You are a constitutional council ranking individual git commits for ownership allocation.

Compare these two commits. Decide which contributed more lasting value to the project.

Judge substance, not spectacle:
- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.
- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.
- Do not favor a side merely because its patch is longer or noisier.
- Weight what the change does for the project, not the contributor's name.

Return ONLY a JSON object: {"winner": "A" or "B", "ratio": "N:M", "explanation": "..."}
The explanation must cite concrete differences in the patches (1-3 sentences).

Side A — contributor: tommy-mor
Side A — commit message:
[52f5c51c] Add Reddit OAuth linking and make UUID the only account identity.

OAuth providers only attach to a session UUID (first link creates the
principal); linked providers stay private on the account page.

Co-authored-by: Cursor <cursoragent@cursor.com>

Side A — unified diff (full patch):
diff --git a/AGENTS.md b/AGENTS.md
index 6e0fd8ebb65d665c9c1438e3275971d62b98fd95..e9cc3173dbeb21ad0fc090ca7b407b027c7820a9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -35,8 +35,11 @@ Environment variables (defaults in `server/src/state.rs`):
 - `SORTER2_DATA_DIR` — default `./data` (created on startup)
 - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`
 - `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)
-- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)
-- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)
+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth linking (optional)
+- `REDDIT_CLIENT_ID` / `REDDIT_CLIENT_SECRET` (or `REDDIT_APP_*`) — Reddit API import + OAuth linking (optional)
+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` and `/auth/reddit` (tests only)
+
+Identity: UUID is canonical. OAuth providers only *link* to a UUID (first link creates the principal). Linked providers are private to the account owner.
 
 Health check: `GET /healthz` → `ok`.
 
diff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs
index 5906f93b13853421e96a3c37bc9d8202a47842bf..c706ae8045a811e5941f5f6c72da88f42a403a82 100644
--- a/server/src/auth/mod.rs
+++ b/server/src/auth/mod.rs
@@ -1,4 +1,8 @@
-//! GitHub OAuth login, session cookies, and vote actor resolution.
+//! OAuth linking, session cookies, and vote actor resolution.
+//!
+//! Canonical identity is a UUID. OAuth providers only *link* to that UUID
+//! (first link creates the principal; later links attach while logged in).
+//! Which providers are linked is private to the account owner.
 
 pub mod config;
 pub mod identity;
@@ -22,7 +26,9 @@ use crate::{
     form_template::template_json_compact,
     html::layout,
     state::AppState,
-    storage_schema::{oauth_link_owner, pseudonym_owner, Store, StoreFields},
+    storage_schema::{
+        linked_providers_for_uuid, oauth_link_owner, pseudonym_owner, Store, StoreFields,
+    },
     ui_action::UI_RPC_FIELD,
 };
 
@@ -53,10 +59,12 @@ fn new_actor_uuid() -> String {
 pub struct LoginQuery {
     #[serde(default)]
     pub return_to: Option<String>,
+    #[serde(default)]
+    pub error: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
-pub struct GitHubStartQuery {
+pub struct OAuthStartQuery {
     #[serde(default)]
     pub return_to: Option<String>,
     #[serde(default)]
@@ -72,15 +80,22 @@ fn return_from_query_or_jar(jar: &CookieJar, query: Option<&str>) -> String {
         .unwrap_or_else(|| "/".to_string())
 }
 
-fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, String)> {
+/// Available OAuth link targets: `(provider_key, label, start_href)`.
+fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, &'static str, String)> {
     let mut out = Vec::new();
+    let enc = urlencoding::encode(return_to);
     if oauth::GitHubConfig::from_env(base_url).is_some() {
         out.push((
-            "GitHub",
-            format!(
-                "/auth/github?return_to={}",
-                urlencoding::encode(return_to)
-            ),
+            "github",
+            oauth::provider_label("github"),
+            format!("/auth/github?return_to={enc}"),
+        ));
+    }
+    if oauth::RedditConfig::from_env(base_url).is_some() {
+        out.push((
+            "reddit",
+            oauth::provider_label("reddit"),
+            format!("/auth/reddit?return_to={enc}"),
         ));
     }
     out
@@ -125,23 +140,41 @@ fn alias_claim_forms(return_to: &str, submit_label: &str) -> Result<Markup, Stat
     })
 }
 
-fn signed_out_body(providers: &[(&str, String)]) -> Markup {
+fn login_error_message(code: Option<&str>) -> Option<&'static str> {
+    match code {
+        Some("oauth_taken") => {
+            Some("that OAuth account is already linked to a different sorter2 account")
+        }
+        Some("oauth_failed") => Some("OAuth failed — try again"),
+        _ => None,
+    }
+}
+
+fn signed_out_body(
+    providers: &[(&str, &str, String)],
+    error: Option<&str>,
+) -> Markup {
     html! {
         main class="panel login-page" {
             section class="login-section" {
                 h1 { "sign in" }
-                p class="muted" { "link an account to vote under a lasting alias" }
+                p class="muted" {
+                    "link an OAuth account to create your identity, then claim an alias to vote"
+                }
+                @if let Some(msg) = login_error_message(error) {
+                    p class="alias-bad" data-testid="login-error" { (msg) }
+                }
                 @if providers.is_empty() {
                     p class="muted" {
-                        "OAuth is not configured. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET."
+                        "OAuth is not configured. Set GitHub and/or Reddit client credentials."
                     }
                 } @else {
                     ul class="oauth-provider-list" {
-                        @for (name, href) in providers {
+                        @for (key, label, href) in providers {
                             li {
                                 a href=(href) class="btn-primary oauth-provider"
-                                    data-testid=(format!("oauth-{}", name.to_lowercase())) {
-                                    (format!("Continue with {name}"))
+                                    data-testid=(format!("oauth-{key}")) {
+                                    (format!("Link {label}"))
                                 }
                             }
                         }
@@ -156,7 +189,10 @@ fn signed_out_body(providers: &[(&str, String)]) -> Markup {
 fn account_body(
     actor: &session::SessionActor,
     aliases: &[String],
-    providers: &[(&str, String)],
+    // Provider keys already linked to this UUID (private).
+    linked: &[String],
+    // Providers available to link: not yet attached.
+    unlinkable: &[(&str, &str, String)],
     claim_forms: Markup,
 ) -> Markup {
     let current = actor.pseudonym.trim();
@@ -212,16 +248,29 @@ fn account_body(
                 (claim_forms)
             }
 
-            @if !providers.is_empty() {
-                section class="login-section" {
-                    h2 { "linked sign-in" }
-                    p class="muted small" { "sign in again with the same provider to return to this account" }
+            section class="login-section" {
+                h2 { "linked sign-in" }
+                p class="muted small" {
+                    "private to you — linking more providers raises trust weight without publishing which accounts you use"
+                }
+                @if linked.is_empty() {
+                    p class="muted" data-testid="linked-providers-empty" { "none yet" }
+                } @else {
+                    ul class="linked-provider-list" data-testid="linked-providers" {
+                        @for key in linked {
+                            li data-testid=(format!("linked-{key}")) {
+                                (oauth::provider_label(key))
+                            }
+                        }
+                    }
+                }
+                @if !unlinkable.is_empty() {
                     ul class="oauth-provider-list" {
-                        @for (name, href) in providers {
+                        @for (key, label, href) in unlinkable {
                             li {
                                 a href=(href) class="btn-secondary oauth-provider"
-                                    data-testid=(format!("oauth-relink-{}", name.to_lowercase())) {
-                                    (format!("Re-link {name}"))
+                                    data-testid=(format!("oauth-link-{key}")) {
+                                    (format!("Link {label}"))
                                 }
                             }
                         }
@@ -243,12 +292,21 @@ fn account_body(
 fn login_body(
     session: Option<&session::SessionActor>,
     aliases: &[String],
-    providers: &[(&str, String)],
+    linked: &[String],
+    providers: &[(&str, &str, String)],
     claim_forms: Option<Markup>,
+    error: Option<&str>,
 ) -> Markup {
     match (session, claim_forms) {
-        (Some(actor), Some(forms)) => account_body(actor, aliases, providers, forms),
-        _ => signed_out_body(providers),
+        (Some(actor), Some(forms)) => {
+            let unlinkable: Vec<_> = providers
+                .iter()
+                .filter(|(key, _, _)| !linked.iter().any(|p| p == key))
+                .cloned()
+                .collect();
+            account_body(actor, aliases, linked, &unlinkable, forms)
+        }
+        _ => signed_out_body(providers, error),
     }
 }
 
@@ -268,6 +326,10 @@ pub async fn login_page(
         .as_ref()
         .map(|s| alias_list(db, &s.uuid))
         .unwrap_or_default();
+    let linked = session
+        .as_ref()
+        .map(|s| linked_providers_for_uuid(db, &s.uuid).unwrap_or_default())
+        .unwrap_or_default();
     let providers = oauth_providers(&base_url_from_env(state.cfg.port), &return_to);
 
     let claim_forms = if session.is_some() {
@@ -282,7 +344,14 @@ pub async fn login_page(
         } else {
             "login · sorter2"
         },
-        login_body(session.as_ref(), &aliases, &providers, claim_forms),
+        login_body(
+            session.as_ref(),
+            &aliases,
+            &linked,
+            &providers,
+            claim_forms,
+            query.error.as_deref(),
+        ),
         state.views.get_views("/login"),
         session
             .as_ref()
@@ -302,7 +371,6 @@ pub async fn alias_page(
     let db = state.projection_store.db();
     let session = session::load_valid_session(db, &session_id).ok_or(StatusCode::UNAUTHORIZED)?;
     if session::session_has_pseudonym(&session) {
-        // Already onboarded — manage aliases on the account page.
         return Ok(Redirect::to("/login").into_response());
     }
 
@@ -331,7 +399,7 @@ pub async fn alias_page(
 pub async fn github_start(
     State(state): State<AppState>,
     jar: CookieJar,
-    Query(query): Query<GitHubStartQuery>,
+    Query(query): Query<OAuthStartQuery>,
 ) -> Result<Response, StatusCode> {
     let cfg = oauth::GitHubConfig::from_env(&base_url_from_env(state.cfg.port))
         .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
@@ -342,7 +410,28 @@ pub async fn github_start(
     } else {
         None
     };
-    let url = oauth::authorize_url(&cfg, &state_token, mock_user);
+    let url = oauth::github_authorize_url(&cfg, &state_token, mock_user);
+    let jar = jar
+        .add(session::oauth_state_cookie_value(&state_token))
+        .add(session::auth_return_cookie_value(&return_to));
+    Ok((jar, Redirect::temporary(&url)).into_response())
+}
+
+pub async fn reddit_start(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    Query(query): Query<OAuthStartQuery>,
+) -> Result<Response, StatusCode> {
+    let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))
+        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
+    let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());
+    let state_token = session::new_oauth_state();
+    let mock_user = if config::mock_oauth_allowed() {
+        query.mock_user.as_deref()
+    } else {
+        None
+    };
+    let url = oauth::reddit_authorize_url(&cfg, &state_token, mock_user);
     let jar = jar
         .add(session::oauth_state_cookie_value(&state_token))
         .add(session::auth_return_cookie_value(&return_to));
@@ -355,6 +444,13 @@ pub struct OAuthCallbackQuery {
     pub state: String,
 }
 
+/// Link `provider:provider_id` to a UUID.
+///
+/// - Logged in + new provider → attach to session UUID
+/// - Logged in + already ours → no-op
+/// - Logged in + owned by someone else → conflict
+/// - Logged out + known link → resume that UUID
+/// - Logged out + unknown → create principal + first link
 async fn finish_oauth_login(
     state: &AppState,
     jar: CookieJar,
@@ -364,11 +460,41 @@ async fn finish_oauth_login(
     let db = state.projection_store.db();
     let return_to = return_from_query_or_jar(&jar, None);
 
-    let uuid = match oauth_link_owner(db, provider, &provider_id)
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-    {
-        Some(existing) => existing,
-        None => {
+    let existing_owner = oauth_link_owner(db, provider, &provider_id)
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    let session_uuid = session::session_id_from_jar(&jar)
+        .as_deref()
+        .and_then(|id| session::load_valid_session(db, id))
+        .map(|s| s.uuid);
+    let linking_while_logged_in = session_uuid.is_some();
+
+    let uuid = match (session_uuid, existing_owner) {
+        (Some(session_uuid), Some(owner)) if owner == session_uuid => session_uuid,
+        (Some(_), Some(_)) => {
+            return Ok((
+                jar.add(session::clear_oauth_state_cookie()),
+                "/login?error=oauth_taken".into(),
+            ));
+        }
+        (Some(session_uuid), None) => {
+            let ts = now_ms();
+            state
+                .append_identity_events(vec![Event::OauthLinked {
+                    uuid: session_uuid.clone(),
+                    provider: provider.to_string(),
+                    provider_id,
+                    ts,
+                }])
+                .await
+                .map_err(|e| {
+                    tracing::warn!(err = %e, "oauth link append failed");
+                    StatusCode::INTERNAL_SERVER_ERROR
+                })?;
+            session_uuid
+        }
+        (None, Some(owner)) => owner,
+        (None, None) => {
             let uuid = new_actor_uuid();
             let ts = now_ms();
             state
@@ -409,6 +535,9 @@ async fn finish_oauth_login(
             "/login/alias?return_to={}",
             urlencoding::encode(&return_to)
         )
+    } else if linking_while_logged_in {
+        // Additional link while already in an account → stay on account page.
+        "/login".to_string()
     } else {
         return_to
     };
@@ -434,22 +563,57 @@ pub async fn github_callback(
         .build()
         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
 
-    let token = oauth::exchange_code(&client, &cfg, &query.code)
+    let token = oauth::github_exchange_code(&client, &cfg, &query.code)
         .await
         .map_err(|e| {
             tracing::warn!(err = %e, "github oauth token exchange failed");
             StatusCode::BAD_GATEWAY
         })?;
-    let user = oauth::fetch_user(&client, &cfg.api_base, &token)
+    let user = oauth::github_fetch_user(&client, &cfg.api_base, &token)
         .await
         .map_err(|e| {
             tracing::warn!(err = %e, "github user fetch failed");
             StatusCode::BAD_GATEWAY
         })?;
 
-    let provider = "github";
-    let provider_id = oauth::provider_id(&user);
-    let (jar, dest) = finish_oauth_login(&state, jar, provider, provider_id).await?;
+    let (jar, dest) =
+        finish_oauth_login(&state, jar, "github", oauth::github_provider_id(&user)).await?;
+    Ok((jar, Redirect::to(&dest)).into_response())
+}
+
+pub async fn reddit_callback(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    Query(query): Query<OAuthCallbackQuery>,
+) -> Result<Response, StatusCode> {
+    let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))
+        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
+
+    let expected_state = session::oauth_state_from_jar(&jar).ok_or(StatusCode::BAD_REQUEST)?;
+    if expected_state != query.state {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+
+    let client = Client::builder()
+        .timeout(std::time::Duration::from_secs(15))
+        .build()
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    let token = oauth::reddit_exchange_code(&client, &cfg, &query.code)
+        .await
+        .map_err(|e| {
+            tracing::warn!(err = %e, "reddit oauth token exchange failed");
+            StatusCode::BAD_GATEWAY
+        })?;
+    let user = oauth::reddit_fetch_user(&client, &cfg, &token)
+        .await
+        .map_err(|e| {
+            tracing::warn!(err = %e, "reddit user fetch failed");
+            StatusCode::BAD_GATEWAY
+        })?;
+
+    let (jar, dest) =
+        finish_oauth_login(&state, jar, "reddit", oauth::reddit_provider_id(&user)).await?;
     Ok((jar, Redirect::to(&dest)).into_response())
 }
 
diff --git a/server/src/auth/oauth.rs b/server/src/auth/oauth.rs
index b80078fee0c5acd905b9125d29454e46c4e0d066..369b1527d9032cf312a07819279e0f988ef4a36e 100644
--- a/server/src/auth/oauth.rs
+++ b/server/src/auth/oauth.rs
@@ -1,8 +1,15 @@
-//! GitHub OAuth (raw reqwest, same style as reddit.rs).
+//! OAuth providers (GitHub + Reddit). Provider accounts only *link* to a UUID;
+//! the UUID is the canonical identity. Which providers are linked is private.
 
 use reqwest::Client;
 use serde::Deserialize;
 
+use crate::reddit::{
+    default_user_agent, reddit_oauth_api_base, reddit_oauth_token_base,
+};
+
+// ── GitHub ──────────────────────────────────────────────────────────────────
+
 #[derive(Debug, Clone)]
 pub struct GitHubConfig {
     pub client_id: String,
@@ -40,7 +47,7 @@ impl GitHubConfig {
 }
 
 #[derive(Debug, Deserialize)]
-struct TokenResponse {
+struct GitHubTokenResponse {
     access_token: String,
 }
 
@@ -50,7 +57,7 @@ pub struct GitHubUser {
     pub login: String,
 }
 
-pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {
+pub fn github_authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {
     let mut url = format!(
         "{}/login/oauth/authorize?client_id={}&redirect_uri={}&scope=read:user&state={}",
         cfg.oauth_base.trim_end_matches('/'),
@@ -65,7 +72,7 @@ pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -
     url
 }
 
-pub async fn exchange_code(
+pub async fn github_exchange_code(
     client: &Client,
     cfg: &GitHubConfig,
     code: &str,
@@ -90,14 +97,14 @@ pub async fn exchange_code(
         return Err(format!("github token HTTP {}", resp.status()));
     }
 
-    let body: TokenResponse = resp
+    let body: GitHubTokenResponse = resp
         .json()
         .await
         .map_err(|e| format!("github token parse failed: {e}"))?;
     Ok(body.access_token)
 }
 
-pub async fn fetch_user(
+pub async fn github_fetch_user(
     client: &Client,
     api_base: &str,
     access_token: &str,
@@ -120,10 +127,149 @@ pub async fn fetch_user(
         .map_err(|e| format!("github user parse failed: {e}"))
 }
 
-pub fn provider_id(user: &GitHubUser) -> String {
+pub fn github_provider_id(user: &GitHubUser) -> String {
     user.id.to_string()
 }
 
+// ── Reddit ──────────────────────────────────────────────────────────────────
+
+#[derive(Debug, Clone)]
+pub struct RedditConfig {
+    pub client_id: String,
+    pub client_secret: String,
+    pub redirect_uri: String,
+    /// Host for `/api/v1/authorize` (www.reddit.com in production).
+    pub authorize_base: String,
+    /// Host for `POST /api/v1/access_token`.
+    pub token_base: String,
+    /// Host for bearer `GET /api/v1/me` (oauth.reddit.com).
+    pub api_base: String,
+    pub user_agent: String,
+}
+
+/// Authorize page base; defaults to the same host as token POSTs.
+pub fn reddit_authorize_base() -> String {
+    std::env::var("REDDIT_OAUTH_AUTHORIZE_BASE")
+        .or_else(|_| std::env::var("REDDIT_OAUTH_BASE"))
+        .unwrap_or_else(|_| "https://www.reddit.com".into())
+}
+
+impl RedditConfig {
+    pub fn from_env(base_url: &str) -> Option<Self> {
+        let client_id = std::env::var("REDDIT_CLIENT_ID")
+            .or_else(|_| std::env::var("REDDIT_APP_ID"))
+            .ok()?;
+        let client_secret = std::env::var("REDDIT_CLIENT_SECRET")
+            .or_else(|_| std::env::var("REDDIT_APP_SECRET"))
+            .ok()?;
+        if client_id.is_empty() || client_secret.is_empty() {
+            return None;
+        }
+        let base = base_url.trim_end_matches('/');
+        Some(Self {
+            client_id,
+            client_secret,
+            redirect_uri: format!("{base}/auth/reddit/callback"),
+            authorize_base: reddit_authorize_base(),
+            token_base: reddit_oauth_token_base(),
+            api_base: reddit_oauth_api_base(),
+            user_agent: default_user_agent(),
+        })
+    }
+}
+
+#[derive(Debug, Deserialize)]
+struct RedditTokenResponse {
+    access_token: String,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct RedditUser {
+    /// Stable id (`t2_…`); never use `name` as identity.
+    pub id: String,
+    pub name: String,
+}
+
+pub fn reddit_authorize_url(cfg: &RedditConfig, state: &str, mock_user: Option<&str>) -> String {
+    let mut url = format!(
+        "{}/api/v1/authorize?client_id={}&response_type=code&state={}&redirect_uri={}&duration=temporary&scope=identity",
+        cfg.authorize_base.trim_end_matches('/'),
+        urlencoding::encode(&cfg.client_id),
+        urlencoding::encode(state),
+        urlencoding::encode(&cfg.redirect_uri),
+    );
+    if let Some(user) = mock_user {
+        url.push_str("&mock_user=");
+        url.push_str(&urlencoding::encode(user));
+    }
+    url
+}
+
+pub async fn reddit_exchange_code(
+    client: &Client,
+    cfg: &RedditConfig,
+    code: &str,
+) -> Result<String, String> {
+    let resp = client
+        .post(format!(
+            "{}/api/v1/access_token",
+            cfg.token_base.trim_end_matches('/')
+        ))
+        .header("User-Agent", &cfg.user_agent)
+        .basic_auth(&cfg.client_id, Some(&cfg.client_secret))
+        .form(&[
+            ("grant_type", "authorization_code"),
+            ("code", code),
+            ("redirect_uri", cfg.redirect_uri.as_str()),
+        ])
+        .send()
+        .await
+        .map_err(|e| format!("reddit token request failed: {e}"))?;
+
+    if !resp.status().is_success() {
+        let status = resp.status();
+        let body = resp.text().await.unwrap_or_default();
+        return Err(format!("reddit token HTTP {status}: {body}"));
+    }
+
+    let body: RedditTokenResponse = resp
+        .json()
+        .await
+        .map_err(|e| format!("reddit token parse failed: {e}"))?;
+    Ok(body.access_token)
+}
+
+pub async fn reddit_fetch_user(
+    client: &Client,
+    cfg: &RedditConfig,
+    access_token: &str,
+) -> Result<RedditUser, String> {
+    let resp = client
+        .get(format!(
+            "{}/api/v1/me",
+            cfg.api_base.trim_end_matches('/')
+        ))
+        .header("User-Agent", &cfg.user_agent)
+        .bearer_auth(access_token)
+        .send()
+        .await
+        .map_err(|e| format!("reddit user request failed: {e}"))?;
+
+    if !resp.status().is_success() {
+        return Err(format!("reddit user HTTP {}", resp.status()));
+    }
+
+    resp.json()
+        .await
+        .map_err(|e| format!("reddit user parse failed: {e}"))
+}
+
+pub fn reddit_provider_id(user: &RedditUser) -> String {
+    user.id.clone()
+}
+
+// ── Shared helpers ──────────────────────────────────────────────────────────
+
 pub fn validate_pseudonym(raw: &str) -> Result<String, &'static str> {
     let trimmed = raw.trim();
     if trimmed.is_empty() {
@@ -144,3 +290,12 @@ pub fn validate_pseudonym(raw: &str) -> Result<String, &'static str> {
 pub fn sanitize_pseudonym(login: &str) -> String {
     validate_pseudonym(login).unwrap_or_else(|_| "user".to_string())
 }
+
+/// Display name for a provider key (`github` → `GitHub`). Never show provider ids.
+pub fn provider_label(provider: &str) -> &'static str {
+    match provider {
+        "github" => "GitHub",
+        "reddit" => "Reddit",
+        _ => "OAuth",
+    }
+}
diff --git a/server/src/lib.rs b/server/src/lib.rs
index 84f2565b105fb302241b949af64bd5e49916eab2..0d948af1457504fdbd34d0b14261f65ac58da0ec 100644
--- a/server/src/lib.rs
+++ b/server/src/lib.rs
@@ -47,6 +47,8 @@ pub fn create_app(state: AppState) -> Router {
         .route("/login/alias", get(crate::auth::alias_page))
         .route("/auth/github", get(crate::auth::github_start))
         .route("/auth/github/callback", get(crate::auth::github_callback))
+        .route("/auth/reddit", get(crate::auth::reddit_start))
+        .route("/auth/reddit/callback", get(crate::auth::reddit_callback))
         .route("/auth/logout", post(crate::auth::logout))
         .route("/auth/switch", post(crate::auth::switch_pseudonym))
         .route("/ui", post(crate::api::ui_html::post_ui_html))
diff --git a/server/src/projection_apply.rs b/server/src/projection_apply.rs
index 4fb4b48ee0a53b7f673fae0c9731eed5acc33332..f50458c2ff3c447a3cfd28adb298e6883a2da4e9 100644
--- a/server/src/projection_apply.rs
+++ b/server/src/projection_apply.rs
@@ -4,6 +4,8 @@
 //! child links, recent-vote appends) plus a cursor advance, all committed in
 //! one atomic `DisableWal` batch.
 
+use std::collections::HashMap;
+
 use crate::{
     event_log::EventLogError,
     events::{Event, EventRecord},
@@ -44,6 +46,8 @@ pub fn apply_records(
     let db = projection_store.db();
     let mut batch = db.batch();
     let mut last_seq = 0u64;
+    // Weight reads must see earlier writes in this same batch.
+    let mut pending_weights: HashMap<String, f64> = HashMap::new();
 
     for record in records {
         match &record.event {
@@ -85,6 +89,7 @@ pub fn apply_records(
                 ensure_path_writes(&mut batch, &parsed);
             }
             Event::PrincipalCreated { uuid, .. } => {
+                pending_weights.insert(uuid.clone(), BASE_TRUST_WEIGHT);
                 batch.write(
                     Store::root()
                         .user_weights()
@@ -112,17 +117,25 @@ pub fn apply_records(
                     }
                 } else {
                     batch.write(Store::root().oauth_links().key(&link_key).set(uuid));
-                    let current = Store::root()
-                        .user_weights()
-                        .key(&uuid.clone())
-                        .get(db)
-                        .map_err(|e| EventLogError::Apply(e.to_string()))?
+                    let current = pending_weights
+                        .get(uuid)
+                        .copied()
+                        .or_else(|| {
+                            Store::root()
+                                .user_weights()
+                                .key(&uuid.clone())
+                                .get(db)
+                                .ok()
+                                .flatten()
+                        })
                         .unwrap_or(BASE_TRUST_WEIGHT);
+                    let next = trust_weight_after_link(current);
+                    pending_weights.insert(uuid.clone(), next);
                     batch.write(
                         Store::root()
                             .user_weights()
                             .key(&uuid.clone())
-                            .set(&trust_weight_after_link(current)),
+                            .set(&next),
                     );
                 }
             }
@@ -205,6 +218,15 @@ mod tests {
                 ),
                 record(
                     3,
+                    Event::OauthLinked {
+                        uuid: uuid.into(),
+                        provider: "reddit".into(),
+                        provider_id: "t2_abc".into(),
+                        ts,
+                    },
+                ),
+                record(
+                    4,
                     Event::PseudonymClaimed {
                         uuid: uuid.into(),
                         pseudonym: "octocat".into(),
@@ -219,8 +241,12 @@ mod tests {
             oauth_link_owner(store.db(), "github", "42").unwrap(),
             Some(uuid.to_string())
         );
+        assert_eq!(
+            crate::storage_schema::linked_providers_for_uuid(store.db(), uuid).unwrap(),
+            vec!["github".to_string(), "reddit".to_string()]
+        );
         assert_eq!(resolve_actor_uuid(store.db(), "octocat").unwrap(), uuid);
-        assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 1.5);
+        assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 2.0);
         let aliases = Store::root()
             .user_pseudonyms()
             .key(&uuid.to_string())
diff --git a/server/src/storage_schema.rs b/server/src/storage_schema.rs
index b942810afd96d3bf01b7765718303a39be4ef8d2..dac6f8e6080e3f5683c24dbb8861f5a981d456c4 100644
--- a/server/src/storage_schema.rs
+++ b/server/src/storage_schema.rs
@@ -103,6 +103,25 @@ pub fn oauth_link_owner(db: &Db, provider: &str, provider_id: &str) -> durable::
         .get(db)
 }
 
+/// Provider names linked to a UUID (`github`, `reddit`, …). Private — for the
+/// account owner's page only; never expose which providers are linked publicly.
+pub fn linked_providers_for_uuid(db: &Db, uuid: &str) -> durable::Result<Vec<String>> {
+    let mut providers = Vec::new();
+    for (key, owner) in Store::root().oauth_links().iter(db)? {
+        if owner != uuid {
+            continue;
+        }
+        let Some((provider, _)) = key.split_once(':') else {
+            continue;
+        };
+        if !providers.iter().any(|p| p == provider) {
+            providers.push(provider.to_string());
+        }
+    }
+    providers.sort();
+    Ok(providers)
+}
+
 pub const RECENT_VOTES_CAP: u64 = 200;
 
 fn id_key(id: &ItemId) -> String {
diff --git a/test/support/harness.clj b/test/support/harness.clj
index 4505ece5aa193e826ca61c52f1467d252080d66b..741024aab1d14269e225791189633287980ae2e4 100644
--- a/test/support/harness.clj
+++ b/test/support/harness.clj
@@ -48,12 +48,15 @@
          "GITHUB_CLIENT_SECRET" "test-secret"
          "GITHUB_OAUTH_BASE" (str "http://127.0.0.1:" oauth-port)
          "GITHUB_API_BASE" (str "http://127.0.0.1:" oauth-port)
+         ;; Reddit import fixtures + Reddit OAuth on reddit-port.
          "REDDIT_API_BASE" (str "http://127.0.0.1:" reddit-port)
+         "REDDIT_CLIENT_ID" "test-reddit"
+         "REDDIT_CLIENT_SECRET" "test-reddit-secret"
          "REDDIT_OAUTH_BASE" (str "http://127.0.0.1:" reddit-port)
-         "REDDIT_CLIENT_ID" ""
-         "REDDIT_CLIENT_SECRET" ""
-         "REDDIT_APP_ID" ""
-         "REDDIT_APP_SECRET" ""}))
+         "REDDIT_OAUTH_AUTHORIZE_BASE" (str "http://127.0.0.1:" reddit-port)
+         "REDDIT_OAUTH_TOKEN_BASE" (str "http://127.0.0.1:" reddit-port)
+         "REDDIT_OAUTH_API_BASE" (str "http://127.0.0.1:" reddit-port)
+         "REDDIT_USER_AGENT" "web:sorter2-test:v0 (by /u/test)"}))
 
 (defn with-auth-servers
   "Start mock Reddit + mock OAuth + release sorter2-server.
diff --git a/test/support/mock_oauth.clj b/test/support/mock_oauth.clj
index 909d7a7be8b159ea54a122d69c46af3db3318118..5ba7e9be3cf6d2226648e9609a09ed45f306930f 100644
--- a/test/support/mock_oauth.clj
+++ b/test/support/mock_oauth.clj
@@ -1,5 +1,5 @@
 (ns test.support.mock-oauth
-  "In-process HTTP stub for GitHub OAuth (authorize, token, /user)."
+  "In-process HTTP stub for GitHub + Reddit OAuth (authorize, token, user)."
   (:require [clojure.string :as str])
   (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]
            [java.net InetSocketAddress URLDecoder]))
@@ -12,11 +12,14 @@
                 (URLDecoder/decode (or v "") "UTF-8"))))
           (str/split query #"&"))))
 
-(defn- parse-mock-user [raw]
+(defn- parse-mock-user
+  "GitHub-style `id:login` (numeric id). Reddit-style `t2_xxx:name`."
+  [raw]
   (let [s (or raw "1002:newbie")
         [id login] (str/split s #":" 2)]
-    {:id (Long/parseLong id)
-     :login (or login "newbie")}))
+    {:id id
+     :login (or login "newbie")
+     :numeric? (re-matches #"\d+" id)}))
 
 (defn- send-json [^HttpExchange ex status body]
   (let [bytes (.getBytes body "UTF-8")]
@@ -31,9 +34,10 @@
   (.sendResponseHeaders ex 302 -1)
   (.close (.getResponseBody ex)))
 
-(defn- read-form-code [^HttpExchange ex]
+(defn- read-form [^HttpExchange ex]
   (let [body (slurp (.getInputStream ex))]
-    (query-param body "code")))
+    {:code (query-param body "code")
+     :grant (query-param body "grant_type")}))
 
 (defn- bearer-token [^HttpExchange ex]
   (some-> (.getRequestHeaders ex)
@@ -44,8 +48,18 @@
   (when (str/starts-with? token "mock:")
     (parse-mock-user (subs token 5))))
 
+(defn- authorize-redirect [exchange query]
+  (let [redirect-uri (query-param query "redirect_uri")
+        state (query-param query "state")
+        mock-user (query-param query "mock_user")
+        user (parse-mock-user mock-user)
+        code (str "mock:" (:id user) ":" (:login user))
+        loc (str redirect-uri "?code=" (java.net.URLEncoder/encode code "UTF-8")
+                 "&state=" (java.net.URLEncoder/encode state "UTF-8"))]
+    (send-redirect exchange loc)))
+
 (defn start-mock-oauth
-  "Start mock GitHub OAuth on `port`. Returns a zero-arg `stop` function."
+  "Start mock GitHub + Reddit OAuth on `port`. Returns a zero-arg `stop` function."
   [port]
   (let [server (HttpServer/create (InetSocketAddress. "127.0.0.1" port) 0)
         handler
@@ -53,28 +67,45 @@
           (handle [^HttpExchange exchange]
             (let [uri (.getRequestURI exchange)
                   path (.getPath uri)
-                  query (.getQuery uri)]
+                  query (.getQuery uri)
+                  method (.getRequestMethod exchange)]
               (cond
+                ;; GitHub authorize
                 (str/ends-with? path "/login/oauth/authorize")
-                (let [redirect-uri (query-param query "redirect_uri")
-                      state (query-param query "state")
-                      mock-user (query-param query "mock_user")
-                      user (parse-mock-user mock-user)
-                      code (str "mock:" (:id user) ":" (:login user))
-                      loc (str redirect-uri "?code=" (java.net.URLEncoder/encode code "UTF-8")
-                               "&state=" (java.net.URLEncoder/encode state "UTF-8"))]
-                  (send-redirect exchange loc))
+                (authorize-redirect exchange query)
+
+                ;; Reddit authorize
+                (str/ends-with? path "/api/v1/authorize")
+                (authorize-redirect exchange query)
 
-                (str/ends-with? path "/login/oauth/access_token")
-                (let [code (or (read-form-code exchange) "mock:1002:newbie")]
+                ;; GitHub token
+                (and (= method "POST") (str/ends-with? path "/login/oauth/access_token"))
+                (let [code (or (:code (read-form exchange)) "mock:1002:newbie")]
                   (send-json exchange 200 (str "{\"access_token\":\"" code "\",\"token_type\":\"bearer\"}")))
 
+                ;; Reddit token (client_credentials for import + authorization_code for login)
+                (and (= method "POST") (str/ends-with? path "/api/v1/access_token"))
+                (let [form (read-form exchange)
+                      grant (or (:grant form) "")
+                      code (or (:code form) "mock:t2_test:redditor")]
+                  (if (= grant "client_credentials")
+                    (send-json exchange 200 "{\"access_token\":\"app-token\",\"token_type\":\"bearer\",\"expires_in\":3600}")
+                    (send-json exchange 200 (str "{\"access_token\":\"" code "\",\"token_type\":\"bearer\",\"expires_in\":3600}"))))
+
+                ;; GitHub user
                 (= path "/user")
                 (let [token (bearer-token exchange)
-                      user (or (parse-token-user token) {:id 1002 :login "newbie"})]
+                      user (or (parse-token-user token) {:id "1002" :login "newbie" :numeric? true})]
                   (send-json exchange 200
                              (str "{\"id\":" (:id user) ",\"login\":\"" (:login user) "\"}")))
 
+                ;; Reddit /api/v1/me
+                (str/ends-with? path "/api/v1/me")
+                (let [token (bearer-token exchange)
+                      user (or (parse-token-user token) {:id "t2_test" :login "redditor"})]
+                  (send-json exchange 200
+                             (str "{\"id\":\"" (:id user) "\",\"name\":\"" (:login user) "\"}")))
+
                 :else
                 (send-json exchange 404 "{\"error\":\"not found\"}")))))]
     (.createContext server "/" handler)
diff --git a/test/support/mock_reddit.clj b/test/support/mock_reddit.clj
index 5efa92db3e1f79b8f423a2f1adcbda959123c1ad..a630cf0938722193e9af88382d60e777ff371be4 100644
--- a/test/support/mock_reddit.clj
+++ b/test/support/mock_reddit.clj
@@ -1,14 +1,56 @@
 (ns test.support.mock-reddit
-  "In-process HTTP stub for Reddit API fixtures (`test/fixtures/reddit/`)."
+  "In-process HTTP stub for Reddit API fixtures + OAuth login endpoints."
   (:require [clojure.java.io :as io]
             [clojure.string :as str])
   (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]
-           [java.net InetSocketAddress]))
+           [java.net InetSocketAddress URLDecoder]))
 
 (defn fixtures-dir
   ([] (fixtures-dir (System/getProperty "user.dir")))
   ([root] (str root "/test/fixtures/reddit")))
 
+(defn- query-param [query key]
+  (when query
+    (some (fn [pair]
+            (let [[k v] (str/split pair "=" 2)]
+              (when (= k key)
+                (URLDecoder/decode (or v "") "UTF-8"))))
+          (str/split query #"&"))))
+
+(defn- parse-mock-user [raw]
+  (let [s (or raw "t2_test:redditor")
+        [id login] (str/split s #":" 2)]
+    {:id id :login (or login "redditor")}))
+
+(defn- send-bytes [^HttpExchange ex status ^bytes body content-type]
+  (.set (.getResponseHeaders ex) "Content-Type" content-type)
+  (.sendResponseHeaders ex status (alength body))
+  (doto (.getResponseBody ex)
+    (.write body)
+    (.close)))
+
+(defn- send-json [^HttpExchange ex status body]
+  (send-bytes ex status (.getBytes body "UTF-8") "application/json"))
+
+(defn- send-redirect [^HttpExchange ex location]
+  (.set (.getResponseHeaders ex) "Location" location)
+  (.sendResponseHeaders ex 302 -1)
+  (.close (.getResponseBody ex)))
+
+(defn- read-form [^HttpExchange ex]
+  (let [body (slurp (.getInputStream ex))]
+    {:code (query-param body "code")
+     :grant (query-param body "grant_type")}))
+
+(defn- bearer-token [^HttpExchange ex]
+  (some-> (.getRequestHeaders ex)
+          (.getFirst "Authorization")
+          (str/replace #"^[Bb]earer " "")))
+
+(defn- parse-token-user [token]
+  (when (str/starts-with? token "mock:")
+    (parse-mock-user (subs token 5))))
+
 (defn start-mock-reddit
   "Start a mock Reddit API on `port`. Returns a zero-arg `stop` function."
   ([port] (start-mock-reddit port (fixtures-dir)))
@@ -19,15 +61,38 @@
          handler
          (proxy [HttpHandler] []
            (handle [^HttpExchange exchange]
-             ;; `/r/<sub>/about.json` → subreddit entity; `/r/<sub>.json` → listing.
-             (let [path (.getPath (.getRequestURI exchange))
-                   body (if (str/includes? path "/about")
-                          about
-                          listing)]
-               (.sendResponseHeaders exchange 200 (alength body))
-               (let [out (.getResponseBody exchange)]
-                 (.write out body)
-                 (.close out)))))]
+             (let [uri (.getRequestURI exchange)
+                   path (.getPath uri)
+                   query (.getQuery uri)
+                   method (.getRequestMethod exchange)]
+               (cond
+                 (str/ends-with? path "/api/v1/authorize")
+                 (let [redirect-uri (query-param query "redirect_uri")
+                       state (query-param query "state")
+                       user (parse-mock-user (query-param query "mock_user"))
+                       code (str "mock:" (:id user) ":" (:login user))
+                       loc (str redirect-uri "?code=" (java.net.URLEncoder/encode code "UTF-8")
+                                "&state=" (java.net.URLEncoder/encode state "UTF-8"))]
+                   (send-redirect exchange loc))
+
+                 (and (= method "POST") (str/ends-with? path "/api/v1/access_token"))
+                 (let [form (read-form exchange)
+                       grant (or (:grant form) "")
+                       code (or (:code form) "mock:t2_test:redditor")]
+                   (if (= grant "client_credentials")
+                     (send-json exchange 200 "{\"access_token\":\"app-token\",\"token_type\":\"bearer\",\"expires_in\":3600}")
+                     (send-json exchange 200 (str "{\"access_token\":\"" code "\",\"token_type\":\"bearer\",\"expires_in\":3600}"))))
+
+                 (str/ends-with? path "/api/v1/me")
+                 (let [user (or (parse-token-user (bearer-token exchange))
+                                {:id "t2_test" :login "redditor"})]
+                   (send-json exchange 200
+                              (str "{\"id\":\"" (:id user) "\",\"name\":\"" (:login user) "\"}")))
+
+                 ;; `/r/<sub>/about.json` → subreddit entity; `/r/<sub>.json` → listing.
+                 :else
+                 (let [body (if (str/includes? path "/about") about listing)]
+                   (send-bytes exchange 200 body "application/json"))))))]
      (.createContext server "/" handler)
      (.setExecutor server nil)
      (.start server)


Side B — contributor: tommy-mor
Side B — commit message:
[08565bea] Tokenize prose refs for garden URL links (#147)

* Tokenize prose refs for garden URL links

Co-authored-by: tommy <thmorriss@gmail.com>

* Stop prose URLs at line boundaries

Co-authored-by: tommy <thmorriss@gmail.com>

* Require braced DSL item bodies

Co-authored-by: tommy <thmorriss@gmail.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Side B — unified diff (full patch):
diff --git a/server/src/dsl.rs b/server/src/dsl.rs
index 4203c2f59dd8825d7a91513c4023f3ccd37f1efc..b3c785674560a0b42a7f4c3aa13d80cd350f485b 100644
--- a/server/src/dsl.rs
+++ b/server/src/dsl.rs
@@ -1,7 +1,5 @@
 use std::collections::HashMap;
 
-use rand::Rng;
-
 /// Parsed DSL document.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Document {
@@ -39,31 +37,57 @@ pub enum DslError {
 /// Matches the legacy Python parser behavior:
 /// - Supports toggle markers (open == close), e.g. ```...```
 /// - Supports nested markers (open != close), e.g. { ... { ... } ... }
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BlockKind {
+    CodeFence,
+    DoubleBrace,
+    Brace,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct MaskedBlock {
+    kind: BlockKind,
+}
+
 #[derive(Debug, Default, Clone)]
 pub struct BlockMasker {
     pub replacements: HashMap<String, String>,
+    blocks: HashMap<String, MaskedBlock>,
+    next_id: u32,
 }
 
 impl BlockMasker {
     pub fn new() -> Self {
         Self {
             replacements: HashMap::new(),
+            blocks: HashMap::new(),
+            next_id: 0,
         }
     }
 
-    fn new_token(&mut self) -> String {
-        let mut rng = rand::thread_rng();
-        let n: u32 = rng.gen();
-        let token = format!("__BLOCK_{:08x}__", n);
-        // Extremely unlikely collision; if it happens, regenerate.
-        if self.replacements.contains_key(&token) {
-            return self.new_token();
+    fn new_token(&mut self, haystack: &str) -> String {
+        loop {
+            let token = format!("__BLOCK_{:08x}__", self.next_id);
+            self.next_id = self.next_id.wrapping_add(1);
+            if !self.replacements.contains_key(&token) && !haystack.contains(&token) {
+                return token;
+            }
         }
-        token
     }
 
     /// Replace outermost balanced blocks with tokens.
     pub fn mask(&mut self, text: &str, open_marker: &str, close_marker: &str) -> String {
+        self.mask_kind(text, open_marker, close_marker, BlockKind::Brace)
+    }
+
+    /// Replace outermost balanced blocks with typed deterministic tokens.
+    pub fn mask_kind(
+        &mut self,
+        text: &str,
+        open_marker: &str,
+        close_marker: &str,
+        kind: BlockKind,
+    ) -> String {
         if text.is_empty() {
             return text.to_string();
         }
@@ -97,9 +121,10 @@ impl BlockMasker {
                     // Found end of outermost block
                     let s = start_idx.max(0) as usize;
                     let original_block = &text[s..i];
-                    let token = self.new_token();
+                    let token = self.new_token(text);
                     self.replacements
                         .insert(token.clone(), original_block.to_string());
+                    self.blocks.insert(token.clone(), MaskedBlock { kind });
                     result_parts.push(token);
                     current_idx = i;
                 }
@@ -176,13 +201,22 @@ impl BlockMasker {
         }
         token.to_string()
     }
+
+    pub fn block_kind(&self, token: &str) -> Option<BlockKind> {
+        self.blocks.get(token).map(|b| b.kind)
+    }
 }
 
 fn mask_all(mut masker: BlockMasker, text: &str) -> (BlockMasker, String) {
     // Mask hierarchy: Code -> Double Brace -> Single Brace.
-    let t = masker.mask(text, "```", "```");
-    let t = masker.mask(&t, "{{", "}}");
-    let t = masker.mask(&t, "{", "}");
+    let t = masker.mask_kind(text, "```", "```", BlockKind::CodeFence);
+    let t = masker.mask_kind(&t, "{{", "}}", BlockKind::DoubleBrace);
+    let t = masker.mask_kind(&t, "{", "}", BlockKind::Brace);
+    (masker, t)
+}
+
+fn mask_code_fences(mut masker: BlockMasker, text: &str) -> (BlockMasker, String) {
+    let t = masker.mask_kind(text, "```", "```", BlockKind::CodeFence);
     (masker, t)
 }
 
@@ -253,7 +287,34 @@ fn skip_ws(s: &str, mut i: usize) -> usize {
     i
 }
 
-fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ProseToken {
+    Text(String),
+    ItemRef(String),
+}
+
+fn trim_prose_item_ref_end(s: &str, mut end: usize) -> usize {
+    while end > 0 {
+        let Some((idx, c)) = s[..end].char_indices().next_back() else {
+            break;
+        };
+        if matches!(
+            c,
+            '.' | ',' | ';' | ':' | '!' | '?' | ')' | ']' | '}' | '"' | '\''
+        ) {
+            end = idx;
+        } else {
+            break;
+        }
+    }
+    end
+}
+
+fn parse_item_name_at_with_mode(
+    s: &str,
+    i: usize,
+    trim_trailing_punctuation: bool,
+) -> Option<(String, usize)> {
     let bytes = s.as_bytes();
     if i >= bytes.len() {
         return None;
@@ -263,6 +324,9 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {
     if s[i..].starts_with("https://") || s[i..].starts_with("http://") {
         let mut j = i;
         while j < bytes.len() {
+            if trim_trailing_punctuation && bytes[j] == b'\n' {
+                break;
+            }
             if bytes[j..].starts_with(b"__BLOCK_") || is_ws_byte(bytes[j]) {
                 break;
             }
@@ -271,6 +335,12 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {
         if j <= i {
             return None;
         }
+        if trim_trailing_punctuation {
+            j = trim_prose_item_ref_end(s, j);
+            if j <= i {
+                return None;
+            }
+        }
         return Some((s[i..j].to_string(), j));
     }
 
@@ -296,6 +366,12 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {
         if j <= i + 2 {
             return None;
         }
+        if trim_trailing_punctuation {
+            j = trim_prose_item_ref_end(s, j);
+            if j <= i + 2 {
+                return None;
+            }
+        }
         let raw = &s[i..j];
         if !is_item_name(raw) {
             return None;
@@ -336,6 +412,46 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {
     Some((format!("~/{}", name), j))
 }
 
+fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {
+    parse_item_name_at_with_mode(s, i, false)
+}
+
+pub fn parse_prose_item_ref_at(s: &str, i: usize) -> Option<(String, usize)> {
+    parse_item_name_at_with_mode(s, i, true)
+}
+
+pub fn tokenize_prose_item_refs(text: &str) -> Vec<ProseToken> {
+    if text.is_empty() {
+        return Vec::new();
+    }
+    let (masker, masked) = mask_code_fences(BlockMasker::new(), text);
+    let mut tokens = Vec::new();
+    let mut text_start = 0usize;
+    let mut i = 0usize;
+
+    while i < masked.len() {
+        if let Some((raw, end)) = parse_prose_item_ref_at(&masked, i) {
+            if text_start < i {
+                tokens.push(ProseToken::Text(masker.unmask(&masked[text_start..i])));
+            }
+            tokens.push(ProseToken::ItemRef(masker.unmask(&raw)));
+            i = end;
+            text_start = i;
+            continue;
+        }
+
+        let Some((_, c)) = masked[i..].char_indices().next() else {
+            break;
+        };
+        i += c.len_utf8();
+    }
+
+    if text_start < masked.len() {
+        tokens.push(ProseToken::Text(masker.unmask(&masked[text_start..])));
+    }
+    tokens
+}
+
 fn parse_block_token_at(s: &str, i: usize) -> Option<(String, usize)> {
     let bytes = s.as_bytes();
     if i >= bytes.len() {
@@ -401,6 +517,12 @@ fn parse_block_prefixed_statement(
     tail: &str,
     masker: &BlockMasker,
 ) -> Result<Stmt, DslError> {
+    if masker.block_kind(block_token) == Some(BlockKind::CodeFence) {
+        return Err(DslError::Parse(
+            "vote explanations must use `{ ... }`; code fences belong inside body blocks"
+                .to_string(),
+        ));
+    }
     // vote: block item_ref comparison item_ref
     let s = tail.trim_start();
     if s.is_empty() {
@@ -462,6 +584,11 @@ fn parse_item_definition_statement(stripped: &str, masker: &BlockMasker) -> Resu
     }
 
     if let Some((tok, end)) = parse_block_token_at(stripped, i) {
+        if masker.block_kind(&tok) == Some(BlockKind::CodeFence) {
+            return Err(DslError::Parse(
+                "item bodies must use `{ ... }`; code fences belong inside body blocks".to_string(),
+            ));
+        }
         let body = masker.extract_body(&tok);
         let tail = stripped[end..].trim();
         if !tail.is_empty() {
@@ -572,6 +699,10 @@ pub fn parse_full(text: &str) -> Result<Document, DslError> {
 
             if let Some((tok, end)) = parse_block_token_at(stripped, 0) {
                 if stripped[end..].trim().is_empty() {
+                    if masker.block_kind(&tok) == Some(BlockKind::CodeFence) {
+                        prose_buffer.push(line);
+                        continue;
+                    }
                     pending_block = Some(tok);
                     continue;
                 }
@@ -619,6 +750,70 @@ mod tests {
         assert_eq!(roundtrip, input);
     }
 
+    #[test]
+    fn blockmasker_tokens_are_deterministic_and_typed() {
+        let input = "x ```code``` y {body}";
+        let (masker, masked) = mask_all(BlockMasker::new(), input);
+        assert!(masked.contains("__BLOCK_00000000__"));
+        assert!(masked.contains("__BLOCK_00000001__"));
+        assert_eq!(
+            masker.block_kind("__BLOCK_00000000__"),
+            Some(BlockKind::CodeFence)
+        );
+        assert_eq!(
+            masker.block_kind("__BLOCK_00000001__"),
+            Some(BlockKind::Brace)
+        );
+        assert_eq!(masker.unmask(&masked), input);
+    }
+
+    #[test]
+    fn prose_tokenizer_finds_tilde_dash_and_raw_url_refs() {
+        let tokens =
+            tokenize_prose_item_refs("see ~/a/b then -/example.com/x and https://Example.com/A/B.");
+        assert_eq!(
+            tokens,
+            vec![
+                ProseToken::Text("see ".to_string()),
+                ProseToken::ItemRef("~/a/b".to_string()),
+                ProseToken::Text(" then ".to_string()),
+                ProseToken::ItemRef("-/example.com/x".to_string()),
+                ProseToken::Text(" and ".to_string()),
+                ProseToken::ItemRef("https://Example.com/A/B".to_string()),
+                ProseToken::Text(".".to_string()),
+            ]
+        );
+    }
+
+    #[test]
+    fn prose_tokenizer_stops_raw_urls_at_newlines() {
+        let tokens = tokenize_prose_item_refs("https://example.com/a/b.\n-/example.com/a/b");
+        assert_eq!(
+            tokens,
+            vec![
+                ProseToken::ItemRef("https://example.com/a/b".to_string()),
+                ProseToken::Text(".\n".to_string()),
+                ProseToken::ItemRef("-/example.com/a/b".to_string()),
+            ]
+        );
+    }
+
+    #[test]
+    fn prose_tokenizer_does_not_linkify_inside_code_fences() {
+        let tokens = tokenize_prose_item_refs(
+            "before ```json\n{\"url\":\"https://example.com\"}\n``` after ~/x",
+        );
+        assert_eq!(
+            tokens,
+            vec![
+                ProseToken::Text(
+                    "before ```json\n{\"url\":\"https://example.com\"}\n``` after ".to_string()
+                ),
+                ProseToken::ItemRef("~/x".to_string()),
+            ]
+        );
+    }
+
     #[test]
     fn parse_item_with_body_strips_outer_braces() {
         let input = "~/rust { Systems language }";
@@ -633,8 +828,8 @@ mod tests {
     }
 
     #[test]
-    fn parse_item_with_fenced_json_body_preserves_braces() {
-        let input = "~/item/in/url ```json\n{\"test\": true}\n```";
+    fn parse_item_with_braced_fenced_json_body_preserves_braces() {
+        let input = "~/item/in/url {\n```json\n{\"test\": true}\n```\n}";
         let doc = parse_full(input).unwrap();
         assert_eq!(
             doc.statements,
@@ -645,6 +840,51 @@ mod tests {
         );
     }
 
+    #[test]
+    fn parse_rejects_singleton_fenced_json_item_body() {
+        let input = "~/item/in/url ```json\n{\"test\": true}\n```";
+        let err = parse_full(input).unwrap_err().to_string();
+        assert!(
+            err.contains("item bodies must use"),
+            "unexpected error: {err}"
+        );
+    }
+
+    #[test]
+    fn parse_keeps_standalone_code_fence_as_prose() {
+        let input = "```json\n{\"test\": true}\n```";
+        let doc = parse_full(input).unwrap();
+        assert_eq!(
+            doc.statements,
+            vec![Stmt::Prose {
+                text: input.to_string(),
+            }]
+        );
+    }
+
+    #[test]
+    fn parse_rejects_code_fence_vote_explanation() {
+        let input = "```json\n{\"why\": true}\n```\n~/a 2:1 ~/b";
+        let err = parse_full(input).unwrap_err().to_string();
+        assert!(
+            err.contains("vote explanations must start"),
+            "unexpected error: {err}"
+        );
+    }
+
+    #[test]
+    fn parse_raw_url_item_with_braced_fenced_json_body() {
+        let input = "https://example.com/itembody/slug {\n```json\n{\"test\": true}\n```\n}";
+        let doc = parse_full(input).unwrap();
+        assert_eq!(
+            doc.statements,
+            vec![Stmt::Item {
+                title: "https://example.com/itembody/slug".to_string(),
+                body: Some("```json\n{\"test\": true}\n```".to_string()),
+            }]
+        );
+    }
+
     #[test]
     fn parse_vote_ratio_and_symbols() {
         let d1 = parse_full("{because}\n~/a 3:1 ~/b").unwrap();
diff --git a/server/src/external_resolver.rs b/server/src/external_resolver.rs
index 8481f1fbff1c4265da182a225f539f97d6829002..04bc3de32b6df1aefe197d942db67de2cbdbde4f 100644
--- a/server/src/external_resolver.rs
+++ b/server/src/external_resolver.rs
@@ -256,7 +256,7 @@ fn children_to_dsl(children: &[ResolvedChild]) -> String {
             .filter(|s| !s.trim().is_empty())
             .unwrap_or(child.title.as_str());
         if body.trim_start().starts_with("```") {
-            out.push_str(&format!("{} {}\n\n", child.url, body.trim()));
+            out.push_str(&format!("{} {{\n{}\n}}\n\n", child.url, body.trim()));
         } else {
             out.push_str(&format!(
                 "{} {{\n{}\n}}\n\n",
@@ -378,7 +378,8 @@ mod tests {
             title: "#1 title".into(),
             body: Some("```json\n{\"test\": true}\n```".into()),
         }]);
-        assert!(dsl.contains("https://github.com/o/r/issues/1 ```json"));
+        assert!(dsl.contains("https://github.com/o/r/issues/1 {\n```json"));
         assert!(dsl.contains("{\"test\": true}"));
+        assert!(dsl.contains("```\n}\n"));
     }
 }
diff --git a/server/src/html/breadcrumb_path.rs b/server/src/html/breadcrumb_path.rs
index 3e949ce2cb70de3f024f46af773a93f3f8852260..e48612d7d3c4df52c161499a11865d4caca607aa 100644
--- a/server/src/html/breadcrumb_path.rs
+++ b/server/src/html/breadcrumb_path.rs
@@ -88,16 +88,12 @@ impl ExternalOntologyPath {
             .filter(|x| !x.is_empty())
             .map(|x| x.to_string())
             .collect();
-        let segments = if segments == ["."] {
-            vec![]
-        } else {
-            segments
-        };
+        let segments = if segments == ["."] { vec![] } else { segments };
         Self { item, segments }
     }
 
     pub(super) fn is_root(&self) -> bool {
-        self.segments.len() <= 1
+        self.segments.is_empty()
     }
 
     pub(super) fn segments(&self) -> &[String] {
@@ -108,3 +104,28 @@ impl ExternalOntologyPath {
         self.item.as_str()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn external_root_and_host_paths_are_distinct() {
+        let root = ExternalOntologyPath::from_input("");
+        assert!(root.is_root());
+        assert!(root.segments().is_empty());
+
+        let host = ExternalOntologyPath::from_input("example.com");
+        assert!(!host.is_root());
+        assert_eq!(host.segments(), &["example.com".to_string()]);
+    }
+
+    #[test]
+    fn external_path_keeps_each_url_segment_for_breadcrumbs() {
+        let path = ExternalOntologyPath::from_input("https://example.com/a/b");
+        assert_eq!(
+            path.segments(),
+            &["example.com".to_string(), "a".to_string(), "b".to_string()]
+        );
+    }
+}
diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs
index 8876a1a00a16ee3bf7a371f7a5ca27b5862b62cc..d5877eeb3632ed5d770f23a04cb4d1881209bc74 100644
--- a/server/src/html/mod.rs
+++ b/server/src/html/mod.rs
@@ -20,27 +20,30 @@ mod search;
 pub mod ui_action;
 use breadcrumb_path::{ExternalOntologyPath, OntologyPath};
 
-pub use auth::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page};
+pub use auth::{
+    auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment,
+    choose_username_page,
+};
 pub use editor::{editor_check, editor_page};
 pub use forum::{
     home, room_page, room_thread_post_view, room_thread_view, thread_feed_html,
     thread_feed_html_for_room, thread_feed_region_markup, thread_post_view, thread_view, ThreadNav,
 };
 
+pub use forum::user_profile_page;
 pub(crate) use forum::{
     fragment_new_thread_slot, login_to_post_hint_markup, room_members_section_markup,
     thread_ui_collapse_redacted_post, thread_ui_expand_post_full, thread_ui_expand_redacted_post,
     user_can_post_room, user_can_view_room,
 };
+pub(crate) use garden::{encode_pin_cookie_value, vote_compare_post_success_js, GARDEN_PIN_COOKIE};
 pub use garden::{
     external_garden_index, external_ontology_path, garden_index, ontology_path,
-    room_external_garden_index, room_external_ontology_path, room_garden_index,
-    room_ontology_path, room_vote_compare_page, vote_compare_page,
+    room_external_garden_index, room_external_ontology_path, room_garden_index, room_ontology_path,
+    room_vote_compare_page, vote_compare_page,
 };
-pub(crate) use garden::{encode_pin_cookie_value, vote_compare_post_success_js, GARDEN_PIN_COOKIE};
 pub use routing::RouteContext;
 pub use search::{search_page, search_results_fragment};
-pub use forum::user_profile_page;
 pub use ui_action::{parse_html_ui_from_form, HtmlUiAction, HtmlUiParseError, UI_RPC_FIELD};
 
 /// Public profile URL path for a stored username (no `@`).
@@ -107,8 +110,8 @@ pub struct ThemeForm {
 pub async fn post_theme(Form(form): Form<ThemeForm>) -> impl IntoResponse {
     let theme = normalize_theme(&form.theme);
     let next = sanitize_theme_next(form.next.as_deref());
-    let loc = HeaderValue::try_from(next.as_str())
-        .unwrap_or_else(|_| HeaderValue::from_static("/"));
+    let loc =
+        HeaderValue::try_from(next.as_str()).unwrap_or_else(|_| HeaderValue::from_static("/"));
     Response::builder()
         .status(StatusCode::SEE_OTHER)
         .header(header::LOCATION, loc)
@@ -179,7 +182,9 @@ pub(crate) struct JsQueryBuilder {
 
 impl JsBuilder {
     pub(crate) fn new() -> Self {
-        Self { snippets: Vec::new() }
+        Self {
+            snippets: Vec::new(),
+        }
     }
 
     pub(crate) fn morph_selector(self, selector: &str, markup: Markup) -> Self {
@@ -195,7 +200,12 @@ impl JsBuilder {
         self.qs(selector).morph_inner(markup)
     }
 
-    pub(crate) fn morph_expr(mut self, expr: &str, markup: Markup, morph_style: Option<&str>) -> Self {
+    pub(crate) fn morph_expr(
+        mut self,
+        expr: &str,
+        markup: Markup,
+        morph_style: Option<&str>,
+    ) -> Self {
         let html = js_string_literal(&markup.into_string());
         let opts = morph_style
             .map(|style| format!(", {{morphStyle: {}}}", js_string_literal(style)))
@@ -217,7 +227,11 @@ impl JsBuilder {
         self.qs(&format!("#{id}"))
     }
 
-    pub(crate) fn if_current_path_matches(mut self, path: &str, f: impl FnOnce(JsBuilder) -> JsBuilder) -> Self {
+    pub(crate) fn if_current_path_matches(
+        mut self,
+        path: &str,
+        f: impl FnOnce(JsBuilder) -> JsBuilder,
+    ) -> Self {
         let inner = f(JsBuilder::new()).build();
         self.snippets.push(format!(
             "var __slugHere = window.location.pathname + window.location.search; var __slugPath = {path}; if (__slugHere === __slugPath || __slugHere.indexOf(__slugPath + '?') === 0) {{ {inner} }}",
@@ -226,7 +240,11 @@ impl JsBuilder {
         self
     }
 
-    pub(crate) fn if_current_path_not_matches(mut self, path: &str, f: impl FnOnce(JsBuilder) -> JsBuilder) -> Self {
+    pub(crate) fn if_current_path_not_matches(
+        mut self,
+        path: &str,
+        f: impl FnOnce(JsBuilder) -> JsBuilder,
+    ) -> Self {
         let inner = f(JsBuilder::new()).build();
         self.snippets.push(format!(
             "var __slugHere = window.location.pathname + window.location.search; var __slugPath = {path}; if (!(__slugHere === __slugPath || __slugHere.indexOf(__slugPath + '?') === 0)) {{ {inner} }}",
@@ -301,7 +319,17 @@ pub(super) fn layout(
     garden_room_wire: Option<&str>,
     garden_path_prefix: Option<&str>,
 ) -> Markup {
-    layout_embed_controls(title, view, body, views, theme, theme_next, garden_room_wire, garden_path_prefix, true)
+    layout_embed_controls(
+        title,
+        view,
+        body,
+        views,
+        theme,
+        theme_next,
+        garden_room_wire,
+        garden_path_prefix,
+        true,
+    )
 }
 
 /// Minimal document shell: no bottom controls, no garden HUD data attributes (`data-garden-room` /
@@ -315,15 +343,7 @@ pub(super) fn layout_full_bleed_chromeless(
     theme_next: &str,
 ) -> Markup {
     layout_embed_controls(
-        title,
-        view,
-        body,
-        views,
-        theme,
-        theme_next,
-        None,
-        None,
-        false,
+        title, view, body, views, theme, theme_next, None, None, false,
     )
 }
 
@@ -545,7 +565,58 @@ fn item_body_title_snippet(body: &str) -> Option<String> {
     Some(format!("{truncated}{ellipsis}"))
 }
 
-/// Replace ~/path slugs in raw text with clickable links.
+fn garden_href_for_item_ref(
+    raw_ref: &str,
+    garden_prefix: &str,
+) -> Option<(crate::path_types::ItemId, String)> {
+    let key = slug_types::canonicalize_item(raw_ref);
+    let id = crate::path_types::ItemId::parse(&key)?;
+    let href = if let Some(tail) = id.tilde_tail() {
+        if tail.is_empty() {
+            garden_prefix.trim_end_matches('/').to_string()
+        } else {
+            format!("{}/{}", garden_prefix.trim_end_matches('/'), tail)
+        }
+    } else if id.as_str().starts_with("https://") || id.as_str().starts_with("http://") {
+        let display = id.display_path();
+        let rest = display.strip_prefix("-/").unwrap_or(display.as_str());
+        let ext_prefix = format!("{}-", garden_prefix.trim_end_matches('~'));
+        format!("{}/{}", ext_prefix, rest)
+    } else {
+        return None;
+    };
+    Some((id, href))
+}
+
+fn push_item_ref_anchor(
+    out: &mut String,
+    raw_ref: &str,
+    garden_prefix: &str,
+    item_bodies: Option<&HashMap<crate::path_types::ItemId, String>>,
+) -> bool {
+    let Some((id, href)) = garden_href_for_item_ref(raw_ref, garden_prefix) else {
+        return false;
+    };
+    out.push_str(r#"<a href=""#);
+    out.push_str(&escape_html(&href));
+    out.push('"');
+    out.push_str(r#" class="pre-link""#);
+    if let Some(bodies) = item_bodies {
+        if let Some(body) = bodies.get(&id) {
+            if let Some(snippet) = item_body_title_snippet(body) {
+                out.push_str(r#" title=""#);
+                out.push_str(&escape_html(&snippet));
+                out.push('"');
+            }
+        }
+    }
+    out.push('>');
+    out.push_str(&escape_html(raw_ref));
+    out.push_str("</a>");
+    true
+}
+
+/// Replace item refs in raw prose with clickable garden links.
 ///
 /// When `item_bodies` is set, matching ontology items get a `title` attribute with a truncated
 /// body preview for native browser tooltips (forum posts, item pages).
@@ -554,53 +625,16 @@ pub(super) fn linkify_slugs_with_prefix(
     garden_prefix: &str,
     item_bodies: Option<&HashMap<crate::path_types::ItemId, String>>,
 ) -> String {
-    let escaped = escape_html(raw);
-    let mut out = String::with_capacity(escaped.len() + 64);
-    let mut i = 0;
-    let s = escaped.as_str();
-    while i < s.len() {
-        let rest = &s[i..];
-        if let Some(after_tilde) = rest.strip_prefix("~/") {
-            let path_len = after_tilde
-                .chars()
-                .take_while(|c| c.is_ascii_alphanumeric() || *c == '_' || *c == '-' || *c == '/')
-                .map(|c| c.len_utf8())
-                .sum::<usize>();
-            if path_len > 0 {
-                let path = &after_tilde[..path_len];
-                out.push_str(r#"<a href=""#);
-                out.push_str(&escape_html(garden_prefix.trim_end_matches('/')));
-                out.push('/');
-                out.push_str(path);
-                out.push('"');
-                out.push_str(r#" class="pre-link""#);
-                if let Some(bodies) = item_bodies {
-                    let tilde_ref = format!("~/{}", path);
-                    let key = slug_types::canonicalize_item(&tilde_ref);
-                    if let Some(id) = crate::path_types::ItemId::parse(&key) {
-                        if let Some(body) = bodies.get(&id) {
-                            if let Some(snippet) = item_body_title_snippet(body) {
-                                out.push_str(r#" title=""#);
-                                out.push_str(&escape_html(&snippet));
-                                out.push('"');
-                            }
-                        }
-                    }
+    let mut out = String::with_capacity(raw.len() + 64);
+    for token in crate::dsl::tokenize_prose_item_refs(raw) {
+        match token {
+            crate::dsl::ProseToken::Text(text) => out.push_str(&escape_html(&text)),
+            crate::dsl::ProseToken::ItemRef(raw_ref) => {
+                if !push_item_ref_anchor(&mut out, &raw_ref, garden_prefix, item_bodies) {
+                    out.push_str(&escape_html(&raw_ref));
                 }
-                out.push('>');
-                out.push_str("~/");
-                out.push_str(path);
-                out.push_str("</a>");
-                i += 2 + path_len;
-                continue;
             }
         }
-        if let Some((j, c)) = rest.char_indices().next() {
-            out.push(c);
-            i += j + c.len_utf8();
-        } else {
-            break;
-        }
     }
     out
 }
@@ -638,7 +672,13 @@ fn spotify_embed_src(url: &str) -> Option<EmbedFrame> {
     if !(host == "open.spotify.com" || host == "www.open.spotify.com") {
         return None;
     }
-    let path = tail.split('#').next().unwrap_or(tail).split('?').next().unwrap_or(tail);
+    let path = tail
+        .split('#')
+        .next()
+        .unwrap_or(tail)
+        .split('?')
+        .next()
+        .unwrap_or(tail);
     let mut segs: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
     if segs.first().is_some_and(|s| s.starts_with("intl-")) {
         segs.remove(0);
@@ -670,8 +710,16 @@ fn youtube_embed_src(url: &str) -> Option<EmbedFrame> {
     let host = host.to_lowercase();
 
     let video_id = if host == "youtu.be" || host == "www.youtu.be" {
-        clean_media_id(tail.split(['?', '#']).next().unwrap_or(tail).trim_matches('/'))
-    } else if matches!(host.as_str(), "youtube.com" | "www.youtube.com" | "m.youtube.com" | "music.youtube.com") {
+        clean_media_id(
+            tail.split(['?', '#'])
+                .next()
+                .unwrap_or(tail)
+                .trim_matches('/'),
+        )
+    } else if matches!(
+        host.as_str(),
+        "youtube.com" | "www.youtube.com" | "m.youtube.com" | "music.youtube.com"
+    ) {
         let path = format!("/{}", tail.split('#').next().unwrap_or(tail));
         if path.starts_with("/watch") {
             clean_media_id(&query_param(url, "v")?)
@@ -745,10 +793,7 @@ pub(super) fn render_linkified_with_embeds_in_scope(
 /// CLI strings are embedded in a single-quoted JS literal; they must never need escaping.
 fn assert_cli_panel_cmd_js_single_quote_safe(s: &str) {
     assert!(
-        !s.contains('\\')
-            && !s.contains('\'')
-            && !s.contains('\n')
-            && !s.contains('\r'),
+        !s.contains('\\') && !s.contains('\'') && !s.contains('\n') && !s.contains('\r'),
         "cli_panel cmd must not contain `\\`, `'`, or newlines (got {s:?})"
     );
 }
@@ -805,15 +850,40 @@ mod linkify_title_tests {
         let mut bodies = HashMap::new();
         let key = ItemId::parse(&slug_types::canonicalize_item("~/foo/bar")).unwrap();
         bodies.insert(key, "Hello  world\nline".to_string());
-        let html = linkify_slugs_with_prefix(
-            "see ~/foo/bar ok",
-            "/r/x/~",
-            Some(&bodies),
-        );
+        let html = linkify_slugs_with_prefix("see ~/foo/bar ok", "/r/x/~", Some(&bodies));
         assert!(html.contains("title=\"Hello world line\""));
         assert!(html.contains("href=\"/r/x/~/foo/bar\""));
     }
 
+    #[test]
+    fn raw_url_links_to_public_external_garden_page() {
+        let html = linkify_slugs_with_prefix("see https://example.com/z.", "/~", None);
+        assert!(html
+            .contains(r#"<a href="/-/example.com/z" class="pre-link">https://example.com/z</a>."#));
+    }
+
+    #[test]
+    fn dash_ref_links_to_room_external_garden_page_with_title() {
+        let mut bodies = HashMap::new();
+        let key = ItemId::parse(&slug_types::canonicalize_item("-/example.com/z")).unwrap();
+        bodies.insert(key, "External body\npreview".to_string());
+        let html =
+            linkify_slugs_with_prefix("see -/example.com/z", "/r/9ab12cdroom/~", Some(&bodies));
+        assert!(html.contains(r#"href="/r/9ab12cdroom/-/example.com/z""#));
+        assert!(html.contains(r#"title="External body preview""#));
+    }
+
+    #[test]
+    fn code_fence_urls_are_not_linkified() {
+        let html = linkify_slugs_with_prefix(
+            "```json\n{\"url\":\"https://example.com/z\"}\n```\nthen https://example.com/a",
+            "/~",
+            None,
+        );
+        assert!(!html.contains(r#"href="/-/example.com/z""#));
+        assert!(html.contains(r#"href="/-/example.com/a""#));
+    }
+
     #[test]
     fn no_title_when_body_missing_or_empty() {
         let html = linkify_slugs_with_prefix("x ~/a/b y", "/~", Some(&HashMap::new()));