You are a constitutional council ranking individual git commits for ownership allocation.

Compare these two commits. Decide which contributed more lasting value to the project.

Judge substance, not spectacle:
- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.
- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.
- Do not favor a side merely because its patch is longer or noisier.
- Weight what the change does for the project, not the contributor's name.

Return ONLY a JSON object: {"winner": "A" or "B", "ratio": "N:M", "explanation": "..."}
The explanation must cite concrete differences in the patches (1-3 sentences).

Side A — contributor: tommy-mor
Side A — commit message:
[00be3a29] invite system

Side A — unified diff (full patch):
diff --git a/bb.edn b/bb.edn
index 50be8232847e672b3f273a2fb25ddd1d12adb7e2..818f850765370d12d58f239e287764fc3649d78b 100644
--- a/bb.edn
+++ b/bb.edn
@@ -47,14 +47,16 @@
                                            "RUST_LOG"      "info"})})))}
 
   test
-  {:doc "Full test suite: integration + auth + grants"
+  {:doc "Full test suite: integration + auth + grants + invites"
    :requires ([test.integration :as integration]
               [test.auth :as auth]
-              [test.grants :as grants])
+              [test.grants :as grants]
+              [test.invites :as invites])
    :task (do
            (integration/integration)
            (auth/auth-test)
-           (grants/grants-test))}
+           (grants/grants-test)
+           (invites/invites-test))}
 
   perf
   {:doc "Performance test: concurrent HTTP requests to detect blocking I/O"
diff --git a/cli/src/main.rs b/cli/src/main.rs
index e5833b0b93d8e667b94c574ba2b0f8cb758ff3df..8eda9f485bd1f7392f1e34be27176c21e20354eb 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -105,6 +105,23 @@ enum ScopedCmd {
         #[arg(long)]
         json: bool,
     },
+
+    /// Mint a shareable invite link (24h TTL, in-memory until redeemed). Requires Manage on the room.
+    InviteLink {
+        /// Comma-separated: view, post, vote, add_item, manage
+        #[arg(long = "caps", value_delimiter = ',')]
+        caps: Vec<String>,
+        #[arg(long, default_value_t = 1)]
+        uses: usize,
+        #[arg(long)]
+        json: bool,
+    },
+
+    /// List principals granted access in this room (requires View or Manage)
+    Audit {
+        #[arg(long)]
+        json: bool,
+    },
 }
 
 #[derive(Subcommand, Debug)]
@@ -514,17 +531,35 @@ fn print_thread(resp: &ThreadDetailResponse) {
         .duration_since(std::time::UNIX_EPOCH)
         .unwrap_or_default()
         .as_millis() as i64;
-    if resp.total > resp.posts.len() {
-        let end = resp.offset + resp.posts.len();
-        eprintln!("# showing {}-{} of {} posts  (--offset N --limit N to paginate)", resp.offset, end.saturating_sub(1), resp.total);
+    if resp.total > resp.items.len() {
+        let end = resp.offset + resp.items.len();
+        eprintln!(
+            "# showing {}-{} of {} rows  (--offset N --limit N to paginate)",
+            resp.offset,
+            end.saturating_sub(1),
+            resp.total
+        );
     }
-    for (i, post) in resp.posts.iter().enumerate() {
-        let timeago = slug_types::timeago::timeago_compact(now_ms, post.ts);
-        let body = &post.body.trim();
-        println!("<post index=\"{}\" timeago=\"{}\">", post.index, timeago);
-        println!("{}", body);
-        println!("</post>");
-        if i + 1 < resp.posts.len() {
+    for (i, item) in resp.items.iter().enumerate() {
+        match item {
+            ThreadItem::Post {
+                index,
+                ts,
+                body,
+                ..
+            } => {
+                let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);
+                let body = body.trim();
+                println!("<post index=\"{}\" timeago=\"{}\">", index, timeago);
+                println!("{}", body);
+                println!("</post>");
+            }
+            ThreadItem::System { ts, text } => {
+                let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);
+                println!("<system timeago=\"{}\">{}</system>", timeago, text.trim());
+            }
+        }
+        if i + 1 < resp.items.len() {
             println!();
             println!();
         }
@@ -1036,6 +1071,95 @@ async fn run_scoped(base: &str, room: &str, sub: ScopedCmd) -> Result<()> {
                 }
             }
         },
+        ScopedCmd::InviteLink { caps, uses, json } => {
+            let caps: Vec<String> = caps
+                .into_iter()
+                .flat_map(|s| {
+                    s.split(',')
+                        .map(|p| p.trim().to_lowercase())
+                        .filter(|p| !p.is_empty())
+                        .collect::<Vec<_>>()
+                })
+                .collect();
+            if caps.is_empty() {
+                return Err(anyhow!("--caps is required (e.g. --caps view,post,vote)"));
+            }
+            let bearer = effective_bearer().ok_or_else(|| {
+                anyhow!(
+                    "no bearer token: run `slugsocial identity start --rig <rig> --model <model>` \
+                     then `slugsocial identity poll <session>`, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token"
+                )
+            })?;
+            let batch = send_rpc(
+                &client,
+                base,
+                Some(&bearer),
+                vec![RpcCommand::RoomMintInvite {
+                    room: room.to_string(),
+                    capabilities: caps,
+                    max_uses: uses,
+                }],
+            )
+            .await?;
+            match rpc_line_ok(&batch.results[0])? {
+                RpcResult::RoomInviteMinted {
+                    invite_url,
+                    expires_at_ms,
+                    max_uses,
+                } => {
+                    if json {
+                        println!(
+                            "{}",
+                            serde_json::to_string_pretty(&serde_json::json!({
+                                "invite_url": invite_url,
+                                "expires_at_ms": expires_at_ms,
+                                "max_uses": max_uses,
+                            }))?
+                        );
+                    } else {
+                        println!("{invite_url}");
+                        println!("(Expires in 24 hours. Max uses: {max_uses})");
+                    }
+                }
+                _ => return Err(anyhow!("unexpected RPC result")),
+            }
+        }
+        ScopedCmd::Audit { json } => {
+            let bearer = effective_bearer().ok_or_else(|| {
+                anyhow!(
+                    "no bearer token: run `slugsocial identity start --rig <rig> --model <model>` \
+                     then `slugsocial identity poll <session>`, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token"
+                )
+            })?;
+            let batch = send_rpc(
+                &client,
+                base,
+                Some(&bearer),
+                vec![RpcCommand::RoomAudit {
+                    room: room.to_string(),
+                }],
+            )
+            .await?;
+            match rpc_line_ok(&batch.results[0])? {
+                RpcResult::RoomAudit(resp) => {
+                    if json {
+                        println!("{}", serde_json::to_string_pretty(&resp)?);
+                    } else {
+                        println!("room {}", resp.room);
+                        if resp.grants.is_empty() {
+                            println!("(no grants recorded)");
+                        } else {
+                            let w_user = resp.grants.iter().map(|g| g.username.len()).max().unwrap_or(0);
+                            for g in &resp.grants {
+                                let caps = g.capabilities.join(", ");
+                                println!("{:<width$}  {}", g.username, caps, width = w_user.max(8));
+                            }
+                        }
+                    }
+                }
+                _ => return Err(anyhow!("unexpected RPC result")),
+            }
+        }
         ScopedCmd::Check { file, json } => {
             let mut text = String::new();
             match file {
diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs
index 995ce4a61d29b024c399c656134f541ecfd880cf..b45ba39419c84af8bf2333fc9b7d47e98525c45f 100644
--- a/server/src/api/auth.rs
+++ b/server/src/api/auth.rs
@@ -12,12 +12,61 @@ use tokio::sync::RwLock;
 
 use crate::{
     api::helpers::{api_error, now_ms, sha256_hex},
-    events::{Event, TokenIssued, UserRegistered},
+    events::{Event, GrantAdded, TokenIssued, UserRegistered},
     identity::{parse_agent, parse_username},
     html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},
     state::{AppState, PendingSession},
 };
 
+/// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).
+const INVITE_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000000:invite:web/join";
+
+async fn apply_invite_redemption(state: &AppState, invite_token: &str, grantee_username: &str) -> Result<(), String> {
+    let now = now_ms();
+    let ga = {
+        let mut invites = state.invites.write().await;
+        let Some(inv) = invites.get_mut(invite_token) else {
+            return Err("invite not found".into());
+        };
+        if now > inv.expires_at_ms {
+            invites.remove(invite_token);
+            return Err("invite expired".into());
+        }
+        if inv.current_uses >= inv.max_uses {
+            return Err("invite exhausted".into());
+        }
+        inv.current_uses += 1;
+        Event::GrantAdded(GrantAdded {
+            ts: now,
+            room_id: inv.room_id.clone(),
+            username: grantee_username.to_string(),
+            capabilities: inv.capabilities.clone(),
+            granted_by: inv.inviter.clone(),
+        })
+    };
+
+    match state.event_log.append(&ga).await {
+        Ok(()) => {
+            let mut reduced = state.reduced.write().await;
+            reduced.apply_event(ga);
+            let mut invites = state.invites.write().await;
+            if let Some(inv) = invites.get(invite_token) {
+                if inv.current_uses >= inv.max_uses {
+                    invites.remove(invite_token);
+                }
+            }
+            Ok(())
+        }
+        Err(e) => {
+            let mut invites = state.invites.write().await;
+            if let Some(inv) = invites.get_mut(invite_token) {
+                inv.current_uses = inv.current_uses.saturating_sub(1);
+            }
+            Err(format!("{e}"))
+        }
+    }
+}
+
 fn pending_sessions(state: &AppState) -> Arc<RwLock<HashMap<String, PendingSession>>> {
     state.pending_sessions.clone()
 }
@@ -115,6 +164,42 @@ pub struct AuthLoginQuery {
     pub session: String,
 }
 
+pub async fn get_join_invite(Path(token): Path<String>, State(state): State<AppState>) -> impl IntoResponse {
+    let token = token.trim().to_string();
+    if token.is_empty() {
+        return api_error(StatusCode::NOT_FOUND, "invite invalid or expired", None).into_response();
+    }
+    let now = now_ms();
+    let valid = {
+        let invites = state.invites.read().await;
+        match invites.get(&token) {
+            None => false,
+            Some(inv) => now <= inv.expires_at_ms && inv.current_uses < inv.max_uses,
+        }
+    };
+    if !valid {
+        return api_error(StatusCode::NOT_FOUND, "invite invalid or expired", None).into_response();
+    }
+
+    let session = format!("p_{}", uuid::Uuid::new_v4().simple());
+    let s = PendingSession {
+        agent: INVITE_BROWSER_AGENT.to_string(),
+        created_ts: now_ms(),
+        provider: None,
+        provider_id: None,
+        redeem_invite: Some(token),
+        complete: None,
+    };
+    state.pending_sessions.write().await.insert(session.clone(), s);
+
+    let public_url = std::env::var("SLUG_PUBLIC_URL").unwrap_or_else(|_| "http://127.0.0.1:8080".to_string());
+    Redirect::temporary(&format!(
+        "{public_url}/auth/login?session={}",
+        urlencoding::encode(&session)
+    ))
+    .into_response()
+}
+
 pub async fn get_auth_login(Query(q): Query<AuthLoginQuery>, State(state): State<AppState>) -> impl IntoResponse {
     // Redirect to Google auth endpoint.
     let sessions = pending_sessions(&state);
@@ -205,6 +290,7 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):
         s.provider = Some("google".to_string());
         s.provider_id = Some(sub.clone());
         if let Some(username) = existing {
+            let invite_tok = s.redeem_invite.clone();
             let (bearer, token_event) = issue_token_for_user(&username);
             // append token event
             let ev = Event::TokenIssued(token_event);
@@ -215,6 +301,11 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):
                 let mut reduced = reduced_arc.write().await;
                 reduced.apply_event(ev);
             }
+            if let Some(tok) = invite_tok {
+                if let Err(e) = apply_invite_redemption(&state, &tok, &username).await {
+                    tracing::warn!(error = %e, "invite redemption skipped after oauth");
+                }
+            }
             s.complete = Some((username, bearer));
             return Redirect::temporary(&format!("{public_url}/auth/complete")).into_response();
         }
@@ -310,6 +401,16 @@ pub async fn post_choose_username(
         reduced.apply_event(ti_ev.clone());
     }
 
+    // Redeem invite (if any) before marking the session complete.
+    if let Some(tok) = {
+        let sessions_read = sessions.read().await;
+        sessions_read.get(&form.session).and_then(|s| s.redeem_invite.clone())
+    } {
+        if let Err(e) = apply_invite_redemption(&state, &tok, &canon_user).await {
+            tracing::warn!(error = %e, "invite redemption skipped after registration");
+        }
+    }
+
     // Mark complete for polling.
     {
         let mut sessions_write = sessions.write().await;
@@ -339,6 +440,7 @@ pub async fn post_pending_session(
         created_ts: now_ms(),
         provider: None,
         provider_id: None,
+        redeem_invite: None,
         complete: None,
     };
     let sessions = pending_sessions(&state);
diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs
index a1ea432932cdca0e42dc7377f0a25075fd5644c0..cb031aecebad1107dfa2898a98fb6084b28ba6e9 100644
--- a/server/src/api/mod.rs
+++ b/server/src/api/mod.rs
@@ -4,6 +4,7 @@ mod rpc;
 mod validate;
 
 pub use auth::{
+    get_join_invite,
     get_pending_session,
     get_whoami,
     post_pending_session,
diff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs
index 11a76ed7a02aae588edadb7a87a43660f5669d9e..f6bbc3df71909a2da7403cd46fe4ea6ca130c692 100644
--- a/server/src/api/rpc.rs
+++ b/server/src/api/rpc.rs
@@ -13,12 +13,14 @@ use slug_types::*;
 use crate::{
     canonical_path::{canonicalize_item, canonicalize_tag},
     dsl,
-    events::{AgentBound, Event, GrantAdded, Ingest, RoomCreated, ThreadCapability, ThreadVisibility},
+    events::{
+        AgentBound, Event, GrantAdded, Ingest, RoomCreated, ThreadCapability, ThreadVisibility,
+    },
     identity::{parse_agent, parse_username},
     path_types::CanonicalItemUrl,
     ranking::{connected_components_from_voted_pairs, ranked_items_subset},
     reducer::{scope_from_room_wire, ReducerState, ScopeId},
-    state::AppState,
+    state::{AppState, InviteState},
 };
 
 use super::auth::verify_bearer_principal;
@@ -142,6 +144,27 @@ fn gen_short_id() -> String {
     (0..7).map(|_| ALPHABET[rng.gen_range(0..ALPHABET.len())] as char).collect()
 }
 
+fn gen_invite_token() -> String {
+    use rand::Rng;
+    const ALPHABET: &[u8] = b"0123456789abcdefghijklmnopqrstuvwxyz";
+    let mut rng = rand::thread_rng();
+    let tail: String = (0..16).map(|_| ALPHABET[rng.gen_range(0..ALPHABET.len())] as char).collect();
+    format!("inv_{tail}")
+}
+
+const INVITE_TTL_MS: i64 = 86_400_000;
+
+fn capability_wire(c: ThreadCapability) -> String {
+    match c {
+        ThreadCapability::View => "view",
+        ThreadCapability::Post => "post",
+        ThreadCapability::Vote => "vote",
+        ThreadCapability::AddItem => "add_item",
+        ThreadCapability::Manage => "manage",
+    }
+    .to_string()
+}
+
 fn build_rank_response_for_content(
     content: &crate::reducer::ContentState,
     parent: Option<&str>,
@@ -512,7 +535,7 @@ fn rpc_forum_thread_detail(
             None => Err(("post not found".into(), None)),
             Some((idx, ing)) => Ok(ThreadDetailResponse {
                 thread: format!("#{}", tag),
-                posts: vec![PostRow {
+                items: vec![ThreadItem::Post {
                     id: ing.id.clone(),
                     index: idx,
                     ts: ing.ts,
@@ -543,7 +566,7 @@ fn rpc_forum_thread_detail(
 
     let total = filtered.len();
     const MAX_BODY: usize = 2000;
-    let posts: Vec<PostRow> = filtered
+    let items: Vec<ThreadItem> = filtered
         .into_iter()
         .skip(offset)
         .take(limit)
@@ -553,7 +576,7 @@ fn rpc_forum_thread_detail(
             } else {
                 (ing.raw.clone(), false)
             };
-            PostRow {
+            ThreadItem::Post {
                 id: ing.id.clone(),
                 index: idx,
                 ts: ing.ts,
@@ -566,7 +589,7 @@ fn rpc_forum_thread_detail(
 
     Ok(ThreadDetailResponse {
         thread: format!("#{}", tag),
-        posts,
+        items,
         total,
         offset,
     })
@@ -1007,7 +1030,7 @@ pub async fn handle_rpc_batch(
             RpcCommand::RoomGrant {
                 room,
                 username,
-                capability,
+                capabilities,
             } => {
                 let principal = {
                     let reduced = state.reduced.read().await;
@@ -1022,6 +1045,8 @@ pub async fn handle_rpc_batch(
                         };
                         if !can_manage {
                             line_err("requires Manage capability", None)
+                        } else if capabilities.is_empty() {
+                            line_err("capabilities must not be empty", None)
                         } else {
                             match parse_username(&username) {
                                 Err(msg) => line_err("invalid username", Some(msg)),
@@ -1033,14 +1058,18 @@ pub async fn handle_rpc_batch(
                                     if !user_exists {
                                         line_err(format!("user @{target} not found"), None)
                                     } else {
-                                        match parse_capability(&capability) {
+                                        let caps: Result<Vec<ThreadCapability>, String> = capabilities
+                                            .iter()
+                                            .map(|c| parse_capability(c.trim()))
+                                            .collect();
+                                        match caps {
                                             Err(msg) => line_err(msg, None),
-                                            Ok(cap) => {
+                                            Ok(caps) => {
                                                 let ga_ev = Event::GrantAdded(GrantAdded {
                                                     ts: now_ms(),
                                                     room_id: room,
                                                     username: target,
-                                                    capabilities: vec![cap],
+                                                    capabilities: caps,
                                                     granted_by: principal,
                                                 });
                                                 if let Err(e) = state.event_log.append(&ga_ev).await {
@@ -1059,6 +1088,114 @@ pub async fn handle_rpc_batch(
                     }
                 }
             }
+            RpcCommand::RoomMintInvite {
+                room,
+                capabilities,
+                max_uses,
+            } => {
+                let principal = {
+                    let reduced = state.reduced.read().await;
+                    verify_bearer_principal(&headers, &*reduced)
+                };
+                match principal {
+                    Err((_, m)) => line_err(m, None),
+                    Ok(principal) => {
+                        let can_manage = {
+                            let reduced = state.reduced.read().await;
+                            reduced.user_has_cap(&room, &principal, ThreadCapability::Manage)
+                        };
+                        if !can_manage {
+                            line_err("requires Manage capability", None)
+                        } else if capabilities.is_empty() {
+                            line_err("capabilities must not be empty", None)
+                        } else {
+                            match capabilities
+                                .iter()
+                                .map(|c| parse_capability(c.trim()))
+                                .collect::<Result<Vec<ThreadCapability>, String>>()
+                            {
+                                Err(msg) => line_err(msg, None),
+                                Ok(caps) => {
+                                    let max_uses = max_uses.max(1).min(100_000);
+                                    let now = now_ms();
+                                    let expires_at_ms = now + INVITE_TTL_MS;
+                                    let token = loop {
+                                        let t = gen_invite_token();
+                                        let taken = {
+                                            let invites = state.invites.read().await;
+                                            invites.contains_key(&t)
+                                        };
+                                        if !taken {
+                                            break t;
+                                        }
+                                    };
+                                    let inv = InviteState {
+                                        room_id: room.clone(),
+                                        capabilities: caps,
+                                        expires_at_ms,
+                                        max_uses,
+                                        current_uses: 0,
+                                        inviter: principal,
+                                    };
+                                    state.invites.write().await.insert(token.clone(), inv);
+                                    let public_url = std::env::var("SLUG_PUBLIC_URL")
+                                        .unwrap_or_else(|_| "http://127.0.0.1:8080".to_string());
+                                    let invite_url = format!("{public_url}/join/{token}");
+                                    line_ok(RpcResult::RoomInviteMinted {
+                                        invite_url,
+                                        expires_at_ms: Some(expires_at_ms),
+                                        max_uses,
+                                    })
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            RpcCommand::RoomAudit { room } => {
+                let principal = {
+                    let reduced = state.reduced.read().await;
+                    verify_bearer_principal(&headers, &*reduced)
+                };
+                match principal {
+                    Err((_, m)) => line_err(m, None),
+                    Ok(principal) => {
+                        let reduced = state.reduced.read().await;
+                        if !reduced.rooms.contains_key(&room) {
+                            line_err("unknown room", None)
+                        } else {
+                            let can_audit = reduced.user_has_cap(&room, &principal, ThreadCapability::View)
+                                || reduced.user_has_cap(&room, &principal, ThreadCapability::Manage);
+                            if !can_audit {
+                                line_err("requires View or Manage capability", None)
+                            } else {
+                                let grants: Vec<RoomAuditEntry> = reduced
+                                    .grants
+                                    .get(&room)
+                                    .map(|m| {
+                                        let mut v: Vec<RoomAuditEntry> = m
+                                            .iter()
+                                            .map(|(username, caps)| {
+                                                let mut c: Vec<String> =
+                                                    caps.iter().copied().map(capability_wire).collect();
+                                                c.sort();
+                                                RoomAuditEntry {
+                                                    username: username.clone(),
+                                                    capabilities: c,
+                                                }
+                                            })
+                                            .collect();
+                                        v.sort_by(|a, b| a.username.cmp(&b.username));
+                                        v
+                                    })
+                                    .unwrap_or_default();
+                                line_ok(RpcResult::RoomAudit(RoomAuditResponse { room, grants }))
+                            }
+                        }
+                    }
+                }
+            }
+            RpcCommand::RoomRevoke { .. } => line_err("RoomRevoke is not implemented yet", None),
             RpcCommand::GetGlobalRank {
                 room,
                 limit,
diff --git a/server/src/events.rs b/server/src/events.rs
index 125005d89ade7b22c9b6d997f0ed81781df5e7ec..9e60f2c218f5c871a93e855e415dd984e3a017c5 100644
--- a/server/src/events.rs
+++ b/server/src/events.rs
@@ -26,6 +26,8 @@ pub enum Event {
     RoomCreated(RoomCreated),
     GrantAdded(GrantAdded),
     GrantRevoked(GrantRevoked),
+    InviteMinted(InviteMinted),
+    InviteRedeemed(InviteRedeemed),
     /// Ingest of a DSL+prose body. Identity and routing live in event metadata.
     Ingest(Ingest),
 }
@@ -82,6 +84,25 @@ pub struct GrantRevoked {
     pub revoked_by: String,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct InviteMinted {
+    pub ts: i64,
+    pub token: String,
+    pub room_id: String,
+    pub capabilities: Vec<ThreadCapability>,
+    pub inviter: String,
+    pub max_uses: u32,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub expires_ts_ms: Option<i64>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct InviteRedeemed {
+    pub ts: i64,
+    pub token: String,
+    pub username: String,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct Ingest {
     /// Unix timestamp in milliseconds.
diff --git a/server/src/lib.rs b/server/src/lib.rs
index d00b56d909e1fabd1d122d054dd02785e13e0bd8..bf2f73d4d0f26a357961e88c52c3b4f72626af81 100644
--- a/server/src/lib.rs
+++ b/server/src/lib.rs
@@ -27,6 +27,7 @@ pub fn create_app(state: AppState) -> Router {
     Router::new()
         .route("/healthz", axum::routing::get(|| async { "ok" }))
         .route("/static/:filename", axum::routing::get(crate::html::serve_theme_css))
+        .route("/join/:token", axum::routing::get(api::get_join_invite))
         .route("/auth/login", axum::routing::get(api::get_auth_login))
         .route("/auth/callback", axum::routing::get(api::get_auth_callback))
         .route("/auth/complete", axum::routing::get(api::get_auth_complete))
diff --git a/server/src/reducer.rs b/server/src/reducer.rs
index 118cb19f4df4a083df2878ca7a1424f3d63de851..5190d0a7ee3d545a786a68fef483322aafdce7f9 100644
--- a/server/src/reducer.rs
+++ b/server/src/reducer.rs
@@ -3,7 +3,7 @@ use std::collections::{HashMap, HashSet, VecDeque};
 use serde::{Deserialize, Serialize};
 
 use crate::canonical_path::canonicalize_tag;
-use crate::events::{Event, Ingest, ThreadCapability};
+use crate::events::{Event, Ingest, ThreadCapability, ThreadVisibility};
 use crate::path_types::CanonicalItemUrl;
 
 #[derive(Debug, Clone, Hash, PartialEq, Eq, PartialOrd, Ord)]
@@ -156,6 +156,41 @@ pub struct RoomState {
     pub visibility: crate::events::ThreadVisibility,
 }
 
+/// Durable invite link state (from [`crate::events::InviteMinted`] / [`crate::events::InviteRedeemed`]).
+#[derive(Debug, Clone)]
+pub struct ActiveInviteState {
+    pub room_id: String,
+    pub capabilities: HashSet<ThreadCapability>,
+    pub inviter: String,
+    pub uses_remaining: u32,
+    pub expires_ts_ms: Option<i64>,
+}
+
+#[derive(Clone, Debug)]
+pub enum RoomTimelineKind {
+    RoomCreated {
+        owner: String,
+        slug: String,
+        visibility: ThreadVisibility,
+    },
+    GrantAdded {
+        username: String,
+        granted_by: String,
+        capabilities: Vec<ThreadCapability>,
+    },
+    GrantRevoked {
+        username: String,
+        revoked_by: String,
+        capabilities: Vec<ThreadCapability>,
+    },
+}
+
+#[derive(Clone, Debug)]
+pub struct RoomTimelineEntry {
+    pub ts: i64,
+    pub kind: RoomTimelineKind,
+}
+
 #[derive(Debug, Clone)]
 pub struct ForumThreadState {
     pub last_activity_ts: i64,
@@ -210,6 +245,10 @@ pub struct ReducerState {
     pub ingests_ordered: Vec<String>,
     /// room_id → username → capabilities
     pub grants: HashMap<String, HashMap<String, HashSet<ThreadCapability>>>,
+    /// room_id → chronological room admin lines (for thread UI).
+    pub room_timeline: HashMap<String, Vec<RoomTimelineEntry>>,
+    /// Invite token → active invite (absent when fully consumed or never minted).
+    pub invites: HashMap<String, ActiveInviteState>,
 }
 
 impl ReducerState {
@@ -225,6 +264,20 @@ impl ReducerState {
             .unwrap_or(false)
     }
 
+    /// Invite link is present, not expired, and has uses left.
+    pub fn invite_token_active(&self, token: &str, now_ms: i64) -> Option<&ActiveInviteState> {
+        let inv = self.invites.get(token)?;
+        if inv.uses_remaining == 0 {
+            return None;
+        }
+        if let Some(exp) = inv.expires_ts_ms {
+            if now_ms > exp {
+                return None;
+            }
+        }
+        Some(inv)
+    }
+
     pub fn content_for_scope_mut(&mut self, scope: ScopeId) -> &mut ContentState {
         self.content.entry(scope).or_default()
     }
@@ -356,6 +409,17 @@ impl ReducerState {
                         visibility: rc.visibility,
                     },
                 );
+                self.room_timeline
+                    .entry(rc.room_id.clone())
+                    .or_default()
+                    .push(RoomTimelineEntry {
+                        ts: rc.ts,
+                        kind: RoomTimelineKind::RoomCreated {
+                            owner: rc.owner.clone(),
+                            slug: rc.slug.clone(),
+                            visibility: rc.visibility,
+                        },
+                    });
             }
             Event::Ingest(mut ing) => {
                 ing.thread_tag = canonicalize_tag(&ing.thread_tag);
@@ -525,18 +589,31 @@ impl ReducerState {
                 nav!(self.actor_last_post_ts, keypath(ing.principal.clone()), setval(ing.ts));
             }
             Event::GrantAdded(ga) => {
+                let room_id = ga.room_id.clone();
                 let caps = self.grants
                     .entry(ga.room_id)
                     .or_default()
-                    .entry(ga.username)
+                    .entry(ga.username.clone())
                     .or_default();
-                for cap in ga.capabilities {
+                for cap in ga.capabilities.iter().copied() {
                     caps.insert(cap);
                 }
+                self.room_timeline
+                    .entry(room_id)
+                    .or_default()
+                    .push(RoomTimelineEntry {
+                        ts: ga.ts,
+                        kind: RoomTimelineKind::GrantAdded {
+                            username: ga.username.clone(),
+                            granted_by: ga.granted_by.clone(),
+                            capabilities: ga.capabilities.clone(),
+                        },
+                    });
             }
             Event::GrantRevoked(gr) => {
+                let room_id = gr.room_id.clone();
                 if let Some(room_grants) = self.grants.get_mut(&gr.room_id) {
-                    let username = gr.username;
+                    let username = gr.username.clone();
                     if let Some(caps) = room_grants.get_mut(&username) {
                         for cap in &gr.capabilities {
                             caps.remove(cap);
@@ -549,6 +626,37 @@ impl ReducerState {
                         self.grants.remove(&gr.room_id);
                     }
                 }
+                self.room_timeline
+                    .entry(room_id)
+                    .or_default()
+                    .push(RoomTimelineEntry {
+                        ts: gr.ts,
+                        kind: RoomTimelineKind::GrantRevoked {
+                            username: gr.username.clone(),
+                            revoked_by: gr.revoked_by.clone(),
+                            capabilities: gr.capabilities.clone(),
+                        },
+                    });
+            }
+            Event::InviteMinted(im) => {
+                self.invites.insert(
+                    im.token.clone(),
+                    ActiveInviteState {
+                        room_id: im.room_id.clone(),
+                        capabilities: im.capabilities.iter().copied().collect(),
+                        inviter: im.inviter.clone(),
+                        uses_remaining: im.max_uses,
+                        expires_ts_ms: im.expires_ts_ms,
+                    },
+                );
+            }
+            Event::InviteRedeemed(ir) => {
+                if let Some(inv) = self.invites.get_mut(&ir.token) {
+                    inv.uses_remaining = inv.uses_remaining.saturating_sub(1);
+                    if inv.uses_remaining == 0 {
+                        self.invites.remove(&ir.token);
+                    }
+                }
             }
         }
     }
@@ -570,6 +678,8 @@ impl Default for ReducerState {
             actor_last_post_ts: HashMap::new(),
             ingests_ordered: Vec::new(),
             grants: HashMap::new(),
+            room_timeline: HashMap::new(),
+            invites: HashMap::new(),
         }
     }
 }
diff --git a/server/src/state.rs b/server/src/state.rs
index b1ff2330903780cbe0cdf35964cb166eb2423d7d..628fd5921b34ba53ac0ca6b6fd33957ca09129b9 100644
--- a/server/src/state.rs
+++ b/server/src/state.rs
@@ -1,8 +1,20 @@
+use std::collections::HashMap;
 use std::sync::Arc;
 
 use tokio::sync::{broadcast, RwLock};
 
-use crate::{event_log::EventLog, reducer::ReducerState};
+use crate::{event_log::EventLog, events::ThreadCapability, reducer::ReducerState};
+
+/// Ephemeral invite link (24h TTL, in-memory only; not written to the event log).
+#[derive(Debug, Clone)]
+pub struct InviteState {
+    pub room_id: String,
+    pub capabilities: Vec<ThreadCapability>,
+    pub expires_at_ms: i64,
+    pub max_uses: usize,
+    pub current_uses: usize,
+    pub inviter: String,
+}
 
 #[derive(Debug, Clone)]
 pub struct PendingSession {
@@ -10,6 +22,8 @@ pub struct PendingSession {
     pub created_ts: i64,
     pub provider: Option<String>,
     pub provider_id: Option<String>,
+    /// When set, successful OAuth completion redeems this invite token and appends [`crate::events::GrantAdded`].
+    pub redeem_invite: Option<String>,
     pub complete: Option<(String /*username*/, String /*bearer*/ )>,
 }
 
@@ -42,7 +56,9 @@ pub struct AppState {
     pub cfg: Arc<AppConfig>,
     pub event_log: Arc<EventLog>,
     pub reduced: Arc<RwLock<ReducerState>>,
-    pub pending_sessions: Arc<RwLock<std::collections::HashMap<String, PendingSession>>>,
+    pub pending_sessions: Arc<RwLock<HashMap<String, PendingSession>>>,
+    /// Ephemeral invite tokens (`inv_…`) until expiry or exhaustion.
+    pub invites: Arc<RwLock<HashMap<String, InviteState>>>,
     /// Broadcast channel for SSE live-streaming. Capacity = 64 events.
     pub stream_tx: broadcast::Sender<StreamEvent>,
     /// Broadcast channel for web SSE HTML fragments (poem pattern). Capacity = 64.
@@ -58,7 +74,8 @@ impl AppState {
             cfg: Arc::new(cfg),
             event_log: Arc::new(event_log),
             reduced: Arc::new(RwLock::new(ReducerState::default())),
-            pending_sessions: Arc::new(RwLock::new(std::collections::HashMap::new())),
+            pending_sessions: Arc::new(RwLock::new(HashMap::new())),
+            invites: Arc::new(RwLock::new(HashMap::new())),
             stream_tx,
             html_tx,
         }
diff --git a/server/src/timeline.rs b/server/src/timeline.rs
new file mode 100644
index 0000000000000000000000000000000000000000..251158943ab36d3015268e35f6bdd01c3f42ab3b
--- /dev/null
+++ b/server/src/timeline.rs
@@ -0,0 +1,153 @@
+//! Room admin lines merged into forum thread views.
+
+use crate::{
+    canonical_path::canonicalize_tag,
+    reducer::{ReducerState, RoomTimelineEntry, RoomTimelineKind},
+};
+
+fn cap_label(c: crate::events::ThreadCapability) -> &'static str {
+    use crate::events::ThreadCapability::*;
+    match c {
+        View => "view",
+        Post => "post",
+        Vote => "vote",
+        AddItem => "add_item",
+        Manage => "manage",
+    }
+}
+
+fn caps_list(caps: &[crate::events::ThreadCapability]) -> String {
+    let mut v: Vec<_> = caps.iter().map(|c| cap_label(*c)).collect();
+    v.sort();
+    v.join(", ")
+}
+
+/// Human-readable system line for the thread feed.
+pub fn format_room_timeline_entry(e: &RoomTimelineEntry) -> String {
+    match &e.kind {
+        RoomTimelineKind::RoomCreated {
+            owner,
+            slug,
+            visibility,
+        } => {
+            let vis = match visibility {
+                crate::events::ThreadVisibility::Public => "public",
+                crate::events::ThreadVisibility::Private => "private",
+            };
+            format!("@{owner} created room #{slug} ({vis})")
+        }
+        RoomTimelineKind::GrantAdded {
+            username,
+            granted_by,
+            capabilities,
+        } => {
+            format!(
+                "@{granted_by} granted @{} {}",
+                username,
+                caps_list(capabilities)
+            )
+        }
+        RoomTimelineKind::GrantRevoked {
+            username,
+            revoked_by,
+            capabilities,
+        } => {
+            format!(
+                "@{revoked_by} revoked @{} {}",
+                username,
+                caps_list(capabilities)
+            )
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+pub enum MergedThreadRow {
+    System { ts: i64, text: String },
+    Post {
+        index: usize,
+        id: String,
+        ts: i64,
+        principal: String,
+        raw: String,
+    },
+}
+
+/// Merge room admin lines with thread ingests for one room + tag. Oldest first.
+/// `actor_prefix` filters posts only (system lines always included).
+pub fn merge_thread_rows(
+    reduced: &ReducerState,
+    room_wire: &str,
+    thread_tag: &str,
+    since: Option<i64>,
+    before: Option<i64>,
+    actor_prefix: &str,
+) -> Vec<MergedThreadRow> {
+    let scope = crate::reducer::scope_from_room_wire(room_wire);
+    let tag = canonicalize_tag(thread_tag);
+    let key = (scope.clone(), tag.clone());
+
+    let mut rows: Vec<MergedThreadRow> = Vec::new();
+
+    if let Some(entries) = reduced.room_timeline.get(room_wire.trim()) {
+        for e in entries {
+            if since.map_or(true, |s| e.ts >= s) && before.map_or(true, |b| e.ts < b) {
+                rows.push(MergedThreadRow::System {
+                    ts: e.ts,
+                    text: format_room_timeline_entry(e),
+                });
+            }
+        }
+    }
+
+    let all_ids: Vec<String> = reduced
+        .ingests_by_scope_thread
+        .get(&key)
+        .map(|q| q.iter().rev().cloned().collect())
+        .unwrap_or_default();
+
+    for (idx, id) in all_ids.into_iter().enumerate() {
+        let Some(ing) = reduced.ingests_by_id.get(&id) else {
+            continue;
+        };
+        if since.map_or(true, |s| ing.ts >= s) && before.map_or(true, |b| ing.ts < b) {
+            if !actor_prefix.is_empty()
+                && !ing
+                    .principal
+                    .to_lowercase()
+                    .starts_with(actor_prefix)
+            {
+                continue;
+            }
+            rows.push(MergedThreadRow::Post {
+                index: idx,
+                id: ing.id.clone(),
+                ts: ing.ts,
+                principal: ing.principal.clone(),
+                raw: ing.raw.clone(),
+            });
+        }
+    }
+
+    rows.sort_by(|a, b| {
+        let ta = match a {
+            MergedThreadRow::System { ts, .. } | MergedThreadRow::Post { ts, .. } => *ts,
+        };
+        let tb = match b {
+            MergedThreadRow::System { ts, .. } | MergedThreadRow::Post { ts, .. } => *ts,
+        };
+        ta.cmp(&tb)
+    });
+    rows
+}
+
+/// Public forum thread (`room_wire == "public"`): same merge (timeline usually empty).
+pub fn merge_public_thread_rows(
+    reduced: &ReducerState,
+    thread_tag: &str,
+    since: Option<i64>,
+    before: Option<i64>,
+    actor_prefix: &str,
+) -> Vec<MergedThreadRow> {
+    merge_thread_rows(reduced, "public", thread_tag, since, before, actor_prefix)
+}
diff --git a/test/grants.bb b/test/grants.bb
index 10ef0f08ce1c3945e5f1634314e6aebcf6810cd2..4ded5ce92576cdea653cce0ba8a751be4374731a 100644
--- a/test/grants.bb
+++ b/test/grants.bb
@@ -105,7 +105,7 @@
        ;; Alice grants bob View only.
        (println "\nalice grants bob View only…")
        (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token
-                                                   [{"RoomGrant" {"room" room-id "username" "bob" "capability" "view"}}])))
+                                                   [{"RoomGrant" {"room" room-id "username" "bob" "capabilities" ["view"]}}])))
                 "grant View RPC ok")
 
        (println "\nbob (View only) tries to post prose…")
@@ -117,7 +117,7 @@
        ;; Alice grants bob Post.
        (println "\nalice grants bob Post…")
        (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token
-                                                   [{"RoomGrant" {"room" room-id "username" "bob" "capability" "post"}}])))
+                                                   [{"RoomGrant" {"room" room-id "username" "bob" "capabilities" ["post"]}}])))
                 "grant Post RPC ok")
 
        (println "\nbob (View + Post) posts prose…")
@@ -143,7 +143,7 @@
        ;; Alice grants bob Vote.
        (println "\nalice grants bob Vote…")
        (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token
-                                                   [{"RoomGrant" {"room" room-id "username" "bob" "capability" "vote"}}])))
+                                                   [{"RoomGrant" {"room" room-id "username" "bob" "capabilities" ["vote"]}}])))
                 "grant Vote RPC ok")
 
        (println "\nbob (View + Post + Vote) votes…")
diff --git a/test/invites.bb b/test/invites.bb
new file mode 100644
index 0000000000000000000000000000000000000000..f72b1e630a6856174cdef11eb977e2f81b16e551
--- /dev/null
+++ b/test/invites.bb
@@ -0,0 +1,150 @@
+(ns test.invites
+  "Ephemeral invite links: mint via RPC, GET /join → pending session + OAuth, redemption → GrantAdded,
+  RoomAudit, post succeeds, second GET /join returns 404 when max_uses exhausted."
+  (:require [babashka.fs :as fs]
+            [cheshire.core :as json]
+            [clojure.string :as str]
+            [test.common :as common]
+            [test.oauth :as oauth]))
+
+(def ^:private counts (atom {:pass 0 :fail 0}))
+
+(defn- assert! [pred msg]
+  (common/test-assert! counts pred msg))
+
+(defn- bearer [token] {"Authorization" (str "Bearer " token)})
+
+(defn- rpc-batch! [base-url token cmds]
+  (let [resp (oauth/http-post-json (str base-url "/api/v0/rpc") cmds :headers (bearer token))]
+    {:status (:status resp)
+     :parsed (json/parse-string (:body resp) false)}))
+
+(defn- rpc-line-ok? [parsed]
+  (true? (get-in parsed ["results" 0 "ok"])))
+
+(defn- session-from-login-location [loc]
+  (when loc
+    (let [qpart (if (str/includes? loc "?")
+                  (-> loc (str/split #"\?" 2) second)
+                  "")
+          qpart (if (str/includes? qpart "#")
+                  (-> qpart (str/split #"#" 2) first)
+                  qpart)
+          m (oauth/parse-query qpart)]
+      (some-> (get m :session) str))))
+
+(defn- invite-token-from-url [invite-url]
+  (second (re-find #"/join/(inv_[^/?#]+)" (str invite-url))))
+
+(defn- register-user! [base-url session-agent username]
+  (oauth/complete-registration! base-url
+                                :agent session-agent
+                                :username username
+                                :assert! (fn [pred msg] (assert! pred msg))))
+
+(defn- ingest! [base-url token room thread delegate text]
+  (rpc-batch! base-url token
+              [{"Post" {"room" room
+                        "thread_tag" thread
+                        "delegate" delegate
+                        "text" text
+                        "return_rank_diff" false}}]))
+
+(defn invites-test [& _args]
+  (println "\n━━━ ephemeral invite + audit integration check ━━━\n")
+  (reset! counts {:pass 0 :fail 0})
+
+  (println "building server binary…")
+  (common/letlocals
+   (bind build (common/run-cargo-build-release! ["slugsocial-server"]))
+   (assert! (zero? (:exit build)) "cargo build succeeds")
+   (bind server-bin "target/release/slugsocial-server")
+
+   (bind tmp-dir (str (fs/create-temp-dir {:prefix "slug-invites-"})))
+   (bind slug-port (common/pick-port))
+   (bind google-port (common/pick-port))
+   (bind base-url (str "http://127.0.0.1:" slug-port))
+   (bind google-url (str "http://127.0.0.1:" google-port))
+
+   (bind !server (atom nil))
+   (bind !google (atom nil))
+
+   (bind server-env (common/slug-server-env tmp-dir base-url google-url slug-port))
+   (try
+     (println (str "starting mock google on :" google-port))
+     (reset! !google (oauth/start-mock-google google-port
+                                              :google-users ["google-user-alice" "google-user-bob"]))
+
+     (println (str "starting server on :" slug-port))
+     (reset! !server (common/start-server server-bin server-env))
+     (assert! (common/wait-for-server base-url 10000) "server responds to /healthz")
+
+     (println "\nregistering alice…")
+     (let [alice-token (register-user! base-url
+                                       "00000000-0000-0000-0000-000000000001:test:local/dev"
+                                       "alice")
+
+           _ (println "\nalice creates private room…")
+           create (rpc-batch! base-url alice-token
+                              [{"RoomCreate" {"slug" "invite-demo" "visibility" "private"}}])
+           _ (assert! (= 200 (:status create)) "room create HTTP 200")
+           _ (assert! (rpc-line-ok? (:parsed create)) "room create RPC ok")
+           room-id (get-in (:parsed create) ["results" 0 "result" "RoomCreated" "room_id"])
+           _ (assert! (some? room-id) "room_id present")
+
+           _ (println "\nalice mints invite (view,post,vote uses=1)…")
+           mint (rpc-batch! base-url alice-token
+                            [{"RoomMintInvite" {"room" room-id
+                                                "capabilities" ["view" "post" "vote"]
+                                                "max_uses" 1}}])
+           _ (assert! (= 200 (:status mint)) "mint HTTP 200")
+           _ (assert! (rpc-line-ok? (:parsed mint)) "mint RPC ok")
+           invite-url (get-in (:parsed mint) ["results" 0 "result" "RoomInviteMinted" "invite_url"])
+           inv-tok (invite-token-from-url invite-url)
+           _ (assert! (some? inv-tok) "invite token parsed from URL")
+
+           _ (println "\nGET /join/:token (expect redirect + session)…")
+           join-resp (oauth/http-get-no-redirect (str base-url "/join/" inv-tok))
+           _ (assert! (contains? #{302 307} (:status join-resp))
+                      (str "join returns redirect (got status " (:status join-resp) ")"))
+           sess (session-from-login-location (:location join-resp))
+           _ (assert! (and (some? sess) (str/starts-with? sess "p_")) "Location carries session=p_…")
+
+           _ (println "\nbob completes OAuth via invite session…")
+           bob-token (oauth/complete-pending-session! base-url sess "bob"
+                                                      :assert! (fn [pred msg] (assert! pred msg)))
+
+           _ (println "\nalice runs RoomAudit…")
+           audit (rpc-batch! base-url alice-token [{"RoomAudit" {"room" room-id}}])
+           _ (assert! (rpc-line-ok? (:parsed audit)) "audit RPC ok")
+           grants (get-in (:parsed audit) ["results" 0 "result" "RoomAudit" "grants"])
+           bob-entry (first (filter #(= "bob" (get % "username")) grants))
+           _ (assert! (some? bob-entry) "audit lists bob")
+           bob-caps (set (get bob-entry "capabilities"))
+           _ (assert! (= bob-caps #{"view" "post" "vote"}) "bob has view, post, vote")
+
+           _ (println "\nbob posts prose to private room…")
+           _ (assert! (rpc-line-ok? (:parsed (ingest! base-url bob-token room-id "main"
+                                                      "00000000-0000-0000-0000-000000000002:test:local/dev"
+                                                      "Hello via invite link.")))
+                      "bob post succeeds")
+
+           _ (println "\nsecond GET /join (invite exhausted → 404)…")
+           join2 (oauth/http-get-no-redirect (str base-url "/join/" inv-tok))
+           _ (assert! (= 404 (:status join2)) "exhausted invite returns 404")]
+
+       (println "\ninvite lifecycle OK."))
+
+     (finally
+       (when-some [s @!server] (common/kill-server s))
+       (when-some [g @!google] ((:stop-fn g)))
+       (fs/delete-tree tmp-dir)))
+
+   (bind {pass :pass fail :fail} @counts)
+   (if (zero? fail)
+     (println (str "\n" common/ansi-green "━━━ " pass " invite checks passed ━━━" common/ansi-reset "\n"))
+     (do (println (str "\n" common/ansi-red "━━━ " fail " invite checks FAILED ━━━" common/ansi-reset "\n"))
+         (System/exit 1)))))
+
+(when (= *file* (System/getProperty "babashka.file"))
+  (invites-test))
diff --git a/test/oauth.bb b/test/oauth.bb
index b69459acd17c23c023170d8dd93fe45bb49c8d88..efb3f3e66346ffde81bf9622d75c3a6ec89f8db2 100644
--- a/test/oauth.bb
+++ b/test/oauth.bb
@@ -21,6 +21,21 @@
           resp (.send (http-client) req (java.net.http.HttpResponse$BodyHandlers/ofString))]
       {:status (.statusCode resp) :body (.body resp) :headers (.map (.headers resp))})))
 
+(defn http-get-no-redirect
+  "GET without following redirects; returns `:location` from the first `Location` header when present."
+  [url & {:keys [headers]}]
+  (let [client (-> (java.net.http.HttpClient/newBuilder)
+                   (.followRedirects java.net.http.HttpClient$Redirect/NEVER)
+                   (.connectTimeout connect-timeout)
+                   (.build))
+        b (java.net.http.HttpRequest/newBuilder (java.net.URI/create url))]
+    (doseq [[k v] (or headers {})]
+      (.header b k v))
+    (let [req (-> b (.timeout request-timeout) (.GET) (.build))
+          resp (.send client req (java.net.http.HttpResponse$BodyHandlers/ofString))
+          loc (first (get (.map (.headers resp)) "location"))]
+      {:status (.statusCode resp) :body (.body resp) :location loc})))
+
 (defn http-post-json [url data & {:keys [headers]}]
   (let [body (json/generate-string data)
         b (java.net.http.HttpRequest/newBuilder (java.net.URI/create url))]
@@ -50,6 +65,35 @@
           resp (.send (http-client) req (java.net.http.HttpResponse$BodyHandlers/ofString))]
       {:status (.statusCode resp) :body (.body resp) :headers (.map (.headers resp))})))
 
+(defn complete-pending-session!
+  "Finish OAuth for an existing pending session id (e.g. created by `GET /join/inv_…`). Returns bearer token."
+  [base-url session-id username & {:keys [assert!]}]
+  (let [check! (fn [pred msg resp]
+                 (if assert!
+                   (assert! pred msg)
+                   (when-not pred
+                     (throw (ex-info msg {:resp resp})))))]
+    (let [enc (java.net.URLEncoder/encode session-id "UTF-8")
+          login-url (str base-url "/auth/login?session=" enc)
+          login-get (http-get login-url)]
+      (check! (= 200 (:status login-get))
+              (str "oauth redirect chain for session " session-id)
+              login-get)
+      (let [choose (http-post-form (str base-url "/auth/choose-username")
+                                   {:session session-id :username username})]
+        (check! (= 200 (:status choose))
+                (str "choose-username for " username " returns 200")
+                choose)
+        (let [poll (http-get (str base-url "/api/v0/pending-session/" session-id))]
+          (check! (= 200 (:status poll))
+                  (str "pending-session poll returns 200")
+                  poll)
+          (let [poll-json (json/parse-string (:body poll) true)]
+            (check! (:complete poll-json)
+                    (str "pending session complete for " username)
+                    poll)
+            (:token poll-json)))))))
+
 (defn parse-query [s]
   (into {}
         (for [part (str/split (or s "") #"&")
diff --git a/types/src/lib.rs b/types/src/lib.rs
index a715fe5639f4a3a7bfedcc706b5fb312b98c9ac5..98c66a00fd27803ef6f75b5ac478ff2eb762d771 100644
--- a/types/src/lib.rs
+++ b/types/src/lib.rs
@@ -123,13 +123,32 @@ pub struct PathDetailResponse {
 #[derive(Debug, Serialize, Deserialize)]
 pub struct ThreadDetailResponse {
     pub thread: String,
-    pub posts: Vec<PostRow>,
-    /// Total posts in this thread.
+    /// Chronological page: prose posts and room system lines, oldest first within the window.
+    pub items: Vec<ThreadItem>,
+    /// Total rows (posts + system lines) in this thread after filters.
     pub total: usize,
-    /// Chronological offset of the first post in this page.
+    /// Offset into the merged chronological list.
     pub offset: usize,
 }
 
+/// One row in a thread timeline: a normal post or a room system line.
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum ThreadItem {
+    Post {
+        id: String,
+        index: usize,
+        ts: i64,
+        actor: String,
+        body: String,
+        truncated: bool,
+    },
+    System {
+        ts: i64,
+        text: String,
+    },
+}
+
 /// One post in a thread. Full body, no snippet.
 #[derive(Debug, Serialize, Deserialize)]
 pub struct PostRow {
@@ -224,6 +243,23 @@ pub struct FeedPost {
 // RPC batch API (`POST /api/v0/rpc`)
 // ---------------------------------------------------------------------------
 
+fn default_invite_max_uses() -> usize {
+    1
+}
+
+/// One principal's capabilities in a private room (from [`RpcCommand::RoomAudit`]).
+#[derive(Debug, Serialize, Deserialize)]
+pub struct RoomAuditEntry {
+    pub username: String,
+    pub capabilities: Vec<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct RoomAuditResponse {
+    pub room: String,
+    pub grants: Vec<RoomAuditEntry>,
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 #[serde(transparent)]
 pub struct RpcBatch(pub Vec<RpcCommand>);
@@ -287,10 +323,27 @@ pub enum RpcCommand {
         visibility: Option<String>,
     },
     RoomGrant {
+        room: String,
+        username: String,
+        /// Capability names: `view`, `post`, `vote`, `add_item`, `manage`.
+        capabilities: Vec<String>,
+    },
+    RoomRevoke {
         room: String,
         username: String,
         capability: String,
     },
+    /// Mint a shareable invite link (24h TTL, stored in memory only until redeemed or expiry).
+    RoomMintInvite {
+        room: String,
+        capabilities: Vec<String>,
+        #[serde(default = "default_invite_max_uses")]
+        max_uses: usize,
+    },
+    /// List principals granted access in a room (requires View or Manage).
+    RoomAudit {
+        room: String,
+    },
     GetGlobalRank {
         room: String,
         #[serde(default)]
@@ -361,6 +414,13 @@ pub enum RpcResult {
     RoomCreated {
         room_id: String,
     },
+    RoomInviteMinted {
+        invite_url: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        expires_at_ms: Option<i64>,
+        max_uses: usize,
+    },
+    RoomAudit(RoomAuditResponse),
     GrantOk {},
     GlobalRank(GlobalRankResponse),
     Pair(PairResponse),


Side B — contributor: tommy-mor
Side B — commit message:
[4e327784] deploy live constitution dashboard

Expose auditable progress and event streaming, configure the production roots and runtime, and make tested main-branch commits the deployment authority.

Co-authored-by: Cursor <cursoragent@cursor.com>

Side B — unified diff (full patch):
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000000000000000000000000000000000000..c9d63a722beba0a0297fc853089332c460ab78dd
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+.git
+.venv
+.hypothesis
+__pycache__
+tests
+*.json
+*.bsp
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000000000000000000000000000000000000..76dcdf82d53177c1e47d86b23a54523239d232a6
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,49 @@
+name: Test and deploy
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: production
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - name: Run Python tests
+        run: uv run pytest -q
+
+      - name: Install Babashka
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/babashka/babashka/master/install \
+            | sudo bash -s -- --dir /usr/local/bin
+
+      - name: Run process integration tests
+        run: bb TEST.sh
+
+  deploy:
+    needs: test
+    runs-on: ubuntu-latest
+    environment:
+      name: production
+      url: https://token.slug.social
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: superfly/flyctl-actions/setup-flyctl@master
+
+      - name: Deploy to Fly
+        run: flyctl deploy --remote-only
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000000000000000000000000000000000000..c9a5c00782371c19ad5ab5c58cf6f5a8ffec0141
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,17 @@
+FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-install-project
+
+COPY constitution.py ./
+
+ENV PATH="/app/.venv/bin:${PATH}" \
+    PYTHONUNBUFFERED="1"
+
+EXPOSE 8080
+CMD ["python", "constitution.py"]
diff --git a/constitution.py b/constitution.py
index 4bee9f83663ab7fb36db95129b92b64b4ef57258..a58257e1881b21d1d6fa8e68a3faa222e4f661ef 100644
--- a/constitution.py
+++ b/constitution.py
@@ -24,12 +24,12 @@ A daily GitHub Action backs up the JSONL ledger to the same repo.
 Run: uv run constitution.py
 """
 
-from decimal import Decimal, getcontext
+from decimal import Decimal, getcontext, DefaultContext
 from datetime import datetime, timezone
 from fastapi import FastAPI, Request, Response
 from fastapi.responses import PlainTextResponse, HTMLResponse
 from starlette.middleware.sessions import SessionMiddleware
-import json, time, os, asyncio, httpx, pathlib, subprocess, hashlib, re, fcntl
+import json, time, os, asyncio, httpx, pathlib, subprocess, hashlib, re, fcntl, base64
 import sympy as sp  # type: ignore[reportMissingImports]
 from tenacity import retry, retry_if_exception, stop_after_attempt, wait_exponential
 from evaleval import (
@@ -37,6 +37,7 @@ from evaleval import (
     exec_event, One, Two, Three, Selector, MORPH, PREPEND,
 )
 
+DefaultContext.prec = 50
 getcontext().prec = 50
 
 app = FastAPI()
@@ -129,14 +130,47 @@ OPENROUTER_BASE_URL = os.environ.get("OPENROUTER_BASE_URL", "https://openrouter.
 # using the exact same source; their normalized values are committed to every
 # discovery event.
 DEFAULT_REPOSITORIES = [
+    {
+        "id": "constitution",
+        "url": "https://github.com/sortersocial/constitution.git",
+        "refs": ["refs/heads/**"],
+    },
     {
         "id": "slug",
-        "url": "https://github.com/tommy-mor/slug.git",
+        "url": "https://github.com/sortersocial/slug.git",
+        "refs": ["refs/heads/**"],
+    },
+    {
+        "id": "sorter",
+        "url": "https://github.com/sorterisntonline/sorter.git",
+        "refs": ["refs/heads/**"],
+    },
+    {
+        "id": "sorter2",
+        "url": "https://github.com/sortersocial/sorter2.git",
+        "refs": ["refs/heads/**"],
+    },
+    {
+        "id": "sorter-oldest",
+        "url": "https://github.com/tommy-mor/sorter.git",
         "refs": ["refs/heads/**"],
     },
 ]
 DEFAULT_CONTRIBUTORS = {
     "tommy-mor": ["thmorriss@gmail.com"],
+    "christopher-whitman": [
+        "chris@cwwhitman.com",
+        "7566903+cwwhitman@users.noreply.github.com",
+    ],
+    "jake-chvatal": [
+        "jake+github@uln.industries",
+        "jakechvatal@gmail.com",
+        "jake@isnt.online",
+    ],
+    "lara": ["me@lara.lv"],
+    "nat-reid": ["nathanielreid@gmail.com"],
+    "zod": ["jason.p.mcel@gmail.com", "me@zod.tf"],
+    "jovan": ["jovan@slug.social", "jovan@getcivicai.com"],
 }
 
 REPOSITORIES = json.loads(
@@ -147,6 +181,7 @@ CONTRIBUTORS = json.loads(
 )
 GIT_MIRROR_DIR = pathlib.Path(os.environ.get("GIT_MIRROR_DIR", "/data/git"))
 GIT_TIMEOUT_SECONDS = int(os.environ.get("GIT_TIMEOUT_SECONDS", "120"))
+GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN", "")
 
 # Council model IDs: slug.social garden rank under this parent (bodies = OpenRouter URLs), then top-up from OpenRouter list.
 SLUG_SOCIAL_BASE_URL = os.environ.get("SLUG_SOCIAL_BASE_URL", "https://slug.social").rstrip("/")
@@ -661,20 +696,30 @@ def _git(repo: pathlib.Path | None, *args: str, input_bytes: bytes | None = None
     if repo is not None:
         command += ["-C", str(repo)]
     command += list(args)
+    git_env = {
+        **os.environ,
+        "GIT_CONFIG_NOSYSTEM": "1",
+        "GIT_CONFIG_GLOBAL": os.devnull,
+        "GIT_NO_REPLACE_OBJECTS": "1",
+        "LC_ALL": "C",
+        "TZ": "UTC",
+    }
+    if GITHUB_TOKEN:
+        credential = base64.b64encode(
+            f"x-access-token:{GITHUB_TOKEN}".encode()
+        ).decode()
+        git_env.update({
+            "GIT_CONFIG_COUNT": "1",
+            "GIT_CONFIG_KEY_0": "http.https://github.com/.extraHeader",
+            "GIT_CONFIG_VALUE_0": f"Authorization: Basic {credential}",
+        })
     try:
         result = subprocess.run(
             command,
             input=input_bytes,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
-            env={
-                **os.environ,
-                "GIT_CONFIG_NOSYSTEM": "1",
-                "GIT_CONFIG_GLOBAL": os.devnull,
-                "GIT_NO_REPLACE_OBJECTS": "1",
-                "LC_ALL": "C",
-                "TZ": "UTC",
-            },
+            env=git_env,
             timeout=GIT_TIMEOUT_SECONDS,
             check=False,
         )
@@ -844,9 +889,15 @@ def _build_discovery(epoch_n: int, boundary_ms: int, events: list) -> GitDiscove
         canonical_location = min(
             locations[qualified_oid], key=lambda x: (x[0], x[1])
         )
+        # One commit may be reachable from dozens of refs in the same mirror.
+        # Verify its object once per repository, not once per source ref.
+        object_locations = {
+            (str(m), raw_oid): (m, raw_oid)
+            for _, _, m, raw_oid in locations[qualified_oid]
+        }
         object_hashes = {
             hashlib.sha256(_git(m, "cat-file", "commit", raw_oid)).hexdigest()
-            for _, _, m, raw_oid in locations[qualified_oid]
+            for m, raw_oid in object_locations.values()
         }
         if len(object_hashes) != 1:
             raise RuntimeError(f"conflicting Git objects share OID {qualified_oid}")
@@ -994,11 +1045,55 @@ async def discover_repositories(epoch_n: int, boundary_ms: int) -> GitDiscovery:
 
 
 SSE_CLIENTS = []
+AUDIT_HISTORY = []
+AUDIT_SEQUENCE = 0
+PROCESS_STATE = {
+    "running": False,
+    "phase": "idle",
+    "progress": 100,
+    "message": "Waiting for the next epoch",
+}
+
+
+def _sse_event(event_name: str, payload: dict) -> str:
+    return (
+        f"event: {event_name}\n"
+        f"data: {json.dumps(payload, separators=(',', ':'))}\n\n"
+    )
+
+
+async def broadcast_audit(
+    kind: str,
+    message: str,
+    *,
+    progress: int | None = None,
+    phase: str | None = None,
+) -> dict:
+    global AUDIT_SEQUENCE
+    AUDIT_SEQUENCE += 1
+    if progress is not None:
+        PROCESS_STATE["progress"] = max(0, min(100, int(progress)))
+    if phase is not None:
+        PROCESS_STATE["phase"] = phase
+    PROCESS_STATE["message"] = message
+    payload = {
+        "id": AUDIT_SEQUENCE,
+        "timestamp_ms": int(time.time() * 1000),
+        "kind": kind,
+        "message": message,
+        **PROCESS_STATE,
+    }
+    AUDIT_HISTORY.append(payload)
+    del AUDIT_HISTORY[:-200]
+    wire = _sse_event("audit", payload)
+    for queue in list(SSE_CLIENTS):
+        await queue.put(wire)
+    return payload
 
 
 async def broadcast_js(js: str):
     """Send a JS snippet to all connected SSE clients."""
-    for queue in SSE_CLIENTS:
+    for queue in list(SSE_CLIENTS):
         await queue.put(js)
 
 
@@ -1006,10 +1101,29 @@ async def rank_commits(commits: list[dict]):
     if not commits:
         return {}, []
 
-    models = await fetch_top_models(n=3)
     contributors = sorted(set(c["contributor"] for c in commits))
-    if len(contributors) > 1 and not models:
+    if len(contributors) == 1:
+        await broadcast_audit(
+            "ranking",
+            f"Only {contributors[0]} is eligible; rank is 1.0",
+            progress=90,
+            phase="finalizing",
+        )
+        return {contributors[0]: Decimal("1")}, []
+    if not (OPENROUTER_API_KEY or "").strip():
+        raise RuntimeError(
+            "OPENROUTER_API_KEY is required when multiple contributors need ranking"
+        )
+
+    models = await fetch_top_models(n=3)
+    if not models:
         raise RuntimeError("no council models available for contributor ranking")
+    await broadcast_audit(
+        "council",
+        f"Council selected: {', '.join(models)}",
+        progress=35,
+        phase="ranking",
+    )
     await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
         ["div.log-council", f"Council: {', '.join(models)} — {len(commits)} commits"]
     ]))
@@ -1035,6 +1149,11 @@ async def rank_commits(commits: list[dict]):
 
     async def compare_fn(i, j):
         a1, a2 = authors[i], authors[j]
+        await broadcast_audit(
+            "comparison",
+            f"Comparing {a1} with {a2}",
+            phase="ranking",
+        )
         await broadcast_js(exec_event(Three[Selector("#emission-status")][MORPH][
             ["div#emission-status", f"Comparing {a1} vs {a2}…"]
         ]))
@@ -1050,6 +1169,11 @@ async def rank_commits(commits: list[dict]):
                 if winner_weight <= 0 or loser_weight <= 0:
                     raise ValueError("ratio weights must be positive")
                 results.append((w, l, winner_weight, loser_weight))
+                await broadcast_audit(
+                    "vote",
+                    f"{model}: {authors[w]} over {authors[l]} ({result['ratio']})",
+                    phase="ranking",
+                )
                 await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
                     ["div.log-vote",
                         ["span.model", model], " — ",
@@ -1059,6 +1183,11 @@ async def rank_commits(commits: list[dict]):
                     ]
                 ]))
             except Exception as e:
+                await broadcast_audit(
+                    "error",
+                    f"{model} failed: {e}",
+                    phase="error",
+                )
                 await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
                     ["div.log-error", f"⚠ {model}: {e}"]
                 ]))
@@ -1068,8 +1197,13 @@ async def rank_commits(commits: list[dict]):
     async def progress_fn(ev):
         if ev["phase"] == "spanning_tree":
             label = f"Spanning tree: {ev['step']}/{ev['total']}"
+            percent = 35 + round(35 * ev["step"] / max(ev["total"], 1))
         else:
             label = f"Zip pass {ev['pass']}: {ev['step']}/{ev['total']}"
+            percent = 70 + round(20 * ev["step"] / max(ev["total"], 1))
+        await broadcast_audit(
+            "progress", label, progress=percent, phase="ranking"
+        )
         await broadcast_js(exec_event(Three[Selector("#emission-status")][MORPH][
             ["div#emission-status", label]
         ]))
@@ -1083,6 +1217,12 @@ async def rank_commits(commits: list[dict]):
     scores = rank_centrality(pairs)
     ranking = {authors[i]: Decimal(str(scores[i])) for i in range(len(authors))}
     ranking_rows = sorted(ranking.items(), key=lambda x: x[1], reverse=True)
+    await broadcast_audit(
+        "ranking",
+        "Ranking: " + ", ".join(f"{a} {s:.4f}" for a, s in ranking_rows),
+        progress=90,
+        phase="finalizing",
+    )
     await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
         ["div.log-ranking",
             ["b", "Ranking: "],
@@ -1104,11 +1244,33 @@ def pool_remaining(events: list) -> Decimal:
 
 
 async def run_emission(epoch_n, boundary_ms):
+    PROCESS_STATE["running"] = True
+    await broadcast_audit(
+        "start",
+        f"Epoch {epoch_n} emission started",
+        progress=2,
+        phase="starting",
+    )
     await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
         ["div.log-start", f"⚡ Epoch {epoch_n} emission started"]
     ]))
 
+    await broadcast_audit(
+        "discovery",
+        "Fetching configured repositories and snapshotting refs",
+        progress=8,
+        phase="discovery",
+    )
     discovery = await discover_repositories(epoch_n, boundary_ms)
+    await broadcast_audit(
+        "discovery",
+        (
+            f"Discovered {len(discovery.observations)} new commits; "
+            f"{len(discovery.commits)} are eligible"
+        ),
+        progress=30,
+        phase="discovery",
+    )
     ranking, models = await rank_commits(discovery.commits)
 
     def make_emission(events):
@@ -1146,6 +1308,13 @@ async def run_emission(epoch_n, boundary_ms):
 
     entry = await store.atomic(make_emission)
     if entry:
+        PROCESS_STATE["running"] = False
+        await broadcast_audit(
+            "complete",
+            f"Epoch {entry.epoch} complete; emitted {entry.total_emitted} SLG",
+            progress=100,
+            phase="idle",
+        )
         await broadcast_js(exec_event(Three[Selector("#emission-log")][PREPEND][
             ["div.log-amount",
                 f"Pool {entry.pool_before} → emit {entry.total_emitted} → {entry.pool_after}"]
@@ -1189,13 +1358,24 @@ async def distribute_usdc(holdings, treasury_balance):
 async def epoch_loop():
     while True:
         epoch_n, current_start, next_boundary = current_epoch()
+        processed = {e.epoch for e in store.read() if isinstance(e, Emission)}
+        if epoch_n >= 0 and epoch_n not in processed:
+            try:
+                await run_emission(epoch_n, current_start)
+            except Exception as exc:
+                PROCESS_STATE["running"] = False
+                await broadcast_audit(
+                    "error",
+                    f"Epoch {epoch_n} failed: {exc}; retrying in 60 seconds",
+                    phase="error",
+                )
+                print(f"epoch {epoch_n} emission failed: {exc}", flush=True)
+                await asyncio.sleep(60)
+                continue
+
         now = int(time.time() * 1000)
         wait_ms = next_boundary - now
-
         if wait_ms <= 0:
-            processed = {e.epoch for e in store.read() if isinstance(e, Emission)}
-            if epoch_n not in processed and epoch_n >= 0:
-                await run_emission(epoch_n, current_start)
             await asyncio.sleep(60)
         elif wait_ms < 86_400_000:
             await broadcast_js(exec_event(Three[Selector("#emission-status")][MORPH][
@@ -1243,6 +1423,36 @@ async def get_ranking():
     return {"ranking": latest.ranking, "epoch": latest.epoch}
 
 
+@app.get("/api/status")
+async def get_status():
+    events = store.read()
+    discoveries = [e for e in events if isinstance(e, GitDiscovery)]
+    emissions = [e for e in events if isinstance(e, Emission)]
+    return {
+        **PROCESS_STATE,
+        "epoch": current_epoch()[0],
+        "openrouter_configured": bool((OPENROUTER_API_KEY or "").strip()),
+        "sse_clients": len(SSE_CLIENTS),
+        "latest_discovery": (
+            {
+                "epoch": discoveries[-1].epoch,
+                "snapshot_id": discoveries[-1].snapshot_id,
+                "observations": len(discoveries[-1].observations),
+                "eligible_commits": len(discoveries[-1].commits),
+            }
+            if discoveries else None
+        ),
+        "latest_emission": (
+            {
+                "epoch": emissions[-1].epoch,
+                "total_emitted": emissions[-1].total_emitted,
+                "ranking": emissions[-1].ranking,
+            }
+            if emissions else None
+        ),
+    }
+
+
 @app.get("/api/contributor/{github_username}")
 async def get_contributor(github_username: str):
     history = [
@@ -1306,13 +1516,6 @@ async def test_emit():
 
 # ===========================================================================
 # §9. SSE — live audit stream of the pairwise voting process
-#
-# TODO: the /sse emission audit page needs a real SSE-driven UI. votes arrive
-# incrementally during rank_commits(), and the client should show a live
-# progress bar and per-vote results as they stream in. this requires a
-# dedicated page that connects to /sse and updates the DOM on each event
-# (council, comparing, vote, ranking, emission_complete). defer until we
-# have playwright tests to cover it — the incremental rendering is fiddly.
 # ===========================================================================
 
 @app.get("/sse")
@@ -1322,6 +1525,13 @@ async def sse_stream(request: Request):
 
     async def generate():
         try:
+            yield _sse_event("audit", {
+                "id": AUDIT_SEQUENCE,
+                "timestamp_ms": int(time.time() * 1000),
+                "kind": "connection",
+                "message": f"Connected to epoch {current_epoch()[0]}",
+                **PROCESS_STATE,
+            })
             yield exec_event(Three[Selector("#emission-status")][MORPH][
                 ["div#emission-status", f"Connected — epoch {current_epoch()[0]}"]
             ])
@@ -1334,10 +1544,15 @@ async def sse_stream(request: Request):
                 except asyncio.TimeoutError:
                     yield ": keepalive\n\n"
         finally:
-            SSE_CLIENTS.remove(queue)
+            if queue in SSE_CLIENTS:
+                SSE_CLIENTS.remove(queue)
 
     from starlette.responses import StreamingResponse
-    return StreamingResponse(generate(), media_type="text/event-stream")
+    return StreamingResponse(
+        generate(),
+        media_type="text/event-stream",
+        headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
+    )
 
 
 # ===========================================================================
@@ -1359,6 +1574,7 @@ def _page(title: str, body: list) -> HTMLResponse:
             ["meta", {"charset": "utf-8"}],
             ["meta", {"name": "viewport", "content": "width=device-width, initial-scale=1"}],
             ["title", title],
+            ["style", RawContent(_WATCH_CSS)],
         ],
         ["body",
             body,
@@ -1367,6 +1583,387 @@ def _page(title: str, body: list) -> HTMLResponse:
     ]))
 
 
+_WATCH_CSS = """
+/* ================================================================
+   ZIGGURAT — bevel-first dark theme
+   --spread (0→1) controls bevel depth. 0 = flat. 1 = full relief.
+   Light source: top-left. Shadow: bottom-right.
+   Platforms nest. Each level is raised. Nothing is rounded.
+   ================================================================ */
+
+:root {
+  color-scheme: dark;
+  --spread: 1;
+
+  --g0: #080808;
+  --g1: #131313;
+  --g2: #1c1c1c;
+  --g3: #252525;
+  --g4: #2e2e2e;
+  --g5: #383838;
+
+  --hi: #5e5e5e;
+  --lo: #050505;
+  --bv: calc(var(--spread) * 4px + 1px);
+  --bv-lg: calc(var(--spread) * 6px + 2px);
+
+  --signal: #f0f0f0;
+  --prose: #c2c2c2;
+  --ui: #888;
+  --meta: #4a4a4a;
+  --link: #8899ee;
+  --code-fg: #c8dda0;
+
+  --font-prose: "Iowan Old Style", "Palatino Linotype", Palatino, "Book Antiqua", Georgia, serif;
+  --font-ui: system-ui, -apple-system, sans-serif;
+  --font-code: ui-monospace, "Cascadia Code", "SF Mono", Menlo, monospace;
+}
+
+*, *::before, *::after { box-sizing: border-box; }
+html, body { margin: 0; padding: 0; }
+
+body {
+  background: var(--g0);
+  color: var(--prose);
+  font-family: var(--font-ui);
+  font-size: 14px;
+  line-height: 1.6;
+  margin: 0 auto;
+  max-width: 560px;
+  min-height: 100vh;
+  padding: 0 16px 48px;
+}
+main { width: 100%; padding: 18px 0 48px; }
+
+h1, h2, h3 {
+  color: var(--signal);
+  font-size: 11px;
+  font-weight: bold;
+  letter-spacing: 0.12em;
+  margin: 14px 0 6px;
+  text-transform: uppercase;
+}
+a { color: var(--link); text-decoration: none; }
+a:hover { color: var(--signal); }
+.eyebrow {
+  background: var(--g2);
+  border: var(--bv) solid;
+  border-color: var(--hi) var(--lo) var(--lo) var(--hi);
+  color: var(--ui);
+  font-size: 11px;
+  letter-spacing: 0.12em;
+  padding: 4px 10px;
+  text-transform: uppercase;
+  width: fit-content;
+}
+
+/* Every dashboard section is a raised platform. */
+.panel {
+  background: var(--g2);
+  border: var(--bv-lg) solid;
+  border-color: var(--hi) var(--lo) var(--lo) var(--hi);
+  margin: 8px 0;
+  padding: 10px;
+  width: 100%;
+}
+.status-row {
+  align-items: center;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  justify-content: space-between;
+}
+#process-status { color: var(--signal); font-family: var(--font-code); font-weight: bold; }
+.badge {
+  align-items: center;
+  background: var(--g3);
+  border: var(--bv) solid;
+  border-color: var(--hi) var(--lo) var(--lo) var(--hi);
+  color: var(--ui);
+  display: inline-flex;
+  font-size: 11px;
+  gap: 7px;
+  padding: 3px 8px;
+}
+.dot { background: var(--meta); height: 8px; width: 8px; }
+.live .dot { background: #7acc7a; }
+.warn .dot { background: #cc9955; }
+
+/* The progress track is inset; its signal is raised inside it. */
+.progress-shell {
+  background: var(--g1);
+  border: var(--bv-lg) solid;
+  border-color: var(--lo) var(--hi) var(--hi) var(--lo);
+  height: 58px;
+  margin: 14px 0 10px;
+  overflow: hidden;
+  position: relative;
+}
+#progress-fill {
+  background: var(--link);
+  border: var(--bv) solid;
+  border-color: var(--hi) var(--lo) var(--lo) var(--hi);
+  height: 100%;
+  transition: width .35s steps(8, end);
+  width: 0;
+}
+#progress-label {
+  color: var(--signal);
+  display: grid;
+  font-family: var(--font-code);
+  font-size: 18px;
+  font-weight: bold;
+  inset: 0;
+  place-items: center;
+  position: absolute;
+  text-shadow: 1px 1px var(--lo);
+}
+
+.controls { align-items: center; display: flex; flex-wrap: wrap; gap: 8px; }
+button {
+  background: var(--g5);
+  border: var(--bv) solid;
+  border-color: var(--hi) var(--lo) var(--lo) var(--hi);
+  color: var(--signal);
+  cursor: pointer;
+  font: inherit;
+  font-size: 12px;
+  padding: 4px 10px;
+}
+button:hover { background: #404040; }
+button:active {
+  background: var(--g4);
+  border-color: var(--lo) var(--hi) var(--hi) var(--lo);
+  transform: translate(1px, 1px);
+}
+button:disabled { cursor: default; opacity: .4; }
+.note { color: var(--meta); font-size: 11px; margin: 4px 0; }
+
+.feed-head { align-items: baseline; display: flex; justify-content: space-between; }
+#audit-feed {
+  background: var(--g1);
+  border: var(--bv) solid;
+  border-color: var(--lo) var(--hi) var(--hi) var(--lo);
+  display: flex;
+  flex-direction: column;
+  gap: 5px;
+  margin-top: 8px;
+  padding: 6px;
+}
+.event {
+  background: var(--g3);
+  border: var(--bv) solid;
+  border-color: var(--hi) var(--lo) var(--lo) var(--hi);
+  display: grid;
+  gap: 6px;
+  grid-template-columns: 82px 88px 1fr;
+  padding: 5px 8px;
+}
+.event[data-kind="error"] { border-left-color: #cc5555; }
+.event[data-kind="complete"], .event[data-kind="ranking"] { border-left-color: #7acc7a; }
+.event[data-kind="vote"] { border-left-color: var(--link); }
+.event time, .event-kind { color: var(--meta); font-family: var(--font-code); font-size: 10px; }
+.event-kind { text-transform: uppercase; }
+.event-message { color: var(--prose); font-family: var(--font-prose); }
+
+code {
+  background: var(--g1);
+  border: 2px solid;
+  border-color: var(--lo) var(--hi) var(--hi) var(--lo);
+  color: var(--code-fg);
+  font-family: var(--font-code);
+  font-size: 12px;
+  padding: 1px 4px;
+}
+
+@media (max-width: 520px) {
+  .event { grid-template-columns: 72px 1fr; }
+  .event-message { grid-column: 1 / -1; }
+}
+"""
+
+
+def _watch_initial_state() -> dict:
+    events = store.read()
+    feed = []
+    for event_ in events[-40:]:
+        if isinstance(event_, GitDiscovery):
+            feed.append({
+                "id": f"discovery-{event_.snapshot_id}",
+                "timestamp_ms": event_.timestamp_ms,
+                "kind": "discovery",
+                "message": (
+                    f"Epoch {event_.epoch}: observed {len(event_.observations)} commits; "
+                    f"{len(event_.commits)} eligible"
+                ),
+            })
+        elif isinstance(event_, Emission):
+            feed.append({
+                "id": f"emission-{event_.epoch}",
+                "timestamp_ms": event_.timestamp_ms,
+                "kind": "complete",
+                "message": (
+                    f"Epoch {event_.epoch}: emitted {event_.total_emitted} SLG; "
+                    f"ranking {event_.ranking}"
+                ),
+            })
+    feed.extend(AUDIT_HISTORY)
+    return {
+        "process": dict(PROCESS_STATE),
+        "openrouter_configured": bool((OPENROUTER_API_KEY or "").strip()),
+        "epoch": current_epoch()[0],
+        "feed": feed[-200:],
+    }
+
+
+_WATCH_JS = """
+const initial = __INITIAL__;
+const feed = document.querySelector('#audit-feed');
+const processStatus = document.querySelector('#process-status');
+const connection = document.querySelector('#connection-status');
+const fill = document.querySelector('#progress-fill');
+const progressLabel = document.querySelector('#progress-label');
+const play = document.querySelector('#play');
+const pause = document.querySelector('#pause');
+const seen = new Set();
+let source = null;
+
+function setProgress(value) {
+  const n = Math.max(0, Math.min(100, Number(value ?? 0)));
+  fill.style.width = `${n}%`;
+  progressLabel.textContent = `${Math.round(n)}%`;
+  document.querySelector('.progress-shell').setAttribute('aria-valuenow', String(n));
+}
+
+function addEvent(event) {
+  const id = String(event.id);
+  if (seen.has(id)) return;
+  seen.add(id);
+  const row = document.createElement('div');
+  row.className = 'event';
+  row.dataset.kind = event.kind || 'event';
+  const when = document.createElement('time');
+  when.dateTime = new Date(event.timestamp_ms).toISOString();
+  when.textContent = new Date(event.timestamp_ms).toLocaleTimeString();
+  const kind = document.createElement('span');
+  kind.className = 'event-kind';
+  kind.textContent = event.kind || 'event';
+  const message = document.createElement('span');
+  message.className = 'event-message';
+  message.textContent = event.message;
+  row.append(when, kind, message);
+  feed.prepend(row);
+  while (feed.children.length > 200) feed.lastElementChild.remove();
+}
+
+function applyState(event) {
+  processStatus.textContent = event.message || 'Waiting for the next epoch';
+  setProgress(event.progress);
+  if (event.kind !== 'connection') addEvent(event);
+}
+
+function connect() {
+  if (source) return;
+  source = new EventSource('/sse');
+  connection.classList.remove('warn');
+  connection.classList.add('live');
+  connection.querySelector('span:last-child').textContent = 'connecting';
+  play.disabled = true;
+  pause.disabled = false;
+  source.onopen = () => {
+    connection.querySelector('span:last-child').textContent = 'live';
+  };
+  source.addEventListener('audit', event => applyState(JSON.parse(event.data)));
+  source.onerror = () => {
+    connection.classList.remove('live');
+    connection.classList.add('warn');
+    connection.querySelector('span:last-child').textContent = 'reconnecting';
+  };
+}
+
+function disconnect() {
+  if (source) source.close();
+  source = null;
+  connection.classList.remove('live');
+  connection.classList.add('warn');
+  connection.querySelector('span:last-child').textContent = 'paused locally';
+  play.disabled = false;
+  pause.disabled = true;
+}
+
+play.addEventListener('click', connect);
+pause.addEventListener('click', disconnect);
+initial.feed.forEach(addEvent);
+processStatus.textContent = initial.process.message;
+setProgress(initial.process.progress);
+connect();
+"""
+
+
+@app.get("/watch")
+async def watch():
+    initial = json.dumps(
+        _watch_initial_state(), separators=(",", ":")
+    ).replace("</", "<\\/")
+    script = _WATCH_JS.replace("__INITIAL__", initial)
+    key_ok = bool((OPENROUTER_API_KEY or "").strip())
+    return HTMLResponse(render(["html",
+        ["head",
+            ["meta", {"charset": "utf-8"}],
+            ["meta", {"name": "viewport", "content": "width=device-width, initial-scale=1"}],
+            ["title", "slug — live constitution"],
+            ["style", RawContent(_WATCH_CSS)],
+        ],
+        ["body", ["main",
+            ["div.eyebrow", f"epoch {current_epoch()[0]} · constitutional audit"],
+            ["h1", "watch the process"],
+            ["section.panel",
+                ["div.status-row",
+                    ["div#process-status", PROCESS_STATE["message"]],
+                    ["div#connection-status.badge", ["span.dot"], ["span", "connecting"]],
+                ],
+                ["div.progress-shell", {
+                    "role": "progressbar", "aria-label": "Emission progress",
+                    "aria-valuemin": "0", "aria-valuemax": "100",
+                    "aria-valuenow": str(PROCESS_STATE["progress"]),
+                },
+                    ["div#progress-fill"],
+                    ["div#progress-label", f"{PROCESS_STATE['progress']}%"],
+                ],
+                ["div.controls",
+                    ["button#play", {"type": "button", "disabled": "true"}, "▶ Play live feed"],
+                    ["button#pause", {"type": "button"}, "Ⅱ Pause feed"],
+                    ["span.note", "Pause stops local updates; the constitutional process continues."],
+                ],
+            ],
+            ["section.panel",
+                ["div.status-row",
+                    ["strong", "Council readiness"],
+                    ["div.badge" + (".live" if key_ok else ".warn"),
+                        ["span.dot"],
+                        ["span", "OpenRouter configured" if key_ok else "OpenRouter key missing"],
+                    ],
+                ],
+                ["p.note",
+                    (
+                        "Pairwise council voting is ready."
+                        if key_ok else
+                        "Single-contributor epochs can finalize, but contested rankings require OPENROUTER_API_KEY."
+                    )
+                ],
+            ],
+            ["section.panel",
+                ["div.feed-head", ["h2", "event feed"], ["a", {"href": "/sse"}, "raw SSE"]],
+                ["div#audit-feed"],
+            ],
+            ["p", ["a", {"href": "/"}, "← constitution"], " · ",
+                  ["a", {"href": "/api/status"}, "status JSON"], " · ",
+                  ["a", {"href": "/api/ledger"}, "ledger"]],
+        ]],
+        ["script", {"type": "module"}, RawContent(script)],
+    ]))
+
+
 async def redeem(github_user: str, wallet_address: str):
     await store.append(Redemption(
         timestamp_ms=int(time.time() * 1000),
@@ -1386,7 +1983,7 @@ async def index(request: Request):
             ["p", "Total supply is 1.0 SLUG ownership unit. FDV is 177,600 USDC. Initial LP seed is 1,331 USDC."],
             ["p", ["a", {"href": "/login"}, "Login with GitHub to check your emissions"]],
             ["p",
-                ["a", {"href": "/sse"}, "Watch emission process live"], " | ",
+                ["a", {"href": "/watch"}, "Watch emission process live"], " | ",
                 ["a", {"href": "/api/epoch"}, "Current epoch"], " | ",
                 ["a", {"href": "/api/ledger"}, "Full ledger"], " | ",
                 ["a", {"href": "/api/halvening"}, "Jubilee countdown"],
@@ -1414,7 +2011,7 @@ async def index(request: Request):
         ["p",
             ["a", {"href": "/api/epoch"}, "Current epoch"], " | ",
             ["a", {"href": "/api/ledger"}, "Full ledger"], " | ",
-            ["a", {"href": "/sse"}, "Watch emission live"],
+            ["a", {"href": "/watch"}, "Watch emission live"],
         ],
     ])
 
diff --git a/fly.toml b/fly.toml
new file mode 100644
index 0000000000000000000000000000000000000000..1b08c7090185b1f8a17884eb86254c1e8d16ad60
--- /dev/null
+++ b/fly.toml
@@ -0,0 +1,35 @@
+app = "slug-constitution"
+primary_region = "ord"
+
+[build]
+  dockerfile = "Dockerfile"
+
+[env]
+  GENESIS_MS = "1775364391260"
+  JSONL_PATH = "/data/ledger.jsonl"
+  GIT_MIRROR_DIR = "/data/git"
+  PORT = "8080"
+
+[http_service]
+  internal_port = 8080
+  force_https = true
+  auto_stop_machines = "off"
+  auto_start_machines = true
+  min_machines_running = 1
+  processes = ["app"]
+
+  [[http_service.checks]]
+    interval = "30s"
+    timeout = "10s"
+    grace_period = "30s"
+    method = "GET"
+    path = "/api/epoch"
+
+[[mounts]]
+  source = "slug_data"
+  destination = "/data"
+
+[[vm]]
+  memory = "2gb"
+  cpu_kind = "shared"
+  cpus = 1
diff --git a/tests/integration.clj b/tests/integration.clj
index 0d34e3b237b4037a28f5e99350e8d447455665de..06b9715e63966d14311b159cbc7058952bff2fbc 100644
--- a/tests/integration.clj
+++ b/tests/integration.clj
@@ -468,14 +468,29 @@
         (assert! (= 1 (count (:history contrib-resp)))   "alice has 1 emission in history")
         (assert! (pos? (parse-double (:total_earned contrib-resp))) "total_earned > 0")
 
-        ;; 9. SSE connects and sends initial event
+        ;; 9. watch UI exposes progress, controls, readiness, and live SSE
+        (println "\nchecking /watch UI…")
+        (bind watch-html (slurp (str base-url "/watch")))
+        (assert! (str/includes? watch-html "role=\"progressbar\"")
+                 "watch page has progress bar")
+        (assert! (str/includes? watch-html "id=\"play\"")
+                 "watch page has play control")
+        (assert! (str/includes? watch-html "id=\"pause\"")
+                 "watch page has pause control")
+        (assert! (str/includes? watch-html "OpenRouter configured")
+                 "watch page reports council readiness")
+        (bind status-resp (get-json base-url "/api/status"))
+        (assert! (true? (:openrouter_configured status-resp))
+                 "status API reports OpenRouter configuration")
+
+        ;; 10. SSE connects and sends initial event
         (println "\nchecking /sse initial event…")
         (bind sse-events (read-sse-events (str base-url "/sse") 1 5000))
         (assert! (= 1 (count sse-events))             "received 1 SSE event")
         (assert! (not (str/blank? (first sse-events)))
                  "initial SSE event contains executable audit data")
 
-        ;; 10. POST /test/emit — full ranking pipeline hits mocks
+        ;; 11. POST /test/emit — full ranking pipeline hits mocks
         (println "\ntriggering /test/emit (epoch 1)…")
         (bind emit-resp (post-json! base-url "/test/emit"))
         (assert! (= "emission" (:type emit-resp))     "emit response type is emission")
@@ -503,7 +518,7 @@
         (bind rank-after (get-json base-url "/api/ranking"))
         (assert! (= 1 (:epoch rank-after))           "latest ranking is epoch 1")
 
-        ;; 11. kill and restart — prove replay determinism
+        ;; 12. kill and restart — prove replay determinism
         (println "\nkilling server for replay test…")
         (.destroyForcibly (:proc server))
         (deref server)
diff --git a/tests/test_git_discovery.py b/tests/test_git_discovery.py
index 0dd31bc42a19bc8c59842dc61f193c595c474659..5a9e167e16ad2ffb25988af85820f6f19e8910cd 100644
--- a/tests/test_git_discovery.py
+++ b/tests/test_git_discovery.py
@@ -393,7 +393,9 @@ def test_empty_epoch_records_zero_emission_without_burning_pool(
     monkeypatch.setattr(c, "store", c.JsonlStore(discovery_config / "ledger.jsonl"))
 
     async def discover(_epoch, _boundary):
-        return SimpleNamespace(commits=[], snapshot_id="empty-snapshot")
+        return SimpleNamespace(
+            observations=[], commits=[], snapshot_id="empty-snapshot"
+        )
 
     async def rank(_commits):
         return {}, []
@@ -412,7 +414,11 @@ def test_emission_distribution_sums_exactly_to_total(
     monkeypatch.setattr(c, "store", c.JsonlStore(discovery_config / "ledger.jsonl"))
 
     async def discover(_epoch, _boundary):
-        return SimpleNamespace(commits=[{"x": 1}], snapshot_id="ranked-snapshot")
+        return SimpleNamespace(
+            observations=[{"x": 1}],
+            commits=[{"x": 1}],
+            snapshot_id="ranked-snapshot",
+        )
 
     async def rank(_commits):
         return {
@@ -454,6 +460,7 @@ def test_any_council_failure_aborts_ranking(monkeypatch):
 
     monkeypatch.setattr(c, "fetch_top_models", models)
     monkeypatch.setattr(c, "llm_pairwise_compare", compare)
+    monkeypatch.setattr(c, "OPENROUTER_API_KEY", "test-key")
     commits = [
         {
             "contributor": contributor,
@@ -465,3 +472,54 @@ def test_any_council_failure_aborts_ranking(monkeypatch):
     ]
     with pytest.raises(RuntimeError, match="council model failed"):
         asyncio.run(c.rank_commits(commits))
+
+
+def test_contested_ranking_requires_openrouter_key(monkeypatch):
+    monkeypatch.setattr(c, "OPENROUTER_API_KEY", "")
+    commits = [
+        {
+            "contributor": contributor,
+            "oid": "sha1:" + char * 40,
+            "message": contributor,
+            "patch": "patch",
+        }
+        for contributor, char in [("alice", "a"), ("bob", "b")]
+    ]
+    with pytest.raises(RuntimeError, match="OPENROUTER_API_KEY"):
+        asyncio.run(c.rank_commits(commits))
+
+
+def test_watch_page_has_live_controls_progress_and_key_warning(
+    discovery_config, monkeypatch
+):
+    monkeypatch.setattr(c, "store", c.JsonlStore(discovery_config / "ledger.jsonl"))
+    monkeypatch.setattr(c, "OPENROUTER_API_KEY", "")
+    monkeypatch.setattr(c, "current_epoch", lambda: (3, 0, 1))
+    response = asyncio.run(c.watch())
+    html = response.body.decode()
+    assert 'role="progressbar"' in html
+    assert 'id="play"' in html
+    assert 'id="pause"' in html
+    assert "new EventSource('/sse')" in html
+    assert "OpenRouter key missing" in html
+
+
+def test_audit_events_are_json_sse_and_update_process_state(monkeypatch):
+    clients = []
+    history = []
+    monkeypatch.setattr(c, "SSE_CLIENTS", clients)
+    monkeypatch.setattr(c, "AUDIT_HISTORY", history)
+    queue = asyncio.Queue()
+    clients.append(queue)
+
+    async def emit():
+        event = await c.broadcast_audit(
+            "progress", "halfway", progress=50, phase="ranking"
+        )
+        return event, await queue.get()
+
+    event, wire = asyncio.run(emit())
+    assert event["progress"] == 50
+    assert event["phase"] == "ranking"
+    assert wire.startswith("event: audit\ndata: {")
+    assert '"message":"halfway"' in wire