{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[c94456ff] Make feed catch-up stable and permission-aware\n\nAnchor implicit feeds to durable ingest order and cover multi-user private-room visibility so concurrent posts are not missed or leaked.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide A — unified diff (full patch):\ndiff --git a/cli/src/main.rs b/cli/src/main.rs\nindex abb5a55b49f60fe28fbfd4ec02715cb94ea0b4ec..c4f1494df3aedbd8b883aea6249579aa8336abfe 100644\n--- a/cli/src/main.rs\n+++ b/cli/src/main.rs\n@@ -878,6 +878,30 @@ mod tests {\n             \"graph: 4 items, 3/6 pairs (50.0% density), 1 component, connected\"\n         );\n     }\n+\n+    #[test]\n+    fn feed_without_since_uses_logged_in_delegate_from_env() {\n+        let key = \"SLUG_DELEGATE\";\n+        let previous = std::env::var_os(key);\n+        let expected = \"00000000-0000-0000-0000-0000000000ee:test:local/model\";\n+        std::env::set_var(key, expected);\n+\n+        let cli = Cli::try_parse_from([\"slugsocial\", \"feed\"]).expect(\"parse feed\");\n+\n+        match previous {\n+            Some(value) => std::env::set_var(key, value),\n+            None => std::env::remove_var(key),\n+        }\n+        match cli.cmd {\n+            Some(Command::Feed {\n+                delegate, since, ..\n+            }) => {\n+                assert_eq!(delegate.as_deref(), Some(expected));\n+                assert!(since.is_none());\n+            }\n+            _ => panic!(\"expected feed command\"),\n+        }\n+    }\n }\n \n async fn run_scoped(base: &str, room: &str, sub: ScopedCmd) -> Result<()> {\n@@ -1626,7 +1650,15 @@ async fn run() -> Result<()> {\n                 } else {\n                     for p in &resp.posts {\n                         let ago = slug_types::timeago::timeago(now_ms, p.ts);\n-                        println!(\"<post id=\\\"{}\\\" ts=\\\"{}\\\">\", p.id, ago);\n+                        let thread_attr = p\n+                            .thread\n+                            .as_deref()\n+                            .map(|thread| format!(\" thread=\\\"{thread}\\\"\"))\n+                            .unwrap_or_default();\n+                        println!(\n+                            \"<post id=\\\"{}\\\" ts=\\\"{}\\\" room=\\\"{}\\\"{}>\",\n+                            p.id, ago, p.room, thread_attr\n+                        );\n                         print!(\"{}\", p.body);\n                         if !p.body.ends_with('\\n') { println!(); }\n                         println!(\"</post>\");\ndiff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs\nindex afc4f95bef160c1e38ecff2c096d6440cd94e2b3..46d748f918d9b225acc4ecedfe5a1793089407b5 100644\n--- a/server/src/api/rpc.rs\n+++ b/server/src/api/rpc.rs\n@@ -72,6 +72,80 @@ fn can_view_scope(reduced: &ReducerState, scope: &ScopeId, principal: Option<&st\n     }\n }\n \n+/// Build a feed in durable ingest order.\n+///\n+/// An implicit feed boundary is an ingest position, not only its millisecond timestamp. Two users\n+/// can post in the same millisecond, and wall-clock timestamps can move backwards during replay.\n+/// Explicit `since` remains a timestamp query for API compatibility, but scans the whole ordered\n+/// ledger rather than assuming timestamps are monotonic.\n+fn rpc_feed(\n+    reduced: &ReducerState,\n+    viewer: &str,\n+    delegate: Option<String>,\n+    requested_since: Option<i64>,\n+    implicit_anchor: Option<(usize, i64)>,\n+    limit: usize,\n+) -> FeedResponse {\n+    let since = requested_since.or_else(|| implicit_anchor.map(|(_, ts)| ts));\n+    let implicit_anchor_index = requested_since\n+        .is_none()\n+        .then(|| implicit_anchor.map(|(index, _)| index))\n+        .flatten();\n+\n+    let matching: Vec<&str> = reduced\n+        .ingests_ordered\n+        .iter()\n+        .enumerate()\n+        .rev()\n+        .filter(|(index, id)| {\n+            reduced.ingests_by_id.get(id.as_str()).is_some_and(|ing| {\n+                match requested_since {\n+                    Some(cutoff) => ing.ts > cutoff,\n+                    None => implicit_anchor_index.is_none_or(|anchor| *index > anchor),\n+                }\n+            })\n+        })\n+        .map(|(_, id)| id.as_str())\n+        .filter(|id| {\n+            reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n+                let scope = scope_from_room_wire(&ing.room_id);\n+                can_view_scope(reduced, &scope, Some(viewer))\n+            })\n+        })\n+        .filter(|id| !reduced.redacted_posts.contains(*id))\n+        .collect();\n+\n+    let total = matching.len();\n+    let posts = matching\n+        .into_iter()\n+        .take(limit)\n+        .filter_map(|id| reduced.ingests_by_id.get(id))\n+        .map(|ing| {\n+            let scope = scope_from_room_wire(&ing.room_id);\n+            let thread_post_index = reduced.try_thread_post_index_chronological(\n+                &scope,\n+                &ing.thread_tag,\n+                &ing.id,\n+            );\n+            FeedPost {\n+                ts: ing.ts,\n+                id: ing.id.clone(),\n+                room: ing.room_id.clone(),\n+                thread: Some(ing.thread_tag.clone()),\n+                thread_post_index,\n+                body: ing.raw.clone(),\n+            }\n+        })\n+        .collect();\n+\n+    FeedResponse {\n+        delegate,\n+        since,\n+        posts,\n+        total,\n+    }\n+}\n+\n fn principal_from_optional_bearer(headers: &HeaderMap, reduced: &ReducerState) -> Result<Option<String>, RpcErr> {\n     if headers.contains_key(axum::http::header::AUTHORIZATION) {\n         verify_bearer_principal(headers, reduced)\n@@ -1506,60 +1580,27 @@ pub async fn handle_rpc_batch(\n                                         Some(\"this delegate is not bound to your signed-in account\".into()),\n                                     )\n                                 } else {\n-                                    let since_default = reduced\n+                                    let implicit_anchor = reduced\n                                         .ingests_ordered\n                                         .iter()\n+                                        .enumerate()\n                                         .rev()\n-                                        .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                        .find(|ing| {\n-                                            if ing.delegate.as_deref() != Some(delegate_stored.as_str()) {\n-                                                return false;\n-                                            }\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n-                                        })\n-                                        .map(|ing| ing.ts);\n-                                    let since = since.or(since_default);\n-                                    let cutoff = since.unwrap_or(0);\n-                                    let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n-                                    let matching: Vec<&str> = reduced.ingests_ordered.iter().rev()\n-                                        .map(|id| id.as_str())\n-                                        .take_while(|id| reduced.ingests_by_id.get(*id).is_some_and(|ing| ing.ts > cutoff))\n-                                        .filter(|id| {\n-                                            reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n-                                                let scope = scope_from_room_wire(&ing.room_id);\n-                                                can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n+                                        .find_map(|(index, id)| {\n+                                            reduced.ingests_by_id.get(id).and_then(|ing| {\n+                                                (ing.delegate.as_deref()\n+                                                    == Some(delegate_stored.as_str()))\n+                                                .then_some((index, ing.ts))\n                                             })\n-                                        })\n-                                        .filter(|id| !reduced.redacted_posts.contains(*id))\n-                                        .collect();\n-                                    let total = matching.len();\n-                                    let posts: Vec<FeedPost> = matching.into_iter()\n-                                        .take(limit)\n-                                        .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                        .map(|ing| {\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            let thread_post_index = reduced\n-                                                .try_thread_post_index_chronological(\n-                                                    &scope,\n-                                                    &ing.thread_tag,\n-                                                    &ing.id,\n-                                                );\n-                                            FeedPost {\n-                                                ts: ing.ts,\n-                                                id: ing.id.clone(),\n-                                                thread: Some(ing.thread_tag.clone()),\n-                                                thread_post_index,\n-                                                body: ing.raw.clone(),\n-                                            }\n-                                        })\n-                                        .collect();\n-                                    line_ok(RpcResult::Feed(FeedResponse {\n-                                        delegate: Some(delegate_stored),\n+                                        });\n+                                    let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n+                                    line_ok(RpcResult::Feed(rpc_feed(\n+                                        &reduced,\n+                                        &viewer,\n+                                        Some(delegate_stored),\n                                         since,\n-                                        posts,\n-                                        total,\n-                                    }))\n+                                        implicit_anchor,\n+                                        limit,\n+                                    )))\n                                 };\n                                 drop(reduced);\n                                 line\n@@ -1567,60 +1608,25 @@ pub async fn handle_rpc_batch(\n                             None => {\n                                 // Session catch-up: last time *you* posted anything (delegate or not), so revisiting\n                                 // an old chat with only a token still gets a sane cutoff.\n-                                let since_default = reduced\n+                                let implicit_anchor = reduced\n                                     .ingests_ordered\n                                     .iter()\n+                                    .enumerate()\n                                     .rev()\n-                                    .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                    .find(|ing| {\n-                                        if ing.principal != viewer {\n-                                            return false;\n-                                        }\n-                                        let scope = scope_from_room_wire(&ing.room_id);\n-                                        can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n-                                    })\n-                                    .map(|ing| ing.ts);\n-                                let since = since.or(since_default);\n-                                let cutoff = since.unwrap_or(0);\n-                                let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n-                                let matching: Vec<&str> = reduced.ingests_ordered.iter().rev()\n-                                    .map(|id| id.as_str())\n-                                    .take_while(|id| reduced.ingests_by_id.get(*id).is_some_and(|ing| ing.ts > cutoff))\n-                                    .filter(|id| {\n-                                        reduced.ingests_by_id.get(*id).is_some_and(|ing| {\n-                                            let scope = scope_from_room_wire(&ing.room_id);\n-                                            can_view_scope(&reduced, &scope, Some(viewer.as_str()))\n+                                    .find_map(|(index, id)| {\n+                                        reduced.ingests_by_id.get(id).and_then(|ing| {\n+                                            (ing.principal == viewer).then_some((index, ing.ts))\n                                         })\n-                                    })\n-                                    .filter(|id| !reduced.redacted_posts.contains(*id))\n-                                    .collect();\n-                                let total = matching.len();\n-                                let posts: Vec<FeedPost> = matching.into_iter()\n-                                    .take(limit)\n-                                    .filter_map(|id| reduced.ingests_by_id.get(id))\n-                                    .map(|ing| {\n-                                        let scope = scope_from_room_wire(&ing.room_id);\n-                                        let thread_post_index = reduced\n-                                            .try_thread_post_index_chronological(\n-                                                &scope,\n-                                                &ing.thread_tag,\n-                                                &ing.id,\n-                                            );\n-                                        FeedPost {\n-                                            ts: ing.ts,\n-                                            id: ing.id.clone(),\n-                                            thread: Some(ing.thread_tag.clone()),\n-                                            thread_post_index,\n-                                            body: ing.raw.clone(),\n-                                        }\n-                                    })\n-                                    .collect();\n-                                let line = line_ok(RpcResult::Feed(FeedResponse {\n-                                    delegate: None,\n+                                    });\n+                                let limit = limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n+                                let line = line_ok(RpcResult::Feed(rpc_feed(\n+                                    &reduced,\n+                                    &viewer,\n+                                    None,\n                                     since,\n-                                    posts,\n-                                    total,\n-                                }));\n+                                    implicit_anchor,\n+                                    limit,\n+                                )));\n                                 drop(reduced);\n                                 line\n                             }\ndiff --git a/server/tests/integration_rooms.rs b/server/tests/integration_rooms.rs\nindex a3b378267e090a016a7e663f103a0dd9f482690b..e623523ba352ce456674a399542c689505760b78 100644\n--- a/server/tests/integration_rooms.rs\n+++ b/server/tests/integration_rooms.rs\n@@ -1,6 +1,9 @@\n mod support;\n \n use slug_types::room_route_segment;\n+use slugsocial_server::events::{\n+    AgentBound, Event, GrantAdded, GrantRevoked, Ingest, RoomCreated, ThreadCapability,\n+};\n use support::*;\n \n #[tokio::test]\n@@ -473,6 +476,247 @@ async fn test_feed_without_delegate_uses_principal_last_post_including_delegate(\n     );\n }\n \n+#[tokio::test]\n+async fn test_feed_uses_delegate_ingest_position_when_multi_user_timestamps_collide() {\n+    let (addr, _tmp, _log, state, _handle) = create_test_server_with_state().await;\n+    seed_test_identity(&state, \"bob\", \"bobtok\", \"bobsecret\").await;\n+    let client = reqwest::Client::new();\n+    let alice_delegate =\n+        \"00000000-0000-0000-0000-0000000000c1:feedtest:local/alice-model\";\n+    let bob_delegate =\n+        \"00000000-0000-0000-0000-0000000000c2:feedtest:local/bob-model\";\n+\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        for (agent, username) in [\n+            (alice_delegate, \"testuser\"),\n+            (bob_delegate, \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::AgentBound(AgentBound {\n+                ts: 1,\n+                agent: agent.to_string(),\n+                username: username.to_string(),\n+            }));\n+        }\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 100,\n+            id: \"alice-anchor\".into(),\n+            raw: \"alice anchor\".into(),\n+            principal: \"testuser\".into(),\n+            delegate: Some(alice_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 100,\n+            id: \"bob-same-millisecond\".into(),\n+            raw: \"bob same-millisecond change\".into(),\n+            principal: \"bob\".into(),\n+            delegate: Some(bob_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+        // Event-log order remains authoritative even if the wall clock moves backwards.\n+        reduced.apply_event(Event::Ingest(Ingest {\n+            ts: 99,\n+            id: \"bob-clock-rollback\".into(),\n+            raw: \"bob change after clock rollback\".into(),\n+            principal: \"bob\".into(),\n+            delegate: Some(bob_delegate.into()),\n+            room_id: \"public\".into(),\n+            thread_tag: \"feed-order\".into(),\n+        }));\n+    }\n+\n+    let feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let posts = feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap();\n+    let ids: Vec<&str> = posts.iter().filter_map(|p| p[\"id\"].as_str()).collect();\n+    assert_eq!(\n+        ids,\n+        [\"bob-clock-rollback\", \"bob-same-millisecond\"],\n+        \"implicit feed cutoff must use append position, not timestamp\"\n+    );\n+}\n+\n+#[tokio::test]\n+async fn test_feed_multi_user_private_room_visibility_and_revoked_anchor_access() {\n+    let (addr, _tmp, _log, state, _handle) = create_test_server_with_state().await;\n+    seed_test_identity(&state, \"bob\", \"bobtok\", \"bobsecret\").await;\n+    seed_test_identity(&state, \"carol\", \"caroltok\", \"carolsecret\").await;\n+    let client = reqwest::Client::new();\n+    let alice_delegate =\n+        \"00000000-0000-0000-0000-0000000000d1:feedtest:local/alice-model\";\n+    let bob_delegate =\n+        \"00000000-0000-0000-0000-0000000000d2:feedtest:local/bob-model\";\n+    let room_alice = \"alice01/alice-room\";\n+    let room_bob = \"bob0001/bob-room\";\n+\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        for (agent, username) in [\n+            (alice_delegate, \"testuser\"),\n+            (bob_delegate, \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::AgentBound(AgentBound {\n+                ts: 1,\n+                agent: agent.to_string(),\n+                username: username.to_string(),\n+            }));\n+        }\n+        for (room_id, slug, owner) in [\n+            (room_alice, \"alice-room\", \"testuser\"),\n+            (room_bob, \"bob-room\", \"bob\"),\n+        ] {\n+            reduced.apply_event(Event::RoomCreated(RoomCreated {\n+                ts: 2,\n+                room_id: room_id.to_string(),\n+                slug: slug.to_string(),\n+                owner: owner.to_string(),\n+            }));\n+            reduced.apply_event(Event::GrantAdded(GrantAdded {\n+                ts: 2,\n+                room_id: room_id.to_string(),\n+                username: owner.to_string(),\n+                capabilities: vec![ThreadCapability::View],\n+                granted_by: owner.to_string(),\n+            }));\n+        }\n+\n+        let mut add_ingest =\n+            |ts, id: &str, raw: &str, principal: &str, delegate: Option<&str>, room: &str| {\n+                reduced.apply_event(Event::Ingest(Ingest {\n+                    ts,\n+                    id: id.into(),\n+                    raw: raw.into(),\n+                    principal: principal.into(),\n+                    delegate: delegate.map(str::to_string),\n+                    room_id: room.into(),\n+                    thread_tag: \"feed-permissions\".into(),\n+                }));\n+            };\n+        add_ingest(10, \"prehistory\", \"must remain before alice anchor\", \"carol\", None, \"public\");\n+        add_ingest(\n+            11,\n+            \"alice-private-anchor\",\n+            \"alice last posted here\",\n+            \"testuser\",\n+            Some(alice_delegate),\n+            room_alice,\n+        );\n+        add_ingest(\n+            12,\n+            \"bob-public-anchor\",\n+            \"bob last posted here\",\n+            \"bob\",\n+            Some(bob_delegate),\n+            \"public\",\n+        );\n+        add_ingest(13, \"alice-room-change\", \"visible only to alice\", \"carol\", None, room_alice);\n+        add_ingest(14, \"bob-room-change\", \"visible only to bob\", \"carol\", None, room_bob);\n+        add_ingest(15, \"public-change\", \"visible to everyone\", \"carol\", None, \"public\");\n+\n+        reduced.apply_event(Event::GrantRevoked(GrantRevoked {\n+            ts: 16,\n+            room_id: room_alice.into(),\n+            username: \"testuser\".into(),\n+            capabilities: vec![ThreadCapability::View],\n+            revoked_by: \"testuser\".into(),\n+        }));\n+    }\n+\n+    let alice_feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let alice_posts = alice_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap();\n+    let alice_ids: Vec<&str> = alice_posts\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(\n+        alice_ids,\n+        [\"public-change\", \"bob-public-anchor\"],\n+        \"revoked private content must be hidden without moving the delegate anchor backwards\"\n+    );\n+    assert!(!alice_ids.contains(&\"prehistory\"));\n+    assert!(\n+        alice_posts\n+            .iter()\n+            .all(|post| post[\"room\"].as_str() == Some(\"public\")),\n+        \"private posts must not leak and every feed post must identify its room\"\n+    );\n+\n+    let bob_bearer = test_bearer_for(\"bobtok\", \"bobsecret\");\n+    let bob_feed = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&bob_bearer),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": bob_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let bob_ids: Vec<&str> = bob_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap()\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(bob_ids, [\"public-change\", \"bob-room-change\"]);\n+    assert_eq!(\n+        bob_feed[\"results\"][0][\"result\"][\"Feed\"][\"posts\"][1][\"room\"],\n+        room_bob\n+    );\n+\n+    // Restoring View exposes only changes after the same stable delegate anchor.\n+    {\n+        let mut reduced = state.reduced.write().await;\n+        reduced.apply_event(Event::GrantAdded(GrantAdded {\n+            ts: 17,\n+            room_id: room_alice.into(),\n+            username: \"testuser\".into(),\n+            capabilities: vec![ThreadCapability::View],\n+            granted_by: \"testuser\".into(),\n+        }));\n+    }\n+    let restored = rpc_batch(\n+        &client,\n+        addr,\n+        Some(&test_bearer()),\n+        serde_json::json!([{\n+            \"GetFeed\": { \"delegate\": alice_delegate, \"limit\": 20 }\n+        }]),\n+    )\n+    .await;\n+    let restored_ids: Vec<&str> = restored[\"results\"][0][\"result\"][\"Feed\"][\"posts\"]\n+        .as_array()\n+        .unwrap()\n+        .iter()\n+        .filter_map(|p| p[\"id\"].as_str())\n+        .collect();\n+    assert_eq!(\n+        restored_ids,\n+        [\"public-change\", \"alice-room-change\", \"bob-public-anchor\"]\n+    );\n+}\n+\n #[tokio::test]\n async fn test_private_room_thread_urls_use_t_segment() {\n     let (addr, _tmp, _log, _handle) = create_test_server().await;\ndiff --git a/server/tests/support/mod.rs b/server/tests/support/mod.rs\nindex 4a620eaa875e7a1145f2a4e82cc4ff2be21d5345..a4320e991763617c1a760efad4b621977e2b74d0 100644\n--- a/server/tests/support/mod.rs\n+++ b/server/tests/support/mod.rs\n@@ -20,8 +20,10 @@ pub fn sha256_hex(s: &str) -> String {\n \n /// Fixed bearer for integration tests (`TokenIssued` seeded into reducer in `create_test_server`).\n pub fn test_bearer() -> String {\n-    let token_id = \"testtok\";\n-    let secret = \"secret\";\n+    test_bearer_for(\"testtok\", \"secret\")\n+}\n+\n+pub fn test_bearer_for(token_id: &str, secret: &str) -> String {\n     format!(\"slug_{token_id}_{secret}\")\n }\n \n@@ -71,19 +73,27 @@ pub async fn rpc_batch(\n }\n \n pub async fn seed_test_token(state: &AppState) {\n+    seed_test_identity(state, \"testuser\", \"testtok\", \"secret\").await;\n+}\n+\n+/// Add a distinct principal and bearer to a running integration-test server.\n+pub async fn seed_test_identity(\n+    state: &AppState,\n+    username: &str,\n+    token_id: &str,\n+    secret: &str,\n+) {\n     let registered = Event::UserRegistered(UserRegistered {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         provider: \"test\".to_string(),\n-        provider_id: \"testuser\".to_string(),\n+        provider_id: username.to_string(),\n     });\n-    let token_id = \"testtok\";\n-    let secret = \"secret\";\n     let salt = \"salt\";\n     let token_hash = sha256_hex(&format!(\"{salt}:{secret}\"));\n     let ev = Event::TokenIssued(TokenIssued {\n         ts: 0,\n-        username: \"testuser\".to_string(),\n+        username: username.to_string(),\n         token_id: token_id.to_string(),\n         token_hash,\n         salt: salt.to_string(),\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex 211493935d19582607f5c87fb492faf47bdc6f53..cd6f94c60a4e1c3bfbce13bc0404b803f5f57c6d 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -264,6 +264,9 @@ pub struct FeedResponse {\n pub struct FeedPost {\n     pub ts: i64,\n     pub id: String,\n+    /// Permission scope containing the post: `\"public\"` or a private room id.\n+    #[serde(default)]\n+    pub room: String,\n     /// Primary thread tag (without #), if the ingest declared one.\n     #[serde(skip_serializing_if = \"Option::is_none\")]\n     pub thread: Option<String>,\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[c99adc26] refactor forum into files\n\nSide B — unified diff (full patch):\ndiff --git a/bb.edn b/bb.edn\nindex 4680e82d4227057d2eea6041dc5647beb759131d..ce0f6fcd45a67ead3295b90db2a301e9b304f3da 100644\n--- a/bb.edn\n+++ b/bb.edn\n@@ -51,6 +51,11 @@\n    :requires ([test.walkthrough-fixture :as walkthrough-fixture])\n    :task (walkthrough-fixture/run-fixture)}\n \n+  sample-fixture\n+  {:doc \"macOS: run `sample` on process(es) listening on the fixture TCP port (default 8080). Usage: bb sample-fixture [PORT] [DURATION_SEC] [OUT_DIR]\"\n+   :requires ([scripts.sample-fixture :as sample-fixture])\n+   :task (apply sample-fixture/-main *command-line-args*)}\n+\n   perf\n   {:doc \"Performance test: concurrent HTTP requests to detect blocking I/O\"\n    :requires ([scripts.perf :as perf])\ndiff --git a/scripts/sample_fixture.bb b/scripts/sample_fixture.bb\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..ac2368623c5043ba6e027afef6b5b37d392767b0\n--- /dev/null\n+++ b/scripts/sample_fixture.bb\n@@ -0,0 +1,70 @@\n+(ns scripts.sample-fixture\n+  \"Find process(es) listening on the fixture port (default 8080) and run macOS `sample`.\"\n+  (:require [babashka.fs :as fs]\n+            [babashka.process :as p]\n+            [clojure.string :as str]))\n+\n+(defn- usage []\n+  (println \"Usage: bb sample-fixture [PORT] [DURATION_SEC] [OUT_DIR]\")\n+  (println \"\")\n+  (println \"  Finds PIDs bound to TCP LISTEN on PORT (default 8080), then runs\")\n+  (println \"  `sample` for each PID. OUT_DIR defaults to the current directory.\")\n+  (println \"\")\n+  (println \"  Example:  bb sample-fixture\")\n+  (println \"            bb sample-fixture 8080 10\")\n+  (println \"            bb sample-fixture 8080 5 /tmp\")\n+  (println \"\")\n+  (println \"  Requires macOS (the `sample` tool).\"))\n+\n+(defn- parse-long* [s]\n+  (try (Long/parseLong s)\n+       (catch NumberFormatException _ nil)))\n+\n+(defn- listen-pids [port]\n+  (let [spec (str \"TCP:\" port)\n+        {:keys [out exit]}\n+        @(p/process [\"lsof\" \"-nP\" (str \"-i\" spec) \"-sTCP:LISTEN\" \"-t\"]\n+                    {:out :string :err :string})]\n+    (when (zero? exit)\n+      (->> (str/split-lines out)\n+           (map str/trim)\n+           (remove str/blank?)\n+           (distinct)\n+           vec))))\n+\n+(defn- sample-bin []\n+  (or (fs/which \"sample\")\n+      (throw (ex-info \"macOS `sample` not found on PATH\" {}))))\n+\n+(defn- run-sample! [sample duration-sec pid out-file]\n+  (println (str \"sampling PID \" pid \" for \" duration-sec \"s → \" out-file))\n+  (let [{:keys [exit err]} @(p/process [sample (str pid) (str duration-sec) \"-file\" out-file]\n+                                      {:out :inherit :err :inherit})]\n+    (when-not (zero? exit)\n+      (binding [*out* *err*]\n+        (println \"sample failed:\" err))\n+      (System/exit exit))))\n+\n+(defn -main [& args]\n+  (when (some #{\"-h\" \"--help\" \"help\"} args)\n+    (usage)\n+    (System/exit 0))\n+  (let [port (or (some-> (first args) parse-long*) 8080)\n+        duration-sec (or (some-> (second args) parse-long*) 5)\n+        out-dir (or (nth args 2 nil) \".\")\n+        pids (listen-pids port)]\n+    (when (or (nil? pids) (empty? pids))\n+      (binding [*out* *err*]\n+        (println (str \"No process listening on TCP \" port \" (LISTEN). Is `bb fixture` running?\")))\n+      (System/exit 1))\n+    (when-not (fs/exists? out-dir)\n+      (binding [*out* *err*]\n+        (println \"Output directory does not exist:\" out-dir))\n+      (System/exit 1))\n+    (let [sample (sample-bin)\n+          ts (str (System/currentTimeMillis))]\n+      (println (str \"port \" port \" → PIDs \" (str/join \", \" pids)))\n+      (doseq [pid pids]\n+        (let [out-file (str (fs/path out-dir) \"/slug-sample-\" port \"-\" pid \"-\" ts \".txt\")]\n+          (run-sample! sample duration-sec pid (str out-file))))\n+      (println \"done.\"))))\ndiff --git a/server/src/html/forum.rs b/server/src/html/forum.rs\nindex a55fc1f79d03719eb74b216865b2c15199c48ea7..5ad8dfc84dd735d589432e2c613ff687a75f2e61 100644\n--- a/server/src/html/forum.rs\n+++ b/server/src/html/forum.rs\n@@ -380,22 +380,6 @@ fn room_members_inner(members: &[RoomMemberRow]) -> Markup {\n     }\n }\n \n-pub(crate) fn set_room_members_expanded_rpc(room_wire: &str, expanded: bool) -> String {\n-    template_json_compact(&HtmlUiAction::SetRoomMembersExpanded {\n-        room_wire: room_wire.to_string(),\n-        expanded,\n-    })\n-    .expect(\"static json\")\n-}\n-\n-pub(crate) fn set_room_new_thread_compose_expanded_rpc(nav: &ThreadNav, expanded: bool) -> String {\n-    template_json_compact(&HtmlUiAction::SetRoomNewThreadComposeExpanded {\n-        room_wire: nav.room_wire.clone(),\n-        expanded,\n-    })\n-    .expect(\"static json\")\n-}\n-\n /// Fragment for `#room-members-section` — expand/collapse is server-driven via `POST /ui`.\n pub(crate) fn room_members_section_markup(\n     reduced: &ReducerState,\n@@ -406,13 +390,14 @@ pub(crate) fn room_members_section_markup(\n     if members.is_empty() {\n         return html! {};\n     }\n-    let rpc_open = set_room_members_expanded_rpc(room_id, true);\n-    let rpc_close = set_room_members_expanded_rpc(room_id, false);\n     html! {\n         div id=\"room-members-section\" {\n             @if members_expanded {\n                 form method=\"POST\" action=\"/ui\" {\n-                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(rpc_close);\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::SetRoomMembersExpanded {\n+                        room_wire: room_id.to_string(),\n+                        expanded: false,\n+                    }).expect(\"static json\"));\n                     button type=\"submit\" class=\"form-toggle\" aria-expanded=\"true\" {\n                         \"hide members & permissions\"\n                     }\n@@ -422,7 +407,10 @@ pub(crate) fn room_members_section_markup(\n                 }\n             } @else {\n                 form method=\"POST\" action=\"/ui\" {\n-                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(rpc_open);\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::SetRoomMembersExpanded {\n+                        room_wire: room_id.to_string(),\n+                        expanded: true,\n+                    }).expect(\"static json\"));\n                     button type=\"submit\" class=\"form-toggle\" aria-expanded=\"false\" {\n                         \"members & permissions\"\n                     }\n@@ -514,28 +502,24 @@ fn compose_form(nav: &ThreadNav, thread_tag: &str, show: bool) -> Markup {\n     if !show {\n         return html! {};\n     }\n-    let rpc_post = template_json_compact(&json!({\n-        \"action\": \"post_ingest\",\n-        \"room\": nav.room_wire,\n-        \"thread_tag\": thread_tag,\n-        \"text\": {\"$form\": \"text\"},\n-        \"error_target\": \"thread-compose-errors\",\n-        \"form_id\": \"thread-compose-form\",\n-    }))\n-    .unwrap();\n-    let rpc_check = template_json_compact(&json!({\n-        \"action\": \"check_ingest\",\n-        \"room\": nav.room_wire,\n-        \"thread_tag\": thread_tag,\n-        \"text\": {\"$form\": \"text\"},\n-        \"error_target\": \"thread-compose-errors\",\n-        \"form_id\": \"thread-compose-form\",\n-    }))\n-    .unwrap();\n     html! {\n         section class=\"compose\" id=\"thread-compose\" {\n-            form id=\"thread-compose-form\" method=\"POST\" action=\"/ui\" data-check-action=\"/ui\" data-check-rpc=(rpc_check) {\n-                input type=\"hidden\" name=(UI_RPC_FIELD) value=(rpc_post);\n+            form id=\"thread-compose-form\" method=\"POST\" action=\"/ui\" data-check-action=\"/ui\" data-check-rpc=(template_json_compact(&json!({\n+                \"action\": \"check_ingest\",\n+                \"room\": nav.room_wire,\n+                \"thread_tag\": thread_tag,\n+                \"text\": {\"$form\": \"text\"},\n+                \"error_target\": \"thread-compose-errors\",\n+                \"form_id\": \"thread-compose-form\",\n+            })).unwrap()) {\n+                input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&json!({\n+                    \"action\": \"post_ingest\",\n+                    \"room\": nav.room_wire,\n+                    \"thread_tag\": thread_tag,\n+                    \"text\": {\"$form\": \"text\"},\n+                    \"error_target\": \"thread-compose-errors\",\n+                    \"form_id\": \"thread-compose-form\",\n+                })).unwrap());\n                 textarea name=\"text\" rows=\"5\" cols=\"80\" placeholder=\"prose or ~/items and votes…\" {}\n                 p {\n                     button type=\"submit\" { \"post\" }\n@@ -712,7 +696,7 @@ pub async fn home(\n             p class=\"muted\" { \"dark = time-ordered · light = vote-ranked\" }\n             div class=\"thread-feed-toolbar\" {\n                 form method=\"POST\" action=\"/ui\" {\n-                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(expand_public_new_thread_rpc_value());\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::ExpandPublicNewThreadForm).expect(\"static json\"));\n                     button type=\"submit\" class=\"section-add-btn\" { \"+\" }\n                 }\n             }\n@@ -1002,14 +986,15 @@ fn new_thread_form_for_room(nav: &ThreadNav, show: bool, compose_expanded: bool)\n     if !show {\n         return html! {};\n     }\n-    let rpc_open = set_room_new_thread_compose_expanded_rpc(nav, true);\n-    let rpc_close = set_room_new_thread_compose_expanded_rpc(nav, false);\n     // Single root for Idiomorph when morphing `#room-new-thread-ui-slot` (expanded has form + section).\n     html! {\n         div class=\"room-new-thread-slot-inner\" {\n             @if compose_expanded {\n                 form method=\"POST\" action=\"/ui\" {\n-                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(rpc_close);\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::SetRoomNewThreadComposeExpanded {\n+                        room_wire: nav.room_wire.clone(),\n+                        expanded: false,\n+                    }).expect(\"static json\"));\n                     button type=\"submit\" class=\"form-toggle\" aria-expanded=\"true\" {\n                         \"-\"\n                     }\n@@ -1039,7 +1024,10 @@ fn new_thread_form_for_room(nav: &ThreadNav, show: bool, compose_expanded: bool)\n                 }\n             } @else {\n                 form method=\"POST\" action=\"/ui\" {\n-                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(rpc_open);\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::SetRoomNewThreadComposeExpanded {\n+                        room_wire: nav.room_wire.clone(),\n+                        expanded: true,\n+                    }).expect(\"static json\"));\n                     button type=\"submit\" class=\"form-toggle\" aria-expanded=\"false\" {\n                         \"+\"\n                     }\n@@ -1049,10 +1037,6 @@ fn new_thread_form_for_room(nav: &ThreadNav, show: bool, compose_expanded: bool)\n     }\n }\n \n-pub(crate) fn expand_public_new_thread_rpc_value() -> String {\n-    template_json_compact(&HtmlUiAction::ExpandPublicNewThreadForm).expect(\"static json\")\n-}\n-\n pub(crate) fn login_to_post_hint_markup() -> Markup {\n     html! {\n         p class=\"muted\" { \"log in to post\" }\ndiff --git a/server/src/html/forum/access.rs b/server/src/html/forum/access.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..f9f7139b63442a6ef3a927b77a72805f15feec3f\n--- /dev/null\n+++ b/server/src/html/forum/access.rs\n@@ -0,0 +1,16 @@\n+use crate::events::ThreadCapability;\n+use crate::reducer::ReducerState;\n+\n+pub(crate) fn user_can_view_room(reduced: &ReducerState, room_id: &str, username: Option<&str>) -> bool {\n+    if !reduced.rooms.contains(room_id) {\n+        return false;\n+    }\n+    let Some(u) = username else {\n+        return false;\n+    };\n+    reduced.user_has_cap(room_id, u, ThreadCapability::View)\n+}\n+\n+pub(crate) fn user_can_post_room(reduced: &ReducerState, room_id: &str, username: &str) -> bool {\n+    reduced.user_has_cap(room_id, username, ThreadCapability::Post)\n+}\ndiff --git a/server/src/html/forum/ingest.rs b/server/src/html/forum/ingest.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..c045046a005db4f8f4d1dc7ea74aaaba45e0f3f4\n--- /dev/null\n+++ b/server/src/html/forum/ingest.rs\n@@ -0,0 +1,171 @@\n+use crate::canonical_path::canonicalize_tag;\n+use crate::form_template::template_json_compact;\n+use crate::reducer::{scope_from_room_wire, ReducerState};\n+use maud::{html, Markup};\n+use serde_json::json;\n+\n+use crate::html::js_string_literal;\n+use crate::html::ui_action::{HtmlUiAction, UI_RPC_FIELD};\n+use crate::html::{profile_href, render_linkified_with_embeds_in_scope, timeago};\n+\n+use super::nav::ThreadNav;\n+\n+/// `POST /ui` + `__rpc__` from an inline link (`onclick`); same-origin credentials as other morph actions.\n+pub(super) fn thread_ui_fetch_onclick(rpc_compact_json: &str) -> String {\n+    format!(\n+        \"fetch('/ui',{{method:'POST',headers:{{'Content-Type':'application/x-www-form-urlencoded'}},body:new URLSearchParams({{__rpc__:{}}}).toString(),credentials:'same-origin'}}).then(r=>r.text()).then(eval);return false\",\n+        js_string_literal(rpc_compact_json)\n+    )\n+}\n+\n+pub(super) fn thread_nav_for_ingest(ing: &crate::events::Ingest) -> Option<ThreadNav> {\n+    let room = ing.room_id.trim();\n+    if room.is_empty() || room == \"public\" {\n+        Some(ThreadNav::public())\n+    } else {\n+        ThreadNav::from_room_id(room)\n+    }\n+}\n+\n+pub(super) fn thread_post_index_in_scope(reduced: &ReducerState, ing: &crate::events::Ingest) -> Option<usize> {\n+    let scope = scope_from_room_wire(&ing.room_id);\n+    let tag = canonicalize_tag(&ing.thread_tag);\n+    reduced\n+        .ingests_by_scope_thread\n+        .get(&(scope, tag))\n+        .and_then(|q| q.iter().rev().position(|id| id == &ing.id))\n+}\n+\n+fn post_header_meta(\n+    nav: &ThreadNav,\n+    tag: &str,\n+    post_idx: usize,\n+    principal: &str,\n+    ts: i64,\n+    now: i64,\n+) -> Markup {\n+    let post_href = nav.post_url(tag, post_idx);\n+    let profile = profile_href(principal);\n+    let hover = timeago::rfc3339_utc(ts);\n+    let ago = timeago::timeago(now, ts);\n+    html! {\n+        div class=\"ingest-meta muted\" title=(hover) {\n+            a href=(post_href) class=\"post-num\" { \"#\" (post_idx) }\n+            \" \"\n+            a href=(profile) class=\"post-author\" { \"@\" (principal) }\n+            \" · \"\n+            (ago)\n+        }\n+    }\n+}\n+\n+pub(super) fn post_header_row(\n+    nav: &ThreadNav,\n+    tag: &str,\n+    post_idx: usize,\n+    ing: &crate::events::Ingest,\n+    _viewer: Option<&str>,\n+    now: i64,\n+    show_delete: bool,\n+) -> Markup {\n+    let meta = post_header_meta(nav, tag, post_idx, &ing.principal, ing.ts, now);\n+    html! {\n+        div class=\"ingest-header-row\" {\n+            (meta)\n+            @if show_delete {\n+                form class=\"post-delete-form\" method=\"POST\" action=\"/ui\" {\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::RedactPost { post_id: ing.id.clone() }).unwrap());\n+                    button type=\"submit\" class=\"post-delete-btn\" { \"delete\" }\n+                }\n+            }\n+        }\n+    }\n+}\n+\n+pub(super) fn redacted_header_row(\n+    nav: &ThreadNav,\n+    tag: &str,\n+    post_idx: usize,\n+    ing: &crate::events::Ingest,\n+    now: i64,\n+    expanded: bool,\n+) -> Markup {\n+    let meta = post_header_meta(nav, tag, post_idx, &ing.principal, ing.ts, now);\n+    let rpc_expand = template_json_compact(&json!({\n+        \"action\": \"expand_redacted_post\",\n+        \"room\": nav.room_wire,\n+        \"thread_tag\": tag,\n+        \"post_index\": post_idx,\n+    }))\n+    .unwrap();\n+    let rpc_collapse = template_json_compact(&json!({\n+        \"action\": \"collapse_redacted_post\",\n+        \"room\": nav.room_wire,\n+        \"thread_tag\": tag,\n+        \"post_index\": post_idx,\n+    }))\n+    .unwrap();\n+    let onclick_expand = thread_ui_fetch_onclick(&rpc_expand);\n+    let onclick_collapse = thread_ui_fetch_onclick(&rpc_collapse);\n+    html! {\n+        div class=\"ingest-header-row ingest-tombstone-row\" {\n+            (meta)\n+            span class=\"post-tombstone-inline muted\" {\n+                \"deleted · \"\n+                @if expanded {\n+                    a href=\"#\" class=\"hide-deleted-link\"\n+                      onclick=(onclick_collapse) {\n+                        \"[hide deleted content]\"\n+                    }\n+                } @else {\n+                    a href=\"#\" class=\"show-deleted-link\"\n+                      onclick=(onclick_expand) {\n+                        \"[show deleted content]\"\n+                    }\n+                }\n+            }\n+        }\n+    }\n+}\n+\n+pub(super) fn ingest_entry_markup(\n+    nav: &ThreadNav,\n+    tag: &str,\n+    post_idx: usize,\n+    ing: &crate::events::Ingest,\n+    viewer: Option<&str>,\n+    now: i64,\n+    reduced: &ReducerState,\n+) -> Markup {\n+    let redacted = reduced.redacted_posts.contains(&ing.id);\n+    let show_delete = viewer == Some(ing.principal.as_str()) && !redacted;\n+    if redacted {\n+        html! {\n+            div class=\"ingest-entry ingest-redacted\" data-ingest-id=(ing.id) {\n+                (redacted_header_row(nav, tag, post_idx, ing, now, false))\n+            }\n+        }\n+    } else {\n+        let truncated = ing.raw.len() > 2000;\n+        let display_body = if truncated { &ing.raw[..2000] } else { &ing.raw[..] };\n+        html! {\n+            div class=\"ingest-entry\" data-ingest-id=(ing.id) {\n+                (post_header_row(nav, tag, post_idx, ing, viewer, now, show_delete))\n+                (render_linkified_with_embeds_in_scope(display_body, nav.garden_root_url()))\n+                @if truncated {\n+                    @let rpc_full = template_json_compact(&json!({\n+                        \"action\": \"expand_post_full\",\n+                        \"room\": nav.room_wire,\n+                        \"thread_tag\": tag,\n+                        \"post_index\": post_idx,\n+                    })).unwrap();\n+                    @let onclick_full = thread_ui_fetch_onclick(&rpc_full);\n+                    a href=\"#\" class=\"show-full-link\"\n+                      onclick=(onclick_full) {\n+                        \"[show full post]\"\n+                    }\n+                }\n+            }\n+        }\n+    }\n+}\ndiff --git a/server/src/html/forum/nav.rs b/server/src/html/forum/nav.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..f5d437f2b1c6a0b727f1540d83774ba4e440f0b1\n--- /dev/null\n+++ b/server/src/html/forum/nav.rs\n@@ -0,0 +1,78 @@\n+use crate::canonical_path::canonicalize_item;\n+use crate::reducer::ScopeId;\n+\n+/// URL helpers for public `/t/…` and private room threads `/r/{short}/{slug}/t/…`.\n+#[derive(Clone)]\n+pub struct ThreadNav {\n+    pub room_wire: String,\n+    scope: ScopeId,\n+    room_path: String,\n+    thread_path_prefix: String,\n+    garden_path_prefix: String,\n+}\n+\n+impl ThreadNav {\n+    pub(crate) fn public() -> Self {\n+        Self {\n+            room_wire: \"public\".into(),\n+            scope: ScopeId::Public,\n+            room_path: \"/t\".into(),\n+            thread_path_prefix: \"/t\".into(),\n+            garden_path_prefix: \"/~\".into(),\n+        }\n+    }\n+\n+    /// `room_id` wire form `shortid/slug`.\n+    pub(crate) fn from_room_id(room_id: &str) -> Option<Self> {\n+        let (short, slug) = room_id.split_once('/')?;\n+        if short.is_empty() || slug.is_empty() {\n+            return None;\n+        }\n+        Some(Self {\n+            room_wire: room_id.to_string(),\n+            scope: ScopeId::Room(room_id.to_string()),\n+            room_path: format!(\"/r/{short}/{slug}\"),\n+            thread_path_prefix: format!(\"/r/{short}/{slug}/t\"),\n+            garden_path_prefix: format!(\"/r/{short}/{slug}/~\"),\n+        })\n+    }\n+\n+    pub(crate) fn scope(&self) -> ScopeId {\n+        self.scope.clone()\n+    }\n+\n+    pub(crate) fn room_url(&self) -> &str {\n+        &self.room_path\n+    }\n+\n+    pub(crate) fn thread_url(&self, tag: &str) -> String {\n+        format!(\"{}/{}\", self.thread_path_prefix, tag)\n+    }\n+\n+    pub(crate) fn garden_root_url(&self) -> &str {\n+        &self.garden_path_prefix\n+    }\n+\n+    pub(crate) fn garden_item_url(&self, item: &str) -> String {\n+        if let Some(tail) = crate::path_types::CanonicalItemUrl::parse(item)\n+            .and_then(|c| c.tilde_tail().map(str::to_owned))\n+        {\n+            format!(\"{}/{}\", self.garden_path_prefix, tail)\n+        } else {\n+            format!(\"{}/{}\", self.garden_path_prefix, canonicalize_item(item))\n+        }\n+    }\n+\n+    pub(crate) fn thread_page_url(&self, tag: &str, offset: usize) -> String {\n+        let base = self.thread_url(tag);\n+        if offset == 0 {\n+            base\n+        } else {\n+            format!(\"{base}?offset={offset}\")\n+        }\n+    }\n+\n+    pub(crate) fn post_url(&self, tag: &str, idx: usize) -> String {\n+        format!(\"{}/{}/{}\", self.thread_path_prefix, tag, idx)\n+    }\n+}\ndiff --git a/server/src/html/forum/new_thread.rs b/server/src/html/forum/new_thread.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..b2d24b8ab3ec7eee0edd16bed8ee6605e49bf408\n--- /dev/null\n+++ b/server/src/html/forum/new_thread.rs\n@@ -0,0 +1,157 @@\n+use crate::form_template::template_json_compact;\n+use crate::html::ui_action::{HtmlUiAction, UI_RPC_FIELD};\n+use maud::{html, Markup};\n+use serde_json::json;\n+\n+use super::nav::ThreadNav;\n+\n+struct NewThreadIds {\n+    compose_section_id: &'static str,\n+    errors_id: &'static str,\n+    form_id: &'static str,\n+    tag_input_id: &'static str,\n+    text_input_id: Option<&'static str>,\n+}\n+\n+const PUBLIC_IDS: NewThreadIds = NewThreadIds {\n+    compose_section_id: \"public-new-thread-compose\",\n+    errors_id: \"public-new-thread-errors\",\n+    form_id: \"public-new-thread-form\",\n+    tag_input_id: \"new-thread-tag\",\n+    text_input_id: Some(\"new-thread-text\"),\n+};\n+\n+const ROOM_IDS: NewThreadIds = NewThreadIds {\n+    compose_section_id: \"room-new-thread-compose\",\n+    errors_id: \"room-new-thread-errors\",\n+    form_id: \"room-new-thread-form\",\n+    tag_input_id: \"room-new-tag\",\n+    text_input_id: None,\n+};\n+\n+#[derive(Clone, Copy)]\n+enum NewThreadComposeKind {\n+    /// Home page: no client-side check RPC; post template omits `error_target` / `form_id`.\n+    Public,\n+    /// Room page: `check_ingest` + error targets on post (matches thread compose).\n+    Room,\n+}\n+\n+/// Shared `<section class=\"compose\">` for creating a thread + first post.\n+fn new_thread_compose_section(room_wire: &str, ids: &NewThreadIds, kind: NewThreadComposeKind) -> Markup {\n+    let client_check = matches!(kind, NewThreadComposeKind::Room);\n+    let (tag_placeholder, text_placeholder, submit_label) = match kind {\n+        NewThreadComposeKind::Public => (\n+            \"thread-title-slug-here\",\n+            \"Hello threadgoers!! Behold my new thread!\",\n+            \"create thread / make first post\",\n+        ),\n+        NewThreadComposeKind::Room => (\n+            \"thread-topic-slug-here\",\n+            \"First post body…\",\n+            \"post\",\n+        ),\n+    };\n+\n+    html! {\n+        section class=\"compose\" id=(ids.compose_section_id) {\n+            div id=(ids.errors_id) {}\n+            @if client_check {\n+                form id=(ids.form_id) method=\"POST\" action=\"/ui\" data-check-action=\"/ui\" data-check-rpc=(template_json_compact(&json!({\n+                    \"action\": \"check_ingest\",\n+                    \"room\": room_wire,\n+                    \"thread_tag\": {\"$form\": \"thread_tag\"},\n+                    \"text\": {\"$form\": \"text\"},\n+                    \"error_target\": ids.errors_id,\n+                    \"form_id\": ids.form_id,\n+                })).unwrap()) {\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&json!({\n+                        \"action\": \"post_ingest\",\n+                        \"room\": room_wire,\n+                        \"thread_tag\": {\"$form\": \"thread_tag\"},\n+                        \"text\": {\"$form\": \"text\"},\n+                        \"error_target\": ids.errors_id,\n+                        \"form_id\": ids.form_id,\n+                    })).unwrap());\n+                    input type=\"text\" id=(ids.tag_input_id) name=\"thread_tag\" pattern=\"[a-z0-9_\\\\-]{1,64}\" required placeholder=(tag_placeholder);\n+                    @if let Some(tid) = ids.text_input_id {\n+                        textarea id=(tid) name=\"text\" rows=\"4\" placeholder=(text_placeholder) required {}\n+                    } @else {\n+                        textarea name=\"text\" rows=\"4\" placeholder=(text_placeholder) required {}\n+                    }\n+                    p { button type=\"submit\" { (submit_label) } }\n+                }\n+            } @else {\n+                form id=(ids.form_id) method=\"POST\" action=\"/ui\" {\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&json!({\n+                        \"action\": \"post_ingest\",\n+                        \"room\": room_wire,\n+                        \"thread_tag\": {\"$form\": \"thread_tag\"},\n+                        \"text\": {\"$form\": \"text\"},\n+                    })).unwrap());\n+                    input type=\"text\" id=(ids.tag_input_id) name=\"thread_tag\" pattern=\"[a-z0-9_\\\\-]{1,64}\" placeholder=(tag_placeholder);\n+                    @if let Some(tid) = ids.text_input_id {\n+                        textarea id=(tid) name=\"text\" rows=\"4\" placeholder=(text_placeholder) {}\n+                    } @else {\n+                        textarea name=\"text\" rows=\"4\" placeholder=(text_placeholder) {}\n+                    }\n+                    p { button type=\"submit\" { (submit_label) } }\n+                }\n+            }\n+        }\n+    }\n+}\n+\n+fn new_thread_form_public(show: bool) -> Markup {\n+    if !show {\n+        return html! {};\n+    }\n+    new_thread_compose_section(\"public\", &PUBLIC_IDS, NewThreadComposeKind::Public)\n+}\n+\n+fn new_thread_form_for_room(nav: &ThreadNav, show: bool, compose_expanded: bool) -> Markup {\n+    if !show {\n+        return html! {};\n+    }\n+    // Single root for Idiomorph when morphing `#room-new-thread-ui-slot` (expanded has form + section).\n+    html! {\n+        div class=\"room-new-thread-slot-inner\" {\n+            @if compose_expanded {\n+                form method=\"POST\" action=\"/ui\" {\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::SetRoomNewThreadComposeExpanded {\n+                        room_wire: nav.room_wire.clone(),\n+                        expanded: false,\n+                    }).expect(\"static json\"));\n+                    button type=\"submit\" class=\"form-toggle\" aria-expanded=\"true\" {\n+                        \"-\"\n+                    }\n+                }\n+                (new_thread_compose_section(&nav.room_wire, &ROOM_IDS, NewThreadComposeKind::Room))\n+            } @else {\n+                form method=\"POST\" action=\"/ui\" {\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::SetRoomNewThreadComposeExpanded {\n+                        room_wire: nav.room_wire.clone(),\n+                        expanded: true,\n+                    }).expect(\"static json\"));\n+                    button type=\"submit\" class=\"form-toggle\" aria-expanded=\"false\" {\n+                        \"+\"\n+                    }\n+                }\n+            }\n+        }\n+    }\n+}\n+\n+pub(crate) fn login_to_post_hint_markup() -> Markup {\n+    html! {\n+        p class=\"muted\" { \"log in to post\" }\n+    }\n+}\n+\n+pub(crate) fn fragment_public_new_thread_form(show: bool) -> Markup {\n+    new_thread_form_public(show)\n+}\n+\n+pub(crate) fn fragment_room_new_thread_form(nav: &ThreadNav, show: bool, compose_expanded: bool) -> Markup {\n+    new_thread_form_for_room(nav, show, compose_expanded)\n+}\ndiff --git a/server/src/html/forum/room_members.rs b/server/src/html/forum/room_members.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..bc13d3eb8030f00799c90c47e689a876168f522c\n--- /dev/null\n+++ b/server/src/html/forum/room_members.rs\n@@ -0,0 +1,108 @@\n+use crate::events::ThreadCapability;\n+use crate::form_template::template_json_compact;\n+use crate::reducer::ReducerState;\n+use maud::{html, Markup};\n+\n+use crate::html::ui_action::{HtmlUiAction, UI_RPC_FIELD};\n+\n+#[derive(Clone)]\n+pub(super) struct RoomMemberRow {\n+    pub(super) username: String,\n+    pub(super) capabilities: Vec<&'static str>,\n+}\n+\n+fn capability_label(cap: ThreadCapability) -> &'static str {\n+    match cap {\n+        ThreadCapability::View => \"view\",\n+        ThreadCapability::Post => \"post\",\n+        ThreadCapability::Vote => \"vote\",\n+        ThreadCapability::AddItem => \"add_item\",\n+        ThreadCapability::Manage => \"manage\",\n+    }\n+}\n+\n+fn room_members_for_room(reduced: &ReducerState, room_id: &str) -> Vec<RoomMemberRow> {\n+    let mut rows: Vec<RoomMemberRow> = reduced\n+        .grants\n+        .get(room_id)\n+        .into_iter()\n+        .flat_map(|members| members.iter())\n+        .map(|(username, caps)| {\n+            let mut ordered = Vec::new();\n+            for cap in [\n+                ThreadCapability::View,\n+                ThreadCapability::Post,\n+                ThreadCapability::Vote,\n+                ThreadCapability::AddItem,\n+                ThreadCapability::Manage,\n+            ] {\n+                if caps.contains(&cap) {\n+                    ordered.push(capability_label(cap));\n+                }\n+            }\n+            RoomMemberRow {\n+                username: username.clone(),\n+                capabilities: ordered,\n+            }\n+        })\n+        .collect();\n+    rows.sort_by(|a, b| a.username.cmp(&b.username));\n+    rows\n+}\n+\n+fn room_members_inner(members: &[RoomMemberRow]) -> Markup {\n+    html! {\n+        h3 { \"members\" }\n+        ul class=\"room-members\" {\n+            @for member in members {\n+                li {\n+                    span class=\"room-member-name\" { \"@\" (member.username) }\n+                    span class=\"muted\" {\n+                        \" · \"\n+                        (member.capabilities.join(\", \"))\n+                    }\n+                }\n+            }\n+        }\n+    }\n+}\n+\n+/// Fragment for `#room-members-section` — expand/collapse is server-driven via `POST /ui`.\n+pub(crate) fn room_members_section_markup(\n+    reduced: &ReducerState,\n+    room_id: &str,\n+    members_expanded: bool,\n+) -> Markup {\n+    let members = room_members_for_room(reduced, room_id);\n+    if members.is_empty() {\n+        return html! {};\n+    }\n+    html! {\n+        div id=\"room-members-section\" {\n+            @if members_expanded {\n+                form method=\"POST\" action=\"/ui\" {\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::SetRoomMembersExpanded {\n+                        room_wire: room_id.to_string(),\n+                        expanded: false,\n+                    }).expect(\"static json\"));\n+                    button type=\"submit\" class=\"form-toggle\" aria-expanded=\"true\" {\n+                        \"hide members & permissions\"\n+                    }\n+                }\n+                section class=\"room-members-panel\" {\n+                    (room_members_inner(&members))\n+                }\n+            } @else {\n+                form method=\"POST\" action=\"/ui\" {\n+                    input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::SetRoomMembersExpanded {\n+                        room_wire: room_id.to_string(),\n+                        expanded: true,\n+                    }).expect(\"static json\"));\n+                    button type=\"submit\" class=\"form-toggle\" aria-expanded=\"false\" {\n+                        \"members & permissions\"\n+                    }\n+                }\n+            }\n+        }\n+    }\n+}\n","role":"user"}],"model":"openai/gpt-chat-latest"}