{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[5db58b98] Improve vote pair selection for spanning trees and rank refinement.\n\nPrefer attaching unranked items to established components before comparing\nisolates, then zip down adjacent rank-centrality pairs once the pool is fully\nconnected, skipping pairs that already have votes.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide A — unified diff (full patch):\ndiff --git a/server/src/pair.rs b/server/src/pair.rs\nindex 54b5d2417e9dba04ed8df422156e274c2b2f76b2..c14de4b0502c8b5a17cddf3746077739d56e03e0 100644\n--- a/server/src/pair.rs\n+++ b/server/src/pair.rs\n@@ -3,13 +3,21 @@\n //! Pair selection prefers **bridge** votes — comparisons between items in\n //! different connected components of the voted-pairs graph — so the pool\n //! merges into one ranking group before refining within it.\n+//!\n+//! Among unvoted bridges, prefer merging established voted components, then\n+//! attaching a never-voted child to an established component, and only then\n+//! comparing two never-voted children (so the voted graph grows as one tree).\n+//!\n+//! Once every pool child sits in one voted component, refinement **zips** down\n+//! the rank-centrality order: prefer 1 vs 2, then 2 vs 3, and so on, skipping\n+//! pairs that already have a vote.\n \n use rand::seq::SliceRandom;\n use std::collections::{HashMap, HashSet};\n \n use crate::{\n     path_types::ItemId,\n-    ranking::connected_components_from_voted_pairs,\n+    ranking::{connected_components_from_voted_pairs, ranked_items},\n     reducer::{GlobalTree, GroupState},\n };\n \n@@ -28,36 +36,77 @@ fn pair_is_voted(group: &GroupState, a: &ItemId, b: &ItemId) -> bool {\n     group.voted_pairs.contains(&(i, j))\n }\n \n-/// Component id per pool item: voted-pairs graph components plus one id per\n-/// never-voted child.\n-fn component_ids(group: &GroupState, pool: &[ItemId]) -> HashMap<ItemId, usize> {\n+/// Voted-pairs layout for pool items: component id per item plus which ids are\n+/// multi-node voted components (ranked groups in the UI).\n+struct ComponentLayout {\n+    ids: HashMap<ItemId, usize>,\n+    established: HashSet<usize>,\n+}\n+\n+fn component_layout(group: &GroupState, pool: &[ItemId]) -> ComponentLayout {\n     let n = group.idx_to_item.len();\n     let (comps, isolates) =\n         connected_components_from_voted_pairs(n, group.voted_pairs.iter().copied());\n \n-    let mut out: HashMap<ItemId, usize> = HashMap::new();\n+    let mut established = HashSet::new();\n+    let mut ids: HashMap<ItemId, usize> = HashMap::new();\n     for (comp_idx, comp) in comps.iter().enumerate() {\n+        if comp.len() >= 2 {\n+            established.insert(comp_idx);\n+        }\n         for &idx in comp {\n             if idx < n {\n-                out.insert(group.idx_to_item[idx].clone(), comp_idx);\n+                ids.insert(group.idx_to_item[idx].clone(), comp_idx);\n             }\n         }\n     }\n     let mut next = comps.len();\n     for &idx in &isolates {\n         if idx < n {\n-            out.insert(group.idx_to_item[idx].clone(), next);\n+            ids.insert(group.idx_to_item[idx].clone(), next);\n             next += 1;\n         }\n     }\n     for item in pool {\n-        out.entry(item.clone()).or_insert_with(|| {\n+        ids.entry(item.clone()).or_insert_with(|| {\n             let id = next;\n             next += 1;\n             id\n         });\n     }\n-    out\n+    ComponentLayout { ids, established }\n+}\n+\n+/// Every pool child shares one multi-node voted component (spanning tree phase done).\n+fn pool_fully_connected(layout: &ComponentLayout, pool: &[ItemId]) -> bool {\n+    if pool.len() < 2 {\n+        return false;\n+    }\n+    let mut comp_id = None;\n+    for item in pool {\n+        let Some(id) = layout.ids.get(item) else {\n+            return false;\n+        };\n+        if !layout.established.contains(id) {\n+            return false;\n+        }\n+        match comp_id {\n+            None => comp_id = Some(*id),\n+            Some(expected) if expected == *id => {}\n+            _ => return false,\n+        }\n+    }\n+    comp_id.is_some()\n+}\n+\n+/// Pool children that appear in `group`, sorted best rank first.\n+fn ranked_pool_order(group: &GroupState, pool: &[ItemId]) -> Vec<ItemId> {\n+    let pool_set: HashSet<_> = pool.iter().collect();\n+    ranked_items(group)\n+        .into_iter()\n+        .map(|r| r.item)\n+        .filter(|id| pool_set.contains(id))\n+        .collect()\n }\n \n #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]\n@@ -72,19 +121,108 @@ enum PairPriority {\n     WithinVoted = 3,\n }\n \n-fn pair_priority(\n+/// Tie-break among unvoted bridge pairs.\n+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]\n+enum BridgeSubPriority {\n+    /// Both endpoints lie in established (multi-node) voted components.\n+    MergeEstablished = 0,\n+    /// One established component member and one never-voted child.\n+    AttachIsolate = 1,\n+    /// Two never-voted children (separate singleton components).\n+    IsolatePair = 2,\n+}\n+\n+/// Tie-break among within-component pairs once the pool is one connected group.\n+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]\n+struct WithinSubPriority {\n+    /// 1 = adjacent ranks (i vs i+1); larger = farther apart in the order.\n+    rank_gap: usize,\n+    /// min rank index of the two — zip from the top (1 vs 2 before 2 vs 3).\n+    zip_index: usize,\n+}\n+\n+const WITHIN_SUB_WORST: WithinSubPriority = WithinSubPriority {\n+    rank_gap: usize::MAX,\n+    zip_index: usize::MAX,\n+};\n+\n+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]\n+struct PairSortKey {\n+    priority: PairPriority,\n+    bridge_sub: BridgeSubPriority,\n+    within_sub: WithinSubPriority,\n+}\n+\n+fn item_in_established(layout: &ComponentLayout, item: &ItemId) -> bool {\n+    layout\n+        .ids\n+        .get(item)\n+        .is_some_and(|id| layout.established.contains(id))\n+}\n+\n+fn bridge_sub_priority(layout: &ComponentLayout, a: &ItemId, b: &ItemId) -> BridgeSubPriority {\n+    let a_est = item_in_established(layout, a);\n+    let b_est = item_in_established(layout, b);\n+    match (a_est, b_est) {\n+        (true, true) => BridgeSubPriority::MergeEstablished,\n+        (true, false) | (false, true) => BridgeSubPriority::AttachIsolate,\n+        (false, false) => BridgeSubPriority::IsolatePair,\n+    }\n+}\n+\n+fn within_sub_priority(\n+    group: &GroupState,\n+    pool: &[ItemId],\n+    layout: &ComponentLayout,\n+    a: &ItemId,\n+    b: &ItemId,\n+) -> WithinSubPriority {\n+    if !pool_fully_connected(layout, pool) {\n+        return WITHIN_SUB_WORST;\n+    }\n+    let order = ranked_pool_order(group, pool);\n+    let (Some(i), Some(j)) = (order.iter().position(|x| x == a), order.iter().position(|x| x == b))\n+    else {\n+        return WITHIN_SUB_WORST;\n+    };\n+    WithinSubPriority {\n+        rank_gap: i.abs_diff(j),\n+        zip_index: i.min(j),\n+    }\n+}\n+\n+fn pair_sort_key(\n     group: &GroupState,\n-    components: &HashMap<ItemId, usize>,\n+    pool: &[ItemId],\n+    layout: &ComponentLayout,\n     a: &ItemId,\n     b: &ItemId,\n-) -> PairPriority {\n+) -> PairSortKey {\n     let voted = pair_is_voted(group, a, b);\n-    let bridge = components.get(a) != components.get(b);\n-    match (bridge, voted) {\n+    let bridge = layout.ids.get(a) != layout.ids.get(b);\n+    let priority = match (bridge, voted) {\n         (true, false) => PairPriority::BridgeUnvoted,\n         (false, false) => PairPriority::WithinUnvoted,\n         (true, true) => PairPriority::BridgeVoted,\n         (false, true) => PairPriority::WithinVoted,\n+    };\n+    let bridge_sub = if priority == PairPriority::BridgeUnvoted {\n+        bridge_sub_priority(layout, a, b)\n+    } else {\n+        BridgeSubPriority::MergeEstablished\n+    };\n+    let within_sub = if matches!(\n+        priority,\n+        PairPriority::WithinUnvoted | PairPriority::WithinVoted\n+    ) {\n+        within_sub_priority(group, pool, layout, a, b)\n+    } else {\n+        WITHIN_SUB_WORST\n+    };\n+    PairSortKey {\n+        priority,\n+        bridge_sub,\n+        within_sub,\n     }\n }\n \n@@ -109,9 +247,12 @@ fn candidate_pairs(pool: &[ItemId], exclude: Option<(&ItemId, &ItemId)>) -> Vec<\n \n /// Pick the next pair to vote on within `pool`.\n ///\n-/// 1. Prefer unvoted **bridge** pairs (connect separate ranking components).\n-/// 2. Then unvoted within-component pairs (refinement).\n-/// 3. Then already-voted pairs (re-compare).\n+/// 1. Prefer unvoted **bridge** pairs (connect separate ranking components),\n+///    with sub-priority: merge established components, attach an isolate to\n+///    established, then compare two isolates.\n+/// 2. Then unvoted within-component pairs; when the pool is one connected group,\n+///    prefer adjacent ranks (1 vs 2, 2 vs 3, …) in order, skipping voted pairs.\n+/// 3. Then already-voted pairs (re-compare), with the same zip ordering.\n pub fn suggest_next_pair_in_pool(\n     group: &GroupState,\n     pool: &[ItemId],\n@@ -121,15 +262,15 @@ pub fn suggest_next_pair_in_pool(\n     if candidates.is_empty() {\n         return None;\n     }\n-    let components = component_ids(group, pool);\n+    let layout = component_layout(group, pool);\n     let best = candidates\n         .iter()\n-        .map(|(a, b)| (pair_priority(group, &components, a, b), (a, b)))\n-        .min_by_key(|(p, _)| *p)?\n+        .map(|(a, b)| (pair_sort_key(group, pool, &layout, a, b), (a, b)))\n+        .min_by_key(|(k, _)| *k)?\n         .0;\n     let best_pairs: Vec<(ItemId, ItemId)> = candidates\n         .into_iter()\n-        .filter(|(a, b)| pair_priority(group, &components, a, b) == best)\n+        .filter(|(a, b)| pair_sort_key(group, pool, &layout, a, b) == best)\n         .collect();\n     best_pairs.choose(&mut rand::thread_rng()).cloned()\n }\n@@ -303,6 +444,38 @@ mod tests {\n         assert!(from_ab && from_cd, \"expected bridge pair, got {:?}\", chosen);\n     }\n \n+    #[test]\n+    fn suggest_prefers_attach_over_isolate_pair_among_many_unranked() {\n+        let parent = ItemId::parse(\"reddit.com/r/rust\").unwrap();\n+        let mut tree = seed_children(\n+            &parent,\n+            &[\n+                \"reddit.com/r/rust/a\",\n+                \"reddit.com/r/rust/b\",\n+                \"reddit.com/r/rust/c\",\n+                \"reddit.com/r/rust/d\",\n+                \"reddit.com/r/rust/e\",\n+            ],\n+        );\n+        let ab =\n+            VoteData::from_recorded(1, \"reddit.com/r/rust/a\", \"reddit.com/r/rust/b\", 2, 1).unwrap();\n+        tree.apply_vote(&parent, ab);\n+        let group = tree.get(&parent).unwrap().local_ranking.clone();\n+        let pool = children_of(&tree, &parent);\n+        let pair = suggest_next_pair_in_pool(&group, &pool, None).unwrap();\n+        let chosen = pair_set(&pair);\n+        let from_ab =\n+            chosen.contains(\"reddit.com/r/rust/a\") || chosen.contains(\"reddit.com/r/rust/b\");\n+        let from_cde = chosen.contains(\"reddit.com/r/rust/c\")\n+            || chosen.contains(\"reddit.com/r/rust/d\")\n+            || chosen.contains(\"reddit.com/r/rust/e\");\n+        assert!(\n+            from_ab && from_cde,\n+            \"expected ranked+unranked attach, got {:?}\",\n+            chosen\n+        );\n+    }\n+\n     #[test]\n     fn suggest_connects_isolate_to_existing_component() {\n         let parent = ItemId::parse(\"reddit.com/r/rust\").unwrap();\n@@ -325,6 +498,65 @@ mod tests {\n         assert!(chosen.contains(\"reddit.com/r/rust/a\") || chosen.contains(\"reddit.com/r/rust/b\"));\n     }\n \n+    #[test]\n+    fn suggest_zips_adjacent_ranks_when_tree_complete() {\n+        let parent = ItemId::parse(\"reddit.com/r/rust\").unwrap();\n+        let mut tree = seed_children(\n+            &parent,\n+            &[\n+                \"reddit.com/r/rust/a\",\n+                \"reddit.com/r/rust/b\",\n+                \"reddit.com/r/rust/c\",\n+            ],\n+        );\n+        // Star at a connects all three; b-c is the only unvoted adjacent pair left.\n+        for (a, b, l, r) in [\n+            (\"reddit.com/r/rust/a\", \"reddit.com/r/rust/b\", 3, 1),\n+            (\"reddit.com/r/rust/a\", \"reddit.com/r/rust/c\", 2, 1),\n+        ] {\n+            let v = VoteData::from_recorded(1, a, b, l, r).unwrap();\n+            tree.apply_vote(&parent, v);\n+        }\n+        let group = tree.get(&parent).unwrap().local_ranking.clone();\n+        let pool = children_of(&tree, &parent);\n+        let pair = suggest_next_pair_in_pool(&group, &pool, None).unwrap();\n+        let chosen = pair_set(&pair);\n+        // a-b and a-c voted; b-c is the only unvoted adjacent pair in rank order.\n+        assert!(chosen.contains(\"reddit.com/r/rust/b\"));\n+        assert!(chosen.contains(\"reddit.com/r/rust/c\"));\n+    }\n+\n+    #[test]\n+    fn suggest_zip_prefers_1v2_before_2v3_when_both_unvoted() {\n+        let parent = ItemId::parse(\"reddit.com/r/rust\").unwrap();\n+        let mut tree = seed_children(\n+            &parent,\n+            &[\n+                \"reddit.com/r/rust/a\",\n+                \"reddit.com/r/rust/b\",\n+                \"reddit.com/r/rust/c\",\n+                \"reddit.com/r/rust/d\",\n+            ],\n+        );\n+        // Hub at c connects all four; leave rank-adjacent a-b and b-c unvoted.\n+        for (a, b, l, r) in [\n+            (\"reddit.com/r/rust/c\", \"reddit.com/r/rust/d\", 3, 1),\n+            (\"reddit.com/r/rust/b\", \"reddit.com/r/rust/c\", 2, 1),\n+            (\"reddit.com/r/rust/a\", \"reddit.com/r/rust/c\", 2, 1),\n+        ] {\n+            let v = VoteData::from_recorded(1, a, b, l, r).unwrap();\n+            tree.apply_vote(&parent, v);\n+        }\n+        let group = tree.get(&parent).unwrap().local_ranking.clone();\n+        let pool = children_of(&tree, &parent);\n+        assert!(pool_fully_connected(&component_layout(&group, &pool), &pool));\n+        let pair = suggest_next_pair_in_pool(&group, &pool, None).unwrap();\n+        let chosen = pair_set(&pair);\n+        // Top adjacent unvoted edge should be a-b (zip index 0), not b-c (index 1).\n+        assert!(chosen.contains(\"reddit.com/r/rust/a\"));\n+        assert!(chosen.contains(\"reddit.com/r/rust/b\"));\n+    }\n+\n     #[test]\n     fn resolve_pair_picks_from_pool() {\n         let parent = ItemId::parse(\"reddit.com/r/rust\").unwrap();\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[c94456ff] Make feed catch-up stable and permission-aware\n\nAnchor implicit feeds to durable ingest order and cover multi-user private-room visibility so concurrent posts are not missed or leaked.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/cli/src/main.rs b/cli/src/main.rs\nindex abb5a55b49f60fe28fbfd4ec02715cb94ea0b4ec..c4f1494df3aedbd8b883aea6249579aa8336abfe 100644\n--- a/cli/src/main.rs\n+++ b/cli/src/main.rs\n@@ -878,6 +878,30 @@ mod tests {\n             \"graph: 4 items, 3/6 pairs (50.0% density), 1 component, connected\"\n         );\n     }\n+\n+    #[test]\n+    fn feed_without_since_uses_logged_in_delegate_from_env() {\n+        let key = \"SLUG_DELEGATE\";\n+        let previous = std::env::var_os(key);\n+        let expected = \"00000000-0000-0000-0000-0000000000ee:test:local/model\";\n+        std::env::set_var(key, expected);\n+\n+        let cli = Cli::try_parse_from([\"slugsocial\", \"feed\"]).expect(\"parse feed\");\n+\n+        match previous {\n+            Some(value) => std::env::set_var(key, value),\n+            None => std::env::remove_var(key),\n+        }\n+        match cli.cmd {\n+            Some(Command::Feed {\n+                delegate, since, ..\n+            }) => {\n+                assert_eq!(delegate.as_deref(), Some(expected));\n+                assert!(since.is_none());\n+            }\n+            _ => panic!(\"expected feed command\"),\n+        }\n+    }\n }\n \n async fn run_scoped(base: &str, room: &str, sub: ScopedCmd) -> Result<()> {\n@@ -1626,7 +1650,15 @@ async fn run() -> Result<()> {\n                 } else {\n                     for p in &resp.posts {\n                         let ago = slug_types::timeago::timeago(now_ms, p.ts);\n-                        println!(\"<post id=\\\"{}\\\" ts=\\\"{}\\\">\", p.id, ago);\n+                        let thread_attr = p\n+                            .thread\n+                            .as_deref()\n+                            .map(|thread| format!(\" thread=\\\"{thread}\\\"\"))\n+                            .unwrap_or_default();\n+                        println!(\n+                            \"<post id=\\\"{}\\\" ts=\\\"{}\\\" room=\\\"{}\\\"{}>\",\n+                            p.id, ago, p.room, thread_attr\n+                        );\n                         print!(\"{}\", p.body);\n                         if !p.body.ends_with('\\n') { println!(); }\n                         println!(\"</post>\");\ndiff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs\nindex afc4f95bef160c1e38ecff2c096d6440cd94e2b3..46d748f918d9b225acc4ecedfe5a1793089407b5 100644\n--- a/server/src/api/rpc.rs\n+++ b/server/src/api/rpc.rs\n@@ -72,6 +72,80 @@ fn can_view_scope(reduced: &ReducerState, scope: &ScopeId, principal: Option<&st\n     }\n }\n \n+/// Build a feed in durable ingest order.\n+///\n+/// An implicit feed boundary is an ingest position, not only its millisecond timestamp. Two users\n+/// can post in the same millisecond, and wall-clock timestamps can move backwards during replay.\n+/// Explicit `since` remains a timestamp query for API compatibility, but scans the whole ordered\n+/// ledger rather than assuming timestamps are monotonic.\n+fn rpc_feed(\n+    reduced: &ReducerState,\n+    viewer: &str,\n+    delegate: Option<String>,\n+    requested_since: Option<i64>,\n+    implicit_anchor: Option<(usize, i64)>,\n+    limit: usize,\n+) -> FeedResponse {\n+    let since = requested_since.or_else(|| implicit_anchor.map(|(_, ts)| ts));\n+    let implicit_anchor_index = requested_since\n+        .is_none()\n+        .then(|| implicit_anchor.map(|(index, _)| index))\n+        .flatten();\n+\n+    let matching: Vec<&str> = reduced\n+        .ingests_ordered\n+        .iter()\n+        .enumerate()\n+        .rev()\n+        .filter(|(index, id)| {\n+            reduced.ingests_by_id.get(id.as_str()).is_some_and(|ing| {\n+                match requested_since {\n+                    Some(cutoff) => ing.ts > cutoff,\n+                    None => implicit_anchor_index.is_none_or(|anchor| *index > anchor),\n+                }\n+            })\n+        })\n+        .map(|(_, id)| id.as_str())\n+        .filter(|id| {\n+            reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n+                let scope = scope_from_room_wire(&ing.room_id);\n+                can_view_scope(reduced, &scope, Some(viewer))\n+            })\n+        })\n+        .filter(|id| !reduced.redacted_posts.contains(*id))\n+        .collect();\n+\n+    let total = matching.len();\n+    let posts = matching\n+        .into_iter()\n+        .take(limit)\n+        .filter_map(|id| reduced.ingests_by_id.get(id))\n+        .map(|ing| {\n+            let scope = scope_from_room_wire(&ing.room_id);\n+            let thread_post_index = reduced.try_thread_post_index_chronological(\n+                &scope,\n+                &ing.thread_tag,\n+                &ing.id,\n+            );\n+            FeedPost {\n+                ts: ing.ts,\n+                id: ing.id.clone(),\n+                room: ing.room_id.clone(),\n+                thread: Some(ing.thread_tag.clone()),\n+                thread_post_index,\n+                body: ing.raw.clone(),\n+            }\n+        })\n+        .collect();\n+\n+    FeedResponse {\n+        delegate,\n+        since,\n+        posts,\n+        total,\n+    }\n+}\n+\n fn principal_from_optional_bearer(headers: &HeaderMap, reduced: &ReducerState) -> Result<Option<String>, RpcErr> {\n     if headers.contains_key(axum::http::header::AUTHORIZATION) {\n         verify_bearer_principal(headers, reduced)\n@@ -1506,60 +1580,27 @@ pub async fn handle_rpc_batch(\n                                         Some(\"this delegate is not bound to your signed-in account\".into()),\n                                     )\n                                 } else {\n-                                    let since_default = reduced\n+                                    let implicit_anchor = reduced\n                                         .ingests_ordered\n                                         .iter()\n+                                        .enumerate()\n                                         .rev()\n-                                        .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                        .find(|ing| {\n-                                            if ing.delegate.as_deref() != Some(delegate_stored.as_str()) {\n-                                                return false;\n-                                            }\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n-                                        })\n-                                        .map(|ing| ing.ts);\n-                                    let since = since.or(since_default);\n-                                    let cutoff = since.unwrap_or(0);\n-                                    let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n-                                    let matching: Vec<&str> = reduced.ingests_ordered.iter().rev()\n-                                        .map(|id| id.as_str())\n-                                        .take_while(|id| reduced.ingests_by_id.get(*id).is_some_and(|ing| ing.ts > cutoff))\n-                                        .filter(|id| {\n-                                            reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n-                                                let scope = scope_from_room_wire(&ing.room_id);\n-                                                can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n+                                        .find_map(|(index, id)| {\n+                                            reduced.ingests_by_id.get(id).and_then(|ing| {\n+                                                (ing.delegate.as_deref()\n+                                                    == Some(delegate_stored.as_str()))\n+                                                .then_some((index, ing.ts))\n                                             })\n-                                        })\n-                                        .filter(|id| !reduced.redacted_posts.contains(*id))\n-                                        .collect();\n-                                    let total = matching.len();\n-                                    let posts: Vec<FeedPost> = matching.into_iter()\n-                                        .take(limit)\n-                                        .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                        .map(|ing| {\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            let thread_post_index = reduced\n-                                                .try_thread_post_index_chronological(\n-                                                    &scope,\n-                                                    &ing.thread_tag,\n-                                                    &ing.id,\n-                                                );\n-                                            FeedPost {\n-                                                ts: ing.ts,\n-                                                id: ing.id.clone(),\n-                                                thread: Some(ing.thread_tag.clone()),\n-                                                thread_post_index,\n-                                                body: ing.raw.clone(),\n-                                            }\n-                                        })\n-                                        .collect();\n-                                    line_ok(RpcResult::Feed(FeedResponse {\n-                                        delegate: Some(delegate_stored),\n+                                        });\n+                                    let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n+                                    line_ok(RpcResult::Feed(rpc_feed(\n+                                        &reduced,\n+                                        &viewer,\n+                                        Some(delegate_stored),\n                                         since,\n-                                        posts,\n-                                        total,\n-                                    }))\n+                                        implicit_anchor,\n+                                        limit,\n+                                    )))\n                                 };\n                                 drop(reduced);\n                                 line\n@@ -1567,60 +1608,25 @@ pub async fn handle_rpc_batch(\n                             None => {\n                                 // Session catch-up: last time *you* posted anything (delegate or not), so revisiting\n                                 // an old chat with only a token still gets a sane cutoff.\n-                                let since_default = reduced\n+                                let implicit_anchor = reduced\n                                     .ingests_ordered\n                                     .iter()\n+                                    .enumerate()\n                                     .rev()\n-                                    .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                    .find(|ing| {\n-                                        if ing.principal != viewer {\n-                                            return false;\n-                                        }\n-                                        let scope = scope_from_room_wire(&ing.room_id);\n-                                        can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n-                                    })\n-                                    .map(|ing| ing.ts);\n-                                let since = since.or(since_default);\n-                                let cutoff = since.unwrap_or(0);\n-                                let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n-                                let matching: Vec<&str> = reduced.ingests_ordered.iter().rev()\n-                                    .map(|id| id.as_str())\n-                                    .take_while(|id| reduced.ingests_by_id.get(*id).is_some_and(|ing| ing.ts > cutoff))\n-                                    .filter(|id| {\n-                                        reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n+                                    .find_map(|(index, id)| {\n+                                        reduced.ingests_by_id.get(id).and_then(|ing| {\n+                                            (ing.principal == viewer).then_some((index, ing.ts))\n                                         })\n-                                    })\n-                                    .filter(|id| !reduced.redacted_posts.contains(*id))\n-                                    .collect();\n-                                let total = matching.len();\n-                                let posts: Vec<FeedPost> = matching.into_iter()\n-                                    .take(limit)\n-                                    .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                    .map(|ing| {\n-                                        let scope = scope_from_room_wire(&ing.room_id);\n-                                        let thread_post_index = reduced\n-                                            .try_thread_post_index_chronological(\n-                                                &scope,\n-                                                &ing.thread_tag,\n-                                                &ing.id,\n-                                            );\n-                                        FeedPost {\n-                                            ts: ing.ts,\n-                                            id: ing.id.clone(),\n-                                            thread: Some(ing.thread_tag.clone()),\n-                                            thread_post_index,\n-                                            body: ing.raw.clone(),\n-                                        }\n-                                    })\n-                                    .collect();\n-                                let line = line_ok(RpcResult::Feed(FeedResponse {\n-                                    delegate: None,\n+                                    });\n+                                let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n+                                let line = line_ok(RpcResult::Feed(rpc_feed(\n+                                    &reduced,\n+                                    &viewer,\n+                                    None,\n                                     since,\n-                                    posts,\n-                                    total,\n-                                }));\n+                                    implicit_anchor,\n+                                    limit,\n+                                )));\n                                 drop(reduced);\n                                 line\n                             }\ndiff --git a/server/tests/integration_rooms.rs b/server/tests/integration_rooms.rs\nindex a3b378267e090a016a7e663f103a0dd9f482690b..e623523ba352ce456674a399542c689505760b78 100644\n--- a/server/tests/integration_rooms.rs\n+++ b/server/tests/integration_rooms.rs\n@@ -1,6 +1,9 @@\n mod support;\n \n use slug_types::room_route_segment;\n+use slugsocial_server::events::{\n+    AgentBound, Event, GrantAdded, GrantRevoked, Ingest, RoomCreated, ThreadCapability,\n+};\n use support::*;\n \n #[tokio::test]\n@@ -473,6 +476,247 @@ async fn test_feed_without_delegate_uses_principal_last_post_including_delegate(\n     );\n }\n \n+#[tokio::test]\n+async fn test_feed_uses_delegate_ingest_position_when_multi_user_timestamps_collide() {\n+    let (addr, _tmp, _log, state, _handle) = create_test_server_with_state().await;\n+    seed_test_identity(&state, \"bob\", \"bobtok\", \"bobsecret\").await;\n+    let client = reqwest::Client::new();\n+    let alice_delegate =\n+        \"00000000-0000-0000-0000-0000000000c1:feedtest:local/alice-model\";\n+    let bob_delegate =\n+        \"00000000-0000-0000-0000-0000000000c2:feedtest:local/bob-model\";\n+\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        for (agent, username) in [\n+            (alice_delegate, \"testuser\"),\n+            (bob_delegate, \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::AgentBound(AgentBound {\n+                ts: 1,\n+                agent: agent.to_string(),\n+                username: username.to_string(),\n+            }));\n+        }\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 100,\n+            id: \"alice-anchor\".into(),\n+            raw: \"alice anchor\".into(),\n+            principal: \"testuser\".into(),\n+            delegate: Some(alice_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 100,\n+            id: \"bob-same-millisecond\".into(),\n+            raw: \"bob same-millisecond change\".into(),\n+            principal: \"bob\".into(),\n+            delegate: Some(bob_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+        // Event-log order remains authoritative even if the wall clock moves backwards.\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 99,\n+            id: \"bob-clock-rollback\".into(),\n+            raw: \"bob change after clock rollback\".into(),\n+            principal: \"bob\".into(),\n+            delegate: Some(bob_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+    }\n+\n+    let feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let posts = feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap();\n+    let ids: Vec<&str> = posts.iter().filter_map(|p| p[\"id\"].as_str()).collect();\n+    assert_eq!(\n+        ids,\n+        [\"bob-clock-rollback\", \"bob-same-millisecond\"],\n+        \"implicit feed cutoff must use append position, not timestamp\"\n+    );\n+}\n+\n+#[tokio::test]\n+async fn test_feed_multi_user_private_room_visibility_and_revoked_anchor_access() {\n+    let (addr, _tmp, _log, state, _handle) = create_test_server_with_state().await;\n+    seed_test_identity(&state, \"bob\", \"bobtok\", \"bobsecret\").await;\n+    seed_test_identity(&state, \"carol\", \"caroltok\", \"carolsecret\").await;\n+    let client = reqwest::Client::new();\n+    let alice_delegate =\n+        \"00000000-0000-0000-0000-0000000000d1:feedtest:local/alice-model\";\n+    let bob_delegate =\n+        \"00000000-0000-0000-0000-0000000000d2:feedtest:local/bob-model\";\n+    let room_alice = \"alice01/alice-room\";\n+    let room_bob = \"bob0001/bob-room\";\n+\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        for (agent, username) in [\n+            (alice_delegate, \"testuser\"),\n+            (bob_delegate, \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::AgentBound(AgentBound {\n+                ts: 1,\n+                agent: agent.to_string(),\n+                username: username.to_string(),\n+            }));\n+        }\n+        for (room_id, slug, owner) in [\n+            (room_alice, \"alice-room\", \"testuser\"),\n+            (room_bob, \"bob-room\", \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::RoomCreated(RoomCreated {\n+                ts: 2,\n+                room_id: room_id.to_string(),\n+                slug: slug.to_string(),\n+                owner: owner.to_string(),\n+            }));\n+            reduced.apply_event(Event::GrantAdded(GrantAdded {\n+                ts: 2,\n+                room_id: room_id.to_string(),\n+                username: owner.to_string(),\n+                capabilities: vec![ThreadCapability::View],\n+                granted_by: owner.to_string(),\n+            }));\n+        }\n+\n+        let mut add_ingest =\n+            |ts, id: &str, raw: &str, principal: &str, delegate: Option<&str>, room: &str| {\n+                reduced.apply_event(Event::Ingest(Ingest {\n+                    ts,\n+                    id: id.into(),\n+                    raw: raw.into(),\n+                    principal: principal.into(),\n+                    delegate: delegate.map(str::to_string),\n+                    room_id: room.into(),\n+                    thread_tag: \"feed-permissions\".into(),\n+                }));\n+            };\n+        add_ingest(10, \"prehistory\", \"must remain before alice anchor\", \"carol\", None, \"public\");\n+        add_ingest(\n+            11,\n+            \"alice-private-anchor\",\n+            \"alice last posted here\",\n+            \"testuser\",\n+            Some(alice_delegate),\n+            room_alice,\n+        );\n+        add_ingest(\n+            12,\n+            \"bob-public-anchor\",\n+            \"bob last posted here\",\n+            \"bob\",\n+            Some(bob_delegate),\n+            \"public\",\n+        );\n+        add_ingest(13, \"alice-room-change\", \"visible only to alice\", \"carol\", None, room_alice);\n+        add_ingest(14, \"bob-room-change\", \"visible only to bob\", \"carol\", None, room_bob);\n+        add_ingest(15, \"public-change\", \"visible to everyone\", \"carol\", None, \"public\");\n+\n+        reduced.apply_event(Event::GrantRevoked(GrantRevoked {\n+            ts: 16,\n+            room_id: room_alice.into(),\n+            username: \"testuser\".into(),\n+            capabilities: vec![ThreadCapability::View],\n+            revoked_by: \"testuser\".into(),\n+        }));\n+    }\n+\n+    let alice_feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let alice_posts = alice_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap();\n+    let alice_ids: Vec<&str> = alice_posts\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(\n+        alice_ids,\n+        [\"public-change\", \"bob-public-anchor\"],\n+        \"revoked private content must be hidden without moving the delegate anchor backwards\"\n+    );\n+    assert!(!alice_ids.contains(&\"prehistory\"));\n+    assert!(\n+        alice_posts\n+            .iter()\n+            .all(|post| post[\"room\"].as_str() == Some(\"public\")),\n+        \"private posts must not leak and every feed post must identify its room\"\n+    );\n+\n+    let bob_bearer = test_bearer_for(\"bobtok\", \"bobsecret\");\n+    let bob_feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&bob_bearer),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": bob_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let bob_ids: Vec<&str> = bob_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap()\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(bob_ids, [\"public-change\", \"bob-room-change\"]);\n+    assert_eq!(\n+        bob_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"][1][\"room\"],\n+        room_bob\n+    );\n+\n+    // Restoring View exposes only changes after the same stable delegate anchor.\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        reduced.apply_event(Event::GrantAdded(GrantAdded {\n+            ts: 17,\n+            room_id: room_alice.into(),\n+            username: \"testuser\".into(),\n+            capabilities: vec![ThreadCapability::View],\n+            granted_by: \"testuser\".into(),\n+        }));\n+    }\n+    let restored = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let restored_ids: Vec<&str> = restored[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap()\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(\n+        restored_ids,\n+        [\"public-change\", \"alice-room-change\", \"bob-public-anchor\"]\n+    );\n+}\n+\n #[tokio::test]\n async fn test_private_room_thread_urls_use_t_segment() {\n     let (addr, _tmp, _log, _handle) = create_test_server().await;\ndiff --git a/server/tests/support/mod.rs b/server/tests/support/mod.rs\nindex 4a620eaa875e7a1145f2a4e82cc4ff2be21d5345..a4320e991763617c1a760efad4b621977e2b74d0 100644\n--- a/server/tests/support/mod.rs\n+++ b/server/tests/support/mod.rs\n@@ -20,8 +20,10 @@ pub fn sha256_hex(s: &str) -> String {\n \n /// Fixed bearer for integration tests (`TokenIssued` seeded into reducer in `create_test_server`).\n pub fn test_bearer() -> String {\n-    let token_id = \"testtok\";\n-    let secret = \"secret\";\n+    test_bearer_for(\"testtok\", \"secret\")\n+}\n+\n+pub fn test_bearer_for(token_id: &str, secret: &str) -> String {\n     format!(\"slug_{token_id}_{secret}\")\n }\n \n@@ -71,19 +73,27 @@ pub async fn rpc_batch(\n }\n \n pub async fn seed_test_token(state: &AppState) {\n+    seed_test_identity(state, \"testuser\", \"testtok\", \"secret\").await;\n+}\n+\n+/// Add a distinct principal and bearer to a running integration-test server.\n+pub async fn seed_test_identity(\n+    state: &AppState,\n+    username: &str,\n+    token_id: &str,\n+    secret: &str,\n+) {\n     let registered = Event::UserRegistered(UserRegistered {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         provider: \"test\".to_string(),\n-        provider_id: \"testuser\".to_string(),\n+        provider_id: username.to_string(),\n     });\n-    let token_id = \"testtok\";\n-    let secret = \"secret\";\n     let salt = \"salt\";\n     let token_hash = sha256_hex(&format!(\"{salt}:{secret}\"));\n     let ev = Event::TokenIssued(TokenIssued {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         token_id: token_id.to_string(),\n         token_hash,\n         salt: salt.to_string(),\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex 211493935d19582607f5c87fb492faf47bdc6f53..cd6f94c60a4e1c3bfbce13bc0404b803f5f57c6d 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -264,6 +264,9 @@ pub struct FeedResponse {\n pub struct FeedPost {\n     pub ts: i64,\n     pub id: String,\n+    /// Permission scope containing the post: `\"public\"` or a private room id.\n+    #[serde(default)]\n+    pub room: String,\n     /// Primary thread tag (without #), if the ingest declared one.\n     #[serde(skip_serializing_if = \"Option::is_none\")]\n     pub thread: Option<String>,\n","role":"user"}],"model":"~x-ai/grok-latest"}