{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[8d8230d1] reddit\n\nSide A — unified diff (full patch):\ndiff --git a/.gitignore b/.gitignore\nindex 4c7073f9fac0c30fd2050d79a60ef447af58ebeb..ada462e900d24a3a6d08165d158c80f79c35a5a5 100644\n--- a/.gitignore\n+++ b/.gitignore\n@@ -7,3 +7,4 @@\n data/\n repomix-output.xml\n dev-data/\n+.env\ndiff --git a/server/Cargo.toml b/server/Cargo.toml\nindex 7906a8547d56b8e6a48ef59c37aa82a8510fdee9..4677fedcb45292eebebe7e9cf6ce2f5738f18ddf 100644\n--- a/server/Cargo.toml\n+++ b/server/Cargo.toml\n@@ -16,6 +16,7 @@ tower = \"0.5\"\n tower-http = { version = \"0.5\", features = [\"trace\"] }\n tracing = \"0.1\"\n tracing-subscriber = { version = \"0.3\", features = [\"env-filter\"] }\n+reqwest = { version = \"0.12\", features = [\"json\"] }\n \n [dev-dependencies]\n reqwest = { version = \"0.12\", features = [\"json\"] }\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex 2864407ed6e8ec284a1dc663acf1805534566b62..df6505021d9f446c2b453e20e3eb3cf696a111f9 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -272,5 +272,16 @@ pub async fn home(State(state): State<AppState>, uri: Uri) -> impl IntoResponse\n \n pub async fn browse(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {\n     let item = ItemId::from_browse_uri(uri.path()).unwrap_or(ItemId::root());\n+    if item.as_str().starts_with(\"reddit.com\") {\n+        let needs_fetch = {\n+            let tree = state.tree.read().await;\n+            tree.get(&item)\n+                .map(|n| n.data.is_none())\n+                .unwrap_or(true)\n+        };\n+        if needs_fetch {\n+            state.reddit.request_fetch(item.clone());\n+        }\n+    }\n     item_page(state, uri, item).await\n }\ndiff --git a/server/src/reddit.rs b/server/src/reddit.rs\nindex d203dca09245daf869b3aa942898447700ae69fb..90053ad03b1d7c8e94f325dd4ee64c2b4f7da900 100644\n--- a/server/src/reddit.rs\n+++ b/server/src/reddit.rs\n@@ -1,4 +1,12 @@\n-//! Reddit API import (async, decoupled from UI request path).\n+//! Reddit API import via a single background worker (rate limits, dedup, backoff).\n+\n+use std::collections::{HashMap, HashSet};\n+use std::sync::Arc;\n+use std::time::{Duration, Instant};\n+\n+use reqwest::{header, Client, StatusCode};\n+use serde::Deserialize;\n+use tokio::sync::{mpsc, RwLock};\n \n use crate::{\n     path_types::ItemId,\n@@ -10,12 +18,401 @@ pub fn ensure_partial_tree(tree: &mut GlobalTree, id: &ItemId) {\n     tree.ensure_path(id);\n }\n \n-/// Placeholder for Reddit JSON import. Returns entity data when implemented.\n-pub async fn fetch_reddit_entity(_id: &ItemId) -> Option<EntityData> {\n-    None\n+pub struct RedditCommand {\n+    pub id: ItemId,\n+}\n+\n+#[derive(Clone)]\n+pub struct RedditBroker {\n+    tx: mpsc::Sender<RedditCommand>,\n+}\n+\n+#[derive(Clone)]\n+struct RedditCredentials {\n+    client_id: String,\n+    client_secret: String,\n+}\n+\n+struct OAuthToken {\n+    access_token: String,\n+    expires_at: Instant,\n+}\n+\n+impl RedditBroker {\n+    pub fn spawn(tree: Arc<RwLock<GlobalTree>>, user_agent: &str) -> Self {\n+        let (tx, rx) = mpsc::channel(100);\n+\n+        let mut headers = header::HeaderMap::new();\n+        headers.insert(\n+            header::USER_AGENT,\n+            header::HeaderValue::from_str(user_agent).expect(\"valid user agent\"),\n+        );\n+\n+        let client = Client::builder()\n+            .default_headers(headers)\n+            .timeout(Duration::from_secs(15))\n+            .build()\n+            .expect(\"reqwest client\");\n+\n+        let creds = RedditCredentials::from_env();\n+        tokio::spawn(reddit_worker(rx, tree, client, creds));\n+\n+        Self { tx }\n+    }\n+\n+    /// Fire-and-forget: queue a fetch; worker updates the tree when done.\n+    pub fn request_fetch(&self, id: ItemId) {\n+        let _ = self.tx.try_send(RedditCommand { id });\n+    }\n+}\n+\n+impl RedditCredentials {\n+    fn from_env() -> Option<Self> {\n+        let client_id = std::env::var(\"REDDIT_CLIENT_ID\").ok()?;\n+        let client_secret = std::env::var(\"REDDIT_CLIENT_SECRET\").ok()?;\n+        if client_id.is_empty() || client_secret.is_empty() {\n+            return None;\n+        }\n+        Some(Self {\n+            client_id,\n+            client_secret,\n+        })\n+    }\n+}\n+\n+pub fn default_user_agent() -> String {\n+    std::env::var(\"REDDIT_USER_AGENT\").unwrap_or_else(|_| {\n+        \"web:sorter2.social:v0.0.1 (by /u/sorter2)\".to_string()\n+    })\n }\n \n-/// Apply fetched entity data to a node (called from async worker).\n-pub fn apply_entity(tree: &mut GlobalTree, id: &ItemId, data: EntityData) {\n-    tree.set_entity_data(id, data);\n+async fn reddit_worker(\n+    mut rx: mpsc::Receiver<RedditCommand>,\n+    tree: Arc<RwLock<GlobalTree>>,\n+    client: Client,\n+    creds: Option<RedditCredentials>,\n+) {\n+    let mut in_flight = HashSet::new();\n+    let mut recently_fetched: HashMap<ItemId, Instant> = HashMap::new();\n+    let mut current_delay = Duration::from_secs(1);\n+    let mut oauth: Option<OAuthToken> = None;\n+    let cache_ttl = Duration::from_secs(300);\n+\n+    while let Some(cmd) = rx.recv().await {\n+        let now = Instant::now();\n+        recently_fetched.retain(|_, t| now.duration_since(*t) < cache_ttl);\n+\n+        if in_flight.contains(&cmd.id) || recently_fetched.contains_key(&cmd.id) {\n+            continue;\n+        }\n+\n+        in_flight.insert(cmd.id.clone());\n+        let fetch_id = cmd.id.clone();\n+\n+        tokio::time::sleep(current_delay).await;\n+\n+        if let Some(c) = &creds {\n+            oauth = ensure_oauth_token(&client, c, oauth.take()).await;\n+        }\n+\n+        let token = oauth.as_ref().map(|t| t.access_token.as_str());\n+        let use_oauth = token.is_some();\n+\n+        match do_fetch(&client, &fetch_id, use_oauth, token).await {\n+            Ok(FetchOutcome::Entity(data)) => {\n+                let mut w = tree.write().await;\n+                w.set_entity_data(&fetch_id, data);\n+                recently_fetched.insert(fetch_id.clone(), Instant::now());\n+                current_delay = Duration::from_millis(600);\n+            }\n+            Ok(FetchOutcome::NotFound) => {\n+                recently_fetched.insert(fetch_id.clone(), Instant::now());\n+            }\n+            Ok(FetchOutcome::RateLimited { reset_secs }) => {\n+                let wait = Duration::from_secs(reset_secs.max(1));\n+                tracing::warn!(\n+                    \"Reddit rate limit for {}; sleeping {}s\",\n+                    fetch_id,\n+                    wait.as_secs()\n+                );\n+                tokio::time::sleep(wait).await;\n+                current_delay = (current_delay * 2).min(Duration::from_secs(60));\n+            }\n+            Err(e) => {\n+                tracing::warn!(\"Reddit fetch failed for {}: {}\", fetch_id, e);\n+                current_delay = (current_delay * 2).min(Duration::from_secs(60));\n+            }\n+        }\n+\n+        in_flight.remove(&fetch_id);\n+    }\n+}\n+\n+enum FetchOutcome {\n+    Entity(EntityData),\n+    NotFound,\n+    RateLimited { reset_secs: u64 },\n+}\n+\n+async fn ensure_oauth_token(\n+    client: &Client,\n+    creds: &RedditCredentials,\n+    existing: Option<OAuthToken>,\n+) -> Option<OAuthToken> {\n+    if let Some(t) = existing {\n+        if Instant::now() < t.expires_at - Duration::from_secs(60) {\n+            return Some(t);\n+        }\n+    }\n+\n+    let resp = client\n+        .post(\"https://www.reddit.com/api/v1/access_token\")\n+        .basic_auth(&creds.client_id, Some(&creds.client_secret))\n+        .form(&[(\"grant_type\", \"client_credentials\")])\n+        .send()\n+        .await;\n+\n+    let resp = match resp {\n+        Ok(r) => r,\n+        Err(e) => {\n+            tracing::warn!(\"Reddit OAuth token request failed: {e}\");\n+            return None;\n+        }\n+    };\n+\n+    if !resp.status().is_success() {\n+        tracing::warn!(\"Reddit OAuth token HTTP {}\", resp.status());\n+        return None;\n+    }\n+\n+    #[derive(Deserialize)]\n+    struct TokenResponse {\n+        access_token: String,\n+        expires_in: u64,\n+    }\n+\n+    let body: TokenResponse = match resp.json().await {\n+        Ok(b) => b,\n+        Err(e) => {\n+            tracing::warn!(\"Reddit OAuth token parse failed: {e}\");\n+            return None;\n+        }\n+    };\n+\n+    Some(OAuthToken {\n+        access_token: body.access_token,\n+        expires_at: Instant::now() + Duration::from_secs(body.expires_in),\n+    })\n+}\n+\n+async fn do_fetch(\n+    client: &Client,\n+    id: &ItemId,\n+    use_oauth: bool,\n+    bearer: Option<&str>,\n+) -> Result<FetchOutcome, String> {\n+    let url = map_item_to_reddit_api(id, use_oauth);\n+    if url.is_empty() {\n+        return Ok(FetchOutcome::NotFound);\n+    }\n+\n+    let mut req = client.get(&url);\n+    if let Some(token) = bearer {\n+        req = req.bearer_auth(token);\n+    }\n+\n+    let resp = req.send().await.map_err(|e| e.to_string())?;\n+\n+    if resp.status() == StatusCode::TOO_MANY_REQUESTS {\n+        let reset = rate_limit_reset_secs(&resp);\n+        return Ok(FetchOutcome::RateLimited { reset_secs: reset });\n+    }\n+\n+    if resp.status() == StatusCode::SERVICE_UNAVAILABLE {\n+        return Err(\"Reddit unavailable (503)\".to_string());\n+    }\n+\n+    if !resp.status().is_success() {\n+        return Ok(FetchOutcome::NotFound);\n+    }\n+\n+    if rate_limit_remaining(&resp) == Some(0) {\n+        let reset = rate_limit_reset_secs(&resp);\n+        return Ok(FetchOutcome::RateLimited { reset_secs: reset });\n+    }\n+\n+    let bytes = resp.bytes().await.map_err(|e| e.to_string())?;\n+    Ok(parse_reddit_json(id, &bytes)\n+        .map(FetchOutcome::Entity)\n+        .unwrap_or(FetchOutcome::NotFound))\n+}\n+\n+fn rate_limit_remaining(resp: &reqwest::Response) -> Option<u64> {\n+    resp.headers()\n+        .get(\"x-ratelimit-remaining\")\n+        .and_then(|v| v.to_str().ok())\n+        .and_then(|s| s.parse::<f64>().ok())\n+        .map(|f| f.floor() as u64)\n+}\n+\n+fn rate_limit_reset_secs(resp: &reqwest::Response) -> u64 {\n+    resp.headers()\n+        .get(\"x-ratelimit-reset\")\n+        .and_then(|v| v.to_str().ok())\n+        .and_then(|s| s.parse::<f64>().ok())\n+        .map(|f| f.ceil() as u64)\n+        .unwrap_or(5)\n+}\n+\n+/// Map canonical item id to Reddit JSON API URL.\n+pub fn map_item_to_reddit_api(id: &ItemId, oauth: bool) -> String {\n+    let path = id.as_str();\n+    if !path.starts_with(\"reddit.com/\") && path != \"reddit.com\" {\n+        return String::new();\n+    }\n+\n+    let base = if oauth {\n+        \"https://oauth.reddit.com\"\n+    } else {\n+        \"https://www.reddit.com\"\n+    };\n+\n+    let segments: Vec<&str> = path.split('/').collect();\n+\n+    if let Some(i) = segments.iter().position(|&p| p == \"comments\") {\n+        if segments.len() > i + 1 {\n+            let api_path = segments[1..=i + 1].join(\"/\");\n+            return format!(\"{base}/{api_path}.json?raw_json=1\");\n+        }\n+    }\n+\n+    if segments.len() == 3 && segments[1] == \"r\" {\n+        return format!(\"{base}/r/{}/about.json?raw_json=1\", segments[2]);\n+    }\n+\n+    String::new()\n+}\n+\n+fn parse_reddit_json(id: &ItemId, bytes: &[u8]) -> Option<EntityData> {\n+    let v: serde_json::Value = serde_json::from_slice(bytes).ok()?;\n+    let segments: Vec<&str> = id.as_str().split('/').collect();\n+\n+    if segments.iter().any(|&p| p == \"comments\") {\n+        parse_post_listing(&v)\n+    } else {\n+        parse_subreddit_about(&v)\n+    }\n+}\n+\n+fn parse_subreddit_about(v: &serde_json::Value) -> Option<EntityData> {\n+    let data = v.get(\"data\")?;\n+    let title = data\n+        .get(\"title\")\n+        .or_else(|| data.get(\"display_name\"))\n+        .and_then(|t| t.as_str())?\n+        .to_string();\n+    let body_html = data\n+        .get(\"public_description_html\")\n+        .or_else(|| data.get(\"public_description\"))\n+        .and_then(|t| t.as_str())\n+        .map(|s| s.to_string());\n+    let thumb_url = data\n+        .get(\"icon_img\")\n+        .or_else(|| data.get(\"community_icon\"))\n+        .and_then(|t| t.as_str())\n+        .filter(|s| !s.is_empty())\n+        .map(|s| s.to_string());\n+\n+    Some(EntityData {\n+        title,\n+        author: None,\n+        body_html,\n+        thumb_url,\n+    })\n+}\n+\n+fn parse_post_listing(v: &serde_json::Value) -> Option<EntityData> {\n+    let listing = v.as_array()?.first()?;\n+    let child = listing\n+        .pointer(\"/data/children/0/data\")?;\n+    let title = child.get(\"title\")?.as_str()?.to_string();\n+    let author = child\n+        .get(\"author\")\n+        .and_then(|a| a.as_str())\n+        .filter(|a| *a != \"[deleted]\")\n+        .map(|s| s.to_string());\n+    let body_html = child\n+        .get(\"selftext_html\")\n+        .and_then(|t| t.as_str())\n+        .filter(|s| !s.is_empty())\n+        .map(|s| s.to_string());\n+    let thumb_url = child\n+        .get(\"thumbnail\")\n+        .and_then(|t| t.as_str())\n+        .filter(|s| s.starts_with(\"http\"))\n+        .map(|s| s.to_string());\n+\n+    Some(EntityData {\n+        title,\n+        author,\n+        body_html,\n+        thumb_url,\n+    })\n+}\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::*;\n+\n+    #[test]\n+    fn map_subreddit_about_url() {\n+        let id = ItemId::parse(\"reddit.com/r/rust\").unwrap();\n+        assert_eq!(\n+            map_item_to_reddit_api(&id, false),\n+            \"https://www.reddit.com/r/rust/about.json?raw_json=1\"\n+        );\n+        assert_eq!(\n+            map_item_to_reddit_api(&id, true),\n+            \"https://oauth.reddit.com/r/rust/about.json?raw_json=1\"\n+        );\n+    }\n+\n+    #[test]\n+    fn map_post_url() {\n+        let id =\n+            ItemId::parse(\"reddit.com/r/amitheasshole/comments/1trnvdl\").unwrap();\n+        assert_eq!(\n+            map_item_to_reddit_api(&id, false),\n+            \"https://www.reddit.com/r/amitheasshole/comments/1trnvdl.json?raw_json=1\"\n+        );\n+    }\n+\n+    #[test]\n+    fn map_non_reddit_empty() {\n+        let id = ItemId::opaque(\"example.com/foo\");\n+        assert!(map_item_to_reddit_api(&id, false).is_empty());\n+    }\n+\n+    #[test]\n+    fn parse_subreddit_fixture() {\n+        let json = r#\"{\"kind\":\"t5\",\"data\":{\"title\":\"Rust\",\"display_name\":\"rust\",\"public_description\":\"systems\"}}\"#;\n+        let entity = parse_reddit_json(\n+            &ItemId::parse(\"reddit.com/r/rust\").unwrap(),\n+            json.as_bytes(),\n+        )\n+        .unwrap();\n+        assert_eq!(entity.title, \"Rust\");\n+    }\n+\n+    #[test]\n+    fn parse_post_fixture() {\n+        let json = r#\"[{\"kind\":\"Listing\",\"data\":{\"children\":[{\"kind\":\"t3\",\"data\":{\"title\":\"AITA\",\"author\":\"op\",\"selftext_html\":\"&lt;p&gt;hi&lt;/p&gt;\",\"thumbnail\":\"https://b.thumbs.redditmedia.com/x.jpg\"}}]}}]\"#;\n+        let entity = parse_reddit_json(\n+            &ItemId::parse(\"reddit.com/r/x/comments/abc\").unwrap(),\n+            json.as_bytes(),\n+        )\n+        .unwrap();\n+        assert_eq!(entity.title, \"AITA\");\n+        assert_eq!(entity.author.as_deref(), Some(\"op\"));\n+    }\n }\ndiff --git a/server/src/state.rs b/server/src/state.rs\nindex cc1722f5a5bf4d415f2327ea585c488a15a75592..8c03aa60c15aee803a534439400b69935b1a3d84 100644\n--- a/server/src/state.rs\n+++ b/server/src/state.rs\n@@ -5,9 +5,10 @@ use tokio::sync::RwLock;\n use crate::{\n     event_log::EventLog,\n     events::Event,\n+    journal::JournalClient,\n     path_types::ItemId,\n+    reddit::{default_user_agent, RedditBroker},\n     reducer::{GlobalTree, VoteData},\n-    journal::JournalClient,\n     views::ViewStore,\n };\n \n@@ -73,6 +74,7 @@ pub struct AppState {\n     pub views: ViewStore,\n     pub tree: Arc<RwLock<GlobalTree>>,\n     journal: JournalClient,\n+    pub reddit: RedditBroker,\n }\n \n impl AppState {\n@@ -112,6 +114,7 @@ impl AppState {\n \n         let tree = Arc::new(RwLock::new(tree));\n         let journal = JournalClient::spawn(tree.clone(), event_log.clone());\n+        let reddit = RedditBroker::spawn(tree.clone(), &default_user_agent());\n \n         Self {\n             cfg: Arc::new(cfg),\n@@ -119,6 +122,7 @@ impl AppState {\n             views,\n             tree,\n             journal,\n+            reddit,\n         }\n     }\n \n@@ -127,8 +131,11 @@ impl AppState {\n             id: id.as_str().to_string(),\n         };\n         self.event_log.append(&event).await.map_err(|e| e.to_string())?;\n-        let mut w = self.tree.write().await;\n-        w.ensure_path(id);\n+        {\n+            let mut w = self.tree.write().await;\n+            w.ensure_path(id);\n+        }\n+        self.reddit.request_fetch(id.clone());\n         Ok(())\n     }\n \ndiff --git a/todo b/todo\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..d196e8cb4cc80ccb95eeff01c73607d520e13212\n--- /dev/null\n+++ b/todo\n@@ -0,0 +1,7 @@\n+reddit import (only on explicit request)\n+reddit rendering\n+vote redering\n+pair chosing\n+nsfw gate\n+\n+logins (uuid user, two sides, oauths, and pseudonyms)\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[c94456ff] Make feed catch-up stable and permission-aware\n\nAnchor implicit feeds to durable ingest order and cover multi-user private-room visibility so concurrent posts are not missed or leaked.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/cli/src/main.rs b/cli/src/main.rs\nindex abb5a55b49f60fe28fbfd4ec02715cb94ea0b4ec..c4f1494df3aedbd8b883aea6249579aa8336abfe 100644\n--- a/cli/src/main.rs\n+++ b/cli/src/main.rs\n@@ -878,6 +878,30 @@ mod tests {\n             \"graph: 4 items, 3/6 pairs (50.0% density), 1 component, connected\"\n         );\n     }\n+\n+    #[test]\n+    fn feed_without_since_uses_logged_in_delegate_from_env() {\n+        let key = \"SLUG_DELEGATE\";\n+        let previous = std::env::var_os(key);\n+        let expected = \"00000000-0000-0000-0000-0000000000ee:test:local/model\";\n+        std::env::set_var(key, expected);\n+\n+        let cli = Cli::try_parse_from([\"slugsocial\", \"feed\"]).expect(\"parse feed\");\n+\n+        match previous {\n+            Some(value) => std::env::set_var(key, value),\n+            None => std::env::remove_var(key),\n+        }\n+        match cli.cmd {\n+            Some(Command::Feed {\n+                delegate, since, ..\n+            }) => {\n+                assert_eq!(delegate.as_deref(), Some(expected));\n+                assert!(since.is_none());\n+            }\n+            _ => panic!(\"expected feed command\"),\n+        }\n+    }\n }\n \n async fn run_scoped(base: &str, room: &str, sub: ScopedCmd) -> Result<()> {\n@@ -1626,7 +1650,15 @@ async fn run() -> Result<()> {\n                 } else {\n                     for p in &resp.posts {\n                         let ago = slug_types::timeago::timeago(now_ms, p.ts);\n-                        println!(\"<post id=\\\"{}\\\" ts=\\\"{}\\\">\", p.id, ago);\n+                        let thread_attr = p\n+                            .thread\n+                            .as_deref()\n+                            .map(|thread| format!(\" thread=\\\"{thread}\\\"\"))\n+                            .unwrap_or_default();\n+                        println!(\n+                            \"<post id=\\\"{}\\\" ts=\\\"{}\\\" room=\\\"{}\\\"{}>\",\n+                            p.id, ago, p.room, thread_attr\n+                        );\n                         print!(\"{}\", p.body);\n                         if !p.body.ends_with('\\n') { println!(); }\n                         println!(\"</post>\");\ndiff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs\nindex afc4f95bef160c1e38ecff2c096d6440cd94e2b3..46d748f918d9b225acc4ecedfe5a1793089407b5 100644\n--- a/server/src/api/rpc.rs\n+++ b/server/src/api/rpc.rs\n@@ -72,6 +72,80 @@ fn can_view_scope(reduced: &ReducerState, scope: &ScopeId, principal: Option<&st\n     }\n }\n \n+/// Build a feed in durable ingest order.\n+///\n+/// An implicit feed boundary is an ingest position, not only its millisecond timestamp. Two users\n+/// can post in the same millisecond, and wall-clock timestamps can move backwards during replay.\n+/// Explicit `since` remains a timestamp query for API compatibility, but scans the whole ordered\n+/// ledger rather than assuming timestamps are monotonic.\n+fn rpc_feed(\n+    reduced: &ReducerState,\n+    viewer: &str,\n+    delegate: Option<String>,\n+    requested_since: Option<i64>,\n+    implicit_anchor: Option<(usize, i64)>,\n+    limit: usize,\n+) -> FeedResponse {\n+    let since = requested_since.or_else(|| implicit_anchor.map(|(_, ts)| ts));\n+    let implicit_anchor_index = requested_since\n+        .is_none()\n+        .then(|| implicit_anchor.map(|(index, _)| index))\n+        .flatten();\n+\n+    let matching: Vec<&str> = reduced\n+        .ingests_ordered\n+        .iter()\n+        .enumerate()\n+        .rev()\n+        .filter(|(index, id)| {\n+            reduced.ingests_by_id.get(id.as_str()).is_some_and(|ing| {\n+                match requested_since {\n+                    Some(cutoff) => ing.ts > cutoff,\n+                    None => implicit_anchor_index.is_none_or(|anchor| *index > anchor),\n+                }\n+            })\n+        })\n+        .map(|(_, id)| id.as_str())\n+        .filter(|id| {\n+            reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n+                let scope = scope_from_room_wire(&ing.room_id);\n+                can_view_scope(reduced, &scope, Some(viewer))\n+            })\n+        })\n+        .filter(|id| !reduced.redacted_posts.contains(*id))\n+        .collect();\n+\n+    let total = matching.len();\n+    let posts = matching\n+        .into_iter()\n+        .take(limit)\n+        .filter_map(|id| reduced.ingests_by_id.get(id))\n+        .map(|ing| {\n+            let scope = scope_from_room_wire(&ing.room_id);\n+            let thread_post_index = reduced.try_thread_post_index_chronological(\n+                &scope,\n+                &ing.thread_tag,\n+                &ing.id,\n+            );\n+            FeedPost {\n+                ts: ing.ts,\n+                id: ing.id.clone(),\n+                room: ing.room_id.clone(),\n+                thread: Some(ing.thread_tag.clone()),\n+                thread_post_index,\n+                body: ing.raw.clone(),\n+            }\n+        })\n+        .collect();\n+\n+    FeedResponse {\n+        delegate,\n+        since,\n+        posts,\n+        total,\n+    }\n+}\n+\n fn principal_from_optional_bearer(headers: &HeaderMap, reduced: &ReducerState) -> Result<Option<String>, RpcErr> {\n     if headers.contains_key(axum::http::header::AUTHORIZATION) {\n         verify_bearer_principal(headers, reduced)\n@@ -1506,60 +1580,27 @@ pub async fn handle_rpc_batch(\n                                         Some(\"this delegate is not bound to your signed-in account\".into()),\n                                     )\n                                 } else {\n-                                    let since_default = reduced\n+                                    let implicit_anchor = reduced\n                                         .ingests_ordered\n                                         .iter()\n+                                        .enumerate()\n                                         .rev()\n-                                        .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                        .find(|ing| {\n-                                            if ing.delegate.as_deref() != Some(delegate_stored.as_str()) {\n-                                                return false;\n-                                            }\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n-                                        })\n-                                        .map(|ing| ing.ts);\n-                                    let since = since.or(since_default);\n-                                    let cutoff = since.unwrap_or(0);\n-                                    let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n-                                    let matching: Vec<&str> = reduced.ingests_ordered.iter().rev()\n-                                        .map(|id| id.as_str())\n-                                        .take_while(|id| reduced.ingests_by_id.get(*id).is_some_and(|ing| ing.ts > cutoff))\n-                                        .filter(|id| {\n-                                            reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n-                                                let scope = scope_from_room_wire(&ing.room_id);\n-                                                can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n+                                        .find_map(|(index, id)| {\n+                                            reduced.ingests_by_id.get(id).and_then(|ing| {\n+                                                (ing.delegate.as_deref()\n+                                                    == Some(delegate_stored.as_str()))\n+                                                .then_some((index, ing.ts))\n                                             })\n-                                        })\n-                                        .filter(|id| !reduced.redacted_posts.contains(*id))\n-                                        .collect();\n-                                    let total = matching.len();\n-                                    let posts: Vec<FeedPost> = matching.into_iter()\n-                                        .take(limit)\n-                                        .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                        .map(|ing| {\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            let thread_post_index = reduced\n-                                                .try_thread_post_index_chronological(\n-                                                    &scope,\n-                                                    &ing.thread_tag,\n-                                                    &ing.id,\n-                                                );\n-                                            FeedPost {\n-                                                ts: ing.ts,\n-                                                id: ing.id.clone(),\n-                                                thread: Some(ing.thread_tag.clone()),\n-                                                thread_post_index,\n-                                                body: ing.raw.clone(),\n-                                            }\n-                                        })\n-                                        .collect();\n-                                    line_ok(RpcResult::Feed(FeedResponse {\n-                                        delegate: Some(delegate_stored),\n+                                        });\n+                                    let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n+                                    line_ok(RpcResult::Feed(rpc_feed(\n+                                        &reduced,\n+                                        &viewer,\n+                                        Some(delegate_stored),\n                                         since,\n-                                        posts,\n-                                        total,\n-                                    }))\n+                                        implicit_anchor,\n+                                        limit,\n+                                    )))\n                                 };\n                                 drop(reduced);\n                                 line\n@@ -1567,60 +1608,25 @@ pub async fn handle_rpc_batch(\n                             None => {\n                                 // Session catch-up: last time *you* posted anything (delegate or not), so revisiting\n                                 // an old chat with only a token still gets a sane cutoff.\n-                                let since_default = reduced\n+                                let implicit_anchor = reduced\n                                     .ingests_ordered\n                                     .iter()\n+                                    .enumerate()\n                                     .rev()\n-                                    .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                    .find(|ing| {\n-                                        if ing.principal != viewer {\n-                                            return false;\n-                                        }\n-                                        let scope = scope_from_room_wire(&ing.room_id);\n-                                        can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n-                                    })\n-                                    .map(|ing| ing.ts);\n-                                let since = since.or(since_default);\n-                                let cutoff = since.unwrap_or(0);\n-                                let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n-                                let matching: Vec<&str> = reduced.ingests_ordered.iter().rev()\n-                                    .map(|id| id.as_str())\n-                                    .take_while(|id| reduced.ingests_by_id.get(*id).is_some_and(|ing| ing.ts > cutoff))\n-                                    .filter(|id| {\n-                                        reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n+                                    .find_map(|(index, id)| {\n+                                        reduced.ingests_by_id.get(id).and_then(|ing| {\n+                                            (ing.principal == viewer).then_some((index, ing.ts))\n                                         })\n-                                    })\n-                                    .filter(|id| !reduced.redacted_posts.contains(*id))\n-                                    .collect();\n-                                let total = matching.len();\n-                                let posts: Vec<FeedPost> = matching.into_iter()\n-                                    .take(limit)\n-                                    .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                    .map(|ing| {\n-                                        let scope = scope_from_room_wire(&ing.room_id);\n-                                        let thread_post_index = reduced\n-                                            .try_thread_post_index_chronological(\n-                                                &scope,\n-                                                &ing.thread_tag,\n-                                                &ing.id,\n-                                            );\n-                                        FeedPost {\n-                                            ts: ing.ts,\n-                                            id: ing.id.clone(),\n-                                            thread: Some(ing.thread_tag.clone()),\n-                                            thread_post_index,\n-                                            body: ing.raw.clone(),\n-                                        }\n-                                    })\n-                                    .collect();\n-                                let line = line_ok(RpcResult::Feed(FeedResponse {\n-                                    delegate: None,\n+                                    });\n+                                let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n+                                let line = line_ok(RpcResult::Feed(rpc_feed(\n+                                    &reduced,\n+                                    &viewer,\n+                                    None,\n                                     since,\n-                                    posts,\n-                                    total,\n-                                }));\n+                                    implicit_anchor,\n+                                    limit,\n+                                )));\n                                 drop(reduced);\n                                 line\n                             }\ndiff --git a/server/tests/integration_rooms.rs b/server/tests/integration_rooms.rs\nindex a3b378267e090a016a7e663f103a0dd9f482690b..e623523ba352ce456674a399542c689505760b78 100644\n--- a/server/tests/integration_rooms.rs\n+++ b/server/tests/integration_rooms.rs\n@@ -1,6 +1,9 @@\n mod support;\n \n use slug_types::room_route_segment;\n+use slugsocial_server::events::{\n+    AgentBound, Event, GrantAdded, GrantRevoked, Ingest, RoomCreated, ThreadCapability,\n+};\n use support::*;\n \n #[tokio::test]\n@@ -473,6 +476,247 @@ async fn test_feed_without_delegate_uses_principal_last_post_including_delegate(\n     );\n }\n \n+#[tokio::test]\n+async fn test_feed_uses_delegate_ingest_position_when_multi_user_timestamps_collide() {\n+    let (addr, _tmp, _log, state, _handle) = create_test_server_with_state().await;\n+    seed_test_identity(&state, \"bob\", \"bobtok\", \"bobsecret\").await;\n+    let client = reqwest::Client::new();\n+    let alice_delegate =\n+        \"00000000-0000-0000-0000-0000000000c1:feedtest:local/alice-model\";\n+    let bob_delegate =\n+        \"00000000-0000-0000-0000-0000000000c2:feedtest:local/bob-model\";\n+\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        for (agent, username) in [\n+            (alice_delegate, \"testuser\"),\n+            (bob_delegate, \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::AgentBound(AgentBound {\n+                ts: 1,\n+                agent: agent.to_string(),\n+                username: username.to_string(),\n+            }));\n+        }\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 100,\n+            id: \"alice-anchor\".into(),\n+            raw: \"alice anchor\".into(),\n+            principal: \"testuser\".into(),\n+            delegate: Some(alice_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 100,\n+            id: \"bob-same-millisecond\".into(),\n+            raw: \"bob same-millisecond change\".into(),\n+            principal: \"bob\".into(),\n+            delegate: Some(bob_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+        // Event-log order remains authoritative even if the wall clock moves backwards.\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 99,\n+            id: \"bob-clock-rollback\".into(),\n+            raw: \"bob change after clock rollback\".into(),\n+            principal: \"bob\".into(),\n+            delegate: Some(bob_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+    }\n+\n+    let feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let posts = feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap();\n+    let ids: Vec<&str> = posts.iter().filter_map(|p| p[\"id\"].as_str()).collect();\n+    assert_eq!(\n+        ids,\n+        [\"bob-clock-rollback\", \"bob-same-millisecond\"],\n+        \"implicit feed cutoff must use append position, not timestamp\"\n+    );\n+}\n+\n+#[tokio::test]\n+async fn test_feed_multi_user_private_room_visibility_and_revoked_anchor_access() {\n+    let (addr, _tmp, _log, state, _handle) = create_test_server_with_state().await;\n+    seed_test_identity(&state, \"bob\", \"bobtok\", \"bobsecret\").await;\n+    seed_test_identity(&state, \"carol\", \"caroltok\", \"carolsecret\").await;\n+    let client = reqwest::Client::new();\n+    let alice_delegate =\n+        \"00000000-0000-0000-0000-0000000000d1:feedtest:local/alice-model\";\n+    let bob_delegate =\n+        \"00000000-0000-0000-0000-0000000000d2:feedtest:local/bob-model\";\n+    let room_alice = \"alice01/alice-room\";\n+    let room_bob = \"bob0001/bob-room\";\n+\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        for (agent, username) in [\n+            (alice_delegate, \"testuser\"),\n+            (bob_delegate, \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::AgentBound(AgentBound {\n+                ts: 1,\n+                agent: agent.to_string(),\n+                username: username.to_string(),\n+            }));\n+        }\n+        for (room_id, slug, owner) in [\n+            (room_alice, \"alice-room\", \"testuser\"),\n+            (room_bob, \"bob-room\", \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::RoomCreated(RoomCreated {\n+                ts: 2,\n+                room_id: room_id.to_string(),\n+                slug: slug.to_string(),\n+                owner: owner.to_string(),\n+            }));\n+            reduced.apply_event(Event::GrantAdded(GrantAdded {\n+                ts: 2,\n+                room_id: room_id.to_string(),\n+                username: owner.to_string(),\n+                capabilities: vec![ThreadCapability::View],\n+                granted_by: owner.to_string(),\n+            }));\n+        }\n+\n+        let mut add_ingest =\n+            |ts, id: &str, raw: &str, principal: &str, delegate: Option<&str>, room: &str| {\n+                reduced.apply_event(Event::Ingest(Ingest {\n+                    ts,\n+                    id: id.into(),\n+                    raw: raw.into(),\n+                    principal: principal.into(),\n+                    delegate: delegate.map(str::to_string),\n+                    room_id: room.into(),\n+                    thread_tag: \"feed-permissions\".into(),\n+                }));\n+            };\n+        add_ingest(10, \"prehistory\", \"must remain before alice anchor\", \"carol\", None, \"public\");\n+        add_ingest(\n+            11,\n+            \"alice-private-anchor\",\n+            \"alice last posted here\",\n+            \"testuser\",\n+            Some(alice_delegate),\n+            room_alice,\n+        );\n+        add_ingest(\n+            12,\n+            \"bob-public-anchor\",\n+            \"bob last posted here\",\n+            \"bob\",\n+            Some(bob_delegate),\n+            \"public\",\n+        );\n+        add_ingest(13, \"alice-room-change\", \"visible only to alice\", \"carol\", None, room_alice);\n+        add_ingest(14, \"bob-room-change\", \"visible only to bob\", \"carol\", None, room_bob);\n+        add_ingest(15, \"public-change\", \"visible to everyone\", \"carol\", None, \"public\");\n+\n+        reduced.apply_event(Event::GrantRevoked(GrantRevoked {\n+            ts: 16,\n+            room_id: room_alice.into(),\n+            username: \"testuser\".into(),\n+            capabilities: vec![ThreadCapability::View],\n+            revoked_by: \"testuser\".into(),\n+        }));\n+    }\n+\n+    let alice_feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let alice_posts = alice_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap();\n+    let alice_ids: Vec<&str> = alice_posts\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(\n+        alice_ids,\n+        [\"public-change\", \"bob-public-anchor\"],\n+        \"revoked private content must be hidden without moving the delegate anchor backwards\"\n+    );\n+    assert!(!alice_ids.contains(&\"prehistory\"));\n+    assert!(\n+        alice_posts\n+            .iter()\n+            .all(|post| post[\"room\"].as_str() == Some(\"public\")),\n+        \"private posts must not leak and every feed post must identify its room\"\n+    );\n+\n+    let bob_bearer = test_bearer_for(\"bobtok\", \"bobsecret\");\n+    let bob_feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&bob_bearer),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": bob_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let bob_ids: Vec<&str> = bob_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap()\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(bob_ids, [\"public-change\", \"bob-room-change\"]);\n+    assert_eq!(\n+        bob_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"][1][\"room\"],\n+        room_bob\n+    );\n+\n+    // Restoring View exposes only changes after the same stable delegate anchor.\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        reduced.apply_event(Event::GrantAdded(GrantAdded {\n+            ts: 17,\n+            room_id: room_alice.into(),\n+            username: \"testuser\".into(),\n+            capabilities: vec![ThreadCapability::View],\n+            granted_by: \"testuser\".into(),\n+        }));\n+    }\n+    let restored = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let restored_ids: Vec<&str> = restored[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap()\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(\n+        restored_ids,\n+        [\"public-change\", \"alice-room-change\", \"bob-public-anchor\"]\n+    );\n+}\n+\n #[tokio::test]\n async fn test_private_room_thread_urls_use_t_segment() {\n     let (addr, _tmp, _log, _handle) = create_test_server().await;\ndiff --git a/server/tests/support/mod.rs b/server/tests/support/mod.rs\nindex 4a620eaa875e7a1145f2a4e82cc4ff2be21d5345..a4320e991763617c1a760efad4b621977e2b74d0 100644\n--- a/server/tests/support/mod.rs\n+++ b/server/tests/support/mod.rs\n@@ -20,8 +20,10 @@ pub fn sha256_hex(s: &str) -> String {\n \n /// Fixed bearer for integration tests (`TokenIssued` seeded into reducer in `create_test_server`).\n pub fn test_bearer() -> String {\n-    let token_id = \"testtok\";\n-    let secret = \"secret\";\n+    test_bearer_for(\"testtok\", \"secret\")\n+}\n+\n+pub fn test_bearer_for(token_id: &str, secret: &str) -> String {\n     format!(\"slug_{token_id}_{secret}\")\n }\n \n@@ -71,19 +73,27 @@ pub async fn rpc_batch(\n }\n \n pub async fn seed_test_token(state: &AppState) {\n+    seed_test_identity(state, \"testuser\", \"testtok\", \"secret\").await;\n+}\n+\n+/// Add a distinct principal and bearer to a running integration-test server.\n+pub async fn seed_test_identity(\n+    state: &AppState,\n+    username: &str,\n+    token_id: &str,\n+    secret: &str,\n+) {\n     let registered = Event::UserRegistered(UserRegistered {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         provider: \"test\".to_string(),\n-        provider_id: \"testuser\".to_string(),\n+        provider_id: username.to_string(),\n     });\n-    let token_id = \"testtok\";\n-    let secret = \"secret\";\n     let salt = \"salt\";\n     let token_hash = sha256_hex(&format!(\"{salt}:{secret}\"));\n     let ev = Event::TokenIssued(TokenIssued {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         token_id: token_id.to_string(),\n         token_hash,\n         salt: salt.to_string(),\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex 211493935d19582607f5c87fb492faf47bdc6f53..cd6f94c60a4e1c3bfbce13bc0404b803f5f57c6d 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -264,6 +264,9 @@ pub struct FeedResponse {\n pub struct FeedPost {\n     pub ts: i64,\n     pub id: String,\n+    /// Permission scope containing the post: `\"public\"` or a private room id.\n+    #[serde(default)]\n+    pub room: String,\n     /// Primary thread tag (without #), if the ingest declared one.\n     #[serde(skip_serializing_if = \"Option::is_none\")]\n     pub thread: Option<String>,\n","role":"user"}],"model":"openai/gpt-chat-latest"}