You are a constitutional council ranking individual git commits for ownership allocation.

Compare these two commits. Decide which contributed more lasting value to the project.

Judge substance, not spectacle:
- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.
- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.
- Do not favor a side merely because its patch is longer or noisier.
- Weight what the change does for the project, not the contributor's name.

Return ONLY a JSON object: {"winner": "A" or "B", "ratio": "N:M", "explanation": "..."}
The explanation must cite concrete differences in the patches (1-3 sentences).

Side A — contributor: tommy-mor
Side A — commit message:
[a888d56c] refactor: centralize path identity in slug-types

Move canonicalization and CanonicalItemUrl into types::paths with
GardenItemUrl, ForumThreadUrl, and TildeOntologyPath for JSON hrefs.
Server canonical_path and path_types re-export slug-types; RPC and
validation build hrefs via those types instead of string helpers.

Made-with: Cursor

Side A — unified diff (full patch):
diff --git a/server/src/api/helpers.rs b/server/src/api/helpers.rs
index 9b71491e9f9efc44a2a4beba09be8f64bd2ff2ee..03b3e77911ccd662bec8635345dafe2593cf242e 100644
--- a/server/src/api/helpers.rs
+++ b/server/src/api/helpers.rs
@@ -4,12 +4,12 @@ use axum::{
     Json,
 };
 use sha2::{Digest, Sha256};
+use slug_types::paths::{CanonicalItemUrl, GardenItemUrl};
 use slug_types::*;
 use std::collections::HashMap;
 
 use crate::{
     canonical_path::canonicalize_item,
-    path_types::CanonicalItemUrl,
     ranking::connected_components_from_voted_pairs,
 };
 
@@ -30,64 +30,6 @@ pub fn now_ms() -> i64 {
     t.as_millis() as i64
 }
 
-/// Serialize a canonical item for JSON: absolute URLs stay as-is; bare paths get a `/` prefix.
-pub fn item_path_for_api(item: &str) -> String {
-    if item.starts_with("http://") || item.starts_with("https://") {
-        item.to_string()
-    } else {
-        format!("/{}", item)
-    }
-}
-
-/// Same as [`item_path_for_api`], but for private rooms ontology items are prefixed with
-/// `/r/{short}/{slug}` so the URL matches the web app (`/r/…/~/…` routes).
-pub fn item_path_for_api_in_room(item: &str, room_wire: &str) -> String {
-    let room = room_wire.trim();
-    if room.is_empty() || room == "public" {
-        return item_path_for_api(item);
-    }
-    let Some((short, slug)) = room.split_once('/') else {
-        return item_path_for_api(item);
-    };
-    if short.is_empty() || slug.is_empty() {
-        return item_path_for_api(item);
-    }
-    let Some(c) = CanonicalItemUrl::parse(item) else {
-        return item_path_for_api(item);
-    };
-    let root = CanonicalItemUrl::ontology_root();
-    let item_norm = c.as_str().trim_end_matches('/');
-    let root_norm = root.as_str().trim_end_matches('/');
-    if let Some(tail) = c.tilde_tail() {
-        return if tail.is_empty() {
-            format!("https://slug.social/r/{short}/{slug}/~")
-        } else {
-            format!("https://slug.social/r/{short}/{slug}/~/{}", tail)
-        };
-    }
-    if item_norm == root_norm {
-        return format!("https://slug.social/r/{short}/{slug}/~");
-    }
-    item_path_for_api(item)
-}
-
-/// Absolute thread URL for forum JSON (`/t/…` vs `/r/…/t/…`).
-pub fn forum_thread_web_url(room_wire: &str, thread_tag: &str) -> String {
-    let room = room_wire.trim();
-    let tag = thread_tag.trim().trim_start_matches('#');
-    if room.is_empty() || room == "public" {
-        format!("https://slug.social/t/{tag}")
-    } else if let Some((short, slug)) = room.split_once('/') {
-        if short.is_empty() || slug.is_empty() {
-            format!("https://slug.social/t/{tag}")
-        } else {
-            format!("https://slug.social/r/{short}/{slug}/t/{tag}")
-        }
-    } else {
-        format!("https://slug.social/t/{tag}")
-    }
-}
-
 /// Resolve an item path as a first-class canonical path.
 pub fn resolve_item(item: &str) -> Result<String, String> {
     let canonical = canonicalize_item(item);
@@ -109,14 +51,12 @@ pub fn parse_parent_specs(parent: Option<&String>) -> Vec<String> {
 }
 
 /// Apply offset+limit pagination to the flattened component rankings.
-/// Items are flattened in component order (largest component first), then unranked last.
-/// Returns (components, unranked_items) after the window.
 pub fn paginate_rankings(
     components: Vec<RankComponent>,
-    unranked_items: Vec<String>,
+    unranked_items: Vec<GardenItemUrl>,
     offset: usize,
     limit: Option<usize>,
-) -> (Vec<RankComponent>, Vec<String>) {
+) -> (Vec<RankComponent>, Vec<GardenItemUrl>) {
     let mut remaining_skip = offset;
     let mut remaining_take = limit.unwrap_or(usize::MAX);
     let mut out_components: Vec<RankComponent> = Vec::new();
@@ -141,7 +81,7 @@ pub fn paginate_rankings(
         });
     }
 
-    let out_unranked: Vec<String> = if remaining_take > 0 {
+    let out_unranked: Vec<GardenItemUrl> = if remaining_take > 0 {
         unranked_items
             .into_iter()
             .skip(remaining_skip)
@@ -183,11 +123,9 @@ pub fn is_pair_voted(group: &crate::reducer::GroupState, a: &str, b: &str) -> bo
     group.voted_pairs.contains(&(i, j))
 }
 
-/// Compute graph connectivity stats for a set of items within the ranking group.
 pub fn compute_connectivity_stats(group: &crate::reducer::GroupState, pool: &[String]) -> ConnectivityStats {
     let n = pool.len();
 
-    // Map pool items to global indices (items not yet in the group get no index)
     let global_idxs: Vec<Option<usize>> = pool
         .iter()
         .map(|it| {
@@ -197,7 +135,6 @@ pub fn compute_connectivity_stats(group: &crate::reducer::GroupState, pool: &[St
         .collect();
     let present: Vec<usize> = global_idxs.iter().filter_map(|x| *x).collect();
 
-    // Build local index mapping for items that exist in the ranking group
     let global_to_local: HashMap<usize, usize> = present
         .iter()
         .enumerate()
@@ -213,7 +150,6 @@ pub fn compute_connectivity_stats(group: &crate::reducer::GroupState, pool: &[St
         }),
     );
 
-    // Items not in the ranking group at all are also isolates
     let items_not_in_group = global_idxs.iter().filter(|x| x.is_none()).count();
 
     let num_components = comps.len() + isolates.len() + items_not_in_group;
@@ -237,52 +173,3 @@ pub fn vote_touches_path(a: &str, b: &str, parent_canon: &str) -> bool {
     let under = |item: &str| item == parent_canon || item.starts_with(&format!("{}/", parent_canon));
     under(a) || under(b)
 }
-
-#[cfg(test)]
-mod wire_url_tests {
-    use super::{forum_thread_web_url, item_path_for_api_in_room};
-
-    #[test]
-    fn public_room_unchanged() {
-        let u = "https://slug.social/~/a/b";
-        assert_eq!(item_path_for_api_in_room(u, "public"), u);
-    }
-
-    #[test]
-    fn private_room_prefixes_ontology() {
-        assert_eq!(
-            item_path_for_api_in_room("https://slug.social/~/topic/x", "9ab12cd/my-room"),
-            "https://slug.social/r/9ab12cd/my-room/~/topic/x"
-        );
-    }
-
-    #[test]
-    fn private_room_ontology_root() {
-        assert_eq!(
-            item_path_for_api_in_room("https://slug.social/~", "9ab12cd/my-room"),
-            "https://slug.social/r/9ab12cd/my-room/~"
-        );
-        assert_eq!(
-            item_path_for_api_in_room("https://slug.social/~/", "9ab12cd/my-room"),
-            "https://slug.social/r/9ab12cd/my-room/~"
-        );
-    }
-
-    #[test]
-    fn external_url_untouched_in_private_room() {
-        let u = "https://example.com/z";
-        assert_eq!(item_path_for_api_in_room(u, "9ab12cd/my-room"), u);
-    }
-
-    #[test]
-    fn forum_web_public_vs_room() {
-        assert_eq!(
-            forum_thread_web_url("public", "debate"),
-            "https://slug.social/t/debate"
-        );
-        assert_eq!(
-            forum_thread_web_url("9ab12cd/my-room", "#debate"),
-            "https://slug.social/r/9ab12cd/my-room/t/debate"
-        );
-    }
-}
diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs
index 042aa248305f9362a3be78f9eea2a5abf6ba707a..cf22cb0129366c3aed031bc86f3197a4321cb806 100644
--- a/server/src/api/mod.rs
+++ b/server/src/api/mod.rs
@@ -24,8 +24,7 @@ pub use auth::{
 
 pub use helpers::{
     api_error, compute_connectivity_stats, is_pair_voted, now_ms, paginate_rankings,
-    parse_parent_specs, pick_random_distinct, sha256_hex, resolve_item, vote_touches_path,
-    item_path_for_api,
+    parse_parent_specs, pick_random_distinct, resolve_item, sha256_hex, vote_touches_path,
 };
 
 pub use rpc::handle_rpc_batch;
diff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs
index 5b91f5836625eedbb1cd9423168046e3fb576c17..5f7d50188f1381267402f2e57e671234ef5db2fd 100644
--- a/server/src/api/rpc.rs
+++ b/server/src/api/rpc.rs
@@ -8,6 +8,7 @@ use axum::{
     Json,
 };
 use rand::seq::SliceRandom;
+use slug_types::paths::{ForumThreadUrl, GardenItemUrl, TildeOntologyPath};
 use slug_types::*;
 
 use crate::{
@@ -27,9 +28,8 @@ use crate::{
 
 use super::auth::verify_bearer_principal;
 use super::helpers::{
-    compute_connectivity_stats, forum_thread_web_url, is_pair_voted, item_path_for_api,
-    item_path_for_api_in_room, now_ms, paginate_rankings, parse_parent_specs, pick_random_distinct,
-    resolve_item, vote_touches_path,
+    compute_connectivity_stats, is_pair_voted, now_ms, paginate_rankings, parse_parent_specs,
+    pick_random_distinct, resolve_item, vote_touches_path,
 };
 use super::validate::{normalize_room_and_thread, validate_ingest_document};
 
@@ -184,7 +184,7 @@ fn compute_scope_rank_changes(
         };
         if changed {
             changes.push(RankChange {
-                item: item_path_for_api_in_room(&item, room_wire),
+                item: GardenItemUrl::from_storage_str(&item, room_wire),
                 before: b,
                 after: a,
             });
@@ -206,7 +206,7 @@ fn compute_scope_rank_changes(
         parent: if parent.is_empty() {
             "/".to_string()
         } else {
-            item_path_for_api_in_room(parent, room_wire)
+            GardenItemUrl::from_storage_str(parent, room_wire).into_inner()
         },
         changes,
     })
@@ -302,7 +302,7 @@ fn build_rank_response_for_content(
                     .ranked
                     .into_iter()
                     .map(|r| RankRow {
-                        item: item_path_for_api_in_room(r.item.as_str(), room_wire),
+                        item: GardenItemUrl::from_stored(&r.item, room_wire),
                         percent: if want_percent {
                             Some((r.score / max_score) * 100.0)
                         } else {
@@ -315,10 +315,10 @@ fn build_rank_response_for_content(
         })
         .collect();
 
-    let prefixed_unranked: Vec<String> = rankings
+    let prefixed_unranked: Vec<GardenItemUrl> = rankings
         .unranked_items
         .into_iter()
-        .map(|s| item_path_for_api_in_room(s.as_str(), room_wire))
+        .map(|s| GardenItemUrl::from_stored(&s, room_wire))
         .collect();
 
     let (components, unranked_items) = if offset > 0 || limit.is_some() {
@@ -537,13 +537,13 @@ async fn rpc_post(
         (
             "npx slugsocial public garden pair".to_string(),
             "npx slugsocial public garden rank".to_string(),
-            forum_thread_web_url("public", &thread_id),
+            ForumThreadUrl::from_room_tag("public", &thread_id),
         )
     } else {
         (
             format!("npx slugsocial private {room_key} garden pair"),
             format!("npx slugsocial private {room_key} garden rank"),
-            forum_thread_web_url(&room_key, &thread_id),
+            ForumThreadUrl::from_room_tag(&room_key, &thread_id),
         )
     };
 
@@ -664,7 +664,7 @@ async fn rpc_check(
                         .ranked
                         .into_iter()
                         .map(|r| RankRow {
-                            item: item_path_for_api_in_room(r.item.as_str(), &room_key),
+                            item: GardenItemUrl::from_stored(&r.item, &room_key),
                             score: r.score,
                             percent: None,
                         })
@@ -672,12 +672,12 @@ async fn rpc_check(
                 })
                 .collect();
             CheckScopeRanking {
-                parent: item_path_for_api_in_room(parent.as_str(), &room_key),
+                parent: GardenItemUrl::from_stored(parent, &room_key).into_inner(),
                 components,
                 unranked_items: scoped
                     .unranked_items
                     .into_iter()
-                    .map(|it| item_path_for_api_in_room(it.as_str(), &room_key))
+                    .map(|it| GardenItemUrl::from_stored(&it, &room_key))
                     .collect(),
             }
         })
@@ -687,13 +687,13 @@ async fn rpc_check(
         vec![
             "npx slugsocial public forum post <TAG> --delegate <uuid:rig:model>".to_string(),
             "npx slugsocial public forum list".to_string(),
-            forum_thread_web_url("public", &thread_id),
+            ForumThreadUrl::from_room_tag("public", &thread_id).into_inner(),
         ]
     } else {
         vec![
             format!("npx slugsocial private {room_key} forum post <TAG> --delegate <uuid:rig:model>"),
             format!("npx slugsocial private {room_key} forum list"),
-            forum_thread_web_url(&room_key, &thread_id),
+            ForumThreadUrl::from_room_tag(&room_key, &thread_id).into_inner(),
         ]
     };
 
@@ -717,7 +717,7 @@ fn rpc_list_forum_threads(reduced: &ReducerState, room: &str) -> ThreadsResponse
         .map(|((_, tag), ts)| ThreadSummary {
             thread: format!("#{tag}"),
             last_activity_ts: ts.last_activity_ts,
-            web: forum_thread_web_url(room, tag),
+            web: ForumThreadUrl::from_room_tag(room, tag),
         })
         .collect();
     out.sort_by(|a, b| b.last_activity_ts.cmp(&a.last_activity_ts));
@@ -885,7 +885,7 @@ fn rpc_search(reduced: &ReducerState, q: &str, limit: usize, principal: Option<&
         }
         if score > 0 {
             scored_items.push((score, SearchItemHit {
-                path: item_path_for_api(item.as_str()),
+                path: GardenItemUrl::from_storage_str(item.as_str(), "public"),
                 body: content.item_bodies.get(item).map(|b| snippet_around(b, &words, 120)),
             }));
         }
@@ -1058,8 +1058,8 @@ async fn rpc_get_pair(state: &AppState, room: String, parent_path: String) -> Re
         .collect();
     let cs = compute_connectivity_stats(&content.ranking_group, &pool);
     Ok(RpcResult::Pair(PairResponse {
-        left: item_path_for_api_in_room(&left, &room),
-        right: item_path_for_api_in_room(&right, &room),
+        left: GardenItemUrl::from_storage_str(&left, &room),
+        right: GardenItemUrl::from_storage_str(&right, &room),
         left_body: lb,
         right_body: rb,
         threads: th,
@@ -1137,7 +1137,7 @@ pub async fn handle_rpc_batch(
                 if !content.items.contains(&item) {
                     line_err(
                         "item not found",
-                        Some(format!("{} does not exist", item_path_for_api_in_room(&item_str, &room))),
+                        Some(format!("{} does not exist", GardenItemUrl::from_storage_str(&item_str, &room))),
                     )
                 } else {
                     const MAX_ITEM_BODY: usize = 10_000;
@@ -1160,7 +1160,7 @@ pub async fn handle_rpc_batch(
                         .map(|s| s.iter().cloned().collect())
                         .unwrap_or_default();
                     line_ok(RpcResult::GardenItem(ItemResponse {
-                        item: item_path_for_api_in_room(&item_str, &room),
+                        item: GardenItemUrl::from_storage_str(&item_str, &room),
                         body,
                         truncated,
                         body_len,
@@ -1554,7 +1554,7 @@ pub async fn handle_rpc_batch(
                     for r in items {
                         let pct = want_percent.then(|| ((r.score - bot) / range * 100.0).clamp(0.0, 100.0));
                         ranked.push(RankRow {
-                            item: item_path_for_api_in_room(r.item.as_str(), &room),
+                            item: GardenItemUrl::from_storage_str(r.item.as_str(), &room),
                             score: r.score,
                             percent: pct,
                         });
@@ -1574,7 +1574,7 @@ pub async fn handle_rpc_batch(
                 let page: Vec<RankRow> = ranked
                     .into_iter()
                     .chain(unranked.into_iter().map(|it| RankRow {
-                        item: item_path_for_api_in_room(&it, &room),
+                        item: GardenItemUrl::from_storage_str(&it, &room),
                         score: 0.0,
                         percent: want_percent.then_some(0.0),
                     }))
@@ -1618,7 +1618,7 @@ pub async fn handle_rpc_batch(
                 if !content.items.contains(&item) {
                     line_err(
                         "item not found",
-                        Some(format!("{} does not exist", item_path_for_api_in_room(&item_str, &room))),
+                        Some(format!("{} does not exist", GardenItemUrl::from_storage_str(&item_str, &room))),
                     )
                 } else {
                     let votes: Vec<VoteRow> = content
@@ -1629,8 +1629,8 @@ pub async fn handle_rpc_batch(
                                 .take(limit)
                                 .map(|v| VoteRow {
                                     ts: v.ts,
-                                    a: item_path_for_api_in_room(v.a.as_str(), &room),
-                                    b: item_path_for_api_in_room(v.b.as_str(), &room),
+                                    a: GardenItemUrl::from_stored(&v.a, &room),
+                                    b: GardenItemUrl::from_stored(&v.b, &room),
                                     ratio: format!("{}:{}", v.ratio_left, v.ratio_right),
                                     actor: Some(v.principal.clone()),
                                     body: v.body.clone(),
@@ -1640,7 +1640,7 @@ pub async fn handle_rpc_batch(
                         })
                         .unwrap_or_default();
                     line_ok(RpcResult::Matchup(MatchupResponse {
-                        item: item_path_for_api_in_room(&item_str, &room),
+                        item: GardenItemUrl::from_storage_str(&item_str, &room),
                         votes,
                     }))
                 }
@@ -1667,8 +1667,8 @@ pub async fn handle_rpc_batch(
                                     if a == item_str || b == item_str {
                                         Some(VoteRow {
                                             ts: e.ts,
-                                            a: item_path_for_api_in_room(&a, &room),
-                                            b: item_path_for_api_in_room(&b, &room),
+                                            a: GardenItemUrl::from_storage_str(&a, &room),
+                                            b: GardenItemUrl::from_storage_str(&b, &room),
                                             ratio: format!("{}:{}", ratio_left, ratio_right),
                                             actor: reduced.ingests_by_id.get(&e.post_id).map(|ing| ing.principal.clone()),
                                             body: explanation,
@@ -1704,7 +1704,7 @@ pub async fn handle_rpc_batch(
                     }
                 }).collect();
                 line_ok(RpcResult::RankHistory(RankHistoryResponse {
-                    item: item_path_for_api_in_room(&item_str, &room),
+                    item: GardenItemUrl::from_storage_str(&item_str, &room),
                     history,
                 }))
                 }
@@ -1716,17 +1716,13 @@ pub async fn handle_rpc_batch(
                 } else {
                 let content = content_for_room(&reduced, &room);
                 let parents: HashSet<&str> = content.item_children.keys().map(|s| s.as_str()).collect();
-                let mut paths: Vec<String> = content
+                let mut paths: Vec<GardenItemUrl> = content
                     .items
                     .iter()
                     .filter(|p| !parents.contains(p.as_str()))
-                    .map(|p| p.as_str().to_string())
-                    .collect();
-                paths.sort();
-                let paths: Vec<String> = paths
-                    .into_iter()
-                    .map(|p| item_path_for_api_in_room(&p, &room))
+                    .map(|p| GardenItemUrl::from_stored(p, &room))
                     .collect();
+                paths.sort_by(|a, b| a.as_str().cmp(b.as_str()));
                 line_ok(RpcResult::Leaves(LeavesResponse { paths }))
                 }
             },
@@ -1743,24 +1739,13 @@ pub async fn handle_rpc_batch(
                         let mut v: Vec<PathSummary> = roots.iter()
                             .map(|path| {
                                 let children = content.item_children.get(path.as_str()).map(|s| s.len()).unwrap_or(0);
-                                let path_label = CanonicalItemUrl::parse(path.as_str())
-                                    .and_then(|c| {
-                                        c.tilde_tail().map(|t| {
-                                            if t.is_empty() {
-                                                "~/".to_string()
-                                            } else {
-                                                format!("~/{}", t)
-                                            }
-                                        })
-                                    })
-                                    .unwrap_or_else(|| path.to_string());
                                 PathSummary {
-                                    path: path_label,
+                                    path: TildeOntologyPath::from_stored(path),
                                     children,
-                                    web: item_path_for_api_in_room(path.as_str(), &room),
+                                    web: GardenItemUrl::from_stored(path, &room),
                                 }
                             }).collect();
-                        v.sort_by(|a, b| a.path.cmp(&b.path));
+                        v.sort_by(|a, b| a.path.as_str().cmp(b.path.as_str()));
                         v
                     })
                     .unwrap_or_default();
@@ -1790,8 +1775,8 @@ pub async fn handle_rpc_batch(
                     .take(limit)
                     .map(|v| VoteRow {
                         ts: v.ts,
-                        a: item_path_for_api_in_room(v.a.as_str(), &room),
-                        b: item_path_for_api_in_room(v.b.as_str(), &room),
+                        a: GardenItemUrl::from_stored(&v.a, &room),
+                        b: GardenItemUrl::from_stored(&v.b, &room),
                         ratio: format!("{}:{}", v.ratio_left, v.ratio_right),
                         actor: Some(v.principal.clone()),
                         body: v.body.clone(),
diff --git a/server/src/api/validate.rs b/server/src/api/validate.rs
index 27150577982f52cbd6d11bb93654dc3d4cf75cc5..a51c783ee9785569b5a44c0b1572471fe00d174b 100644
--- a/server/src/api/validate.rs
+++ b/server/src/api/validate.rs
@@ -7,8 +7,9 @@ use crate::{
     path_types::CanonicalItemUrl,
     reducer::{ReducerState, ScopeId},
 };
+use slug_types::paths::GardenItemUrl;
 
-use super::helpers::{item_path_for_api, resolve_item};
+use super::helpers::resolve_item;
 
 #[derive(Debug)]
 pub struct ValidatedIngest {
@@ -22,6 +23,10 @@ pub fn validate_ingest_document(
     text: &str,
     scope: &ScopeId,
 ) -> Result<ValidatedIngest, (StatusCode, String, Option<String>)> {
+    let room_wire = match scope {
+        ScopeId::Public => "public",
+        ScopeId::Room(r) => r.as_str(),
+    };
     let public_content = reduced.public();
     let scoped_content = match scope {
         ScopeId::Public => None,
@@ -61,14 +66,14 @@ pub fn validate_ingest_document(
                 let Some(body_text) = body else {
                     return Err((
                         StatusCode::BAD_REQUEST,
-                        format!("item missing body: {}", item_path_for_api(&item)),
+                        format!("item missing body: {}", GardenItemUrl::from_storage_str(&item, room_wire)),
                         Some("items must be declared with bodies, e.g. `~/path/item { ... }`".to_string()),
                     ));
                 };
                 if body_text.trim().is_empty() {
                     return Err((
                         StatusCode::BAD_REQUEST,
-                        format!("item body is empty: {}", item_path_for_api(&item)),
+                        format!("item body is empty: {}", GardenItemUrl::from_storage_str(&item, room_wire)),
                         Some("write at least one sentence inside `{ ... }`".to_string()),
                     ));
                 }
@@ -101,7 +106,7 @@ pub fn validate_ingest_document(
                         let key = CanonicalItemUrl((*it).clone());
                         !defined_in_doc.contains(*it) && !item_exists(&key)
                     })
-                    .map(|it| item_path_for_api(it))
+                    .map(|it| GardenItemUrl::from_storage_str(it, room_wire).into_inner())
                     .collect();
                 if !missing.is_empty() {
                     return Err((
@@ -119,7 +124,7 @@ pub fn validate_ingest_document(
                         let key = CanonicalItemUrl((*it).clone());
                         !defined_in_doc.contains(*it) && !body_exists(&key)
                     })
-                    .map(|it| item_path_for_api(it))
+                    .map(|it| GardenItemUrl::from_storage_str(it, room_wire).into_inner())
                     .collect();
                 if !missing_body.is_empty() {
                     return Err((
diff --git a/server/src/canonical_path.rs b/server/src/canonical_path.rs
index 5c0febe883d8b3978a25896ed0d71df8509a8717..8a1998025121838b0867f8c5ddbd28aea41a23d2 100644
--- a/server/src/canonical_path.rs
+++ b/server/src/canonical_path.rs
@@ -1,92 +1,3 @@
-//! Normalization for thread tags and ontology item URLs (DSL ↔ stored canonical form).
-//! Not event types — see `events` and `path_types`.
+//! Re-exports — implementations live in `slug-types` (`paths` module).
 
-/// Thread / public tag: stored without leading `#`, lowercase.
-pub fn canonicalize_tag(input: &str) -> String {
-    input.trim().trim_start_matches('#').to_lowercase()
-}
-
-/// Ontology item reference → canonical absolute URL on the slug host.
-pub fn canonicalize_item(input: &str) -> String {
-    let s = input.trim();
-    if s.is_empty() {
-        return String::new();
-    }
-
-    if let Some(rest) = s.strip_prefix("https://") {
-        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
-        let host = host.trim().to_lowercase();
-        if tail.is_empty() {
-            return format!("https://{}", host);
-        } else {
-            return format!("https://{}/{}", host, tail);
-        }
-    }
-    if let Some(rest) = s.strip_prefix("http://") {
-        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
-        let host = host.trim().to_lowercase();
-        if tail.is_empty() {
-            return format!("http://{}", host);
-        } else {
-            return format!("http://{}/{}", host, tail);
-        }
-    }
-
-    let is_tilde = s.starts_with("~/");
-    let rest = s.strip_prefix("~/").or_else(|| s.strip_prefix("/")).unwrap_or(s);
-
-    let tail = rest
-        .split('/')
-        .filter_map(|seg| {
-            let t = seg.trim();
-            if t.is_empty() {
-                None
-            } else {
-                Some(t.to_lowercase())
-            }
-        })
-        .collect::<Vec<_>>()
-        .join("/");
-
-    if is_tilde {
-        format!("https://slug.social/~/{}", tail)
-    } else if tail.is_empty() {
-        "https://slug.social".to_string()
-    } else {
-        format!("https://slug.social/{}", tail)
-    }
-}
-
-pub fn item_path_segments(input: &str) -> Vec<String> {
-    let canonical = canonicalize_item(input);
-    if canonical.is_empty() {
-        return vec![];
-    }
-
-    if let Some(rest) = canonical.strip_prefix("https://") {
-        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
-        let mut out = vec![format!("https://{}", host)];
-        out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));
-        return out;
-    }
-    if let Some(rest) = canonical.strip_prefix("http://") {
-        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
-        let mut out = vec![format!("http://{}", host)];
-        out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));
-        return out;
-    }
-
-    canonical
-        .split('/')
-        .filter(|s| !s.is_empty())
-        .map(|s| s.to_string())
-        .collect()
-}
-
-pub fn item_parent_path(input: &str) -> Option<String> {
-    let segs = item_path_segments(input);
-    if segs.len() <= 1 {
-        return None;
-    }
-    Some(segs[..segs.len() - 1].join("/"))
-}
+pub use slug_types::paths::{canonicalize_item, canonicalize_tag, item_parent_path, item_path_segments};
diff --git a/server/src/html/forum.rs b/server/src/html/forum.rs
index ab7970feca47a4431ddc19dab2c8186180b78413..f789e347dc136f8ffd356f4492f0bd76cea04bf0 100644
--- a/server/src/html/forum.rs
+++ b/server/src/html/forum.rs
@@ -697,7 +697,7 @@ async fn thread_view_inner(
     let offset = q.offset.unwrap_or(0);
     let page_ids: Vec<String> = all_ids.into_iter().skip(offset).take(PAGE_SIZE).collect();
 
-    let (display_ingests, subtitle) = {
+    let (display_ingests, _subtitle) = {
         let reduced = state.reduced.read().await;
         let ingests = page_ids
             .iter()
diff --git a/server/src/path_types.rs b/server/src/path_types.rs
index cad58cac7da948f92d6ea2a5587d917ab21d57ea..4c8075bbd488f1b9a5eda9e03ced83f6238c6d5e 100644
--- a/server/src/path_types.rs
+++ b/server/src/path_types.rs
@@ -1,260 +1,3 @@
-//! Path representation types.
-//!
-//! The codebase currently treats item identifiers as strings in a few different
-//! encodings:
-//! - user/DSL input like `~/a/b`
-//! - canonical item URLs like `https://slug.social/~/a/b`
-//! - relative paths within a rooted tree view (e.g. `llms/openai` under a root)
-//!
-//! This module adds lightweight newtypes so code can be explicit about what it
-//! expects without changing core storage formats.
-//!
-//! **Storage vs wire:** [`CanonicalItemUrl`] values are shared across scopes
-//! (`https://slug.social/~/…`); which [`crate::reducer::ContentState`] they live in
-//! is determined by scope, not by embedding the room id in the string. For JSON/RPC
-//! and browser links in a private room, use [`crate::api::helpers::item_path_for_api_in_room`]
-//! so ontology items become `https://slug.social/r/{short}/{slug}/~/…`.
+//! Re-exports — implementations live in `slug-types` (`paths` module).
 
-use std::borrow::Borrow;
-use std::fmt;
-
-use serde::{Deserialize, Serialize};
-
-use crate::canonical_path::canonicalize_item;
-
-/// Canonical item identifier as produced by `canonical_path::canonicalize_item`.
-///
-/// In practice this is usually:
-/// - `https://slug.social/~/...` for ontology items, or
-/// - `https://...` / `http://...` for URL items.
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
-pub struct CanonicalItemUrl(pub String);
-
-impl CanonicalItemUrl {
-    pub fn parse(input: &str) -> Option<Self> {
-        let c = canonicalize_item(input);
-        if c.is_empty() {
-            None
-        } else {
-            Some(Self(c))
-        }
-    }
-
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-
-    /// Returns the `~/...` tail for ontology items (`https://slug.social/~/...`).
-    pub fn tilde_tail(&self) -> Option<&str> {
-        self.0.strip_prefix("https://slug.social/~/")
-    }
-
-    /// Returns the final non-empty `/`-separated segment of the path.
-    ///
-    /// `https://slug.social/~/a/b/c` → `"c"`
-    /// `https://slug.social/~/a`     → `"a"`
-    pub fn last_segment(&self) -> &str {
-        self.0
-            .rsplit('/')
-            .find(|s| !s.is_empty())
-            .unwrap_or(self.0.as_str())
-    }
-
-    /// The ontology root key as stored in `item_children`: `"https://slug.social/~"`.
-    /// Use this (not `parse("~/")`) when looking up top-level children.
-    pub fn ontology_root() -> Self {
-        Self("https://slug.social/~".to_string())
-    }
-
-    /// Returns the parent of this canonical item URL by stripping the last
-    /// path segment, or `None` if there is no parent (already at root).
-    ///
-    /// `https://slug.social/~/a/b/c` → `Some("https://slug.social/~/a/b")`
-    /// `https://slug.social/~/a`     → `Some("https://slug.social/~")`
-    /// `https://slug.social/~/`      → `None`  (tilde root)
-    pub fn parent(&self) -> Option<Self> {
-        // tilde_tail() is None for non-ontology URLs and "" for the root ~/
-        if self.tilde_tail().map(|t| t.is_empty()).unwrap_or(true) {
-            return None;
-        }
-        // Strip everything from the last '/' onwards.
-        let last_slash = self.0.rfind('/')?;
-        let parent_str = &self.0[..last_slash];
-        if parent_str.is_empty() {
-            None
-        } else {
-            Some(Self(parent_str.to_string()))
-        }
-    }
-
-    /// Segments of an ontology path suitable for breadcrumb rendering.
-    /// Strips the `https://slug.social` prefix and returns the `~/…` parts.
-    ///
-    /// `https://slug.social/~/a/b` → `["~", "a", "b"]`
-    /// `https://slug.social/~/`    → `["~"]`
-    pub fn tilde_segments(&self) -> Vec<&str> {
-        match self.tilde_tail() {
-            Some(tail) if !tail.is_empty() => {
-                std::iter::once("~")
-                    .chain(tail.split('/').filter(|s| !s.is_empty()))
-                    .collect()
-            }
-            Some(_) => vec!["~"],
-            None => vec![],
-        }
-    }
-}
-
-impl fmt::Display for CanonicalItemUrl {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        self.0.fmt(f)
-    }
-}
-
-/// Allow `HashMap<CanonicalItemUrl, _>` to be searched by `&str`.
-impl Borrow<str> for CanonicalItemUrl {
-    fn borrow(&self) -> &str {
-        &self.0
-    }
-}
-
-impl PartialEq<str> for CanonicalItemUrl {
-    fn eq(&self, other: &str) -> bool {
-        self.0 == other
-    }
-}
-
-impl PartialEq<&str> for CanonicalItemUrl {
-    fn eq(&self, other: &&str) -> bool {
-        self.0 == *other
-    }
-}
-
-impl PartialEq<String> for CanonicalItemUrl {
-    fn eq(&self, other: &String) -> bool {
-        &self.0 == other
-    }
-}
-
-/// A `~/...` input path (as used in the DSL and UX).
-///
-/// This is not canonicalized; it is a presentation/input form.
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
-pub struct TildePath(pub String);
-
-impl TildePath {
-    pub fn new(input: &str) -> Option<Self> {
-        let s = input.trim();
-        if s.starts_with("~/") && s.len() > 2 {
-            Some(Self(s.to_string()))
-        } else if s == "~/" {
-            Some(Self("~/".to_string()))
-        } else {
-            None
-        }
-    }
-
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-
-    pub fn canonicalize(&self) -> Option<CanonicalItemUrl> {
-        CanonicalItemUrl::parse(&self.0)
-    }
-}
-
-impl fmt::Display for TildePath {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        self.0.fmt(f)
-    }
-}
-
-/// A path relative to a chosen root in a tree UI.
-///
-/// This is intended for compact state encodings (blobs). It must be joined to a
-/// root `CanonicalItemUrl` (typically an ontology root) to become a full item.
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
-pub struct RelativePath(pub String);
-
-impl RelativePath {
-    pub fn new(input: &str) -> Option<Self> {
-        let s = input.trim().trim_matches('/');
-        if s.is_empty() {
-            Some(Self(String::new()))
-        } else {
-            // Keep this permissive: the DSL parser is the main gatekeeper.
-            Some(Self(s.to_string()))
-        }
-    }
-
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-
-    /// Join this relative path under a canonical ontology root
-    /// (`https://slug.social/~/...`) to form a canonical item URL.
-    pub fn join_under_ontology_root(&self, root: &CanonicalItemUrl) -> Option<CanonicalItemUrl> {
-        let base = root.tilde_tail()?;
-        // base is the tail after https://slug.social/~/, e.g. "models" or "models/llms"
-        let joined = if base.is_empty() {
-            if self.0.is_empty() {
-                "~/".to_string()
-            } else {
-                format!("~/{}", self.0)
-            }
-        } else if self.0.is_empty() {
-            format!("~/{}", base)
-        } else {
-            format!("~/{}/{}", base.trim_end_matches('/'), self.0)
-        };
-        CanonicalItemUrl::parse(&joined)
-    }
-}
-
-impl fmt::Display for RelativePath {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        self.0.fmt(f)
-    }
-}
-
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn canonical_parent_deep() {
-        let c = CanonicalItemUrl::parse("~/a/b/c").unwrap();
-        assert_eq!(c.parent().unwrap().as_str(), "https://slug.social/~/a/b");
-    }
-
-    #[test]
-    fn canonical_parent_one_level() {
-        let c = CanonicalItemUrl::parse("~/a").unwrap();
-        assert_eq!(c.parent().unwrap().as_str(), "https://slug.social/~");
-    }
-
-    #[test]
-    fn canonical_parent_root_is_none() {
-        let root = CanonicalItemUrl::parse("~/").unwrap();
-        assert!(root.parent().is_none());
-    }
-
-    #[test]
-    fn tilde_segments_deep() {
-        let c = CanonicalItemUrl::parse("~/a/b").unwrap();
-        assert_eq!(c.tilde_segments(), vec!["~", "a", "b"]);
-    }
-
-    #[test]
-    fn tilde_segments_root() {
-        let c = CanonicalItemUrl::parse("~/").unwrap();
-        assert_eq!(c.tilde_segments(), vec!["~"]);
-    }
-
-    #[test]
-    fn tilde_segments_non_ontology_is_empty() {
-        let c = CanonicalItemUrl::parse("https://example.com/foo").unwrap();
-        assert_eq!(c.tilde_segments(), Vec::<&str>::new());
-    }
-}
+pub use slug_types::paths::{CanonicalItemUrl, RelativePath, TildePath};
diff --git a/types/src/lib.rs b/types/src/lib.rs
index c1cde3b783d03b02783385b5f07659fb112aae3e..5fc867bf2af84c2ca63fa1cdd03413110ad784a3 100644
--- a/types/src/lib.rs
+++ b/types/src/lib.rs
@@ -1,7 +1,13 @@
 use serde::{Deserialize, Serialize};
 
+pub mod paths;
 pub mod timeago;
 
+pub use paths::{
+    canonicalize_item, canonicalize_tag, item_parent_path, item_path_segments, CanonicalItemUrl,
+    ForumThreadUrl, GardenItemUrl, RelativePath, TildeOntologyPath, TildePath,
+};
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct ApiError {
     pub ok: bool,
@@ -12,7 +18,7 @@ pub struct ApiError {
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct RankRow {
-    pub item: String,
+    pub item: GardenItemUrl,
     pub score: f64,
     /// Normalized score as a percentage of the top item (0–100). Present when ?percent=true.
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -43,7 +49,7 @@ pub struct RankComponent {
 #[derive(Debug, Serialize, Deserialize)]
 pub struct RankResponse {
     pub components: Vec<RankComponent>,
-    pub unranked_items: Vec<String>,
+    pub unranked_items: Vec<GardenItemUrl>,
 }
 
 /// Graph connectivity stats for a scope, returned with pair suggestions.
@@ -63,8 +69,8 @@ pub struct ConnectivityStats {
 
 #[derive(Debug, Serialize, Deserialize)]
 pub struct PairResponse {
-    pub left: String,
-    pub right: String,
+    pub left: GardenItemUrl,
+    pub right: GardenItemUrl,
     pub left_body: Option<String>,
     pub right_body: Option<String>,
     /// Thread tags that discuss either item (connective tissue to forum).
@@ -79,7 +85,7 @@ pub struct PairResponse {
 pub struct NextMoves {
     pub pair: String,
     pub rank: String,
-    pub web: String,
+    pub web: ForumThreadUrl,
 }
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -90,14 +96,14 @@ pub struct PathsResponse {
 /// Leaf items only (no children). For search / "full path list" — does not scale, works for now.
 #[derive(Debug, Serialize, Deserialize)]
 pub struct LeavesResponse {
-    pub paths: Vec<String>,
+    pub paths: Vec<GardenItemUrl>,
 }
 
 #[derive(Debug, Serialize, Deserialize)]
 pub struct PathSummary {
-    pub path: String,
+    pub path: TildeOntologyPath,
     pub children: usize,
-    pub web: String,
+    pub web: GardenItemUrl,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -109,7 +115,7 @@ pub struct ThreadsResponse {
 pub struct ThreadSummary {
     pub thread: String,
     pub last_activity_ts: i64,
-    pub web: String,
+    pub web: ForumThreadUrl,
 }
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -178,7 +184,7 @@ pub struct IngestRow {
 
 #[derive(Debug, Serialize, Deserialize)]
 pub struct ItemResponse {
-    pub item: String,
+    pub item: GardenItemUrl,
     pub body: Option<String>,
     /// True when the body was truncated due to size. Fetch with `?full=true` for the complete body.
     #[serde(default, skip_serializing_if = "std::ops::Not::not")]
@@ -201,15 +207,15 @@ pub struct RecentVotesResponse {
 /// Vote history for one item (matchup: wins/losses + thread per vote).
 #[derive(Debug, Serialize, Deserialize)]
 pub struct MatchupResponse {
-    pub item: String,
+    pub item: GardenItemUrl,
     pub votes: Vec<VoteRow>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct VoteRow {
     pub ts: i64,
-    pub a: String,
-    pub b: String,
+    pub a: GardenItemUrl,
+    pub b: GardenItemUrl,
     pub ratio: String,
     /// Principal username when present (stored form, no `@`).
     pub actor: Option<String>,
@@ -510,7 +516,7 @@ pub struct RankPosition {
 /// How one item's rank changed after a vote.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct RankChange {
-    pub item: String,
+    pub item: GardenItemUrl,
     /// Position before the vote. None = was unranked (no voted connections in this scope).
     pub before: Option<RankPosition>,
     /// Position after the vote. None = became unranked (e.g. component split, unlikely).
@@ -544,7 +550,7 @@ pub struct CheckScopeRanking {
     /// Parent scope path (e.g. "/models" or "/" for root).
     pub parent: String,
     pub components: Vec<RankComponent>,
-    pub unranked_items: Vec<String>,
+    pub unranked_items: Vec<GardenItemUrl>,
 }
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -567,7 +573,7 @@ pub struct SearchResponse {
 
 #[derive(Debug, Serialize, Deserialize)]
 pub struct SearchItemHit {
-    pub path: String,
+    pub path: GardenItemUrl,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub body: Option<String>,
 }
@@ -614,7 +620,7 @@ pub struct RankHistoryRow {
 
 #[derive(Debug, Serialize, Deserialize)]
 pub struct RankHistoryResponse {
-    pub item: String,
+    pub item: GardenItemUrl,
     pub history: Vec<RankHistoryRow>,
 }
 
diff --git a/types/src/paths.rs b/types/src/paths.rs
new file mode 100644
index 0000000000000000000000000000000000000000..2950a7502255927583fbacdfd2adb700f0b0c221
--- /dev/null
+++ b/types/src/paths.rs
@@ -0,0 +1,498 @@
+//! Canonical paths, storage ids, and JSON href newtypes. All normalization and
+//! room-aware URL rules for items live here.
+
+use std::borrow::Borrow;
+use std::fmt;
+
+use serde::{Deserialize, Serialize};
+
+// ---------------------------------------------------------------------------
+// Normalization (moved from server `canonical_path`)
+// ---------------------------------------------------------------------------
+
+/// Thread / public tag: stored without leading `#`, lowercase.
+pub fn canonicalize_tag(input: &str) -> String {
+    input.trim().trim_start_matches('#').to_lowercase()
+}
+
+/// Ontology item reference → canonical absolute URL on the slug host.
+pub fn canonicalize_item(input: &str) -> String {
+    let s = input.trim();
+    if s.is_empty() {
+        return String::new();
+    }
+
+    if let Some(rest) = s.strip_prefix("https://") {
+        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
+        let host = host.trim().to_lowercase();
+        if tail.is_empty() {
+            return format!("https://{}", host);
+        } else {
+            return format!("https://{}/{}", host, tail);
+        }
+    }
+    if let Some(rest) = s.strip_prefix("http://") {
+        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
+        let host = host.trim().to_lowercase();
+        if tail.is_empty() {
+            return format!("http://{}", host);
+        } else {
+            return format!("http://{}/{}", host, tail);
+        }
+    }
+
+    let is_tilde = s.starts_with("~/");
+    let rest = s.strip_prefix("~/").or_else(|| s.strip_prefix("/")).unwrap_or(s);
+
+    let tail = rest
+        .split('/')
+        .filter_map(|seg| {
+            let t = seg.trim();
+            if t.is_empty() {
+                None
+            } else {
+                Some(t.to_lowercase())
+            }
+        })
+        .collect::<Vec<_>>()
+        .join("/");
+
+    if is_tilde {
+        format!("https://slug.social/~/{}", tail)
+    } else if tail.is_empty() {
+        "https://slug.social".to_string()
+    } else {
+        format!("https://slug.social/{}", tail)
+    }
+}
+
+pub fn item_path_segments(input: &str) -> Vec<String> {
+    let canonical = canonicalize_item(input);
+    if canonical.is_empty() {
+        return vec![];
+    }
+
+    if let Some(rest) = canonical.strip_prefix("https://") {
+        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
+        let mut out = vec![format!("https://{}", host)];
+        out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));
+        return out;
+    }
+    if let Some(rest) = canonical.strip_prefix("http://") {
+        let (host, tail) = rest.split_once('/').map_or((rest, ""), |(h, t)| (h, t));
+        let mut out = vec![format!("http://{}", host)];
+        out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));
+        return out;
+    }
+
+    canonical
+        .split('/')
+        .filter(|s| !s.is_empty())
+        .map(|s| s.to_string())
+        .collect()
+}
+
+pub fn item_parent_path(input: &str) -> Option<String> {
+    let segs = item_path_segments(input);
+    if segs.len() <= 1 {
+        return None;
+    }
+    Some(segs[..segs.len() - 1].join("/"))
+}
+
+// ---------------------------------------------------------------------------
+// Storage + input path newtypes
+// ---------------------------------------------------------------------------
+
+/// Canonical item identifier as produced by [`canonicalize_item`].
+///
+/// Shared across all scopes; room is not embedded. Usually
+/// `https://slug.social/~/…` or an external `http(s)://…` URL item.
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+pub struct CanonicalItemUrl(pub String);
+
+impl CanonicalItemUrl {
+    pub fn parse(input: &str) -> Option<Self> {
+        let c = canonicalize_item(input);
+        if c.is_empty() {
+            None
+        } else {
+            Some(Self(c))
+        }
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn tilde_tail(&self) -> Option<&str> {
+        self.0.strip_prefix("https://slug.social/~/")
+    }
+
+    pub fn last_segment(&self) -> &str {
+        self.0
+            .rsplit('/')
+            .find(|s| !s.is_empty())
+            .unwrap_or(self.0.as_str())
+    }
+
+    pub fn ontology_root() -> Self {
+        Self("https://slug.social/~".to_string())
+    }
+
+    pub fn parent(&self) -> Option<Self> {
+        if self.tilde_tail().map(|t| t.is_empty()).unwrap_or(true) {
+            return None;
+        }
+        let last_slash = self.0.rfind('/')?;
+        let parent_str = &self.0[..last_slash];
+        if parent_str.is_empty() {
+            None
+        } else {
+            Some(Self(parent_str.to_string()))
+        }
+    }
+
+    pub fn tilde_segments(&self) -> Vec<&str> {
+        match self.tilde_tail() {
+            Some(tail) if !tail.is_empty() => {
+                std::iter::once("~")
+                    .chain(tail.split('/').filter(|s| !s.is_empty()))
+                    .collect()
+            }
+            Some(_) => vec!["~"],
+            None => vec![],
+        }
+    }
+
+    /// `~/…` list label for ontology items (paths index, CLI).
+    pub fn tilde_list_label(&self) -> TildeOntologyPath {
+        TildeOntologyPath::from_stored(self)
+    }
+
+    /// Absolute href for JSON/RPC and browsers for this stored id in `room`.
+    pub fn json_href(&self, room_wire: &str) -> GardenItemUrl {
+        GardenItemUrl::from_stored(self, room_wire)
+    }
+}
+
+impl fmt::Display for CanonicalItemUrl {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
+impl Borrow<str> for CanonicalItemUrl {
+    fn borrow(&self) -> &str {
+        &self.0
+    }
+}
+
+impl PartialEq<str> for CanonicalItemUrl {
+    fn eq(&self, other: &str) -> bool {
+        self.0 == other
+    }
+}
+
+impl PartialEq<&str> for CanonicalItemUrl {
+    fn eq(&self, other: &&str) -> bool {
+        self.0 == *other
+    }
+}
+
+impl PartialEq<String> for CanonicalItemUrl {
+    fn eq(&self, other: &String) -> bool {
+        &self.0 == other
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+pub struct TildePath(pub String);
+
+impl TildePath {
+    pub fn new(input: &str) -> Option<Self> {
+        let s = input.trim();
+        if s.starts_with("~/") && s.len() > 2 {
+            Some(Self(s.to_string()))
+        } else if s == "~/" {
+            Some(Self("~/".to_string()))
+        } else {
+            None
+        }
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn canonicalize(&self) -> Option<CanonicalItemUrl> {
+        CanonicalItemUrl::parse(&self.0)
+    }
+}
+
+impl fmt::Display for TildePath {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+pub struct RelativePath(pub String);
+
+impl RelativePath {
+    pub fn new(input: &str) -> Option<Self> {
+        let s = input.trim().trim_matches('/');
+        if s.is_empty() {
+            Some(Self(String::new()))
+        } else {
+            Some(Self(s.to_string()))
+        }
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn join_under_ontology_root(&self, root: &CanonicalItemUrl) -> Option<CanonicalItemUrl> {
+        let base = root.tilde_tail()?;
+        let joined = if base.is_empty() {
+            if self.0.is_empty() {
+                "~/".to_string()
+            } else {
+                format!("~/{}", self.0)
+            }
+        } else if self.0.is_empty() {
+            format!("~/{}", base)
+        } else {
+            format!("~/{}/{}", base.trim_end_matches('/'), self.0)
+        };
+        CanonicalItemUrl::parse(&joined)
+    }
+}
+
+impl fmt::Display for RelativePath {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Wire / JSON: correct-by-construction hrefs
+// ---------------------------------------------------------------------------
+
+fn api_path_or_url(item: &str) -> String {
+    if item.starts_with("http://") || item.starts_with("https://") {
+        item.to_string()
+    } else {
+        format!("/{}", item)
+    }
+}
+
+/// Ontology item as serialized in JSON (absolute URL or `/`-prefixed path).
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct GardenItemUrl(pub String);
+
+impl GardenItemUrl {
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn into_inner(self) -> String {
+        self.0
+    }
+
+    /// Stored canonical id + RPC `room` field (`"public"` or `"short/slug"`).
+    pub fn from_stored(stored: &CanonicalItemUrl, room_wire: &str) -> Self {
+        Self(garden_href_string(stored.as_str(), room_wire))
+    }
+
+    /// Like [`Self::from_stored`] but accepts a string that may already be canonical.
+    pub fn from_storage_str(stored: &str, room_wire: &str) -> Self {
+        Self(garden_href_string(stored, room_wire))
+    }
+}
+
+impl fmt::Display for GardenItemUrl {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
+fn garden_href_string(item: &str, room_wire: &str) -> String {
+    let room = room_wire.trim();
+    if room.is_empty() || room == "public" {
+        return api_path_or_url(item);
+    }
+    let Some((short, slug)) = room.split_once('/') else {
+        return api_path_or_url(item);
+    };
+    if short.is_empty() || slug.is_empty() {
+        return api_path_or_url(item);
+    }
+    let Some(c) = CanonicalItemUrl::parse(item) else {
+        return api_path_or_url(item);
+    };
+    let root = CanonicalItemUrl::ontology_root();
+    let item_norm = c.as_str().trim_end_matches('/');
+    let root_norm = root.as_str().trim_end_matches('/');
+    if let Some(tail) = c.tilde_tail() {
+        return if tail.is_empty() {
+            format!("https://slug.social/r/{short}/{slug}/~")
+        } else {
+            format!("https://slug.social/r/{short}/{slug}/~/{}", tail)
+        };
+    }
+    if item_norm == root_norm {
+        return format!("https://slug.social/r/{short}/{slug}/~");
+    }
+    api_path_or_url(item)
+}
+
+/// Forum thread URL for JSON (`/t/…` or `/r/…/t/…` on slug.social).
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct ForumThreadUrl(pub String);
+
+impl ForumThreadUrl {
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn into_inner(self) -> String {
+        self.0
+    }
+
+    pub fn from_room_tag(room_wire: &str, thread_tag: &str) -> Self {
+        let room = room_wire.trim();
+        let tag = thread_tag.trim().trim_start_matches('#');
+        Self(if room.is_empty() || room == "public" {
+            format!("https://slug.social/t/{tag}")
+        } else if let Some((short, slug)) = room.split_once('/') {
+            if short.is_empty() || slug.is_empty() {
+                format!("https://slug.social/t/{tag}")
+            } else {
+                format!("https://slug.social/r/{short}/{slug}/t/{tag}")
+            }
+        } else {
+            format!("https://slug.social/t/{tag}")
+        })
+    }
+}
+
+impl fmt::Display for ForumThreadUrl {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
+/// `~/a/b` style path for list UIs (paths index `path` field).
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct TildeOntologyPath(pub String);
+
+impl TildeOntologyPath {
+    pub fn from_stored(c: &CanonicalItemUrl) -> Self {
+        let s = match c.tilde_tail() {
+            Some(tail) if !tail.is_empty() => format!("~/{}", tail),
+            Some(_) => "~/".to_string(),
+            None => c.to_string(),
+        };
+        Self(s)
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl fmt::Display for TildeOntologyPath {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn canonical_parent_deep() {
+        let c = CanonicalItemUrl::parse("~/a/b/c").unwrap();
+        assert_eq!(c.parent().unwrap().as_str(), "https://slug.social/~/a/b");
+    }
+
+    #[test]
+    fn canonical_parent_one_level() {
+        let c = CanonicalItemUrl::parse("~/a").unwrap();
+        assert_eq!(c.parent().unwrap().as_str(), "https://slug.social/~");
+    }
+
+    #[test]
+    fn canonical_parent_root_is_none() {
+        let root = CanonicalItemUrl::parse("~/").unwrap();
+        assert!(root.parent().is_none());
+    }
+
+    #[test]
+    fn tilde_segments_deep() {
+        let c = CanonicalItemUrl::parse("~/a/b").unwrap();
+        assert_eq!(c.tilde_segments(), vec!["~", "a", "b"]);
+    }
+
+    #[test]
+    fn tilde_segments_root() {
+        let c = CanonicalItemUrl::parse("~/").unwrap();
+        assert_eq!(c.tilde_segments(), vec!["~"]);
+    }
+
+    #[test]
+    fn tilde_segments_non_ontology_is_empty() {
+        let c = CanonicalItemUrl::parse("https://example.com/foo").unwrap();
+        assert_eq!(c.tilde_segments(), Vec::<&str>::new());
+    }
+
+    #[test]
+    fn garden_public_passthrough_https() {
+        let u = "https://slug.social/~/a/b";
+        assert_eq!(GardenItemUrl::from_storage_str(u, "public").as_str(), u);
+    }
+
+    #[test]
+    fn garden_private_room_prefixes_ontology() {
+        assert_eq!(
+            GardenItemUrl::from_storage_str("https://slug.social/~/topic/x", "9ab12cd/my-room").as_str(),
+            "https://slug.social/r/9ab12cd/my-room/~/topic/x"
+        );
+    }
+
+    #[test]
+    fn garden_private_room_ontology_root() {
+        assert_eq!(
+            GardenItemUrl::from_storage_str("https://slug.social/~", "9ab12cd/my-room").as_str(),
+            "https://slug.social/r/9ab12cd/my-room/~"
+        );
+        assert_eq!(
+            GardenItemUrl::from_storage_str("https://slug.social/~/", "9ab12cd/my-room").as_str(),
+            "https://slug.social/r/9ab12cd/my-room/~"
+        );
+    }
+
+    #[test]
+    fn garden_external_url_untouched_in_private_room() {
+        let u = "https://example.com/z";
+        assert_eq!(GardenItemUrl::from_storage_str(u, "9ab12cd/my-room").as_str(), u);
+    }
+
+    #[test]
+    fn forum_web_public_vs_room() {
+        assert_eq!(
+            ForumThreadUrl::from_room_tag("public", "debate").as_str(),
+            "https://slug.social/t/debate"
+        );
+        assert_eq!(
+            ForumThreadUrl::from_room_tag("9ab12cd/my-room", "#debate").as_str(),
+            "https://slug.social/r/9ab12cd/my-room/t/debate"
+        );
+    }
+}


Side B — contributor: tommy-mor
Side B — commit message:
[7caef802] room ui wired up again

Side B — unified diff (full patch):
diff --git a/Cargo.lock b/Cargo.lock
index e31485f28717993a13e1c4caf7be15b43a97573e..8be6ff8677700ce0a56d4a53b221e25c2bb70507 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -158,6 +158,7 @@ dependencies = [
  "axum",
  "axum-core",
  "bytes",
+ "cookie",
  "fastrand",
  "futures-util",
  "http",
@@ -300,6 +301,17 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 
+[[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
diff --git a/plan2.md b/plan2.md
new file mode 100644
index 0000000000000000000000000000000000000000..1587cbe558eb0a98fbce78566bf5f93b18100e54
--- /dev/null
+++ b/plan2.md
@@ -0,0 +1,190 @@
+This is a phenomenal synthesis. You stripped away the exact parts of `evaleval` that don't scale to a multi-tenant web application (string-splicing `eval` and in-memory nonce OCAP tracking) and kept the parts that make development lightning fast (embedded declarative payloads, single endpoint routing, and Javascript AST responses). 
+
+You are entirely right about the **AST substitution in Rust**. Walking a `serde_json::Value` tree to find `{"$form": "field_name"}` and swapping the node for a String isn't a hack—in Rust, it’s just a completely standard recursive enum visitor. 
+
+Let’s lock in this exact architecture. It is cohesive, secure, and incredibly ergonomic.
+
+Here is what the code actually looks like to execute this vision.
+
+---
+
+### 1. The Safe AST Substitution
+
+This is the exact function that runs in the Web handler before giving the payload to the RPC engine. Because it operates on the JSON AST *before* deserialization, it's 100% immune to injection.
+
+```rust
+use serde_json::Value;
+use std::collections::HashMap;
+
+/// Recursively walk the JSON AST and replace {"$form": "key"} with the actual form string.
+fn substitute_form_vars(val: &mut Value, form_data: &HashMap<String, String>) {
+    match val {
+        Value::Object(map) => {
+            // Is this the magic placeholder node? {"$form": "input_name"}
+            if map.len() == 1 && map.contains_key("$form") {
+                if let Some(field_name) = map.get("$form").and_then(|v| v.as_str()) {
+                    let submitted_text = form_data.get(field_name).map(|s| s.as_str()).unwrap_or("");
+                    *val = Value::String(submitted_text.to_string());
+                    return;
+                }
+            }
+            // Otherwise, keep walking the object
+            for v in map.values_mut() {
+                substitute_form_vars(v, form_data);
+            }
+        }
+        Value::Array(arr) => {
+            // Walk arrays
+            for v in arr.iter_mut() {
+                substitute_form_vars(v, form_data);
+            }
+        }
+        _ => {} // Primitives stay as is
+    }
+}
+```
+**Why this rules:** You can write a single, hidden HTML input: 
+`<input type="hidden" name="__rpc__" value="base64({"Ingest": {"space": "a7f2k", "text": {"$form": "body_input"}}})">`
+When the form submits, the backend safely turns it into standard RPC input.
+
+---
+
+### 2. The Unified Core RPC Layer
+
+You keep exactly one execution layer that strictly enforces your domain constraints (ACLs). Whether the command originated from a CLI script or a web form, they all hit this choke point:
+
+```rust
+// Core execute function, decoupled from HTTP
+pub async fn execute_rpc(
+    state: &ReducerState, 
+    principal: &Principal, 
+    command: RpcCommand
+) -> Result<RpcResponse, ApiError> {
+    match command {
+        RpcCommand::Ingest { space, text } => {
+            // ACLs are checked RIGHT HERE, universally.
+            if !state.user_has_cap(&space, principal, ThreadCapability::Post) {
+                return Err(ApiError::Forbidden("No post access in this space".to_string()));
+            }
+            // Do the write, apply events...
+            Ok(RpcResponse::IngestOk { ... })
+        }
+        // ...
+    }
+}
+```
+
+---
+
+### 3. The `DomPatch` Builder Pattern
+
+You prefer the Builder pattern over a macro for the response mapping. I agree—builders are far easier for your IDE to autocomplete, and easier to compose dynamically (e.g., iterating over a list of items to append).
+
+```rust
+pub struct DomPatch {
+    js: String,
+}
+
+impl DomPatch {
+    pub fn new() -> Self {
+        Self { js: String::new() }
+    }
+
+    /// Morphs an element using Idiomorph
+    pub fn morph(mut self, selector: &str, html: &str) -> Self {
+        let safe_html = serde_json::to_string(html).expect("string escaping failed");
+        self.js.push_str(&format!(
+            "Idiomorph.morph(document.querySelector('{}'), {}, {{morphStyle: 'innerHTML'}});\n", 
+            selector, safe_html
+        ));
+        self
+    }
+
+    /// Appends raw HTML to an element
+    pub fn append(mut self, selector: &str, html: &str) -> Self {
+        let safe_html = serde_json::to_string(html).unwrap();
+        self.js.push_str(&format!(
+            "document.querySelector('{}')?.insertAdjacentHTML('beforeend', {});\n", 
+            selector, safe_html
+        ));
+        self
+    }
+
+    /// Executes raw javascript
+    pub fn eval(mut self, code: &str) -> Self {
+        self.js.push_str(code);
+        self.js.push('\n');
+        self
+    }
+
+    /// Consumes the builder into an HTTP Response with the right content-type
+    pub fn into_response(self) -> impl axum::response::IntoResponse {
+        (
+            axum::http::StatusCode::OK, 
+            [(axum::http::header::CONTENT_TYPE, "text/javascript")], 
+            self.js
+        )
+    }
+}
+```
+
+---
+
+### 4. The Single Web Handler (`POST /ui/action`)
+
+With the pipeline defined, you only ever have to write **one** `POST` handler for the entire Web UI.
+
+```rust
+pub async fn handle_web_action(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Form(form_data): Form<HashMap<String, String>>, // Captures everything dynamically
+) -> impl IntoResponse {
+    // 1. Authenticate using Bearer / Cookie exactly like the CLI
+    let principal = match extract_web_session(&headers, &state) {
+        Ok(p) => p,
+        Err(_) => return DomPatch::new().eval("window.location = '/auth/login';").into_response(),
+    };
+
+    // 2. Decode the Base64 JSON
+    let b64 = form_data.get("__rpc__").expect("Missing RPC payload in form");
+    let decoded = base64::decode(b64).expect("Bad b64");
+    let mut json_ast: Value = serde_json::from_slice(&decoded).expect("Bad JSON");
+
+    // 3. Do AST Substitution!
+    substitute_form_vars(&mut json_ast, &form_data);
+
+    // 4. Parse it strongly into the RPC enum
+    let command: RpcCommand = serde_json::from_value(json_ast).expect("Invalid RpcCommand");
+
+    // 5. Pass it to the core execute function (authz + mutation happens here)
+    match execute_rpc(&state.reduced.read().await, &principal, command).await {
+        Ok(RpcResponse::IngestOk { new_ranks }) => {
+            // Translate the RpcResponse to UI JS snippets
+            DomPatch::new()
+                .morph("#rank-container", &render_ranking(&new_ranks))
+                .eval("document.getElementById('ingest-form').reset();")
+                .into_response()
+        }
+        Ok(_) => DomPatch::new().eval("console.log('Action complete');").into_response(),
+        Err(e) => {
+            // Reconcile errors
+            DomPatch::new()
+                .morph("#error-banner", &format!("<div class='error'>{}</div>", e.message()))
+                .into_response()
+        }
+    }
+}
+```
+
+### The Verdict on the Grand Architecture
+
+By combining:
+1. The **Domain-Driven Asymmetry** (Spaces contain Gardens & Threads)
+2. The **Core RPC Logic** (1 executor, `Vec<RpcCommand>`, strict ACL checks)
+3. The **Single Web Form Controller** (b64 embedded, `substitute_form_vars()`)
+4. The **Javascript DomPatch Builder**
+
+You have constructed an application architecture that gives you absolute security and data integrity for your CLI AI Agents, while keeping the absolute peak hackability, form simplicity, and lightning-fast JS UI diffing of your `evaleval` Python framework. 
+
+I'm sold. It is clean, it is uniquely fitted to the mechanics of Rust (`serde`, `enums`), and it solves the URL routing fatigue problem beautifully. This is the exact way to build `slug.social` v2.
\ No newline at end of file
diff --git a/server/Cargo.toml b/server/Cargo.toml
index d527f86532c2856e29f9c6265e54c7235fdf0a8c..18c45777d662b71dc309e1daa4ddb2944da9759d 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT"
 
 [dependencies]
 axum = { version = "0.7", features = ["macros"] }
-axum-extra = { version = "0.9", features = ["query"] }
+axum-extra = { version = "0.9", features = ["query", "cookie"] }
 bytes = "1.11.1"  # pin: RUSTSEC-2026-0007
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal", "fs", "io-util"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs
index b45ba39419c84af8bf2333fc9b7d47e98525c45f..2524a3ffcb5ea9ef6259cb9bb0bf12119bd840d2 100644
--- a/server/src/api/auth.rs
+++ b/server/src/api/auth.rs
@@ -1,9 +1,11 @@
 use axum::{
+    body::Body,
     extract::{Path, Query, State},
-    http::{HeaderMap, StatusCode},
-    response::{IntoResponse, Redirect},
+    http::{header, HeaderMap, HeaderValue, StatusCode},
+    response::{IntoResponse, Redirect, Response},
     Form, Json,
 };
+use axum_extra::extract::cookie::CookieJar;
 use base64::Engine;
 use serde::Deserialize;
 use slug_types::{PendingSessionPollResponse, PendingSessionStartRequest, PendingSessionStartResponse, WhoamiResponse};
@@ -13,14 +15,47 @@ use tokio::sync::RwLock;
 use crate::{
     api::helpers::{api_error, now_ms, sha256_hex},
     events::{Event, GrantAdded, TokenIssued, UserRegistered},
-    identity::{parse_agent, parse_username},
     html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},
+    identity::{parse_agent, parse_username},
+    reducer::ReducerState,
     state::{AppState, PendingSession},
 };
 
 /// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).
 const INVITE_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000000:invite:web/join";
 
+/// Agent id for `/login` browser OAuth (no CLI); must pass [`parse_agent`].
+const WEB_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000001:social:web/browser";
+
+/// HttpOnly cookie storing the same `slug_*` bearer string the CLI uses.
+pub const SLUG_SESSION_COOKIE: &str = "slug_session";
+
+/// `Set-Cookie` header value (full attribute string).
+pub fn session_cookie_header_value(bearer: &str) -> HeaderValue {
+    let s = format!(
+        "{SLUG_SESSION_COOKIE}={bearer}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000"
+    );
+    HeaderValue::from_str(&s).expect("session cookie value must be ASCII")
+}
+
+/// Resolve the signed-in username from `Authorization: Bearer` or `slug_session` cookie.
+pub fn optional_principal(headers: &HeaderMap, jar: &CookieJar, reduced: &ReducerState) -> Option<String> {
+    if let Ok(u) = verify_bearer_principal(headers, reduced) {
+        return Some(u);
+    }
+    let c = jar.get(SLUG_SESSION_COOKIE)?;
+    verify_token(reduced, c.value()).ok()
+}
+
+fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str) -> Response {
+    Response::builder()
+        .status(StatusCode::TEMPORARY_REDIRECT)
+        .header(header::LOCATION, format!("{public_url}{path_and_query}"))
+        .header(header::SET_COOKIE, session_cookie_header_value(bearer))
+        .body(Body::empty())
+        .unwrap()
+}
+
 async fn apply_invite_redemption(state: &AppState, invite_token: &str, grantee_username: &str) -> Result<(), String> {
     let now = now_ms();
     let ga = {
@@ -306,8 +341,9 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):
                     tracing::warn!(error = %e, "invite redemption skipped after oauth");
                 }
             }
+            let cookie_bearer = bearer.clone();
             s.complete = Some((username, bearer));
-            return Redirect::temporary(&format!("{public_url}/auth/complete")).into_response();
+            return redirect_with_session_cookie(&public_url, "/", &cookie_bearer).into_response();
         }
     }
 
@@ -418,7 +454,47 @@ pub async fn post_choose_username(
         s.complete = Some((canon_user.clone(), bearer.clone()));
     }
 
-    auth_signed_in_fragment().into_response()
+    Response::builder()
+        .status(StatusCode::OK)
+        .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
+        .header(header::SET_COOKIE, session_cookie_header_value(&bearer))
+        .body(Body::from(auth_signed_in_fragment().into_string()))
+        .unwrap()
+        .into_response()
+}
+
+/// Start a browser-only OAuth flow (no CLI polling). Sets session cookie on success.
+pub async fn get_web_login(State(state): State<AppState>) -> impl IntoResponse {
+    let session = format!("p_{}", uuid::Uuid::new_v4().simple());
+    let s = PendingSession {
+        agent: WEB_BROWSER_AGENT.to_string(),
+        created_ts: now_ms(),
+        provider: None,
+        provider_id: None,
+        redeem_invite: None,
+        complete: None,
+    };
+    state.pending_sessions.write().await.insert(session.clone(), s);
+    let public_url = std::env::var("SLUG_PUBLIC_URL").unwrap_or_else(|_| "http://127.0.0.1:8080".to_string());
+    Redirect::temporary(&format!(
+        "{public_url}/auth/login?session={}",
+        urlencoding::encode(&session)
+    ))
+    .into_response()
+}
+
+pub async fn get_logout() -> impl IntoResponse {
+    let clear = format!("{SLUG_SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0");
+    Response::builder()
+        .status(StatusCode::TEMPORARY_REDIRECT)
+        .header(header::LOCATION, "/")
+        .header(
+            header::SET_COOKIE,
+            HeaderValue::from_str(&clear).expect("static cookie clears"),
+        )
+        .body(Body::empty())
+        .unwrap()
+        .into_response()
 }
 
 pub async fn post_pending_session(
diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs
index cb031aecebad1107dfa2898a98fb6084b28ba6e9..5320345a33bbb7b5ab769696a31f70347d019c3e 100644
--- a/server/src/api/mod.rs
+++ b/server/src/api/mod.rs
@@ -1,7 +1,9 @@
 mod auth;
 mod helpers;
 mod rpc;
+mod stream;
 mod validate;
+mod web_post;
 
 pub use auth::{
     get_join_invite,
@@ -13,6 +15,11 @@ pub use auth::{
     get_auth_callback,
     get_auth_complete,
     get_choose_username,
+    get_web_login,
+    get_logout,
+    optional_principal,
+    session_cookie_header_value,
+    SLUG_SESSION_COOKIE,
 };
 
 pub use helpers::{
@@ -23,8 +30,12 @@ pub use helpers::{
 
 pub use rpc::handle_rpc_batch;
 
+pub use stream::{get_html_stream, get_stream};
+
 pub use validate::{normalize_room_and_thread, validate_ingest_document, ValidatedIngest};
 
+pub use web_post::post_web_ingest;
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs
index 7d384e938a526bdf6aa04d1bf21a54d3fcb57d7e..231bf7381cf804144efd0521970b72dd8ffd4213 100644
--- a/server/src/api/rpc.rs
+++ b/server/src/api/rpc.rs
@@ -407,6 +407,22 @@ async fn rpc_post(
     })
 }
 
+/// Post forum content using a raw bearer token (CLI `Authorization` header or browser session cookie).
+pub async fn rpc_post_with_bearer(
+    state: &AppState,
+    bearer_token: &str,
+    room: String,
+    thread_tag: String,
+    text: String,
+) -> Result<RpcResult, RpcErr> {
+    use axum::http::{header, HeaderMap, HeaderValue};
+    let mut headers = HeaderMap::new();
+    let hv = HeaderValue::from_str(&format!("Bearer {bearer_token}"))
+        .map_err(|_| ("invalid session token".into(), None))?;
+    headers.insert(header::AUTHORIZATION, hv);
+    rpc_post(state, &headers, room, thread_tag, None, text, false).await
+}
+
 async fn rpc_check(
     state: &AppState,
     _room: String,
diff --git a/server/src/api/web_post.rs b/server/src/api/web_post.rs
new file mode 100644
index 0000000000000000000000000000000000000000..d7a5780c02281a60d29f27d17b291d6df5580606
--- /dev/null
+++ b/server/src/api/web_post.rs
@@ -0,0 +1,107 @@
+use axum::{
+    extract::State,
+    http::{HeaderMap, StatusCode},
+    response::{Html, IntoResponse, Redirect},
+    Form,
+};
+use axum_extra::extract::cookie::CookieJar;
+use serde::Deserialize;
+use slug_types::RpcResult;
+
+use crate::{
+    api::{
+        auth::{optional_principal, SLUG_SESSION_COOKIE},
+        rpc::rpc_post_with_bearer,
+    },
+    canonical_path::canonicalize_tag,
+    html::layout,
+    state::AppState,
+};
+
+#[derive(Debug, Deserialize)]
+pub struct WebPostForm {
+    pub room: String,
+    pub thread_tag: String,
+    pub text: String,
+}
+
+fn post_redirect_location(room: &str, thread_tag: &str) -> String {
+    let tag = canonicalize_tag(thread_tag);
+    if room.trim() == "public" {
+        format!("/t/{tag}")
+    } else {
+        let room = room.trim();
+        let Some((a, b)) = room.split_once('/') else {
+            return "/".to_string();
+        };
+        format!("/r/{a}/{b}/{tag}")
+    }
+}
+
+pub async fn post_web_ingest(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    jar: CookieJar,
+    Form(form): Form<WebPostForm>,
+) -> impl IntoResponse {
+    let reduced = state.reduced.read().await;
+    let Some(username) = optional_principal(&headers, &jar, &reduced) else {
+        drop(reduced);
+        return Redirect::temporary("/login").into_response();
+    };
+
+    let bearer = headers
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string()))
+        .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string()));
+
+    drop(reduced);
+
+    let Some(bearer) = bearer else {
+        return Redirect::temporary("/login").into_response();
+    };
+
+    let room = form.room.trim().to_string();
+    let thread_tag = form.thread_tag.trim().to_string();
+    let text = form.text.clone();
+
+    if text.trim().is_empty() {
+        return error_page(
+            "empty post",
+            "Write something in the text area (DSL / prose).",
+            &username,
+        )
+        .into_response();
+    }
+
+    match rpc_post_with_bearer(&state, &bearer, room.clone(), thread_tag.clone(), text).await {
+        Ok(RpcResult::PostOk { .. }) => {
+            Redirect::to(&post_redirect_location(&room, &thread_tag)).into_response()
+        }
+        Ok(_) => error_page("unexpected response", "Post did not return PostOk.", &username).into_response(),
+        Err((msg, hint)) => error_page(
+            &msg,
+            hint.as_deref().unwrap_or(""),
+            &username,
+        )
+        .into_response(),
+    }
+}
+
+fn error_page(title: &str, detail: &str, user: &str) -> impl IntoResponse {
+    use maud::html;
+    let body = html! {
+        nav class="breadcrumb" {
+            a href="/" { "slug.social" }
+        }
+        h1 { "could not post" }
+        p { (title) }
+        @if !detail.is_empty() {
+            pre class="muted" { (detail) }
+        }
+        p class="muted" { "signed in as @" (user) " · " a href="/" { "home" } }
+    };
+    let page = layout("post error — slug.social", "view-thread", body, None);
+    (StatusCode::BAD_REQUEST, Html(page.into_string()))
+}
diff --git a/server/src/html/forum.rs b/server/src/html/forum.rs
index 228a120065dbacd8a308ba6e8bfc6ab111877c4b..8dfcd6b23a18e1571c4f0b3b60c865fa8f576f2f 100644
--- a/server/src/html/forum.rs
+++ b/server/src/html/forum.rs
@@ -1,21 +1,24 @@
 use axum::{
     extract::{Path, Query, State},
-    http::{header, StatusCode},
+    http::{header, HeaderMap, StatusCode},
     response::{Html, IntoResponse, Response},
 };
-use serde::Deserialize;
+use axum_extra::extract::cookie::CookieJar;
 use maud::{html, Markup};
+use serde::Deserialize;
 
 use crate::{
+    api::optional_principal,
     canonical_path::canonicalize_tag,
+    events::ThreadCapability,
     reducer::{ReducerState, ScopeId},
     state::AppState,
     timeago,
 };
 
 use super::{
-    authorship_address, bc_threads, cli_panel, layout, now_ms,
-    recency_class, render_linkified_with_embeds,
+    authorship_address, bc_segment, bc_threads, cli_panel, layout, now_ms, recency_class,
+    render_linkified_with_embeds,
 };
 
 #[derive(Clone)]
@@ -26,17 +29,72 @@ struct ThreadRow {
     ingests: usize,
 }
 
-/// Collect thread rows from reducer state (unsorted).
-fn collect_thread_rows(reduced: &ReducerState, now: i64) -> Vec<ThreadRow> {
+/// URL prefix for thread pages: public `/t/…` or room `/r/{short}/{slug}/…`.
+#[derive(Clone)]
+pub struct ThreadNav {
+    pub room_wire: String,
+    scope: ScopeId,
+    path_prefix: String,
+}
+
+impl ThreadNav {
+    pub fn public() -> Self {
+        Self {
+            room_wire: "public".into(),
+            scope: ScopeId::Public,
+            path_prefix: "/t".into(),
+        }
+    }
+
+    /// `room_id` wire form `shortid/slug`.
+    pub fn from_room_id(room_id: &str) -> Option<Self> {
+        let (short, slug) = room_id.split_once('/')?;
+        if short.is_empty() || slug.is_empty() {
+            return None;
+        }
+        Some(Self {
+            room_wire: room_id.to_string(),
+            scope: ScopeId::Room(room_id.to_string()),
+            path_prefix: format!("/r/{short}/{slug}"),
+        })
+    }
+
+    fn scope(&self) -> ScopeId {
+        self.scope.clone()
+    }
+
+    fn thread_url(&self, tag: &str) -> String {
+        format!("{}/{}", self.path_prefix, tag)
+    }
+
+    fn thread_page_url(&self, tag: &str, offset: usize) -> String {
+        let base = self.thread_url(tag);
+        if offset == 0 {
+            base
+        } else {
+            format!("{base}?offset={offset}")
+        }
+    }
+
+    fn post_url(&self, tag: &str, idx: usize) -> String {
+        format!("{}/{}/{}", self.path_prefix, tag, idx)
+    }
+
+    fn expand_url(&self, tag: &str, idx: usize) -> String {
+        format!("{}/{}/{}/expand", self.path_prefix, tag, idx)
+    }
+}
+
+fn collect_thread_rows_for_scope(reduced: &ReducerState, scope: &ScopeId, now: i64) -> Vec<ThreadRow> {
     let _ = now;
     reduced
         .forum_threads
         .iter()
-        .filter(|((scope, _), _)| scope == &ScopeId::Public)
+        .filter(|((s, _), _)| s == scope)
         .map(|((_, tag), thread)| {
             let ingests = reduced
                 .ingests_by_scope_thread
-                .get(&(ScopeId::Public, tag.clone()))
+                .get(&(scope.clone(), tag.clone()))
                 .map(|q| q.len())
                 .unwrap_or(0);
             ThreadRow {
@@ -49,16 +107,46 @@ fn collect_thread_rows(reduced: &ReducerState, now: i64) -> Vec<ThreadRow> {
         .collect()
 }
 
-/// Render the thread feed div (id="thread-feed"). Used by both index() and SSE broadcast.
-fn render_thread_feed(rows: &[ThreadRow], now: i64) -> Markup {
+fn rooms_for_user(reduced: &ReducerState, username: &str) -> Vec<String> {
+    let mut v: Vec<String> = reduced
+        .grants
+        .iter()
+        .filter(|(rid, m)| reduced.rooms.contains(*rid) && m.contains_key(username))
+        .map(|(rid, _)| rid.clone())
+        .collect();
+    v.sort();
+    v
+}
+
+fn user_can_view_room(reduced: &ReducerState, room_id: &str, username: Option<&str>) -> bool {
+    if !reduced.rooms.contains(room_id) {
+        return false;
+    }
+    let Some(u) = username else {
+        return false;
+    };
+    reduced.user_has_cap(room_id, u, ThreadCapability::View)
+        || reduced.user_has_cap(room_id, u, ThreadCapability::Post)
+        || reduced.user_has_cap(room_id, u, ThreadCapability::Manage)
+}
+
+fn user_can_post_room(reduced: &ReducerState, room_id: &str, username: &str) -> bool {
+    reduced.user_has_cap(room_id, username, ThreadCapability::Post)
+}
+
+/// `feed_id` is e.g. `thread-feed` (public bump list, SSE) or `room-thread-feed`.
+fn render_thread_feed(nav: Option<&ThreadNav>, feed_id: &str, rows: &[ThreadRow], now: i64) -> Markup {
     html! {
-        div id="thread-feed" {
+        div id=(feed_id) {
             @if rows.is_empty() {
                 p class="muted" { "no threads yet" }
             } @else {
                 ul class="thread-feed" {
                     @for r in rows {
-                        @let thread_href = format!("/t/{}", r.tag);
+                        @let thread_href = nav
+                            .as_ref()
+                            .map(|n| n.thread_url(&r.tag))
+                            .unwrap_or_else(|| format!("/t/{}", r.tag));
                         @let hover = timeago::rfc3339_utc(r.last_ts);
                         @let ago = timeago::timeago(now, r.last_ts);
                         @let age_cls = recency_class(now, r.last_ts);
@@ -83,36 +171,148 @@ fn render_thread_feed(rows: &[ThreadRow], now: i64) -> Markup {
     }
 }
 
+fn auth_strip(
+    headers: &HeaderMap,
+    jar: &CookieJar,
+    reduced: &ReducerState,
+) -> Markup {
+    match optional_principal(headers, jar, reduced) {
+        Some(u) => html! {
+            p class="muted auth-strip" {
+                "@" (u)
+                " · "
+                a href="/logout" { "log out" }
+            }
+        },
+        None => html! {
+            p class="muted auth-strip" {
+                a href="/login" { "log in" }
+            }
+        },
+    }
+}
+
+fn bc_room(nav: &ThreadNav, room_slug: &str, thread_tag: Option<&str>) -> Markup {
+    html! {
+        a href="/" { "slug.social" }
+        @if let Some(t) = thread_tag {
+            (bc_segment(
+                &format!("r / {room_slug}"),
+                &nav.path_prefix,
+                false,
+            ))
+            (bc_segment(&format!("#{t}"), &nav.thread_url(t), true))
+        } @else {
+            (bc_segment(
+                &format!("r / {room_slug}"),
+                &nav.path_prefix,
+                true,
+            ))
+        }
+    }
+}
+
+fn compose_form(nav: &ThreadNav, thread_tag: &str, show: bool) -> Markup {
+    if !show {
+        return html! {};
+    }
+    html! {
+        section class="compose" {
+            h3 { "reply" }
+            p class="muted" { "Uses the same ingest DSL as the CLI. You must be logged in." }
+            form method="POST" action="/post" {
+                input type="hidden" name="room" value=(nav.room_wire.clone());
+                input type="hidden" name="thread_tag" value=(thread_tag);
+                textarea name="text" rows="8" cols="80" placeholder="prose or ~/items and votes…" {}
+                p {
+                    button type="submit" { "post" }
+                }
+            }
+        }
+    }
+}
+
+fn new_thread_form_public(show: bool) -> Markup {
+    if !show {
+        return html! {};
+    }
+    html! {
+        section class="compose" {
+            h3 { "new public thread" }
+            p class="muted" { "Set thread tag and body. Example: start with a title line or use the CLI-shaped DSL." }
+            form method="POST" action="/post" {
+                input type="hidden" name="room" value="public";
+                label for="new-thread-tag" { "thread tag" }
+                input type="text" id="new-thread-tag" name="thread_tag" pattern="[a-z0-9_\\-]{1,64}" placeholder="my-topic";
+                label for="new-thread-text" { "text" }
+                textarea id="new-thread-text" name="text" rows="6" placeholder="#my-topic\n\nYour first post…" {}
+                p { button type="submit" { "create / post" } }
+            }
+        }
+    }
+}
 
-/// Returns the current thread feed HTML fragment for SSE broadcast.
-/// selector: `#thread-feed`
+/// Returns the current public thread feed HTML fragment for SSE (`#thread-feed`).
 pub async fn thread_feed_html(state: &AppState) -> String {
     let now = now_ms();
+    let nav = ThreadNav::public();
     let mut rows = {
         let reduced = state.reduced.read().await;
-        collect_thread_rows(&reduced, now)
+        collect_thread_rows_for_scope(&reduced, &ScopeId::Public, now)
     };
     rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));
-    render_thread_feed(&rows, now).into_string()
+    render_thread_feed(Some(&nav), "thread-feed", &rows, now).into_string()
 }
 
-pub async fn index(State(state): State<AppState>) -> impl IntoResponse {
+/// Home: private rooms (signed-in), then public bump-ordered threads.
+pub async fn home(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    jar: CookieJar,
+) -> impl IntoResponse {
     let now = now_ms();
-    let mut rows: Vec<ThreadRow> = {
-        let reduced = state.reduced.read().await;
-        collect_thread_rows(&reduced, now)
-    };
-    // Bump order: most recently active first.
-    rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));
+    let reduced = state.reduced.read().await;
+    let user = optional_principal(&headers, &jar, &reduced);
+    let room_ids = user
+        .as_ref()
+        .map(|u| rooms_for_user(&reduced, u))
+        .unwrap_or_default();
+    let mut public_rows = collect_thread_rows_for_scope(&reduced, &ScopeId::Public, now);
+    drop(reduced);
+    public_rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));
+
+    let nav = ThreadNav::public();
+    let reduced_read = state.reduced.read().await;
+    let strip = auth_strip(&headers, &jar, &reduced_read);
+    let show_forms = user.is_some();
+    drop(reduced_read);
 
     let page = layout(
         "slug.social",
         "view-thread",
         html! {
+            (strip)
             nav class="breadcrumb" { (bc_threads(None)) }
+            @if !room_ids.is_empty() {
+                h2 { "your rooms" }
+                ul class="thread-feed" {
+                    @for rid in &room_ids {
+                        @if let Some(nav_r) = ThreadNav::from_room_id(rid) {
+                            @let slug = if let Some((_, s)) = rid.split_once('/') { s } else { rid.as_str() };
+                            li {
+                                a href=(nav_r.path_prefix) {
+                                    (slug)
+                                    span class="muted" { " · " (rid) }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            h2 { "public threads" }
             p class="muted" { "dark = time-ordered · light = vote-ranked" }
-            h2 { "threads" }
-            (render_thread_feed(&rows, now))
+            (render_thread_feed(Some(&nav), "thread-feed", &public_rows, now))
+            (new_thread_form_public(show_forms))
             (cli_panel("npx slugsocial forum"))
         },
         None,
@@ -127,9 +327,13 @@ pub struct ThreadViewQuery {
 
 const PAGE_SIZE: usize = 10;
 
-fn render_thread_paginator(tag: &str, offset: usize, total: usize, top: bool) -> Markup {
+fn render_thread_paginator(nav: &ThreadNav, tag: &str, offset: usize, total: usize, top: bool) -> Markup {
     let newer_offset = offset.checked_add(PAGE_SIZE).filter(|&o| o < total);
-    let older_offset = if offset > 0 { Some(offset.saturating_sub(PAGE_SIZE)) } else { None };
+    let older_offset = if offset > 0 {
+        Some(offset.saturating_sub(PAGE_SIZE))
+    } else {
+        None
+    };
     let latest_offset = total.saturating_sub(PAGE_SIZE);
     let on_latest = offset >= latest_offset;
     let (id, scroll_href, scroll_label) = if top {
@@ -141,7 +345,7 @@ fn render_thread_paginator(tag: &str, offset: usize, total: usize, top: bool) ->
         div class="thread-paginator" id=(id) {
             a href=(scroll_href) class="post-nav-btn" { (scroll_label) }
             @if let Some(o) = older_offset {
-                a href=(format!("/t/{tag}?offset={o}")) class="post-nav-btn" { "← older" }
+                a href=(nav.thread_page_url(tag, o)) class="post-nav-btn" { "← older" }
             } @else {
                 span class="post-nav-btn disabled" { "← older" }
             }
@@ -149,37 +353,38 @@ fn render_thread_paginator(tag: &str, offset: usize, total: usize, top: bool) ->
                 (offset + 1) "–" (total.min(offset + PAGE_SIZE)) " / " (total)
             }
             @if let Some(o) = newer_offset {
-                a href=(format!("/t/{tag}?offset={o}")) class="post-nav-btn" { "newer →" }
+                a href=(nav.thread_page_url(tag, o)) class="post-nav-btn" { "newer →" }
             } @else {
                 span class="post-nav-btn disabled" { "newer →" }
             }
             @if !on_latest {
-                a href=(format!("/t/{tag}?offset={latest_offset}")) class="post-nav-btn" { "latest" }
+                a href=(nav.thread_page_url(tag, latest_offset)) class="post-nav-btn" { "latest" }
             }
         }
     }
 }
 
-/// Thread view — `/t/:tag` — dark, paginated.
-pub async fn thread_view(
-    State(state): State<AppState>,
-    Path(tag): Path<String>,
-    Query(q): Query<ThreadViewQuery>,
+async fn thread_view_inner(
+    state: AppState,
+    tag: String,
+    q: ThreadViewQuery,
+    nav: ThreadNav,
+    headers: HeaderMap,
+    jar: CookieJar,
 ) -> impl IntoResponse {
     let tag = canonicalize_tag(&tag);
+    let scope = nav.scope();
 
-    // Newest-first queue → chronological for the page.
     let all_ids: Vec<String> = {
         let reduced = state.reduced.read().await;
         reduced
             .ingests_by_scope_thread
-            .get(&(ScopeId::Public, tag.clone()))
+            .get(&(scope.clone(), tag.clone()))
             .map(|q| q.iter().rev().cloned().collect())
             .unwrap_or_default()
     };
 
     let total = all_ids.len();
-    // Default: first page (oldest posts first, like a book).
     let offset = q.offset.unwrap_or(0);
     let page_ids: Vec<String> = all_ids.into_iter().skip(offset).take(PAGE_SIZE).collect();
 
@@ -189,18 +394,49 @@ pub async fn thread_view(
             .iter()
             .filter_map(|id| reduced.ingests_by_id.get(id).cloned())
             .collect::<Vec<_>>();
-        let subtitle: Option<String> = None;
-        (ingests, subtitle)
+        (ingests, None::<String>)
+    };
+
+    let reduced = state.reduced.read().await;
+    let user = optional_principal(&headers, &jar, &reduced);
+    let sc = nav.scope();
+    let show_compose = match &sc {
+        ScopeId::Public => user.is_some(),
+        ScopeId::Room(rid) => user
+            .as_ref()
+            .map(|u| user_can_post_room(&reduced, rid, u))
+            .unwrap_or(false),
     };
+    let strip = auth_strip(&headers, &jar, &reduced);
+    drop(reduced);
 
     let now = now_ms();
-    let paginator_top = render_thread_paginator(&tag, offset, total, true);
-    let paginator_bot = render_thread_paginator(&tag, offset, total, false);
+    let paginator_top = render_thread_paginator(&nav, &tag, offset, total, true);
+    let paginator_bot = render_thread_paginator(&nav, &tag, offset, total, false);
+
+    let bc: Markup = match &sc {
+        ScopeId::Public => bc_threads(Some(&tag)),
+        ScopeId::Room(rid) => {
+            let slug = if let Some((_, s)) = rid.split_once('/') {
+                s
+            } else {
+                rid.as_str()
+            };
+            bc_room(&nav, slug, Some(&tag))
+        }
+    };
+
+    let cli = match &sc {
+        ScopeId::Public => format!("npx slugsocial forum {tag}"),
+        ScopeId::Room(r) => format!("npx slugsocial private {r} forum {tag}"),
+    };
+
     let page = layout(
         &format!("#{tag}"),
         "view-thread",
         html! {
-            nav class="breadcrumb" { (bc_threads(Some(&tag))) }
+            (strip)
+            nav class="breadcrumb" { (bc) }
             h2 { "#" (tag) @if let Some(sub) = &subtitle { ": " (sub) } }
             p class="muted" { "top=oldest · bottom=newest" }
             @if display_ingests.is_empty() {
@@ -209,7 +445,7 @@ pub async fn thread_view(
                 (paginator_top)
                 @for (i, ing) in display_ingests.iter().enumerate() {
                     @let post_idx = offset + i;
-                    @let post_href = format!("/t/{tag}/{post_idx}");
+                    @let post_href = nav.post_url(&tag, post_idx);
                     @let hover = timeago::rfc3339_utc(ing.ts);
                     @let ago = timeago::timeago(now, ing.ts);
                     @let truncated = ing.raw.len() > 2000;
@@ -222,8 +458,9 @@ pub async fn thread_view(
                         }
                         (render_linkified_with_embeds(display_body))
                         @if truncated {
+                            @let exp = nav.expand_url(&tag, post_idx);
                             a href="#" class="show-full-link"
-                              onclick=(format!("fetch('/t/{tag}/{post_idx}/expand').then(r=>r.text()).then(eval);return false")) {
+                              onclick=(format!("fetch('{exp}').then(r=>r.text()).then(eval);return false")) {
                                 "[show full post]"
                             }
                         }
@@ -231,34 +468,171 @@ pub async fn thread_view(
                 }
                 (paginator_bot)
             }
-            (cli_panel(&format!("npx slugsocial forum {tag}")))
+            (compose_form(&nav, &tag, show_compose))
+            (cli_panel(&cli))
         },
         None,
     );
     Html(page.into_string()).into_response()
 }
 
-/// Single-post view — `/t/:tag/:index` — shows one ingest at full length.
-pub async fn thread_post_view(
+/// Thread view — `/t/:tag`
+pub async fn thread_view(
     State(state): State<AppState>,
-    Path((tag, index_str)): Path<(String, String)>,
+    Path(tag): Path<String>,
+    Query(q): Query<ThreadViewQuery>,
+    headers: HeaderMap,
+    jar: CookieJar,
 ) -> impl IntoResponse {
-    let tag = canonicalize_tag(&tag);
+    thread_view_inner(state, tag, q, ThreadNav::public(), headers, jar).await
+}
+
+/// Room thread — `/r/:short/:slug/:tag`
+pub async fn room_thread_view(
+    State(state): State<AppState>,
+    Path((room_short, room_slug, tag)): Path<(String, String, String)>,
+    Query(q): Query<ThreadViewQuery>,
+    headers: HeaderMap,
+    jar: CookieJar,
+) -> impl IntoResponse {
+    let room_id = format!("{room_short}/{room_slug}");
+    let reduced = state.reduced.read().await;
+    let user = optional_principal(&headers, &jar, &reduced);
+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {
+        drop(reduced);
+        return room_forbidden_page().into_response();
+    }
+    drop(reduced);
+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {
+        return (StatusCode::NOT_FOUND, "bad room path").into_response();
+    };
+    thread_view_inner(state, tag, q, nav, headers, jar)
+        .await
+        .into_response()
+}
+
+fn room_forbidden_page() -> impl IntoResponse {
+    let body = html! {
+        nav class="breadcrumb" { a href="/" { "slug.social" } }
+        h1 { "private room" }
+        p { "Log in with an account that has been granted access to this room." }
+        p { a href="/login" { "log in" } " · " a href="/" { "home" } }
+    };
+    let page = layout("private room — slug.social", "view-thread", body, None);
+    (StatusCode::FORBIDDEN, Html(page.into_string()))
+}
+
+/// Private room index — `/r/:short/:slug`
+pub async fn room_page(
+    State(state): State<AppState>,
+    Path((room_short, room_slug)): Path<(String, String)>,
+    headers: HeaderMap,
+    jar: CookieJar,
+) -> impl IntoResponse {
+    let room_id = format!("{room_short}/{room_slug}");
     let now = now_ms();
+    let reduced = state.reduced.read().await;
+    if !reduced.rooms.contains(&room_id) {
+        drop(reduced);
+        return (StatusCode::NOT_FOUND, "room not found").into_response();
+    }
+    let user = optional_principal(&headers, &jar, &reduced);
+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {
+        drop(reduced);
+        return room_forbidden_page().into_response();
+    }
+    let scope = ScopeId::Room(room_id.clone());
+    let mut rows = collect_thread_rows_for_scope(&reduced, &scope, now);
+    let strip = auth_strip(&headers, &jar, &reduced);
+    let show_new = user
+        .as_ref()
+        .map(|u| user_can_post_room(&reduced, &room_id, u))
+        .unwrap_or(false);
+    drop(reduced);
+    rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));
+
+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {
+        return (StatusCode::NOT_FOUND, "room not found").into_response();
+    };
+    let slug_display = room_slug.as_str();
+    let cli = format!("npx slugsocial private {room_id} forum");
+
+    let page = layout(
+        &format!("room {slug_display} — slug.social"),
+        "view-thread",
+        html! {
+            (strip)
+            nav class="breadcrumb" { (bc_room(&nav, slug_display, None)) }
+            h2 { (slug_display) }
+            p class="muted" { (room_id) }
+            h3 { "threads" }
+            (render_thread_feed(Some(&nav), "room-thread-feed", &rows, now))
+            @if show_new {
+                (new_thread_form_for_room(&nav, show_new))
+            }
+            (cli_panel(&cli))
+        },
+        None,
+    );
+    Html(page.into_string()).into_response()
+}
+
+fn new_thread_form_for_room(nav: &ThreadNav, show: bool) -> Markup {
+    if !show {
+        return html! {};
+    }
+    html! {
+        section class="compose" {
+            h3 { "new thread in this room" }
+            form method="POST" action="/post" {
+                input type="hidden" name="room" value=(nav.room_wire.clone());
+                label for="room-new-tag" { "thread tag" }
+                input type="text" id="room-new-tag" name="thread_tag" pattern="[a-z0-9_\\-]{1,64}" required;
+                textarea name="text" rows="6" placeholder="First post body…" required {}
+                p { button type="submit" { "post" } }
+            }
+        }
+    }
+}
+
+async fn thread_post_view_inner(
+    state: AppState,
+    tag: String,
+    index_str: String,
+    nav: ThreadNav,
+) -> impl IntoResponse {
+    let tag = canonicalize_tag(&tag);
     let index: usize = index_str.parse().unwrap_or(0);
+    let scope = nav.scope();
+    let now = now_ms();
     let (ing, subtitle) = {
         let reduced = state.reduced.read().await;
-        let ing = reduced.ingests_by_scope_thread.get(&(ScopeId::Public, tag.clone()))
+        let ing = reduced
+            .ingests_by_scope_thread
+            .get(&(scope.clone(), tag.clone()))
             .and_then(|q| q.iter().rev().nth(index))
             .and_then(|id| reduced.ingests_by_id.get(id).cloned());
-        let subtitle: Option<String> = None;
-        (ing, subtitle)
+        (ing, None::<String>)
     };
+
+    let sc = nav.scope();
+    let bc: Markup = match &sc {
+        ScopeId::Public => bc_threads(Some(&tag)),
+        ScopeId::Room(rid) => {
+            let slug = if let Some((_, s)) = rid.split_once('/') {
+                s
+            } else {
+                rid.as_str()
+            };
+            bc_room(&nav, slug, Some(&tag))
+        }
+    };
+
     let page = layout(
         &format!("#{tag} / post #{index}"),
         "view-thread",
         html! {
-            nav class="breadcrumb" { (bc_threads(Some(&tag))) }
+            nav class="breadcrumb" { (bc) }
             h2 { "#" (tag) @if let Some(sub) = &subtitle { ": " (sub) } " / post #" (index) }
             @if let Some(ing) = ing {
                 @let hover = timeago::rfc3339_utc(ing.ts);
@@ -280,21 +654,51 @@ pub async fn thread_post_view(
     Html(page.into_string()).into_response()
 }
 
-/// Inline expand handler — `/t/:tag/:id/expand`
-/// Returns a JS snippet that morphs the truncated post into its full version.
-pub async fn thread_post_expand(
+pub async fn thread_post_view(
     State(state): State<AppState>,
     Path((tag, index_str)): Path<(String, String)>,
+) -> impl IntoResponse {
+    thread_post_view_inner(state, tag, index_str, ThreadNav::public()).await
+}
+
+pub async fn room_thread_post_view(
+    State(state): State<AppState>,
+    Path((room_short, room_slug, tag, index_str)): Path<(String, String, String, String)>,
+    headers: HeaderMap,
+    jar: CookieJar,
+) -> impl IntoResponse {
+    let room_id = format!("{room_short}/{room_slug}");
+    let reduced = state.reduced.read().await;
+    let user = optional_principal(&headers, &jar, &reduced);
+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {
+        drop(reduced);
+        return room_forbidden_page().into_response();
+    }
+    drop(reduced);
+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {
+        return (StatusCode::NOT_FOUND, "bad room path").into_response();
+    };
+    thread_post_view_inner(state, tag, index_str, nav)
+        .await
+        .into_response()
+}
+
+async fn thread_post_expand_inner(
+    state: AppState,
+    tag: String,
+    index_str: String,
+    nav: ThreadNav,
 ) -> impl IntoResponse {
     let tag = canonicalize_tag(&tag);
     let index: usize = index_str.parse().unwrap_or(0);
     let now = now_ms();
+    let scope = nav.scope();
 
     let ing = {
         let reduced = state.reduced.read().await;
         reduced
             .ingests_by_scope_thread
-            .get(&(ScopeId::Public, tag.clone()))
+            .get(&(scope.clone(), tag.clone()))
             .and_then(|q| q.iter().rev().nth(index))
             .and_then(|id| reduced.ingests_by_id.get(id).cloned())
     };
@@ -303,7 +707,7 @@ pub async fn thread_post_expand(
         return (StatusCode::NOT_FOUND, "post not found").into_response();
     };
 
-    let post_href = format!("/t/{tag}/{index}");
+    let post_href = nav.post_url(&tag, index);
     let hover = timeago::rfc3339_utc(ing.ts);
     let ago = timeago::timeago(now, ing.ts);
 
@@ -319,7 +723,6 @@ pub async fn thread_post_expand(
     };
 
     let full_html_str = full_html.into_string();
-    // Escape backticks and backslashes for JS template literal
     let escaped = full_html_str
         .replace('\\', "\\\\")
         .replace('`', "\\`")
@@ -334,7 +737,36 @@ pub async fn thread_post_expand(
     Response::builder()
         .status(StatusCode::OK)
         .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8")
-        .body(js)
+        .body(axum::body::Body::from(js))
         .unwrap()
         .into_response()
 }
+
+pub async fn thread_post_expand(
+    State(state): State<AppState>,
+    Path((tag, index_str)): Path<(String, String)>,
+) -> impl IntoResponse {
+    thread_post_expand_inner(state, tag, index_str, ThreadNav::public()).await
+}
+
+pub async fn room_thread_post_expand(
+    State(state): State<AppState>,
+    Path((room_short, room_slug, tag, index_str)): Path<(String, String, String, String)>,
+    headers: HeaderMap,
+    jar: CookieJar,
+) -> impl IntoResponse {
+    let room_id = format!("{room_short}/{room_slug}");
+    let reduced = state.reduced.read().await;
+    let user = optional_principal(&headers, &jar, &reduced);
+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {
+        drop(reduced);
+        return (StatusCode::FORBIDDEN, "forbidden").into_response();
+    }
+    drop(reduced);
+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {
+        return (StatusCode::NOT_FOUND, "not found").into_response();
+    };
+    thread_post_expand_inner(state, tag, index_str, nav)
+        .await
+        .into_response()
+}
diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs
index 9c5af9654c7010d2cdb100e4cf63ba63e77c8c57..26e86124aae7cd878c92e1dc927e19d9fd2feaba 100644
--- a/server/src/html/mod.rs
+++ b/server/src/html/mod.rs
@@ -16,7 +16,10 @@ use breadcrumb_path::OntologyPath;
 
 pub use auth::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page};
 pub use editor::{editor_check, editor_page};
-pub use forum::{index, thread_feed_html, thread_post_expand, thread_post_view, thread_view};
+pub use forum::{
+    home, room_page, room_thread_post_expand, room_thread_post_view, room_thread_view, thread_feed_html,
+    thread_post_expand, thread_post_view, thread_view,
+};
 pub use garden::{garden_index, ontology_path};
 pub use search::{search_page, search_results_fragment};
 
diff --git a/server/src/lib.rs b/server/src/lib.rs
index bf2f73d4d0f26a357961e88c52c3b4f72626af81..b074cc31b94f23d1d566513392d7da3c02653c97 100644
--- a/server/src/lib.rs
+++ b/server/src/lib.rs
@@ -16,7 +16,7 @@ pub mod state;
 pub mod timeago;
 
 use axum::Router;
-use axum::routing::post;
+use axum::routing::{get, post};
 use tower_http::trace::TraceLayer;
 
 use crate::state::AppState;
@@ -25,17 +25,48 @@ pub use reducer::ReducerState;
 
 pub fn create_app(state: AppState) -> Router {
     Router::new()
-        .route("/healthz", axum::routing::get(|| async { "ok" }))
-        .route("/static/:filename", axum::routing::get(crate::html::serve_theme_css))
-        .route("/join/:token", axum::routing::get(api::get_join_invite))
-        .route("/auth/login", axum::routing::get(api::get_auth_login))
-        .route("/auth/callback", axum::routing::get(api::get_auth_callback))
-        .route("/auth/complete", axum::routing::get(api::get_auth_complete))
-        .route("/auth/choose-username", axum::routing::get(api::get_choose_username))
-        .route("/auth/choose-username", axum::routing::post(api::post_choose_username))
-        .route("/api/v0/pending-session", axum::routing::post(api::post_pending_session))
-        .route("/api/v0/pending-session/:id", axum::routing::get(api::get_pending_session))
-        .route("/api/v0/whoami", axum::routing::get(api::get_whoami))
+        .route("/healthz", get(|| async { "ok" }))
+        .route("/static/:filename", get(crate::html::serve_theme_css))
+        .route("/", get(crate::html::home))
+        .route("/login", get(api::get_web_login))
+        .route("/logout", get(api::get_logout))
+        .route("/post", post(api::post_web_ingest))
+        .route("/sse", get(api::get_html_stream))
+        .route("/stream", get(api::get_stream))
+        .route("/search", get(crate::html::search_page))
+        .route("/search/results", get(crate::html::search_results_fragment))
+        .route("/try", get(crate::html::editor_page))
+        .route("/try/check", post(crate::html::editor_check))
+        .route("/~", get(crate::html::garden_index))
+        .route("/~/*path", get(crate::html::ontology_path))
+        .route(
+            "/t/:tag/:index/expand",
+            get(crate::html::thread_post_expand),
+        )
+        .route("/t/:tag/:index", get(crate::html::thread_post_view))
+        .route("/t/:tag", get(crate::html::thread_view))
+        .route(
+            "/r/:room_short/:room_slug/:thread_tag/:index/expand",
+            get(crate::html::room_thread_post_expand),
+        )
+        .route(
+            "/r/:room_short/:room_slug/:thread_tag/:index",
+            get(crate::html::room_thread_post_view),
+        )
+        .route(
+            "/r/:room_short/:room_slug/:thread_tag",
+            get(crate::html::room_thread_view),
+        )
+        .route("/r/:room_short/:room_slug", get(crate::html::room_page))
+        .route("/join/:token", get(api::get_join_invite))
+        .route("/auth/login", get(api::get_auth_login))
+        .route("/auth/callback", get(api::get_auth_callback))
+        .route("/auth/complete", get(api::get_auth_complete))
+        .route("/auth/choose-username", get(api::get_choose_username))
+        .route("/auth/choose-username", post(api::post_choose_username))
+        .route("/api/v0/pending-session", post(api::post_pending_session))
+        .route("/api/v0/pending-session/:id", get(api::get_pending_session))
+        .route("/api/v0/whoami", get(api::get_whoami))
         .route("/api/v0/rpc", post(api::handle_rpc_batch))
         .with_state(state)
         .layer(TraceLayer::new_for_http())