{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[880eb778] Harden auth: fail-closed votes, mock OAuth gate, Secure cookies.\n\nAlso show the current alias in the top nav and pin durable by rev.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide A — unified diff (full patch):\ndiff --git a/AGENTS.md b/AGENTS.md\nindex babb889d6fbfb1fa7176c9e6b7544ae17b61dd2e..6e0fd8ebb65d665c9c1438e3275971d62b98fd95 100644\n--- a/AGENTS.md\n+++ b/AGENTS.md\n@@ -10,11 +10,11 @@ Single Rust web app **`sorter2-server`**: pairwise voting, rank-centrality ranki\n \n - **Bootstrap script**: `./scripts/cursor-env-install.sh` (also run via `.cursor/environment.json` on Cloud Agent boot) installs Playwright Chromium, Babashka, bbin, `clj-paren-repair`, and warms the RocksDB build.\n - **Rust 1.88+** is required (`rust-toolchain.toml`). The Cloud Dockerfile and `cursor-env-install.sh` install **rustup** 1.88.0 first so `cargo` works while Playwright/Clojure bootstrap continues. Do not rely on `/usr/local/cargo` (often missing or stale).\n-- **RocksDB / `durable`**: Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS=\"-C linker=g++\"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.\n+- **RocksDB / `durable`**: `durable` is an external git dependency (`tommy-mor/durable`, pinned by rev in `server/Cargo.toml`). Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS=\"-C linker=g++\"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.\n - **System packages** for builds: `build-essential`, `g++`, `clang`, `libclang-dev`, `pkg-config`, `libssl-dev`, `openjdk-21-jre-headless` (for `reqwest` / OpenSSL, `librocksdb-sys`, `zstd-sys` / bindgen, and **bbin** / Clojure JVM). The bootstrap sets **`JAVA_HOME`** when Java is present.\n - **Clojure CLI 1.12.0.1530** (used in CI): install from https://clojure.org/guides/install_clojure — needed for `./scripts/clj-test.sh` / Kaocha tests.\n - **Babashka / bbin / clj-paren-repair**: installed by `cursor-env-install.sh` into `~/.local/bin` (bb tasks in `bb.edn`, delimiter repair for Clojure edits).\n-- **Playwright** (Spel browser tests in `test/vote_compare.clj`): Chromium via `clojure -M -e \"(com.microsoft.playwright.CLI/main ...)\"` — run once after clone or use the bootstrap script.\n+- **Playwright** (Spel browser tests in `test/vote_compare.clj` / `test/auth_login.clj`): Chromium via `clojure -M -e \"(com.microsoft.playwright.CLI/main ...)\"` — run once after clone or use the bootstrap script.\n \n ### Commands (see also `TEST.sh`)\n \n@@ -34,13 +34,17 @@ Environment variables (defaults in `server/src/state.rs`):\n - `PORT` — default `8080`\n - `SORTER2_DATA_DIR` — default `./data` (created on startup)\n - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`\n+- `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)\n+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)\n+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)\n \n Health check: `GET /healthz` → `ok`.\n \n-Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Example vote:\n+Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Votes require a session cookie (sign in via `/login`). Example vote:\n \n ```bash\n curl -sf -X POST http://127.0.0.1:8080/ui \\\n+  --cookie \"sorter2_session=...\" \\\n   --data-urlencode '__rpc__={\"action\":\"record_vote\",\"a\":\"alpha\",\"b\":\"beta\",\"ratio_left\":2,\"ratio_right\":1}'\n ```\n \ndiff --git a/Cargo.lock b/Cargo.lock\nindex aa02997ad85777195f135bfd9456bcee0fc9a590..1f8690f3e486d099577a32c2ece48caf57ea7160 100644\n--- a/Cargo.lock\n+++ b/Cargo.lock\n@@ -414,7 +414,7 @@ dependencies = [\n [[package]]\n name = \"durable\"\n version = \"0.2.0\"\n-source = \"git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n+source = \"git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n dependencies = [\n  \"ciborium\",\n  \"durable-derive\",\n@@ -426,7 +426,7 @@ dependencies = [\n [[package]]\n name = \"durable-derive\"\n version = \"0.2.0\"\n-source = \"git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n+source = \"git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf\"\n dependencies = [\n  \"proc-macro2\",\n  \"quote\",\ndiff --git a/server/Cargo.toml b/server/Cargo.toml\nindex dfa39beddecfa37dcdeaa602cb30f4b547528fbb..bd88687fb0ba47d68f2c08eb5e11d0e08b7c4398 100644\n--- a/server/Cargo.toml\n+++ b/server/Cargo.toml\n@@ -25,7 +25,7 @@ futures-util = { version = \"0.3\", default-features = false, features = [\"std\"] }\n rand = \"0.8\"\n urlencoding = \"2\"\n url = \"2\"\n-durable = { git = \"https://github.com/tommy-mor/durable.git\", branch = \"main\" }\n+durable = { git = \"https://github.com/tommy-mor/durable.git\", rev = \"a6c14eaa809693140eea0c22b07ef24d8e74adaf\" }\n \n [dev-dependencies]\n reqwest = { version = \"0.12\", features = [\"json\"] }\ndiff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs\nindex b86581b1f337650564274254d840e8a75b49524d..9da62ffbed07eb28729aa3160bf33b07ce0d7945 100644\n--- a/server/src/api/ui_html.rs\n+++ b/server/src/api/ui_html.rs\n@@ -71,10 +71,16 @@ pub async fn post_ui_html(\n                 return resp;\n             }\n             let parent = parent_from_scope(&scope);\n-            let actor = resolve_vote_actor(\n+            let actor = match resolve_vote_actor(\n                 state.projection_store.db(),\n                 session_id_from_jar(&jar).as_deref(),\n-            );\n+            ) {\n+                Ok(actor) => actor,\n+                Err(_) => {\n+                    return vote_auth_redirect(&state, &jar)\n+                        .unwrap_or_else(|| login_redirect_js().into_response());\n+                }\n+            };\n             if let Err(e) = state\n                 .record_vote(&parent, &a, &b, ratio_left, ratio_right, &actor)\n                 .await\ndiff --git a/server/src/auth/config.rs b/server/src/auth/config.rs\nindex a1f042c655bf3e5234eeb87a7d889f64592807fb..a5976af9a52ea207b35ae87bd1fe927c47a477ca 100644\n--- a/server/src/auth/config.rs\n+++ b/server/src/auth/config.rs\n@@ -1,9 +1,42 @@\n pub const AUTH_RETURN_COOKIE: &str = \"sorter2_auth_return\";\n \n+/// Allow `mock_user` on `/auth/github` (test harness only).\n+pub fn mock_oauth_allowed() -> bool {\n+    matches!(\n+        std::env::var(\"SORTER2_ALLOW_MOCK_OAUTH\").as_deref(),\n+        Ok(\"1\") | Ok(\"true\") | Ok(\"TRUE\")\n+    )\n+}\n+\n+/// Set the Secure flag on auth cookies when serving over HTTPS.\n+pub fn cookies_secure() -> bool {\n+    std::env::var(\"SORTER2_BASE_URL\")\n+        .map(|u| u.starts_with(\"https://\"))\n+        .unwrap_or(false)\n+}\n+\n pub fn sanitize_return_to(raw: &str) -> String {\n     let s = raw.trim();\n-    if s.is_empty() || !s.starts_with('/') || s.starts_with(\"//\") {\n+    if s.is_empty() || !s.starts_with('/') || s.starts_with(\"//\") || s.starts_with(\"/\\\\\") {\n+        return \"/\".to_string();\n+    }\n+    // Reject scheme-relative and protocol-smuggling forms.\n+    if s.contains(\"://\") || s.contains('\\\\') {\n         return \"/\".to_string();\n     }\n     s.to_string()\n }\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::*;\n+\n+    #[test]\n+    fn sanitize_return_to_blocks_open_redirects() {\n+        assert_eq!(sanitize_return_to(\"\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"//evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"/\\\\evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"https://evil.com\"), \"/\");\n+        assert_eq!(sanitize_return_to(\"/vote?parent=x\"), \"/vote?parent=x\");\n+    }\n+}\ndiff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs\nindex 5ed535ba199fa736f0048c32623b14c3b1e5de2d..d4a85ef52c15dc35148e4c743f0d646cbbdb056d 100644\n--- a/server/src/auth/mod.rs\n+++ b/server/src/auth/mod.rs\n@@ -26,7 +26,7 @@ use crate::{\n     ui_action::UI_RPC_FIELD,\n };\n \n-pub use session::{resolve_vote_actor, session_id_from_jar, VoteActor};\n+pub use session::{nav_pseudonym, resolve_vote_actor, session_id_from_jar, VoteActor};\n \n pub fn base_url_from_env(port: u16) -> String {\n     std::env::var(\"SORTER2_BASE_URL\")\n@@ -168,6 +168,10 @@ pub async fn login_page(\n         \"login · sorter2\",\n         login_body(session.as_ref(), &aliases, &providers),\n         state.views.get_views(\"/login\"),\n+        session\n+            .as_ref()\n+            .filter(|s| !s.pseudonym.trim().is_empty())\n+            .map(|s| s.pseudonym.as_str()),\n     );\n     (jar, Html(markup.into_string())).into_response()\n }\n@@ -222,6 +226,7 @@ pub async fn alias_page(\n             \"choose alias · sorter2\",\n             body,\n             state.views.get_views(\"/login/alias\"),\n+            None,\n         )\n         .into_string(),\n     )\n@@ -237,7 +242,12 @@ pub async fn github_start(\n         .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n     let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());\n     let state_token = session::new_oauth_state();\n-    let url = oauth::authorize_url(&cfg, &state_token, query.mock_user.as_deref());\n+    let mock_user = if config::mock_oauth_allowed() {\n+        query.mock_user.as_deref()\n+    } else {\n+        None\n+    };\n+    let url = oauth::authorize_url(&cfg, &state_token, mock_user);\n     let jar = jar\n         .add(session::oauth_state_cookie_value(&state_token))\n         .add(session::auth_return_cookie_value(&return_to));\ndiff --git a/server/src/auth/session.rs b/server/src/auth/session.rs\nindex 09659240b9455c6fca12db5652e1d31cf8c2acfc..41df030ded3abcafc0ab3887ab769adf103f9aa0 100644\n--- a/server/src/auth/session.rs\n+++ b/server/src/auth/session.rs\n@@ -5,7 +5,7 @@ use durable::{Db, Durability};\n use rand::Rng;\n \n use crate::{\n-    auth::config::AUTH_RETURN_COOKIE,\n+    auth::config::{self, AUTH_RETURN_COOKIE},\n     fetch::now_ms,\n     identity::{DEFAULT_ACTOR_UUID, DEFAULT_PSEUDONYM},\n     storage_dto::{SessionDataV1, SESSION_DATA_VERSION},\n@@ -37,6 +37,7 @@ pub struct VoteActor {\n }\n \n impl VoteActor {\n+    /// Test / bench helper: seed votes as the default pseudonym without a session.\n     pub fn anon() -> Self {\n         Self {\n             pseudonym: DEFAULT_PSEUDONYM.to_string(),\n@@ -70,20 +71,51 @@ fn hex_encode(bytes: &[u8]) -> String {\n     bytes.iter().map(|b| format!(\"{b:02x}\")).collect()\n }\n \n-pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> VoteActor {\n-    let Some(session_id) = session_id else {\n-        return VoteActor::anon();\n-    };\n-    let Ok(Some(session)) = load_session(db, session_id) else {\n-        return VoteActor::anon();\n-    };\n-    if session.expires_at <= now_ms() {\n-        return VoteActor::anon();\n+fn build_cookie(name: &'static str, value: String) -> Cookie<'static> {\n+    let mut builder = Cookie::build((name, value))\n+        .http_only(true)\n+        .same_site(SameSite::Lax)\n+        .path(\"/\");\n+    if config::cookies_secure() {\n+        builder = builder.secure(true);\n+    }\n+    builder.build()\n+}\n+\n+fn clear_cookie(name: &'static str) -> Cookie<'static> {\n+    let mut builder = Cookie::build((name, \"\"))\n+        .http_only(true)\n+        .same_site(SameSite::Lax)\n+        .path(\"/\")\n+        .removal();\n+    if config::cookies_secure() {\n+        builder = builder.secure(true);\n+    }\n+    builder.build()\n+}\n+\n+/// Resolve the vote actor from a live session. Fail-closed: never falls back to anon.\n+pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> Result<VoteActor, &'static str> {\n+    let session_id = session_id.ok_or(\"sign in to vote\")?;\n+    let session = load_valid_session(db, session_id).ok_or(\"session expired\")?;\n+    if !session_has_pseudonym(&session) {\n+        return Err(\"choose an alias first\");\n     }\n     let trust_weight = user_trust_weight(db, &session.uuid).unwrap_or(1.0);\n-    VoteActor {\n+    Ok(VoteActor {\n         pseudonym: session.current_pseudonym,\n         trust_weight,\n+    })\n+}\n+\n+/// Display name for the top nav, if any session is active.\n+pub fn nav_pseudonym(db: &Db, jar: &CookieJar) -> Option<String> {\n+    let session_id = session_id_from_jar(jar)?;\n+    let session = load_valid_session(db, &session_id)?;\n+    if session_has_pseudonym(&session) {\n+        Some(session.current_pseudonym)\n+    } else {\n+        None\n     }\n }\n \n@@ -151,54 +183,27 @@ pub fn destroy_session(db: &Db, session_id: &str) -> Result<(), String> {\n }\n \n pub fn session_cookie_value(session_id: &str) -> Cookie<'static> {\n-    Cookie::build((SESSION_COOKIE, session_id.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(SESSION_COOKIE, session_id.to_string())\n }\n \n pub fn clear_session_cookie() -> Cookie<'static> {\n-    Cookie::build((SESSION_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(SESSION_COOKIE)\n }\n \n pub fn oauth_state_cookie_value(state: &str) -> Cookie<'static> {\n-    Cookie::build((OAUTH_STATE_COOKIE, state.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(OAUTH_STATE_COOKIE, state.to_string())\n }\n \n pub fn clear_oauth_state_cookie() -> Cookie<'static> {\n-    Cookie::build((OAUTH_STATE_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(OAUTH_STATE_COOKIE)\n }\n \n pub fn auth_return_cookie_value(return_to: &str) -> Cookie<'static> {\n-    Cookie::build((AUTH_RETURN_COOKIE, return_to.to_string()))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .build()\n+    build_cookie(AUTH_RETURN_COOKIE, return_to.to_string())\n }\n \n pub fn clear_auth_return_cookie() -> Cookie<'static> {\n-    Cookie::build((AUTH_RETURN_COOKIE, \"\"))\n-        .http_only(true)\n-        .same_site(SameSite::Lax)\n-        .path(\"/\")\n-        .removal()\n-        .build()\n+    clear_cookie(AUTH_RETURN_COOKIE)\n }\n \n pub fn auth_return_from_jar(jar: &CookieJar) -> Option<String> {\n@@ -213,28 +218,35 @@ pub fn oauth_state_from_jar(jar: &CookieJar) -> Option<String> {\n     jar.get(OAUTH_STATE_COOKIE).map(|c| c.value().to_string())\n }\n \n-pub fn actor_uuid_for_vote(db: &Db, session_id: Option<&str>) -> String {\n-    let Some(session_id) = session_id else {\n-        return DEFAULT_ACTOR_UUID.to_string();\n-    };\n-    load_session(db, session_id)\n-        .ok()\n-        .flatten()\n-        .filter(|s| s.expires_at > now_ms())\n-        .map(|s| s.uuid)\n-        .unwrap_or_else(|| DEFAULT_ACTOR_UUID.to_string())\n-}\n-\n #[cfg(test)]\n mod tests {\n     use super::*;\n \n     #[test]\n-    fn missing_session_falls_back_to_anon() {\n+    fn missing_session_is_error() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let db = Db::open(dir.path()).unwrap();\n+        assert_eq!(resolve_vote_actor(&db, None).unwrap_err(), \"sign in to vote\");\n+    }\n+\n+    #[test]\n+    fn session_without_pseudonym_is_error() {\n+        let dir = tempfile::tempdir().unwrap();\n+        let db = Db::open(dir.path()).unwrap();\n+        let (id, _) = create_session(&db, DEFAULT_ACTOR_UUID, \"\").unwrap();\n+        assert_eq!(\n+            resolve_vote_actor(&db, Some(&id)).unwrap_err(),\n+            \"choose an alias first\"\n+        );\n+    }\n+\n+    #[test]\n+    fn session_with_pseudonym_resolves() {\n         let dir = tempfile::tempdir().unwrap();\n         let db = Db::open(dir.path()).unwrap();\n-        let actor = resolve_vote_actor(&db, None);\n-        assert_eq!(actor.pseudonym, DEFAULT_PSEUDONYM);\n+        let (id, _) = create_session(&db, DEFAULT_ACTOR_UUID, \"alice\").unwrap();\n+        let actor = resolve_vote_actor(&db, Some(&id)).unwrap();\n+        assert_eq!(actor.pseudonym, \"alice\");\n         assert_eq!(actor.trust_weight, 1.0);\n     }\n }\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex 46d18b87f1313bf0aeb29955d18f291961057509..3cc3d7bdf55b5cb5d009600f4ade1fcd201a410b 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -4,11 +4,13 @@ use axum::{\n     http::{header, StatusCode, Uri},\n     response::{IntoResponse, Response},\n };\n+use axum_extra::extract::cookie::CookieJar;\n use maud::{html, Markup, DOCTYPE};\n \n use std::collections::HashSet;\n \n use crate::{\n+    auth::nav_pseudonym,\n     fetch::html::entity_section,\n     form_template::template_json_compact,\n     path_types::ItemId,\n@@ -126,7 +128,7 @@ pub fn now_ms() -> i64 {\n     t.as_millis() as i64\n }\n \n-pub(crate) fn layout(title: &str, body: Markup, views: u64) -> Markup {\n+pub(crate) fn layout(title: &str, body: Markup, views: u64, nav_user: Option<&str>) -> Markup {\n     let ver = asset_version();\n     let css_href = format!(\"/static/sorter.css?v={ver}\");\n     let js_src = format!(\"/static/sorter_ui.js?v={ver}\");\n@@ -145,7 +147,15 @@ pub(crate) fn layout(title: &str, body: Markup, views: u64) -> Markup {\n                     span class=\"view-meta muted\" { (views) \" views\" }\n                 }\n                 nav class=\"top-nav\" {\n-                    a href=\"/login\" { \"login\" }\n+                    @if let Some(name) = nav_user {\n+                        span class=\"top-nav-user\" data-testid=\"nav-user\" { (name) }\n+                        a href=\"/login\" { \"account\" }\n+                        form class=\"top-nav-logout\" method=\"post\" action=\"/auth/logout\" data-navigate=\"full\" {\n+                            button type=\"submit\" data-testid=\"nav-logout\" { \"log out\" }\n+                        }\n+                    } @else {\n+                        a href=\"/login\" data-testid=\"nav-login\" { \"login\" }\n+                    }\n                 }\n                 div id=\"errors\" {}\n                 (body)\n@@ -481,10 +491,11 @@ pub fn input_panel(query: &str, error: Option<&str>) -> Markup {\n     }\n }\n \n-async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup {\n+async fn item_page(state: AppState, uri: Uri, item: ItemId, jar: CookieJar) -> Markup {\n     let path = uri.path().to_string();\n     state.views.increment(path.clone());\n     let views = state.views.get_views(&path);\n+    let nav_user = nav_pseudonym(state.projection_store.db(), &jar);\n \n     let tree = state\n         .scope_tree(&item)\n@@ -513,16 +524,24 @@ async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup {\n             (ranking_panel(&item, node, &tree))\n         }\n     };\n-    layout(\"sorter2\", body, views)\n+    layout(\"sorter2\", body, views, nav_user.as_deref())\n }\n \n-pub async fn home(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {\n-    item_page(state, uri, ItemId::root()).await\n+pub async fn home(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    uri: Uri,\n+) -> impl IntoResponse {\n+    item_page(state, uri, ItemId::root(), jar).await\n }\n \n-pub async fn browse(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {\n+pub async fn browse(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    uri: Uri,\n+) -> impl IntoResponse {\n     let item = ItemId::from_browse_uri(uri.path()).unwrap_or(ItemId::root());\n-    item_page(state, uri, item).await\n+    item_page(state, uri, item, jar).await\n }\n \n #[cfg(test)]\ndiff --git a/server/src/html/vote.rs b/server/src/html/vote.rs\nindex 3aa00c417c89a9cab3417c650b50ed7c73f08e20..cadbec188b17a48a63b269c0e2fa2ea8ffedd7ed 100644\n--- a/server/src/html/vote.rs\n+++ b/server/src/html/vote.rs\n@@ -4,11 +4,13 @@ use axum::{\n     extract::{Query, State},\n     response::{Html, IntoResponse},\n };\n+use axum_extra::extract::cookie::CookieJar;\n use maud::{html, Markup};\n use serde::Deserialize;\n use std::collections::HashSet;\n \n use crate::{\n+    auth::nav_pseudonym,\n     fetch::html::entity_section,\n     form_template::template_json_compact,\n     html::{ranking_panel_with_highlights, scope_theme_style, JsBuilder},\n@@ -262,6 +264,7 @@ fn suggest_next(\n \n pub async fn vote_page(\n     State(state): State<AppState>,\n+    jar: CookieJar,\n     Query(q): Query<VoteQuery>,\n ) -> impl IntoResponse {\n     let parent = parse_item_param(&q.parent);\n@@ -329,8 +332,9 @@ pub async fn vote_page(\n     let path = format!(\"/vote?parent={}\", urlencoding::encode(parent.as_str()));\n     state.views.increment(path.clone());\n     let views = state.views.get_views(&path);\n+    let nav_user = nav_pseudonym(state.projection_store.db(), &jar);\n \n-    Html(layout(&title, body, views).into_string()).into_response()\n+    Html(layout(&title, body, views, nav_user.as_deref()).into_string()).into_response()\n }\n \n #[cfg(test)]\ndiff --git a/server/static/sorter.css b/server/static/sorter.css\nindex e66a1e6c1acc473c8ff1ddb1e16e75a82d33741c..257280b6b490c65222e580a325b77351cac6cc6b 100644\n--- a/server/static/sorter.css\n+++ b/server/static/sorter.css\n@@ -34,6 +34,47 @@ body {\n   font-size: 0.75rem;\n }\n \n+.top-nav {\n+  display: flex;\n+  align-items: center;\n+  justify-content: flex-end;\n+  gap: 0.75rem;\n+  padding: 0.5rem 1rem;\n+  font-size: 0.875rem;\n+}\n+\n+.top-nav a {\n+  color: var(--muted);\n+  text-decoration: none;\n+}\n+\n+.top-nav a:hover {\n+  color: var(--fg);\n+}\n+\n+.top-nav-user {\n+  color: var(--fg);\n+  font-weight: 600;\n+}\n+\n+.top-nav-logout {\n+  display: inline;\n+  margin: 0;\n+}\n+\n+.top-nav-logout button {\n+  background: none;\n+  border: none;\n+  padding: 0;\n+  color: var(--muted);\n+  font: inherit;\n+  cursor: pointer;\n+}\n+\n+.top-nav-logout button:hover {\n+  color: var(--fg);\n+}\n+\n .btn-primary {\n   background: var(--accent);\n   color: var(--accent-fg, #0f1115);\ndiff --git a/test/support/harness.clj b/test/support/harness.clj\nindex 3f05951f418258642dcacb4a10ccccc8bfbe8748..4505ece5aa193e826ca61c52f1467d252080d66b 100644\n--- a/test/support/harness.clj\n+++ b/test/support/harness.clj\n@@ -43,6 +43,7 @@\n          \"SORTER2_VIEWS_LOG\" (str data-dir \"/views.jsonl\")\n          \"PORT\" (str app-port)\n          \"SORTER2_BASE_URL\" (str \"http://127.0.0.1:\" app-port)\n+         \"SORTER2_ALLOW_MOCK_OAUTH\" \"1\"\n          \"GITHUB_CLIENT_ID\" \"test-client\"\n          \"GITHUB_CLIENT_SECRET\" \"test-secret\"\n          \"GITHUB_OAUTH_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[5ca518f6] url refactor\n\nSide B — unified diff (full patch):\ndiff --git a/Cargo.lock b/Cargo.lock\nindex 67a09a3b54f778fa7e857fdd589c3ed9c92e1322..ad7e4fe6d4ba2f2b033916194c1ef1ed873f1d46 100644\n--- a/Cargo.lock\n+++ b/Cargo.lock\n@@ -1757,6 +1757,7 @@ name = \"slug-types\"\n version = \"0.1.0\"\n dependencies = [\n  \"serde\",\n+ \"url\",\n ]\n \n [[package]]\n@@ -2272,6 +2273,7 @@ dependencies = [\n  \"idna\",\n  \"percent-encoding\",\n  \"serde\",\n+ \"serde_derive\",\n ]\n \n [[package]]\ndiff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs\nindex 606f7d6f97a4428efb90d1e0d544934c861fc4c5..cd3e0f0afd972d9ad9e7e4b92c5fa4c22bb8f620 100644\n--- a/server/src/api/ui_html.rs\n+++ b/server/src/api/ui_html.rs\n@@ -270,10 +270,10 @@ fn post_redirect_location(room: &str, thread_tag: &str) -> String {\n         format!(\"/t/{tag}\")\n     } else {\n         let room = room.trim();\n-        let Some((a, b)) = room.split_once('/') else {\n+        let Some(seg) = slug_types::room_route_segment(room) else {\n             return \"/\".to_string();\n         };\n-        format!(\"/r/{a}/{b}/t/{tag}\")\n+        format!(\"/r/{seg}/t/{tag}\")\n     }\n }\n \ndiff --git a/server/src/api/write_actor.rs b/server/src/api/write_actor.rs\nindex cb78d2f3f95b1bc163c1fb064d1d5f657e18000f..f9c3b8bd3fbf8fcb9c035e1a1572fef0b08fa8a9 100644\n--- a/server/src/api/write_actor.rs\n+++ b/server/src/api/write_actor.rs\n@@ -19,13 +19,15 @@ use crate::{\n use super::auth::{issue_token_for_user, verify_token};\n use super::helpers::{now_ms, resolve_item};\n use super::validate::{normalize_room_and_thread, validate_ingest_document};\n-use slug_types::RpcResult;\n+use slug_types::{room_route_segment, RpcResult, ROOM_SHORT_ID_LEN};\n \n fn gen_short_id() -> String {\n     use rand::Rng;\n     const ALPHABET: &[u8] = b\"0123456789abcdefghijklmnopqrstuvwxyz\";\n     let mut rng = rand::thread_rng();\n-    (0..7).map(|_| ALPHABET[rng.gen_range(0..ALPHABET.len())] as char).collect()\n+    (0..ROOM_SHORT_ID_LEN)\n+        .map(|_| ALPHABET[rng.gen_range(0..ALPHABET.len())] as char)\n+        .collect()\n }\n \n fn parse_capability(s: &str) -> Result<crate::events::ThreadCapability, String> {\n@@ -55,8 +57,8 @@ async fn broadcast_web_refresh(state: &AppState, room_key: &str, thread_id: &str\n     let feed_id = if room_key == \"public\" { \"thread-feed\" } else { \"room-thread-feed\" };\n     let thread_url = if room_key == \"public\" {\n         format!(\"/t/{thread_id}\")\n-    } else if let Some((short, slug)) = room_key.split_once('/') {\n-        format!(\"/r/{short}/{slug}/t/{thread_id}\")\n+    } else if let Some(seg) = room_route_segment(room_key) {\n+        format!(\"/r/{seg}/t/{thread_id}\")\n     } else {\n         format!(\"/t/{thread_id}\")\n     };\n@@ -78,8 +80,8 @@ async fn broadcast_web_refresh(state: &AppState, room_key: &str, thread_id: &str\n     let js = builder.build();\n     let mut path_prefixes = vec![if room_key == \"public\" {\n         \"/\".to_string()\n-    } else if let Some((short, slug)) = room_key.split_once('/') {\n-        format!(\"/r/{short}/{slug}\")\n+    } else if let Some(seg) = room_route_segment(room_key) {\n+        format!(\"/r/{seg}\")\n     } else {\n         \"/\".to_string()\n     }];\ndiff --git a/server/src/html/forum/nav.rs b/server/src/html/forum/nav.rs\nindex 0ee33d91160fc5542817b5e3e9ab4fee1d0e600f..48fe11e46731670874ff8b6b05baa6f09ae0b7e4 100644\n--- a/server/src/html/forum/nav.rs\n+++ b/server/src/html/forum/nav.rs\n@@ -1,7 +1,8 @@\n use crate::canonical_path::canonicalize_item;\n use crate::reducer::ScopeId;\n+use slug_types::room_route_segment;\n \n-/// URL helpers for public `/t/…` and private room threads `/r/{short}/{slug}/t/…`.\n+/// URL helpers for public `/t/…` and private room threads `/r/{short}{slug}/t/…`.\n #[derive(Clone)]\n pub struct ThreadNav {\n     pub room_wire: String,\n@@ -22,18 +23,15 @@ impl ThreadNav {\n         }\n     }\n \n-    /// `room_id` wire form `shortid/slug`.\n+    /// `room_id` wire form `shortid/slug` (HTTP uses [`slug_types::room_route_segment`]).\n     pub(crate) fn from_room_id(room_id: &str) -> Option<Self> {\n-        let (short, slug) = room_id.split_once('/')?;\n-        if short.is_empty() || slug.is_empty() {\n-            return None;\n-        }\n+        let room_seg = room_route_segment(room_id)?;\n         Some(Self {\n             room_wire: room_id.to_string(),\n             scope: ScopeId::Room(room_id.to_string()),\n-            room_path: format!(\"/r/{short}/{slug}\"),\n-            thread_path_prefix: format!(\"/r/{short}/{slug}/t\"),\n-            garden_path_prefix: format!(\"/r/{short}/{slug}/~\"),\n+            room_path: format!(\"/r/{room_seg}\"),\n+            thread_path_prefix: format!(\"/r/{room_seg}/t\"),\n+            garden_path_prefix: format!(\"/r/{room_seg}/~\"),\n         })\n     }\n \ndiff --git a/server/src/html/forum/post_single.rs b/server/src/html/forum/post_single.rs\nindex c316f8f836df9d4ef9c05ebd9e54f699540e6d72..473747b3da3d4d7a54b5e0c63165d2533df643e1 100644\n--- a/server/src/html/forum/post_single.rs\n+++ b/server/src/html/forum/post_single.rs\n@@ -93,12 +93,14 @@ pub async fn thread_post_view(\n \n pub async fn room_thread_post_view(\n     State(state): State<AppState>,\n-    Path((room_short, room_slug, tag, index_str)): Path<(String, String, String, String)>,\n+    Path((room_key, tag, index_str)): Path<(String, String, String)>,\n     headers: HeaderMap,\n     jar: CookieJar,\n     uri: Uri,\n ) -> impl IntoResponse {\n-    let room_id = format!(\"{room_short}/{room_slug}\");\n+    let Some(room_id) = slug_types::room_id_from_route_segment(&room_key) else {\n+        return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n+    };\n     let reduced = state.reduced.read().await;\n     let user = optional_principal(&headers, &jar, &reduced);\n     if !user_can_view_room(&reduced, &room_id, user.as_deref()) {\ndiff --git a/server/src/html/forum/views.rs b/server/src/html/forum/views.rs\nindex be5df1745ef580891a167c23c3dd6c06f804f295..1ec421f84335cbfe7f9db775b73a8ed24b197174 100644\n--- a/server/src/html/forum/views.rs\n+++ b/server/src/html/forum/views.rs\n@@ -183,16 +183,18 @@ pub async fn thread_view(\n     thread_view_inner(state, tag, q, ThreadNav::public(), headers, jar, uri).await\n }\n \n-/// Room thread — `/r/:short/:slug/t/:tag`\n+/// Room thread — `/r/:room_key/t/:tag` (`room_key` = `{short}{slug}`).\n pub async fn room_thread_view(\n     State(state): State<AppState>,\n-    Path((room_short, room_slug, tag)): Path<(String, String, String)>,\n+    Path((room_key, tag)): Path<(String, String)>,\n     Query(q): Query<ThreadViewQuery>,\n     headers: HeaderMap,\n     jar: CookieJar,\n     uri: Uri,\n ) -> impl IntoResponse {\n-    let room_id = format!(\"{room_short}/{room_slug}\");\n+    let Some(room_id) = slug_types::room_id_from_route_segment(&room_key) else {\n+        return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n+    };\n     let reduced = state.reduced.read().await;\n     let user = optional_principal(&headers, &jar, &reduced);\n     if !user_can_view_room(&reduced, &room_id, user.as_deref()) {\n@@ -226,15 +228,17 @@ pub(super) fn room_not_found_page(jar: &CookieJar, uri: &Uri) -> impl IntoRespon\n     (StatusCode::NOT_FOUND, Html(page.into_string()))\n }\n \n-/// Private room index — `/r/:short/:slug`\n+/// Private room index — `/r/:room_key`\n pub async fn room_page(\n     State(state): State<AppState>,\n-    Path((room_short, room_slug)): Path<(String, String)>,\n+    Path(room_key): Path<String>,\n     headers: HeaderMap,\n     jar: CookieJar,\n     uri: Uri,\n ) -> impl IntoResponse {\n-    let room_id = format!(\"{room_short}/{room_slug}\");\n+    let Some(room_id) = slug_types::room_id_from_route_segment(&room_key) else {\n+        return (StatusCode::NOT_FOUND, \"room not found\").into_response();\n+    };\n     let now = now_ms();\n     let reduced = state.reduced.read().await;\n     if !reduced.rooms.contains(&room_id) {\n@@ -266,7 +270,10 @@ pub async fn room_page(\n     let audit_cli = format!(\"npx slugsocial private {room_id} audit\");\n     drop(reduced);\n \n-    let slug_display = room_slug.as_str();\n+    let slug_display = room_id\n+        .split_once('/')\n+        .map(|(_, slug)| slug)\n+        .unwrap_or(room_id.as_str());\n     let page = layout(\n         &format!(\"room {slug_display} — slug.social\"),\n         \"view-thread\",\ndiff --git a/server/src/html/garden.rs b/server/src/html/garden.rs\nindex 423f23fd8c9ad7b7f454d6ea7a9a7607a4c9c5b9..e615dd356bcf634232d85610c0a26235ead125fd 100644\n--- a/server/src/html/garden.rs\n+++ b/server/src/html/garden.rs\n@@ -309,12 +309,14 @@ pub async fn external_ontology_path(\n \n pub async fn room_garden_index(\n     State(state): State<AppState>,\n-    Path((room_short, room_slug)): Path<(String, String)>,\n+    Path(room_key): Path<String>,\n     headers: HeaderMap,\n     jar: CookieJar,\n     uri: Uri,\n ) -> impl IntoResponse {\n-    let room_id = format!(\"{room_short}/{room_slug}\");\n+    let Some(room_id) = slug_types::room_id_from_route_segment(&room_key) else {\n+        return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n+    };\n     let Some(nav) = ThreadNav::from_room_id(&room_id) else {\n         return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n     };\n@@ -341,12 +343,14 @@ pub async fn room_garden_index(\n \n pub async fn room_external_garden_index(\n     State(state): State<AppState>,\n-    Path((room_short, room_slug)): Path<(String, String)>,\n+    Path(room_key): Path<String>,\n     headers: HeaderMap,\n     jar: CookieJar,\n     uri: Uri,\n ) -> impl IntoResponse {\n-    let room_id = format!(\"{room_short}/{room_slug}\");\n+    let Some(room_id) = slug_types::room_id_from_route_segment(&room_key) else {\n+        return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n+    };\n     let Some(nav) = ThreadNav::from_room_id(&room_id) else {\n         return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n     };\n@@ -416,12 +420,14 @@ pub async fn room_external_garden_index(\n \n pub async fn room_external_ontology_path(\n     State(state): State<AppState>,\n-    Path((room_short, room_slug, path)): Path<(String, String, String)>,\n+    Path((room_key, path)): Path<(String, String)>,\n     headers: HeaderMap,\n     jar: CookieJar,\n     uri: Uri,\n ) -> impl IntoResponse {\n-    let room_id = format!(\"{room_short}/{room_slug}\");\n+    let Some(room_id) = slug_types::room_id_from_route_segment(&room_key) else {\n+        return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n+    };\n     let Some(nav) = ThreadNav::from_room_id(&room_id) else {\n         return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n     };\n@@ -442,12 +448,14 @@ pub async fn room_external_ontology_path(\n \n pub async fn room_ontology_path(\n     State(state): State<AppState>,\n-    Path((room_short, room_slug, path)): Path<(String, String, String)>,\n+    Path((room_key, path)): Path<(String, String)>,\n     headers: HeaderMap,\n     jar: CookieJar,\n     uri: Uri,\n ) -> impl IntoResponse {\n-    let room_id = format!(\"{room_short}/{room_slug}\");\n+    let Some(room_id) = slug_types::room_id_from_route_segment(&room_key) else {\n+        return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n+    };\n     let Some(nav) = ThreadNav::from_room_id(&room_id) else {\n         return (StatusCode::NOT_FOUND, \"bad room path\").into_response();\n     };\ndiff --git a/server/src/html/search.rs b/server/src/html/search.rs\nindex 43e6ebf36cf0fe72c96f0f9d850bea51ac094c43..f01732f7edb32c68fcc10c39545c8f56476adb27 100644\n--- a/server/src/html/search.rs\n+++ b/server/src/html/search.rs\n@@ -351,8 +351,8 @@ fn render_search_results(results: &SearchResults, query: &str) -> Markup {\n                     ul class=\"search-posts\" {\n                         @for r in &results.posts {\n                             @let (post_href, post_label) = if let Some((room, tag)) = r.thread.split_once(\"/#\") {\n-                                if let Some((short, slug)) = room.split_once('/') {\n-                                    (format!(\"/r/{short}/{slug}/t/{tag}\"), format!(\"{room}/#{tag}\"))\n+                                if let Some(seg) = slug_types::room_route_segment(room) {\n+                                    (format!(\"/r/{seg}/t/{tag}\"), format!(\"{room}/#{tag}\"))\n                                 } else {\n                                     (\"/\".to_string(), r.thread.clone())\n                                 }\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex 9e69c3f4a153527caa77b00ad101aca94b425995..71032f9a0b556097d90f3b403c677e0c86429ee4 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -79,30 +79,30 @@ pub fn create_app(state: AppState) -> Router {\n         .route(\"/~/*path\", get(crate::html::ontology_path))\n         .route(\"/-\", get(crate::html::external_garden_index))\n         .route(\"/-/*path\", get(crate::html::external_ontology_path))\n-        .route(\"/r/:room_short/:room_slug/~\", get(crate::html::room_garden_index))\n+        .route(\"/r/:room_key/~\", get(crate::html::room_garden_index))\n         .route(\n-            \"/r/:room_short/:room_slug/~/*path\",\n+            \"/r/:room_key/~/*path\",\n             get(crate::html::room_ontology_path),\n         )\n         .route(\n-            \"/r/:room_short/:room_slug/-\",\n+            \"/r/:room_key/-\",\n             get(crate::html::room_external_garden_index),\n         )\n         .route(\n-            \"/r/:room_short/:room_slug/-/*path\",\n+            \"/r/:room_key/-/*path\",\n             get(crate::html::room_external_ontology_path),\n         )\n         .route(\"/t/:tag/:index\", get(crate::html::thread_post_view))\n         .route(\"/t/:tag\", get(crate::html::thread_view))\n         .route(\n-            \"/r/:room_short/:room_slug/t/:thread_tag/:index\",\n+            \"/r/:room_key/t/:thread_tag/:index\",\n             get(crate::html::room_thread_post_view),\n         )\n         .route(\n-            \"/r/:room_short/:room_slug/t/:thread_tag\",\n+            \"/r/:room_key/t/:thread_tag\",\n             get(crate::html::room_thread_view),\n         )\n-        .route(\"/r/:room_short/:room_slug\", get(crate::html::room_page))\n+        .route(\"/r/:room_key\", get(crate::html::room_page))\n         .route(\"/join/:token\", get(api::get_join_invite))\n         .route(\"/auth/login\", get(api::get_auth_login))\n         .route(\"/auth/callback\", get(api::get_auth_callback))\ndiff --git a/server/tests/integration.rs b/server/tests/integration.rs\nindex 515c691d04ef3f1f4bdfa8ee911360a43fd2b26e..feb73d475b3fc635d7f16c329d4600718c7472ba 100644\n--- a/server/tests/integration.rs\n+++ b/server/tests/integration.rs\n@@ -1,4 +1,5 @@\n use sha2::{Digest, Sha256};\n+use slug_types::room_route_segment;\n use slugsocial_server::{\n     event_log::EventLog,\n     events::{Event, TokenIssued, UserRegistered},\n@@ -607,7 +608,7 @@ async fn test_private_room_thread_urls_use_t_segment() {\n         .as_str()\n         .unwrap()\n         .to_string();\n-    let (room_short, room_slug) = room_id.split_once('/').unwrap();\n+    let room_seg = room_route_segment(&room_id).unwrap();\n \n     let rpc = ui_post_ingest_rpc(&room_id, \"main-thread\", \"private post via web\");\n     let post = client\n@@ -626,7 +627,7 @@ async fn test_private_room_thread_urls_use_t_segment() {\n         Some(\"text/javascript; charset=utf-8\")\n     );\n     let post_js = post.text().await.unwrap();\n-    let location = format!(\"/r/{room_short}/{room_slug}/t/main-thread\");\n+    let location = format!(\"/r/{room_seg}/t/main-thread\");\n     assert!(post_js.contains(&format!(\"window.location = {:?};\", location)));\n     assert!(post_js.contains(\"#room-thread-feed\"));\n     assert!(post_js.contains(\"#thread-feed-region\"));\n@@ -665,7 +666,7 @@ async fn test_private_room_post_links_use_private_garden_routes() {\n         .as_str()\n         .unwrap()\n         .to_string();\n-    let (room_short, room_slug) = room_id.split_once('/').unwrap();\n+    let room_seg = room_route_segment(&room_id).unwrap();\n \n     let rpc = ui_post_ingest_rpc(\n         &room_id,\n@@ -682,18 +683,18 @@ async fn test_private_room_post_links_use_private_garden_routes() {\n     assert_eq!(post.status(), reqwest::StatusCode::OK);\n \n     let thread_page = client\n-        .get(format!(\"http://{addr}/r/{room_short}/{room_slug}/t/garden-thread\"))\n+        .get(format!(\"http://{addr}/r/{room_seg}/t/garden-thread\"))\n         .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n         .send()\n         .await\n         .unwrap();\n     assert!(thread_page.status().is_success());\n     let body = thread_page.text().await.unwrap();\n-    assert!(body.contains(&format!(\"/r/{room_short}/{room_slug}/~/secret/item\")));\n+    assert!(body.contains(&format!(\"/r/{room_seg}/~/secret/item\")));\n     assert!(!body.contains(\"href=\\\"/~/secret/item\\\"\"));\n \n     let garden_page = client\n-        .get(format!(\"http://{addr}/r/{room_short}/{room_slug}/~/secret/item\"))\n+        .get(format!(\"http://{addr}/r/{room_seg}/~/secret/item\"))\n         .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n         .send()\n         .await\n@@ -701,7 +702,7 @@ async fn test_private_room_post_links_use_private_garden_routes() {\n     assert!(garden_page.status().is_success());\n     let garden_body = garden_page.text().await.unwrap();\n     assert!(garden_body.contains(\"classified\"));\n-    assert!(garden_body.contains(&format!(\"/r/{room_short}/{room_slug}/t/garden-thread\")));\n+    assert!(garden_body.contains(&format!(\"/r/{room_seg}/t/garden-thread\")));\n }\n \n #[tokio::test]\n@@ -726,7 +727,7 @@ async fn test_private_room_garden_root_lists_top_level_tilde_children() {\n         .as_str()\n         .unwrap()\n         .to_string();\n-    let (room_short, room_slug) = room_id.split_once('/').unwrap();\n+    let room_seg = room_route_segment(&room_id).unwrap();\n \n     let rpc = ui_post_ingest_rpc(\n         &room_id,\n@@ -743,7 +744,7 @@ async fn test_private_room_garden_root_lists_top_level_tilde_children() {\n     assert_eq!(post.status(), reqwest::StatusCode::OK);\n \n     let root_page = client\n-        .get(format!(\"http://{addr}/r/{room_short}/{room_slug}/~\"))\n+        .get(format!(\"http://{addr}/r/{room_seg}/~\"))\n         .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n         .send()\n         .await\n@@ -782,10 +783,10 @@ async fn test_empty_private_room_garden_returns_404() {\n         .as_str()\n         .unwrap()\n         .to_string();\n-    let (room_short, room_slug) = room_id.split_once('/').unwrap();\n+    let room_seg = room_route_segment(&room_id).unwrap();\n \n     let root = client\n-        .get(format!(\"http://{addr}/r/{room_short}/{room_slug}/~\"))\n+        .get(format!(\"http://{addr}/r/{room_seg}/~\"))\n         .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n         .send()\n         .await\n@@ -896,8 +897,8 @@ async fn test_sse_stream_emits_evalable_js_after_post() {\n         .as_str()\n         .unwrap()\n         .to_string();\n-    let (room_short, room_slug) = room_id.split_once('/').unwrap();\n-    let room_path = format!(\"/r/{room_short}/{room_slug}\");\n+    let room_seg = room_route_segment(&room_id).unwrap();\n+    let room_path = format!(\"/r/{room_seg}\");\n \n     let sse_resp = client\n         .get(format!(\"http://{addr}/sse?path={}\", urlencoding::encode(&room_path)))\ndiff --git a/test/browser_room_delete.clj b/test/browser_room_delete.clj\nindex 833e3f8aa7f850b60ee59742736143cbf101a07d..764ecaa674798a61c1ffca3859f2a56a91a0e97e 100644\n--- a/test/browser_room_delete.clj\n+++ b/test/browser_room_delete.clj\n@@ -54,7 +54,7 @@\n            room-id (get-in create-json [\"results\" 0 \"result\" \"RoomCreated\" \"room_id\"])\n            _ (is (string? room-id) \"room id present\")\n            [room-short room-slug] (str/split room-id #\"/\" 2)\n-           room-path (str \"/r/\" room-short \"/\" room-slug)]\n+           room-path (str \"/r/\" room-short room-slug)]\n        (core/with-playwright [pw]\n          (core/with-browser [browser (core/launch-chromium pw {:headless true :channel \"chrome\"})]\n            (core/with-context [ctx (core/new-context browser)]\ndiff --git a/test/browser_sse.clj b/test/browser_sse.clj\nindex 8bb064dbc2dc0feb6caaa67f520a461645958277..678399b79f78ff48b5e77342fa21e69992393834 100644\n--- a/test/browser_sse.clj\n+++ b/test/browser_sse.clj\n@@ -77,7 +77,7 @@\n                   (login-user! bob-pg base-url \"bob\")\n \n                    (let [[room-short room-slug] (str/split room-id #\"/\" 2)\n-                         room-url (str base-url \"/r/\" room-short \"/\" room-slug)\n+                         room-url (str base-url \"/r/\" room-short room-slug)\n                          thread-url (str room-url \"/t/sse-thread\")]\n                     ;; Object under test: slug_ui.js intercepts POST /ui, evals JS, morphs\n                     ;; #new-thread-ui-slot (expand compose), then post_ingest redirects to thread.\ndiff --git a/test/walkthrough_fixture.clj b/test/walkthrough_fixture.clj\nindex a487ff1ef8548580577914fb33f321586859c9af..f7eb1cacca0317129e9baf68fa4f4e33356ad70f 100644\n--- a/test/walkthrough_fixture.clj\n+++ b/test/walkthrough_fixture.clj\n@@ -88,9 +88,9 @@\n      :room {:id room-id\n             :short room-short\n             :slug room-slug\n-            :url (str base-url \"/r/\" room-short \"/\" room-slug)\n-            :thread_url (str base-url \"/r/\" room-short \"/\" room-slug \"/t/walkthrough-thread\")\n-            :garden_url (str base-url \"/r/\" room-short \"/\" room-slug \"/~/secret/item\")}}))\n+            :url (str base-url \"/r/\" room-short room-slug)\n+            :thread_url (str base-url \"/r/\" room-short room-slug \"/t/walkthrough-thread\")\n+            :garden_url (str base-url \"/r/\" room-short room-slug \"/~/secret/item\")}}))\n \n (defn- rebase-fixture-summary [saved current-base-url current-google-url current-data-dir]\n   (let [inner (:summary saved)\n@@ -103,9 +103,9 @@\n            :data_dir (str current-data-dir)\n            :summary (assoc inner\n                            :room (assoc room\n-                                         :url (str current-base-url \"/r/\" rs \"/\" lg)\n-                                         :thread_url (str current-base-url \"/r/\" rs \"/\" lg \"/t/walkthrough-thread\")\n-                                         :garden_url (str current-base-url \"/r/\" rs \"/\" lg \"/~/secret/item\"))))))\n+                                         :url (str current-base-url \"/r/\" rs lg)\n+                                         :thread_url (str current-base-url \"/r/\" rs lg \"/t/walkthrough-thread\")\n+                                         :garden_url (str current-base-url \"/r/\" rs lg \"/~/secret/item\"))))))\n \n (defn- fixture-log-present? [data-dir]\n   (let [p (fs/path data-dir \"events.jsonl\")]\ndiff --git a/types/Cargo.toml b/types/Cargo.toml\nindex 1ed06d483ac7c126516bce27f90e7639c2dfe370..5dc3becf238f23243313dff0484c682a7b225737 100644\n--- a/types/Cargo.toml\n+++ b/types/Cargo.toml\n@@ -5,3 +5,4 @@ edition = \"2021\"\n \n [dependencies]\n serde = { version = \"1.0\", features = [\"derive\"] }\n+url = { version = \"2.5\", features = [\"serde\"] }\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex fce1b5fa5e259a4b86a11cb4d4f7cc9bec3a0aa1..516cf935f15fca97081b39b988da5be894c67725 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -1,5 +1,7 @@\n use serde::{Deserialize, Serialize};\n \n+pub mod room_route;\n+pub mod url_normalize;\n pub mod paths;\n pub mod timeago;\n \n@@ -8,6 +10,8 @@ pub use paths::{\n     CanonicalItemUrl, ForumThreadUrl, GardenItemUrl, RelativePath, SLUG_TILDE_ONTOLOGY_ROOT,\n     TildeHttpPathTail, TildeOntologyPath, TildePath, tilde_http_path_to_canonical,\n };\n+pub use room_route::{room_id_from_route_segment, room_route_segment, ROOM_SHORT_ID_LEN};\n+pub use url_normalize::normalize_http_identity_url;\n \n /// Max characters returned for a garden item body unless `full=true` / `--full` (API + CLI).\n pub const MAX_ITEM_BODY_PREVIEW_CHARS: usize = 100_000;\n@@ -657,3 +661,6 @@ pub struct VoteResponse {\n     pub ranking: Vec<RankRow>,\n     pub next: NextMoves,\n }\n+\n+#[cfg(test)]\n+mod url_identity_tests;\ndiff --git a/types/src/paths.rs b/types/src/paths.rs\nindex 8971f599a7ebcf399f60c306d35ee28d0f581194..98787a5fb481a1599556564bbbbd1d54dc693fc3 100644\n--- a/types/src/paths.rs\n+++ b/types/src/paths.rs\n@@ -5,7 +5,7 @@\n //!\n //! - **[`canonicalize_item`] / [`CanonicalItemUrl`]** — graph storage key and DSL form; tilde\n //!   ontology root is always [`SLUG_TILDE_ONTOLOGY_ROOT`] (no `…/~/` trailing slash only).\n-//! - **[`TildeHttpPathTail`]** — capture from `GET /~/*path` or `…/r/…/~/…` (the `*path` segment).\n+//! - **[`TildeHttpPathTail`]** — capture from `GET /~/*path` or `…/r/{short}{slug}/~/…` (the `*path` segment).\n //! - **`-/…` wire form** — external items; see [`canonicalize_item`] dash branch.\n //! - **[`GardenItemUrl`], [`ForumThreadUrl`]** — JSON / browser href surfaces.\n \n@@ -15,6 +15,9 @@ use std::ops::Deref;\n \n use serde::{Deserialize, Serialize};\n \n+use crate::room_route::room_route_segment;\n+use crate::url_normalize::{host_preserves_dash_path_case, normalize_http_identity_url};\n+\n // ---------------------------------------------------------------------------\n // Slug tilde ontology (single storage form for `~/`)\n // ---------------------------------------------------------------------------\n@@ -41,6 +44,29 @@ pub fn canonicalize_tag(input: &str) -> String {\n     input.trim().trim_start_matches('#').to_lowercase()\n }\n \n+fn finalize_external_identity_url(s: String) -> String {\n+    if s.starts_with(\"https://slug.social/\") {\n+        return s;\n+    }\n+    let normalized = normalize_http_identity_url(&s).unwrap_or_else(|| s.clone());\n+    strip_redundant_root_slash(&normalized).unwrap_or(normalized)\n+}\n+\n+/// `url::Url` serializes bare hosts with a `/` path; we keep host-only items slash-free for stable\n+/// keys matching the pre-normalizer spellings.\n+fn strip_redundant_root_slash(s: &str) -> Option<String> {\n+    let u = url::Url::parse(s).ok()?;\n+    if u.path() == \"/\" && u.query().is_none() && u.fragment().is_none() {\n+        let scheme = u.scheme();\n+        let host = u.host_str()?;\n+        return Some(match u.port() {\n+            Some(p) => format!(\"{scheme}://{host}:{p}\"),\n+            None => format!(\"{scheme}://{host}\"),\n+        });\n+    }\n+    None\n+}\n+\n /// Ontology item reference → canonical absolute URL on the slug host.\n pub fn canonicalize_item(input: &str) -> String {\n     let s = input.trim();\n@@ -57,8 +83,9 @@ pub fn canonicalize_item(input: &str) -> String {\n         if host.is_empty() {\n             return String::new();\n         }\n+        let preserve_case = host_preserves_dash_path_case(&host);\n         return if tail.is_empty() {\n-            format!(\"https://{}\", host)\n+            finalize_external_identity_url(format!(\"https://{}\", host))\n         } else {\n             let path = tail\n                 .trim_start_matches('/')\n@@ -68,33 +95,35 @@ pub fn canonicalize_item(input: &str) -> String {\n                     let t = seg.trim();\n                     if t.is_empty() {\n                         None\n+                    } else if preserve_case {\n+                        Some(t.to_string())\n                     } else {\n                         Some(t.to_lowercase())\n                     }\n                 })\n                 .collect::<Vec<_>>()\n                 .join(\"/\");\n-            format!(\"https://{}/{}\", host, path)\n+            finalize_external_identity_url(format!(\"https://{}/{}\", host, path))\n         };\n     }\n \n     if let Some(rest) = s.strip_prefix(\"https://\") {\n         let (host, tail) = rest.split_once('/').map_or((rest, \"\"), |(h, t)| (h, t));\n         let host = host.trim().to_lowercase();\n-        if tail.is_empty() {\n-            return format!(\"https://{}\", host);\n+        return finalize_external_identity_url(if tail.is_empty() {\n+            format!(\"https://{}\", host)\n         } else {\n-            return format!(\"https://{}/{}\", host, tail);\n-        }\n+            format!(\"https://{}/{}\", host, tail)\n+        });\n     }\n     if let Some(rest) = s.strip_prefix(\"http://\") {\n         let (host, tail) = rest.split_once('/').map_or((rest, \"\"), |(h, t)| (h, t));\n         let host = host.trim().to_lowercase();\n-        if tail.is_empty() {\n-            return format!(\"http://{}\", host);\n+        return finalize_external_identity_url(if tail.is_empty() {\n+            format!(\"http://{}\", host)\n         } else {\n-            return format!(\"http://{}/{}\", host, tail);\n-        }\n+            format!(\"http://{}/{}\", host, tail)\n+        });\n     }\n \n     let is_tilde = s.starts_with(\"~/\");\n@@ -319,7 +348,7 @@ impl CanonicalItemUrl {\n     }\n }\n \n-/// HTTP route capture: path segment after `~/` in `GET /~/*path` or `…/r/…/~/…` (empty = ontology root).\n+/// HTTP route capture: path segment after `~/` in `GET /~/*path` or `…/r/{short}{slug}/~/…` (empty = ontology root).\n #[derive(Debug, Clone, PartialEq, Eq, Hash)]\n pub struct TildeHttpPathTail(pub String);\n \n@@ -506,12 +535,9 @@ fn garden_href_string(item: &str, room_wire: &str) -> String {\n     if room.is_empty() || room == \"public\" {\n         return api_path_or_url(item);\n     }\n-    let Some((short, slug)) = room.split_once('/') else {\n+    let Some(room_seg) = room_route_segment(room) else {\n         return api_path_or_url(item);\n     };\n-    if short.is_empty() || slug.is_empty() {\n-        return api_path_or_url(item);\n-    }\n     let Some(c) = CanonicalItemUrl::parse(item) else {\n         return api_path_or_url(item);\n     };\n@@ -520,19 +546,19 @@ fn garden_href_string(item: &str, room_wire: &str) -> String {\n     let root_norm = root.as_str().trim_end_matches('/');\n     if let Some(tail) = c.tilde_tail() {\n         return if tail.is_empty() {\n-            format!(\"https://slug.social/r/{short}/{slug}/~\")\n+            format!(\"https://slug.social/r/{room_seg}/~\")\n         } else {\n-            format!(\"https://slug.social/r/{short}/{slug}/~/{}\", tail)\n+            format!(\"https://slug.social/r/{room_seg}/~/{}\", tail)\n         };\n     }\n     if item_norm == root_norm {\n-        return format!(\"https://slug.social/r/{short}/{slug}/~\");\n+        return format!(\"https://slug.social/r/{room_seg}/~\");\n     }\n     // External http(s) items use the same `/-/…` namespace under the room garden.\n     if c.as_str().starts_with(\"https://\") || c.as_str().starts_with(\"http://\") {\n         let tail = c.display_path();\n         let tail = tail.strip_prefix(\"-/\").unwrap_or(tail.as_str());\n-        return format!(\"https://slug.social/r/{short}/{slug}/-/{tail}\");\n+        return format!(\"https://slug.social/r/{room_seg}/-/{tail}\");\n     }\n     api_path_or_url(item)\n }\n@@ -556,12 +582,8 @@ impl ForumThreadUrl {\n         let tag = thread_tag.trim().trim_start_matches('#');\n         Self(if room.is_empty() || room == \"public\" {\n             format!(\"https://slug.social/t/{tag}\")\n-        } else if let Some((short, slug)) = room.split_once('/') {\n-            if short.is_empty() || slug.is_empty() {\n-                format!(\"https://slug.social/t/{tag}\")\n-            } else {\n-                format!(\"https://slug.social/r/{short}/{slug}/t/{tag}\")\n-            }\n+        } else if let Some(room_seg) = room_route_segment(room) {\n+            format!(\"https://slug.social/r/{room_seg}/t/{tag}\")\n         } else {\n             format!(\"https://slug.social/t/{tag}\")\n         })\n@@ -706,7 +728,7 @@ mod tests {\n     fn garden_private_room_prefixes_ontology() {\n         assert_eq!(\n             GardenItemUrl::from_storage_str(\"https://slug.social/~/topic/x\", \"9ab12cd/my-room\").as_str(),\n-            \"https://slug.social/r/9ab12cd/my-room/~/topic/x\"\n+            \"https://slug.social/r/9ab12cdmy-room/~/topic/x\"\n         );\n     }\n \n@@ -714,11 +736,11 @@ mod tests {\n     fn garden_private_room_ontology_root() {\n         assert_eq!(\n             GardenItemUrl::from_storage_str(\"https://slug.social/~\", \"9ab12cd/my-room\").as_str(),\n-            \"https://slug.social/r/9ab12cd/my-room/~\"\n+            \"https://slug.social/r/9ab12cdmy-room/~\"\n         );\n         assert_eq!(\n             GardenItemUrl::from_storage_str(\"https://slug.social/~/\", \"9ab12cd/my-room\").as_str(),\n-            \"https://slug.social/r/9ab12cd/my-room/~\"\n+            \"https://slug.social/r/9ab12cdmy-room/~\"\n         );\n     }\n \n@@ -727,7 +749,7 @@ mod tests {\n         let u = \"https://example.com/z\";\n         assert_eq!(\n             GardenItemUrl::from_storage_str(u, \"9ab12cd/my-room\").as_str(),\n-            \"https://slug.social/r/9ab12cd/my-room/-/example.com/z\"\n+            \"https://slug.social/r/9ab12cdmy-room/-/example.com/z\"\n         );\n     }\n \n@@ -739,7 +761,19 @@ mod tests {\n         );\n         assert_eq!(\n             ForumThreadUrl::from_room_tag(\"9ab12cd/my-room\", \"#debate\").as_str(),\n-            \"https://slug.social/r/9ab12cd/my-room/t/debate\"\n+            \"https://slug.social/r/9ab12cdmy-room/t/debate\"\n+        );\n+    }\n+\n+    #[test]\n+    fn canonicalize_youtube_short_links() {\n+        assert_eq!(\n+            canonicalize_item(\"https://youtu.be/dQw4w9WgXcQ\"),\n+            \"https://www.youtube.com/watch?v=dQw4w9WgXcQ\"\n+        );\n+        assert_eq!(\n+            canonicalize_item(\"-/youtu.be/dQw4w9WgXcQ\"),\n+            \"https://www.youtube.com/watch?v=dQw4w9WgXcQ\"\n         );\n     }\n \ndiff --git a/types/src/room_route.rs b/types/src/room_route.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..4f4780c88e30f2b28e2cfcd7aee713d39dbd1c66\n--- /dev/null\n+++ b/types/src/room_route.rs\n@@ -0,0 +1,56 @@\n+//! HTTP path encoding for private rooms: `/r/{short}{slug}` (short is fixed width).\n+\n+/// Byte length of the random `short` segment in `short/slug` room ids.\n+/// Must match room creation (`gen_short_id`) and [`super::paths`][] URL builders.\n+pub const ROOM_SHORT_ID_LEN: usize = 7;\n+\n+/// `ab12cde/my-room` → `ab12cdemy-room` for a single `/r/…` path segment.\n+pub fn room_route_segment(room_id: &str) -> Option<String> {\n+    let (short, slug) = room_id.split_once('/')?;\n+    if short.len() != ROOM_SHORT_ID_LEN || short.is_empty() || slug.is_empty() {\n+        return None;\n+    }\n+    if !short\n+        .bytes()\n+        .all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'z'))\n+    {\n+        return None;\n+    }\n+    Some(format!(\"{short}{slug}\"))\n+}\n+\n+/// `/r/{short}{slug}` path segment → `short/slug` wire id (inverse of [`room_route_segment`]).\n+pub fn room_id_from_route_segment(seg: &str) -> Option<String> {\n+    if seg.len() <= ROOM_SHORT_ID_LEN {\n+        return None;\n+    }\n+    let (short, slug) = seg.split_at(ROOM_SHORT_ID_LEN);\n+    if short.is_empty() || slug.is_empty() {\n+        return None;\n+    }\n+    if !short\n+        .bytes()\n+        .all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'z'))\n+    {\n+        return None;\n+    }\n+    Some(format!(\"{short}/{slug}\"))\n+}\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::*;\n+\n+    #[test]\n+    fn round_trip_room_segment() {\n+        let id = \"9ab12cd/my-room\";\n+        let seg = room_route_segment(id).unwrap();\n+        assert_eq!(seg, \"9ab12cdmy-room\");\n+        assert_eq!(room_id_from_route_segment(&seg).as_deref(), Some(id));\n+    }\n+\n+    #[test]\n+    fn too_short_segment_rejected() {\n+        assert!(room_id_from_route_segment(\"9ab12cd\").is_none());\n+    }\n+}\ndiff --git a/types/src/url_identity_tests.rs b/types/src/url_identity_tests.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..e2ff0a9a64a88049e31f20979c703777df6a9b65\n--- /dev/null\n+++ b/types/src/url_identity_tests.rs\n@@ -0,0 +1,126 @@\n+//! How `url::Url` behaves as `HashMap` keys (`Eq` + `Hash`).\n+//!\n+//! If `ItemId::External` stores `Url`, these tests are the contract you are buying into\n+//! (or the baseline before you add a custom normalization layer).\n+\n+use std::collections::HashMap;\n+use std::hash::{Hash, Hasher};\n+use url::Url;\n+\n+fn hash_one(url: &Url) -> u64 {\n+    let mut h = std::collections::hash_map::DefaultHasher::new();\n+    url.hash(&mut h);\n+    h.finish()\n+}\n+\n+#[test]\n+fn identical_parse_strings_are_eq_and_share_hash_bucket() {\n+    let a = Url::parse(\"https://example.com/path\").unwrap();\n+    let b = Url::parse(\"https://example.com/path\").unwrap();\n+    assert_eq!(a, b);\n+    assert_eq!(hash_one(&a), hash_one(&b));\n+\n+    let mut m: HashMap<Url, u32> = HashMap::new();\n+    m.insert(a, 1);\n+    *m.entry(b).or_default() += 10;\n+    assert_eq!(m.len(), 1);\n+    assert_eq!(m[&Url::parse(\"https://example.com/path\").unwrap()], 11);\n+}\n+\n+#[test]\n+fn host_is_ascii_lowercase_in_eq() {\n+    let lower = Url::parse(\"https://examplE.com/\").unwrap();\n+    let upper = Url::parse(\"https://EXAMPLE.com/\").unwrap();\n+    assert_eq!(lower, upper);\n+    assert_eq!(hash_one(&lower), hash_one(&upper));\n+}\n+\n+#[test]\n+fn path_space_normalizes_to_percent_encoding_so_forms_merge() {\n+    let encoded = Url::parse(\"https://example.com/a%20b\").unwrap();\n+    let decoded = Url::parse(\"https://example.com/a b\").unwrap();\n+    // Parser normalizes both to the same internal path (`/a%20b`).\n+    assert_eq!(encoded, decoded);\n+    assert_eq!(hash_one(&encoded), hash_one(&decoded));\n+\n+    let mut m: HashMap<Url, &str> = HashMap::new();\n+    m.insert(encoded, \"first\");\n+    assert_eq!(m.insert(decoded, \"second\"), Some(\"first\"));\n+    assert_eq!(m.len(), 1);\n+    assert_eq!(m.values().next().copied(), Some(\"second\"));\n+}\n+\n+#[test]\n+fn encoded_slash_in_segment_stays_distinct_from_real_path_separator() {\n+    let encoded = Url::parse(\"https://example.com/a%2Fb\").unwrap();\n+    let real_slash = Url::parse(\"https://example.com/a/b\").unwrap();\n+    assert_ne!(encoded, real_slash);\n+    assert_ne!(hash_one(&encoded), hash_one(&real_slash));\n+}\n+\n+#[test]\n+fn trailing_slash_on_path_is_significant_for_eq() {\n+    let with_slash = Url::parse(\"https://example.com/foo/\").unwrap();\n+    let no_slash = Url::parse(\"https://example.com/foo\").unwrap();\n+    assert_ne!(with_slash, no_slash);\n+    assert_ne!(hash_one(&with_slash), hash_one(&no_slash));\n+}\n+\n+#[test]\n+fn default_http_port_80_is_normalized_in_representation() {\n+    let explicit = Url::parse(\"http://example.com:80/\").unwrap();\n+    let implicit = Url::parse(\"http://example.com/\").unwrap();\n+    assert_eq!(explicit, implicit);\n+    assert_eq!(hash_one(&explicit), hash_one(&implicit));\n+}\n+\n+#[test]\n+fn default_https_port_443_is_normalized() {\n+    let explicit = Url::parse(\"https://example.com:443/foo\").unwrap();\n+    let implicit = Url::parse(\"https://example.com/foo\").unwrap();\n+    assert_eq!(explicit, implicit);\n+}\n+\n+#[test]\n+fn non_default_port_is_part_of_identity() {\n+    let a = Url::parse(\"https://example.com:444/\").unwrap();\n+    let b = Url::parse(\"https://example.com:445/\").unwrap();\n+    assert_ne!(a, b);\n+}\n+\n+#[test]\n+fn empty_path_vs_slash_only_path_may_differ() {\n+    let root = Url::parse(\"https://example.com\").unwrap();\n+    let slash = Url::parse(\"https://example.com/\").unwrap();\n+    // Both serialize to `https://example.com/` in practice for this crate — verify.\n+    assert_eq!(root, slash, \"document: root and trailing-slash-only merge for this parser\");\n+}\n+\n+#[test]\n+fn scheme_case_is_normalized_to_lowercase() {\n+    let lower = Url::parse(\"https://example.com/\").unwrap();\n+    let upper = Url::parse(\"HTTPS://example.com/\").unwrap();\n+    assert_eq!(lower, upper);\n+}\n+\n+#[test]\n+fn fragment_is_part_of_eq_and_hash() {\n+    let no_frag = Url::parse(\"https://example.com/a\").unwrap();\n+    let frag = Url::parse(\"https://example.com/a#section\").unwrap();\n+    assert_ne!(\n+        no_frag, frag,\n+        \"#fragment is included in PartialEq — anchors are different HashMap keys\"\n+    );\n+    assert_ne!(hash_one(&no_frag), hash_one(&frag));\n+}\n+\n+#[test]\n+fn query_order_and_encoding_can_split_identity() {\n+    let a = Url::parse(\"https://example.com/?b=2&a=1\").unwrap();\n+    let b = Url::parse(\"https://example.com/?a=1&b=2\").unwrap();\n+    assert_ne!(a, b, \"query pairs order is preserved in serialization\");\n+\n+    let plus = Url::parse(\"https://example.com/?q=a+b\").unwrap();\n+    let encoded = Url::parse(\"https://example.com/?q=a%20b\").unwrap();\n+    assert_ne!(plus, encoded, \"space as + vs %20 — different keys unless normalized\");\n+}\ndiff --git a/types/src/url_normalize.rs b/types/src/url_normalize.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..d5bc913f33ad29cd0cd1c7158e28e4fefdbf5f5d\n--- /dev/null\n+++ b/types/src/url_normalize.rs\n@@ -0,0 +1,234 @@\n+//! Normalization for external `http(s)://` item identity (not slug tilde ontology).\n+//!\n+//! Policy (intentional, extend here as new domains need treatment):\n+//! - Query pairs sorted lexicographically by **lowercased** key, then value.\n+//! - YouTube family → stable `www.youtube.com` shapes where possible.\n+\n+use url::Url;\n+\n+/// Whether `-/` → `https://…` path segments should keep original casing (YouTube video IDs are\n+/// case-sensitive).\n+pub(crate) fn host_preserves_dash_path_case(host: &str) -> bool {\n+    let h = host.trim().to_ascii_lowercase();\n+    let h = h.strip_prefix(\"www.\").unwrap_or(h.as_str());\n+    matches!(\n+        h,\n+        \"youtu.be\" | \"youtube.com\" | \"m.youtube.com\" | \"music.youtube.com\"\n+    )\n+}\n+\n+/// Normalize external http(s) URLs for stable [`super::paths::canonicalize_item`] output.\n+pub fn normalize_http_identity_url(s: &str) -> Option<String> {\n+    let mut u = Url::parse(s).ok()?;\n+    if !matches!(u.scheme(), \"http\" | \"https\") {\n+        return None;\n+    }\n+    rewrite_youtube(&mut u);\n+    sort_query_pairs(&mut u);\n+    Some(u.to_string())\n+}\n+\n+fn base_host(host: &str) -> String {\n+    let lower = host.to_ascii_lowercase();\n+    lower\n+        .strip_prefix(\"www.\")\n+        .unwrap_or(lower.as_str())\n+        .to_string()\n+}\n+\n+fn rewrite_youtube(u: &mut Url) {\n+    let Some(host_raw) = u.host_str() else {\n+        return;\n+    };\n+    let base = base_host(host_raw);\n+    let path = u.path().to_string();\n+\n+    match base.as_str() {\n+        \"youtu.be\" => {\n+            let id = path.trim_start_matches('/').split('/').next().unwrap_or(\"\").to_string();\n+            if id.is_empty() {\n+                return;\n+            }\n+            let saved: Vec<(String, String)> = u.query_pairs().into_owned().collect();\n+            let Ok(mut out) = Url::parse(&format!(\"https://www.youtube.com/watch?v={id}\")) else {\n+                return;\n+            };\n+            {\n+                let mut q = out.query_pairs_mut();\n+                for (k, v) in saved {\n+                    if k.eq_ignore_ascii_case(\"v\") {\n+                        continue;\n+                    }\n+                    q.append_pair(&k, &v);\n+                }\n+            }\n+            *u = out;\n+        }\n+        \"youtube.com\" | \"m.youtube.com\" => {\n+            if base == \"m.youtube.com\" {\n+                let _ = u.set_host(Some(\"www.youtube.com\"));\n+            }\n+            if path.starts_with(\"/embed/\") {\n+                let id = path\n+                    .strip_prefix(\"/embed/\")\n+                    .unwrap_or(\"\")\n+                    .trim_matches('/')\n+                    .split('/')\n+                    .next()\n+                    .unwrap_or(\"\")\n+                    .to_string();\n+                if id.is_empty() {\n+                    return;\n+                }\n+                let saved: Vec<(String, String)> = u.query_pairs().into_owned().collect();\n+                let Ok(mut out) = Url::parse(&format!(\"https://www.youtube.com/watch?v={id}\"))\n+                else {\n+                    return;\n+                };\n+                {\n+                    let mut q = out.query_pairs_mut();\n+                    for (k, v) in saved {\n+                        if k.eq_ignore_ascii_case(\"v\") {\n+                            continue;\n+                        }\n+                        q.append_pair(&k, &v);\n+                    }\n+                }\n+                *u = out;\n+                return;\n+            }\n+            if path.starts_with(\"/v/\") {\n+                let id = path\n+                    .strip_prefix(\"/v/\")\n+                    .unwrap_or(\"\")\n+                    .trim_matches('/')\n+                    .split('/')\n+                    .next()\n+                    .unwrap_or(\"\")\n+                    .to_string();\n+                if id.is_empty() {\n+                    return;\n+                }\n+                let saved: Vec<(String, String)> = u.query_pairs().into_owned().collect();\n+                let Ok(mut out) = Url::parse(&format!(\"https://www.youtube.com/watch?v={id}\"))\n+                else {\n+                    return;\n+                };\n+                {\n+                    let mut q = out.query_pairs_mut();\n+                    for (k, v) in saved {\n+                        if k.eq_ignore_ascii_case(\"v\") {\n+                            continue;\n+                        }\n+                        q.append_pair(&k, &v);\n+                    }\n+                }\n+                *u = out;\n+                return;\n+            }\n+            if path.starts_with(\"/watch\") {\n+                let _ = u.set_host(Some(\"www.youtube.com\"));\n+                return;\n+            }\n+            if path.starts_with(\"/shorts/\") {\n+                let id = path\n+                    .strip_prefix(\"/shorts/\")\n+                    .unwrap_or(\"\")\n+                    .trim_matches('/')\n+                    .split('/')\n+                    .next()\n+                    .unwrap_or(\"\")\n+                    .to_string();\n+                if id.is_empty() {\n+                    return;\n+                }\n+                let saved: Vec<(String, String)> = u.query_pairs().into_owned().collect();\n+                let Ok(mut out) = Url::parse(&format!(\"https://www.youtube.com/shorts/{id}\"))\n+                else {\n+                    return;\n+                };\n+                {\n+                    let mut q = out.query_pairs_mut();\n+                    for (k, v) in saved {\n+                        q.append_pair(&k, &v);\n+                    }\n+                }\n+                *u = out;\n+                return;\n+            }\n+            let _ = u.set_host(Some(\"www.youtube.com\"));\n+        }\n+        \"music.youtube.com\" => {}\n+        _ => {}\n+    }\n+}\n+\n+fn sort_query_pairs(u: &mut Url) {\n+    let pairs: Vec<(String, String)> = u.query_pairs().into_owned().collect();\n+    if pairs.is_empty() {\n+        u.set_query(None);\n+        return;\n+    }\n+    let mut pairs = pairs;\n+    pairs.sort_by(|a, b| {\n+        a.0.to_ascii_lowercase()\n+            .cmp(&b.0.to_ascii_lowercase())\n+            .then_with(|| a.1.cmp(&b.1))\n+    });\n+    u.set_query(None);\n+    {\n+        let mut q = u.query_pairs_mut();\n+        for (k, v) in pairs {\n+            q.append_pair(&k, &v);\n+        }\n+    }\n+}\n+\n+#[cfg(test)]\n+mod tests {\n+    use super::*;\n+\n+    #[test]\n+    fn youtube_youtu_be_to_watch() {\n+        assert_eq!(\n+            normalize_http_identity_url(\"https://youtu.be/dQw4w9WgXcQ\").as_deref(),\n+            Some(\"https://www.youtube.com/watch?v=dQw4w9WgXcQ\")\n+        );\n+    }\n+\n+    #[test]\n+    fn youtube_watch_query_sorted() {\n+        assert_eq!(\n+            normalize_http_identity_url(\"https://youtube.com/watch?v=Z&a=1&b=2\").as_deref(),\n+            Some(\"https://www.youtube.com/watch?a=1&b=2&v=Z\")\n+        );\n+        assert_eq!(\n+            normalize_http_identity_url(\"https://youtube.com/watch?b=2&a=1&v=Z\").as_deref(),\n+            Some(\"https://www.youtube.com/watch?a=1&b=2&v=Z\")\n+        );\n+    }\n+\n+    #[test]\n+    fn youtube_embed_to_watch() {\n+        assert_eq!(\n+            normalize_http_identity_url(\"https://www.youtube.com/embed/dQw4w9WgXcQ\").as_deref(),\n+            Some(\"https://www.youtube.com/watch?v=dQw4w9WgXcQ\")\n+        );\n+    }\n+\n+    #[test]\n+    fn youtube_shorts_host() {\n+        assert_eq!(\n+            normalize_http_identity_url(\"https://youtube.com/shorts/AbCdEfGhIjK\").as_deref(),\n+            Some(\"https://www.youtube.com/shorts/AbCdEfGhIjK\")\n+        );\n+    }\n+\n+    #[test]\n+    fn arbitrary_query_sorted() {\n+        assert_eq!(\n+            normalize_http_identity_url(\"https://example.com/x?z=1&a=2\").as_deref(),\n+            Some(\"https://example.com/x?a=2&z=1\")\n+        );\n+    }\n+}\n","role":"user"}],"model":"~x-ai/grok-latest"}