You are a constitutional council ranking individual git commits for ownership allocation.

Compare these two commits. Decide which contributed more lasting value to the project.

Judge substance, not spectacle:
- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.
- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.
- Do not favor a side merely because its patch is longer or noisier.
- Weight what the change does for the project, not the contributor's name.

Return ONLY a JSON object: {"winner": "A" or "B", "ratio": "N:M", "explanation": "..."}
The explanation must cite concrete differences in the patches (1-3 sentences).

Side A — contributor: tommy-mor
Side A — commit message:
[30a67104] fixes

Side A — unified diff (full patch):
diff --git a/agents.md b/agents.md
index a6a283716e09fcaba1fd690f4e877e0bbecda2c0..d9a924d2f77c444d9b112bbf37a480b963ace4f0 100644
--- a/agents.md
+++ b/agents.md
@@ -39,7 +39,7 @@ Strict **CSP** that blocks `eval` would break the current app. Other projects ma
 
 - **`VoteComparePost`:** On success returns **`text/javascript`** that **morphs** **`#vote-compare-preview`** (new ingest card) and **`#vote-edge-history-region`** (recomputed edge list). Uses **`RpcResult::PostOk`**’s **`post_id`** / **`post_index`** for the card. **`__rpc__`** carries **`form_action: "/ui"`**; **`thread_tag`** and ratio fields come from the same form as **`$form`** holes.
 
-- **Garden pin / compare voting:** Cookie **`slug_garden_pin`** via **`set_garden_pin`**. Pairwise UI: **`GET /vote/compare?…`** / **`GET /r/:room_key/vote/compare?…`**. HUD: **`#slug-pin-hud`** when **`layout`** passes garden metadata on **`body`**.
+- **Garden pin / compare voting:** Cookie **`slug_garden_pin`** via **`set_garden_pin`**. Pairwise UI: **`GET /vote/compare?…`** / **`GET /r/:room_key/vote/compare?…`**. HUD: **`#slug-pin-hud`** when **`layout`** passes garden metadata on **`body`**; the label is **`POST /ui`** **`set_garden_pin`** **`clear:true`** (**`slug_ui.js`**), not a permalink to the item.
 
 **Rule of thumb:** New **CLI or API** verbs → `RpcCommand`. New **in-page morph or form-driven** behavior that only makes sense in the browser → `HtmlUiAction`. If both need the same operation, implement the real work once (e.g. call shared RPC helpers from `post_ui_html`) and keep the wire shapes separate.
 
diff --git a/server/src/html/garden.rs b/server/src/html/garden.rs
index 8a46b1e92d38f2c390f88d48750d95d11388cd73..121d9498e8cb93d4d001dc1bbce23d74fbb958f5 100644
--- a/server/src/html/garden.rs
+++ b/server/src/html/garden.rs
@@ -16,7 +16,6 @@ use crate::{
     canonical_path::{canonicalize_item, canonicalize_tag},
     form_template::template_json_compact,
     html::{
-        forum::ingest_entry_markup,
         ui_action::UI_RPC_FIELD,
         user_can_post_room,
         JsBuilder,
@@ -111,6 +110,23 @@ fn votes_for_edge(content: &ContentState, a: &ItemId, b: &ItemId) -> Vec<crate::
     out
 }
 
+/// Number of vote ingests recorded for this unordered pair in `content` (same scope as ranking).
+fn edge_vote_count_for_pair(content: &ContentState, a: &ItemId, b: &ItemId) -> usize {
+    let (lo, hi) = canonical_edge_items(a, b);
+    let lo_s = lo.as_str();
+    let hi_s = hi.as_str();
+    content
+        .item_votes
+        .get(&lo)
+        .into_iter()
+        .flat_map(|q| q.iter())
+        .filter(|v| {
+            (v.a.as_str() == lo_s && v.b.as_str() == hi_s)
+                || (v.a.as_str() == hi_s && v.b.as_str() == lo_s)
+        })
+        .count()
+}
+
 fn vote_thread_tags_for_pair(content: &ContentState, a: &ItemId, b: &ItemId) -> Vec<String> {
     let set: HashSet<String> = content
         .item_threads
@@ -288,6 +304,7 @@ fn child_row_pin_or_vote(
     nav: &ThreadNav,
     row_item: &ItemId,
     pinned_room_and_item: Option<&(String, ItemId)>,
+    scope_content: &ContentState,
     next_path: &str,
 ) -> maud::Markup {
     let pin_matches_scope = pinned_room_and_item
@@ -315,7 +332,16 @@ fn child_row_pin_or_vote(
                 @if pi == row_item {
                     span class="ont-garden-pinned-here" title="Pinned" aria-label="Pinned" { "📌" }
                 } @else {
-                    a class="ont-garden-vote-ico" href=(vote_compare_href(nav, pi, row_item, None)) title="Vote vs pinned" aria-label="Vote" { "⚖" }
+                    @let nv = edge_vote_count_for_pair(scope_content, pi, row_item);
+                    @let tip = format!(
+                        "Compare and vote — {nv} pairwise vote{} in this scope for pinned vs this row",
+                        if nv == 1 { "" } else { "s" },
+                    );
+                    @let aria = format!("Vote; {} pairwise {}", nv, if nv == 1 { "vote" } else { "votes" });
+                    a class="ont-garden-vote-ico" href=(vote_compare_href(nav, pi, row_item, None)) title=(tip) aria-label=(aria) {
+                        span class="ont-garden-vote-glyph" aria-hidden="true" { "⚖" }
+                        span class="ont-garden-vote-count" { (format!("{}", nv)) }
+                    }
                 }
             } @else {
                 form method="POST" action="/ui" data-navigate="full" class="ont-pin-form ont-garden-pin-form" {
@@ -978,10 +1004,9 @@ async fn render_scope_view(
 ) -> axum::response::Response {
     let scope = nav.scope();
     let pin_ref = pinned_item_from_jar(&jar);
-    let model = {
-        let reduced = state.reduced.read().await;
-        build_item_page_view_model(&reduced, &scope, browse.item())
-    };
+    let reduced = state.reduced.read().await;
+    let model = build_item_page_view_model(&reduced, &scope, browse.item());
+    let scope_content = content_for_garden_view(&reduced, &scope);
     let thread_href = |tag: &str| nav.thread_url(tag);
     let external_empty_body = browse.is_external() && model.body.is_none();
     let cli_path_arg = item_display_path(&model.item);
@@ -1108,7 +1133,7 @@ async fn render_scope_view(
                                     @let item_url = item_href(r.item.as_str(), &nav);
                                     @let score_str = format!("{:.3}", r.score);
                                     li data-garden-item=(r.item.as_str()) {
-                                        (child_row_pin_or_vote(&nav, &r.item, pin_ref.as_ref(), &next_for_pin))
+                                        (child_row_pin_or_vote(&nav, &r.item, pin_ref.as_ref(), scope_content, &next_for_pin))
                                         a class="item-link" href=(item_url) { code { (item_display_path(r.item.as_str())) } }
                                         span class="ont-rank-score" { (score_str) }
                                     }
@@ -1124,7 +1149,7 @@ async fn render_scope_view(
                         ul class="ont-group-list" {
                             @for name in &model.child_rankings.unranked_items {
                                 li data-garden-item=(name.as_str()) {
-                                    (child_row_pin_or_vote(&nav, name, pin_ref.as_ref(), &next_for_pin))
+                                    (child_row_pin_or_vote(&nav, name, pin_ref.as_ref(), scope_content, &next_for_pin))
                                     @let href = item_href(name.as_str(), &nav);
                                     a class="item-link" href=(href) { code { (item_display_path(name.as_str())) } }
                                 }
@@ -1363,6 +1388,33 @@ mod tests {
         }));
     }
 
+    #[test]
+    fn edge_vote_count_for_pair_matches_votes_for_edge_len() {
+        use super::{
+            content_for_garden_view, edge_vote_count_for_pair, votes_for_edge,
+        };
+        use crate::path_types::ItemId;
+        let mut reduced = ReducerState::default();
+        apply_ingest(
+            &mut reduced,
+            1,
+            "@00000000-0000-0000-0000-000000000000:test:local/test\n\
+             ~/topic {root}\n\
+             ~/topic/a {alpha}\n\
+             ~/topic/b {beta}\n\
+             ~/topic/a 3:2 ~/topic/b {first vote}\n\
+             ~/topic/b 2:3 ~/topic/a {second vote}\n",
+        );
+        let content = content_for_garden_view(&reduced, &ScopeId::Public);
+        let a = ItemId::parse("~/topic/a").unwrap().normalized_storage();
+        let b = ItemId::parse("~/topic/b").unwrap().normalized_storage();
+        assert_eq!(
+            edge_vote_count_for_pair(content, &a, &b),
+            votes_for_edge(content, &a, &b).len()
+        );
+        assert_eq!(votes_for_edge(content, &a, &b).len(), 2);
+    }
+
     #[test]
     fn item_page_model_includes_body_and_unranked_without_votes() {
         let mut reduced = ReducerState::default();
diff --git a/server/static/slug_ui.js b/server/static/slug_ui.js
index c0de1cddbba78227dfb80bfd41e7b855b3a42bc3..86f935f8dd998f3d6df016f33b1e47f9780782ea 100644
--- a/server/static/slug_ui.js
+++ b/server/static/slug_ui.js
@@ -170,15 +170,6 @@
       return { room: raw.slice(0, i), item: raw.slice(i + 1) };
     }
 
-    function gardenItemHref(prefix, storageUrl) {
-      var marker = 'https://slug.social/~/';
-      if (storageUrl.indexOf(marker) === 0) {
-        var tail = storageUrl.slice(marker.length);
-        return prefix.replace(/\/$/, '') + (tail ? '/' + tail : '');
-      }
-      return storageUrl;
-    }
-
     function refreshPinHud() {
       var hud = document.getElementById('slug-pin-hud');
       if (!hud) return;
@@ -187,19 +178,37 @@
       var pin = decodePinCookie();
       hud.innerHTML = '';
       if (!pin || !prefix || pin.room !== bodyRoom) return;
-      var a = document.createElement('a');
-      a.className = 'slug-pin-hud-link';
-      a.href = gardenItemHref(prefix, pin.item);
-      a.title = 'Pinned item';
+      var form = document.createElement('form');
+      form.method = 'POST';
+      form.action = '/ui';
+      form.setAttribute('data-navigate', 'full');
+      form.className = 'slug-pin-hud-form';
+      var rpc = document.createElement('input');
+      rpc.type = 'hidden';
+      rpc.name = '__rpc__';
+      rpc.value = JSON.stringify({
+        action: 'set_garden_pin',
+        clear: true,
+        room_wire: '',
+        next: window.location.pathname + window.location.search,
+        form_action: '/ui',
+      });
+      form.appendChild(rpc);
+      var btn = document.createElement('button');
+      btn.type = 'submit';
+      btn.className = 'slug-pin-hud-link slug-pin-hud-unpin-btn';
+      btn.title = 'Unpin — removes this item from the corner HUD';
+      btn.setAttribute('aria-label', 'Unpin pinned item');
       var span = document.createElement('span');
       span.className = 'slug-pin-hud-glyph';
       span.setAttribute('aria-hidden', 'true');
       span.textContent = '📌';
-      a.appendChild(span);
+      btn.appendChild(span);
       var label = pin.item.replace(/^https:\/\/slug\.social\/~\/?/, '~/');
       if (label.length > 36) label = label.slice(0, 34) + '…';
-      a.appendChild(document.createTextNode(' ' + label));
-      hud.appendChild(a);
+      btn.appendChild(document.createTextNode(' ' + label));
+      form.appendChild(btn);
+      hud.appendChild(form);
     }
     refreshPinHud();
 
diff --git a/server/static/theme_default.css b/server/static/theme_default.css
index ec0fbe7acee0aa2802f978f14a9b0fc86e78c5b8..9178f0629cfb868348740e6dea1626dc6afb8345 100644
--- a/server/static/theme_default.css
+++ b/server/static/theme_default.css
@@ -799,6 +799,12 @@ details > summary::-webkit-details-marker { display: none; }
 }
 
 /* Pinned item HUD — bottom bar, same plane as spread */
+.slug-pin-hud-form {
+  display: inline;
+  margin: 0;
+  padding: 0;
+  border: none;
+}
 #slug-pin-hud.slug-pin-hud {
   margin-left: auto;
   max-width: min(42vw, 280px);
@@ -808,6 +814,13 @@ details > summary::-webkit-details-marker { display: none; }
   overflow: hidden;
   text-overflow: ellipsis;
 }
+.slug-pin-hud-link.slug-pin-hud-unpin-btn {
+  background: transparent;
+  border: none;
+  cursor: pointer;
+  font-size: inherit;
+  font-family: inherit;
+}
 .slug-pin-hud-link {
   color: var(--ui);
   text-decoration: none;
@@ -815,7 +828,10 @@ details > summary::-webkit-details-marker { display: none; }
   align-items: center;
   gap: 4px;
 }
-.slug-pin-hud-link:hover { color: var(--signal); }
+.slug-pin-hud-link:hover,
+.slug-pin-hud-unpin-btn:hover {
+  color: var(--signal);
+}
 .slug-pin-hud-glyph { font-size: 13px; line-height: 1; }
 
 /* Garden pin / vote controls */
@@ -890,10 +906,21 @@ span.ont-garden-pinned-here {
   align-items: center;
   justify-content: center;
 }
+a.ont-garden-vote-ico {
+  gap: 4px;
+}
 a.ont-garden-vote-ico:hover {
   color: var(--signal);
   background: var(--g4);
 }
+.ont-garden-vote-count {
+  font-size: 10px;
+  font-weight: 700;
+  font-variant-numeric: tabular-nums;
+}
+span.ont-garden-vote-glyph {
+  line-height: 1;
+}
 span.ont-garden-pinned-here {
   border-color: var(--link);
   color: var(--signal);
diff --git a/server/static/theme_retro_craft.css b/server/static/theme_retro_craft.css
index 092d4b3540b052cc86870179e4c264541c4446cc..efaeed06d01fd835df0621f4c621c8f034c8b536 100644
--- a/server/static/theme_retro_craft.css
+++ b/server/static/theme_retro_craft.css
@@ -593,6 +593,12 @@ body.view-ontology #controls {
    (Global craft `code` + `button[type=submit]` are tuned for dark
    thread pages; these overrides match the cream ontology shell.)
    ---------------------------------------------------------------- */
+body.view-ontology .slug-pin-hud-form {
+  display: inline;
+  margin: 0;
+  padding: 0;
+  border: none;
+}
 body.view-ontology #slug-pin-hud.slug-pin-hud {
   margin-left: auto;
   max-width: min(42vw, 280px);
@@ -603,6 +609,14 @@ body.view-ontology #slug-pin-hud.slug-pin-hud {
   overflow: hidden;
   text-overflow: ellipsis;
 }
+body.view-ontology .slug-pin-hud-link.slug-pin-hud-unpin-btn {
+  background: transparent;
+  border: none;
+  cursor: pointer;
+  font-size: inherit;
+  font-family: inherit;
+  padding: 0;
+}
 body.view-ontology .slug-pin-hud-link {
   color: #1a4a8c;
   text-decoration: none;
@@ -610,7 +624,8 @@ body.view-ontology .slug-pin-hud-link {
   align-items: center;
   gap: 0.25rem;
 }
-body.view-ontology .slug-pin-hud-link:hover {
+body.view-ontology .slug-pin-hud-link:hover,
+body.view-ontology .slug-pin-hud-unpin-btn:hover {
   color: #0d3d82;
   text-decoration: underline;
 }
@@ -676,6 +691,20 @@ body.view-ontology .ont-garden-child-actions {
   gap: 0.1rem;
 }
 body.view-ontology button.ont-garden-pin-ico,
+body.view-ontology a.ont-garden-vote-ico {
+  gap: 0.2rem;
+}
+body.view-ontology .ont-garden-vote-count {
+  font-size: 0.65rem;
+  font-family: var(--font-ui);
+  font-weight: 600;
+  font-variant-numeric: tabular-nums;
+  opacity: 0.92;
+}
+body.view-ontology span.ont-garden-vote-glyph {
+  line-height: 1;
+}
+body.view-ontology button.ont-garden-pin-ico,
 body.view-ontology a.ont-garden-vote-ico,
 body.view-ontology span.ont-garden-pinned-here {
   font-size: 0.95rem;
diff --git a/test/browser_garden_pin.clj b/test/browser_garden_pin.clj
index 169ff9b6913049094611fb0e5b6683b30220b285..98c086d5647207f3ac72dbb9cbc13488c030eef1 100644
--- a/test/browser_garden_pin.clj
+++ b/test/browser_garden_pin.clj
@@ -21,6 +21,17 @@
             (do (Thread/sleep 200) (recur))
             false))))))
 
+(defn- wait-for-absence-substr [pg selector substr timeout-ms]
+  "True once selector text does not contain substr (or is empty), or timeout."
+  (let [deadline (+ (System/currentTimeMillis) timeout-ms)]
+    (loop []
+      (let [text (locator/text-content (page/locator pg selector))]
+        (if (not (and (string? text) (str/includes? text substr)))
+          true
+          (if (< (System/currentTimeMillis) deadline)
+            (do (Thread/sleep 200) (recur))
+            false))))))
+
 (defn garden-pin-flow! []
   (println "\n━━━ browser garden pin (POST /ui set_garden_pin + HUD + vote link) ━━━\n")
 
@@ -75,8 +86,14 @@
                (is (wait-for-text pg ".ont-item-shell" "~/gp-pin-b" 15000) "on item b page")
                (is (wait-for-text pg "a.ont-vote-compare-btn" "vote" 10000)
                    "vote link visible vs pinned item")
+               ;; HUD clears pin (POST set_garden_pin clear), not navigate to item
+               (locator/click (page/locator pg "#slug-pin-hud button.slug-pin-hud-unpin-btn"))
+               (is (wait-for-absence-substr pg "#slug-pin-hud" "gp-pin-a" 15000)
+                   "HUD clears after unpin from HUD button")
+               (is (wait-for-absence-substr pg "body" "ont-vote-compare-btn" 15000)
+                   "compare vote CTA removed after HUD unpin on same reload")
                (is (str/includes? (or (page/url pg) "") "/~/gp-pin-b")
-                   "still on item b after vote link check"))))))
+                   "still on item b after HUD unpin"))))))
 
      (finally
        (when-some [s @!server] (common/kill-server s))


Side B — contributor: tommy-mor
Side B — commit message:
[7caef802] room ui wired up again

Side B — unified diff (full patch):
diff --git a/Cargo.lock b/Cargo.lock
index e31485f28717993a13e1c4caf7be15b43a97573e..8be6ff8677700ce0a56d4a53b221e25c2bb70507 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -158,6 +158,7 @@ dependencies = [
  "axum",
  "axum-core",
  "bytes",
+ "cookie",
  "fastrand",
  "futures-util",
  "http",
@@ -300,6 +301,17 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 
+[[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
diff --git a/plan2.md b/plan2.md
new file mode 100644
index 0000000000000000000000000000000000000000..1587cbe558eb0a98fbce78566bf5f93b18100e54
--- /dev/null
+++ b/plan2.md
@@ -0,0 +1,190 @@
+This is a phenomenal synthesis. You stripped away the exact parts of `evaleval` that don't scale to a multi-tenant web application (string-splicing `eval` and in-memory nonce OCAP tracking) and kept the parts that make development lightning fast (embedded declarative payloads, single endpoint routing, and Javascript AST responses). 
+
+You are entirely right about the **AST substitution in Rust**. Walking a `serde_json::Value` tree to find `{"$form": "field_name"}` and swapping the node for a String isn't a hack—in Rust, it’s just a completely standard recursive enum visitor. 
+
+Let’s lock in this exact architecture. It is cohesive, secure, and incredibly ergonomic.
+
+Here is what the code actually looks like to execute this vision.
+
+---
+
+### 1. The Safe AST Substitution
+
+This is the exact function that runs in the Web handler before giving the payload to the RPC engine. Because it operates on the JSON AST *before* deserialization, it's 100% immune to injection.
+
+```rust
+use serde_json::Value;
+use std::collections::HashMap;
+
+/// Recursively walk the JSON AST and replace {"$form": "key"} with the actual form string.
+fn substitute_form_vars(val: &mut Value, form_data: &HashMap<String, String>) {
+    match val {
+        Value::Object(map) => {
+            // Is this the magic placeholder node? {"$form": "input_name"}
+            if map.len() == 1 && map.contains_key("$form") {
+                if let Some(field_name) = map.get("$form").and_then(|v| v.as_str()) {
+                    let submitted_text = form_data.get(field_name).map(|s| s.as_str()).unwrap_or("");
+                    *val = Value::String(submitted_text.to_string());
+                    return;
+                }
+            }
+            // Otherwise, keep walking the object
+            for v in map.values_mut() {
+                substitute_form_vars(v, form_data);
+            }
+        }
+        Value::Array(arr) => {
+            // Walk arrays
+            for v in arr.iter_mut() {
+                substitute_form_vars(v, form_data);
+            }
+        }
+        _ => {} // Primitives stay as is
+    }
+}
+```
+**Why this rules:** You can write a single, hidden HTML input: 
+`<input type="hidden" name="__rpc__" value="base64({"Ingest": {"space": "a7f2k", "text": {"$form": "body_input"}}})">`
+When the form submits, the backend safely turns it into standard RPC input.
+
+---
+
+### 2. The Unified Core RPC Layer
+
+You keep exactly one execution layer that strictly enforces your domain constraints (ACLs). Whether the command originated from a CLI script or a web form, they all hit this choke point:
+
+```rust
+// Core execute function, decoupled from HTTP
+pub async fn execute_rpc(
+    state: &ReducerState, 
+    principal: &Principal, 
+    command: RpcCommand
+) -> Result<RpcResponse, ApiError> {
+    match command {
+        RpcCommand::Ingest { space, text } => {
+            // ACLs are checked RIGHT HERE, universally.
+            if !state.user_has_cap(&space, principal, ThreadCapability::Post) {
+                return Err(ApiError::Forbidden("No post access in this space".to_string()));
+            }
+            // Do the write, apply events...
+            Ok(RpcResponse::IngestOk { ... })
+        }
+        // ...
+    }
+}
+```
+
+---
+
+### 3. The `DomPatch` Builder Pattern
+
+You prefer the Builder pattern over a macro for the response mapping. I agree—builders are far easier for your IDE to autocomplete, and easier to compose dynamically (e.g., iterating over a list of items to append).
+
+```rust
+pub struct DomPatch {
+    js: String,
+}
+
+impl DomPatch {
+    pub fn new() -> Self {
+        Self { js: String::new() }
+    }
+
+    /// Morphs an element using Idiomorph
+    pub fn morph(mut self, selector: &str, html: &str) -> Self {
+        let safe_html = serde_json::to_string(html).expect("string escaping failed");
+        self.js.push_str(&format!(
+            "Idiomorph.morph(document.querySelector('{}'), {}, {{morphStyle: 'innerHTML'}});\n", 
+            selector, safe_html
+        ));
+        self
+    }
+
+    /// Appends raw HTML to an element
+    pub fn append(mut self, selector: &str, html: &str) -> Self {
+        let safe_html = serde_json::to_string(html).unwrap();
+        self.js.push_str(&format!(
+            "document.querySelector('{}')?.insertAdjacentHTML('beforeend', {});\n", 
+            selector, safe_html
+        ));
+        self
+    }
+
+    /// Executes raw javascript
+    pub fn eval(mut self, code: &str) -> Self {
+        self.js.push_str(code);
+        self.js.push('\n');
+        self
+    }
+
+    /// Consumes the builder into an HTTP Response with the right content-type
+    pub fn into_response(self) -> impl axum::response::IntoResponse {
+        (
+            axum::http::StatusCode::OK, 
+            [(axum::http::header::CONTENT_TYPE, "text/javascript")], 
+            self.js
+        )
+    }
+}
+```
+
+---
+
+### 4. The Single Web Handler (`POST /ui/action`)
+
+With the pipeline defined, you only ever have to write **one** `POST` handler for the entire Web UI.
+
+```rust
+pub async fn handle_web_action(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Form(form_data): Form<HashMap<String, String>>, // Captures everything dynamically
+) -> impl IntoResponse {
+    // 1. Authenticate using Bearer / Cookie exactly like the CLI
+    let principal = match extract_web_session(&headers, &state) {
+        Ok(p) => p,
+        Err(_) => return DomPatch::new().eval("window.location = '/auth/login';").into_response(),
+    };
+
+    // 2. Decode the Base64 JSON
+    let b64 = form_data.get("__rpc__").expect("Missing RPC payload in form");
+    let decoded = base64::decode(b64).expect("Bad b64");
+    let mut json_ast: Value = serde_json::from_slice(&decoded).expect("Bad JSON");
+
+    // 3. Do AST Substitution!
+    substitute_form_vars(&mut json_ast, &form_data);
+
+    // 4. Parse it strongly into the RPC enum
+    let command: RpcCommand = serde_json::from_value(json_ast).expect("Invalid RpcCommand");
+
+    // 5. Pass it to the core execute function (authz + mutation happens here)
+    match execute_rpc(&state.reduced.read().await, &principal, command).await {
+        Ok(RpcResponse::IngestOk { new_ranks }) => {
+            // Translate the RpcResponse to UI JS snippets
+            DomPatch::new()
+                .morph("#rank-container", &render_ranking(&new_ranks))
+                .eval("document.getElementById('ingest-form').reset();")
+                .into_response()
+        }
+        Ok(_) => DomPatch::new().eval("console.log('Action complete');").into_response(),
+        Err(e) => {
+            // Reconcile errors
+            DomPatch::new()
+                .morph("#error-banner", &format!("<div class='error'>{}</div>", e.message()))
+                .into_response()
+        }
+    }
+}
+```
+
+### The Verdict on the Grand Architecture
+
+By combining:
+1. The **Domain-Driven Asymmetry** (Spaces contain Gardens & Threads)
+2. The **Core RPC Logic** (1 executor, `Vec<RpcCommand>`, strict ACL checks)
+3. The **Single Web Form Controller** (b64 embedded, `substitute_form_vars()`)
+4. The **Javascript DomPatch Builder**
+
+You have constructed an application architecture that gives you absolute security and data integrity for your CLI AI Agents, while keeping the absolute peak hackability, form simplicity, and lightning-fast JS UI diffing of your `evaleval` Python framework. 
+
+I'm sold. It is clean, it is uniquely fitted to the mechanics of Rust (`serde`, `enums`), and it solves the URL routing fatigue problem beautifully. This is the exact way to build `slug.social` v2.
\ No newline at end of file
diff --git a/server/Cargo.toml b/server/Cargo.toml
index d527f86532c2856e29f9c6265e54c7235fdf0a8c..18c45777d662b71dc309e1daa4ddb2944da9759d 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT"
 
 [dependencies]
 axum = { version = "0.7", features = ["macros"] }
-axum-extra = { version = "0.9", features = ["query"] }
+axum-extra = { version = "0.9", features = ["query", "cookie"] }
 bytes = "1.11.1"  # pin: RUSTSEC-2026-0007
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal", "fs", "io-util"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs
index b45ba39419c84af8bf2333fc9b7d47e98525c45f..2524a3ffcb5ea9ef6259cb9bb0bf12119bd840d2 100644
--- a/server/src/api/auth.rs
+++ b/server/src/api/auth.rs
@@ -1,9 +1,11 @@
 use axum::{
+    body::Body,
     extract::{Path, Query, State},
-    http::{HeaderMap, StatusCode},
-    response::{IntoResponse, Redirect},
+    http::{header, HeaderMap, HeaderValue, StatusCode},
+    response::{IntoResponse, Redirect, Response},
     Form, Json,
 };
+use axum_extra::extract::cookie::CookieJar;
 use base64::Engine;
 use serde::Deserialize;
 use slug_types::{PendingSessionPollResponse, PendingSessionStartRequest, PendingSessionStartResponse, WhoamiResponse};
@@ -13,14 +15,47 @@ use tokio::sync::RwLock;
 use crate::{
     api::helpers::{api_error, now_ms, sha256_hex},
     events::{Event, GrantAdded, TokenIssued, UserRegistered},
-    identity::{parse_agent, parse_username},
     html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},
+    identity::{parse_agent, parse_username},
+    reducer::ReducerState,
     state::{AppState, PendingSession},
 };
 
 /// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).
 const INVITE_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000000:invite:web/join";
 
+/// Agent id for `/login` browser OAuth (no CLI); must pass [`parse_agent`].
+const WEB_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000001:social:web/browser";
+
+/// HttpOnly cookie storing the same `slug_*` bearer string the CLI uses.
+pub const SLUG_SESSION_COOKIE: &str = "slug_session";
+
+/// `Set-Cookie` header value (full attribute string).
+pub fn session_cookie_header_value(bearer: &str) -> HeaderValue {
+    let s = format!(
+        "{SLUG_SESSION_COOKIE}={bearer}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000"
+    );
+    HeaderValue::from_str(&s).expect("session cookie value must be ASCII")
+}
+
+/// Resolve the signed-in username from `Authorization: Bearer` or `slug_session` cookie.
+pub fn optional_principal(headers: &HeaderMap, jar: &CookieJar, reduced: &ReducerState) -> Option<String> {
+    if let Ok(u) = verify_bearer_principal(headers, reduced) {
+        return Some(u);
+    }
+    let c = jar.get(SLUG_SESSION_COOKIE)?;
+    verify_token(reduced, c.value()).ok()
+}
+
+fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str) -> Response {
+    Response::builder()
+        .status(StatusCode::TEMPORARY_REDIRECT)
+        .header(header::LOCATION, format!("{public_url}{path_and_query}"))
+        .header(header::SET_COOKIE, session_cookie_header_value(bearer))
+        .body(Body::empty())
+        .unwrap()
+}
+
 async fn apply_invite_redemption(state: &AppState, invite_token: &str, grantee_username: &str) -> Result<(), String> {
     let now = now_ms();
     let ga = {
@@ -306,8 +341,9 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):
                     tracing::warn!(error = %e, "invite redemption skipped after oauth");
                 }
             }
+            let cookie_bearer = bearer.clone();
             s.complete = Some((username, bearer));
-            return Redirect::temporary(&format!("{public_url}/auth/complete")).into_response();
+            return redirect_with_session_cookie(&public_url, "/", &cookie_bearer).into_response();
         }
     }
 
@@ -418,7 +454,47 @@ pub async fn post_choose_username(
         s.complete = Some((canon_user.clone(), bearer.clone()));
     }
 
-    auth_signed_in_fragment().into_response()
+    Response::builder()
+        .status(StatusCode::OK)
+        .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
+        .header(header::SET_COOKIE, session_cookie_header_value(&bearer))
+        .body(Body::from(auth_signed_in_fragment().into_string()))
+        .unwrap()
+        .into_response()
+}
+
+/// Start a browser-only OAuth flow (no CLI polling). Sets session cookie on success.
+pub async fn get_web_login(State(state): State<AppState>) -> impl IntoResponse {
+    let session = format!("p_{}", uuid::Uuid::new_v4().simple());
+    let s = PendingSession {
+        agent: WEB_BROWSER_AGENT.to_string(),
+        created_ts: now_ms(),
+        provider: None,
+        provider_id: None,
+        redeem_invite: None,
+        complete: None,
+    };
+    state.pending_sessions.write().await.insert(session.clone(), s);
+    let public_url = std::env::var("SLUG_PUBLIC_URL").unwrap_or_else(|_| "http://127.0.0.1:8080".to_string());
+    Redirect::temporary(&format!(
+        "{public_url}/auth/login?session={}",
+        urlencoding::encode(&session)
+    ))
+    .into_response()
+}
+
+pub async fn get_logout() -> impl IntoResponse {
+    let clear = format!("{SLUG_SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0");
+    Response::builder()
+        .status(StatusCode::TEMPORARY_REDIRECT)
+        .header(header::LOCATION, "/")
+        .header(
+            header::SET_COOKIE,
+            HeaderValue::from_str(&clear).expect("static cookie clears"),
+        )
+        .body(Body::empty())
+        .unwrap()
+        .into_response()
 }
 
 pub async fn post_pending_session(
diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs
index cb031aecebad1107dfa2898a98fb6084b28ba6e9..5320345a33bbb7b5ab769696a31f70347d019c3e 100644
--- a/server/src/api/mod.rs
+++ b/server/src/api/mod.rs
@@ -1,7 +1,9 @@
 mod auth;
 mod helpers;
 mod rpc;
+mod stream;
 mod validate;
+mod web_post;
 
 pub use auth::{
     get_join_invite,
@@ -13,6 +15,11 @@ pub use auth::{
     get_auth_callback,
     get_auth_complete,
     get_choose_username,
+    get_web_login,
+    get_logout,
+    optional_principal,
+    session_cookie_header_value,
+    SLUG_SESSION_COOKIE,
 };
 
 pub use helpers::{
@@ -23,8 +30,12 @@ pub use helpers::{
 
 pub use rpc::handle_rpc_batch;
 
+pub use stream::{get_html_stream, get_stream};
+
 pub use validate::{normalize_room_and_thread, validate_ingest_document, ValidatedIngest};
 
+pub use web_post::post_web_ingest;
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs
index 7d384e938a526bdf6aa04d1bf21a54d3fcb57d7e..231bf7381cf804144efd0521970b72dd8ffd4213 100644
--- a/server/src/api/rpc.rs
+++ b/server/src/api/rpc.rs
@@ -407,6 +407,22 @@ async fn rpc_post(
     })
 }
 
+/// Post forum content using a raw bearer token (CLI `Authorization` header or browser session cookie).
+pub async fn rpc_post_with_bearer(
+    state: &AppState,
+    bearer_token: &str,
+    room: String,
+    thread_tag: String,
+    text: String,
+) -> Result<RpcResult, RpcErr> {
+    use axum::http::{header, HeaderMap, HeaderValue};
+    let mut headers = HeaderMap::new();
+    let hv = HeaderValue::from_str(&format!("Bearer {bearer_token}"))
+        .map_err(|_| ("invalid session token".into(), None))?;
+    headers.insert(header::AUTHORIZATION, hv);
+    rpc_post(state, &headers, room, thread_tag, None, text, false).await
+}
+
 async fn rpc_check(
     state: &AppState,
     _room: String,
diff --git a/server/src/api/web_post.rs b/server/src/api/web_post.rs
new file mode 100644
index 0000000000000000000000000000000000000000..d7a5780c02281a60d29f27d17b291d6df5580606
--- /dev/null
+++ b/server/src/api/web_post.rs
@@ -0,0 +1,107 @@
+use axum::{
+    extract::State,
+    http::{HeaderMap, StatusCode},
+    response::{Html, IntoResponse, Redirect},
+    Form,
+};
+use axum_extra::extract::cookie::CookieJar;
+use serde::Deserialize;
+use slug_types::RpcResult;
+
+use crate::{
+    api::{
+        auth::{optional_principal, SLUG_SESSION_COOKIE},
+        rpc::rpc_post_with_bearer,
+    },
+    canonical_path::canonicalize_tag,
+    html::layout,
+    state::AppState,
+};
+
+#[derive(Debug, Deserialize)]
+pub struct WebPostForm {
+    pub room: String,
+    pub thread_tag: String,
+    pub text: String,
+}
+
+fn post_redirect_location(room: &str, thread_tag: &str) -> String {
+    let tag = canonicalize_tag(thread_tag);
+    if room.trim() == "public" {
+        format!("/t/{tag}")
+    } else {
+        let room = room.trim();
+        let Some((a, b)) = room.split_once('/') else {
+            return "/".to_string();
+        };
+        format!("/r/{a}/{b}/{tag}")
+    }
+}
+
+pub async fn post_web_ingest(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    jar: CookieJar,
+    Form(form): Form<WebPostForm>,
+) -> impl IntoResponse {
+    let reduced = state.reduced.read().await;
+    let Some(username) = optional_principal(&headers, &jar, &reduced) else {
+        drop(reduced);
+        return Redirect::temporary("/login").into_response();
+    };
+
+    let bearer = headers
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string()))
+        .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string()));
+
+    drop(reduced);
+
+    let Some(bearer) = bearer else {
+        return Redirect::temporary("/login").into_response();
+    };
+
+    let room = form.room.trim().to_string();
+    let thread_tag = form.thread_tag.trim().to_string();
+    let text = form.text.clone();
+
+    if text.trim().is_empty() {
+        return error_page(
+            "empty post",
+            "Write something in the text area (DSL / prose).",
+            &username,
+        )
+        .into_response();
+    }
+
+    match rpc_post_with_bearer(&state, &bearer, room.clone(), thread_tag.clone(), text).await {
+        Ok(RpcResult::PostOk { .. }) => {
+            Redirect::to(&post_redirect_location(&room, &thread_tag)).into_response()
+        }
+        Ok(_) => error_page("unexpected response", "Post did not return PostOk.", &username).into_response(),
+        Err((msg, hint)) => error_page(
+            &msg,
+            hint.as_deref().unwrap_or(""),
+            &username,
+        )
+        .into_response(),
+    }
+}
+
+fn error_page(title: &str, detail: &str, user: &str) -> impl IntoResponse {
+    use maud::html;
+    let body = html! {
+        nav class="breadcrumb" {
+            a href="/" { "slug.social" }
+        }
+        h1 { "could not post" }
+        p { (title) }
+        @if !detail.is_empty() {
+            pre class="muted" { (detail) }
+        }
+        p class="muted" { "signed in as @" (user) " · " a href="/" { "home" } }
+    };
+    let page = layout("post error — slug.social", "view-thread", body, None);
+    (StatusCode::BAD_REQUEST, Html(page.into_string()))
+}
diff --git a/server/src/html/forum.rs b/server/src/html/forum.rs
index 228a120065dbacd8a308ba6e8bfc6ab111877c4b..8dfcd6b23a18e1571c4f0b3b60c865fa8f576f2f 100644
--- a/server/src/html/forum.rs
+++ b/server/src/html/forum.rs
@@ -1,21 +1,24 @@
 use axum::{
     extract::{Path, Query, State},
-    http::{header, StatusCode},
+    http::{header, HeaderMap, StatusCode},
     response::{Html, IntoResponse, Response},
 };
-use serde::Deserialize;
+use axum_extra::extract::cookie::CookieJar;
 use maud::{html, Markup};
+use serde::Deserialize;
 
 use crate::{
+    api::optional_principal,
     canonical_path::canonicalize_tag,
+    events::ThreadCapability,
     reducer::{ReducerState, ScopeId},
     state::AppState,
     timeago,
 };
 
 use super::{
-    authorship_address, bc_threads, cli_panel, layout, now_ms,
-    recency_class, render_linkified_with_embeds,
+    authorship_address, bc_segment, bc_threads, cli_panel, layout, now_ms, recency_class,
+    render_linkified_with_embeds,
 };
 
 #[derive(Clone)]
@@ -26,17 +29,72 @@ struct ThreadRow {
     ingests: usize,
 }
 
-/// Collect thread rows from reducer state (unsorted).
-fn collect_thread_rows(reduced: &ReducerState, now: i64) -> Vec<ThreadRow> {
+/// URL prefix for thread pages: public `/t/…` or room `/r/{short}/{slug}/…`.
+#[derive(Clone)]
+pub struct ThreadNav {
+    pub room_wire: String,
+    scope: ScopeId,
+    path_prefix: String,
+}
+
+impl ThreadNav {
+    pub fn public() -> Self {
+        Self {
+            room_wire: "public".into(),
+            scope: ScopeId::Public,
+            path_prefix: "/t".into(),
+        }
+    }
+
+    /// `room_id` wire form `shortid/slug`.
+    pub fn from_room_id(room_id: &str) -> Option<Self> {
+        let (short, slug) = room_id.split_once('/')?;
+        if short.is_empty() || slug.is_empty() {
+            return None;
+        }
+        Some(Self {
+            room_wire: room_id.to_string(),
+            scope: ScopeId::Room(room_id.to_string()),
+            path_prefix: format!("/r/{short}/{slug}"),
+        })
+    }
+
+    fn scope(&self) -> ScopeId {
+        self.scope.clone()
+    }
+
+    fn thread_url(&self, tag: &str) -> String {
+        format!("{}/{}", self.path_prefix, tag)
+    }
+
+    fn thread_page_url(&self, tag: &str, offset: usize) -> String {
+        let base = self.thread_url(tag);
+        if offset == 0 {
+            base
+        } else {
+            format!("{base}?offset={offset}")
+        }
+    }
+
+    fn post_url(&self, tag: &str, idx: usize) -> String {
+        format!("{}/{}/{}", self.path_prefix, tag, idx)
+    }
+
+    fn expand_url(&self, tag: &str, idx: usize) -> String {
+        format!("{}/{}/{}/expand", self.path_prefix, tag, idx)
+    }
+}
+
+fn collect_thread_rows_for_scope(reduced: &ReducerState, scope: &ScopeId, now: i64) -> Vec<ThreadRow> {
     let _ = now;
     reduced
         .forum_threads
         .iter()
-        .filter(|((scope, _), _)| scope == &ScopeId::Public)
+        .filter(|((s, _), _)| s == scope)
         .map(|((_, tag), thread)| {
             let ingests = reduced
                 .ingests_by_scope_thread
-                .get(&(ScopeId::Public, tag.clone()))
+                .get(&(scope.clone(), tag.clone()))
                 .map(|q| q.len())
                 .unwrap_or(0);
             ThreadRow {
@@ -49,16 +107,46 @@ fn collect_thread_rows(reduced: &ReducerState, now: i64) -> Vec<ThreadRow> {
         .collect()
 }
 
-/// Render the thread feed div (id="thread-feed"). Used by both index() and SSE broadcast.
-fn render_thread_feed(rows: &[ThreadRow], now: i64) -> Markup {
+fn rooms_for_user(reduced: &ReducerState, username: &str) -> Vec<String> {
+    let mut v: Vec<String> = reduced
+        .grants
+        .iter()
+        .filter(|(rid, m)| reduced.rooms.contains(*rid) && m.contains_key(username))
+        .map(|(rid, _)| rid.clone())
+        .collect();
+    v.sort();
+    v
+}
+
+fn user_can_view_room(reduced: &ReducerState, room_id: &str, username: Option<&str>) -> bool {
+    if !reduced.rooms.contains(room_id) {
+        return false;
+    }
+    let Some(u) = username else {
+        return false;
+    };
+    reduced.user_has_cap(room_id, u, ThreadCapability::View)
+        || reduced.user_has_cap(room_id, u, ThreadCapability::Post)
+        || reduced.user_has_cap(room_id, u, ThreadCapability::Manage)
+}
+
+fn user_can_post_room(reduced: &ReducerState, room_id: &str, username: &str) -> bool {
+    reduced.user_has_cap(room_id, username, ThreadCapability::Post)
+}
+
+/// `feed_id` is e.g. `thread-feed` (public bump list, SSE) or `room-thread-feed`.
+fn render_thread_feed(nav: Option<&ThreadNav>, feed_id: &str, rows: &[ThreadRow], now: i64) -> Markup {
     html! {
-        div id="thread-feed" {
+        div id=(feed_id) {
             @if rows.is_empty() {
                 p class="muted" { "no threads yet" }
             } @else {
                 ul class="thread-feed" {
                     @for r in rows {
-                        @let thread_href = format!("/t/{}", r.tag);
+                        @let thread_href = nav
+                            .as_ref()
+                            .map(|n| n.thread_url(&r.tag))
+                            .unwrap_or_else(|| format!("/t/{}", r.tag));
                         @let hover = timeago::rfc3339_utc(r.last_ts);
                         @let ago = timeago::timeago(now, r.last_ts);
                         @let age_cls = recency_class(now, r.last_ts);
@@ -83,36 +171,148 @@ fn render_thread_feed(rows: &[ThreadRow], now: i64) -> Markup {
     }
 }
 
+fn auth_strip(
+    headers: &HeaderMap,
+    jar: &CookieJar,
+    reduced: &ReducerState,
+) -> Markup {
+    match optional_principal(headers, jar, reduced) {
+        Some(u) => html! {
+            p class="muted auth-strip" {
+                "@" (u)
+                " · "
+                a href="/logout" { "log out" }
+            }
+        },
+        None => html! {
+            p class="muted auth-strip" {
+                a href="/login" { "log in" }
+            }
+        },
+    }
+}
+
+fn bc_room(nav: &ThreadNav, room_slug: &str, thread_tag: Option<&str>) -> Markup {
+    html! {
+        a href="/" { "slug.social" }
+        @if let Some(t) = thread_tag {
+            (bc_segment(
+                &format!("r / {room_slug}"),
+                &nav.path_prefix,
+                false,
+            ))
+            (bc_segment(&format!("#{t}"), &nav.thread_url(t), true))
+        } @else {
+            (bc_segment(
+                &format!("r / {room_slug}"),
+                &nav.path_prefix,
+                true,
+            ))
+        }
+    }
+}
+
+fn compose_form(nav: &ThreadNav, thread_tag: &str, show: bool) -> Markup {
+    if !show {
+        return html! {};
+    }
+    html! {
+        section class="compose" {
+            h3 { "reply" }
+            p class="muted" { "Uses the same ingest DSL as the CLI. You must be logged in." }
+            form method="POST" action="/post" {
+                input type="hidden" name="room" value=(nav.room_wire.clone());
+                input type="hidden" name="thread_tag" value=(thread_tag);
+                textarea name="text" rows="8" cols="80" placeholder="prose or ~/items and votes…" {}
+                p {
+                    button type="submit" { "post" }
+                }
+            }
+        }
+    }
+}
+
+fn new_thread_form_public(show: bool) -> Markup {
+    if !show {
+        return html! {};
+    }
+    html! {
+        section class="compose" {
+            h3 { "new public thread" }
+            p class="muted" { "Set thread tag and body. Example: start with a title line or use the CLI-shaped DSL." }
+            form method="POST" action="/post" {
+                input type="hidden" name="room" value="public";
+                label for="new-thread-tag" { "thread tag" }
+                input type="text" id="new-thread-tag" name="thread_tag" pattern="[a-z0-9_\\-]{1,64}" placeholder="my-topic";
+                label for="new-thread-text" { "text" }
+                textarea id="new-thread-text" name="text" rows="6" placeholder="#my-topic\n\nYour first post…" {}
+                p { button type="submit" { "create / post" } }
+            }
+        }
+    }
+}
 
-/// Returns the current thread feed HTML fragment for SSE broadcast.
-/// selector: `#thread-feed`
+/// Returns the current public thread feed HTML fragment for SSE (`#thread-feed`).
 pub async fn thread_feed_html(state: &AppState) -> String {
     let now = now_ms();
+    let nav = ThreadNav::public();
     let mut rows = {
         let reduced = state.reduced.read().await;
-        collect_thread_rows(&reduced, now)
+        collect_thread_rows_for_scope(&reduced, &ScopeId::Public, now)
     };
     rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));
-    render_thread_feed(&rows, now).into_string()
+    render_thread_feed(Some(&nav), "thread-feed", &rows, now).into_string()
 }
 
-pub async fn index(State(state): State<AppState>) -> impl IntoResponse {
+/// Home: private rooms (signed-in), then public bump-ordered threads.
+pub async fn home(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    jar: CookieJar,
+) -> impl IntoResponse {
     let now = now_ms();
-    let mut rows: Vec<ThreadRow> = {
-        let reduced = state.reduced.read().await;
-        collect_thread_rows(&reduced, now)
-    };
-    // Bump order: most recently active first.
-    rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));
+    let reduced = state.reduced.read().await;
+    let user = optional_principal(&headers, &jar, &reduced);
+    let room_ids = user
+        .as_ref()
+        .map(|u| rooms_for_user(&reduced, u))
+        .unwrap_or_default();
+    let mut public_rows = collect_thread_rows_for_scope(&reduced, &ScopeId::Public, now);
+    drop(reduced);
+    public_rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));
+
+    let nav = ThreadNav::public();
+    let reduced_read = state.reduced.read().await;
+    let strip = auth_strip(&headers, &jar, &reduced_read);
+    let show_forms = user.is_some();
+    drop(reduced_read);
 
     let page = layout(
         "slug.social",
         "view-thread",
         html! {
+            (strip)
             nav class="breadcrumb" { (bc_threads(None)) }
+            @if !room_ids.is_empty() {
+                h2 { "your rooms" }
+                ul class="thread-feed" {
+                    @for rid in &room_ids {
+                        @if let Some(nav_r) = ThreadNav::from_room_id(rid) {
+                            @let slug = if let Some((_, s)) = rid.split_once('/') { s } else { rid.as_str() };
+                            li {
+                                a href=(nav_r.path_prefix) {
+                                    (slug)
+                                    span class="muted" { " · " (rid) }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            h2 { "public threads" }
             p class="muted" { "dark = time-ordered · light = vote-ranked" }
-            h2 { "threads" }
-            (render_thread_feed(&rows, now))
+            (render_thread_feed(Some(&nav), "thread-feed", &public_rows, now))
+            (new_thread_form_public(show_forms))
             (cli_panel("npx slugsocial forum"))
         },
         None,
@@ -127,9 +327,13 @@ pub struct ThreadViewQuery {
 
 const PAGE_SIZE: usize = 10;
 
-fn render_thread_paginator(tag: &str, offset: usize, total: usize, top: bool) -> Markup {
+fn render_thread_paginator(nav: &ThreadNav, tag: &str, offset: usize, total: usize, top: bool) -> Markup {
     let newer_offset = offset.checked_add(PAGE_SIZE).filter(|&o| o < total);
-    let older_offset = if offset > 0 { Some(offset.saturating_sub(PAGE_SIZE)) } else { None };
+    let older_offset = if offset > 0 {
+        Some(offset.saturating_sub(PAGE_SIZE))
+    } else {
+        None
+    };
     let latest_offset = total.saturating_sub(PAGE_SIZE);
     let on_latest = offset >= latest_offset;
     let (id, scroll_href, scroll_label) = if top {
@@ -141,7 +345,7 @@ fn render_thread_paginator(tag: &str, offset: usize, total: usize, top: bool) ->
         div class="thread-paginator" id=(id) {
             a href=(scroll_href) class="post-nav-btn" { (scroll_label) }
             @if let Some(o) = older_offset {
-                a href=(format!("/t/{tag}?offset={o}")) class="post-nav-btn" { "← older" }
+                a href=(nav.thread_page_url(tag, o)) class="post-nav-btn" { "← older" }
             } @else {
                 span class="post-nav-btn disabled" { "← older" }
             }
@@ -149,37 +353,38 @@ fn render_thread_paginator(tag: &str, offset: usize, total: usize, top: bool) ->
                 (offset + 1) "–" (total.min(offset + PAGE_SIZE)) " / " (total)
             }
             @if let Some(o) = newer_offset {
-                a href=(format!("/t/{tag}?offset={o}")) class="post-nav-btn" { "newer →" }
+                a href=(nav.thread_page_url(tag, o)) class="post-nav-btn" { "newer →" }
             } @else {
                 span class="post-nav-btn disabled" { "newer →" }
             }
             @if !on_latest {
-                a href=(format!("/t/{tag}?offset={latest_offset}")) class="post-nav-btn" { "latest" }
+                a href=(nav.thread_page_url(tag, latest_offset)) class="post-nav-btn" { "latest" }
             }
         }
     }
 }
 
-/// Thread view — `/t/:tag` — dark, paginated.
-pub async fn thread_view(
-    State(state): State<AppState>,
-    Path(tag): Path<String>,
-    Query(q): Query<ThreadViewQuery>,
+async fn thread_view_inner(
+    state: AppState,
+    tag: String,
+    q: ThreadViewQuery,
+    nav: ThreadNav,
+    headers: HeaderMap,
+    jar: CookieJar,
 ) -> impl IntoResponse {
     let tag = canonicalize_tag(&tag);
+    let scope = nav.scope();
 
-    // Newest-first queue → chronological for the page.
     let all_ids: Vec<String> = {
         let reduced = state.reduced.read().await;
         reduced
             .ingests_by_scope_thread
-            .get(&(ScopeId::Public, tag.clone()))
+            .get(&(scope.clone(), tag.clone()))
             .map(|q| q.iter().rev().cloned().collect())
             .unwrap_or_default()
     };
 
     let total = all_ids.len();
-    // Default: first page (oldest posts first, like a book).
     let offset = q.offset.unwrap_or(0);
     let page_ids: Vec<String> = all_ids.into_iter().skip(offset).take(PAGE_SIZE).collect();
 
@@ -189,18 +394,49 @@ pub async fn thread_view(
             .iter()
             .filter_map(|id| reduced.ingests_by_id.get(id).cloned())
             .collect::<Vec<_>>();
-        let subtitle: Option<String> = None;
-        (ingests, subtitle)
+        (ingests, None::<String>)
+    };
+
+    let reduced = state.reduced.read().await;
+    let user = optional_principal(&headers, &jar, &reduced);
+    let sc = nav.scope();
+    let show_compose = match &sc {
+        ScopeId::Public => user.is_some(),
+        ScopeId::Room(rid) => user
+            .as_ref()
+            .map(|u| user_can_post_room(&reduced, rid, u))
+            .unwrap_or(false),
     };
+    let strip = auth_strip(&headers, &jar, &reduced);
+    drop(reduced);
 
     let now = now_ms();
-    let paginator_top = render_thread_paginator(&tag, offset, total, true);
-    let paginator_bot = render_thread_paginator(&tag, offset, total, false);
+    let paginator_top = render_thread_paginator(&nav, &tag, offset, total, true);
+    let paginator_bot = render_thread_paginator(&nav, &tag, offset, total, false);
+
+    let bc: Markup = match &sc {
+        ScopeId::Public => bc_threads(Some(&tag)),
+        ScopeId::Room(rid) => {
+            let slug = if let Some((_, s)) = rid.split_once('/') {
+                s
+            } else {
+                rid.as_str()
+            };
+            bc_room(&nav, slug, Some(&tag))
+        }
+    };
+
+    let cli = match &sc {
+        ScopeId::Public => format!("npx slugsocial forum {tag}"),
+        ScopeId::Room(r) => format!("npx slugsocial private {r} forum {tag}"),
+    };
+
     let page = layout(
         &format!("#{tag}"),
         "view-thread",
         html! {
-            nav class="breadcrumb" { (bc_threads(Some(&tag))) }
+            (strip)
+            nav class="breadcrumb" { (bc) }
             h2 { "#" (tag) @if let Some(sub) = &subtitle { ": " (sub) } }
             p class="muted" { "top=oldest · bottom=newest" }
             @if display_ingests.is_empty() {
@@ -209,7 +445,7 @@ pub async fn thread_view(
                 (paginator_top)
                 @for (i, ing) in display_ingests.iter().enumerate() {
                     @let post_idx = offset + i;
-                    @let post_href = format!("/t/{tag}/{post_idx}");
+                    @let post_href = nav.post_url(&tag, post_idx);
                     @let hover = timeago::rfc3339_utc(ing.ts);
                     @let ago = timeago::timeago(now, ing.ts);
                     @let truncated = ing.raw.len() > 2000;
@@ -222,8 +458,9 @@ pub async fn thread_view(
                         }
                         (render_linkified_with_embeds(display_body))
                         @if truncated {
+                            @let exp = nav.expand_url(&tag, post_idx);
                             a href="#" class="show-full-link"
-                              onclick=(format!("fetch('/t/{tag}/{post_idx}/expand').then(r=>r.text()).then(eval);return false")) {
+                              onclick=(format!("fetch('{exp}').then(r=>r.text()).then(eval);return false")) {
                                 "[show full post]"
                             }
                         }
@@ -231,34 +468,171 @@ pub async fn thread_view(
                 }
                 (paginator_bot)
             }
-            (cli_panel(&format!("npx slugsocial forum {tag}")))
+            (compose_form(&nav, &tag, show_compose))
+            (cli_panel(&cli))
         },
         None,
     );
     Html(page.into_string()).into_response()
 }
 
-/// Single-post view — `/t/:tag/:index` — shows one ingest at full length.
-pub async fn thread_post_view(
+/// Thread view — `/t/:tag`
+pub async fn thread_view(
     State(state): State<AppState>,
-    Path((tag, index_str)): Path<(String, String)>,
+    Path(tag): Path<String>,
+    Query(q): Query<ThreadViewQuery>,
+    headers: HeaderMap,
+    jar: CookieJar,
 ) -> impl IntoResponse {
-    let tag = canonicalize_tag(&tag);
+    thread_view_inner(state, tag, q, ThreadNav::public(), headers, jar).await
+}
+
+/// Room thread — `/r/:short/:slug/:tag`
+pub async fn room_thread_view(
+    State(state): State<AppState>,
+    Path((room_short, room_slug, tag)): Path<(String, String, String)>,
+    Query(q): Query<ThreadViewQuery>,
+    headers: HeaderMap,
+    jar: CookieJar,
+) -> impl IntoResponse {
+    let room_id = format!("{room_short}/{room_slug}");
+    let reduced = state.reduced.read().await;
+    let user = optional_principal(&headers, &jar, &reduced);
+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {
+        drop(reduced);
+        return room_forbidden_page().into_response();
+    }
+    drop(reduced);
+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {
+        return (StatusCode::NOT_FOUND, "bad room path").into_response();
+    };
+    thread_view_inner(state, tag, q, nav, headers, jar)
+        .await
+        .into_response()
+}
+
+fn room_forbidden_page() -> impl IntoResponse {
+    let body = html! {
+        nav class="breadcrumb" { a href="/" { "slug.social" } }
+        h1 { "private room" }
+        p { "Log in with an account that has been granted access to this room." }
+        p { a href="/login" { "log in" } " · " a href="/" { "home" } }
+    };
+    let page = layout("private room — slug.social", "view-thread", body, None);
+    (StatusCode::FORBIDDEN, Html(page.into_string()))
+}
+
+/// Private room index — `/r/:short/:slug`
+pub async fn room_page(
+    State(state): State<AppState>,
+    Path((room_short, room_slug)): Path<(String, String)>,
+    headers: HeaderMap,
+    jar: CookieJar,
+) -> impl IntoResponse {
+    let room_id = format!("{room_short}/{room_slug}");
     let now = now_ms();
+    let reduced = state.reduced.read().await;
+    if !reduced.rooms.contains(&room_id) {
+        drop(reduced);
+        return (StatusCode::NOT_FOUND, "room not found").into_response();
+    }
+    let user = optional_principal(&headers, &jar, &reduced);
+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {
+        drop(reduced);
+        return room_forbidden_page().into_response();
+    }
+    let scope = ScopeId::Room(room_id.clone());
+    let mut rows = collect_thread_rows_for_scope(&reduced, &scope, now);
+    let strip = auth_strip(&headers, &jar, &reduced);
+    let show_new = user
+        .as_ref()
+        .map(|u| user_can_post_room(&reduced, &room_id, u))
+        .unwrap_or(false);
+    drop(reduced);
+    rows.sort_by(|a, b| b.last_ts.cmp(&a.last_ts));
+
+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {
+        return (StatusCode::NOT_FOUND, "room not found").into_response();
+    };
+    let slug_display = room_slug.as_str();
+    let cli = format!("npx slugsocial private {room_id} forum");
+
+    let page = layout(
+        &format!("room {slug_display} — slug.social"),
+        "view-thread",
+        html! {
+            (strip)
+            nav class="breadcrumb" { (bc_room(&nav, slug_display, None)) }
+            h2 { (slug_display) }
+            p class="muted" { (room_id) }
+            h3 { "threads" }
+            (render_thread_feed(Some(&nav), "room-thread-feed", &rows, now))
+            @if show_new {
+                (new_thread_form_for_room(&nav, show_new))
+            }
+            (cli_panel(&cli))
+        },
+        None,
+    );
+    Html(page.into_string()).into_response()
+}
+
+fn new_thread_form_for_room(nav: &ThreadNav, show: bool) -> Markup {
+    if !show {
+        return html! {};
+    }
+    html! {
+        section class="compose" {
+            h3 { "new thread in this room" }
+            form method="POST" action="/post" {
+                input type="hidden" name="room" value=(nav.room_wire.clone());
+                label for="room-new-tag" { "thread tag" }
+                input type="text" id="room-new-tag" name="thread_tag" pattern="[a-z0-9_\\-]{1,64}" required;
+                textarea name="text" rows="6" placeholder="First post body…" required {}
+                p { button type="submit" { "post" } }
+            }
+        }
+    }
+}
+
+async fn thread_post_view_inner(
+    state: AppState,
+    tag: String,
+    index_str: String,
+    nav: ThreadNav,
+) -> impl IntoResponse {
+    let tag = canonicalize_tag(&tag);
     let index: usize = index_str.parse().unwrap_or(0);
+    let scope = nav.scope();
+    let now = now_ms();
     let (ing, subtitle) = {
         let reduced = state.reduced.read().await;
-        let ing = reduced.ingests_by_scope_thread.get(&(ScopeId::Public, tag.clone()))
+        let ing = reduced
+            .ingests_by_scope_thread
+            .get(&(scope.clone(), tag.clone()))
             .and_then(|q| q.iter().rev().nth(index))
             .and_then(|id| reduced.ingests_by_id.get(id).cloned());
-        let subtitle: Option<String> = None;
-        (ing, subtitle)
+        (ing, None::<String>)
     };
+
+    let sc = nav.scope();
+    let bc: Markup = match &sc {
+        ScopeId::Public => bc_threads(Some(&tag)),
+        ScopeId::Room(rid) => {
+            let slug = if let Some((_, s)) = rid.split_once('/') {
+                s
+            } else {
+                rid.as_str()
+            };
+            bc_room(&nav, slug, Some(&tag))
+        }
+    };
+
     let page = layout(
         &format!("#{tag} / post #{index}"),
         "view-thread",
         html! {
-            nav class="breadcrumb" { (bc_threads(Some(&tag))) }
+            nav class="breadcrumb" { (bc) }
             h2 { "#" (tag) @if let Some(sub) = &subtitle { ": " (sub) } " / post #" (index) }
             @if let Some(ing) = ing {
                 @let hover = timeago::rfc3339_utc(ing.ts);
@@ -280,21 +654,51 @@ pub async fn thread_post_view(
     Html(page.into_string()).into_response()
 }
 
-/// Inline expand handler — `/t/:tag/:id/expand`
-/// Returns a JS snippet that morphs the truncated post into its full version.
-pub async fn thread_post_expand(
+pub async fn thread_post_view(
     State(state): State<AppState>,
     Path((tag, index_str)): Path<(String, String)>,
+) -> impl IntoResponse {
+    thread_post_view_inner(state, tag, index_str, ThreadNav::public()).await
+}
+
+pub async fn room_thread_post_view(
+    State(state): State<AppState>,
+    Path((room_short, room_slug, tag, index_str)): Path<(String, String, String, String)>,
+    headers: HeaderMap,
+    jar: CookieJar,
+) -> impl IntoResponse {
+    let room_id = format!("{room_short}/{room_slug}");
+    let reduced = state.reduced.read().await;
+    let user = optional_principal(&headers, &jar, &reduced);
+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {
+        drop(reduced);
+        return room_forbidden_page().into_response();
+    }
+    drop(reduced);
+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {
+        return (StatusCode::NOT_FOUND, "bad room path").into_response();
+    };
+    thread_post_view_inner(state, tag, index_str, nav)
+        .await
+        .into_response()
+}
+
+async fn thread_post_expand_inner(
+    state: AppState,
+    tag: String,
+    index_str: String,
+    nav: ThreadNav,
 ) -> impl IntoResponse {
     let tag = canonicalize_tag(&tag);
     let index: usize = index_str.parse().unwrap_or(0);
     let now = now_ms();
+    let scope = nav.scope();
 
     let ing = {
         let reduced = state.reduced.read().await;
         reduced
             .ingests_by_scope_thread
-            .get(&(ScopeId::Public, tag.clone()))
+            .get(&(scope.clone(), tag.clone()))
             .and_then(|q| q.iter().rev().nth(index))
             .and_then(|id| reduced.ingests_by_id.get(id).cloned())
     };
@@ -303,7 +707,7 @@ pub async fn thread_post_expand(
         return (StatusCode::NOT_FOUND, "post not found").into_response();
     };
 
-    let post_href = format!("/t/{tag}/{index}");
+    let post_href = nav.post_url(&tag, index);
     let hover = timeago::rfc3339_utc(ing.ts);
     let ago = timeago::timeago(now, ing.ts);
 
@@ -319,7 +723,6 @@ pub async fn thread_post_expand(
     };
 
     let full_html_str = full_html.into_string();
-    // Escape backticks and backslashes for JS template literal
     let escaped = full_html_str
         .replace('\\', "\\\\")
         .replace('`', "\\`")
@@ -334,7 +737,36 @@ pub async fn thread_post_expand(
     Response::builder()
         .status(StatusCode::OK)
         .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8")
-        .body(js)
+        .body(axum::body::Body::from(js))
         .unwrap()
         .into_response()
 }
+
+pub async fn thread_post_expand(
+    State(state): State<AppState>,
+    Path((tag, index_str)): Path<(String, String)>,
+) -> impl IntoResponse {
+    thread_post_expand_inner(state, tag, index_str, ThreadNav::public()).await
+}
+
+pub async fn room_thread_post_expand(
+    State(state): State<AppState>,
+    Path((room_short, room_slug, tag, index_str)): Path<(String, String, String, String)>,
+    headers: HeaderMap,
+    jar: CookieJar,
+) -> impl IntoResponse {
+    let room_id = format!("{room_short}/{room_slug}");
+    let reduced = state.reduced.read().await;
+    let user = optional_principal(&headers, &jar, &reduced);
+    if !user_can_view_room(&reduced, &room_id, user.as_deref()) {
+        drop(reduced);
+        return (StatusCode::FORBIDDEN, "forbidden").into_response();
+    }
+    drop(reduced);
+    let Some(nav) = ThreadNav::from_room_id(&room_id) else {
+        return (StatusCode::NOT_FOUND, "not found").into_response();
+    };
+    thread_post_expand_inner(state, tag, index_str, nav)
+        .await
+        .into_response()
+}
diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs
index 9c5af9654c7010d2cdb100e4cf63ba63e77c8c57..26e86124aae7cd878c92e1dc927e19d9fd2feaba 100644
--- a/server/src/html/mod.rs
+++ b/server/src/html/mod.rs
@@ -16,7 +16,10 @@ use breadcrumb_path::OntologyPath;
 
 pub use auth::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page};
 pub use editor::{editor_check, editor_page};
-pub use forum::{index, thread_feed_html, thread_post_expand, thread_post_view, thread_view};
+pub use forum::{
+    home, room_page, room_thread_post_expand, room_thread_post_view, room_thread_view, thread_feed_html,
+    thread_post_expand, thread_post_view, thread_view,
+};
 pub use garden::{garden_index, ontology_path};
 pub use search::{search_page, search_results_fragment};
 
diff --git a/server/src/lib.rs b/server/src/lib.rs
index bf2f73d4d0f26a357961e88c52c3b4f72626af81..b074cc31b94f23d1d566513392d7da3c02653c97 100644
--- a/server/src/lib.rs
+++ b/server/src/lib.rs
@@ -16,7 +16,7 @@ pub mod state;
 pub mod timeago;
 
 use axum::Router;
-use axum::routing::post;
+use axum::routing::{get, post};
 use tower_http::trace::TraceLayer;
 
 use crate::state::AppState;
@@ -25,17 +25,48 @@ pub use reducer::ReducerState;
 
 pub fn create_app(state: AppState) -> Router {
     Router::new()
-        .route("/healthz", axum::routing::get(|| async { "ok" }))
-        .route("/static/:filename", axum::routing::get(crate::html::serve_theme_css))
-        .route("/join/:token", axum::routing::get(api::get_join_invite))
-        .route("/auth/login", axum::routing::get(api::get_auth_login))
-        .route("/auth/callback", axum::routing::get(api::get_auth_callback))
-        .route("/auth/complete", axum::routing::get(api::get_auth_complete))
-        .route("/auth/choose-username", axum::routing::get(api::get_choose_username))
-        .route("/auth/choose-username", axum::routing::post(api::post_choose_username))
-        .route("/api/v0/pending-session", axum::routing::post(api::post_pending_session))
-        .route("/api/v0/pending-session/:id", axum::routing::get(api::get_pending_session))
-        .route("/api/v0/whoami", axum::routing::get(api::get_whoami))
+        .route("/healthz", get(|| async { "ok" }))
+        .route("/static/:filename", get(crate::html::serve_theme_css))
+        .route("/", get(crate::html::home))
+        .route("/login", get(api::get_web_login))
+        .route("/logout", get(api::get_logout))
+        .route("/post", post(api::post_web_ingest))
+        .route("/sse", get(api::get_html_stream))
+        .route("/stream", get(api::get_stream))
+        .route("/search", get(crate::html::search_page))
+        .route("/search/results", get(crate::html::search_results_fragment))
+        .route("/try", get(crate::html::editor_page))
+        .route("/try/check", post(crate::html::editor_check))
+        .route("/~", get(crate::html::garden_index))
+        .route("/~/*path", get(crate::html::ontology_path))
+        .route(
+            "/t/:tag/:index/expand",
+            get(crate::html::thread_post_expand),
+        )
+        .route("/t/:tag/:index", get(crate::html::thread_post_view))
+        .route("/t/:tag", get(crate::html::thread_view))
+        .route(
+            "/r/:room_short/:room_slug/:thread_tag/:index/expand",
+            get(crate::html::room_thread_post_expand),
+        )
+        .route(
+            "/r/:room_short/:room_slug/:thread_tag/:index",
+            get(crate::html::room_thread_post_view),
+        )
+        .route(
+            "/r/:room_short/:room_slug/:thread_tag",
+            get(crate::html::room_thread_view),
+        )
+        .route("/r/:room_short/:room_slug", get(crate::html::room_page))
+        .route("/join/:token", get(api::get_join_invite))
+        .route("/auth/login", get(api::get_auth_login))
+        .route("/auth/callback", get(api::get_auth_callback))
+        .route("/auth/complete", get(api::get_auth_complete))
+        .route("/auth/choose-username", get(api::get_choose_username))
+        .route("/auth/choose-username", post(api::post_choose_username))
+        .route("/api/v0/pending-session", post(api::post_pending_session))
+        .route("/api/v0/pending-session/:id", get(api::get_pending_session))
+        .route("/api/v0/whoami", get(api::get_whoami))
         .route("/api/v0/rpc", post(api::handle_rpc_batch))
         .with_state(state)
         .layer(TraceLayer::new_for_http())