\n        (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token\n-                                                   [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capability\" \"vote\"}}])))\n+                                                   [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capabilities\" [\"vote\"]}}])))\n                 \"grant Vote RPC ok\")\n \n        (println \"\\nbob (View + Post + Vote) votes…\")\ndiff --git a/test/invites.bb b/test/invites.bb\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..f72b1e630a6856174cdef11eb977e2f81b16e551\n--- /dev/null\n+++ b/test/invites.bb\n@@ -0,0 +1,150 @@\n+(ns test.invites\n+  \"Ephemeral invite links: mint via RPC, GET /join → pending session + OAuth, redemption → GrantAdded,\n+  RoomAudit, post succeeds, second GET /join returns 404 when max_uses exhausted.\"\n+  (:require [babashka.fs :as fs]\n+            [cheshire.core :as json]\n+            [clojure.string :as str]\n+            [test.common :as common]\n+            [test.oauth :as oauth]))\n+\n+(def ^:private counts (atom {:pass 0 :fail 0}))\n+\n+(defn- assert! [pred msg]\n+  (common/test-assert! counts pred msg))\n+\n+(defn- bearer [token] {\"Authorization\" (str \"Bearer \" token)})\n+\n+(defn- rpc-batch! [base-url token cmds]\n+  (let [resp (oauth/http-post-json (str base-url \"/api/v0/rpc\") cmds :headers (bearer token))]\n+    {:status (:status resp)\n+     :parsed (json/parse-string (:body resp) false)}))\n+\n+(defn- rpc-line-ok? [parsed]\n+  (true? (get-in parsed [\"results\" 0 \"ok\"])))\n+\n+(defn- session-from-login-location [loc]\n+  (when loc\n+    (let [qpart (if (str/includes? loc \"?\")\n+                  (-> loc (str/split #\"\\?\" 2) second)\n+                  \"\")\n+          qpart (if (str/includes? qpart \"#\")\n+                  (-> qpart (str/split #\"#\" 2) first)\n+                  qpart)\n+          m (oauth/parse-query qpart)]\n+      (some-> (get m :session) str))))\n+\n+(defn- invite-token-from-url [invite-url]\n+  (second (re-find #\"/join/(inv_[^/?#]+)\" (str invite-url))))\n+\n+(defn- register-user! [base-url session-agent username]\n+  (oauth/complete-registration! base-url\n+                                :agent session-agent\n+                                :username username\n+                                :assert! (fn [pred msg] (assert! pred msg))))\n+\n+(defn- ingest! [base-url token room thread delegate text]\n+  (rpc-batch! base-url token\n+              [{\"Post\" {\"room\" room\n+                        \"thread_tag\" thread\n+                        \"delegate\" delegate\n+                        \"text\" text\n+                        \"return_rank_diff\" false}}]))\n+\n+(defn invites-test [& _args]\n+  (println \"\\n━━━ ephemeral invite + audit integration check ━━━\\n\")\n+  (reset! counts {:pass 0 :fail 0})\n+\n+  (println \"building server binary…\")\n+  (common/letlocals\n+   (bind build (common/run-cargo-build-release! [\"slugsocial-server\"]))\n+   (assert! (zero? (:exit build)) \"cargo build succeeds\")\n+   (bind server-bin \"target/release/slugsocial-server\")\n+\n+   (bind tmp-dir (str (fs/create-temp-dir {:prefix \"slug-invites-\"})))\n+   (bind slug-port (common/pick-port))\n+   (bind google-port (common/pick-port))\n+   (bind base-url (str \"http://127.0.0.1:\" slug-port))\n+   (bind google-url (str \"http://127.0.0.1:\" google-port))\n+\n+   (bind !server (atom nil))\n+   (bind !google (atom nil))\n+\n+   (bind server-env (common/slug-server-env tmp-dir base-url google-url slug-port))\n+   (try\n+     (println (str \"starting mock google on :\" google-port))\n+     (reset! !google (oauth/start-mock-google google-port\n+                                              :google-users [\"google-user-alice\" \"google-user-bob\"]))\n+\n+     (println (str \"starting server on :\" slug-port))\n+     (reset! !server (common/start-server server-bin server-env))\n+     (assert! (common/wait-for-server base-url 10000) \"server responds to /healthz\")\n+\n+     (println \"\\nregistering alice…\")\n+     (let [alice-token (register-user! base-url\n+                                       \"00000000-0000-0000-0000-000000000001:test:local/dev\"\n+                                       \"alice\")\n+\n+           _ (println \"\\nalice creates private room…\")\n+           create (rpc-batch! base-url alice-token\n+                              [{\"RoomCreate\" {\"slug\" \"invite-demo\" \"visibility\" \"private\"}}])\n+           _ (assert! (= 200 (:status create)) \"room create HTTP 200\")\n+           _ (assert! (rpc-line-ok? (:parsed create)) \"room create RPC ok\")\n+           room-id (get-in (:parsed create) [\"results\" 0 \"result\" \"RoomCreated\" \"room_id\"])\n+           _ (assert! (some? room-id) \"room_id present\")\n+\n+           _ (println \"\\nalice mints invite (view,post,vote uses=1)…\")\n+           mint (rpc-batch! base-url alice-token\n+                            [{\"RoomMintInvite\" {\"room\" room-id\n+                                                \"capabilities\" [\"view\" \"post\" \"vote\"]\n+                                                \"max_uses\" 1}}])\n+           _ (assert! (= 200 (:status mint)) \"mint HTTP 200\")\n+           _ (assert! (rpc-line-ok? (:parsed mint)) \"mint RPC ok\")\n+           invite-url (get-in (:parsed mint) [\"results\" 0 \"result\" \"RoomInviteMinted\" \"invite_url\"])\n+           inv-tok (invite-token-from-url invite-url)\n+           _ (assert! (some? inv-tok) \"invite token parsed from URL\")\n+\n+           _ (println \"\\nGET /join/:token (expect redirect + session)…\")\n+           join-resp (oauth/http-get-no-redirect (str base-url \"/join/\" inv-tok))\n+           _ (assert! (contains? #{302 307} (:status join-resp))\n+                      (str \"join returns redirect (got status \" (:status join-resp) \")\"))\n+           sess (session-from-login-location (:location join-resp))\n+           _ (assert! (and (some? sess) (str/starts-with? sess \"p_\")) \"Location carries session=p_…\")\n+\n+           _ (println \"\\nbob completes OAuth via invite session…\")\n+           bob-token (oauth/complete-pending-session! base-url sess \"bob\"\n+                                                      :assert! (fn [pred msg] (assert! pred msg)))\n+\n+           _ (println \"\\nalice runs RoomAudit…\")\n+           audit (rpc-batch! base-url alice-token [{\"RoomAudit\" {\"room\" room-id}}])\n+           _ (assert! (rpc-line-ok? (:parsed audit)) \"audit RPC ok\")\n+           grants (get-in (:parsed audit) [\"results\" 0 \"result\" \"RoomAudit\" \"grants\"])\n+           bob-entry (first (filter #(= \"bob\" (get % \"username\")) grants))\n+           _ (assert! (some? bob-entry) \"audit lists bob\")\n+           bob-caps (set (get bob-entry \"capabilities\"))\n+           _ (assert! (= bob-caps #{\"view\" \"post\" \"vote\"}) \"bob has view, post, vote\")\n+\n+           _ (println \"\\nbob posts prose to private room…\")\n+           _ (assert! (rpc-line-ok? (:parsed (ingest! base-url bob-token room-id \"main\"\n+                                                      \"00000000-0000-0000-0000-000000000002:test:local/dev\"\n+                                                      \"Hello via invite link.\")))\n+                      \"bob post succeeds\")\n+\n+           _ (println \"\\nsecond GET /join (invite exhausted → 404)…\")\n+           join2 (oauth/http-get-no-redirect (str base-url \"/join/\" inv-tok))\n+           _ (assert! (= 404 (:status join2)) \"exhausted invite returns 404\")]\n+\n+       (println \"\\ninvite lifecycle OK.\"))\n+\n+     (finally\n+       (when-some [s @!server] (common/kill-server s))\n+       (when-some [g @!google] ((:stop-fn g)))\n+       (fs/delete-tree tmp-dir)))\n+\n+   (bind {pass :pass fail :fail} @counts)\n+   (if (zero? fail)\n+     (println (str \"\\n\" common/ansi-green \"━━━ \" pass \" invite checks passed ━━━\" common/ansi-reset \"\\n\"))\n+     (do (println (str \"\\n\" common/ansi-red \"━━━ \" fail \" invite checks FAILED ━━━\" common/ansi-reset \"\\n\"))\n+         (System/exit 1)))))\n+\n+(when (= *file* (System/getProperty \"babashka.file\"))\n+  (invites-test))\ndiff --git a/test/oauth.bb b/test/oauth.bb\nindex b69459acd17c23c023170d8dd93fe45bb49c8d88..efb3f3e66346ffde81bf9622d75c3a6ec89f8db2 100644\n--- a/test/oauth.bb\n+++ b/test/oauth.bb\n@@ -21,6 +21,21 @@\n           resp (.send (http-client) req (java.net.http.HttpResponse$BodyHandlers/ofString))]\n       {:status (.statusCode resp) :body (.body resp) :headers (.map (.headers resp))})))\n \n+(defn http-get-no-redirect\n+  \"GET without following redirects; returns `:location` from the first `Location` header when present.\"\n+  [url & {:keys [headers]}]\n+  (let [client (-> (java.net.http.HttpClient/newBuilder)\n+                   (.followRedirects java.net.http.HttpClient$Redirect/NEVER)\n+                   (.connectTimeout connect-timeout)\n+                   (.build))\n+        b (java.net.http.HttpRequest/newBuilder (java.net.URI/create url))]\n+    (doseq [[k v] (or headers {})]\n+      (.header b k v))\n+    (let [req (-> b (.timeout request-timeout) (.GET) (.build))\n+          resp (.send client req (java.net.http.HttpResponse$BodyHandlers/ofString))\n+          loc (first (get (.map (.headers resp)) \"location\"))]\n+      {:status (.statusCode resp) :body (.body resp) :location loc})))\n+\n (defn http-post-json [url data & {:keys [headers]}]\n   (let [body (json/generate-string data)\n         b (java.net.http.HttpRequest/newBuilder (java.net.URI/create url))]\n@@ -50,6 +65,35 @@\n           resp (.send (http-client) req (java.net.http.HttpResponse$BodyHandlers/ofString))]\n       {:status (.statusCode resp) :body (.body resp) :headers (.map (.headers resp))})))\n \n+(defn complete-pending-session!\n+  \"Finish OAuth for an existing pending session id (e.g. created by `GET /join/inv_…`). Returns bearer token.\"\n+  [base-url session-id username & {:keys [assert!]}]\n+  (let [check! (fn [pred msg resp]\n+                 (if assert!\n+                   (assert! pred msg)\n+                   (when-not pred\n+                     (throw (ex-info msg {:resp resp})))))]\n+    (let [enc (java.net.URLEncoder/encode session-id \"UTF-8\")\n+          login-url (str base-url \"/auth/login?session=\" enc)\n+          login-get (http-get login-url)]\n+      (check! (= 200 (:status login-get))\n+              (str \"oauth redirect chain for session \" session-id)\n+              login-get)\n+      (let [choose (http-post-form (str base-url \"/auth/choose-username\")\n+                                   {:session session-id :username username})]\n+        (check! (= 200 (:status choose))\n+                (str \"choose-username for \" username \" returns 200\")\n+                choose)\n+        (let [poll (http-get (str base-url \"/api/v0/pending-session/\" session-id))]\n+          (check! (= 200 (:status poll))\n+                  (str \"pending-session poll returns 200\")\n+                  poll)\n+          (let [poll-json (json/parse-string (:body poll) true)]\n+            (check! (:complete poll-json)\n+                    (str \"pending session complete for \" username)\n+                    poll)\n+            (:token poll-json)))))))\n+\n (defn parse-query [s]\n   (into {}\n         (for [part (str/split (or s \"\") #\"&\")\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex a715fe5639f4a3a7bfedcc706b5fb312b98c9ac5..98c66a00fd27803ef6f75b5ac478ff2eb762d771 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -123,13 +123,32 @@ pub struct PathDetailResponse {\n #[derive(Debug, Serialize, Deserialize)]\n pub struct ThreadDetailResponse {\n     pub thread: String,\n-    pub posts: Vec<PostRow>,\n-    /// Total posts in this thread.\n+    /// Chronological page: prose posts and room system lines, oldest first within the window.\n+    pub items: Vec<ThreadItem>,\n+    /// Total rows (posts + system lines) in this thread after filters.\n     pub total: usize,\n-    /// Chronological offset of the first post in this page.\n+    /// Offset into the merged chronological list.\n     pub offset: usize,\n }\n \n+/// One row in a thread timeline: a normal post or a room system line.\n+#[derive(Debug, Serialize, Deserialize)]\n+#[serde(tag = \"kind\", rename_all = \"snake_case\")]\n+pub enum ThreadItem {\n+    Post {\n+        id: String,\n+        index: usize,\n+        ts: i64,\n+        actor: String,\n+        body: String,\n+        truncated: bool,\n+    },\n+    System {\n+        ts: i64,\n+        text: String,\n+    },\n+}\n+\n /// One post in a thread. Full body, no snippet.\n #[derive(Debug, Serialize, Deserialize)]\n pub struct PostRow {\n@@ -224,6 +243,23 @@ pub struct FeedPost {\n // RPC batch API (`POST /api/v0/rpc`)\n // ---------------------------------------------------------------------------\n \n+fn default_invite_max_uses() -> usize {\n+    1\n+}\n+\n+/// One principal's capabilities in a private room (from [`RpcCommand::RoomAudit`]).\n+#[derive(Debug, Serialize, Deserialize)]\n+pub struct RoomAuditEntry {\n+    pub username: String,\n+    pub capabilities: Vec<String>,\n+}\n+\n+#[derive(Debug, Serialize, Deserialize)]\n+pub struct RoomAuditResponse {\n+    pub room: String,\n+    pub grants: Vec<RoomAuditEntry>,\n+}\n+\n #[derive(Debug, Serialize, Deserialize)]\n #[serde(transparent)]\n pub struct RpcBatch(pub Vec<RpcCommand>);\n@@ -287,10 +323,27 @@ pub enum RpcCommand {\n         visibility: Option<String>,\n     },\n     RoomGrant {\n+        room: String,\n+        username: String,\n+        /// Capability names: `view`, `post`, `vote`, `add_item`, `manage`.\n+        capabilities: Vec<String>,\n+    },\n+    RoomRevoke {\n         room: String,\n         username: String,\n         capability: String,\n     },\n+    /// Mint a shareable invite link (24h TTL, stored in memory only until redeemed or expiry).\n+    RoomMintInvite {\n+        room: String,\n+        capabilities: Vec<String>,\n+        #[serde(default = \"default_invite_max_uses\")]\n+        max_uses: usize,\n+    },\n+    /// List principals granted access in a room (requires View or Manage).\n+    RoomAudit {\n+        room: String,\n+    },\n     GetGlobalRank {\n         room: String,\n         #[serde(default)]\n@@ -361,6 +414,13 @@ pub enum RpcResult {\n     RoomCreated {\n         room_id: String,\n     },\n+    RoomInviteMinted {\n+        invite_url: String,\n+        #[serde(default, skip_serializing_if = \"Option::is_none\")]\n+        expires_at_ms: Option<i64>,\n+        max_uses: usize,\n+    },\n+    RoomAudit(RoomAuditResponse),\n     GrantOk {},\n     GlobalRank(GlobalRankResponse),\n     Pair(PairResponse),\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[02cd761c] Make ranked child group pin icons clickable to unpin.\n\nLets users clear the garden pin from the ranked child groups list via the same POST /ui set_garden_pin flow as the HUD and item header.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/server/src/html/garden/pin.rs b/server/src/html/garden/pin.rs\nindex 1820d7fe7ee167ecbf5ad5124f23b2ab92ffb01f..b7ea92bbe67d6d499915edb607a3a0b36178d7f6 100644\n--- a/server/src/html/garden/pin.rs\n+++ b/server/src/html/garden/pin.rs\n@@ -101,6 +101,7 @@ pub(super) fn child_row_pin_or_vote(\n     row_item: &ItemId,\n     pinned_room_and_item: Option<&(String, ItemId)>,\n     scope_content: &ContentState,\n+    next_path: &str,\n ) -> maud::Markup {\n     let pin_matches_scope = pinned_room_and_item\n         .map(|(r, _)| r == nav.room_wire.as_str())\n@@ -108,12 +109,25 @@ pub(super) fn child_row_pin_or_vote(\n     let pinned_item = pinned_room_and_item\n         .filter(|_| pin_matches_scope)\n         .map(|(_, i)| i);\n+    let unpin_rpc = template_json_compact(&json!({\n+        \"action\": \"set_garden_pin\",\n+        \"clear\": true,\n+        \"room_wire\": \"\",\n+        \"next\": next_path,\n+        \"form_action\": \"/ui\",\n+    }))\n+    .expect(\"unpin rpc json\");\n \n     html! {\n         @if let Some(pi) = pinned_item {\n             span class=\"ont-garden-child-actions\" data-garden-room=(nav.room_wire.as_str()) {\n                 @if pi == row_item {\n-                    span class=\"ont-garden-pinned-here\" title=\"Pinned\" aria-label=\"Pinned\" { \"📌\" }\n+                    form method=\"POST\" action=\"/ui\" data-navigate=\"full\" class=\"ont-garden-pin-form\" {\n+                        input type=\"hidden\" name=(UI_RPC_FIELD) value=(unpin_rpc);\n+                        button type=\"submit\" class=\"ont-garden-pin-ico ont-garden-pin-ico-active\" title=\"Unpin\" aria-label=\"Unpin from HUD\" {\n+                            span class=\"ont-garden-pin-glyph\" aria-hidden=\"true\" { \"📌\" }\n+                        }\n+                    }\n                 } @else {\n                     @let nv = edge_vote_count_for_pair(scope_content, pi, row_item);\n                     @let tip = format!(\ndiff --git a/server/src/html/garden/render.rs b/server/src/html/garden/render.rs\nindex bd8cbce059ee789de6e8dc9b6f69f54beee2f994..7bfaadc0786b734db8973c53b82296a188d26e22 100644\n--- a/server/src/html/garden/render.rs\n+++ b/server/src/html/garden/render.rs\n@@ -216,7 +216,7 @@ pub(super) async fn render_scope_view(\n                                     @let item_url = item_href(r.item.as_str(), &nav);\n                                     @let score_str = format!(\"{:.3}\", r.score);\n                                     li data-garden-item=(r.item.as_str()) {\n-                                        (child_row_pin_or_vote(&nav, &r.item, pin_ref.as_ref(), scope_content))\n+                                        (child_row_pin_or_vote(&nav, &r.item, pin_ref.as_ref(), scope_content, &next_for_pin))\n                                         a class=\"item-link\" href=(item_url) { code { (item_display_path(r.item.as_str())) } }\n                                         span class=\"ont-rank-score\" { (score_str) }\n                                     }\n@@ -232,7 +232,7 @@ pub(super) async fn render_scope_view(\n                         ul class=\"ont-group-list\" {\n                             @for name in &model.child_rankings.unranked_items {\n                                 li data-garden-item=(name.as_str()) {\n-                                    (child_row_pin_or_vote(&nav, name, pin_ref.as_ref(), scope_content))\n+                                    (child_row_pin_or_vote(&nav, name, pin_ref.as_ref(), scope_content, &next_for_pin))\n                                     @let href = item_href(name.as_str(), &nav);\n                                     a class=\"item-link\" href=(href) { code { (item_display_path(name.as_str())) } }\n                                 }\ndiff --git a/server/static/theme_default.css b/server/static/theme_default.css\nindex 2dabf3a7094cecd89d0c9674d27efe30cd01c010..b846ab86cb6eb5fb56be87efb054fb8b18082583 100644\n--- a/server/static/theme_default.css\n+++ b/server/static/theme_default.css\n@@ -891,8 +891,7 @@ button.ont-pin-btn-active {\n   vertical-align: middle;\n }\n button.ont-garden-pin-ico,\n-a.ont-garden-vote-ico,\n-span.ont-garden-pinned-here {\n+a.ont-garden-vote-ico {\n   font-size: 13px;\n   line-height: 1;\n   padding: 2px 6px;\n@@ -910,6 +909,11 @@ span.ont-garden-pinned-here {\n   align-items: center;\n   justify-content: center;\n }\n+form.ont-garden-pin-form {\n+  display: inline;\n+  margin: 0;\n+  padding: 0;\n+}\n a.ont-garden-vote-ico {\n   gap: 4px;\n }\n@@ -925,10 +929,14 @@ a.ont-garden-vote-ico:hover {\n span.ont-garden-vote-glyph {\n   line-height: 1;\n }\n-span.ont-garden-pinned-here {\n+button.ont-garden-pin-ico-active {\n   border-color: var(--link);\n   color: var(--signal);\n-  cursor: default;\n+  background: color-mix(in srgb, var(--link) 12%, var(--g3));\n+}\n+button.ont-garden-pin-ico-active:hover {\n+  color: var(--signal);\n+  background: color-mix(in srgb, var(--link) 18%, var(--g4));\n }\n button.ont-garden-pin-ico:focus-visible {\n   outline: 2px solid var(--link);\ndiff --git a/server/static/theme_retro_craft.css b/server/static/theme_retro_craft.css\nindex bdd9031b82154a5019782e6dcb8bf7589fafce09..5d4954812ad43f2ee7e63c71c7f0ae0b3e3fc95b 100644\n--- a/server/static/theme_retro_craft.css\n+++ b/server/static/theme_retro_craft.css\n@@ -711,8 +711,7 @@ body.view-ontology span.ont-garden-vote-glyph {\n   line-height: 1;\n }\n body.view-ontology button.ont-garden-pin-ico,\n-body.view-ontology a.ont-garden-vote-ico,\n-body.view-ontology span.ont-garden-pinned-here {\n+body.view-ontology a.ont-garden-vote-ico {\n   font-size: 0.95rem;\n   line-height: 1;\n   padding: 0.1rem 0.35rem;\n@@ -732,10 +731,14 @@ body.view-ontology a.ont-garden-vote-ico:hover {\n   border-color: #a68e6b;\n   background: #ebe6dc;\n }\n-body.view-ontology span.ont-garden-pinned-here {\n+body.view-ontology button.ont-garden-pin-ico-active {\n   border-color: #1a4a8c;\n   background: color-mix(in srgb, #1a4a8c 10%, #f7f3eb);\n-  cursor: default;\n+  color: #0d2d5c;\n+}\n+body.view-ontology button.ont-garden-pin-ico-active:hover {\n+  border-color: #a68e6b;\n+  background: color-mix(in srgb, #1a4a8c 14%, #ebe6dc);\n }\n body.view-ontology form.ont-garden-pin-form {\n   display: inline;\ndiff --git a/test/browser_garden_pin.clj b/test/browser_garden_pin.clj\nindex d4fa9ed60b45e872ec60e29307cfa61bcd9dd6b2..579976f4c2493a149f9eba081862ca07919f4fe9 100644\n--- a/test/browser_garden_pin.clj\n+++ b/test/browser_garden_pin.clj\n@@ -58,10 +58,11 @@\n      (let [alice-token (oauth/fetch-bearer-token! base-url :username \"alice\")\n            thread-tag \"browser-garden-pin\"\n            raw (str \"# \" thread-tag \"\\n\\n\"\n-                    \"~/gp-pin-a {alpha}\\n\"\n-                    \"~/gp-pin-b {beta}\\n\"\n+                    \"~/gp-parent {parent}\\n\"\n+                    \"~/gp-parent/pin-a {alpha}\\n\"\n+                    \"~/gp-parent/pin-b {beta}\\n\"\n                     \"{pin test vote}\\n\"\n-                    \"~/gp-pin-a 2:1 ~/gp-pin-b\\n\")\n+                    \"~/gp-parent/pin-a 2:1 ~/gp-parent/pin-b\\n\")\n            post-resp (oauth/http-post-json\n                       (str base-url \"/api/v0/rpc\")\n                       [{\"Post\" {\"room\" \"public\"\n@@ -77,23 +78,43 @@\n              (core/with-page [pg (core/new-page-from-context ctx)]\n                (page/navigate pg (str base-url \"/login\"))\n                (is (wait-for-text pg \"body\" \"@alice\" 15000) \"alice session after login\")\n-               (page/navigate pg (str base-url \"/~/gp-pin-a\"))\n-               (is (wait-for-text pg \".ont-item-shell\" \"~/gp-pin-a\" 15000) \"on item a page\")\n+               (page/navigate pg (str base-url \"/~/gp-parent/pin-a\"))\n+               (is (wait-for-text pg \".ont-item-shell\" \"~/gp-parent/pin-a\" 15000) \"on item a page\")\n                ;; Native form POST /ui (data-navigate=full) — not fetch/eval\n                (locator/click (page/locator pg \".ont-item-pin-zone form.ont-pin-form button[type=submit]\"))\n-               (is (wait-for-text pg \"#slug-pin-hud\" \"gp-pin-a\" 15000)\n+               (is (wait-for-text pg \"#slug-pin-hud\" \"gp-parent/pin-a\" 15000)\n                    \"HUD shows pinned item label after redirect\")\n-               (page/navigate pg (str base-url \"/~/gp-pin-b\"))\n-               (is (wait-for-text pg \".ont-item-shell\" \"~/gp-pin-b\" 15000) \"on item b page\")\n+               (page/navigate pg (str base-url \"/~/gp-parent/pin-b\"))\n+               (is (wait-for-text pg \".ont-item-shell\" \"~/gp-parent/pin-b\" 15000) \"on item b page\")\n                (is (wait-for-text pg \"a.ont-vote-compare-btn\" \"vote\" 10000)\n                    \"vote link visible vs pinned item\")\n-               ;; HUD clears pin (POST set_garden_pin clear), not navigate to item\n+               ;; Unpin from ranked child groups on parent page\n+               (page/navigate pg (str base-url \"/~/gp-parent\"))\n+               (is (wait-for-text pg \".ont-tab-panel-children\" \"ranked child groups\" 15000)\n+                   \"parent page shows ranked child groups\")\n+               (is (wait-for-text pg \".ont-ranking-list button.ont-garden-pin-ico-active\" \"📌\" 10000)\n+                   \"pinned row shows active pin in ranked list\")\n+               (locator/click (page/locator pg \".ont-ranking-list button.ont-garden-pin-ico-active\"))\n+               (is (wait-for-absence-substr pg \"#slug-pin-hud\" \"gp-parent/pin-a\" 15000)\n+                   \"HUD clears after unpin from ranked child list\")\n+               (is (wait-for-absence-substr pg \".ont-ranking-list\" \"ont-garden-vote-ico\" 10000)\n+                   \"vote icons removed from ranked list after unpin\")\n+               (page/navigate pg (str base-url \"/~/gp-parent/pin-b\"))\n+               (is (wait-for-text pg \".ont-item-shell\" \"~/gp-parent/pin-b\" 15000) \"on item b page again\")\n+               (is (wait-for-absence-substr pg \"body\" \"ont-vote-compare-btn\" 15000)\n+                   \"compare vote CTA removed after ranked-list unpin\")\n+               ;; HUD unpin still works from item page context\n+               (page/navigate pg (str base-url \"/~/gp-parent/pin-a\"))\n+               (locator/click (page/locator pg \".ont-item-pin-zone form.ont-pin-form button[type=submit]\"))\n+               (is (wait-for-text pg \"#slug-pin-hud\" \"gp-parent/pin-a\" 15000)\n+                   \"re-pin from item page for HUD unpin test\")\n+               (page/navigate pg (str base-url \"/~/gp-parent/pin-b\"))\n                (locator/click (page/locator pg \"#slug-pin-hud button.slug-pin-hud-unpin-btn\"))\n-               (is (wait-for-absence-substr pg \"#slug-pin-hud\" \"gp-pin-a\" 15000)\n+               (is (wait-for-absence-substr pg \"#slug-pin-hud\" \"gp-parent/pin-a\" 15000)\n                    \"HUD clears after unpin from HUD button\")\n                (is (wait-for-absence-substr pg \"body\" \"ont-vote-compare-btn\" 15000)\n                    \"compare vote CTA removed after HUD unpin on same reload\")\n-               (is (str/includes? (or (page/url pg) \"\") \"/~/gp-pin-b\")\n+               (is (str/includes? (or (page/url pg) \"\") \"/~/gp-parent/pin-b\")\n                    \"still on item b after HUD unpin\"))))))\n \n      (finally\n","role":"user"}],"model":"openai/gpt-5.2-chat"}