{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[52f5c51c] Add Reddit OAuth linking and make UUID the only account identity.\n\nOAuth providers only attach to a session UUID (first link creates the\nprincipal); linked providers stay private on the account page.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide A — unified diff (full patch):\ndiff --git a/AGENTS.md b/AGENTS.md\nindex 6e0fd8ebb65d665c9c1438e3275971d62b98fd95..e9cc3173dbeb21ad0fc090ca7b407b027c7820a9 100644\n--- a/AGENTS.md\n+++ b/AGENTS.md\n@@ -35,8 +35,11 @@ Environment variables (defaults in `server/src/state.rs`):\n - `SORTER2_DATA_DIR` — default `./data` (created on startup)\n - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`\n - `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)\n-- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)\n-- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)\n+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth linking (optional)\n+- `REDDIT_CLIENT_ID` / `REDDIT_CLIENT_SECRET` (or `REDDIT_APP_*`) — Reddit API import + OAuth linking (optional)\n+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` and `/auth/reddit` (tests only)\n+\n+Identity: UUID is canonical. OAuth providers only *link* to a UUID (first link creates the principal). Linked providers are private to the account owner.\n \n Health check: `GET /healthz` → `ok`.\n \ndiff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs\nindex 5906f93b13853421e96a3c37bc9d8202a47842bf..c706ae8045a811e5941f5f6c72da88f42a403a82 100644\n--- a/server/src/auth/mod.rs\n+++ b/server/src/auth/mod.rs\n@@ -1,4 +1,8 @@\n-//! GitHub OAuth login, session cookies, and vote actor resolution.\n+//! OAuth linking, session cookies, and vote actor resolution.\n+//!\n+//! Canonical identity is a UUID. OAuth providers only *link* to that UUID\n+//! (first link creates the principal; later links attach while logged in).\n+//! Which providers are linked is private to the account owner.\n \n pub mod config;\n pub mod identity;\n@@ -22,7 +26,9 @@ use crate::{\n     form_template::template_json_compact,\n     html::layout,\n     state::AppState,\n-    storage_schema::{oauth_link_owner, pseudonym_owner, Store, StoreFields},\n+    storage_schema::{\n+        linked_providers_for_uuid, oauth_link_owner, pseudonym_owner, Store, StoreFields,\n+    },\n     ui_action::UI_RPC_FIELD,\n };\n \n@@ -53,10 +59,12 @@ fn new_actor_uuid() -> String {\n pub struct LoginQuery {\n     #[serde(default)]\n     pub return_to: Option<String>,\n+    #[serde(default)]\n+    pub error: Option<String>,\n }\n \n #[derive(Debug, Deserialize)]\n-pub struct GitHubStartQuery {\n+pub struct OAuthStartQuery {\n     #[serde(default)]\n     pub return_to: Option<String>,\n     #[serde(default)]\n@@ -72,15 +80,22 @@ fn return_from_query_or_jar(jar: &CookieJar, query: Option<&str>) -> String {\n         .unwrap_or_else(|| \"/\".to_string())\n }\n \n-fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, String)> {\n+/// Available OAuth link targets: `(provider_key, label, start_href)`.\n+fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, &'static str, String)> {\n     let mut out = Vec::new();\n+    let enc = urlencoding::encode(return_to);\n     if oauth::GitHubConfig::from_env(base_url).is_some() {\n         out.push((\n-            \"GitHub\",\n-            format!(\n-                \"/auth/github?return_to={}\",\n-                urlencoding::encode(return_to)\n-            ),\n+            \"github\",\n+            oauth::provider_label(\"github\"),\n+            format!(\"/auth/github?return_to={enc}\"),\n+        ));\n+    }\n+    if oauth::RedditConfig::from_env(base_url).is_some() {\n+        out.push((\n+            \"reddit\",\n+            oauth::provider_label(\"reddit\"),\n+            format!(\"/auth/reddit?return_to={enc}\"),\n         ));\n     }\n     out\n@@ -125,23 +140,41 @@ fn alias_claim_forms(return_to: &str, submit_label: &str) -> Result<Markup, Stat\n     })\n }\n \n-fn signed_out_body(providers: &[(&str, String)]) -> Markup {\n+fn login_error_message(code: Option<&str>) -> Option<&'static str> {\n+    match code {\n+        Some(\"oauth_taken\") => {\n+            Some(\"that OAuth account is already linked to a different sorter2 account\")\n+        }\n+        Some(\"oauth_failed\") => Some(\"OAuth failed — try again\"),\n+        _ => None,\n+    }\n+}\n+\n+fn signed_out_body(\n+    providers: &[(&str, &str, String)],\n+    error: Option<&str>,\n+) -> Markup {\n     html! {\n         main class=\"panel login-page\" {\n             section class=\"login-section\" {\n                 h1 { \"sign in\" }\n-                p class=\"muted\" { \"link an account to vote under a lasting alias\" }\n+                p class=\"muted\" {\n+                    \"link an OAuth account to create your identity, then claim an alias to vote\"\n+                }\n+                @if let Some(msg) = login_error_message(error) {\n+                    p class=\"alias-bad\" data-testid=\"login-error\" { (msg) }\n+                }\n                 @if providers.is_empty() {\n                     p class=\"muted\" {\n-                        \"OAuth is not configured. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET.\"\n+                        \"OAuth is not configured. Set GitHub and/or Reddit client credentials.\"\n                     }\n                 } @else {\n                     ul class=\"oauth-provider-list\" {\n-                        @for (name, href) in providers {\n+                        @for (key, label, href) in providers {\n                             li {\n                                 a href=(href) class=\"btn-primary oauth-provider\"\n-                                    data-testid=(format!(\"oauth-{}\", name.to_lowercase())) {\n-                                    (format!(\"Continue with {name}\"))\n+                                    data-testid=(format!(\"oauth-{key}\")) {\n+                                    (format!(\"Link {label}\"))\n                                 }\n                             }\n                         }\n@@ -156,7 +189,10 @@ fn signed_out_body(providers: &[(&str, String)]) -> Markup {\n fn account_body(\n     actor: &session::SessionActor,\n     aliases: &[String],\n-    providers: &[(&str, String)],\n+    // Provider keys already linked to this UUID (private).\n+    linked: &[String],\n+    // Providers available to link: not yet attached.\n+    unlinkable: &[(&str, &str, String)],\n     claim_forms: Markup,\n ) -> Markup {\n     let current = actor.pseudonym.trim();\n@@ -212,16 +248,29 @@ fn account_body(\n                 (claim_forms)\n             }\n \n-            @if !providers.is_empty() {\n-                section class=\"login-section\" {\n-                    h2 { \"linked sign-in\" }\n-                    p class=\"muted small\" { \"sign in again with the same provider to return to this account\" }\n+            section class=\"login-section\" {\n+                h2 { \"linked sign-in\" }\n+                p class=\"muted small\" {\n+                    \"private to you — linking more providers raises trust weight without publishing which accounts you use\"\n+                }\n+                @if linked.is_empty() {\n+                    p class=\"muted\" data-testid=\"linked-providers-empty\" { \"none yet\" }\n+                } @else {\n+                    ul class=\"linked-provider-list\" data-testid=\"linked-providers\" {\n+                        @for key in linked {\n+                            li data-testid=(format!(\"linked-{key}\")) {\n+                                (oauth::provider_label(key))\n+                            }\n+                        }\n+                    }\n+                }\n+                @if !unlinkable.is_empty() {\n                     ul class=\"oauth-provider-list\" {\n-                        @for (name, href) in providers {\n+                        @for (key, label, href) in unlinkable {\n                             li {\n                                 a href=(href) class=\"btn-secondary oauth-provider\"\n-                                    data-testid=(format!(\"oauth-relink-{}\", name.to_lowercase())) {\n-                                    (format!(\"Re-link {name}\"))\n+                                    data-testid=(format!(\"oauth-link-{key}\")) {\n+                                    (format!(\"Link {label}\"))\n                                 }\n                             }\n                         }\n@@ -243,12 +292,21 @@ fn account_body(\n fn login_body(\n     session: Option<&session::SessionActor>,\n     aliases: &[String],\n-    providers: &[(&str, String)],\n+    linked: &[String],\n+    providers: &[(&str, &str, String)],\n     claim_forms: Option<Markup>,\n+    error: Option<&str>,\n ) -> Markup {\n     match (session, claim_forms) {\n-        (Some(actor), Some(forms)) => account_body(actor, aliases, providers, forms),\n-        _ => signed_out_body(providers),\n+        (Some(actor), Some(forms)) => {\n+            let unlinkable: Vec<_> = providers\n+                .iter()\n+                .filter(|(key, _, _)| !linked.iter().any(|p| p == key))\n+                .cloned()\n+                .collect();\n+            account_body(actor, aliases, linked, &unlinkable, forms)\n+        }\n+        _ => signed_out_body(providers, error),\n     }\n }\n \n@@ -268,6 +326,10 @@ pub async fn login_page(\n         .as_ref()\n         .map(|s| alias_list(db, &s.uuid))\n         .unwrap_or_default();\n+    let linked = session\n+        .as_ref()\n+        .map(|s| linked_providers_for_uuid(db, &s.uuid).unwrap_or_default())\n+        .unwrap_or_default();\n     let providers = oauth_providers(&base_url_from_env(state.cfg.port), &return_to);\n \n     let claim_forms = if session.is_some() {\n@@ -282,7 +344,14 @@ pub async fn login_page(\n         } else {\n             \"login · sorter2\"\n         },\n-        login_body(session.as_ref(), &aliases, &providers, claim_forms),\n+        login_body(\n+            session.as_ref(),\n+            &aliases,\n+            &linked,\n+            &providers,\n+            claim_forms,\n+            query.error.as_deref(),\n+        ),\n         state.views.get_views(\"/login\"),\n         session\n             .as_ref()\n@@ -302,7 +371,6 @@ pub async fn alias_page(\n     let db = state.projection_store.db();\n     let session = session::load_valid_session(db, &session_id).ok_or(StatusCode::UNAUTHORIZED)?;\n     if session::session_has_pseudonym(&session) {\n-        // Already onboarded — manage aliases on the account page.\n         return Ok(Redirect::to(\"/login\").into_response());\n     }\n \n@@ -331,7 +399,7 @@ pub async fn alias_page(\n pub async fn github_start(\n     State(state): State<AppState>,\n     jar: CookieJar,\n-    Query(query): Query<GitHubStartQuery>,\n+    Query(query): Query<OAuthStartQuery>,\n ) -> Result<Response, StatusCode> {\n     let cfg = oauth::GitHubConfig::from_env(&base_url_from_env(state.cfg.port))\n         .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n@@ -342,7 +410,28 @@ pub async fn github_start(\n     } else {\n         None\n     };\n-    let url = oauth::authorize_url(&cfg, &state_token, mock_user);\n+    let url = oauth::github_authorize_url(&cfg, &state_token, mock_user);\n+    let jar = jar\n+        .add(session::oauth_state_cookie_value(&state_token))\n+        .add(session::auth_return_cookie_value(&return_to));\n+    Ok((jar, Redirect::temporary(&url)).into_response())\n+}\n+\n+pub async fn reddit_start(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    Query(query): Query<OAuthStartQuery>,\n+) -> Result<Response, StatusCode> {\n+    let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+    let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());\n+    let state_token = session::new_oauth_state();\n+    let mock_user = if config::mock_oauth_allowed() {\n+        query.mock_user.as_deref()\n+    } else {\n+        None\n+    };\n+    let url = oauth::reddit_authorize_url(&cfg, &state_token, mock_user);\n     let jar = jar\n         .add(session::oauth_state_cookie_value(&state_token))\n         .add(session::auth_return_cookie_value(&return_to));\n@@ -355,6 +444,13 @@ pub struct OAuthCallbackQuery {\n     pub state: String,\n }\n \n+/// Link `provider:provider_id` to a UUID.\n+///\n+/// - Logged in + new provider → attach to session UUID\n+/// - Logged in + already ours → no-op\n+/// - Logged in + owned by someone else → conflict\n+/// - Logged out + known link → resume that UUID\n+/// - Logged out + unknown → create principal + first link\n async fn finish_oauth_login(\n     state: &AppState,\n     jar: CookieJar,\n@@ -364,11 +460,41 @@ async fn finish_oauth_login(\n     let db = state.projection_store.db();\n     let return_to = return_from_query_or_jar(&jar, None);\n \n-    let uuid = match oauth_link_owner(db, provider, &provider_id)\n-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?\n-    {\n-        Some(existing) => existing,\n-        None => {\n+    let existing_owner = oauth_link_owner(db, provider, &provider_id)\n+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+    let session_uuid = session::session_id_from_jar(&jar)\n+        .as_deref()\n+        .and_then(|id| session::load_valid_session(db, id))\n+        .map(|s| s.uuid);\n+    let linking_while_logged_in = session_uuid.is_some();\n+\n+    let uuid = match (session_uuid, existing_owner) {\n+        (Some(session_uuid), Some(owner)) if owner == session_uuid => session_uuid,\n+        (Some(_), Some(_)) => {\n+            return Ok((\n+                jar.add(session::clear_oauth_state_cookie()),\n+                \"/login?error=oauth_taken\".into(),\n+            ));\n+        }\n+        (Some(session_uuid), None) => {\n+            let ts = now_ms();\n+            state\n+                .append_identity_events(vec![Event::OauthLinked {\n+                    uuid: session_uuid.clone(),\n+                    provider: provider.to_string(),\n+                    provider_id,\n+                    ts,\n+                }])\n+                .await\n+                .map_err(|e| {\n+                    tracing::warn!(err = %e, \"oauth link append failed\");\n+                    StatusCode::INTERNAL_SERVER_ERROR\n+                })?;\n+            session_uuid\n+        }\n+        (None, Some(owner)) => owner,\n+        (None, None) => {\n             let uuid = new_actor_uuid();\n             let ts = now_ms();\n             state\n@@ -409,6 +535,9 @@ async fn finish_oauth_login(\n             \"/login/alias?return_to={}\",\n             urlencoding::encode(&return_to)\n         )\n+    } else if linking_while_logged_in {\n+        // Additional link while already in an account → stay on account page.\n+        \"/login\".to_string()\n     } else {\n         return_to\n     };\n@@ -434,22 +563,57 @@ pub async fn github_callback(\n         .build()\n         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n \n-    let token = oauth::exchange_code(&client, &cfg, &query.code)\n+    let token = oauth::github_exchange_code(&client, &cfg, &query.code)\n         .await\n         .map_err(|e| {\n             tracing::warn!(err = %e, \"github oauth token exchange failed\");\n             StatusCode::BAD_GATEWAY\n         })?;\n-    let user = oauth::fetch_user(&client, &cfg.api_base, &token)\n+    let user = oauth::github_fetch_user(&client, &cfg.api_base, &token)\n         .await\n         .map_err(|e| {\n             tracing::warn!(err = %e, \"github user fetch failed\");\n             StatusCode::BAD_GATEWAY\n         })?;\n \n-    let provider = \"github\";\n-    let provider_id = oauth::provider_id(&user);\n-    let (jar, dest) = finish_oauth_login(&state, jar, provider, provider_id).await?;\n+    let (jar, dest) =\n+        finish_oauth_login(&state, jar, \"github\", oauth::github_provider_id(&user)).await?;\n+    Ok((jar, Redirect::to(&dest)).into_response())\n+}\n+\n+pub async fn reddit_callback(\n+    State(state): State<AppState>,\n+    jar: CookieJar,\n+    Query(query): Query<OAuthCallbackQuery>,\n+) -> Result<Response, StatusCode> {\n+    let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+\n+    let expected_state = session::oauth_state_from_jar(&jar).ok_or(StatusCode::BAD_REQUEST)?;\n+    if expected_state != query.state {\n+        return Err(StatusCode::BAD_REQUEST);\n+    }\n+\n+    let client = Client::builder()\n+        .timeout(std::time::Duration::from_secs(15))\n+        .build()\n+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+    let token = oauth::reddit_exchange_code(&client, &cfg, &query.code)\n+        .await\n+        .map_err(|e| {\n+            tracing::warn!(err = %e, \"reddit oauth token exchange failed\");\n+            StatusCode::BAD_GATEWAY\n+        })?;\n+    let user = oauth::reddit_fetch_user(&client, &cfg, &token)\n+        .await\n+        .map_err(|e| {\n+            tracing::warn!(err = %e, \"reddit user fetch failed\");\n+            StatusCode::BAD_GATEWAY\n+        })?;\n+\n+    let (jar, dest) =\n+        finish_oauth_login(&state, jar, \"reddit\", oauth::reddit_provider_id(&user)).await?;\n     Ok((jar, Redirect::to(&dest)).into_response())\n }\n \ndiff --git a/server/src/auth/oauth.rs b/server/src/auth/oauth.rs\nindex b80078fee0c5acd905b9125d29454e46c4e0d066..369b1527d9032cf312a07819279e0f988ef4a36e 100644\n--- a/server/src/auth/oauth.rs\n+++ b/server/src/auth/oauth.rs\n@@ -1,8 +1,15 @@\n-//! GitHub OAuth (raw reqwest, same style as reddit.rs).\n+//! OAuth providers (GitHub + Reddit). Provider accounts only *link* to a UUID;\n+//! the UUID is the canonical identity. Which providers are linked is private.\n \n use reqwest::Client;\n use serde::Deserialize;\n \n+use crate::reddit::{\n+    default_user_agent, reddit_oauth_api_base, reddit_oauth_token_base,\n+};\n+\n+// ── GitHub ──────────────────────────────────────────────────────────────────\n+\n #[derive(Debug, Clone)]\n pub struct GitHubConfig {\n     pub client_id: String,\n@@ -40,7 +47,7 @@ impl GitHubConfig {\n }\n \n #[derive(Debug, Deserialize)]\n-struct TokenResponse {\n+struct GitHubTokenResponse {\n     access_token: String,\n }\n \n@@ -50,7 +57,7 @@ pub struct GitHubUser {\n     pub login: String,\n }\n \n-pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n+pub fn github_authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n     let mut url = format!(\n         \"{}/login/oauth/authorize?client_id={}&redirect_uri={}&scope=read:user&state={}\",\n         cfg.oauth_base.trim_end_matches('/'),\n@@ -65,7 +72,7 @@ pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -\n     url\n }\n \n-pub async fn exchange_code(\n+pub async fn github_exchange_code(\n     client: &Client,\n     cfg: &GitHubConfig,\n     code: &str,\n@@ -90,14 +97,14 @@ pub async fn exchange_code(\n         return Err(format!(\"github token HTTP {}\", resp.status()));\n     }\n \n-    let body: TokenResponse = resp\n+    let body: GitHubTokenResponse = resp\n         .json()\n         .await\n         .map_err(|e| format!(\"github token parse failed: {e}\"))?;\n     Ok(body.access_token)\n }\n \n-pub async fn fetch_user(\n+pub async fn github_fetch_user(\n     client: &Client,\n     api_base: &str,\n     access_token: &str,\n@@ -120,10 +127,149 @@ pub async fn fetch_user(\n         .map_err(|e| format!(\"github user parse failed: {e}\"))\n }\n \n-pub fn provider_id(user: &GitHubUser) -> String {\n+pub fn github_provider_id(user: &GitHubUser) -> String {\n     user.id.to_string()\n }\n \n+// ── Reddit ──────────────────────────────────────────────────────────────────\n+\n+#[derive(Debug, Clone)]\n+pub struct RedditConfig {\n+    pub client_id: String,\n+    pub client_secret: String,\n+    pub redirect_uri: String,\n+    /// Host for `/api/v1/authorize` (www.reddit.com in production).\n+    pub authorize_base: String,\n+    /// Host for `POST /api/v1/access_token`.\n+    pub token_base: String,\n+    /// Host for bearer `GET /api/v1/me` (oauth.reddit.com).\n+    pub api_base: String,\n+    pub user_agent: String,\n+}\n+\n+/// Authorize page base; defaults to the same host as token POSTs.\n+pub fn reddit_authorize_base() -> String {\n+    std::env::var(\"REDDIT_OAUTH_AUTHORIZE_BASE\")\n+        .or_else(|_| std::env::var(\"REDDIT_OAUTH_BASE\"))\n+        .unwrap_or_else(|_| \"https://www.reddit.com\".into())\n+}\n+\n+impl RedditConfig {\n+    pub fn from_env(base_url: &str) -> Option<Self> {\n+        let client_id = std::env::var(\"REDDIT_CLIENT_ID\")\n+            .or_else(|_| std::env::var(\"REDDIT_APP_ID\"))\n+            .ok()?;\n+        let client_secret = std::env::var(\"REDDIT_CLIENT_SECRET\")\n+            .or_else(|_| std::env::var(\"REDDIT_APP_SECRET\"))\n+            .ok()?;\n+        if client_id.is_empty() || client_secret.is_empty() {\n+            return None;\n+        }\n+        let base = base_url.trim_end_matches('/');\n+        Some(Self {\n+            client_id,\n+            client_secret,\n+            redirect_uri: format!(\"{base}/auth/reddit/callback\"),\n+            authorize_base: reddit_authorize_base(),\n+            token_base: reddit_oauth_token_base(),\n+            api_base: reddit_oauth_api_base(),\n+            user_agent: default_user_agent(),\n+        })\n+    }\n+}\n+\n+#[derive(Debug, Deserialize)]\n+struct RedditTokenResponse {\n+    access_token: String,\n+}\n+\n+#[derive(Debug, Deserialize)]\n+pub struct RedditUser {\n+    /// Stable id (`t2_…`); never use `name` as identity.\n+    pub id: String,\n+    pub name: String,\n+}\n+\n+pub fn reddit_authorize_url(cfg: &RedditConfig, state: &str, mock_user: Option<&str>) -> String {\n+    let mut url = format!(\n+        \"{}/api/v1/authorize?client_id={}&response_type=code&state={}&redirect_uri={}&duration=temporary&scope=identity\",\n+        cfg.authorize_base.trim_end_matches('/'),\n+        urlencoding::encode(&cfg.client_id),\n+        urlencoding::encode(state),\n+        urlencoding::encode(&cfg.redirect_uri),\n+    );\n+    if let Some(user) = mock_user {\n+        url.push_str(\"&mock_user=\");\n+        url.push_str(&urlencoding::encode(user));\n+    }\n+    url\n+}\n+\n+pub async fn reddit_exchange_code(\n+    client: &Client,\n+    cfg: &RedditConfig,\n+    code: &str,\n+) -> Result<String, String> {\n+    let resp = client\n+        .post(format!(\n+            \"{}/api/v1/access_token\",\n+            cfg.token_base.trim_end_matches('/')\n+        ))\n+        .header(\"User-Agent\", &cfg.user_agent)\n+        .basic_auth(&cfg.client_id, Some(&cfg.client_secret))\n+        .form(&[\n+            (\"grant_type\", \"authorization_code\"),\n+            (\"code\", code),\n+            (\"redirect_uri\", cfg.redirect_uri.as_str()),\n+        ])\n+        .send()\n+        .await\n+        .map_err(|e| format!(\"reddit token request failed: {e}\"))?;\n+\n+    if !resp.status().is_success() {\n+        let status = resp.status();\n+        let body = resp.text().await.unwrap_or_default();\n+        return Err(format!(\"reddit token HTTP {status}: {body}\"));\n+    }\n+\n+    let body: RedditTokenResponse = resp\n+        .json()\n+        .await\n+        .map_err(|e| format!(\"reddit token parse failed: {e}\"))?;\n+    Ok(body.access_token)\n+}\n+\n+pub async fn reddit_fetch_user(\n+    client: &Client,\n+    cfg: &RedditConfig,\n+    access_token: &str,\n+) -> Result<RedditUser, String> {\n+    let resp = client\n+        .get(format!(\n+            \"{}/api/v1/me\",\n+            cfg.api_base.trim_end_matches('/')\n+        ))\n+        .header(\"User-Agent\", &cfg.user_agent)\n+        .bearer_auth(access_token)\n+        .send()\n+        .await\n+        .map_err(|e| format!(\"reddit user request failed: {e}\"))?;\n+\n+    if !resp.status().is_success() {\n+        return Err(format!(\"reddit user HTTP {}\", resp.status()));\n+    }\n+\n+    resp.json()\n+        .await\n+        .map_err(|e| format!(\"reddit user parse failed: {e}\"))\n+}\n+\n+pub fn reddit_provider_id(user: &RedditUser) -> String {\n+    user.id.clone()\n+}\n+\n+// ── Shared helpers ──────────────────────────────────────────────────────────\n+\n pub fn validate_pseudonym(raw: &str) -> Result<String, &'static str> {\n     let trimmed = raw.trim();\n     if trimmed.is_empty() {\n@@ -144,3 +290,12 @@ pub fn validate_pseudonym(raw: &str) -> Result<String, &'static str> {\n pub fn sanitize_pseudonym(login: &str) -> String {\n     validate_pseudonym(login).unwrap_or_else(|_| \"user\".to_string())\n }\n+\n+/// Display name for a provider key (`github` → `GitHub`). Never show provider ids.\n+pub fn provider_label(provider: &str) -> &'static str {\n+    match provider {\n+        \"github\" => \"GitHub\",\n+        \"reddit\" => \"Reddit\",\n+        _ => \"OAuth\",\n+    }\n+}\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex 84f2565b105fb302241b949af64bd5e49916eab2..0d948af1457504fdbd34d0b14261f65ac58da0ec 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -47,6 +47,8 @@ pub fn create_app(state: AppState) -> Router {\n         .route(\"/login/alias\", get(crate::auth::alias_page))\n         .route(\"/auth/github\", get(crate::auth::github_start))\n         .route(\"/auth/github/callback\", get(crate::auth::github_callback))\n+        .route(\"/auth/reddit\", get(crate::auth::reddit_start))\n+        .route(\"/auth/reddit/callback\", get(crate::auth::reddit_callback))\n         .route(\"/auth/logout\", post(crate::auth::logout))\n         .route(\"/auth/switch\", post(crate::auth::switch_pseudonym))\n         .route(\"/ui\", post(crate::api::ui_html::post_ui_html))\ndiff --git a/server/src/projection_apply.rs b/server/src/projection_apply.rs\nindex 4fb4b48ee0a53b7f673fae0c9731eed5acc33332..f50458c2ff3c447a3cfd28adb298e6883a2da4e9 100644\n--- a/server/src/projection_apply.rs\n+++ b/server/src/projection_apply.rs\n@@ -4,6 +4,8 @@\n //! child links, recent-vote appends) plus a cursor advance, all committed in\n //! one atomic `DisableWal` batch.\n \n+use std::collections::HashMap;\n+\n use crate::{\n     event_log::EventLogError,\n     events::{Event, EventRecord},\n@@ -44,6 +46,8 @@ pub fn apply_records(\n     let db = projection_store.db();\n     let mut batch = db.batch();\n     let mut last_seq = 0u64;\n+    // Weight reads must see earlier writes in this same batch.\n+    let mut pending_weights: HashMap<String, f64> = HashMap::new();\n \n     for record in records {\n         match &record.event {\n@@ -85,6 +89,7 @@ pub fn apply_records(\n                 ensure_path_writes(&mut batch, &parsed);\n             }\n             Event::PrincipalCreated { uuid, .. } => {\n+                pending_weights.insert(uuid.clone(), BASE_TRUST_WEIGHT);\n                 batch.write(\n                     Store::root()\n                         .user_weights()\n@@ -112,17 +117,25 @@ pub fn apply_records(\n                     }\n                 } else {\n                     batch.write(Store::root().oauth_links().key(&link_key).set(uuid));\n-                    let current = Store::root()\n-                        .user_weights()\n-                        .key(&uuid.clone())\n-                        .get(db)\n-                        .map_err(|e| EventLogError::Apply(e.to_string()))?\n+                    let current = pending_weights\n+                        .get(uuid)\n+                        .copied()\n+                        .or_else(|| {\n+                            Store::root()\n+                                .user_weights()\n+                                .key(&uuid.clone())\n+                                .get(db)\n+                                .ok()\n+                                .flatten()\n+                        })\n                         .unwrap_or(BASE_TRUST_WEIGHT);\n+                    let next = trust_weight_after_link(current);\n+                    pending_weights.insert(uuid.clone(), next);\n                     batch.write(\n                         Store::root()\n                             .user_weights()\n                             .key(&uuid.clone())\n-                            .set(&trust_weight_after_link(current)),\n+                            .set(&next),\n                     );\n                 }\n             }\n@@ -205,6 +218,15 @@ mod tests {\n                 ),\n                 record(\n                     3,\n+                    Event::OauthLinked {\n+                        uuid: uuid.into(),\n+                        provider: \"reddit\".into(),\n+                        provider_id: \"t2_abc\".into(),\n+                        ts,\n+                    },\n+                ),\n+                record(\n+                    4,\n                     Event::PseudonymClaimed {\n                         uuid: uuid.into(),\n                         pseudonym: \"octocat\".into(),\n@@ -219,8 +241,12 @@ mod tests {\n             oauth_link_owner(store.db(), \"github\", \"42\").unwrap(),\n             Some(uuid.to_string())\n         );\n+        assert_eq!(\n+            crate::storage_schema::linked_providers_for_uuid(store.db(), uuid).unwrap(),\n+            vec![\"github\".to_string(), \"reddit\".to_string()]\n+        );\n         assert_eq!(resolve_actor_uuid(store.db(), \"octocat\").unwrap(), uuid);\n-        assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 1.5);\n+        assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 2.0);\n         let aliases = Store::root()\n             .user_pseudonyms()\n             .key(&uuid.to_string())\ndiff --git a/server/src/storage_schema.rs b/server/src/storage_schema.rs\nindex b942810afd96d3bf01b7765718303a39be4ef8d2..dac6f8e6080e3f5683c24dbb8861f5a981d456c4 100644\n--- a/server/src/storage_schema.rs\n+++ b/server/src/storage_schema.rs\n@@ -103,6 +103,25 @@ pub fn oauth_link_owner(db: &Db, provider: &str, provider_id: &str) -> durable::\n         .get(db)\n }\n \n+/// Provider names linked to a UUID (`github`, `reddit`, …). Private — for the\n+/// account owner's page only; never expose which providers are linked publicly.\n+pub fn linked_providers_for_uuid(db: &Db, uuid: &str) -> durable::Result<Vec<String>> {\n+    let mut providers = Vec::new();\n+    for (key, owner) in Store::root().oauth_links().iter(db)? {\n+        if owner != uuid {\n+            continue;\n+        }\n+        let Some((provider, _)) = key.split_once(':') else {\n+            continue;\n+        };\n+        if !providers.iter().any(|p| p == provider) {\n+            providers.push(provider.to_string());\n+        }\n+    }\n+    providers.sort();\n+    Ok(providers)\n+}\n+\n pub const RECENT_VOTES_CAP: u64 = 200;\n \n fn id_key(id: &ItemId) -> String {\ndiff --git a/test/support/harness.clj b/test/support/harness.clj\nindex 4505ece5aa193e826ca61c52f1467d252080d66b..741024aab1d14269e225791189633287980ae2e4 100644\n--- a/test/support/harness.clj\n+++ b/test/support/harness.clj\n@@ -48,12 +48,15 @@\n          \"GITHUB_CLIENT_SECRET\" \"test-secret\"\n          \"GITHUB_OAUTH_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n          \"GITHUB_API_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n+         ;; Reddit import fixtures + Reddit OAuth on reddit-port.\n          \"REDDIT_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_CLIENT_ID\" \"test-reddit\"\n+         \"REDDIT_CLIENT_SECRET\" \"test-reddit-secret\"\n          \"REDDIT_OAUTH_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n-         \"REDDIT_CLIENT_ID\" \"\"\n-         \"REDDIT_CLIENT_SECRET\" \"\"\n-         \"REDDIT_APP_ID\" \"\"\n-         \"REDDIT_APP_SECRET\" \"\"}))\n+         \"REDDIT_OAUTH_AUTHORIZE_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_OAUTH_TOKEN_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_OAUTH_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+         \"REDDIT_USER_AGENT\" \"web:sorter2-test:v0 (by /u/test)\"}))\n \n (defn with-auth-servers\n   \"Start mock Reddit + mock OAuth + release sorter2-server.\ndiff --git a/test/support/mock_oauth.clj b/test/support/mock_oauth.clj\nindex 909d7a7be8b159ea54a122d69c46af3db3318118..5ba7e9be3cf6d2226648e9609a09ed45f306930f 100644\n--- a/test/support/mock_oauth.clj\n+++ b/test/support/mock_oauth.clj\n@@ -1,5 +1,5 @@\n (ns test.support.mock-oauth\n-  \"In-process HTTP stub for GitHub OAuth (authorize, token, /user).\"\n+  \"In-process HTTP stub for GitHub + Reddit OAuth (authorize, token, user).\"\n   (:require [clojure.string :as str])\n   (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n            [java.net InetSocketAddress URLDecoder]))\n@@ -12,11 +12,14 @@\n                 (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n           (str/split query #\"&\"))))\n \n-(defn- parse-mock-user [raw]\n+(defn- parse-mock-user\n+  \"GitHub-style `id:login` (numeric id). Reddit-style `t2_xxx:name`.\"\n+  [raw]\n   (let [s (or raw \"1002:newbie\")\n         [id login] (str/split s #\":\" 2)]\n-    {:id (Long/parseLong id)\n-     :login (or login \"newbie\")}))\n+    {:id id\n+     :login (or login \"newbie\")\n+     :numeric? (re-matches #\"\\d+\" id)}))\n \n (defn- send-json [^HttpExchange ex status body]\n   (let [bytes (.getBytes body \"UTF-8\")]\n@@ -31,9 +34,10 @@\n   (.sendResponseHeaders ex 302 -1)\n   (.close (.getResponseBody ex)))\n \n-(defn- read-form-code [^HttpExchange ex]\n+(defn- read-form [^HttpExchange ex]\n   (let [body (slurp (.getInputStream ex))]\n-    (query-param body \"code\")))\n+    {:code (query-param body \"code\")\n+     :grant (query-param body \"grant_type\")}))\n \n (defn- bearer-token [^HttpExchange ex]\n   (some-> (.getRequestHeaders ex)\n@@ -44,8 +48,18 @@\n   (when (str/starts-with? token \"mock:\")\n     (parse-mock-user (subs token 5))))\n \n+(defn- authorize-redirect [exchange query]\n+  (let [redirect-uri (query-param query \"redirect_uri\")\n+        state (query-param query \"state\")\n+        mock-user (query-param query \"mock_user\")\n+        user (parse-mock-user mock-user)\n+        code (str \"mock:\" (:id user) \":\" (:login user))\n+        loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+                 \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+    (send-redirect exchange loc)))\n+\n (defn start-mock-oauth\n-  \"Start mock GitHub OAuth on `port`. Returns a zero-arg `stop` function.\"\n+  \"Start mock GitHub + Reddit OAuth on `port`. Returns a zero-arg `stop` function.\"\n   [port]\n   (let [server (HttpServer/create (InetSocketAddress. \"127.0.0.1\" port) 0)\n         handler\n@@ -53,28 +67,45 @@\n           (handle [^HttpExchange exchange]\n             (let [uri (.getRequestURI exchange)\n                   path (.getPath uri)\n-                  query (.getQuery uri)]\n+                  query (.getQuery uri)\n+                  method (.getRequestMethod exchange)]\n               (cond\n+                ;; GitHub authorize\n                 (str/ends-with? path \"/login/oauth/authorize\")\n-                (let [redirect-uri (query-param query \"redirect_uri\")\n-                      state (query-param query \"state\")\n-                      mock-user (query-param query \"mock_user\")\n-                      user (parse-mock-user mock-user)\n-                      code (str \"mock:\" (:id user) \":\" (:login user))\n-                      loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n-                               \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n-                  (send-redirect exchange loc))\n+                (authorize-redirect exchange query)\n+\n+                ;; Reddit authorize\n+                (str/ends-with? path \"/api/v1/authorize\")\n+                (authorize-redirect exchange query)\n \n-                (str/ends-with? path \"/login/oauth/access_token\")\n-                (let [code (or (read-form-code exchange) \"mock:1002:newbie\")]\n+                ;; GitHub token\n+                (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n+                (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n                   (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n \n+                ;; Reddit token (client_credentials for import + authorization_code for login)\n+                (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+                (let [form (read-form exchange)\n+                      grant (or (:grant form) \"\")\n+                      code (or (:code form) \"mock:t2_test:redditor\")]\n+                  (if (= grant \"client_credentials\")\n+                    (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+                    (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+                ;; GitHub user\n                 (= path \"/user\")\n                 (let [token (bearer-token exchange)\n-                      user (or (parse-token-user token) {:id 1002 :login \"newbie\"})]\n+                      user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n                   (send-json exchange 200\n                              (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n \n+                ;; Reddit /api/v1/me\n+                (str/ends-with? path \"/api/v1/me\")\n+                (let [token (bearer-token exchange)\n+                      user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n+                  (send-json exchange 200\n+                             (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n                 :else\n                 (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))))]\n     (.createContext server \"/\" handler)\ndiff --git a/test/support/mock_reddit.clj b/test/support/mock_reddit.clj\nindex 5efa92db3e1f79b8f423a2f1adcbda959123c1ad..a630cf0938722193e9af88382d60e777ff371be4 100644\n--- a/test/support/mock_reddit.clj\n+++ b/test/support/mock_reddit.clj\n@@ -1,14 +1,56 @@\n (ns test.support.mock-reddit\n-  \"In-process HTTP stub for Reddit API fixtures (`test/fixtures/reddit/`).\"\n+  \"In-process HTTP stub for Reddit API fixtures + OAuth login endpoints.\"\n   (:require [clojure.java.io :as io]\n             [clojure.string :as str])\n   (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n-           [java.net InetSocketAddress]))\n+           [java.net InetSocketAddress URLDecoder]))\n \n (defn fixtures-dir\n   ([] (fixtures-dir (System/getProperty \"user.dir\")))\n   ([root] (str root \"/test/fixtures/reddit\")))\n \n+(defn- query-param [query key]\n+  (when query\n+    (some (fn [pair]\n+            (let [[k v] (str/split pair \"=\" 2)]\n+              (when (= k key)\n+                (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n+          (str/split query #\"&\"))))\n+\n+(defn- parse-mock-user [raw]\n+  (let [s (or raw \"t2_test:redditor\")\n+        [id login] (str/split s #\":\" 2)]\n+    {:id id :login (or login \"redditor\")}))\n+\n+(defn- send-bytes [^HttpExchange ex status ^bytes body content-type]\n+  (.set (.getResponseHeaders ex) \"Content-Type\" content-type)\n+  (.sendResponseHeaders ex status (alength body))\n+  (doto (.getResponseBody ex)\n+    (.write body)\n+    (.close)))\n+\n+(defn- send-json [^HttpExchange ex status body]\n+  (send-bytes ex status (.getBytes body \"UTF-8\") \"application/json\"))\n+\n+(defn- send-redirect [^HttpExchange ex location]\n+  (.set (.getResponseHeaders ex) \"Location\" location)\n+  (.sendResponseHeaders ex 302 -1)\n+  (.close (.getResponseBody ex)))\n+\n+(defn- read-form [^HttpExchange ex]\n+  (let [body (slurp (.getInputStream ex))]\n+    {:code (query-param body \"code\")\n+     :grant (query-param body \"grant_type\")}))\n+\n+(defn- bearer-token [^HttpExchange ex]\n+  (some-> (.getRequestHeaders ex)\n+          (.getFirst \"Authorization\")\n+          (str/replace #\"^[Bb]earer \" \"\")))\n+\n+(defn- parse-token-user [token]\n+  (when (str/starts-with? token \"mock:\")\n+    (parse-mock-user (subs token 5))))\n+\n (defn start-mock-reddit\n   \"Start a mock Reddit API on `port`. Returns a zero-arg `stop` function.\"\n   ([port] (start-mock-reddit port (fixtures-dir)))\n@@ -19,15 +61,38 @@\n          handler\n          (proxy [HttpHandler] []\n            (handle [^HttpExchange exchange]\n-             ;; `/r/<sub>/about.json` → subreddit entity; `/r/<sub>.json` → listing.\n-             (let [path (.getPath (.getRequestURI exchange))\n-                   body (if (str/includes? path \"/about\")\n-                          about\n-                          listing)]\n-               (.sendResponseHeaders exchange 200 (alength body))\n-               (let [out (.getResponseBody exchange)]\n-                 (.write out body)\n-                 (.close out)))))]\n+             (let [uri (.getRequestURI exchange)\n+                   path (.getPath uri)\n+                   query (.getQuery uri)\n+                   method (.getRequestMethod exchange)]\n+               (cond\n+                 (str/ends-with? path \"/api/v1/authorize\")\n+                 (let [redirect-uri (query-param query \"redirect_uri\")\n+                       state (query-param query \"state\")\n+                       user (parse-mock-user (query-param query \"mock_user\"))\n+                       code (str \"mock:\" (:id user) \":\" (:login user))\n+                       loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+                                \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+                   (send-redirect exchange loc))\n+\n+                 (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+                 (let [form (read-form exchange)\n+                       grant (or (:grant form) \"\")\n+                       code (or (:code form) \"mock:t2_test:redditor\")]\n+                   (if (= grant \"client_credentials\")\n+                     (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+                     (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+                 (str/ends-with? path \"/api/v1/me\")\n+                 (let [user (or (parse-token-user (bearer-token exchange))\n+                                {:id \"t2_test\" :login \"redditor\"})]\n+                   (send-json exchange 200\n+                              (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n+                 ;; `/r/<sub>/about.json` → subreddit entity; `/r/<sub>.json` → listing.\n+                 :else\n+                 (let [body (if (str/includes? path \"/about\") about listing)]\n+                   (send-bytes exchange 200 body \"application/json\"))))))]\n      (.createContext server \"/\" handler)\n      (.setExecutor server nil)\n      (.start server)\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[075d4d37] Fix OAuth test mocks so Clojure E2E auth flows work again.\n\nHttpServer handlers were crashing on query parsing and token POSTs, which broke Playwright login; also read alias/history via real CSS selectors.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/test/auth_login.clj b/test/auth_login.clj\nindex 6f2f00d7aa7340e63d1ac465b0a2234cec7a983f..aa63b66ccb2471b710ba3d168d0461252b39fc10 100644\n--- a/test/auth_login.clj\n+++ b/test/auth_login.clj\n@@ -14,27 +14,27 @@\n (defn- type-alias! [pg text]\n   (page/evaluate pg\n                  (.replace\n-                  \"(() => { const i = document.getElementById('alias-input'); const f = document.getElementById('alias-check-form'); if (!i || !f) return;\n+                  \"(() => { const i = document.getElementById('alias-input'); const f = document.getElementById('alias-check-form'); if (!i || !f) return Promise.resolve('missing-form');\n                     i.value = __TEXT__;\n                     const cf = document.getElementById('alias-claim-field'); if (cf) cf.value = i.value;\n                     return fetch(f.action, { method: 'POST', credentials: 'same-origin',\n                       headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n                       body: new URLSearchParams(new FormData(f)).toString() })\n                       .then(function (r) { return r.text(); })\n-                      .then(function (t) { eval(t); }); })()\"\n+                      .then(function (t) { eval(t); return document.getElementById('alias-status')?.textContent || ''; }); })()\"\n                   \"__TEXT__\"\n-                  (pr-str text)))\n-  (Thread/sleep 400))\n+                  (pr-str text))))\n \n-(defn- element-text [pg test-id]\n+(defn- element-text [pg selector]\n   (let [raw (page/evaluate pg\n-                           (str \"document.querySelector('[data-testid=\\\"\" test-id \"\\\"]')?.textContent || ''\"))]\n+                           (str \"document.querySelector(\" (pr-str selector) \")?.textContent || ''\"))]\n     (when (string? raw) (str/trim raw))))\n \n (defn- wait-for-text [pg test-id text timeout-ms]\n-  (let [deadline (+ (System/currentTimeMillis) timeout-ms)]\n+  (let [deadline (+ (System/currentTimeMillis) timeout-ms)\n+        selector (str \"[data-testid=\\\"\" test-id \"\\\"]\")]\n     (loop []\n-      (let [got (or (element-text pg test-id) \"\")]\n+      (let [got (or (element-text pg selector) \"\")]\n         (cond\n           (= got text) got\n           (< (System/currentTimeMillis) deadline) (do (Thread/sleep 200) (recur))\ndiff --git a/test/support/mock_oauth.clj b/test/support/mock_oauth.clj\nindex 5ba7e9be3cf6d2226648e9609a09ed45f306930f..333fe08d56cb06bac2a338cad1c73894d54c4495 100644\n--- a/test/support/mock_oauth.clj\n+++ b/test/support/mock_oauth.clj\n@@ -7,7 +7,7 @@\n (defn- query-param [query key]\n   (when query\n     (some (fn [pair]\n-            (let [[k v] (str/split pair \"=\" 2)]\n+            (let [[k v] (str/split pair #\"=\" 2)]\n               (when (= k key)\n                 (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n           (str/split query #\"&\"))))\n@@ -31,11 +31,11 @@\n \n (defn- send-redirect [^HttpExchange ex location]\n   (.set (.getResponseHeaders ex) \"Location\" location)\n-  (.sendResponseHeaders ex 302 -1)\n+  (.sendResponseHeaders ex 302 0)\n   (.close (.getResponseBody ex)))\n \n (defn- read-form [^HttpExchange ex]\n-  (let [body (slurp (.getInputStream ex))]\n+  (let [body (slurp (.getRequestBody ex))]\n     {:code (query-param body \"code\")\n      :grant (query-param body \"grant_type\")}))\n \n@@ -45,7 +45,7 @@\n           (str/replace #\"^[Bb]earer \" \"\")))\n \n (defn- parse-token-user [token]\n-  (when (str/starts-with? token \"mock:\")\n+  (when (and token (str/starts-with? token \"mock:\"))\n     (parse-mock-user (subs token 5))))\n \n (defn- authorize-redirect [exchange query]\n@@ -55,7 +55,7 @@\n         user (parse-mock-user mock-user)\n         code (str \"mock:\" (:id user) \":\" (:login user))\n         loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n-                 \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+                 \"&state=\" (java.net.URLEncoder/encode (or state \"\") \"UTF-8\"))]\n     (send-redirect exchange loc)))\n \n (defn start-mock-oauth\n@@ -65,49 +65,56 @@\n         handler\n         (proxy [HttpHandler] []\n           (handle [^HttpExchange exchange]\n-            (let [uri (.getRequestURI exchange)\n-                  path (.getPath uri)\n-                  query (.getQuery uri)\n-                  method (.getRequestMethod exchange)]\n-              (cond\n-                ;; GitHub authorize\n-                (str/ends-with? path \"/login/oauth/authorize\")\n-                (authorize-redirect exchange query)\n+            (try\n+              (let [uri (.getRequestURI exchange)\n+                    path (.getPath uri)\n+                    query (.getQuery uri)\n+                    method (.getRequestMethod exchange)]\n+                (cond\n+                  ;; GitHub authorize\n+                  (str/ends-with? path \"/login/oauth/authorize\")\n+                  (authorize-redirect exchange query)\n \n-                ;; Reddit authorize\n-                (str/ends-with? path \"/api/v1/authorize\")\n-                (authorize-redirect exchange query)\n+                  ;; Reddit authorize\n+                  (str/ends-with? path \"/api/v1/authorize\")\n+                  (authorize-redirect exchange query)\n \n-                ;; GitHub token\n-                (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n-                (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n-                  (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n+                  ;; GitHub token\n+                  (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n+                  (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n+                    (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n \n-                ;; Reddit token (client_credentials for import + authorization_code for login)\n-                (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n-                (let [form (read-form exchange)\n-                      grant (or (:grant form) \"\")\n-                      code (or (:code form) \"mock:t2_test:redditor\")]\n-                  (if (= grant \"client_credentials\")\n-                    (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n-                    (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+                  ;; Reddit token (client_credentials for import + authorization_code for login)\n+                  (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+                  (let [form (read-form exchange)\n+                        grant (or (:grant form) \"\")\n+                        code (or (:code form) \"mock:t2_test:redditor\")]\n+                    (if (= grant \"client_credentials\")\n+                      (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+                      (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n \n-                ;; GitHub user\n-                (= path \"/user\")\n-                (let [token (bearer-token exchange)\n-                      user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n-                  (send-json exchange 200\n-                             (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n+                  ;; GitHub user\n+                  (= path \"/user\")\n+                  (let [token (bearer-token exchange)\n+                        user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n+                    (send-json exchange 200\n+                               (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n \n-                ;; Reddit /api/v1/me\n-                (str/ends-with? path \"/api/v1/me\")\n-                (let [token (bearer-token exchange)\n-                      user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n-                  (send-json exchange 200\n-                             (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+                  ;; Reddit /api/v1/me\n+                  (str/ends-with? path \"/api/v1/me\")\n+                  (let [token (bearer-token exchange)\n+                        user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n+                    (send-json exchange 200\n+                               (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n \n-                :else\n-                (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))))]\n+                  :else\n+                  (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))\n+              (catch Throwable t\n+                (binding [*out* *err*]\n+                  (println \"mock-oauth handler error:\" t))\n+                (try\n+                  (send-json exchange 500 \"{\\\"error\\\":\\\"mock-oauth internal\\\"}\")\n+                  (catch Throwable _))))))]\n     (.createContext server \"/\" handler)\n     (.setExecutor server nil)\n     (.start server)\ndiff --git a/test/support/mock_reddit.clj b/test/support/mock_reddit.clj\nindex a630cf0938722193e9af88382d60e777ff371be4..faa27945b6394363914c853627a0bad1e819a5f9 100644\n--- a/test/support/mock_reddit.clj\n+++ b/test/support/mock_reddit.clj\n@@ -12,7 +12,7 @@\n (defn- query-param [query key]\n   (when query\n     (some (fn [pair]\n-            (let [[k v] (str/split pair \"=\" 2)]\n+            (let [[k v] (str/split pair #\"=\" 2)]\n               (when (= k key)\n                 (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n           (str/split query #\"&\"))))\n@@ -34,11 +34,11 @@\n \n (defn- send-redirect [^HttpExchange ex location]\n   (.set (.getResponseHeaders ex) \"Location\" location)\n-  (.sendResponseHeaders ex 302 -1)\n+  (.sendResponseHeaders ex 302 0)\n   (.close (.getResponseBody ex)))\n \n (defn- read-form [^HttpExchange ex]\n-  (let [body (slurp (.getInputStream ex))]\n+  (let [body (slurp (.getRequestBody ex))]\n     {:code (query-param body \"code\")\n      :grant (query-param body \"grant_type\")}))\n \n@@ -48,7 +48,7 @@\n           (str/replace #\"^[Bb]earer \" \"\")))\n \n (defn- parse-token-user [token]\n-  (when (str/starts-with? token \"mock:\")\n+  (when (and token (str/starts-with? token \"mock:\"))\n     (parse-mock-user (subs token 5))))\n \n (defn start-mock-reddit\n@@ -72,7 +72,7 @@\n                        user (parse-mock-user (query-param query \"mock_user\"))\n                        code (str \"mock:\" (:id user) \":\" (:login user))\n                        loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n-                                \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+                                \"&state=\" (java.net.URLEncoder/encode (or state \"\") \"UTF-8\"))]\n                    (send-redirect exchange loc))\n \n                  (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}