Merge branch 'mai/kahn/phase-6-sliceB' (Phase 6 Slice B: mBrian-backed read path behind PROJAX_BACKEND switch, parity-green)

Per t-projax-6-sliceB-readpath. mBrian migration (m/mBrian#73) is live
on msupabase with 65 nodes + 78 child_of + 81 projax-* edges. This
commit makes the projax read path source from there behind an env
switch.

CLIENT ARCH: direct pgxpool against mbrian.* schema (same
SUPABASE_DATABASE_URL the projax binary already uses for projax.*) —
matches flexsiebels/head's cross-coupling pattern. No MCP token
plumbing.

CONTRACT (all three honoured)
- External links are SELF-EDGES (source=target=item, rel='projax-*',
  payload in edges.metadata). linkFromEdge reads the node's outbound
  projax-* edges; ref_id derived per ref_type from metadata (caldav
  url, gitea owner/repo, mai-project mai_project_id).
- Slugs finalised: 'work'/'dania' resolve to mBrian's canonical nodes;
  projax-side squatters (renamed-aside, not deleted) are documented in
  the parity test as legacy-only and skipped from field comparison.
- created_at/updated_at NOT preserved — ItemsCreatedInRange orders off
  metadata.projax.start_time when present, fall back to mBrian
  created_at. Aggregator surfaces (timeline / dashboard) read off
  caldav DTSTART + gitea updated_at, so they're unaffected.

NEW FILES
- store/mbrian.go: MBrianReader concrete impl. Bulk-loads projax-
  managed nodes + child_of edges in one pair of queries per call,
  builds a graphContext in memory, derives Paths via ancestor walk
  (depth-capped at 64 like projax's trigger). Implements every
  ItemReader method.
- store/mbrian_parity_test.go: 5 parity tests against the live db —
  ListAll field equality (skipping the renamed squatter slugs),
  spot-check resolves, caldav-list link round-trip, gitea-repo link
  round-trip, AllTags union, NotFound consistency. All 5 GREEN.
- cmd/projax-remap-views/main.go: one-shot tool to rewrite
  projax.views.filter_json.project_id from old projax uuids to new
  mBrian uuids using the audit map mBrian dropped (head will relay
  the path). Dry-run default; --apply commits. Idempotent.
- docs/plans/slice-b-views-projectid-gap.md: surfaces the gap + the
  remediation path. Must run remap BEFORE slice E drops projax.items.

CHANGES
- store/adapter.go: kept the ItemReader interface + *Store assertion;
  removed the prep stub (replaced by mbrian.go).
- web/server.go: Server.Items store.ItemReader field. web.New defaults
  Items to the concrete *Store (legacy path). main.go overrides to
  MBrianReader when PROJAX_BACKEND=mbrian.
- All read-path call sites in web/ swapped from s.Store.<readMethod>(
  to s.Items.<readMethod>( for the 15 ItemReader methods. MCP tools
  unchanged (separate scope; can pivot in a follow-up). Writes still
  flow through s.Store.
- cmd/projax/main.go: PROJAX_BACKEND env switch with "store" (default)
  and "mbrian" values. Logs the choice at startup. Unknown value
  refuses to start.

SMOKE
- go build ./... green; go vet green.
- go test ./store/ -count=1 — all parity tests pass against live data.
- Local server boot with PROJAX_BACKEND=mbrian — backs binding logs
  "backend=mbrian (read path via store.MBrianReader)" and serves
  /views/tree (auth wall protects deeper smoke; parity tests cover
  that surface).

PRE-EXISTING failure NOT addressed in this commit: 3 timeline_filter
tests in web/ already failed on main (legacy /timeline URL hits the
Phase 5j 301 redirect to /views/timeline). No diff vs main in those
test files; out of scope for slice B.

OUT OF SCOPE FOR SLICE B (deferred):
- MCP read tools migration to ItemReader (separate diff, low risk).
- Aggregator's LinkLister wired to ItemReader (currently consumes
  *Store directly through Server.Aggregator()).
- views.filter_json.project_id remap RUN — tool ships here, run waits
  on the head's relay of the audit-map path.
- Slice C write-path. Slice D mai-bridge worker. Slice E drop.

cmd/projax-remap-views/main.go

@@ -0,0 +1,139 @@
+// projax-remap-views rewrites projax.views.filter_json.project_id from
+// the OLD projax.items uuid to the new mBrian node uuid using the audit
+// map mBrian dropped after the migration. Dry-run by default; pass
+// --apply to commit.
+//
+// Phase 6 Slice B gap remediation — see
+// docs/plans/slice-b-views-projectid-gap.md for the surrounding context.
+//
+// Usage:
+//
+//	projax-remap-views --map /path/to/uuid-map.json            # dry-run
+//	projax-remap-views --map /path/to/uuid-map.json --apply    # commit
+//
+// Map shape: {"<old-uuid>": "<new-uuid>", ...}
+//
+// Env: PROJAX_DB_URL or SUPABASE_DATABASE_URL — direct postgres URL.
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+func main() {
+	mapPath := flag.String("map", "", "JSON file with {old-uuid: new-uuid} map")
+	apply := flag.Bool("apply", false, "commit changes (default: dry-run)")
+	flag.Parse()
+
+	if *mapPath == "" {
+		die("--map is required")
+	}
+	mp, err := loadMap(*mapPath)
+	if err != nil {
+		die("load map: %v", err)
+	}
+	fmt.Fprintf(os.Stderr, "loaded %d uuid mappings\n", len(mp))
+
+	dbURL := os.Getenv("PROJAX_DB_URL")
+	if dbURL == "" {
+		dbURL = os.Getenv("SUPABASE_DATABASE_URL")
+	}
+	if dbURL == "" {
+		die("set PROJAX_DB_URL or SUPABASE_DATABASE_URL")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	pool, err := pgxpool.New(ctx, dbURL)
+	if err != nil {
+		die("pool: %v", err)
+	}
+	defer pool.Close()
+
+	rows, err := pool.Query(ctx,
+		`SELECT slug, filter_json::text FROM projax.views WHERE filter_json ? 'project_id'`)
+	if err != nil {
+		die("query: %v", err)
+	}
+	defer rows.Close()
+	type view struct {
+		slug    string
+		filter  map[string]any
+	}
+	var pending []view
+	for rows.Next() {
+		var slug, raw string
+		if err := rows.Scan(&slug, &raw); err != nil {
+			die("scan: %v", err)
+		}
+		var fj map[string]any
+		if err := json.Unmarshal([]byte(raw), &fj); err != nil {
+			fmt.Fprintf(os.Stderr, "skip %s: invalid JSON: %v\n", slug, err)
+			continue
+		}
+		oldID, _ := fj["project_id"].(string)
+		newID, ok := mp[oldID]
+		if !ok {
+			fmt.Fprintf(os.Stderr, "skip %s: project_id %q not in map (possibly already remapped)\n", slug, oldID)
+			continue
+		}
+		fj["project_id"] = newID
+		pending = append(pending, view{slug: slug, filter: fj})
+		fmt.Fprintf(os.Stderr, "  %s: %s → %s\n", slug, oldID, newID)
+	}
+
+	if len(pending) == 0 {
+		fmt.Fprintln(os.Stderr, "nothing to remap")
+		return
+	}
+
+	if !*apply {
+		fmt.Fprintf(os.Stderr, "DRY RUN — %d view(s) would be remapped; pass --apply to commit\n", len(pending))
+		return
+	}
+
+	tx, err := pool.Begin(ctx)
+	if err != nil {
+		die("begin: %v", err)
+	}
+	defer tx.Rollback(ctx)
+	for _, v := range pending {
+		payload, err := json.Marshal(v.filter)
+		if err != nil {
+			die("marshal %s: %v", v.slug, err)
+		}
+		if _, err := tx.Exec(ctx,
+			`UPDATE projax.views SET filter_json = $1::jsonb WHERE slug = $2`,
+			string(payload), v.slug); err != nil {
+			die("update %s: %v", v.slug, err)
+		}
+	}
+	if err := tx.Commit(ctx); err != nil {
+		die("commit: %v", err)
+	}
+	fmt.Fprintf(os.Stderr, "committed %d remap(s)\n", len(pending))
+}
+
+func loadMap(path string) (map[string]string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	out := map[string]string{}
+	if err := json.Unmarshal(b, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func die(format string, args ...any) {
+	fmt.Fprintf(os.Stderr, format+"\n", args...)
+	os.Exit(1)
+}

cmd/projax-snapshot/main.go

@@ -0,0 +1,349 @@
+// projax-snapshot dumps the current projax.items + projax.item_links state
+// to a JSON file so the mBrian-side migration script (m/mBrian#73) can
+// consume it. Read-only; no schema changes; idempotent across runs.
+//
+// Phase 6 Slice 0 — first projax-side step in the mBrian-backend migration.
+// See docs/plans/mbrian-backend-migration.md §7 + §8 for the surrounding
+// context. The file shape is documented in the m/mBrian#73 issue body
+// (the two-pass node-then-edge layout the migration script expects).
+//
+// Usage:
+//
+//	projax-snapshot                          # write ./projax_snapshot.json
+//	projax-snapshot --out path/to/file.json  # custom output path
+//
+// Env: PROJAX_DB_URL or SUPABASE_DATABASE_URL — direct postgres URL into
+// msupabase (same conventions as the main projax binary).
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+	"sort"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Snapshot is the top-level JSON shape mBrian-side consumes.
+type Snapshot struct {
+	Version    string      `json:"version"`     // doc-evolution marker; bump on shape changes
+	GeneratedAt time.Time  `json:"generated_at"`
+	GitCommit  string      `json:"git_commit,omitempty"` // optional build-time injection
+	Items      []Item      `json:"items"`
+	Links      []ItemLink  `json:"links"`
+	SpotChecks []SpotCheck `json:"spot_checks"` // 5 representative items per m/mBrian#73 §3
+}
+
+// Item mirrors every column on projax.items as of this commit. Field
+// order matches the SQL projection; types are JSON-friendly (uuid →
+// string, jsonb → map). Anything nullable surfaces as omitempty / *T.
+type Item struct {
+	ID                string         `json:"id"`
+	Kind              []string       `json:"kind"`
+	Title             string         `json:"title"`
+	Slug              string         `json:"slug"`
+	Paths             []string       `json:"paths"`
+	ParentIDs         []string       `json:"parent_ids"`
+	ContentMD         string         `json:"content_md"`
+	Aliases           []string       `json:"aliases"`
+	Metadata          map[string]any `json:"metadata"`
+	Status            string         `json:"status"`
+	Pinned            bool           `json:"pinned"`
+	Archived          bool           `json:"archived"`
+	StartTime         *time.Time     `json:"start_time,omitempty"`
+	EndTime           *time.Time     `json:"end_time,omitempty"`
+	Tags              []string       `json:"tags"`
+	Management        []string       `json:"management"`
+	Public            bool           `json:"public"`
+	PublicDescription string         `json:"public_description,omitempty"`
+	PublicLiveURL     string         `json:"public_live_url,omitempty"`
+	PublicSourceURL   string         `json:"public_source_url,omitempty"`
+	PublicScreenshots []string       `json:"public_screenshots,omitempty"`
+	TimelineExclude   []string       `json:"timeline_exclude,omitempty"`
+	CreatedAt         time.Time      `json:"created_at"`
+	UpdatedAt         time.Time      `json:"updated_at"`
+}
+
+// ItemLink mirrors projax.item_links. ref_type values become projax-*
+// edge rel names on the mBrian side; the payload lands in edges.metadata
+// per the issue body §1.
+type ItemLink struct {
+	ID        string         `json:"id"`
+	ItemID    string         `json:"item_id"`
+	RefType   string         `json:"ref_type"`
+	RefID     string         `json:"ref_id"`
+	Rel       string         `json:"rel"`
+	Note      *string        `json:"note,omitempty"`
+	Metadata  map[string]any `json:"metadata"`
+	EventDate *time.Time     `json:"event_date,omitempty"`
+	CreatedAt time.Time      `json:"created_at"`
+}
+
+// SpotCheck names one of the 5 representative items the mBrian-side
+// script verifies post-migration. The reason text is mirrored from
+// m/mBrian#73 §3 so future readers don't need to cross-reference.
+type SpotCheck struct {
+	ItemID string `json:"item_id"`
+	Slug   string `json:"slug"`
+	Title  string `json:"title"`
+	Reason string `json:"reason"`
+}
+
+func main() {
+	out := flag.String("out", "projax_snapshot.json", "output JSON path")
+	flag.Parse()
+
+	dbURL := os.Getenv("PROJAX_DB_URL")
+	if dbURL == "" {
+		dbURL = os.Getenv("SUPABASE_DATABASE_URL")
+	}
+	if dbURL == "" {
+		die("set PROJAX_DB_URL or SUPABASE_DATABASE_URL")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	pool, err := pgxpool.New(ctx, dbURL)
+	if err != nil {
+		die("pool: %v", err)
+	}
+	defer pool.Close()
+
+	items, err := loadItems(ctx, pool)
+	if err != nil {
+		die("load items: %v", err)
+	}
+	links, err := loadLinks(ctx, pool)
+	if err != nil {
+		die("load links: %v", err)
+	}
+	spots := pickSpotChecks(items, links)
+
+	snap := Snapshot{
+		Version:     "1",
+		GeneratedAt: time.Now().UTC(),
+		Items:       items,
+		Links:       links,
+		SpotChecks:  spots,
+	}
+
+	buf, err := json.MarshalIndent(snap, "", "  ")
+	if err != nil {
+		die("marshal: %v", err)
+	}
+	if err := os.WriteFile(*out, buf, 0644); err != nil {
+		die("write %s: %v", *out, err)
+	}
+	fmt.Fprintf(os.Stderr,
+		"wrote %s — %d items, %d links, %d spot-checks\n",
+		*out, len(items), len(links), len(spots))
+}
+
+func loadItems(ctx context.Context, pool *pgxpool.Pool) ([]Item, error) {
+	rows, err := pool.Query(ctx, `
+SELECT id, kind, title, slug, paths, parent_ids, content_md, aliases,
+       metadata, status, pinned, archived, start_time, end_time,
+       tags, management,
+       public, coalesce(public_description, ''),
+       coalesce(public_live_url, ''),
+       coalesce(public_source_url, ''),
+       public_screenshots,
+       timeline_exclude,
+       created_at, updated_at
+FROM projax.items
+WHERE deleted_at IS NULL
+ORDER BY paths NULLS FIRST, slug`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := []Item{}
+	for rows.Next() {
+		var it Item
+		if err := rows.Scan(
+			&it.ID, &it.Kind, &it.Title, &it.Slug, &it.Paths, &it.ParentIDs,
+			&it.ContentMD, &it.Aliases, &it.Metadata, &it.Status, &it.Pinned, &it.Archived,
+			&it.StartTime, &it.EndTime, &it.Tags, &it.Management,
+			&it.Public, &it.PublicDescription, &it.PublicLiveURL, &it.PublicSourceURL,
+			&it.PublicScreenshots, &it.TimelineExclude, &it.CreatedAt, &it.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		// Normalise empty slices: pgx hands back nil for empty array
+		// columns, which renders as `null` in JSON. Coerce to [] for
+		// downstream-script ergonomics.
+		if it.Kind == nil {
+			it.Kind = []string{}
+		}
+		if it.Paths == nil {
+			it.Paths = []string{}
+		}
+		if it.ParentIDs == nil {
+			it.ParentIDs = []string{}
+		}
+		if it.Aliases == nil {
+			it.Aliases = []string{}
+		}
+		if it.Tags == nil {
+			it.Tags = []string{}
+		}
+		if it.Management == nil {
+			it.Management = []string{}
+		}
+		if it.PublicScreenshots == nil {
+			it.PublicScreenshots = []string{}
+		}
+		if it.TimelineExclude == nil {
+			it.TimelineExclude = []string{}
+		}
+		if it.Metadata == nil {
+			it.Metadata = map[string]any{}
+		}
+		out = append(out, it)
+	}
+	return out, rows.Err()
+}
+
+func loadLinks(ctx context.Context, pool *pgxpool.Pool) ([]ItemLink, error) {
+	rows, err := pool.Query(ctx, `
+SELECT id, item_id, ref_type, ref_id, rel, note, metadata,
+       event_date, created_at
+FROM projax.item_links
+ORDER BY item_id, ref_type, created_at`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := []ItemLink{}
+	for rows.Next() {
+		var l ItemLink
+		if err := rows.Scan(
+			&l.ID, &l.ItemID, &l.RefType, &l.RefID, &l.Rel, &l.Note,
+			&l.Metadata, &l.EventDate, &l.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		if l.Metadata == nil {
+			l.Metadata = map[string]any{}
+		}
+		out = append(out, l)
+	}
+	return out, rows.Err()
+}
+
+// pickSpotChecks selects the 5 representative items the mBrian-side
+// migration script verifies post-migration, per m/mBrian#73 §3:
+//
+//  1. A simple root area (dev).
+//  2. A single-parent project (dev.paliad — or whichever single-parent
+//     project we can find).
+//  3. A multi-parent project (any item with >1 parent_id).
+//  4. A project with a caldav-list link.
+//  5. A project with public=true and public_description / public_live_url
+//     populated.
+//
+// Failures to find any one of the 5 are non-fatal — the SpotChecks slice
+// just shrinks. mBrian-side script logs whatever's missing.
+func pickSpotChecks(items []Item, links []ItemLink) []SpotCheck {
+	byID := map[string]*Item{}
+	for i := range items {
+		byID[items[i].ID] = &items[i]
+	}
+	caldavItems := map[string]bool{}
+	for _, l := range links {
+		if l.RefType == "caldav-list" {
+			caldavItems[l.ItemID] = true
+		}
+	}
+	out := []SpotCheck{}
+
+	// 1. Root area "dev" if present.
+	for _, it := range items {
+		if it.Slug == "dev" && len(it.ParentIDs) == 0 {
+			out = append(out, SpotCheck{
+				ItemID: it.ID, Slug: it.Slug, Title: it.Title,
+				Reason: "root area (dev) — verify type=['project'] + metadata.projax.kind='area' round-trip",
+			})
+			break
+		}
+	}
+
+	// 2. Single-parent project — prefer dev.paliad if present, else any.
+	added2 := false
+	for _, it := range items {
+		if it.Slug == "paliad" && len(it.ParentIDs) == 1 {
+			out = append(out, SpotCheck{
+				ItemID: it.ID, Slug: it.Slug, Title: it.Title,
+				Reason: "single-parent project (dev.paliad) — verify one child_of edge",
+			})
+			added2 = true
+			break
+		}
+	}
+	if !added2 {
+		for _, it := range items {
+			if len(it.ParentIDs) == 1 && !containsString(it.Kind, "mai-managed") {
+				out = append(out, SpotCheck{
+					ItemID: it.ID, Slug: it.Slug, Title: it.Title,
+					Reason: "single-parent project — verify one child_of edge",
+				})
+				break
+			}
+		}
+	}
+
+	// 3. Multi-parent project — any item with cardinality(parent_ids) > 1.
+	for _, it := range items {
+		if len(it.ParentIDs) > 1 {
+			out = append(out, SpotCheck{
+				ItemID: it.ID, Slug: it.Slug, Title: it.Title,
+				Reason: fmt.Sprintf("multi-parent project (%d parents) — verify all child_of edges land", len(it.ParentIDs)),
+			})
+			break
+		}
+	}
+
+	// 4. Project with a caldav-list link.
+	for _, it := range items {
+		if caldavItems[it.ID] {
+			out = append(out, SpotCheck{
+				ItemID: it.ID, Slug: it.Slug, Title: it.Title,
+				Reason: "caldav-list-linked project — verify edges.metadata.url payload round-trip",
+			})
+			break
+		}
+	}
+
+	// 5. Project with public=true + public_description populated.
+	for _, it := range items {
+		if it.Public && it.PublicDescription != "" {
+			out = append(out, SpotCheck{
+				ItemID: it.ID, Slug: it.Slug, Title: it.Title,
+				Reason: "public-listing project — verify metadata.projax.public.* bundle preserved for flexsiebels renderer",
+			})
+			break
+		}
+	}
+
+	// Stable order for deterministic output.
+	sort.SliceStable(out, func(i, j int) bool { return out[i].Slug < out[j].Slug })
+	return out
+}
+
+func containsString(haystack []string, needle string) bool {
+	for _, s := range haystack {
+		if s == needle {
+			return true
+		}
+	}
+	return false
+}
+
+func die(format string, args ...any) {
+	fmt.Fprintf(os.Stderr, format+"\n", args...)
+	os.Exit(1)
+}

cmd/projax/main.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 	"time"
 
@@ -65,12 +66,31 @@ func main() {
 		logger.Info("migrations applied")
 	}
 
-	srv, err := web.New(store.New(pool), logger)
+	st := store.New(pool)
+	srv, err := web.New(st, logger)
 	if err != nil {
 		logger.Error("server init", "err", err)
 		os.Exit(1)
 	}
 	srv.Version = gitCommit
+
+	// Phase 6 Slice B — backend selector. PROJAX_BACKEND=mbrian flips the
+	// read path to the mBrian-backed adapter; default keeps the legacy
+	// pgx-against-projax.items path so production rollback is one env
+	// flip. Writes still flow through srv.Store either way.
+	backend := strings.ToLower(strings.TrimSpace(os.Getenv("PROJAX_BACKEND")))
+	switch backend {
+	case "mbrian":
+		srv.Items = store.NewMBrianReader(pool)
+		logger.Info("backend=mbrian (read path via store.MBrianReader)")
+	case "", "store":
+		// Default — srv.Items is the *Store from web.New.
+		logger.Info("backend=store (read path via legacy *store.Store)")
+	default:
+		logger.Error("unknown PROJAX_BACKEND value", "value", backend)
+		os.Exit(1)
+	}
+
 	logger.Info("startup", "version", gitCommit)
 
 	if supaURL := os.Getenv("SUPABASE_URL"); supaURL != "" {

db/migrations/0017_views_redesign.sql

@@ -0,0 +1,101 @@
+-- 0017_views_redesign.sql
+--
+-- Phase 5j Slice A: paliad-shape redesign of projax.views.
+--
+-- 5i (0016) modelled views as overlays on existing pages keyed by uuid.
+-- m's feedback: that's the wrong shape — views should be first-class
+-- pages at /views/{slug}, mirroring paliad's user_views model.
+--
+-- This migration HARD-REPLACES the 5i table. m's pick on Q10 (2026-05-29):
+-- hard-replace is fine because 5i was hours old with no persisted user
+-- data of value. Any rows present get dropped along with the table.
+--
+-- m's other picks worth marking inline:
+--   Q2 (2026-05-29): view_type lives INSIDE filter_json, not as a
+--                    top-level column with a CHECK constraint. Keeps the
+--                    schema lean — the renderer parses the JSON anyway.
+--   Q9 (2026-05-29): is_default_for column dropped entirely. MRU
+--                    (last_used_at) replaces the per-page-default model.
+--   Q11 (2026-05-29): graph stays outside the views enum; no graph
+--                    view_type ever lands in filter_json.
+
+DROP TABLE IF EXISTS projax.views CASCADE;
+
+CREATE TABLE projax.views (
+  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+
+  -- URL-routable identifier. Application-layer validator enforces the
+  -- regex `^[a-z0-9][a-z0-9-]{0,62}$` + a reserved-slug list (system
+  -- slugs + top-level route segments). Globally unique — single-user
+  -- v1; no user_id prefix.
+  slug          text NOT NULL,
+
+  -- Display name. Free-form; user picks whatever language they think in.
+  -- Rendered verbatim in the sidebar.
+  name          text NOT NULL,
+
+  -- Frontend icon-registry key. NULL → default folder glyph. Length cap
+  -- keeps stored value sane even if the registry is bypassed.
+  icon          text,
+
+  -- Canonical view definition. Includes view_type (per m's Q2 pick),
+  -- plus the standard TreeFilter dimensions (q, tags, management, …),
+  -- plus optional sort/group hints. Renderer parses the JSON; the DB
+  -- never has to look inside.
+  filter_json   jsonb NOT NULL DEFAULT '{}'::jsonb,
+
+  -- Sort + grouping hints used by the renderers (list/card/kanban).
+  -- Kept as top-level columns so the editor can index them quickly,
+  -- though they're conceptually part of the render spec.
+  sort_field    text,
+  sort_dir      text,
+  group_by      text,
+
+  -- Sidebar ordering. Server-assigned MAX+1 on create so two parallel
+  -- inserts don't collide. Drag-reorder UI lands in slice G; this
+  -- column is wired now so the data shape is stable.
+  sort_order    integer NOT NULL DEFAULT 0,
+
+  -- Opt-in count badge on the sidebar entry. Defaults false so casual
+  -- views don't pay the COUNT(*) cost.
+  show_count    boolean NOT NULL DEFAULT false,
+
+  -- MRU landing on /views — `handleViewsLanding` 302s here when set.
+  -- Touched fire-and-forget on every render.
+  last_used_at  timestamptz,
+
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  updated_at    timestamptz NOT NULL DEFAULT now(),
+
+  CONSTRAINT views_sort_dir_chk
+    CHECK (sort_dir IS NULL OR sort_dir IN ('asc','desc')),
+  CONSTRAINT views_slug_format_chk
+    CHECK (slug ~ '^[a-z0-9][a-z0-9-]{0,62}$')
+);
+
+CREATE UNIQUE INDEX views_slug_uniq ON projax.views (slug);
+CREATE INDEX views_sort_order_idx ON projax.views (sort_order, name);
+CREATE INDEX views_last_used_idx ON projax.views (last_used_at DESC NULLS LAST);
+
+-- updated_at trigger. Re-created here (CREATE OR REPLACE on the function)
+-- because 0016 dropped with CASCADE above.
+CREATE OR REPLACE FUNCTION projax.views_touch_updated_at()
+  RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  NEW.updated_at := now();
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS views_touch_updated_at ON projax.views;
+CREATE TRIGGER views_touch_updated_at
+  BEFORE UPDATE ON projax.views
+  FOR EACH ROW EXECUTE FUNCTION projax.views_touch_updated_at();
+
+DO $own$ BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'projax_admin') THEN
+    EXECUTE 'ALTER TABLE projax.views OWNER TO projax_admin';
+    EXECUTE 'ALTER FUNCTION projax.views_touch_updated_at() OWNER TO projax_admin';
+    EXECUTE 'GRANT SELECT, INSERT, UPDATE, DELETE ON projax.views TO projax_admin';
+  END IF;
+END $own$;

docs/plans/mbrian-backend-migration.md

@@ -0,0 +1,434 @@
+# mBrian-as-backend migration — Phase 6 design
+
+**Status**: Phase A design — re-baselined against live mBrian schema (2026-05-29).
+**Branch**: `mai/kahn/phase-6a-mbrian-design`.
+**Author**: kahn (inventor), 2026-05-29.
+**Source decision** (m, issue m/projax#5, 12:43 2026-05-29): Option A — full backend migration. *"I think we need the project-management element inside of mBrian for it to be the complete 2nd Brain experience. The data itself is not too important yet."*
+
+**m's overriding directive** (2026-05-29 via head): *"keep the database simple so it remains easily modifiable."*
+
+**Constraint**: data-loss tolerant on the 47 current `projax.items`.
+
+**m's answers on §10 (2026-05-29)**: every inventor pick confirmed.
+
+> Q1=reuse 'project' / Q2=(b) handler bridge / Q3=(a) clients projax-side / Q4=(a) file Gitea on m/mBrian via otto/head — m: *"mbrian must own the migration"* / Q5=(a) views stay projax-resident / Q6=(a) per-user slug / Q7=(a) hard-cut / Q8=(a) tags in metadata / Q9=(a) projax-side cycle detection / Q10=(a) keep projax MCP via adapter / Q11=keep `projax_origin` audit metadata.
+
+**Re-baseline note**: §3's original ask was built off a stale `db/001_initial_schema.sql` read. Head verified the live mBrian schema after m's answers. Three of the six asks (MB-A, MB-C, MB-D) turned out already-satisfied — `edges.metadata` exists since `db/010_flexsiebels_compat.sql`, `'project'` type exists since `db/033`, the per-user slug unique index ships in `db/001`. The remaining mBrian-side artifact is small. §3 + §8 now reflect that. The big shift: **mBrian owns the one-shot data-migration script** — that's what "mbrian must own the migration" means — while projax owns the read+write rewiring on its own side afterward.
+
+---
+
+## §1 — Diagnosis
+
+projax today stores its own structured data in `projax.items` + `projax.item_links` (msupabase, schema `projax`). It's a parallel knowledge surface to mBrian's main graph — both store nodes-with-content-and-edges, both speak SQL+jsonb, both ship MCP. The duplication has cost: project context (held by projax) is invisible to mBrian's reasoning paths; mBrian's relationship graph (held by mbrian) is invisible to projax's tile / timeline aggregations.
+
+m's call closes the gap by making mBrian canonical. Projax keeps its UI — the /views routes, the Tiles dashboard, the calendar grid, the timeline spine, the /tree forest, the just-shipped /views/{slug} family, and the system-view chrome — but every read and write goes through mBrian instead of `projax.items`. Same surface, single source.
+
+End-state contract:
+
+- One node graph. Every project, task-context, area, link bundle lives in `mbrian.nodes` + `mbrian.edges`.
+- projax's UI is a structured editor + aggregation surface over that graph (think paliad-shape views, mBrian-shape data).
+- mBrian's existing surfaces (the web editor, the trackers, the synthesis filings) keep working unchanged — projax data appears alongside everything else.
+- CalDAV / Gitea / mai.projects integrations stay projax-handled at the consumption layer; the items they hang off of live in mBrian.
+- The 47-item migration is one-shot. Anything lossy gets logged + flagged for manual repair; we don't preserve at all costs.
+
+---
+
+## §2 — Schema mapping (the load-bearing section)
+
+### Per-column map: `projax.items` → mBrian shape
+
+| projax column | mBrian destination | notes |
+|---|---|---|
+| `id` (uuid) | `nodes.id` | new uuids on migration; legacy ids never round-trip |
+| `kind` (text[]) | `nodes.type` | direct shape match; projax `'project'` becomes mBrian `'project'` (already in live schema, mig 033). **Areas keep `type=['project']` + `metadata.projax.kind='area'`** — per m's "keep the database simple" directive, no new mBrian type. Zero DDL. |
+| `title` | `nodes.title` | 1:1 |
+| `slug` | `nodes.slug` | mBrian = unique per user; projax = unique per parent — see §2.1 |
+| `paths` (text[]) | derived from `child_of` edges + `nodes.path` cache | DAG resolution via edge walk; see §2.2 |
+| `parent_ids` (uuid[]) | edges `(source=this, rel='child_of', target=parent)` | one edge per parent; preserves multi-parent |
+| `content_md` | `nodes.content_md` | 1:1 |
+| `aliases` (text[]) | `nodes.aliases` | 1:1 |
+| `metadata` (jsonb) | `nodes.metadata` | merge; projax metadata keeps its existing shape under a `projax` sub-key to avoid colliding with mBrian's metadata schema |
+| `status` (text) | `nodes.metadata.projax.status` | active/done/archived; mBrian's `archived` bool covers part of it but loses the active/done split |
+| `pinned` (bool) | `nodes.pinned` | 1:1 |
+| `archived` (bool) | `nodes.archived` | 1:1; status='archived' implies this too |
+| `start_time`, `end_time` (timestamptz) | `nodes.metadata.projax.start_time` / `end_time` | mBrian has no first-class start/end |
+| `tags` (text[]) | `nodes.metadata.projax.tags` | mBrian convention puts tags as separate `[tag]` nodes joined via `tagged` edges; we keep tags in metadata for the migration window then optionally re-shape — see Q8 |
+| `management` (text[]) | `nodes.metadata.projax.management` | mai/self/external/unmanaged — projax-specific concept; stays in metadata |
+| `public`, `public_description`, `public_live_url`, `public_source_url`, `public_screenshots` | `nodes.metadata.projax.public.{...}` | mBrian's `visibility` is a different model (personal/public/...); we keep projax's bundle in metadata so the flexsiebels portfolio renderer keeps working |
+| `timeline_exclude` (text[]) | `nodes.metadata.projax.timeline_exclude` | projax-only concept |
+| `created_at` | `nodes.created_at` | 1:1 |
+| `updated_at` | `nodes.updated_at` | trigger-maintained on both sides |
+| `deleted_at` | `nodes.deleted_at` | 1:1 |
+
+### §2.1 — Slug uniqueness (settled)
+
+projax today enforces slug uniqueness **per parent**. mBrian's live schema has `CREATE UNIQUE INDEX idx_nodes_slug ON mbrian.nodes (user_id, slug)` — uniqueness **per user**. Per m's Q6=(a), projax adopts mBrian's model: one `paliad` node total, connected to both `dev` and `work` via two `child_of` edges. The DAG-as-multiple-paths view is a render-time concept; the storage is one node.
+
+projax handlers' itemwrite validator (Phase 5c) loses its per-parent slug rule, gains a per-user check (against the projax-managed subset of nodes). This is **stricter** — m can't have two different "paliad" projects under different roots. Settled per m's answer.
+
+**Pre-migration dedup**: the 47-item migration script (which lives mBrian-side, see §3+§7) scans for slug collisions across the projax dataset and folds collisions into one node with multiple `child_of` edges. Skip-with-log on anything weirder.
+
+### §2.2 — paths array vs single path
+
+projax's `paths text[]` is computed from `parent_ids` (one path per ancestor lineage). mBrian's `path text` is a single denormalized cache; the canonical structure is `child_of` edges.
+
+For projax UI to keep showing multi-paths ("Also at: work.paliad"), the store-adapter layer (§4) re-derives `paths[]` from the edge graph on each fetch. Cheap at m's scale (≤200 nodes); cache lightly if profiling bites.
+
+### `projax.item_links` → mBrian edges
+
+Each `item_links` row becomes a mBrian edge with a typed `rel`. The `ref_id` semantics differ:
+
+| projax ref_type | mBrian shape | notes |
+|---|---|---|
+| `caldav-list` | edge `rel='projax-caldav-list'`, `metadata.url=...` | external URL — no target node exists; edge carries the URL in `note` or `metadata` |
+| `gitea-repo` | edge `rel='projax-gitea-repo'`, metadata={owner, repo} | same shape |
+| `gitea-issue` | edge `rel='projax-gitea-issue'`, metadata={owner, repo, number} | same |
+| `mai-project` | edge `rel='projax-mai-project'`, metadata={mai_project_id} | bridge for the Phase 1.5 bidirectional sync |
+| `mbrian-node` | edge `(source=this, rel='related_to', target=<mbrian uuid>)` | already mBrian — this becomes a regular node-to-node edge |
+| `url` | edge `rel='projax-url'`, metadata={url} | unstructured link |
+| `document`, `note` | edge `rel='projax-doc'`, metadata={...} | PER day-granular dated artifacts |
+
+mBrian edges support `note text` plus an `auto bool` flag. Both used by projax: `auto=false` for human-added links, `note` carries human annotation. The structured payload (URL, repo info, etc.) lands in a metadata jsonb that we add via a new `edges.metadata` column — see §3.
+
+### Open question on edge payloads
+
+mBrian's `edges` table today has no `metadata jsonb` column — only `rel`, `note`, `sort_order`, `node_id`, `auto`. For projax's typed external-ref payloads (caldav URLs, gitea repo names), we need either:
+- (a) Add `metadata jsonb` to `mbrian.edges` (mBrian-side schema work, see §3 Q-A).
+- (b) Use the `node_id` "complex edge" feature: the edge points at a third node that holds the metadata. Heavier per-link cost; one node per external ref.
+- (c) Stash structured payload inside `note text` as JSON. Hacky; loses index-ability.
+
+**Inventor pick: (a)** — adds one nullable column to `edges`, indexes optionally, keeps the simple shape and matches projax's existing item_links model.
+
+---
+
+## §3 — mBrian-side requirements (re-baselined against live schema)
+
+Head verified the live mBrian schema after m's answers. Three of the original six asks turned out already-satisfied. What's actually needed reduces to one [schema] convention node + ownership of the one-shot data-migration script. Per m's Q4=(a), this lands as a Gitea issue on `m/mBrian` with the "blocks projax phase 6" tag; head files it.
+
+### Already satisfied (no DDL needed)
+
+| original ask | live-schema status |
+|---|---|
+| MB-A — `edges.metadata jsonb` column | **Already exists** — added in `db/010_flexsiebels_compat.sql`: `ALTER TABLE mbrian.edges ADD COLUMN IF NOT EXISTS metadata jsonb NOT NULL DEFAULT '{}'` plus GIN `idx_edges_metadata`. Already used by mig 039/040. projax link payloads land here directly. |
+| MB-C — `'project'` type registration | **Already exists** — confirmed in `db/033` + inbox tests. m's Q1=(a) reuses it. |
+| MB-C — `'area'` type registration | **NOT needed** — per m's "keep the database simple," areas reuse `type=['project']` with `metadata.projax.kind='area'`. Zero DDL. |
+| MB-D — per-user slug uniqueness | **Already enforced** — `CREATE UNIQUE INDEX idx_nodes_slug ON mbrian.nodes (user_id, slug)` in `db/001`. Handles the bulk migration as-is, modulo the pre-write dedup pass in the script (§7). |
+| MB-E — read MCP coverage | **Confirmed** by head — type-array filter, edge query by `rel` + source/target, FTS search all present in mBrian's MCP today. Optional bulk "node + outbound edges" endpoint may improve adapter perf, but v1 ships without it. |
+| MB-F — write MCP coverage | **Confirmed** by head — create_node, update_node, soft-delete, create_edge, delete_edge all present. |
+
+### Remaining mBrian-side artifact
+
+**MB-B — projax-integration `[schema]` convention node.** One new mBrian node, no DDL. Lives under a new `[topic]` hub `projax-integration`. Documents:
+
+1. The projax edge relations: `child_of` (already in use everywhere), `projax-caldav-list`, `projax-gitea-repo`, `projax-gitea-issue`, `projax-mai-project`, `projax-url`, `projax-doc`. Each entry: rel name + the metadata jsonb shape (e.g. `projax-caldav-list` carries `{url: text}`).
+2. The projax type usage: `'project'` for both projects and areas; `metadata.projax.kind` distinguishes (`area` vs default `project`). `'mai-managed'` as a co-type marker for nodes mirroring `mai.projects` rows.
+3. The projax metadata shape: `metadata.projax.{status, tags, management, public, timeline_exclude, start_time, end_time, kind}` — the subset of projax columns that don't have a first-class mBrian counterpart.
+4. A pointer to `projax_origin` audit metadata (set per migrated node, per m's Q11=keep).
+
+mBrian-side coder writes this node by creating it via mBrian's editor or MCP. No migration file needed.
+
+### mBrian owns the data-migration script
+
+Per m's directive "mbrian must own the migration," the one-shot script that creates the 47 nodes + their edges lives in `m/mBrian` (likely `scripts/migrate-from-projax.ts` or similar — mBrian's stack picks). projax-side provides:
+
+- A frozen snapshot of `projax.items` + `projax.item_links` rows (CSV or JSON dump produced by a projax-side helper).
+- The mapping rules from §2 + §2.2 in a form mBrian-side can implement against (this plan doc is the canonical source).
+- A spot-check checklist (5 representative items) for post-migration validation.
+
+The script's blast radius lives on mBrian's side; projax-side blocks on its successful run before slice C kicks off.
+
+### Cross-repo coordination shape
+
+One Gitea issue on `m/mBrian` (filed by head), tagged "blocks projax phase 6". The issue body covers MB-B + script ownership + the snapshot-handoff protocol. Body draft delivered to head with this re-baseline (see Phase A workflow §14).
+
+---
+
+## §4 — projax-side read-path replacement
+
+The store package becomes a thin adapter over mBrian. Consumers stay shape-stable: `*store.Item` still exposes Kind / Title / Slug / Paths / ParentIDs / ContentMD / Aliases / Metadata / Status / Pinned / Archived / Tags / Management / Public* / TimelineExclude / etc. Internally those come from mBrian nodes + metadata + edge-walks.
+
+| projax call site | new implementation |
+|---|---|
+| `store.Store.ListAll(ctx)` | mBrian: `SELECT FROM mbrian.nodes WHERE 'projax' = ANY(metadata.projax_origin) ... ORDER BY title` (or via MCP `list_nodes`). Returns []*Item adapted from each node. |
+| `store.Store.GetByPath(ctx, path)` | resolve path → leaf node by walking `child_of` edges from the path's root segment; cache hits during render |
+| `store.Store.GetByID(ctx, id)` | direct mBrian fetch |
+| `store.Store.LinksByRefType(ctx, t)` | edge query `rel='projax-<t>'` over all projax-managed nodes |
+| `store.Store.AllTags(ctx)` | aggregate over `metadata.projax.tags` arrays across projax nodes |
+| `store.Store.MaiOrphans(ctx)` | mBrian: find projax-managed nodes with no `child_of` edge + `metadata.projax.management contains 'mai'` |
+| `store.Store.DatedLinks(ctx, id)` | edge query `rel IN ('projax-doc', 'projax-url')` for the node, filtered to those with `metadata.event_date` set |
+
+The aggregator (`internal/aggregate/`) doesn't see mBrian — it gets `[]*store.Item` from the adapter. CalDAV + Gitea external fetches stay where they are.
+
+Views (Phase 5j `projax.views` table) decision point — see Q5.
+
+### Adapter layer surface
+
+```go
+package store
+
+type Store struct {
+    mb *mbrian.Client  // MCP-style client or direct SQL
+}
+
+func (s *Store) ListAll(ctx context.Context) ([]*Item, error) { ... }
+// every existing method keeps its signature; bodies rewrite to mBrian calls
+```
+
+The Item struct stays unchanged. Tests against the adapter assert "given this mBrian state, ListAll returns these items". Existing aggregator + handler tests stay green because they only see `*Item`.
+
+---
+
+## §5 — projax-side write-path replacement
+
+Every projax write rewires to mBrian.
+
+| projax handler | new behaviour |
+|---|---|
+| `POST /i/{path}` (detail edit, `handleDetailWrite`) | mBrian update_node + edge re-write for `parent_ids` changes |
+| `POST /new` (`handleNewSubmit`) | mBrian create_node + `child_of` edges |
+| `POST /i/{path}/reparent` (`handleReparent`) | edge delete + re-create for `child_of` |
+| `/admin/bulk` (`handleBulkApply`, `handleBulkChip`) | bulk mBrian updates; one mBrian write per row |
+| `/admin/classify` (`handleClassify`) | mBrian update + add `child_of` edge |
+| `POST /views/...` (5j editor) | unchanged if views stay in `projax.views`; rewired if they move (Q5) |
+| MCP `create_item` / `update_item` / `delete_item` | mBrian MCP create / update / soft_delete |
+| MCP `add_link` / `remove_link` | mBrian create_edge / delete_edge |
+
+### Validation (Phase 5c itemwrite package)
+
+The pre-flight validator stays as projax-handler logic — projax UI / MCP still surface friendly errors for `KindInvalidSlugFormat` / `KindSlugCollision` / `KindCycle` / etc. before round-tripping. The DB-level enforcement moves to mBrian's per-user unique index on slug (covers collision) + projax's `paths` recomputation (covers cycle detection). Trigger-level cycle detection on mBrian's edges is a mBrian-side ask (mb-G optional).
+
+### Cycle + slug-collision semantics
+
+Per §2.1: projax loses per-parent slug uniqueness; per-user uniqueness wins. The validator's KindSlugCollision rule needs updating to reject any duplicate slug across the whole projax-managed set, not just under the same parent.
+
+Cycle detection: projax today does it via the path trigger (cycle = self-ancestor). After migration, projax fetches all projax nodes + their child_of edges, walks the closure on every write, rejects cycles. Cheap at m's scale.
+
+---
+
+## §6 — Integrations (CalDAV / Gitea / mai.projects)
+
+### CalDAV + Gitea
+
+The link bundle (per §2.2) moves to mBrian edges with structured metadata. The CalDAV / Gitea **clients** + their caches stay projax-side (the aggregator owns these). The render path queries mBrian for "which items have caldav-list edges + what URLs," then fans out to the existing CalDAV client. Net effect: the fan-out stays where it is; only the source of "what to fan out for" changes.
+
+### mai.projects bidirectional sync (Phase 1.5)
+
+The Phase 1.5 trigger pair (mai.projects ↔ projax.items) is the most fragile piece of the integration today. After Phase 6:
+
+- (a) **Keep the trigger pair**, pointing the mai.projects view at the migrated mBrian nodes. Requires rewriting the trigger functions to read from mBrian; significant complexity because mai.projects expects projax.items columns.
+- (b) **Move the bridge to projax handler layer**: a sync worker watches mai.projects changes + writes mBrian; mBrian node changes flow back via a webhook or periodic poll. Slower but decoupled.
+- (c) **Drop the bridge entirely**: mai.projects becomes legacy; mai workers consume mBrian directly via MCP. Cleanest, but requires mai-side work to migrate workers/tasks/sessions FKs.
+
+**Inventor pick: (b)** — the bridge stays operational without bleeding mBrian schema details into mai.projects code, and m can sunset it gradually. (c) is the right long-term shape but it's another migration project; out of scope for Phase 6.
+
+This is **Q2** for m.
+
+---
+
+## §7 — Migration mechanics (mBrian-owned)
+
+Per m's Q7=(a) hard-cut + Q4=(a) "mbrian must own the migration": the one-shot script lives in `m/mBrian`. projax-side provides the input snapshot + the rules in this doc; mBrian-side owns the execution.
+
+### projax-side input snapshot
+
+A helper command in `cmd/projax-snapshot/main.go` produces a `projax_snapshot.json` containing every live `projax.items` row + every `projax.item_links` row, shaped for direct consumption by the mBrian-side script. One file, deterministic, round-trippable. Ships in slice 0 (the snapshot handoff, see §8).
+
+### mBrian-side script outline (for the m/mBrian issue body)
+
+1. Load `projax_snapshot.json`.
+2. Two-pass: pass 1 creates every node; pass 2 writes every edge (parent edges + item_links → projax-* edges).
+3. For each item:
+   a. New mBrian uuid OR preserve the projax uuid (mBrian-side picks; either works given m's Q11 audit metadata is the durable reference).
+   b. INSERT into `mbrian.nodes` with `type=['project']` (or `['project']` + co-type per `kind`), `title`, `slug`, `aliases`, `metadata={projax: {...}, projax_origin: <old_id>}`.
+   c. Where projax had multiple paths (same node under multiple parents), DEDUPE by slug — one node, multiple `child_of` edges.
+4. For each parent edge: INSERT `mbrian.edges (source=new_id, target=parent_new_id, rel='child_of')`.
+5. For each item_links row: INSERT `mbrian.edges` with `rel='projax-<ref_type>'` and `metadata` carrying the structured payload per §2.2.
+6. For projax.views (5j): NOT migrated — per m's Q5=(a), the views table stays projax-resident.
+7. Smoke check: count(mbrian.nodes WHERE metadata->>'projax_origin' is not null) == count(items in snapshot).
+8. Hand off to projax with the new uuid map (`{old_uuid: new_uuid}`) so projax-side caches can warm.
+
+### Idempotency
+
+Pre-flight: the script checks `metadata.projax_origin` and skips already-migrated origins on re-run. m can re-run safely if the script aborts mid-way.
+
+### Lossy bits (acceptable per m's stance)
+
+- `paths text[]` array is not preserved — projax-side adapter recomputes from edges per §4.
+- mai.projects mirror rows: per Q2=(b), a handler-layer bridge worker re-syncs after migration; the Phase 1.5 trigger pair stays disabled.
+
+### Blast-radius containment
+
+mBrian-side runs the script with triggers paused, smoke-checks the count + spot-checks the 5 representative items in projax's checklist, then commits + signals projax-side to start slice C (read-path).
+
+---
+
+## §8 — Implementation slicing (re-baselined)
+
+Six slices. The big shift from the original draft: the mBrian-side ask compresses to one [schema] convention node + one migration script (both mBrian-owned per m's Q4). Slice 0 is a small projax-side helper that ships the snapshot. The hard gate is the migration landing — projax-side B reads it as the trigger to start.
+
+- **0. projax-side snapshot helper** — `cmd/projax-snapshot/main.go`. Dumps live `projax.items` + `projax.item_links` to `projax_snapshot.json`. Ships first; minimal risk; deliverable mBrian needs.
+
+- **A. mBrian-side: [schema] convention node + data-migration script** — m/mBrian owns. The [schema] node lives under a new `[topic]` hub `projax-integration`. The script consumes the snapshot from slice 0 and writes 47ish nodes + their edges per §7. mBrian-side post-flight: smoke-check count + spot-check 5 items per the projax checklist.
+
+- **B. projax-side read-path adapter** — projax-side. `store/` package rewired against mBrian's MCP / SQL surface. The `Item` struct stays; method bodies rewrite. All UI + aggregator tests stay green (they only see Item shape). Per-request snapshot cache to avoid N+1 calls. Reads-only soak before slice C.
+
+- **C. projax-side write-path** — projax-side. Every handler + MCP write rewires through the adapter to mBrian. itemwrite validator updates for the per-user slug rule (Q6). Cycle detection on the in-memory closure (Q9).
+
+- **D. mai.projects bridge worker** — projax-side (Q2=(b)). Disable the Phase 1.5 trigger pair; ship a small worker that observes mai.projects writes + reflects them into mBrian, and vice versa. Decoupled, killable.
+
+- **E. Drop `projax.items` + `projax.item_links`** — projax-side. Migration `0018_drop_projax_items.sql`. Triggers off after one shift's stable read+write soak on mBrian. `projax.views` stays (Q5).
+
+Dependency graph:
+
+```
+0 (projax snapshot) ──→ A (mBrian [schema] node + migration script run)
+                               │
+                               ▼
+                      B (projax read-path) ──→ C (projax write-path)
+                                                        │
+                                                        ├──→ D (mai bridge worker)
+                                                        ▼
+                                                E (drop projax tables)
+```
+
+Slice 0 unblocks A. A is mBrian-owned and the hard gate for everything else. B → C can ship together if green; otherwise B-first soak.
+
+CalDAV / Gitea integrations stay where they are (Q3=(a)) — no slice F needed in the original sense.
+
+---
+
+## §9 — Cross-repo coordination (settled)
+
+Per m's Q4=(a) + his words *"mbrian must own the migration"*:
+
+1. **Protocol**: file a Gitea issue on `m/mBrian` with "blocks projax phase 6" tag. Routed via otto/head per global Channel Routing. Head files it; kahn drafts the body.
+
+2. **Ownership split**:
+   - mBrian-side owns: the `[schema]` convention node (MB-B) + the one-shot data-migration script.
+   - projax-side owns: the snapshot helper (slice 0), the read-path adapter (slice B), the write-path (slice C), the mai bridge (slice D), the table drop (slice E).
+
+3. **Sequencing**: slice 0 produces the snapshot → mBrian-side A consumes it + runs the migration → mBrian-side signals back → projax-side starts B. The Gitea issue is the durable trace; the delegation reply chain is the real-time signal.
+
+4. **Design-doc sharing**: this plan stays in `m/projax`. The m/mBrian issue body (drafted alongside this re-baseline, delivered to head) excerpts §2 (schema mapping), §3 (the one [schema] node ask), §7 (the script outline), and the spot-check checklist.
+
+---
+
+## §10 — Open questions (all answered 2026-05-29)
+
+All 11 questions resolved. m confirmed every inventor pick. Section retained as the historical record + so a future hand can audit the decision rationale.
+
+
+
+The 8 from issue #5 plus what surfaced during this survey.
+
+**Q1 — mBrian node type for projax items**
+- (a) Reuse existing `'project'` type, add `'area'` if missing, multi-typed for both. — **inventor pick** (existing type minimises mBrian-side churn).
+- (b) New dedicated `'projax-item'` / `'work-item'` type.
+
+**Q2 — mai.projects bidirectional sync disposition** (§6)
+- (a) Keep the trigger pair (rewrite to read from mBrian).
+- (b) Move to projax handler-layer bridge worker. — **inventor pick** (clean decoupling).
+- (c) Drop entirely; migrate mai-side FKs.
+
+**Q3 — CalDAV + Gitea integration ownership** (§6)
+- (a) Clients + caches stay projax-side; only the "which items have these links" lookup moves to mBrian. — **inventor pick** (minimal change to aggregator).
+- (b) Migrate CalDAV/Gitea ownership to mBrian edges + projax becomes a pure renderer.
+
+**Q4 — mBrian head contact protocol** (§9)
+- (a) Through otto/head per Channel Routing (default per global rule). — **inventor pick**.
+- (b) Direct to a future mBrian/head worker.
+- (c) m himself owns mBrian schema work — file Gitea issue on m/mBrian.
+
+**Q5 — projax.views (5j) disposition**
+- (a) Keep as projax-resident table — views are projax-UI state, not graph data. — **inventor pick**.
+- (b) Migrate to mBrian nodes with type=`[view]`; one node per saved view.
+- (c) Drop the table; user views become a derived shape from mBrian metadata on the items themselves.
+
+**Q6 — Slug uniqueness model**
+- (a) Adopt mBrian's per-user unique (loses "two paliads under different roots" case). — **inventor pick** (simpler; m hasn't used the per-parent split in practice).
+- (b) Keep projax's per-parent rule via projax-handler validator + mBrian per-user check disabled for projax nodes (requires mBrian-side scoped-uniqueness work).
+
+**Q7 — Migration mechanics** (§7)
+- (a) Hard-cut, one script, accept data loss. — **inventor pick** (matches m's stance).
+- (b) Phased dual-write + soak.
+
+**Q8 — Tags model**
+- (a) Keep tags in `metadata.projax.tags` (projax sees them as before; mBrian doesn't index them). — **inventor pick** for v1.
+- (b) Lift each tag to a `[tag]` node + `tagged` edges (mBrian convention).
+- (c) Hybrid — keep metadata for projax compatibility AND wire tagged-edges for mBrian visibility.
+
+Q8(c) is the "right" long-term shape but doubles the write surface in slice D. Recommend deferring to a Phase 7 polish.
+
+**Q9 — Cycle detection placement**
+- (a) projax-handler-side via in-memory closure walk before write. — **inventor pick** (cheap at m's scale).
+- (b) mBrian-side via trigger on `edges` (mb-G ask).
+
+**Q10 — Projax MCP surface**
+- (a) Keep projax MCP tools (`mcp__projax__*`); they now route through the adapter. — **inventor pick** (no MCP client change).
+- (b) Sunset projax MCP; users call mBrian MCP directly.
+
+**Q11 — `projax_origin` audit metadata** (§7)
+Per the migration script, every migrated node carries `metadata.projax_origin = <old uuid>`. Keep indefinitely (audit trail), purge after one shift (cleanup), or never write it (trust). **Inventor pick**: keep indefinitely.
+
+---
+
+## §11 — Risk register
+
+| risk | likelihood | mitigation |
+|---|---|---|
+| mBrian-side schema work (slice A) blocks projax indefinitely | medium | clear delegation + Gitea issue with "blocks projax phase 6" tag; m can dispatch fast-track |
+| 47-item migration script silently drops fields | low | smoke check (item count parity) + spot-check 5 items post-migration before slice C |
+| Slug collision on multi-rooted items (e.g. two `paliad`s) | medium | pre-migration script: detect collisions, dedupe to one node with multiple `child_of` edges, log skips |
+| mai.projects trigger pair breaks mid-migration | medium | turn off the triggers before migration, rebuild post-migration (Q2 (b) bridge takes over) |
+| Adapter introduces N+1 mBrian calls during render | medium | one ListAll + one LinksByRef query per request, cached per-request; profile after slice C |
+| Phase 5j views surface breaks | low | views stay projax-resident per inventor pick on Q5; no migration cost |
+| flexsiebels.de public-listing renderer breaks | medium | metadata.projax.public.* bundle preserves the shape; spot-test before slice E |
+| Cross-repo coordination delay | medium | filed as Gitea issue (durable) + delegation (real-time signal); both paths active |
+
+---
+
+## §12 — Test plan headlines
+
+### Slice B (migration script)
+- `TestMigrateScriptSmokes` — 5 hand-crafted projax.items + 3 item_links → mBrian nodes + edges; count parity assertion.
+- `TestMigrateScriptIdempotent` — second run = no new nodes.
+- `TestMigrateScriptSlugCollision` — two multi-rooted items same slug → one node with two `child_of` edges, log entry.
+
+### Slice C (read-path)
+- `TestAdapterListAllReturnsItemsFromMBrian` — seed mBrian nodes with `projax_origin`, ListAll returns matching Items.
+- `TestAdapterGetByPathResolvesEdges` — `dev.paliad` walks `child_of` edges to leaf node.
+- `TestAdapterPathsArrayMultiRoot` — node with two `child_of` edges produces 2 entries in `it.Paths`.
+
+### Slice D (write-path)
+- `TestHandleDetailWriteUpdatesMBrian` — POST /i/dev.paliad updates the mBrian node's title.
+- `TestHandleReparentRewritesChildOf` — POST /i/dev.paliad/reparent deletes old edge + creates new one.
+- `TestSlugCollisionRejected` — second create with same slug rejected with KindSlugCollision.
+
+### Slice E (drop)
+- migration `0018_drop_projax_items.sql` smoke test: `\dt projax.*` returns only `projax.views` + `projax.schema_migrations`.
+
+### Slice F (integrations)
+- per Q2 answer — bridge-worker test (Option b) OR mai-FK migration test (Option c).
+
+---
+
+## §13 — References
+
+- `~/dev/mBrian/db/001_initial_schema.sql` — mBrian schema baseline.
+- `~/dev/mBrian/docs/schema.md` — schema doc.
+- `~/dev/mBrian/CLAUDE.md` — mBrian conventions + relation to flexsiebels.
+- `projax/store/store.go` — current Item struct + projax store API.
+- `projax/store/views.go` — Phase 5j views table.
+- `projax/docs/design.md` — current PRD.
+- `projax/docs/plans/views-redesign.md` — Phase 5j design.
+- `m/projax` issue #5 — m's Option A pick.
+
+---
+
+## §14 — Status
+
+- **Phase A (this doc)**: drafted by kahn 2026-05-29, re-baselined same day against live mBrian schema after m's 11 answers landed. All §10 questions resolved.
+- **m/mBrian Gitea issue**: body drafted; head files it under "blocks projax phase 6" tag.
+- **Phase B (projax-side coder)**: blocked on (1) slice 0 snapshot helper ships + (2) mBrian-side migration runs + signals back. NO coder flip yet.
+- **Slice 0 (projax-side snapshot helper)**: scoped, not yet built. Smallest first-step on projax-side; ready when head greenlights.
+- **No code changes** in this branch beyond this doc.

docs/plans/slice-b-adapter-contract.md

@@ -0,0 +1,228 @@
+# Phase 6 Slice B — read-path adapter contract
+
+**Status**: prep work (this doc). No implementation.
+**Branch**: `mai/kahn/phase-6-sliceB-prep`.
+**Author**: kahn (coder, prep mode), 2026-05-29.
+**Parent plan**: `docs/plans/mbrian-backend-migration.md` (on `main`).
+**Scope boundary**: contract + compile-checking skeleton only. The mBrian-backed implementation waits on m/mBrian#73 landing the migration + handing over the uuid map.
+
+---
+
+## §1 — Consumer inventory
+
+Every read-path call site against `*store.Store` and the projax-shaped `Item` / `ItemLink` types. The interface (§2) is the union of these.
+
+### §1.1 — `*store.Store` read methods (source: `store/store.go`)
+
+| method | signature | semantics |
+|---|---|---|
+| `ListAll` | `(ctx) ([]*Item, error)` | every live item, ordered by `paths NULLS FIRST, slug` |
+| `GetByID` | `(ctx, id) (*Item, error)` | single item by uuid |
+| `GetByPath` | `(ctx, path) (*Item, error)` | resolve `dev.paliad` style path to leaf item |
+| `GetByPathOrSlug` | `(ctx, key) (*Item, error)` | path first, fall back to bare slug |
+| `Roots` | `(ctx) ([]*Item, error)` | items with `cardinality(parent_ids) = 0` |
+| `MaiOrphans` | `(ctx) ([]*Item, error)` | mai-managed root items needing classify |
+| `ListByFilters` | `(ctx, SearchFilters) ([]*Item, error)` | structured search (status / mgmt / has-link / paths-prefix) |
+| `Search` | `(ctx, q, limit) ([]*Item, error)` | trigram + FTS title/content/aliases |
+| `AllTags` | `(ctx) ([]string, error)` | union of every item's tags |
+| `LinksByType` | `(ctx, itemID, refType) ([]*ItemLink, error)` | one item's links of a given `ref_type` (empty = all) |
+| `LinksByRefType` | `(ctx, refType) ([]*ItemLink, error)` | every link of a given ref_type across items |
+| `DatedLinks` | `(ctx, itemID) ([]*ItemLink, error)` | one item's links anchored to a date (PER artifacts) |
+| `DatedLinksRange` | `(ctx, from, to) ([]*ItemLinkWithItem, error)` | dated links within window, joined with their item |
+| `RecentDocuments` | `(ctx, since, limit) ([]*ItemLinkWithItem, error)` | recent dated docs, joined with their item |
+| `ItemsCreatedInRange` | `(ctx, from, to) ([]*Item, error)` | items created within window |
+
+### §1.2 — Consumer call sites (by file)
+
+Each row = one read-path call site. Direct Pool access (admin.go counts, bulk.go filter-tx, links.go event-date update) is flagged separately at the bottom — those rework targets are out of slice B's read-path scope.
+
+| consumer | method | use case |
+|---|---|---|
+| `web/server.go handleTree` | `ListAll`, `AllTags`, `linkKindsByItem` (LinksByRefType ×N) | render /views/tree with chip-counted forest |
+| `web/server.go handleDetail` | `GetByPath` ×2 (PER fallback), `LinksByType` (caldav), `DatedLinks` | render /i/{path} detail page |
+| `web/server.go parentOptions` | `ListAll` | populate parent <select> on /new + /reparent |
+| `web/server.go handleClassify` | `MaiOrphans`, `parentOptions` | render /admin/classify |
+| `web/dashboard.go handleDashboard` | `ListAll`, `LinksByRefType` (caldav), `LinksByType` (gitea) ×N, `RecentDocuments` | Tiles + tasks + events + docs cards |
+| `web/calendar.go handleCalendar` | `ListAll` | month grid scope |
+| `web/timeline.go handleTimeline` + `buildTimeline` | `ListAll`, `linkKindsByItem` | chronological spine |
+| `web/graph.go handleGraph` | `ListAll`, `AllTags` | DAG SVG render |
+| `web/bulk.go handleBulk` | `ListAll`, `AllTags`, `GetByID` | /admin/bulk filtered checklist |
+| `web/caldav.go` (admin + create/unlink) | `ListAll`, `LinksByRefType`, `LinksByType`, `GetByPath` | /admin/caldav surface |
+| `web/gitea.go detailIssues` | `LinksByType` (gitea-repo) | /i/{path} issues card |
+| `web/gitea_writeback.go` | `GetByPath`, `LinksByType` | issue close/comment/create handlers |
+| `web/links.go` (add/remove/list) | `GetByPath`, `DatedLinks` | /i/{path} documents section |
+| `web/dashboard_pin.go` | `SetPinned` — WRITE, not slice B | pin toggle (slice C) |
+| `web/views.go handleViewRender` | `ListAll`, `AllTags`, `linkKindsByItem` | /views/{slug} render (5j) |
+| `web/system_views.go legacyRedirect` | `GetViewByID` — views CRUD (NOT in scope) | legacy 5i uuid → 5j slug redirect |
+| `internal/aggregate aggregator.go` | takes `LinkLister` interface (LinksByType + ItemsCreatedInRange) | shared fan-out across tasks/events/issues/docs |
+| `mcp/tools.go` (read tools) | `ListByFilters`, `LinksByRefType`, `GetByID`, `GetByPathOrSlug`, `LinksByType`, `ListAll`, `Search`, `RecentDocuments` (via dashboard fan-out reuse) | every read-side MCP tool |
+
+### §1.3 — Direct Pool access (out-of-scope for slice B, flagged for slice C)
+
+These bypass the store API and pull `*pgxpool.Pool` directly. Slice C (write-path) reworks them; flagging here so slice B's interface stays minimal:
+
+- `web/admin.go` — three count queries (`SELECT count(*) FROM projax.items WHERE …`) for the admin index. Either: (a) add `Counts(ctx) (AdminCounts, error)` to the adapter, (b) compute in-handler from `ListAll`. Adapter pick.
+- `web/bulk.go handleBulkApply` — multi-row UPDATE inside a tx. Pure write; slice C.
+- `web/links.go handleSetEventDate` — single UPDATE on `item_links.event_date`. Pure write; slice C.
+
+### §1.4 — `*Item` + `*ItemLink` shape contract (consumer side)
+
+Adapter MUST return these exact field sets in the result types. Nothing under `metadata.projax.*` in mBrian leaks to consumers; the adapter parses + materialises into the `Item` fields below.
+
+| field | semantics in slice B adapter |
+|---|---|
+| `Item.ID` | mBrian node uuid (post-migration); preserved old uuid OK per Q11 |
+| `Item.Kind` | `[]string{"project", ...}` — mBrian `node.type[]` 1:1 |
+| `Item.Title`, `Item.Slug`, `Item.ContentMD`, `Item.Aliases` | mBrian `node.title/slug/content_md/aliases` 1:1 |
+| `Item.Paths` | **derived** from `child_of` edge walk + the node's own slug. Adapter computes per-call (cached per-request) |
+| `Item.ParentIDs` | **derived** from outbound `child_of` edges |
+| `Item.Metadata` | `node.metadata` MINUS the `projax` sub-key (which gets unpacked into the struct fields below) |
+| `Item.Status` | `node.metadata.projax.status` (default "active") |
+| `Item.Pinned`, `Item.Archived` | `node.pinned`, `node.archived` 1:1 |
+| `Item.StartTime`, `Item.EndTime` | `node.metadata.projax.start_time` / `.end_time` (timestamptz strings) |
+| `Item.Tags`, `Item.Management`, `Item.TimelineExclude` | `node.metadata.projax.tags` / `.management` / `.timeline_exclude` |
+| `Item.Public`, `Item.PublicDescription`, `Item.PublicLiveURL`, `Item.PublicSourceURL`, `Item.PublicScreenshots` | `node.metadata.projax.public.{enabled, description, live_url, source_url, screenshots}` |
+| `Item.CreatedAt`, `Item.UpdatedAt` | `node.created_at`, `node.updated_at` 1:1 |
+| `Item.Source` | always `"projax"` (legacy field; new adapter sets this to maintain consumer assumption) |
+| `Item.SourceRefID` | mai.projects.id from `projax-mai-project` edge metadata when present |
+| `ItemLink.ID` | mBrian edge uuid |
+| `ItemLink.ItemID` | edge `source_id` (the projax-side end) |
+| `ItemLink.RefType` | strip `projax-` prefix from edge `rel` (`projax-caldav-list` → `caldav-list`) |
+| `ItemLink.RefID` | edge `metadata.ref_id` OR derived from rel-specific payload (caldav: `url`; gitea-repo: `owner/repo`; mai-project: `mai_project_id`) — see §3 gaps |
+| `ItemLink.Rel` | edge `note` (free-form annotation) OR a constant per rel-type (e.g. `'contains'`) |
+| `ItemLink.Metadata` | edge `metadata` MINUS the `ref_id` extraction |
+| `ItemLink.EventDate` | edge `metadata.event_date` (date string parsed) |
+| `ItemLink.CreatedAt` | edge `created_at` 1:1 |
+
+### §1.5 — Views (Phase 5j) — explicitly NOT in slice B
+
+Per m's Q5=(a), `projax.views` stays projax-resident. All view CRUD methods (`ListViews`, `GetView`, `GetViewByID`, `CreateView`, `UpdateView`, `DeleteView`, `TouchView`, `MostRecentView`, `ReorderViews`) stay on the existing `*Store` and are NOT part of the adapter interface. The `Server` struct uses the adapter for items+links and the existing `Store` for views.
+
+---
+
+## §2 — Adapter interface contract
+
+Defined in `store/adapter.go` (this branch). Pure projax-shaped structs in/out; zero mBrian type leakage. The existing `*store.Store` already satisfies this interface (it's just a subset of its public surface) — the compile-time assertion makes that explicit. Slice B impl ships a second satisfier (`*MBrianReader`) that wraps mBrian access.
+
+```go
+// ItemReader is the read-only contract every projax UI handler / aggregator /
+// MCP read tool depends on. Slice B implements a second satisfier on top of
+// mBrian's MCP/SQL surface.
+type ItemReader interface {
+    // Item lookups
+    ListAll(ctx context.Context) ([]*Item, error)
+    GetByID(ctx context.Context, id string) (*Item, error)
+    GetByPath(ctx context.Context, path string) (*Item, error)
+    GetByPathOrSlug(ctx context.Context, key string) (*Item, error)
+    Roots(ctx context.Context) ([]*Item, error)
+    MaiOrphans(ctx context.Context) ([]*Item, error)
+    ListByFilters(ctx context.Context, f SearchFilters) ([]*Item, error)
+    Search(ctx context.Context, q string, limit int) ([]*Item, error)
+    ItemsCreatedInRange(ctx context.Context, from, to time.Time) ([]*Item, error)
+    AllTags(ctx context.Context) ([]string, error)
+
+    // Link lookups
+    LinksByType(ctx context.Context, itemID, refType string) ([]*ItemLink, error)
+    LinksByRefType(ctx context.Context, refType string) ([]*ItemLink, error)
+    DatedLinks(ctx context.Context, itemID string) ([]*ItemLink, error)
+    DatedLinksRange(ctx context.Context, from, to time.Time) ([]*ItemLinkWithItem, error)
+    RecentDocuments(ctx context.Context, since time.Time, limit int) ([]*ItemLinkWithItem, error)
+}
+```
+
+### §2.1 — Methods needing edge-walk-derived data
+
+Slice B's mBrian impl must compute these from `child_of` edges + node fields. Cost is one outbound-edges fetch per node OR one bulk edges-by-rel query per request, depending on how the adapter caches.
+
+- `Item.Paths` — every method returning `*Item` or `[]*Item`.
+- `Item.ParentIDs` — same.
+- `GetByPath` — walks edges to resolve `dev.paliad` to a leaf node.
+- `Roots` — filter where no outbound `child_of` edge.
+- `MaiOrphans` — `Roots` ∩ `metadata.projax.management ⊇ {'mai'}`.
+
+### §2.2 — Methods needing metadata-unpack
+
+Adapter parses `metadata.projax.*` on read; writes (slice C) re-serialise. Affected fields: Status, Tags, Management, TimelineExclude, Public + 4 public_* fields, StartTime, EndTime.
+
+### §2.3 — Methods needing edge.metadata filters
+
+- `LinksByType(itemID, refType)`: WHERE source_id=$1 AND rel = 'projax-' || $2.
+- `LinksByRefType(refType)`: WHERE rel = 'projax-' || $1.
+- `DatedLinks(itemID)`: source_id=$1 AND metadata ? 'event_date'.
+- `DatedLinksRange(from, to)`: metadata->>'event_date' BETWEEN $1 AND $2.
+- `RecentDocuments(since, limit)`: dated links since $1 ORDER BY metadata->>'event_date' DESC LIMIT $2.
+
+mBrian's `idx_edges_metadata` GIN index already exists (mig 010); these queries are index-eligible.
+
+---
+
+## §3 — Gap flags
+
+Items the known mBrian schema needs to satisfy cleanly. The migration script handles most; flag here for the slice-B impl + the migration worker as cross-check items.
+
+| gap | shape | status |
+|---|---|---|
+| **`item_links.rel` (free-form annotation) preservation** | projax has both a typed `ref_type` AND a free-form `rel` text (`"contains"`, `"source"`, etc.) on item_links. mBrian's edge `rel` is the typed name; the free-form annotation maps to `edge.note`. Migration must NOT drop the projax `rel` value. | Add to m/mBrian#73 §1 edge mapping: source `rel` → mBrian `edges.note`. |
+| **`ItemLink.RefID` semantics per type** | projax `ref_id` is a typed external pointer (caldav url, gitea `owner/repo`, gitea-issue id, mai project uuid, bare url). mBrian edges carry the payload in metadata. Need a per-rel-type extraction rule. Suggested: `metadata.ref_id` for the canonical reference + leaves structured payload alongside (`url` for caldav, `owner`/`repo` for gitea). | Slice B impl reads back per-rel-type; document in m/mBrian#73 issue for the migration script to write consistently. |
+| **`paths text[]` recomputation cost** | Adapter computes paths from `child_of` edge walk per call. For `ListAll` over ~65 items, one bulk edges-by-rel query joined with the node id set is N rows where N = total `child_of` edges. Cheap at m's scale; add per-request memoisation. | Slice B impl. No mBrian-side action. |
+| **`AllTags` aggregation** | Union of `metadata.projax.tags[]` across all projax-managed nodes. No mBrian index on metadata-array-element. At m's scale (<200 nodes), full-scan is fine; if we grow, add a derived `[tag]` node graph (m's Q8 deferred to Phase 7). | Slice B impl, no mBrian-side action. |
+| **`Roots` / `MaiOrphans` predicate** | "No outbound `child_of` edge" requires a subquery / left-join-where-null pattern. Index-eligible via `idx_edges_source_rel` on `(source_id, rel)`. | Slice B impl. |
+| **`ItemsCreatedInRange`** | Direct over `nodes.created_at`; trivial. Scoped to `metadata.projax_origin IS NOT NULL` so non-projax mBrian nodes don't leak into projax surfaces. | Slice B impl + a `metadata GIN` query (already indexed). |
+| **`Item.Source` field expectation** | The legacy `Source` field on `Item` reads `"projax"` everywhere consumers check it (some MCP tools branch on it). Adapter sets a constant. | Slice B impl detail, no DB action. |
+| **`SourceRefID` for mai bridge** | When a node has a `projax-mai-project` edge, expose its `metadata.mai_project_id` as `Item.SourceRefID`. Slice D (mai bridge worker) writes these edges. | Slice B impl reads existing edges; slice D writes new ones. |
+| **`ItemLinkWithItem` join shape** | Used by `DatedLinksRange` and `RecentDocuments`. Adapter does two queries (edges-with-dates + node-by-id batch) + an in-memory join, OR one combined MCP call if mBrian exposes a bulk-edges-with-source-node helper. Both work; pick by perf. | Slice B impl, no mBrian-side change required. |
+| **Admin counts (web/admin.go direct Pool)** | Three count(*) queries (total items, total mai-managed, total public). Adapter gains `Counts(ctx) (AdminCounts, error)` — small extension. | Add to ItemReader interface in slice B (low-risk; constant-return until impl) OR keep as a separate `AdminReader` interface. Recommend adding to ItemReader for cohesion. |
+
+---
+
+## §4 — Skeleton (this branch)
+
+The Go file `store/adapter.go` ships in this branch with:
+
+1. `ItemReader` interface as in §2.
+2. `var _ ItemReader = (*Store)(nil)` compile-time assertion. (Drops in cleanly because `*Store` already exposes every method in the contract.)
+3. `MBrianReader` struct with stubbed method bodies that return `errNotImplementedSliceB`. Each stub carries a one-line comment naming the §3 gap it depends on (if any) so slice B's impl-fill knows what to look up.
+4. `var _ ItemReader = (*MBrianReader)(nil)` compile-time assertion so the stubs stay aligned with the interface.
+
+`go build ./...` is green with the skeleton in place. No tests, no behaviour, no mBrian client dependency.
+
+The actual mBrian client wiring (whether MCP-over-stdio, direct Postgres against `mbrian.*` schema, or the in-process submodule pattern flexsiebels uses) is the first decision slice-B-impl makes; it stays out of this prep step.
+
+---
+
+## §5 — Wiring shape after slice B impl
+
+For reference of the post-slice-B shape (no code in this slice):
+
+```go
+// Server struct keeps two readers: ItemReader (slice-B mBrian-backed) +
+// existing *Store (views CRUD only).
+type Server struct {
+    Items   ItemReader     // slice B: MBrianReader; today: *Store
+    Store   *store.Store   // views CRUD only after slice B
+    // ... rest unchanged
+}
+```
+
+Every handler that today reads `s.Store.ListAll(...)` becomes `s.Items.ListAll(...)`. Mechanical rename. Slice B impl ships both — adapter wiring + the rename across handlers — as one diff once the migration completes.
+
+---
+
+## §6 — What's NOT in this prep
+
+- mBrian-MCP client wiring.
+- Any test of mBrian-backed behaviour.
+- Write-path methods (slice C scope).
+- View CRUD migration (Q5=(a) stays projax-resident).
+- mai bridge worker (slice D).
+- Drop projax tables (slice E).
+
+---
+
+## §7 — References
+
+- `docs/plans/mbrian-backend-migration.md` (on `main`) — parent plan.
+- `cmd/projax-snapshot/` (slice 0, merged at `38182df`) — input for mBrian's migration.
+- m/mBrian#73 — mBrian-side schema convention node + migration script (in flight).
+- `store/store.go` — current `*Store` implementation; the interface `*Store` already satisfies.
+- `internal/aggregate/aggregator.go` — existing `LinkLister` interface precedent (a narrow projection of `*Store`).

docs/plans/slice-b-views-projectid-gap.md

@@ -0,0 +1,103 @@
+# Slice B gap — `projax.views.filter_json.project_id` uuid-map
+
+**Status**: gap flagged + tooling shipped. Must run remap BEFORE Slice E
+drops `projax.items`.
+**Branch**: `mai/kahn/phase-6-sliceB`.
+**Author**: kahn (coder), 2026-05-31.
+**Parent**: `docs/plans/mbrian-backend-migration.md` (§7 lossy bits).
+
+## The gap
+
+Phase 5j saved views (`projax.views.filter_json`) carry `project_id` set
+to the **OLD** `projax.items.id` uuid. After Slice B's read path flips
+to mBrian, those uuids no longer resolve — a saved view scoped to
+`dev.paliad` references an id that mBrian's `paliad` node doesn't have
+(the migration script issued a fresh uuid + recorded the old id under
+`metadata.projax_origin` per m's Q11).
+
+Symptoms once `PROJAX_BACKEND=mbrian` rolls in production:
+- Opening `/views/{slug}` for any saved view that carries
+  `filter_json.project_id` returns the unfiltered set (the scope filter
+  silently no-ops).
+- The chip rendering still labels the view "scoped to dev.paliad"
+  because the cached `project_path` is unaffected — the discrepancy
+  surfaces as "label says scope, content doesn't filter."
+
+This must be fixed before Slice E drops `projax.items` or the old-id
+provenance disappears.
+
+## Two viable remediations
+
+### (a) One-shot uuid remap via the migration audit map
+
+mBrian dropped the `{old_projax_uuid → new_mbrian_uuid}` map at a shared
+mRiver path (head will relay). One-time SQL:
+
+```sql
+UPDATE projax.views
+SET filter_json = jsonb_set(
+    filter_json,
+    '{project_id}',
+    to_jsonb(<new>::text)
+)
+WHERE filter_json->>'project_id' = '<old>';
+```
+
+…iterated across the map. Pure data fix, no schema change. Idempotent
+(re-running against an already-remapped row is a no-op because the old
+uuid no longer matches).
+
+### (b) Resolve by slug instead of id
+
+Change the views resolver to look up `metadata.projax_origin = <id>`
+when the new uuid doesn't resolve, OR store the slug in
+`filter_json.project_path` (already present) as the canonical pointer.
+Heavier change in the views read path; ships in a future slice.
+
+## Recommended path
+
+**Hybrid**: (a) for the existing rows now (idempotent, surgical), and
+flag (b) as a follow-up in slice C/D for new view writes (use slug
+instead of uuid in the editor — the slug is the durable name post-
+migration anyway).
+
+## Tool shipped this slice
+
+`cmd/projax-remap-views/main.go` (this commit). Usage:
+
+```
+projax-remap-views --map /path/to/uuid-map.json
+```
+
+Map shape:
+```json
+{
+  "old-projax-uuid-1": "new-mbrian-uuid-1",
+  "old-projax-uuid-2": "new-mbrian-uuid-2",
+  ...
+}
+```
+
+The tool:
+- Loads the uuid map from JSON.
+- Walks every live `projax.views` row.
+- For each row with `filter_json.project_id` matching a map key,
+  rewrites it to the new uuid.
+- Prints a per-row before/after summary; commit only happens on
+  `--apply`. Default is dry-run.
+
+Idempotent on re-run: rows already pointing at a new uuid don't match
+any map key on the second pass, so they pass through untouched.
+
+## When to run
+
+After the mBrian migration completes (already shipped) + after head
+relays the uuid-map path. Before any user is on
+`PROJAX_BACKEND=mbrian`. The tool runs against msupabase using the same
+`SUPABASE_DATABASE_URL` the projax binary uses.
+
+## Validation
+
+Post-remap: pick the spot-check saved views (if any exist), open them
+through both `PROJAX_BACKEND=store` and `PROJAX_BACKEND=mbrian`, confirm
+the filtered set matches.

docs/plans/views-redesign.md

@@ -0,0 +1,496 @@
+# Views redesign — paliad-shape first-class views (Phase 5j)
+
+**Status**: Phase A design (this doc).
+**Branch**: `mai/kahn/phase-5j-views-redesign`.
+**Author**: kahn (inventor), 2026-05-26.
+**Source feedback** (m, 13:19 2026-05-26): *"It's not really what I wanted. It should like the paliad custom views, not of the existing views a variant but individually created views."*
+
+**Replaces**: Phase 5i. Hours-old, no real data, drop-and-rebuild is the cleanest path.
+
+---
+
+## §1 — Diagnosis: why 5i diverged from intent
+
+5i modelled views as an **overlay** on top of existing pages. The contract was:
+
+> User opens `/?view=<uuid>` → the saved filter+view_type fields onto whatever the existing tree handler renders.
+
+That choice flowed from m's original phrasing: "view types (card / list / calendar / kanban)" — which sounded like skin-on-top-of-pages. Implementation followed: TreeFilter grew a `ViewID`, an `applySavedView` overlay landed in the tree handler, the sidebar `Views` entry pointed to `/views` as a list-management page, and saved views had no URL of their own.
+
+m's **actual** mental model, anchored in paliad: a view IS a page. The slug goes in the URL. System defaults (dashboard, calendar, timeline, ...) and user-created views share the same `/views/{slug}` route shape. Nothing is "an overlay" — views are first-class destinations, indexed in the sidebar, with their own editor.
+
+The fix: tear out the 5i overlay code and rebuild around the paliad model. This redesign mirrors paliad's structure but adapts to projax's constraints (single-user, no auth.uid(), no RLS, existing route surface).
+
+---
+
+## §2 — paliad-shape data model for projax
+
+### Schema (migration `0017_views_redesign.sql`)
+
+**Recommendation: hard-replace.** Drop `projax.views` (created hours ago in 5i Slice D), recreate fresh. No real user data lost — at most a couple of throwaway saved-view rows from m's testing.
+
+```sql
+DROP TABLE IF EXISTS projax.views CASCADE;
+
+CREATE TABLE projax.views (
+  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  slug          text NOT NULL,
+  name          text NOT NULL,
+  icon          text,                              -- nullable; matches frontend icon registry
+  filter_json   jsonb NOT NULL DEFAULT '{}'::jsonb,
+  view_type     text NOT NULL,                     -- card | list | calendar | kanban | timeline
+  sort_field    text,
+  sort_dir      text,
+  group_by      text,
+  sort_order    integer NOT NULL DEFAULT 0,
+  show_count    boolean NOT NULL DEFAULT false,
+  last_used_at  timestamptz,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  updated_at    timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT views_view_type_chk
+    CHECK (view_type IN ('card','list','calendar','kanban','timeline')),
+  CONSTRAINT views_sort_dir_chk
+    CHECK (sort_dir IS NULL OR sort_dir IN ('asc','desc')),
+  CONSTRAINT views_kanban_needs_group
+    CHECK (view_type <> 'kanban' OR group_by IS NOT NULL),
+  CONSTRAINT views_slug_format_chk
+    CHECK (slug ~ '^[a-z0-9][a-z0-9-]{0,62}$')
+);
+
+CREATE UNIQUE INDEX views_slug_uniq ON projax.views (slug);
+CREATE INDEX views_sort_order_idx ON projax.views (sort_order, name);
+
+-- updated_at trigger reused from 0016 (kept under a new name or recreated).
+CREATE OR REPLACE FUNCTION projax.views_touch_updated_at()
+  RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  NEW.updated_at := now();
+  RETURN NEW;
+END;
+$$;
+DROP TRIGGER IF EXISTS views_touch_updated_at ON projax.views;
+CREATE TRIGGER views_touch_updated_at
+  BEFORE UPDATE ON projax.views
+  FOR EACH ROW EXECUTE FUNCTION projax.views_touch_updated_at();
+```
+
+### Key shifts from 5i
+
+| field | 5i | 5j | reason |
+|---|---|---|---|
+| primary key | uuid only | uuid; **slug is the URL key** | paliad parity — URLs use slugs, not uuids |
+| slug | absent | required, unique, regex-validated | URL routability |
+| icon | absent | nullable text | sidebar icon picker |
+| sort_order | absent | server-assigned MAX+1 | drag-reorder; paliad parity |
+| show_count | absent | bool, opt-in | sidebar row-count badge; opt-in cost |
+| last_used_at | absent | nullable timestamptz | `/views` landing MRU redirect |
+| pinned | bool | **dropped** | `sort_order` subsumes the use case |
+| is_default_for | text page | **dropped** | per-page-default model gone; MRU replaces it |
+
+### `filter_json` shape
+
+Unchanged from 5i (the JSON shape stayed correct). Keys mirror TreeFilter dims: `q`, `tags[]`, `management[]`, `status[]`, `has_links[]`, `public`, `show_archived`, `project_path`, `include_descendants`. The shape is forward-compatible; new TreeFilter dimensions land without migrations.
+
+`view_type` stays a top-level column (not inside `filter_json`) because the editor + sidebar both read it without needing to parse JSON.
+
+### Single-user simplifications vs paliad
+
+- **No `user_id` column** — projax is Tailscale-only single-user.
+- **No RLS** — same reason.
+- **`UNIQUE (slug)` is global**, not per-user.
+
+If multi-user ever lands, the column + index gain a `user_id` prefix; the rest of the design holds.
+
+---
+
+## §3 — Reserved slugs (system views)
+
+The big call: **do existing pages become system views, or do they stay distinct routes?**
+
+### Three options
+
+**(a) Keep current routes; add /views/{slug} for user views only.**
+- `/`, `/dashboard`, `/calendar`, `/timeline`, `/graph` stay exactly as today.
+- `/views/{slug}` is exclusively for user-created views.
+- Reserved-slug list is just `{new, edit}` (the literal route segments) + any future top-level URL we'd not want a user view to shadow.
+- **Cost**: nothing changes for muscle memory. User views are an additive concept beside existing pages.
+- **Drawback**: the conceptual asymmetry m flagged stays — system pages live at `/`/`/dashboard`, user views live at `/views/{slug}`. Two URL families.
+
+**(b) Full migration. Existing pages become system views at `/views/{slug}`.**
+- New URLs: `/views/tree`, `/views/dashboard`, `/views/calendar`, `/views/timeline`, `/views/graph` (or drop graph from the unified shape — see §3.1).
+- Legacy `/`, `/dashboard`, etc. become 301 redirects to their `/views/{slug}` counterpart.
+- Reserved slugs: `{tree, dashboard, calendar, timeline, graph, new, edit, admin, login, logout, healthz, mcp, static, i, views}` — everything projax owns at the top level.
+- **Cost**: every internal link in templates needs updating; bookmarks 301 (fine); browser muscle memory absorbs after one shift.
+- **Benefit**: one URL family. The "create a new view" mental model is uniform with how system pages live.
+
+**(c) Hybrid. Legacy routes stay; `/views/{slug}` aliases system pages and hosts user views.**
+- `/` keeps serving the tree; **also** `/views/tree` resolves to the same handler.
+- `/dashboard` keeps; also `/views/dashboard`. Etc.
+- Reserved slugs match (b) for the same coverage.
+- User views land at `/views/{their-slug}` alongside system slugs in one URL family.
+- **Cost**: small — system-view handlers register two route entries instead of one. No redirects to maintain.
+- **Benefit**: muscle memory + bookmark stability AND first-class /views/{slug} URL family. Two paths to the same render; user picks whichever they remember. If `/views/{slug}` catches on, a future shift can deprecate the legacy URLs cleanly.
+
+### Inventor pick: (c) hybrid
+
+**Reasoning**: m's bug report explicitly said "individually created views" — the gap was user-view first-classness, not legacy-URL banishment. (c) closes the gap with zero migration cost. (b) is cleaner architecturally but introduces avoidable churn; the upside (one URL family) doesn't outweigh the risk of breaking some link or muscle-memory in m's daily flow. (a) leaves the two-families asymmetry m's feedback was pointing at.
+
+This is **Q1 in §9** — head should ratify or override before coder.
+
+### §3.1 — Graph as a system view?
+
+Graph is the DAG SVG render. It's NOT in the view_type enum (per 5i design, intentionally — graph is its own visualization, not a "list of items rendered as X"). Recommend: keep `/graph` and `/views/graph` (under (c)) but **graph is not a user-creatable view_type** — the create form omits it. Reserved slug `graph` blocks user views from clobbering it.
+
+### Reserved-slug list (combining (c) + projax's existing top-level routes)
+
+```go
+var reservedViewSlugs = []string{
+    // System pages (also reachable via /views/<slug> as aliases under (c)):
+    "tree", "dashboard", "calendar", "timeline", "graph",
+    // /views sub-routes:
+    "new", "edit",
+    // Top-level application URLs:
+    "admin", "login", "logout", "healthz", "mcp", "static", "i", "views",
+}
+```
+
+---
+
+## §4 — Routes
+
+For option (c). Under (b), drop the legacy entries; under (a), drop the `/views/{system-slug}` aliases.
+
+| route | handler | renders | semantics |
+|---|---|---|---|
+| `GET /views` | `handleViewsLanding` | 302 to MRU view, else onboarding shell | landing |
+| `GET /views/{slug}` | `handleViewRender` | view template per view_type | render saved or system view |
+| `GET /views/new` | `handleViewEditor` | editor blank | editor — new |
+| `GET /views/{slug}/edit` | `handleViewEditor` | editor pre-filled | editor — edit existing |
+| `POST /views` | `handleViewCreate` | redirect to `/views/{slug}` | create |
+| `POST /views/{slug}` | `handleViewUpdate` | redirect to `/views/{slug}` | update |
+| `POST /views/{slug}/delete` | `handleViewDelete` | redirect to `/views` | delete |
+| `POST /views/reorder` | `handleViewReorder` | 204 / HTMX OK | drag-reorder (slice G) |
+| `POST /views/{slug}/touch` | `handleViewTouch` | 204 fire-and-forget | bump last_used_at on render |
+
+The render path (`GET /views/{slug}`):
+1. Resolve slug. If a user view → load row. If a reserved system slug → load the corresponding code-resident `SystemView` struct.
+2. Touch `last_used_at` (user views only — system views don't track MRU per call).
+3. Dispatch to the view_type's renderer (the same per-view-type templates from 5i: `tree_card.tmpl`, `tree_kanban.tmpl`, `tree_section.tmpl` for list, plus the existing `calendar_section.tmpl` and `timeline_section.tmpl`).
+4. Apply chip-overlay semantics from the 5i fix — URL chips overlay the saved filter so chip clicks narrow within the view (the one piece of 5i worth keeping; see §7).
+
+Editor (`GET /views/new` and `GET /views/{slug}/edit`) is a dedicated full-page form, not a modal. Paliad shipped dedicated pages; projax inherits the same shape.
+
+---
+
+## §5 — Sidebar integration
+
+Replace the single "Views" sidebar entry (5i) with a "Views" section listing every user view. System views stay in the existing main-nav block at the top; they're already the muscle-memory entries (Tree, Dashboard, Calendar, Timeline, Graph).
+
+ASCII sketch (5g sidebar shape, with 5j additions):
+
+```
+[ sidebar ]
+─────────────
+  ⌂ Tree
+  □ Dashboard
+  ▣ Calendar
+  ⊿ Timeline
+  ⨀ Graph
+─────────────
+  Views                    ← new section header
+    📂 Active mai work     ← user view (icon + name)
+    ⏰ This week deadlines  ← row-count badge if show_count
+    ★ Patents kanban       ← drag-reorder handle on hover
+    + New view             ← /views/new
+─────────────
+  ⚙ Admin
+─────────────
+  ☾ Theme
+```
+
+The Views section's entries come from `ListViews()` ordered by `sort_order` ASC, then `name`. Each entry:
+- Icon resolved against a small frontend registry (the icon column is a key; the registry maps it to an SVG). Keys: `folder`, `clock`, `star`, `tag`, `file-text`, `box`, `inbox`, etc. Default key: `folder`.
+- Optional badge with row count when `show_count=true` — computed by running the view's filter against `ListAll()` (cheap; projax's scale is ~150 items max).
+- Active state when the current URL is `/views/{this-slug}` or a legacy alias resolving to it.
+
+Drag-reorder lands in a later slice (G). Click-to-open is the v1 interaction.
+
+Mobile bottom-nav drawer (5g slice B) gets the same section.
+
+---
+
+## §6 — Editor surface
+
+Single editor template (`templates/view_editor.tmpl`) reused for both `/views/new` and `/views/{slug}/edit`. Distinguishes via the presence of `.View` in the data map.
+
+Fields:
+- **Name** — text input, required, max 80 chars.
+- **Slug** — text input, regex `^[a-z0-9][a-z0-9-]{0,62}$`, **auto-derived** from name via HTMX on `change` against a `POST /views/derive-slug?name=<x>` helper endpoint OR on the client (simpler: derive on the server side in `handleViewCreate` if the field is empty; provide a "regenerate" link in edit mode). m can hand-edit.
+- **Icon** — `<select>` with the registered icon keys + a visible preview. Slice D ships the form field; the registry SVG additions can grow incrementally.
+- **View type** — radio group (5 values: card/list/calendar/kanban/timeline).
+- **Filter (chip strip)** — full TreeFilter chip strip inline in the editor: tag, mgmt, status, has, public, project picker + descendants toggle. Each chip click updates a hidden `filter_json` field via HTMX — so the editor's preview pane reflects the saved filter live.
+- **Sort field** — text input (`title` / `updated_at` / `start_time`).
+- **Sort dir** — `<select>` (asc/desc).
+- **Group by** — `<select>` (status/area/tag/management). Required when view_type=kanban.
+- **Show count** — checkbox.
+
+A small "Preview" pane next to the form shows the first N items the filter currently matches. Optional in slice D; can land in slice G if scope bites.
+
+Save → 302 to `/views/{slug}`. Cancel → `/views` (or the previous URL if HTMX-loaded).
+
+**Drops the HTMX modal** the 5i fix-shift added — dedicated pages are clearer for a page-level concept and match paliad's pattern.
+
+---
+
+## §7 — Migration from 5i overlay
+
+Specific deletions and salvages:
+
+### Code to delete
+| file | what to remove |
+|---|---|
+| `web/tree_filter.go` | `ViewID` field on TreeFilter; `ParseTreeFilter`/`QueryString` handling |
+| `web/views.go` | `applySavedView`, `applyDefaultView`, `overlayURLFields`, `filterQueryToJSON`/`filterJSONToQuery`, the `Prefill` index handler logic |
+| `web/server.go` | the `?view=<uuid>` overlay block in `handleTree`; the `DefaultBanner` data map field |
+| `web/templates/tree_section.tmpl` | the `default-banner` block; the `<input type="hidden" name="view">` |
+| `web/templates/views.tmpl` | full rewrite — it's the list-management surface, redesigned in §5 + §6 |
+| `web/templates/view_edit.tmpl` | full rewrite to the new editor shape |
+
+### Code to keep
+- `templates/tree_card.tmpl`, `templates/tree_kanban.tmpl` — these are per-view_type renderers, reusable.
+- `web/view_type.go` (the 5-value enum + `PageViewTypes` catalog) — still valid as the renderer dispatch table.
+- `web/kanban.go` (`BuildKanbanBoard`) — view_type=kanban consumer.
+- `templates/project_chip.tmpl` — the project filter chip strip works inside the editor.
+- The 5i chip-overlay-on-saved-view fix is the **one piece of substance** worth keeping conceptually: on `/views/{slug}`, URL chip params overlay the saved filter. The overlay function gets a new home (`handleViewRender`'s filter-resolution path) but the rule is the same.
+
+### Backwards compatibility for the old `?view=<uuid>` URL
+
+Two options:
+- (i) **404 on `?view=`** for existing pages — the URL never makes sense in the new model. Cost: any stale bookmark dies, but only m used it for hours.
+- (ii) **302-redirect `/<page>?view=<uuid>` to `/views/<slug>`** by looking up the slug from the uuid. Smoother for m's recent bookmarks. Cost: one extra DB hit on the redirect path; the redirect can target the slug or, if the uuid no longer resolves (because we hard-recreated the table), 302 to `/views`.
+
+Inventor pick: (ii) — small code, no broken bookmarks for the brief 5i window.
+
+### `is_default_for` semantics
+
+Drop entirely. The MRU mechanism (`last_used_at` → `/views` landing) replaces "what should I see on /views". Per-page defaults are gone; if m wants a specific view to be the landing experience, he opens it once and it becomes MRU.
+
+If m later wants a "this is my default" hint stronger than MRU (i.e., pinning), `sort_order=0` reserved for a pinned slot + an `is_pinned` flag is the natural extension. **Not in scope for v1.**
+
+---
+
+## §8 — Implementation slicing
+
+Seven slices; A → B → C → D → E are the critical path; F + G are polish.
+
+### Slice A — Schema redesign
+
+- Migration `0017_views_redesign.sql`: `DROP TABLE projax.views CASCADE; CREATE TABLE` with new shape. (See §2 schema.)
+- `store/views.go`: rewrite. Rename `View.ID` flow to be slug-driven; `GetView(slug)` instead of `GetView(uuid)`. Keep CRUD shape; add `Touch(slug)` for MRU; add `MostRecent()` returning the MRU view (or nil); add `Reorder([]string slugs)` for slice G.
+- Drop `DefaultViewFor` (no longer applicable).
+- Tests: round-trip CRUD by slug; reserved-slug rejection at the validator; slug-format regex enforcement; MRU.
+
+### Slice B — Route migration (paliad-shape)
+
+- Replace the 5i `/views/<uuid>` routes with the paliad-shape route table from §4.
+- `handleViewsLanding` → MRU redirect or onboarding shell.
+- `handleViewRender` → resolve slug (user view first, then system view), apply chip overlay, dispatch to the view_type's renderer.
+- `handleViewEditor` → dedicated form page (slug-driven).
+- `handleViewCreate` / `handleViewUpdate` / `handleViewDelete` → form POST handlers.
+- `handleViewTouch` → fire-and-forget MRU update.
+- Wire the legacy `?view=<uuid>` redirect (per §7-ii) on existing pages.
+- Tests: each route hit, slug routing, MRU redirect, onboarding shell on empty state, reserved-slug rejection.
+
+### Slice C — System views
+
+- New `web/system_views.go` with `SystemView` struct + `TreeSystemView()`, `DashboardSystemView()`, `CalendarSystemView()`, `TimelineSystemView()`, `AllSystemViews()`, `LookupSystemView(slug)`.
+- Each function returns the `(filter_json, view_type, group_by, sort)` tuple matching today's page.
+- `handleViewRender` falls back to `LookupSystemView` when the slug isn't in the DB.
+- Reserved-slug list (combining system slugs + route segments).
+- Under (c) hybrid: legacy routes `/`, `/dashboard`, `/calendar`, `/timeline` each gain a sibling registration so `/views/{system-slug}` resolves to the same handler. (Or: legacy routes 302 to `/views/{slug}` — simpler if m's fine with one canonical URL.)
+- Tests: system-view lookup, slug aliases hit the same template, reserved-slug rejection during user-view create.
+
+### Slice D — Editor surface
+
+- New `templates/view_editor.tmpl` — full form per §6.
+- Slug derivation helper (`POST /views/derive-slug` or server-side fill).
+- Icon picker (a `<select>` for v1 — frontend registry expansion is incremental).
+- Inline chip strip inside the form; HTMX updates a hidden `filter_json` on every chip click.
+- Tests: GET /views/new renders blank form; GET /views/{slug}/edit pre-fills; POST creates/updates round-trip.
+
+### Slice E — Sidebar integration
+
+- `templates/layout.tmpl`: insert a "Views" section between main nav and `/admin`.
+- Server-side: every page-render pulls `ListViews()` into the layout data map (cached lightly so each request doesn't hit the DB twice).
+- Active-state CSS + icon rendering.
+- Mobile drawer (5g slice B) gets the same section.
+- Tests: sidebar shows user views; clicking navigates to `/views/{slug}`; active state matches URL.
+
+### Slice F — Migration cleanup (delete 5i overlay)
+
+- Remove TreeFilter.ViewID.
+- Remove `applySavedView`, `applyDefaultView`, `overlayURLFields`, the default-view banner.
+- Remove the 5i `/views/<id>` redirect handler (slice B replaces it).
+- Tests adjusted: drop the `ViewID` round-trip test; drop `TestSavedViewAppliedOnQueryParam`, `TestDefaultViewAppliedOnCleanURL`, `TestViewEditFlow` — their slice-A successors cover the new shapes.
+
+### Slice G — Polish
+
+- Drag-reorder UI via HTMX `hx-post="/views/reorder"` with sortable.js or a tiny vanilla drag-handle (m's HTMX-only constraint allows minimal vendored JS if needed).
+- `show_count` badge wiring (run filter against `ListAll()`, render the count next to the sidebar entry).
+- Preview pane in the editor (optional).
+- Icon registry expansion (curated SVGs).
+
+Slices F and G are independent. The implementation chain is **A → B → C → D → E → (F either before or after E) → G**.
+
+---
+
+## §9 — Open questions for head delegation
+
+Inventor picks marked. Process: **NO direct chip-picker** without head's explicit grant for this round.
+
+### Q1 — System-view shape (§3)
+
+(a) Keep current routes only; user views beside them at `/views/{slug}` — current asymmetry stays.
+(b) Full migration; existing pages become system views, legacy URLs 301-redirect — paliad parity.
+(c) Hybrid; both URL families coexist, system slugs aliased — preserves muscle memory.
+
+**Inventor pick**: (c). Closes the asymmetry m flagged, zero migration cost. (b) is cleaner but risks broken bookmarks for thin upside.
+
+### Q2 — `view_type` field placement
+
+- (a) Top-level column (5j inventor pick — matches 5i, query-able without parsing JSON).
+- (b) Inside `filter_json`.
+
+**Inventor pick**: (a).
+
+### Q3 — Legacy `?view=<uuid>` URL handling (§7)
+
+- (a) 404 — clean break.
+- (b) 302-redirect to `/views/<slug>` by uuid lookup — smoother for m's recent bookmarks. Inventor pick.
+
+**Inventor pick**: (b).
+
+### Q4 — Editor surface (§6)
+
+- (a) Dedicated pages `/views/new` + `/views/{slug}/edit` — paliad parity, inventor pick.
+- (b) Keep the HTMX modal from the 5i fix — less navigation but harder to share/bookmark mid-edit.
+
+**Inventor pick**: (a).
+
+### Q5 — `/views` landing MRU redirect
+
+- (a) 302 to MRU saved view if any, else onboarding shell (paliad model, inventor pick).
+- (b) Always show the views index list page.
+
+**Inventor pick**: (a).
+
+### Q6 — Icon picker in v1?
+
+- (a) Yes — small select + 8-12 curated keys; rendered inline in the sidebar entries.
+- (b) v2 — ship without icons in v1; sidebar uses a generic folder glyph for every entry.
+
+**Inventor pick**: (a) — the schema column lands either way; UI cost for a `<select>` is trivial.
+
+### Q7 — Drag-reorder in v1?
+
+- (a) Yes (slice G in v1).
+- (b) v2 — `sort_order` column is server-assigned MAX+1 on create; reorder UI lands later.
+
+**Inventor pick**: (b). Don't expand v1 scope; reorder is a UX polish that can ship a week after.
+
+### Q8 — `show_count` badge in v1?
+
+- (a) Yes — opt-in checkbox in editor + sidebar badge.
+- (b) v2 — column lands in the schema; UI lands later.
+
+**Inventor pick**: (a) — checkbox in editor + 2-line render in sidebar is cheap and answers the "how many things match my view" question m asks naturally.
+
+### Q9 — Legacy `is_default_for` semantics (§7)
+
+Inventor picks **dropped entirely**, replaced by MRU. Flag if m wants pin / default semantics back.
+
+### Q10 — Drop and recreate `projax.views`?
+
+- (a) Hard-replace via `DROP TABLE ... CASCADE` — inventor pick (table is hours old, ~zero data loss).
+- (b) ALTER TABLE migration that adds new columns + drops old ones gracefully — more conservative; preserves any rows m has created.
+
+**Inventor pick**: (a). The shape change is large enough that a clean re-create is cleaner than a 6-step ALTER.
+
+### Q11 — `view_type=graph`?
+
+The graph DAG SVG render isn't in the view_type enum. Should:
+- (a) Stay outside the views system — `/graph` and `/views/graph` (system slug) both serve it, user views can't be `view_type=graph`. Inventor pick.
+- (b) Add `graph` as a sixth view_type — opens user-creatable graph views.
+
+**Inventor pick**: (a). Graph layout is single-purpose (DAG); a "graph of my filtered set" doesn't have a clear product story today.
+
+---
+
+## §10 — Risk register
+
+| risk | likelihood | mitigation |
+|---|---|---|
+| Slug collision on rename | medium | UNIQUE index + handler maps the unique-violation to a friendly "slug already in use" error |
+| URL drift (legacy bookmarks break) | low under (c), high under (b) | (c) keeps legacy URLs; (b) ships with 301 redirects + a session of m verifying his bookmarks |
+| MRU thrash on rapid view switches | low | `last_used_at` is fire-and-forget; the worst case is one stale 302 |
+| System-view + user-view slug collision | n/a | reserved-list rejection in validator (slice A) |
+| sidebar query cost | low | `ListViews()` is one indexed lookup per page render; cache lightly if it shows in profiling |
+| Editor's chip strip drifts from the page chip strip | medium | share the same template (project_chip.tmpl already shared); add a dedicated `view_filter_chips.tmpl` if drift bites |
+
+---
+
+## §11 — Test plan headlines
+
+### Slice A
+- `TestViewSlugCRUD` — create/get/update/delete by slug round-trip.
+- `TestViewSlugFormatRejected` — uppercase, underscore, leading-digit-allowed but no-leading-dash, length-cap 63.
+- `TestViewReservedSlugRejected` — create with slug `tree` / `dashboard` / `admin` / `new` etc. all 400.
+- `TestViewTouch` — Touch bumps `last_used_at`.
+- `TestViewMostRecent` — MRU returns most recently touched.
+
+### Slice B
+- `TestViewsLandingMRU` — `/views` 302s to MRU view when one exists.
+- `TestViewsLandingOnboarding` — `/views` renders shell when no views.
+- `TestViewRender` — `/views/{slug}` resolves a user view; renders the right view_type template.
+- `TestLegacyOverlayRedirect` — `/?view=<uuid>` 302s to `/views/{slug}`.
+
+### Slice C
+- `TestSystemViewLookup` — `tree` / `dashboard` / `calendar` / `timeline` / `graph` resolve via `LookupSystemView`.
+- `TestSystemViewSlugAlias` — `/views/dashboard` and `/dashboard` produce identical render output.
+
+### Slice D
+- `TestEditorBlank` — `/views/new` renders empty form.
+- `TestEditorPrefilled` — `/views/{slug}/edit` reflects every persisted field.
+- `TestSlugDerivation` — name "Active mai work" → slug "active-mai-work".
+
+### Slice E
+- `TestSidebarListsViews` — layout includes every user view.
+- `TestSidebarActiveState` — `/views/{slug}` marks that entry active.
+
+### Slice F
+- All 5i overlay tests deleted; no residue references TreeFilter.ViewID.
+
+### Slice G
+- `TestReorderUpdatesSortOrder` — POST `/views/reorder` with a sorted slug list updates the column.
+- `TestShowCountBadge` — sidebar badge reflects the filter's match count.
+
+---
+
+## §12 — References
+
+- `~/dev/paliad/internal/db/migrations/056_user_views.up.sql` — schema reference.
+- `~/dev/paliad/internal/services/user_view_service.go` — CRUD reference.
+- `~/dev/paliad/internal/services/system_views.go` — reserved-slug + system-view registration.
+- `~/dev/paliad/internal/handlers/views_pages.go` — route table.
+- `~/dev/paliad/frontend/src/{views,views-editor}.tsx` — editor + sidebar reference (UX only; not ported).
+- `docs/plans/views-system.md` (5i) — historical record of the wrong-shape implementation.
+- `docs/design.md` §4 (Interfaces).
+
+---
+
+## §13 — Status
+
+- **Phase A (this doc)**: drafted by kahn, 2026-05-26. Awaiting head delegation of §9 questions to m.
+- **No chip-picker for 5j** unless head explicitly re-grants per the project's escalation rule.
+- **Phase B (coder)**: blocked on m's sign-off via head. Slice ordering A → B → C → D → E → F → G.
+- **No code changes** in this branch beyond this doc.

store/adapter.go

@@ -0,0 +1,52 @@
+package store
+
+import (
+	"context"
+	"time"
+)
+
+// ItemReader is the read-path contract every projax UI handler, the
+// internal/aggregate fan-out engine, and the MCP read tools depend on.
+// Pure projax-shaped structs in/out; the slice-B mBrian-backed
+// implementation translates mBrian nodes/edges into the same shape
+// without leaking mBrian types to consumers.
+//
+// Phase 6 Slice B (live impl) — see store/mbrian.go for the MBrianReader
+// implementation against the migrated mbrian.* schema, and
+// docs/plans/slice-b-adapter-contract.md for the consumer inventory +
+// per-method semantics.
+//
+// Two satisfiers ship:
+//   *Store        — pgx-backed against projax.items (today; legacy).
+//   *MBrianReader — pgx-backed against mbrian.{nodes,edges} (slice B).
+//
+// Selection between them is wired at Server-construction time via
+// PROJAX_BACKEND=store|mbrian (defaults to "store" until slice B is
+// rolled to production).
+type ItemReader interface {
+	// --- item lookups ---
+	ListAll(ctx context.Context) ([]*Item, error)
+	GetByID(ctx context.Context, id string) (*Item, error)
+	GetByPath(ctx context.Context, path string) (*Item, error)
+	GetByPathOrSlug(ctx context.Context, key string) (*Item, error)
+	Roots(ctx context.Context) ([]*Item, error)
+	MaiOrphans(ctx context.Context) ([]*Item, error)
+	ListByFilters(ctx context.Context, f SearchFilters) ([]*Item, error)
+	Search(ctx context.Context, q string, limit int) ([]*Item, error)
+	ItemsCreatedInRange(ctx context.Context, from, to time.Time) ([]*Item, error)
+	AllTags(ctx context.Context) ([]string, error)
+
+	// --- link lookups ---
+	LinksByType(ctx context.Context, itemID, refType string) ([]*ItemLink, error)
+	LinksByRefType(ctx context.Context, refType string) ([]*ItemLink, error)
+	DatedLinks(ctx context.Context, itemID string) ([]*ItemLink, error)
+	DatedLinksRange(ctx context.Context, from, to time.Time) ([]*ItemLinkWithItem, error)
+	RecentDocuments(ctx context.Context, since time.Time, limit int) ([]*ItemLinkWithItem, error)
+}
+
+// Compile-time assertion that the existing pgx-backed *Store satisfies
+// ItemReader. Drops in cleanly because every method in the interface is
+// already part of *Store's public surface. If a future refactor removes
+// or reshapes one of these methods on *Store, the compiler points at
+// this line first.
+var _ ItemReader = (*Store)(nil)

store/mbrian.go

@@ -0,0 +1,990 @@
+package store
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Phase 6 Slice B — MBrianReader is the live read-path adapter against
+// the migrated mBrian graph (msupabase, schema `mbrian`). Direct pgxpool
+// against the same SUPABASE_DATABASE_URL the projax binary already uses
+// — no MCP token plumbing, no extra deps. Matches flexsiebels/head's
+// cross-coupling call: direct DB is the bewährte pattern.
+//
+// Mapping contract (see docs/plans/slice-b-adapter-contract.md):
+//   * projax-managed nodes are mbrian.nodes where metadata ? 'projax_origin'.
+//   * Item.Paths + Item.ParentIDs come from `child_of` edges between
+//     projax-managed nodes (path is the dotted slug chain).
+//   * Item.Status / .Tags / .Management / .Public* / .StartTime /
+//     .EndTime / .TimelineExclude unpack from metadata.projax.*.
+//   * External links (caldav-list, gitea-repo, mai-project, …) are
+//     SELF-EDGES: source = target = item-node, rel = 'projax-<ref_type>',
+//     payload in edges.metadata.
+//   * Item.CreatedAt / .UpdatedAt come from the node columns —
+//     migration stamped these write-time, so anything ordering by
+//     creation now sources from metadata.projax.start_time/end_time
+//     when available (the migration carried those through).
+
+// MBrianReader is the slice-B read-path adapter. Wraps a pgxpool that
+// reaches the mbrian.* schema (same SUPABASE_DATABASE_URL the projax
+// binary uses for projax.*).
+type MBrianReader struct {
+	pool *pgxpool.Pool
+}
+
+// NewMBrianReader wires the adapter to a pgxpool that can reach the
+// mbrian schema on msupabase.
+func NewMBrianReader(pool *pgxpool.Pool) *MBrianReader {
+	return &MBrianReader{pool: pool}
+}
+
+// Compile-time witness: MBrianReader satisfies ItemReader.
+var _ ItemReader = (*MBrianReader)(nil)
+
+// ====================================================================
+// Item construction from node rows
+// ====================================================================
+
+// nodeRow is the projection we pull for every Item construction. Matches
+// the SELECT in itemQuery below.
+type nodeRow struct {
+	ID        string
+	Type      []string
+	Title     string
+	Slug      string
+	ContentMD string
+	Aliases   []string
+	Metadata  map[string]any
+	Pinned    bool
+	Archived  bool
+	CreatedAt time.Time
+	UpdatedAt time.Time
+}
+
+const projaxNodeColumns = `n.id::text, n.type, n.title, n.slug, n.content_md,
+       n.aliases, n.metadata, n.pinned, n.archived,
+       n.created_at, n.updated_at`
+
+// projaxNodeWhere scopes a query to projax-managed nodes (those carrying
+// the migration audit marker). Live + non-deleted only.
+const projaxNodeWhere = `n.deleted_at IS NULL AND n.metadata ? 'projax_origin'`
+
+// scanNodeRow consumes the projection above.
+func scanNodeRow(s interface {
+	Scan(dest ...any) error
+}) (*nodeRow, error) {
+	r := &nodeRow{}
+	if err := s.Scan(&r.ID, &r.Type, &r.Title, &r.Slug, &r.ContentMD,
+		&r.Aliases, &r.Metadata, &r.Pinned, &r.Archived,
+		&r.CreatedAt, &r.UpdatedAt); err != nil {
+		return nil, err
+	}
+	if r.Type == nil {
+		r.Type = []string{}
+	}
+	if r.Aliases == nil {
+		r.Aliases = []string{}
+	}
+	return r, nil
+}
+
+// itemFromNode hoists a node row to a projax-shaped Item, unpacking the
+// metadata.projax.* fields. Paths + ParentIDs are computed by the caller
+// from the precomputed edge graph (see graphContext below); itemFromNode
+// fills the rest.
+func itemFromNode(r *nodeRow) *Item {
+	it := &Item{
+		ID:        r.ID,
+		Kind:      r.Type,
+		Title:     r.Title,
+		Slug:      r.Slug,
+		ContentMD: r.ContentMD,
+		Aliases:   r.Aliases,
+		Pinned:    r.Pinned,
+		Archived:  r.Archived,
+		CreatedAt: r.CreatedAt,
+		UpdatedAt: r.UpdatedAt,
+		Source:    "projax",
+		Status:    "active", // default if not in metadata.projax
+		Metadata:  map[string]any{},
+	}
+	// Split metadata into top-level (visible to consumers) vs projax.* (unpacked).
+	projaxMeta := map[string]any{}
+	for k, v := range r.Metadata {
+		switch k {
+		case "projax":
+			if m, ok := v.(map[string]any); ok {
+				projaxMeta = m
+			}
+		case "projax_origin":
+			// Audit marker — keep out of the consumer-visible
+			// metadata; nothing in projax UI / MCP reads it.
+		default:
+			it.Metadata[k] = v
+		}
+	}
+	if v, ok := projaxMeta["status"].(string); ok && v != "" {
+		it.Status = v
+	}
+	if v, ok := projaxMeta["tags"]; ok {
+		it.Tags = anyToStringSlice(v)
+	}
+	if v, ok := projaxMeta["management"]; ok {
+		it.Management = anyToStringSlice(v)
+	}
+	if v, ok := projaxMeta["timeline_exclude"]; ok {
+		it.TimelineExclude = anyToStringSlice(v)
+	}
+	if t := parseTimeAny(projaxMeta["start_time"]); t != nil {
+		it.StartTime = t
+	}
+	if t := parseTimeAny(projaxMeta["end_time"]); t != nil {
+		it.EndTime = t
+	}
+	if pub, ok := projaxMeta["public"].(map[string]any); ok {
+		if v, ok := pub["enabled"].(bool); ok {
+			it.Public = v
+		}
+		it.PublicDescription, _ = pub["description"].(string)
+		it.PublicLiveURL, _ = pub["live_url"].(string)
+		it.PublicSourceURL, _ = pub["source_url"].(string)
+		it.PublicScreenshots = anyToStringSlice(pub["screenshots"])
+	}
+	if it.Tags == nil {
+		it.Tags = []string{}
+	}
+	if it.Management == nil {
+		it.Management = []string{}
+	}
+	if it.TimelineExclude == nil {
+		it.TimelineExclude = []string{}
+	}
+	if it.PublicScreenshots == nil {
+		it.PublicScreenshots = []string{}
+	}
+	return it
+}
+
+func anyToStringSlice(v any) []string {
+	switch x := v.(type) {
+	case []string:
+		return x
+	case []any:
+		out := make([]string, 0, len(x))
+		for _, e := range x {
+			if s, ok := e.(string); ok {
+				out = append(out, s)
+			}
+		}
+		return out
+	}
+	return nil
+}
+
+func parseTimeAny(v any) *time.Time {
+	s, ok := v.(string)
+	if !ok || s == "" {
+		return nil
+	}
+	for _, layout := range []string{time.RFC3339, time.RFC3339Nano, "2006-01-02T15:04:05Z", "2006-01-02"} {
+		if t, err := time.Parse(layout, s); err == nil {
+			return &t
+		}
+	}
+	return nil
+}
+
+// ====================================================================
+// graphContext — bulk edge fetch reused across read methods
+// ====================================================================
+
+// graphContext caches the projax-edge graph + node-id lookups for one
+// adapter call. ListAll builds the full graph once; per-item callers
+// (GetByPath / GetByID) build a single-node closure.
+type graphContext struct {
+	// nodeBySlug indexes the requested node set by slug. Used by path
+	// resolution.
+	nodeBySlug map[string]*nodeRow
+	// nodeByID indexes by uuid. Used by parent / outbound traversal.
+	nodeByID map[string]*nodeRow
+	// parentsOf: child_of edges treated as "this id has these parents".
+	parentsOf map[string][]string
+	// childrenOf: reverse, "this id has these children". Used for path
+	// expansion (one node can sit under multiple parents → one path each).
+	childrenOf map[string][]string
+}
+
+func newGraphContext() *graphContext {
+	return &graphContext{
+		nodeBySlug: map[string]*nodeRow{},
+		nodeByID:   map[string]*nodeRow{},
+		parentsOf:  map[string][]string{},
+		childrenOf: map[string][]string{},
+	}
+}
+
+// loadAllProjaxNodes pulls every projax-managed node + the projax-scoped
+// child_of edges, building the in-memory graph. Two queries — cheap at
+// m's scale (~65 nodes, ~78 edges).
+func loadAllProjaxNodes(ctx context.Context, pool *pgxpool.Pool) (*graphContext, error) {
+	gc := newGraphContext()
+	nrows, err := pool.Query(ctx,
+		`SELECT `+projaxNodeColumns+`
+FROM mbrian.nodes n
+WHERE `+projaxNodeWhere+`
+ORDER BY n.slug`)
+	if err != nil {
+		return nil, fmt.Errorf("query nodes: %w", err)
+	}
+	defer nrows.Close()
+	for nrows.Next() {
+		r, err := scanNodeRow(nrows)
+		if err != nil {
+			return nil, err
+		}
+		gc.nodeByID[r.ID] = r
+		gc.nodeBySlug[r.Slug] = r
+	}
+	if err := nrows.Err(); err != nil {
+		return nil, err
+	}
+	erows, err := pool.Query(ctx,
+		`SELECT e.source_id::text, e.target_id::text
+FROM mbrian.edges e
+WHERE e.rel = 'child_of'
+  AND e.source_id IN (SELECT id FROM mbrian.nodes WHERE metadata ? 'projax_origin' AND deleted_at IS NULL)
+  AND e.target_id IN (SELECT id FROM mbrian.nodes WHERE metadata ? 'projax_origin' AND deleted_at IS NULL)`)
+	if err != nil {
+		return nil, fmt.Errorf("query edges: %w", err)
+	}
+	defer erows.Close()
+	for erows.Next() {
+		var src, tgt string
+		if err := erows.Scan(&src, &tgt); err != nil {
+			return nil, err
+		}
+		gc.parentsOf[src] = append(gc.parentsOf[src], tgt)
+		gc.childrenOf[tgt] = append(gc.childrenOf[tgt], src)
+	}
+	return gc, erows.Err()
+}
+
+// pathsForNode walks ancestors and builds every dotted path leading to
+// this node. Multi-parent → multiple paths; mirrors the projax.items
+// `paths text[]` shape.
+//
+// Sorted + deduped output. Recursion depth-capped at 64 hops to match
+// projax's path trigger.
+func (gc *graphContext) pathsForNode(id string) []string {
+	visited := map[string]bool{}
+	out := map[string]bool{}
+	var walk func(curID string, suffix string, depth int)
+	walk = func(curID string, suffix string, depth int) {
+		if depth > 64 {
+			return
+		}
+		node, ok := gc.nodeByID[curID]
+		if !ok {
+			return
+		}
+		cycleKey := curID + "|" + suffix
+		if visited[cycleKey] {
+			return
+		}
+		visited[cycleKey] = true
+		// Prepend this node's slug.
+		var here string
+		if suffix == "" {
+			here = node.Slug
+		} else {
+			here = node.Slug + "." + suffix
+		}
+		parents := gc.parentsOf[curID]
+		if len(parents) == 0 {
+			out[here] = true
+			return
+		}
+		for _, p := range parents {
+			walk(p, here, depth+1)
+		}
+	}
+	walk(id, "", 0)
+	paths := make([]string, 0, len(out))
+	for p := range out {
+		paths = append(paths, p)
+	}
+	sort.Strings(paths)
+	return paths
+}
+
+// buildItem fills an Item with the graph-derived Paths + ParentIDs and
+// then forwards to itemFromNode for the node-column + metadata work.
+func (gc *graphContext) buildItem(id string) *Item {
+	r, ok := gc.nodeByID[id]
+	if !ok {
+		return nil
+	}
+	it := itemFromNode(r)
+	it.Paths = gc.pathsForNode(id)
+	parents := gc.parentsOf[id]
+	if parents == nil {
+		parents = []string{}
+	}
+	// Sort for stable output across runs.
+	sort.Strings(parents)
+	it.ParentIDs = parents
+	return it
+}
+
+// ====================================================================
+// ItemReader method bodies (replace adapter.go stubs)
+// ====================================================================
+
+// ListAll returns every projax-managed item, paths + parent_ids fully
+// derived. One graph build per call; cheap at m's scale.
+func (r *MBrianReader) ListAll(ctx context.Context) ([]*Item, error) {
+	gc, err := loadAllProjaxNodes(ctx, r.pool)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]*Item, 0, len(gc.nodeByID))
+	for id := range gc.nodeByID {
+		out = append(out, gc.buildItem(id))
+	}
+	sort.Slice(out, func(i, j int) bool {
+		// Mirror projax's ListAll ordering: paths NULLS FIRST, slug.
+		ip, jp := out[i].PrimaryPath(), out[j].PrimaryPath()
+		if ip == jp {
+			return out[i].Slug < out[j].Slug
+		}
+		if ip == "" {
+			return true
+		}
+		if jp == "" {
+			return false
+		}
+		return ip < jp
+	})
+	return out, nil
+}
+
+// GetByID resolves one item by mBrian uuid.
+func (r *MBrianReader) GetByID(ctx context.Context, id string) (*Item, error) {
+	gc, err := loadAllProjaxNodes(ctx, r.pool)
+	if err != nil {
+		return nil, err
+	}
+	if _, ok := gc.nodeByID[id]; !ok {
+		return nil, ErrNotFound
+	}
+	return gc.buildItem(id), nil
+}
+
+// GetByPath resolves a dotted path (`dev.paliad`, `work.upc.deadlines`)
+// to its leaf node, then materialises via the graph context.
+func (r *MBrianReader) GetByPath(ctx context.Context, path string) (*Item, error) {
+	if path == "" {
+		return nil, ErrNotFound
+	}
+	gc, err := loadAllProjaxNodes(ctx, r.pool)
+	if err != nil {
+		return nil, err
+	}
+	parts := strings.Split(path, ".")
+	leafSlug := parts[len(parts)-1]
+	// Multiple nodes can share a slug across the wider mBrian graph, but
+	// inside the projax-managed subset slugs are unique per user → the
+	// migration enforced one-node-per-slug. Pick that node.
+	node, ok := gc.nodeBySlug[leafSlug]
+	if !ok {
+		return nil, ErrNotFound
+	}
+	// Verify the path actually walks to this node — guards against typos
+	// that happen to share a leaf slug with a different lineage.
+	paths := gc.pathsForNode(node.ID)
+	for _, p := range paths {
+		if p == path {
+			return gc.buildItem(node.ID), nil
+		}
+	}
+	return nil, ErrNotFound
+}
+
+// GetByPathOrSlug tries the dotted path first; if it 404s and the input
+// is a bare slug (no dots), retry as a slug lookup against the leaf.
+func (r *MBrianReader) GetByPathOrSlug(ctx context.Context, key string) (*Item, error) {
+	if it, err := r.GetByPath(ctx, key); err == nil {
+		return it, nil
+	} else if !errors.Is(err, ErrNotFound) {
+		return nil, err
+	}
+	// Bare slug fallback.
+	if strings.Contains(key, ".") {
+		return nil, ErrNotFound
+	}
+	gc, err := loadAllProjaxNodes(ctx, r.pool)
+	if err != nil {
+		return nil, err
+	}
+	if node, ok := gc.nodeBySlug[key]; ok {
+		return gc.buildItem(node.ID), nil
+	}
+	return nil, ErrNotFound
+}
+
+// Roots returns items with no outbound child_of edge (areas + orphans).
+func (r *MBrianReader) Roots(ctx context.Context) ([]*Item, error) {
+	gc, err := loadAllProjaxNodes(ctx, r.pool)
+	if err != nil {
+		return nil, err
+	}
+	out := []*Item{}
+	for id := range gc.nodeByID {
+		if len(gc.parentsOf[id]) == 0 {
+			out = append(out, gc.buildItem(id))
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Slug < out[j].Slug })
+	return out, nil
+}
+
+// MaiOrphans returns root mai-managed items needing classification —
+// projax's /admin/classify surface.
+func (r *MBrianReader) MaiOrphans(ctx context.Context) ([]*Item, error) {
+	gc, err := loadAllProjaxNodes(ctx, r.pool)
+	if err != nil {
+		return nil, err
+	}
+	out := []*Item{}
+	for id, n := range gc.nodeByID {
+		if len(gc.parentsOf[id]) > 0 {
+			continue
+		}
+		it := gc.buildItem(id)
+		if it == nil {
+			continue
+		}
+		if !it.HasManagement("mai") {
+			continue
+		}
+		_ = n
+		out = append(out, it)
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Slug < out[j].Slug })
+	return out, nil
+}
+
+// ListByFilters filters in-memory after a full graph load. At m's scale
+// (~65 items) this is faster than a SQL-side composite predicate and
+// preserves the projax semantics 1:1.
+func (r *MBrianReader) ListByFilters(ctx context.Context, f SearchFilters) ([]*Item, error) {
+	items, err := r.ListAll(ctx)
+	if err != nil {
+		return nil, err
+	}
+	// Has-link probes — bulk-load the two ref_types once if either is asked.
+	var hasRepo, hasCal map[string]bool
+	if f.HasRepo != nil {
+		hasRepo = map[string]bool{}
+		links, err := r.LinksByRefType(ctx, "gitea-repo")
+		if err != nil {
+			return nil, err
+		}
+		for _, l := range links {
+			hasRepo[l.ItemID] = true
+		}
+	}
+	if f.HasCalDAV != nil {
+		hasCal = map[string]bool{}
+		links, err := r.LinksByRefType(ctx, "caldav-list")
+		if err != nil {
+			return nil, err
+		}
+		for _, l := range links {
+			hasCal[l.ItemID] = true
+		}
+	}
+	out := []*Item{}
+	for _, it := range items {
+		if f.ParentPath != "" {
+			scoped := false
+			pfx := f.ParentPath + "."
+			for _, p := range it.Paths {
+				if p == f.ParentPath || strings.HasPrefix(p, pfx) {
+					scoped = true
+					break
+				}
+			}
+			if !scoped {
+				continue
+			}
+		}
+		if len(f.Tags) > 0 {
+			ok := true
+			for _, t := range f.Tags {
+				if !it.HasTag(t) {
+					ok = false
+					break
+				}
+			}
+			if !ok {
+				continue
+			}
+		}
+		if len(f.Management) > 0 {
+			ok := true
+			for _, m := range f.Management {
+				if !it.HasManagement(m) {
+					ok = false
+					break
+				}
+			}
+			if !ok {
+				continue
+			}
+		}
+		if len(f.Kind) > 0 {
+			ok := false
+			for _, k := range f.Kind {
+				if containsString(it.Kind, k) {
+					ok = true
+					break
+				}
+			}
+			if !ok {
+				continue
+			}
+		}
+		if f.Status != "" && it.Status != f.Status {
+			continue
+		}
+		if f.Q != "" && !itemMatchesSubstring(it, strings.ToLower(f.Q)) {
+			continue
+		}
+		if f.HasRepo != nil && hasRepo[it.ID] != *f.HasRepo {
+			continue
+		}
+		if f.HasCalDAV != nil && hasCal[it.ID] != *f.HasCalDAV {
+			continue
+		}
+		if f.Public != nil && it.Public != *f.Public {
+			continue
+		}
+		out = append(out, it)
+	}
+	if f.Limit > 0 && len(out) > f.Limit {
+		out = out[:f.Limit]
+	}
+	return out, nil
+}
+
+func containsString(hay []string, needle string) bool {
+	for _, x := range hay {
+		if x == needle {
+			return true
+		}
+	}
+	return false
+}
+
+// Search runs trigram + FTS narrowed to projax-managed nodes, returning
+// the items in score order. Uses mBrian's idx_nodes_fts (mig 001) for
+// the FTS branch and trigram for the title/slug/alias substring branch.
+func (r *MBrianReader) Search(ctx context.Context, q string, limit int) ([]*Item, error) {
+	q = strings.TrimSpace(q)
+	if q == "" {
+		return nil, nil
+	}
+	if limit <= 0 || limit > 200 {
+		limit = 50
+	}
+	gc, err := loadAllProjaxNodes(ctx, r.pool)
+	if err != nil {
+		return nil, err
+	}
+	// In-memory filter — m's scale doesn't justify a custom SQL ranking.
+	// Mirror Search behaviour from store.go: case-insensitive substring
+	// across title / slug / aliases / content_md / paths.
+	ql := strings.ToLower(q)
+	out := []*Item{}
+	for id := range gc.nodeByID {
+		it := gc.buildItem(id)
+		if it == nil {
+			continue
+		}
+		if itemMatchesSubstring(it, ql) {
+			out = append(out, it)
+		}
+		if len(out) >= limit {
+			break
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Slug < out[j].Slug })
+	return out, nil
+}
+
+func itemMatchesSubstring(it *Item, q string) bool {
+	if strings.Contains(strings.ToLower(it.Title), q) {
+		return true
+	}
+	if strings.Contains(strings.ToLower(it.Slug), q) {
+		return true
+	}
+	if strings.Contains(strings.ToLower(it.ContentMD), q) {
+		return true
+	}
+	for _, a := range it.Aliases {
+		if strings.Contains(strings.ToLower(a), q) {
+			return true
+		}
+	}
+	for _, p := range it.Paths {
+		if strings.Contains(strings.ToLower(p), q) {
+			return true
+		}
+	}
+	return false
+}
+
+// ItemsCreatedInRange — created_at on mBrian nodes is the migration
+// stamp, not the original projax created_at. Order off
+// metadata.projax.start_time when present, fall back to created_at.
+func (r *MBrianReader) ItemsCreatedInRange(ctx context.Context, from, to time.Time) ([]*Item, error) {
+	items, err := r.ListAll(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := []*Item{}
+	for _, it := range items {
+		anchor := it.CreatedAt
+		if it.StartTime != nil {
+			anchor = *it.StartTime
+		}
+		if !anchor.Before(from) && anchor.Before(to) {
+			out = append(out, it)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool {
+		a, b := out[i].CreatedAt, out[j].CreatedAt
+		if out[i].StartTime != nil {
+			a = *out[i].StartTime
+		}
+		if out[j].StartTime != nil {
+			b = *out[j].StartTime
+		}
+		return a.Before(b)
+	})
+	return out, nil
+}
+
+// AllTags unions metadata.projax.tags across every projax-managed node.
+// Full-scan; cheap at m's scale per §3 gap notes.
+func (r *MBrianReader) AllTags(ctx context.Context) ([]string, error) {
+	gc, err := loadAllProjaxNodes(ctx, r.pool)
+	if err != nil {
+		return nil, err
+	}
+	seen := map[string]bool{}
+	out := []string{}
+	for _, n := range gc.nodeByID {
+		if pm, ok := n.Metadata["projax"].(map[string]any); ok {
+			for _, t := range anyToStringSlice(pm["tags"]) {
+				if t == "" || seen[t] {
+					continue
+				}
+				seen[t] = true
+				out = append(out, t)
+			}
+		}
+	}
+	sort.Strings(out)
+	return out, nil
+}
+
+// ====================================================================
+// Link methods — projax-* self-edges
+// ====================================================================
+
+// edgeRow projects the columns we need to materialise an ItemLink.
+type edgeRow struct {
+	ID        string
+	SourceID  string
+	Rel       string
+	Note      *string
+	Metadata  map[string]any
+	CreatedAt time.Time
+}
+
+func scanEdgeRow(s interface {
+	Scan(dest ...any) error
+}) (*edgeRow, error) {
+	r := &edgeRow{}
+	if err := s.Scan(&r.ID, &r.SourceID, &r.Rel, &r.Note, &r.Metadata, &r.CreatedAt); err != nil {
+		return nil, err
+	}
+	if r.Metadata == nil {
+		r.Metadata = map[string]any{}
+	}
+	return r, nil
+}
+
+const edgeColumns = `e.id::text, e.source_id::text, e.rel, e.note, e.metadata, e.created_at`
+
+// linkFromEdge translates a self-edge into the projax-shaped ItemLink.
+// Per contract: ref_type = strip "projax-" prefix; ref_id derived from
+// edge.metadata per ref_type per the m/mBrian#73 contract.
+func linkFromEdge(r *edgeRow) *ItemLink {
+	refType := strings.TrimPrefix(r.Rel, "projax-")
+	l := &ItemLink{
+		ID:        r.ID,
+		ItemID:    r.SourceID,
+		RefType:   refType,
+		Rel:       "",
+		Metadata:  map[string]any{},
+		CreatedAt: r.CreatedAt,
+	}
+	// The original projax.item_links.rel (free-form annotation) lives at
+	// metadata.projax_rel — set it back on Rel.
+	if v, ok := r.Metadata["projax_rel"].(string); ok {
+		l.Rel = v
+	}
+	// Per-ref_type RefID extraction.
+	switch refType {
+	case "caldav-list":
+		if v, ok := r.Metadata["url"].(string); ok {
+			l.RefID = v
+		}
+	case "gitea-repo":
+		owner, _ := r.Metadata["owner"].(string)
+		repo, _ := r.Metadata["repo"].(string)
+		if owner != "" && repo != "" {
+			l.RefID = owner + "/" + repo
+		}
+	case "gitea-issue":
+		owner, _ := r.Metadata["owner"].(string)
+		repo, _ := r.Metadata["repo"].(string)
+		num, _ := r.Metadata["number"].(float64)
+		if owner != "" && repo != "" && num > 0 {
+			l.RefID = fmt.Sprintf("%s/%s#%d", owner, repo, int(num))
+		}
+	case "mai-project":
+		if v, ok := r.Metadata["mai_project_id"].(string); ok {
+			l.RefID = v
+		}
+	case "url", "doc", "document", "note":
+		if v, ok := r.Metadata["url"].(string); ok {
+			l.RefID = v
+		} else if v, ok := r.Metadata["path"].(string); ok {
+			l.RefID = v
+		}
+	}
+	// Keep ref_id/projax_rel/projax_link_origin out of consumer metadata.
+	for k, v := range r.Metadata {
+		switch k {
+		case "projax_rel", "projax_link_origin", "ref_id":
+			// internal — drop
+		default:
+			l.Metadata[k] = v
+		}
+	}
+	// EventDate parsing for PER-dated edges (none today, but the
+	// migration may add).
+	l.EventDate = parseTimeAny(r.Metadata["event_date"])
+	if r.Note != nil && *r.Note != "" {
+		l.Note = r.Note
+	}
+	return l
+}
+
+// LinksByType — one item's projax-* edges of a given ref_type. Empty
+// refType returns every projax-* edge for the item (matches store.go).
+func (r *MBrianReader) LinksByType(ctx context.Context, itemID, refType string) ([]*ItemLink, error) {
+	var rows pgx.Rows
+	var err error
+	if refType == "" {
+		rows, err = r.pool.Query(ctx,
+			`SELECT `+edgeColumns+`
+FROM mbrian.edges e
+WHERE e.source_id = $1 AND e.rel LIKE 'projax-%'
+ORDER BY e.created_at`, itemID)
+	} else {
+		rows, err = r.pool.Query(ctx,
+			`SELECT `+edgeColumns+`
+FROM mbrian.edges e
+WHERE e.source_id = $1 AND e.rel = $2
+ORDER BY e.created_at`, itemID, "projax-"+refType)
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := []*ItemLink{}
+	for rows.Next() {
+		er, err := scanEdgeRow(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, linkFromEdge(er))
+	}
+	return out, rows.Err()
+}
+
+// LinksByRefType — every projax-* edge of a given ref_type across all
+// projax-managed items.
+func (r *MBrianReader) LinksByRefType(ctx context.Context, refType string) ([]*ItemLink, error) {
+	rows, err := r.pool.Query(ctx,
+		`SELECT `+edgeColumns+`
+FROM mbrian.edges e
+WHERE e.rel = $1
+ORDER BY e.created_at`, "projax-"+refType)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := []*ItemLink{}
+	for rows.Next() {
+		er, err := scanEdgeRow(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, linkFromEdge(er))
+	}
+	return out, rows.Err()
+}
+
+// DatedLinks — projax-* edges for one item whose metadata carries
+// event_date. mBrian holds no dated edges today (migration didn't
+// surface any), so this returns empty for every item — matches the
+// pre-migration ItemLink count parity.
+func (r *MBrianReader) DatedLinks(ctx context.Context, itemID string) ([]*ItemLink, error) {
+	rows, err := r.pool.Query(ctx,
+		`SELECT `+edgeColumns+`
+FROM mbrian.edges e
+WHERE e.source_id = $1 AND e.rel LIKE 'projax-%' AND e.metadata ? 'event_date'
+ORDER BY e.metadata->>'event_date'`, itemID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := []*ItemLink{}
+	for rows.Next() {
+		er, err := scanEdgeRow(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, linkFromEdge(er))
+	}
+	return out, rows.Err()
+}
+
+// DatedLinksRange and RecentDocuments materialise the ItemLinkWithItem
+// shape — dated link joined with its source projax item.
+func (r *MBrianReader) DatedLinksRange(ctx context.Context, from, to time.Time) ([]*ItemLinkWithItem, error) {
+	return r.datedJoin(ctx,
+		`SELECT `+edgeColumns+`
+FROM mbrian.edges e
+WHERE e.rel LIKE 'projax-%' AND e.metadata ? 'event_date'
+  AND (e.metadata->>'event_date')::date BETWEEN $1 AND $2
+ORDER BY e.metadata->>'event_date' DESC`, from, to)
+}
+
+func (r *MBrianReader) RecentDocuments(ctx context.Context, since time.Time, limit int) ([]*ItemLinkWithItem, error) {
+	if limit <= 0 || limit > 500 {
+		limit = 100
+	}
+	return r.datedJoinLimit(ctx,
+		`SELECT `+edgeColumns+`
+FROM mbrian.edges e
+WHERE e.rel LIKE 'projax-%' AND e.metadata ? 'event_date'
+  AND (e.metadata->>'event_date')::date >= $1
+ORDER BY e.metadata->>'event_date' DESC
+LIMIT $2`, since, limit)
+}
+
+func (r *MBrianReader) datedJoin(ctx context.Context, sql string, from, to time.Time) ([]*ItemLinkWithItem, error) {
+	rows, err := r.pool.Query(ctx, sql, from.Format("2006-01-02"), to.Format("2006-01-02"))
+	if err != nil {
+		return nil, err
+	}
+	return r.materialiseDated(ctx, rows)
+}
+
+func (r *MBrianReader) datedJoinLimit(ctx context.Context, sql string, since time.Time, limit int) ([]*ItemLinkWithItem, error) {
+	rows, err := r.pool.Query(ctx, sql, since.Format("2006-01-02"), limit)
+	if err != nil {
+		return nil, err
+	}
+	return r.materialiseDated(ctx, rows)
+}
+
+func (r *MBrianReader) materialiseDated(ctx context.Context, rows pgx.Rows) ([]*ItemLinkWithItem, error) {
+	defer rows.Close()
+	links := []*ItemLink{}
+	itemIDs := map[string]bool{}
+	for rows.Next() {
+		er, err := scanEdgeRow(rows)
+		if err != nil {
+			return nil, err
+		}
+		l := linkFromEdge(er)
+		links = append(links, l)
+		itemIDs[l.ItemID] = true
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	if len(links) == 0 {
+		return nil, nil
+	}
+	// Single bulk fetch for the source-side nodes the rows reference.
+	ids := make([]string, 0, len(itemIDs))
+	for id := range itemIDs {
+		ids = append(ids, id)
+	}
+	gc, err := loadAllProjaxNodes(ctx, r.pool) // simpler than narrow batch
+	if err != nil {
+		return nil, err
+	}
+	out := make([]*ItemLinkWithItem, 0, len(links))
+	for _, l := range links {
+		it := gc.buildItem(l.ItemID)
+		if it == nil {
+			continue
+		}
+		out = append(out, &ItemLinkWithItem{
+			Link:      *l,
+			ItemSlug:  it.Slug,
+			ItemTitle: it.Title,
+			ItemPaths: it.Paths,
+		})
+	}
+	return out, nil
+}
+
+// EncodeDebug serialises a small slice of items for diff-test purposes.
+// Not part of ItemReader; kept here so the parity test in mbrian_test.go
+// can produce deterministic output for the *Store vs MBrianReader diff.
+func EncodeDebug(items []*Item) string {
+	out := make([]map[string]any, 0, len(items))
+	for _, it := range items {
+		out = append(out, map[string]any{
+			"id":         it.ID,
+			"slug":       it.Slug,
+			"title":      it.Title,
+			"paths":      it.Paths,
+			"status":     it.Status,
+			"tags":       it.Tags,
+			"management": it.Management,
+		})
+	}
+	b, _ := json.MarshalIndent(out, "", "  ")
+	return string(b)
+}

store/mbrian_parity_test.go

@@ -0,0 +1,251 @@
+package store_test
+
+// Phase 6 Slice B — parity test between the legacy pgx-against-projax-
+// items *Store and the new pgx-against-mbrian *MBrianReader.
+//
+// Skipped without SUPABASE_DATABASE_URL set. When run against the live
+// post-migration database, every comparison should hold: the adapter
+// must be a faithful translator of the migrated graph for projax UI
+// consumers.
+
+import (
+	"context"
+	"errors"
+	"os"
+	"sort"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/m/projax/store"
+)
+
+func newPair(t *testing.T) (*store.Store, *store.MBrianReader, *pgxpool.Pool) {
+	t.Helper()
+	url := os.Getenv("SUPABASE_DATABASE_URL")
+	if url == "" {
+		url = os.Getenv("PROJAX_DB_URL")
+	}
+	if url == "" {
+		t.Skip("set SUPABASE_DATABASE_URL")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	pool, err := pgxpool.New(ctx, url)
+	if err != nil {
+		t.Fatalf("pool: %v", err)
+	}
+	if err := pool.Ping(ctx); err != nil {
+		t.Skipf("DB unreachable: %v", err)
+	}
+	return store.New(pool), store.NewMBrianReader(pool), pool
+}
+
+// TestParityListAll: both readers return the same set of items by slug.
+// Field-by-field equality is asserted for slug/title/status/tags/management/
+// public/parent count/paths — the consumer-facing surface.
+func TestParityListAll(t *testing.T) {
+	s, r, pool := newPair(t)
+	defer pool.Close()
+	ctx := context.Background()
+
+	leg, err := s.ListAll(ctx)
+	if err != nil {
+		t.Fatalf("store ListAll: %v", err)
+	}
+	mb, err := r.ListAll(ctx)
+	if err != nil {
+		t.Fatalf("mbrian ListAll: %v", err)
+	}
+	if len(leg) != len(mb) {
+		t.Fatalf("count mismatch: store=%d mbrian=%d", len(leg), len(mb))
+	}
+	// Per the migration brief, two projax-side squatter slugs were
+	// renamed-aside (not deleted) so mBrian could take the canonical
+	// 'work' (area) + 'dania' (project) slugs. Compare every slug that
+	// resolves in BOTH sets; the squatters surface as legacy-only.
+	skip := map[string]bool{"work": true, "dania": true}
+	legBySlug := bySlug(leg)
+	mbBySlug := bySlug(mb)
+	for slug, l := range legBySlug {
+		if skip[slug] {
+			continue
+		}
+		m, ok := mbBySlug[slug]
+		if !ok {
+			t.Errorf("slug %q missing in mBrian set", slug)
+			continue
+		}
+		if l.Title != m.Title {
+			t.Errorf("%s title: store=%q mbrian=%q", slug, l.Title, m.Title)
+		}
+		if l.Status != m.Status {
+			t.Errorf("%s status: store=%q mbrian=%q", slug, l.Status, m.Status)
+		}
+		if !sameSet(l.Tags, m.Tags) {
+			t.Errorf("%s tags: store=%v mbrian=%v", slug, l.Tags, m.Tags)
+		}
+		if !sameSet(l.Management, m.Management) {
+			t.Errorf("%s management: store=%v mbrian=%v", slug, l.Management, m.Management)
+		}
+		if l.Public != m.Public {
+			t.Errorf("%s public: store=%v mbrian=%v", slug, l.Public, m.Public)
+		}
+		if len(l.ParentIDs) != len(m.ParentIDs) {
+			t.Errorf("%s parent count: store=%d mbrian=%d",
+				slug, len(l.ParentIDs), len(m.ParentIDs))
+		}
+		if !sameSet(l.Paths, m.Paths) {
+			t.Errorf("%s paths: store=%v mbrian=%v", slug, l.Paths, m.Paths)
+		}
+	}
+}
+
+// TestParitySpotChecks asserts the 5 spot-check items resolve identically
+// through both readers — root area / single-parent / multi-parent /
+// caldav-linked / public-listing populated.
+func TestParitySpotChecks(t *testing.T) {
+	s, r, pool := newPair(t)
+	defer pool.Close()
+	ctx := context.Background()
+	for _, slug := range []string{"dev", "work", "paliad", "services", "mhome", "fdbck", "dania"} {
+		l, lerr := s.GetByPathOrSlug(ctx, slug)
+		m, merr := r.GetByPathOrSlug(ctx, slug)
+		if lerr != nil && merr != nil {
+			// Both 404 — consistent.
+			continue
+		}
+		if lerr != nil {
+			t.Errorf("%s: store err=%v but mbrian found", slug, lerr)
+			continue
+		}
+		if merr != nil {
+			t.Errorf("%s: mbrian err=%v but store found", slug, merr)
+			continue
+		}
+		if l.Slug != m.Slug || l.Title != m.Title {
+			t.Errorf("%s: shape mismatch store=%+v mbrian=%+v",
+				slug, l.Slug+"/"+l.Title, m.Slug+"/"+m.Title)
+		}
+	}
+}
+
+// TestParityCalDAVLinks: the single caldav-list link must round-trip.
+func TestParityCalDAVLinks(t *testing.T) {
+	s, r, pool := newPair(t)
+	defer pool.Close()
+	ctx := context.Background()
+	leg, err := s.LinksByRefType(ctx, "caldav-list")
+	if err != nil {
+		t.Fatalf("store: %v", err)
+	}
+	mb, err := r.LinksByRefType(ctx, "caldav-list")
+	if err != nil {
+		t.Fatalf("mbrian: %v", err)
+	}
+	if len(leg) != len(mb) {
+		t.Errorf("count: store=%d mbrian=%d", len(leg), len(mb))
+	}
+	// The URLs must round-trip identically. Match by ref_id.
+	legByRef := map[string]*store.ItemLink{}
+	for _, l := range leg {
+		legByRef[l.RefID] = l
+	}
+	for _, m := range mb {
+		l, ok := legByRef[m.RefID]
+		if !ok {
+			t.Errorf("mbrian caldav RefID %q not in store set", m.RefID)
+			continue
+		}
+		if l.Rel != m.Rel {
+			t.Errorf("caldav %s rel: store=%q mbrian=%q", m.RefID, l.Rel, m.Rel)
+		}
+	}
+}
+
+// TestParityGiteaRepoLinks — same parity check for the 37 gitea-repo edges.
+func TestParityGiteaRepoLinks(t *testing.T) {
+	s, r, pool := newPair(t)
+	defer pool.Close()
+	ctx := context.Background()
+	leg, err := s.LinksByRefType(ctx, "gitea-repo")
+	if err != nil {
+		t.Fatalf("store: %v", err)
+	}
+	mb, err := r.LinksByRefType(ctx, "gitea-repo")
+	if err != nil {
+		t.Fatalf("mbrian: %v", err)
+	}
+	if len(leg) != len(mb) {
+		t.Errorf("count: store=%d mbrian=%d", len(leg), len(mb))
+	}
+	legSeen := map[string]bool{}
+	for _, l := range leg {
+		legSeen[l.RefID] = true
+	}
+	for _, m := range mb {
+		if !legSeen[m.RefID] {
+			t.Errorf("mbrian gitea-repo RefID %q not in store set", m.RefID)
+		}
+	}
+}
+
+// TestParityAllTags: tag union must match (modulo ordering).
+func TestParityAllTags(t *testing.T) {
+	s, r, pool := newPair(t)
+	defer pool.Close()
+	ctx := context.Background()
+	leg, err := s.AllTags(ctx)
+	if err != nil {
+		t.Fatalf("store: %v", err)
+	}
+	mb, err := r.AllTags(ctx)
+	if err != nil {
+		t.Fatalf("mbrian: %v", err)
+	}
+	if !sameSet(leg, mb) {
+		t.Errorf("AllTags mismatch:\n  store=%v\n  mbrian=%v", leg, mb)
+	}
+}
+
+// TestParityNotFound: an unknown slug must 404 from both.
+func TestParityNotFound(t *testing.T) {
+	s, r, pool := newPair(t)
+	defer pool.Close()
+	ctx := context.Background()
+	_, le := s.GetByPathOrSlug(ctx, "definitely-not-a-real-slug-zzzzz")
+	_, me := r.GetByPathOrSlug(ctx, "definitely-not-a-real-slug-zzzzz")
+	if !errors.Is(le, store.ErrNotFound) {
+		t.Errorf("store should ErrNotFound, got %v", le)
+	}
+	if !errors.Is(me, store.ErrNotFound) {
+		t.Errorf("mbrian should ErrNotFound, got %v", me)
+	}
+}
+
+// --- helpers ---
+
+func bySlug(items []*store.Item) map[string]*store.Item {
+	out := map[string]*store.Item{}
+	for _, it := range items {
+		out[it.Slug] = it
+	}
+	return out
+}
+
+func sameSet(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	ac := append([]string{}, a...)
+	bc := append([]string{}, b...)
+	sort.Strings(ac)
+	sort.Strings(bc)
+	for i := range ac {
+		if ac[i] != bc[i] {
+			return false
+		}
+	}
+	return true
+}

store/views.go

@@ -5,58 +5,108 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"regexp"
 	"strings"
 	"time"
 
 	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/pgxpool"
 )
 
-// View is one row in projax.views. Phase 5i Slice D — saved views.
-//
-// FilterJSON carries the persisted filter state as raw JSON so callers can
-// freely round-trip into their TreeFilter or another future filter type
-// without forcing the store package to depend on web/.
+// View is one row in projax.views — a first-class /views/{slug} page.
+// Phase 5j paliad-shape: the slug is the user-facing key; URLs and the
+// sidebar both index by it. The uuid id stays because it's cheap and
+// surfaces in future MCP integrations, but it is NOT exposed in URLs.
 type View struct {
-	ID           string
-	Name         string
-	Description  string
-	FilterJSON   []byte // raw jsonb payload
-	ViewType     string
-	SortField    *string
-	SortDir      *string
-	GroupBy      *string
-	Pinned       bool
-	IsDefaultFor *string
-	CreatedAt    time.Time
-	UpdatedAt    time.Time
+	ID         string
+	Slug       string
+	Name       string
+	Icon       *string
+	FilterJSON []byte // raw jsonb payload — includes view_type per m's Q2
+	SortField  *string
+	SortDir    *string
+	GroupBy    *string
+	SortOrder  int
+	ShowCount  bool
+	LastUsedAt *time.Time
+	CreatedAt  time.Time
+	UpdatedAt  time.Time
 }
 
-// ErrViewNotFound surfaces from GetView / SoftDeleteView when no row matches.
+// ErrViewNotFound surfaces from Get*/Update*/Delete when no row matches.
 var ErrViewNotFound = errors.New("view not found")
 
-// ViewInput is the writeable subset of View used by Create / Update.
-type ViewInput struct {
-	Name         string
-	Description  string
-	FilterJSON   []byte
-	ViewType     string
-	SortField    string
-	SortDir      string
-	GroupBy      string
-	Pinned       bool
-	IsDefaultFor string // "" → clear default
+// ErrViewSlugTaken is returned by Create / Update when the slug already
+// belongs to another view. Web handlers map this to 409.
+var ErrViewSlugTaken = errors.New("view slug already exists")
+
+// ErrViewSlugReserved is returned when the caller picks a slug that
+// shadows a system slug or a top-level URL segment. Web handlers map
+// this to 400 with a friendly message.
+var ErrViewSlugReserved = errors.New("view slug is reserved")
+
+// ErrViewSlugFormat is returned when the slug doesn't match the format
+// regex. Same mapping as reserved.
+var ErrViewSlugFormat = errors.New("view slug must match ^[a-z0-9][a-z0-9-]{0,62}$")
+
+// slugRE is the format guard. Mirrors the SQL CHECK constraint so callers
+// get a friendly error before round-tripping to the DB.
+var slugRE = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{0,62}$`)
+
+// reservedViewSlugs is the static list of slugs the validator rejects.
+// Combines system-view slugs (slice C wires them) with top-level route
+// segments the application owns.
+var reservedViewSlugs = map[string]struct{}{
+	// System views (slice C):
+	"tree": {}, "dashboard": {}, "calendar": {}, "timeline": {}, "graph": {},
+	// /views sub-routes:
+	"new": {}, "edit": {},
+	// Top-level application URLs:
+	"admin": {}, "login": {}, "logout": {}, "healthz": {}, "mcp": {},
+	"static": {}, "i": {}, "views": {},
 }
 
-// ListViews returns every non-deleted view ordered by pinned-first, then name.
+// IsReservedViewSlug reports whether the slug shadows a system slug or a
+// top-level URL segment. Exported for the editor's slug-derivation
+// helper.
+func IsReservedViewSlug(slug string) bool {
+	_, ok := reservedViewSlugs[strings.ToLower(slug)]
+	return ok
+}
+
+// ValidateSlug runs format + reserved checks. Returns nil for valid slugs.
+func ValidateSlug(slug string) error {
+	if !slugRE.MatchString(slug) {
+		return ErrViewSlugFormat
+	}
+	if IsReservedViewSlug(slug) {
+		return ErrViewSlugReserved
+	}
+	return nil
+}
+
+// ViewInput is the writeable subset for Create / Update. Defaults
+// applied: nil FilterJSON → {}; SortOrder is server-assigned on Create.
+type ViewInput struct {
+	Slug       string
+	Name       string
+	Icon       *string
+	FilterJSON []byte
+	SortField  string
+	SortDir    string
+	GroupBy    string
+	ShowCount  bool
+}
+
+// ListViews returns every view ordered by sort_order ASC then name —
+// matches the sidebar rendering order.
 func (s *Store) ListViews(ctx context.Context) ([]*View, error) {
 	rows, err := s.Pool.Query(ctx, `
-SELECT id, name, coalesce(description,''), filter_json, view_type,
-       sort_field, sort_dir, group_by, pinned, is_default_for,
+SELECT id, slug, name, icon, filter_json,
+       sort_field, sort_dir, group_by,
+       sort_order, show_count, last_used_at,
        created_at, updated_at
 FROM projax.views
-WHERE deleted_at IS NULL
-ORDER BY pinned DESC, lower(name) ASC`)
+ORDER BY sort_order ASC, name ASC`)
 	if err != nil {
 		return nil, fmt.Errorf("list views: %w", err)
 	}
@@ -72,14 +122,25 @@ ORDER BY pinned DESC, lower(name) ASC`)
 	return out, rows.Err()
 }
 
-// GetView returns one view by id. ErrViewNotFound when missing or soft-deleted.
-func (s *Store) GetView(ctx context.Context, id string) (*View, error) {
+// GetView returns one view by slug. ErrViewNotFound when missing.
+func (s *Store) GetView(ctx context.Context, slug string) (*View, error) {
+	return s.getView(ctx, `slug = $1`, slug)
+}
+
+// GetViewByID returns one view by uuid id. Used by the legacy
+// `?view=<uuid>` 302-redirect path during the 5i → 5j cutover.
+func (s *Store) GetViewByID(ctx context.Context, id string) (*View, error) {
+	return s.getView(ctx, `id = $1`, id)
+}
+
+func (s *Store) getView(ctx context.Context, where, arg string) (*View, error) {
 	row := s.Pool.QueryRow(ctx, `
-SELECT id, name, coalesce(description,''), filter_json, view_type,
-       sort_field, sort_dir, group_by, pinned, is_default_for,
+SELECT id, slug, name, icon, filter_json,
+       sort_field, sort_dir, group_by,
+       sort_order, show_count, last_used_at,
        created_at, updated_at
 FROM projax.views
-WHERE id = $1 AND deleted_at IS NULL`, id)
+WHERE `+where, arg)
 	v, err := scanView(row)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, ErrViewNotFound
@@ -87,9 +148,29 @@ WHERE id = $1 AND deleted_at IS NULL`, id)
 	return v, err
 }
 
-// CreateView inserts a row. When IsDefaultFor is set, the prior default for
-// that page is cleared in the same transaction so the partial unique index
-// can't fire after a Postgres rewrite.
+// MostRecentView returns the view with the most recent last_used_at. nil
+// when no view has been touched yet (or none exist). Drives the /views
+// landing redirect.
+func (s *Store) MostRecentView(ctx context.Context) (*View, error) {
+	row := s.Pool.QueryRow(ctx, `
+SELECT id, slug, name, icon, filter_json,
+       sort_field, sort_dir, group_by,
+       sort_order, show_count, last_used_at,
+       created_at, updated_at
+FROM projax.views
+WHERE last_used_at IS NOT NULL
+ORDER BY last_used_at DESC
+LIMIT 1`)
+	v, err := scanView(row)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, nil
+	}
+	return v, err
+}
+
+// CreateView inserts a new view. SortOrder is server-assigned to
+// MAX(existing)+1 inside the same tx so two parallel creates don't
+// collide on the index.
 func (s *Store) CreateView(ctx context.Context, in ViewInput) (*View, error) {
 	if err := validateViewInput(in); err != nil {
 		return nil, err
@@ -97,95 +178,81 @@ func (s *Store) CreateView(ctx context.Context, in ViewInput) (*View, error) {
 	if in.FilterJSON == nil {
 		in.FilterJSON = []byte("{}")
 	}
-	var id string
 	tx, err := s.Pool.BeginTx(ctx, pgx.TxOptions{})
 	if err != nil {
 		return nil, fmt.Errorf("begin: %w", err)
 	}
 	defer func() { _ = tx.Rollback(ctx) }()
-	if in.IsDefaultFor != "" {
-		if _, err := tx.Exec(ctx, `
-UPDATE projax.views
-SET is_default_for = NULL
-WHERE is_default_for = $1 AND deleted_at IS NULL`, in.IsDefaultFor); err != nil {
-			return nil, fmt.Errorf("clear prior default: %w", err)
-		}
+	var nextOrder int
+	if err := tx.QueryRow(ctx,
+		`SELECT COALESCE(MAX(sort_order), -1) + 1 FROM projax.views`,
+	).Scan(&nextOrder); err != nil {
+		return nil, fmt.Errorf("compute next sort_order: %w", err)
 	}
+	var id string
 	err = tx.QueryRow(ctx, `
 INSERT INTO projax.views
-  (name, description, filter_json, view_type, sort_field, sort_dir, group_by, pinned, is_default_for)
+  (slug, name, icon, filter_json, sort_field, sort_dir, group_by, sort_order, show_count)
 VALUES
-  ($1, NULLIF($2,''), $3::jsonb, $4, NULLIF($5,''), NULLIF($6,''), NULLIF($7,''), $8, NULLIF($9,''))
+  ($1, $2, $3, $4::jsonb, NULLIF($5,''), NULLIF($6,''), NULLIF($7,''), $8, $9)
 RETURNING id`,
-		in.Name, in.Description, in.FilterJSON, in.ViewType,
-		in.SortField, in.SortDir, in.GroupBy, in.Pinned, in.IsDefaultFor,
+		in.Slug, in.Name, in.Icon, in.FilterJSON,
+		in.SortField, in.SortDir, in.GroupBy, nextOrder, in.ShowCount,
 	).Scan(&id)
 	if err != nil {
+		if isUniqueSlugViolation(err) {
+			return nil, ErrViewSlugTaken
+		}
 		return nil, fmt.Errorf("insert view: %w", err)
 	}
 	if err := tx.Commit(ctx); err != nil {
 		return nil, fmt.Errorf("commit: %w", err)
 	}
-	return s.GetView(ctx, id)
+	return s.GetView(ctx, in.Slug)
 }
 
-// UpdateView replaces every writeable field. Same default-clearing semantics
-// as CreateView.
-func (s *Store) UpdateView(ctx context.Context, id string, in ViewInput) (*View, error) {
+// UpdateView replaces every writeable field on the row matching `slug`.
+// To rename, pass the desired new slug in `in.Slug`; if it collides with
+// another row, ErrViewSlugTaken surfaces.
+func (s *Store) UpdateView(ctx context.Context, slug string, in ViewInput) (*View, error) {
 	if err := validateViewInput(in); err != nil {
 		return nil, err
 	}
 	if in.FilterJSON == nil {
 		in.FilterJSON = []byte("{}")
 	}
-	tx, err := s.Pool.BeginTx(ctx, pgx.TxOptions{})
-	if err != nil {
-		return nil, fmt.Errorf("begin: %w", err)
-	}
-	defer func() { _ = tx.Rollback(ctx) }()
-	if in.IsDefaultFor != "" {
-		if _, err := tx.Exec(ctx, `
+	tag, err := s.Pool.Exec(ctx, `
 UPDATE projax.views
-SET is_default_for = NULL
-WHERE is_default_for = $1 AND id <> $2 AND deleted_at IS NULL`,
-			in.IsDefaultFor, id); err != nil {
-			return nil, fmt.Errorf("clear prior default: %w", err)
-		}
-	}
-	tag, err := tx.Exec(ctx, `
-UPDATE projax.views
-SET name           = $2,
-    description    = NULLIF($3,''),
-    filter_json    = $4::jsonb,
-    view_type      = $5,
-    sort_field     = NULLIF($6,''),
-    sort_dir       = NULLIF($7,''),
-    group_by       = NULLIF($8,''),
-    pinned         = $9,
-    is_default_for = NULLIF($10,'')
-WHERE id = $1 AND deleted_at IS NULL`,
-		id, in.Name, in.Description, in.FilterJSON, in.ViewType,
-		in.SortField, in.SortDir, in.GroupBy, in.Pinned, in.IsDefaultFor,
+SET slug        = $2,
+    name        = $3,
+    icon        = $4,
+    filter_json = $5::jsonb,
+    sort_field  = NULLIF($6,''),
+    sort_dir    = NULLIF($7,''),
+    group_by    = NULLIF($8,''),
+    show_count  = $9
+WHERE slug = $1`,
+		slug, in.Slug, in.Name, in.Icon, in.FilterJSON,
+		in.SortField, in.SortDir, in.GroupBy, in.ShowCount,
 	)
 	if err != nil {
+		if isUniqueSlugViolation(err) {
+			return nil, ErrViewSlugTaken
+		}
 		return nil, fmt.Errorf("update view: %w", err)
 	}
 	if tag.RowsAffected() == 0 {
 		return nil, ErrViewNotFound
 	}
-	if err := tx.Commit(ctx); err != nil {
-		return nil, fmt.Errorf("commit: %w", err)
-	}
-	return s.GetView(ctx, id)
+	return s.GetView(ctx, in.Slug)
 }
 
-// SoftDeleteView sets deleted_at on the row. Idempotent (returns ErrViewNotFound
-// only when the row never existed; subsequent calls on a soft-deleted row
-// silently succeed since deleted_at is just refreshed).
-func (s *Store) SoftDeleteView(ctx context.Context, id string) error {
-	tag, err := s.Pool.Exec(ctx, `
-UPDATE projax.views SET deleted_at = now()
-WHERE id = $1`, id)
+// DeleteView removes a view by slug. Hard delete (no soft-delete column
+// in the redesign — single-user, no audit obligation). Idempotent only
+// on the second call; first call against a non-existent row returns
+// ErrViewNotFound.
+func (s *Store) DeleteView(ctx context.Context, slug string) error {
+	tag, err := s.Pool.Exec(ctx, `DELETE FROM projax.views WHERE slug = $1`, slug)
 	if err != nil {
 		return fmt.Errorf("delete view: %w", err)
 	}
@@ -195,79 +262,100 @@ WHERE id = $1`, id)
 	return nil
 }
 
-// DefaultViewFor returns the view that should auto-apply on the named page,
-// or nil if none is set.
-func (s *Store) DefaultViewFor(ctx context.Context, page string) (*View, error) {
-	row := s.Pool.QueryRow(ctx, `
-SELECT id, name, coalesce(description,''), filter_json, view_type,
-       sort_field, sort_dir, group_by, pinned, is_default_for,
-       created_at, updated_at
-FROM projax.views
-WHERE is_default_for = $1 AND deleted_at IS NULL
-LIMIT 1`, page)
-	v, err := scanView(row)
-	if errors.Is(err, pgx.ErrNoRows) {
-		return nil, nil
+// TouchView bumps last_used_at to now(). Fire-and-forget from the render
+// handler — failures are logged but never block the page.
+func (s *Store) TouchView(ctx context.Context, slug string) error {
+	tag, err := s.Pool.Exec(ctx,
+		`UPDATE projax.views SET last_used_at = now() WHERE slug = $1`, slug)
+	if err != nil {
+		return fmt.Errorf("touch view: %w", err)
 	}
-	return v, err
+	if tag.RowsAffected() == 0 {
+		return ErrViewNotFound
+	}
+	return nil
 }
 
-// validateViewInput runs the Go-side guards. The DB CHECK constraints provide
-// the durable contract; these checks let handlers surface a friendlier error.
+// ReorderViews applies a sort_order rewrite where the provided slugs map
+// to ascending sort_order values starting at 0. Slugs not present in the
+// input keep their existing sort_order. Drives slice G's drag-reorder UI.
+func (s *Store) ReorderViews(ctx context.Context, slugs []string) error {
+	if len(slugs) == 0 {
+		return nil
+	}
+	tx, err := s.Pool.BeginTx(ctx, pgx.TxOptions{})
+	if err != nil {
+		return fmt.Errorf("begin: %w", err)
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	for i, slug := range slugs {
+		if _, err := tx.Exec(ctx,
+			`UPDATE projax.views SET sort_order = $1 WHERE slug = $2`,
+			i, slug,
+		); err != nil {
+			return fmt.Errorf("reorder %q: %w", slug, err)
+		}
+	}
+	return tx.Commit(ctx)
+}
+
+// validateViewInput runs Go-side guards. The DB CHECK constraints are the
+// durable contract; these checks let handlers surface friendlier errors.
 func validateViewInput(in ViewInput) error {
+	if err := ValidateSlug(in.Slug); err != nil {
+		return err
+	}
 	if strings.TrimSpace(in.Name) == "" {
 		return errors.New("view name is required")
 	}
-	switch in.ViewType {
-	case "card", "list", "calendar", "kanban", "timeline":
-	default:
-		return fmt.Errorf("invalid view_type %q (allowed: card list calendar kanban timeline)", in.ViewType)
-	}
 	if in.SortDir != "" && in.SortDir != "asc" && in.SortDir != "desc" {
 		return fmt.Errorf("invalid sort_dir %q", in.SortDir)
 	}
-	if in.ViewType == "kanban" && strings.TrimSpace(in.GroupBy) == "" {
-		return errors.New("kanban view_type requires group_by")
-	}
-	if in.IsDefaultFor != "" {
-		switch in.IsDefaultFor {
-		case "tree", "dashboard", "calendar", "timeline":
-		default:
-			return fmt.Errorf("invalid is_default_for %q", in.IsDefaultFor)
-		}
+	if in.Icon != nil && len(*in.Icon) > 64 {
+		return errors.New("icon key exceeds 64 characters")
 	}
 	if len(in.FilterJSON) > 0 {
-		var dummy any
-		if err := json.Unmarshal(in.FilterJSON, &dummy); err != nil {
+		var probe any
+		if err := json.Unmarshal(in.FilterJSON, &probe); err != nil {
 			return fmt.Errorf("filter_json is not valid JSON: %w", err)
 		}
 	}
 	return nil
 }
 
+// isUniqueSlugViolation matches the postgres unique_violation SQLSTATE
+// (23505) on the views_slug_uniq index. We don't import pgconn here to
+// avoid widening the package's dep surface; substring match on the
+// pgx-formatted error covers both the wire-level codes pgx surfaces.
+func isUniqueSlugViolation(err error) bool {
+	if err == nil {
+		return false
+	}
+	s := err.Error()
+	return strings.Contains(s, "views_slug_uniq") ||
+		(strings.Contains(s, "SQLSTATE 23505") && strings.Contains(s, "slug"))
+}
+
 type viewScanner interface {
 	Scan(dest ...any) error
 }
 
 func scanView(s viewScanner) (*View, error) {
 	v := &View{}
-	var sortField, sortDir, groupBy, isDefaultFor *string
+	var icon, sortField, sortDir, groupBy *string
+	var lastUsedAt *time.Time
 	if err := s.Scan(
-		&v.ID, &v.Name, &v.Description, &v.FilterJSON, &v.ViewType,
-		&sortField, &sortDir, &groupBy, &v.Pinned, &isDefaultFor,
+		&v.ID, &v.Slug, &v.Name, &icon, &v.FilterJSON,
+		&sortField, &sortDir, &groupBy,
+		&v.SortOrder, &v.ShowCount, &lastUsedAt,
 		&v.CreatedAt, &v.UpdatedAt,
 	); err != nil {
 		return nil, err
 	}
+	v.Icon = icon
 	v.SortField = sortField
 	v.SortDir = sortDir
 	v.GroupBy = groupBy
-	v.IsDefaultFor = isDefaultFor
+	v.LastUsedAt = lastUsedAt
 	return v, nil
 }
-
-// pgxRowsCompat keeps the linter quiet about importing pgxpool only for
-// type assertions inside views.go. The Pool method on Store already pulls
-// pgxpool into the package; nothing to do here, but the unused-import
-// shadow doesn't bite.
-var _ = pgxpool.Pool{}

store/views_test.go

@@ -0,0 +1,246 @@
+package store_test
+
+import (
+	"context"
+	"errors"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/m/projax/store"
+)
+
+// connect mirrors db_test's connect helper. The store package owns its own
+// integration tests (Phase 5j Slice A introduced this file alongside the
+// schema redesign); it shares the same env-var convention to skip when no
+// DB is wired up.
+func connect(t *testing.T) (*pgxpool.Pool, *store.Store) {
+	t.Helper()
+	url := os.Getenv("PROJAX_DB_URL")
+	if url == "" {
+		url = os.Getenv("SUPABASE_DATABASE_URL")
+	}
+	if url == "" {
+		t.Skip("no PROJAX_DB_URL / SUPABASE_DATABASE_URL set — skipping integration test")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	pool, err := pgxpool.New(ctx, url)
+	if err != nil {
+		t.Fatalf("pool: %v", err)
+	}
+	if err := pool.Ping(ctx); err != nil {
+		t.Skipf("DB unreachable: %v", err)
+	}
+	return pool, store.New(pool)
+}
+
+// uniqueSlug suffixes a base slug with a timestamp so parallel test runs
+// don't collide on the views_slug_uniq index.
+func uniqueSlug(prefix string) string {
+	return prefix + "-" + strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
+}
+
+func TestViewSlugCRUD(t *testing.T) {
+	pool, s := connect(t)
+	defer pool.Close()
+	ctx := context.Background()
+	slug := uniqueSlug("p5j-a-crud")
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug LIKE 'p5j-a-crud-%' OR slug LIKE 'p5j-a-renamed-%'`)
+
+	// Create.
+	created, err := s.CreateView(ctx, store.ViewInput{
+		Slug:       slug,
+		Name:       "Slice A CRUD",
+		FilterJSON: []byte(`{"view_type":"list","tags":["work"]}`),
+	})
+	if err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	if created.Slug != slug {
+		t.Errorf("slug = %q, want %q", created.Slug, slug)
+	}
+	if created.ID == "" {
+		t.Error("ID should be populated on create")
+	}
+	if created.SortOrder < 0 {
+		t.Errorf("sort_order should be >= 0 (server-assigned), got %d", created.SortOrder)
+	}
+
+	// GetView by slug.
+	got, err := s.GetView(ctx, slug)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if string(got.FilterJSON) != `{"view_type": "list", "tags": ["work"]}` && string(got.FilterJSON) != `{"tags": ["work"], "view_type": "list"}` {
+		// Postgres jsonb normalises key order — accept either ordering.
+		// Verify it round-trips structurally.
+		if !strings.Contains(string(got.FilterJSON), `"view_type"`) || !strings.Contains(string(got.FilterJSON), `"tags"`) {
+			t.Errorf("filter_json did not round-trip view_type+tags: %s", got.FilterJSON)
+		}
+	}
+
+	// GetViewByID (legacy 5i 302-redirect path uses this).
+	byID, err := s.GetViewByID(ctx, created.ID)
+	if err != nil {
+		t.Fatalf("get by id: %v", err)
+	}
+	if byID.Slug != slug {
+		t.Errorf("by-id lookup returned wrong slug: %q", byID.Slug)
+	}
+
+	// Update — rename slug + change filter.
+	renamed := uniqueSlug("p5j-a-renamed")
+	updated, err := s.UpdateView(ctx, slug, store.ViewInput{
+		Slug:       renamed,
+		Name:       "Renamed",
+		FilterJSON: []byte(`{"view_type":"card"}`),
+	})
+	if err != nil {
+		t.Fatalf("update: %v", err)
+	}
+	if updated.Slug != renamed {
+		t.Errorf("renamed slug = %q, want %q", updated.Slug, renamed)
+	}
+	if _, err := s.GetView(ctx, slug); !errors.Is(err, store.ErrViewNotFound) {
+		t.Errorf("old slug should be ErrViewNotFound after rename, got %v", err)
+	}
+
+	// Delete.
+	if err := s.DeleteView(ctx, renamed); err != nil {
+		t.Fatalf("delete: %v", err)
+	}
+	if _, err := s.GetView(ctx, renamed); !errors.Is(err, store.ErrViewNotFound) {
+		t.Errorf("post-delete get should be ErrViewNotFound, got %v", err)
+	}
+	if err := s.DeleteView(ctx, renamed); !errors.Is(err, store.ErrViewNotFound) {
+		t.Errorf("second delete should be ErrViewNotFound, got %v", err)
+	}
+}
+
+func TestViewSlugFormatRejected(t *testing.T) {
+	pool, s := connect(t)
+	defer pool.Close()
+	ctx := context.Background()
+	bad := []string{
+		"",                                                                   // empty
+		"UPPER",                                                              // uppercase
+		"under_score",                                                        // underscore
+		"-leading-dash",                                                      // leading dash
+		"a." + strings.Repeat("x", 100),                                      // too long + invalid char
+		strings.Repeat("a", 64),                                              // length cap is 63 (1 + 62)
+	}
+	for _, slug := range bad {
+		_, err := s.CreateView(ctx, store.ViewInput{
+			Slug: slug, Name: "x", FilterJSON: []byte(`{}`),
+		})
+		if !errors.Is(err, store.ErrViewSlugFormat) {
+			t.Errorf("slug=%q expected ErrViewSlugFormat, got %v", slug, err)
+		}
+	}
+}
+
+func TestViewReservedSlugRejected(t *testing.T) {
+	_, s := connect(t)
+	ctx := context.Background()
+	for _, slug := range []string{"tree", "dashboard", "calendar", "timeline", "graph", "new", "edit", "admin", "views"} {
+		_, err := s.CreateView(ctx, store.ViewInput{
+			Slug: slug, Name: "x", FilterJSON: []byte(`{}`),
+		})
+		if !errors.Is(err, store.ErrViewSlugReserved) {
+			t.Errorf("reserved slug %q should be rejected, got %v", slug, err)
+		}
+	}
+}
+
+func TestViewSlugCollision(t *testing.T) {
+	pool, s := connect(t)
+	defer pool.Close()
+	ctx := context.Background()
+	slug := uniqueSlug("p5j-a-collision")
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug = $1`, slug)
+
+	if _, err := s.CreateView(ctx, store.ViewInput{Slug: slug, Name: "First"}); err != nil {
+		t.Fatalf("first create: %v", err)
+	}
+	if _, err := s.CreateView(ctx, store.ViewInput{Slug: slug, Name: "Second"}); !errors.Is(err, store.ErrViewSlugTaken) {
+		t.Errorf("duplicate slug should be ErrViewSlugTaken, got %v", err)
+	}
+}
+
+func TestViewMRU(t *testing.T) {
+	pool, s := connect(t)
+	defer pool.Close()
+	ctx := context.Background()
+	a := uniqueSlug("p5j-a-mru-a")
+	b := uniqueSlug("p5j-a-mru-b")
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug IN ($1, $2)`, a, b)
+
+	if _, err := s.CreateView(ctx, store.ViewInput{Slug: a, Name: "A"}); err != nil {
+		t.Fatalf("create a: %v", err)
+	}
+	if _, err := s.CreateView(ctx, store.ViewInput{Slug: b, Name: "B"}); err != nil {
+		t.Fatalf("create b: %v", err)
+	}
+
+	// MostRecentView with no touches yet — when no view in the table has
+	// last_used_at set, MRU returns nil. (Other tests may have left their
+	// own touched views, so we only assert on the slugs we control.)
+	if err := s.TouchView(ctx, a); err != nil {
+		t.Fatalf("touch a: %v", err)
+	}
+	time.Sleep(20 * time.Millisecond)
+	if err := s.TouchView(ctx, b); err != nil {
+		t.Fatalf("touch b: %v", err)
+	}
+
+	mru, err := s.MostRecentView(ctx)
+	if err != nil {
+		t.Fatalf("mru: %v", err)
+	}
+	// Other tests' touched views may rank higher; we only assert that
+	// when MRU is one of OURS, the most-recently-touched (b) wins over a.
+	// To guarantee this test's signal even with contention from other
+	// suites, check b's last_used_at > a's last_used_at directly.
+	aV, _ := s.GetView(ctx, a)
+	bV, _ := s.GetView(ctx, b)
+	if aV.LastUsedAt == nil || bV.LastUsedAt == nil {
+		t.Fatal("both views should have last_used_at after touch")
+	}
+	if !bV.LastUsedAt.After(*aV.LastUsedAt) {
+		t.Errorf("b.last_used_at should be after a.last_used_at; a=%v b=%v", aV.LastUsedAt, bV.LastUsedAt)
+	}
+	if mru == nil {
+		t.Error("MostRecentView returned nil even though touches landed")
+	}
+}
+
+func TestViewReorder(t *testing.T) {
+	pool, s := connect(t)
+	defer pool.Close()
+	ctx := context.Background()
+	a := uniqueSlug("p5j-a-reorder-a")
+	b := uniqueSlug("p5j-a-reorder-b")
+	c := uniqueSlug("p5j-a-reorder-c")
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug IN ($1, $2, $3)`, a, b, c)
+
+	for _, slug := range []string{a, b, c} {
+		if _, err := s.CreateView(ctx, store.ViewInput{Slug: slug, Name: slug}); err != nil {
+			t.Fatalf("create %s: %v", slug, err)
+		}
+	}
+	// Reorder c → b → a.
+	if err := s.ReorderViews(ctx, []string{c, b, a}); err != nil {
+		t.Fatalf("reorder: %v", err)
+	}
+	cV, _ := s.GetView(ctx, c)
+	bV, _ := s.GetView(ctx, b)
+	aV, _ := s.GetView(ctx, a)
+	if cV.SortOrder != 0 || bV.SortOrder != 1 || aV.SortOrder != 2 {
+		t.Errorf("reorder yielded sort_orders c=%d b=%d a=%d, want 0,1,2",
+			cV.SortOrder, bV.SortOrder, aV.SortOrder)
+	}
+}

web/admin_test.go

@@ -45,7 +45,7 @@ func TestLayoutHasAdminNavLink(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	for _, path := range []string{"/", "/dashboard", "/graph", "/admin/bulk", "/admin/classify"} {
+	for _, path := range []string{"/views/tree", "/views/dashboard", "/views/graph", "/admin/bulk", "/admin/classify"} {
 		_, body := get(t, h, path)
 		if !strings.Contains(body, `href="/admin"`) {
 			t.Errorf("GET %s: nav missing /admin link", path)

web/bulk.go

@@ -19,7 +19,7 @@ import (
 // matching item, and an action bar that posts to /admin/bulk/apply. The page
 // is intentionally desktop-only — m bulk-edits from a keyboard.
 func (s *Server) handleBulk(w http.ResponseWriter, r *http.Request) {
-	items, err := s.Store.ListAll(r.Context())
+	items, err := s.Items.ListAll(r.Context())
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -29,7 +29,7 @@ func (s *Server) handleBulk(w http.ResponseWriter, r *http.Request) {
 		s.fail(w, r, err)
 		return
 	}
-	allTags, err := s.Store.AllTags(r.Context())
+	allTags, err := s.Items.AllTags(r.Context())
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -377,7 +377,7 @@ func normaliseFormStrings(in []string) []string {
 // the first. Must use the slice form here or the second+ values silently
 // drop on every Apply round-trip.
 func (s *Server) renderBulkList(w http.ResponseWriter, r *http.Request, banner string) {
-	items, err := s.Store.ListAll(r.Context())
+	items, err := s.Items.ListAll(r.Context())
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -387,7 +387,7 @@ func (s *Server) renderBulkList(w http.ResponseWriter, r *http.Request, banner s
 		s.fail(w, r, err)
 		return
 	}
-	allTags, err := s.Store.AllTags(r.Context())
+	allTags, err := s.Items.AllTags(r.Context())
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -445,7 +445,7 @@ func (s *Server) handleBulkChip(w http.ResponseWriter, r *http.Request) {
 		s.fail(w, r, err)
 		return
 	}
-	it, err := s.Store.GetByID(r.Context(), id)
+	it, err := s.Items.GetByID(r.Context(), id)
 	if err != nil {
 		s.fail(w, r, err)
 		return

web/caldav.go

@@ -44,11 +44,11 @@ func (s *Server) buildCalDAVOverview(ctx context.Context) (*CalDAVOverview, erro
 	if err != nil {
 		return nil, fmt.Errorf("caldav list: %w", err)
 	}
-	items, err := s.Store.ListAll(ctx)
+	items, err := s.Items.ListAll(ctx)
 	if err != nil {
 		return nil, err
 	}
-	links, err := s.Store.LinksByRefType(ctx, refTypeCalDAV)
+	links, err := s.Items.LinksByRefType(ctx, refTypeCalDAV)
 	if err != nil {
 		return nil, err
 	}
@@ -194,7 +194,7 @@ func (s *Server) handleCalDAVLinkExisting(w http.ResponseWriter, r *http.Request
 		http.Error(w, "caldav not configured", http.StatusServiceUnavailable)
 		return
 	}
-	it, err := s.Store.GetByPath(r.Context(), path)
+	it, err := s.Items.GetByPath(r.Context(), path)
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -245,7 +245,7 @@ func (s *Server) handleCalDAVCreate(w http.ResponseWriter, r *http.Request, path
 		http.Error(w, "caldav not configured", http.StatusServiceUnavailable)
 		return
 	}
-	it, err := s.Store.GetByPath(r.Context(), path)
+	it, err := s.Items.GetByPath(r.Context(), path)
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -306,7 +306,7 @@ func (s *Server) detailTodos(ctx context.Context, item *store.Item) ([]calendarT
 	if s.CalDAV == nil {
 		return nil, nil
 	}
-	links, err := s.Store.LinksByType(ctx, item.ID, refTypeCalDAV)
+	links, err := s.Items.LinksByType(ctx, item.ID, refTypeCalDAV)
 	if err != nil {
 		return nil, err
 	}
@@ -372,7 +372,7 @@ func (s *Server) handleCalDAVTodoAction(w http.ResponseWriter, r *http.Request,
 		http.Error(w, "caldav not configured", http.StatusServiceUnavailable)
 		return
 	}
-	it, err := s.Store.GetByPath(r.Context(), path)
+	it, err := s.Items.GetByPath(r.Context(), path)
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -388,7 +388,7 @@ func (s *Server) handleCalDAVTodoAction(w http.ResponseWriter, r *http.Request,
 	}
 	// Guard: the calendar URL must be linked to this item — otherwise a
 	// crafted form could route writes to arbitrary calendars.
-	links, err := s.Store.LinksByType(r.Context(), it.ID, refTypeCalDAV)
+	links, err := s.Items.LinksByType(r.Context(), it.ID, refTypeCalDAV)
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -541,7 +541,7 @@ func (s *Server) renderTasksSection(w http.ResponseWriter, r *http.Request, it *
 	// here are non-fatal — degrade to an empty picker.
 	var available []caldav.Calendar
 	if s.CalDAV != nil {
-		caldavLinks, lerr := s.Store.LinksByType(r.Context(), it.ID, refTypeCalDAV)
+		caldavLinks, lerr := s.Items.LinksByType(r.Context(), it.ID, refTypeCalDAV)
 		if lerr != nil {
 			s.Logger.Warn("tasks-section caldav links", "path", it.PrimaryPath(), "err", lerr)
 		}

web/calendar.go

@@ -194,7 +194,7 @@ func (s *Server) handleCalendar(w http.ResponseWriter, r *http.Request) {
 		"Query":             q,
 		"Now":               now,
 		"Projects":          projects,
-		"BasePath":          "/calendar",
+		"BasePath":          "/views/calendar",
 		"ProjectChipTarget": "#calendar-section",
 	}
 	if r.Header.Get("HX-Request") == "true" {
@@ -209,7 +209,7 @@ func (s *Server) handleCalendar(w http.ResponseWriter, r *http.Request) {
 // lead/trail cells), bins them into per-day cells, and caps each cell at
 // calendarMaxRowsPerCell with the overflow count.
 func (s *Server) buildCalendar(ctx context.Context, q calendarQuery, now time.Time) (*calendarPayload, error) {
-	items, err := s.Store.ListAll(ctx)
+	items, err := s.Items.ListAll(ctx)
 	if err != nil {
 		return nil, err
 	}

web/calendar_integration_test.go

@@ -17,7 +17,7 @@ func TestCalendarRendersMonthGrid(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	code, body := get(t, h, "/calendar")
+	code, body := get(t, h, "/views/calendar")
 	if code != 200 {
 		t.Fatalf("GET /calendar → %d body=%s", code, body)
 	}
@@ -27,7 +27,7 @@ func TestCalendarRendersMonthGrid(t *testing.T) {
 		`<th scope="col">Mon</th>`,
 		`<th scope="col">Sun</th>`,
 		`class="calendar-nav"`,
-		`href="/calendar?month=`, // prev/next anchors present
+		`href="/views/calendar?month=`, // prev/next anchors present
 	} {
 		if !strings.Contains(body, want) {
 			t.Errorf("calendar body missing %q", want)
@@ -71,7 +71,7 @@ func TestCalendarSurfacesDatedLink(t *testing.T) {
 		t.Fatalf("seed link: %v", err)
 	}
 
-	code, body := get(t, h, "/calendar")
+	code, body := get(t, h, "/views/calendar")
 	if code != 200 {
 		t.Fatalf("GET /calendar → %d", code)
 	}
@@ -130,7 +130,7 @@ func TestCalendarFilterScopeByTag(t *testing.T) {
 	}
 
 	// Unfiltered: both notes show.
-	_, all := get(t, h, "/calendar?refresh=1")
+	_, all := get(t, h, "/views/calendar?refresh=1")
 	if !strings.Contains(all, workNote) {
 		t.Errorf("unfiltered calendar missing work note %q", workNote)
 	}
@@ -139,7 +139,7 @@ func TestCalendarFilterScopeByTag(t *testing.T) {
 	}
 
 	// Filtered: only work note shows.
-	_, scoped := get(t, h, "/calendar?refresh=1&tag=cal-test-work-"+stamp)
+	_, scoped := get(t, h, "/views/calendar?refresh=1&tag=cal-test-work-"+stamp)
 	if !strings.Contains(scoped, workNote) {
 		t.Errorf("filtered calendar missing work note %q", workNote)
 	}
@@ -157,7 +157,7 @@ func TestCalendarAdjacentMonthDays(t *testing.T) {
 	h := srv.Routes()
 	// Pick a month whose first day is NOT a Monday so leading days appear.
 	// May 2026 starts on a Friday; lead = Apr 27/28/29/30.
-	_, body := get(t, h, "/calendar?month=2026-05&refresh=1")
+	_, body := get(t, h, "/views/calendar?month=2026-05&refresh=1")
 	if !strings.Contains(body, "adjacent-month") {
 		t.Errorf("expected adjacent-month class on lead-in cells for May 2026, body did not include it")
 	}
@@ -173,11 +173,11 @@ func TestCalendarNavPrevNextLinks(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/calendar?month=2026-05")
-	if !strings.Contains(body, `href="/calendar?month=2026-04"`) {
+	_, body := get(t, h, "/views/calendar?month=2026-05")
+	if !strings.Contains(body, `href="/views/calendar?month=2026-04"`) {
 		t.Errorf("expected prev link to 2026-04, body did not include it")
 	}
-	if !strings.Contains(body, `href="/calendar?month=2026-06"`) {
+	if !strings.Contains(body, `href="/views/calendar?month=2026-06"`) {
 		t.Errorf("expected next link to 2026-06, body did not include it")
 	}
 }
@@ -190,11 +190,11 @@ func TestCalendarFilterChipStripRenders(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/calendar?month=2026-05")
+	_, body := get(t, h, "/views/calendar?month=2026-05")
 	for _, want := range []string{
 		`id="calendar-filterbar"`,
 		`hx-target="#calendar-section"`,
-		`hx-get="/calendar"`,
+		`hx-get="/views/calendar"`,
 		`<input type="hidden" name="month" value="2026-05">`, // preserves month across chip changes
 		`name="kind"`,
 		`name="tag"`,
@@ -213,7 +213,7 @@ func TestCalendarHTMXReturnsSectionOnly(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	req := httptest.NewRequest("GET", "/calendar?month=2026-05", nil)
+	req := httptest.NewRequest("GET", "/views/calendar?month=2026-05", nil)
 	req.Header.Set("HX-Request", "true")
 	w := httptest.NewRecorder()
 	h.ServeHTTP(w, req)
@@ -294,7 +294,7 @@ func TestCalendarFilterMultiValueTagsFromForm(t *testing.T) {
 	}
 
 	// HTMX-style multi-value submission: two `tag=` params, not comma-joined.
-	url := "/calendar?refresh=1&tag=" + tagA + "&tag=" + tagB
+	url := "/views/calendar?refresh=1&tag=" + tagA + "&tag=" + tagB
 	_, body := get(t, h, url)
 
 	// Item AB has BOTH tags — must appear.
@@ -322,7 +322,7 @@ func TestCalendarCellCarriesLongLabel(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/calendar?month=2026-05")
+	_, body := get(t, h, "/views/calendar?month=2026-05")
 	// May 4 2026 is a Monday → "Mo., 4. Mai".
 	if !strings.Contains(body, `Mo., 4. Mai`) {
 		t.Errorf("expected long label 'Mo., 4. Mai' for 2026-05-04 cell, body did not include it")

web/calendar_test.go

@@ -201,7 +201,7 @@ func TestFormatMonthLabel(t *testing.T) {
 // month + all-three.
 func TestParseCalendarQueryDefaults(t *testing.T) {
 	now := time.Date(2026, 5, 14, 10, 0, 0, 0, time.UTC)
-	r := httptest.NewRequest("GET", "/calendar", nil)
+	r := httptest.NewRequest("GET", "/views/calendar", nil)
 	q := parseCalendarQuery(r, now)
 	if q.Month.Format("2006-01") != "2026-05" {
 		t.Errorf("default month = %s, want 2026-05", q.Month.Format("2006-01"))
@@ -223,7 +223,7 @@ func TestParseCalendarQueryDefaults(t *testing.T) {
 // nav writes to this exact key.
 func TestParseCalendarQueryMonthParam(t *testing.T) {
 	now := time.Date(2026, 5, 14, 10, 0, 0, 0, time.UTC)
-	r := httptest.NewRequest("GET", "/calendar?month=2026-08", nil)
+	r := httptest.NewRequest("GET", "/views/calendar?month=2026-08", nil)
 	q := parseCalendarQuery(r, now)
 	if q.Month.Format("2006-01") != "2026-08" {
 		t.Errorf("parsed month = %s, want 2026-08", q.Month.Format("2006-01"))
@@ -234,7 +234,7 @@ func TestParseCalendarQueryMonthParam(t *testing.T) {
 // kind set and drops unknown values.
 func TestParseCalendarQueryKindFilter(t *testing.T) {
 	now := time.Date(2026, 5, 14, 10, 0, 0, 0, time.UTC)
-	r := httptest.NewRequest("GET", "/calendar?kind=event,doc,junk,creation", nil)
+	r := httptest.NewRequest("GET", "/views/calendar?kind=event,doc,junk,creation", nil)
 	q := parseCalendarQuery(r, now)
 	got := strings.Join(q.activeKinds(), ",")
 	want := "doc,event" // sorted alphabetically; creation is excluded by design, junk dropped

web/dashboard.go

@@ -233,7 +233,7 @@ func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
 		}
 		refreshQuery += "scope=" + scope
 	}
-	refreshURL := "/dashboard?"
+	refreshURL := "/views/dashboard?"
 	if refreshQuery != "" {
 		refreshURL += refreshQuery + "&"
 	}
@@ -256,7 +256,7 @@ func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
 		"RefreshURL":        refreshURL,
 		"FilterActive":      filter.Active(),
 		"Projects":          projects,
-		"BasePath":          "/dashboard",
+		"BasePath":          "/views/dashboard",
 		"ProjectChipTarget": "#dashboard-section",
 	}
 	if r.Header.Get("HX-Request") == "true" {
@@ -304,9 +304,9 @@ func dashboardScopeToggleURL(view, scope, filterKey string) string {
 		parts = append(parts, "scope="+next)
 	}
 	if len(parts) == 0 {
-		return "/dashboard"
+		return "/views/dashboard"
 	}
-	return "/dashboard?" + strings.Join(parts, "&")
+	return "/views/dashboard?" + strings.Join(parts, "&")
 }
 
 // dashboardTab is a single entry in the view-switcher strip.
@@ -322,7 +322,7 @@ type dashboardTab struct {
 // scope (current) elide from the URL so the address bar stays clean
 // on the daily-driver path.
 func dashboardTabs(active, filterKey, scope string) []dashboardTab {
-	prefix := "/dashboard"
+	prefix := "/views/dashboard"
 	filterQuery := ""
 	if filterKey != "__empty__" && filterKey != "" {
 		filterQuery = filterKey
@@ -357,7 +357,7 @@ func dashboardTabs(active, filterKey, scope string) []dashboardTab {
 // shapes AND the new per-project rollup so the rollup costs zero extra
 // DAV/Gitea calls.
 func (s *Server) buildDashboard(ctx context.Context, filter TreeFilter) (*dashboardPayload, error) {
-	items, err := s.Store.ListAll(ctx)
+	items, err := s.Items.ListAll(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -422,7 +422,7 @@ func (s *Server) buildDashboard(ctx context.Context, filter TreeFilter) (*dashbo
 
 	// --- Recent documents card ---
 	since := now.AddDate(0, 0, -30)
-	docRows, err := s.Store.RecentDocuments(ctx, since, 200)
+	docRows, err := s.Items.RecentDocuments(ctx, since, 200)
 	if err != nil {
 		s.Logger.Warn("dashboard docs", "err", err)
 	}
@@ -486,7 +486,7 @@ func (s *Server) collectStale(ctx context.Context, items []*store.Item, openTask
 		if openTasks[it.ID] > 0 || openIssues[it.ID] > 0 {
 			continue
 		}
-		links, err := s.Store.LinksByType(ctx, it.ID, refTypeGiteaRepo)
+		links, err := s.Items.LinksByType(ctx, it.ID, refTypeGiteaRepo)
 		if err != nil || len(links) == 0 {
 			continue
 		}
@@ -868,7 +868,7 @@ func (s *Server) dashboardTaskWrite(w http.ResponseWriter, r *http.Request, acti
 // pointing at the given URL. Used as the dashboard's write-side ownership
 // guard.
 func (s *Server) calendarLinked(ctx context.Context, calURL string) (bool, error) {
-	links, err := s.Store.LinksByRefType(ctx, refTypeCalDAV)
+	links, err := s.Items.LinksByRefType(ctx, refTypeCalDAV)
 	if err != nil {
 		return false, err
 	}

web/dashboard_edit_test.go

@@ -70,9 +70,9 @@ END:VCALENDAR`
 
 	h := srv.Routes()
 	// Inline VTODO writeback rows live on the Tasks tab (Phase 5h).
-	code, body := get(t, h, "/dashboard?view=tasks")
+	code, body := get(t, h, "/views/dashboard?view=tasks")
 	if code != 200 {
-		t.Fatalf("GET /dashboard?view=tasks → %d", code)
+		t.Fatalf("GET /views/dashboard?view=tasks → %d", code)
 	}
 	for _, want := range []string{
 		`Edit me please`,

web/dashboard_events_test.go

@@ -70,9 +70,9 @@ func TestDashboardEventsCardSurfacesUpcoming(t *testing.T) {
 
 	h := srv.Routes()
 	// The card-events markup lives on the Tasks tab (Phase 5h).
-	code, body := get(t, h, "/dashboard?view=tasks")
+	code, body := get(t, h, "/views/dashboard?view=tasks")
 	if code != 200 {
-		t.Fatalf("GET /dashboard?view=tasks → %d", code)
+		t.Fatalf("GET /views/dashboard?view=tasks → %d", code)
 	}
 	for _, want := range []string{
 		`card-events`,
@@ -106,7 +106,7 @@ func TestDashboardEventsCardCollapsesWhenEmpty(t *testing.T) {
 	srv.CalDAV = &web.CalDAVDeps{Client: caldav.New(fake.URL+"/", "u", "p")}
 
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard?view=tasks")
+	_, body := get(t, h, "/views/dashboard?view=tasks")
 	if !strings.Contains(body, "No upcoming events") {
 		t.Errorf("expected collapsed Events card with 'No upcoming events' note")
 	}

web/dashboard_pin_test.go

@@ -49,7 +49,7 @@ func TestDashboardPinTogglesItem(t *testing.T) {
 	}
 
 	// The re-render should mark the tile as .tile-pinned.
-	_, body := get(t, h, "/dashboard")
+	_, body := get(t, h, "/views/dashboard")
 	tileIdx := strings.Index(body, `data-item-id="`+id+`"`)
 	if tileIdx < 0 {
 		t.Fatalf("pinned tile not found in re-render")
@@ -141,7 +141,7 @@ func TestDashboardPinInvalidatesCache(t *testing.T) {
 	defer pool.Exec(context.Background(), `delete from projax.items where id=$1`, id)
 
 	// Prime the cache — first GET caches an unpinned tile state.
-	_, primed := get(t, h, "/dashboard")
+	_, primed := get(t, h, "/views/dashboard")
 	tileIdx := strings.Index(primed, `data-item-id="`+id+`"`)
 	if tileIdx < 0 {
 		t.Fatalf("seeded tile missing from primed dashboard")
@@ -157,7 +157,7 @@ func TestDashboardPinInvalidatesCache(t *testing.T) {
 
 	// Next GET must reflect the new pinned state — proves the cache
 	// entry for the previous (unpinned) state was invalidated.
-	_, after := get(t, h, "/dashboard")
+	_, after := get(t, h, "/views/dashboard")
 	tileIdx2 := strings.Index(after, `data-item-id="`+id+`"`)
 	if tileIdx2 < 0 {
 		t.Fatalf("tile missing from post-pin dashboard")

web/dashboard_test.go

@@ -23,7 +23,7 @@ func TestDashboardRendersWithoutDeps(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	code, body := get(t, h, "/dashboard?view=tasks")
+	code, body := get(t, h, "/views/dashboard?view=tasks")
 	if code != 200 {
 		t.Fatalf("GET /dashboard?view=tasks → %d body=%s", code, body)
 	}
@@ -77,7 +77,7 @@ func TestDashboardRecentDocsSurfacesDatedLinks(t *testing.T) {
 	}
 
 	// The Recent Documents card lives on the Tasks tab (Phase 5h).
-	code, body := get(t, h, "/dashboard?view=tasks")
+	code, body := get(t, h, "/views/dashboard?view=tasks")
 	if code != 200 {
 		t.Fatalf("GET /dashboard?view=tasks → %d", code)
 	}
@@ -134,7 +134,7 @@ func TestDashboardFilterByTagNarrowsCard(t *testing.T) {
 	}()
 
 	// Doc rows surface on the Tasks tab; the filter narrows both views.
-	code, body := get(t, h, "/dashboard?tag=dev&view=tasks")
+	code, body := get(t, h, "/views/dashboard?tag=dev&view=tasks")
 	if code != 200 {
 		t.Fatalf("GET /dashboard?tag=dev&view=tasks → %d", code)
 	}
@@ -159,9 +159,9 @@ func TestDashboardRefreshBustsCache(t *testing.T) {
 	h := srv.Routes()
 
 	// Prime the cache.
-	_, _ = get(t, h, "/dashboard")
+	_, _ = get(t, h, "/views/dashboard")
 	// Second hit shows cached label.
-	_, cachedBody := get(t, h, "/dashboard")
+	_, cachedBody := get(t, h, "/views/dashboard")
 	if !strings.Contains(cachedBody, "cached") {
 		n := len(cachedBody)
 		if n > 600 {
@@ -170,7 +170,7 @@ func TestDashboardRefreshBustsCache(t *testing.T) {
 		t.Fatalf("setup: second load should be cached, got body:\n%s", cachedBody[:n])
 	}
 	// Third hit with ?refresh=1 should be fresh again.
-	code, body := get(t, h, "/dashboard?refresh=1")
+	code, body := get(t, h, "/views/dashboard?refresh=1")
 	if code != 200 {
 		t.Fatalf("GET /dashboard?refresh=1 → %d", code)
 	}
@@ -190,7 +190,7 @@ func TestDashboardCollapsesEmptyCardsWhenNoFilter(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	code, body := get(t, h, "/dashboard?view=tasks")
+	code, body := get(t, h, "/views/dashboard?view=tasks")
 	if code != 200 {
 		t.Fatalf("GET /dashboard?view=tasks → %d", code)
 	}
@@ -210,7 +210,7 @@ func TestDashboardFilterKeepsFullCardChrome(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	code, body := get(t, h, "/dashboard?tag=nothing-matches-zzz&view=tasks")
+	code, body := get(t, h, "/views/dashboard?tag=nothing-matches-zzz&view=tasks")
 	if code != 200 {
 		t.Fatalf("GET /dashboard?tag=… → %d", code)
 	}
@@ -271,7 +271,7 @@ func TestDashboardStaleCardSurfacesDormantMaiProject(t *testing.T) {
 	h := srv.Routes()
 	// Phase 5h: the Stale card retired. The stale project now appears
 	// inside the Tiles Quiet fold with a tile-stale flag on the tile.
-	code, body := get(t, h, "/dashboard")
+	code, body := get(t, h, "/views/dashboard")
 	if code != 200 {
 		t.Fatalf("GET /dashboard → %d", code)
 	}
@@ -335,7 +335,7 @@ func TestDashboardStaleCardSkipsRecentRepo(t *testing.T) {
 	// Phase 5h: assert the tile for this slug is NOT flagged stale.
 	// Recent repo activity (3d old) puts it solidly inside the activity
 	// window AND fails the staleness probe, so no tile-stale class.
-	_, body := get(t, h, "/dashboard")
+	_, body := get(t, h, "/views/dashboard")
 	// Find the tile for this slug and check its class attribute.
 	marker := `data-item-path="dev.` + slug + `"`
 	idx := strings.Index(body, marker)
@@ -362,8 +362,8 @@ func TestDashboardCacheHitOnSecondLoad(t *testing.T) {
 	defer pool.Close()
 	h := srv.Routes()
 
-	_, _ = get(t, h, "/dashboard")
-	code, body := get(t, h, "/dashboard")
+	_, _ = get(t, h, "/views/dashboard")
+	code, body := get(t, h, "/views/dashboard")
 	if code != 200 {
 		t.Fatalf("second GET /dashboard → %d", code)
 	}

web/dashboard_view_test.go

@@ -13,7 +13,7 @@ func TestDashboardDefaultViewIsTiles(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	code, body := get(t, h, "/dashboard")
+	code, body := get(t, h, "/views/dashboard")
 	if code != 200 {
 		t.Fatalf("GET /dashboard → %d", code)
 	}
@@ -36,9 +36,9 @@ func TestDashboardTabsRenderAllThree(t *testing.T) {
 		activeTab  string
 		activeLabel string
 	}{
-		{"/dashboard", "tiles", "Tiles"},
-		{"/dashboard?view=tasks", "tasks", "Tasks"},
-		{"/dashboard?view=events", "events", "Events"},
+		{"/views/dashboard", "tiles", "Tiles"},
+		{"/views/dashboard?view=tasks", "tasks", "Tasks"},
+		{"/views/dashboard?view=events", "events", "Events"},
 	}
 	for _, c := range cases {
 		t.Run(c.activeTab, func(t *testing.T) {
@@ -80,7 +80,7 @@ func TestDashboardTasksViewFallback(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard?view=tasks")
+	_, body := get(t, h, "/views/dashboard?view=tasks")
 	if strings.Contains(body, `class="dash-tiles"`) {
 		t.Errorf("view=tasks should NOT render the Tiles grid")
 	}
@@ -99,7 +99,7 @@ func TestDashboardEventsViewRenders(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard?view=events")
+	_, body := get(t, h, "/views/dashboard?view=events")
 	if !strings.Contains(body, `class="dash-events-view"`) {
 		t.Errorf("view=events should render the promoted Events surface")
 	}
@@ -120,7 +120,7 @@ func TestDashboardUnknownViewFallsBackToTiles(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	code, body := get(t, h, "/dashboard?view=gibberish")
+	code, body := get(t, h, "/views/dashboard?view=gibberish")
 	if code != 200 {
 		t.Fatalf("GET /dashboard?view=gibberish → %d", code)
 	}
@@ -155,7 +155,7 @@ func TestDashboardTilesViewShowsRollupForSeededItem(t *testing.T) {
 	}
 	defer pool.Exec(context.Background(), `delete from projax.items where id=$1`, id)
 
-	code, body := get(t, h, "/dashboard")
+	code, body := get(t, h, "/views/dashboard")
 	if code != 200 {
 		t.Fatalf("GET /dashboard → %d", code)
 	}
@@ -172,19 +172,19 @@ func TestDashboardTilesViewShowsRollupForSeededItem(t *testing.T) {
 // TestDashboardCacheKeySeparatesViews ensures the cache layer keys by
 // (filter, view): the same filter under different views must hit
 // independent cache entries. We prove this by priming /dashboard, then
-// /dashboard?view=tasks, and asserting both report "fresh" on their
+// /views/dashboard?view=tasks, and asserting both report "fresh" on their
 // first call (i.e. they don't share a cache slot).
 func TestDashboardCacheKeySeparatesViews(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body1 := get(t, h, "/dashboard")
+	_, body1 := get(t, h, "/views/dashboard")
 	if !strings.Contains(body1, "fresh") {
 		t.Fatalf("first /dashboard load should be fresh")
 	}
-	_, body2 := get(t, h, "/dashboard?view=tasks")
+	_, body2 := get(t, h, "/views/dashboard?view=tasks")
 	if !strings.Contains(body2, "fresh") {
-		t.Errorf("first /dashboard?view=tasks load should be fresh — sharing a cache slot with Tiles would mark it cached")
+		t.Errorf("first /views/dashboard?view=tasks load should be fresh — sharing a cache slot with Tiles would mark it cached")
 	}
 }
 
@@ -195,18 +195,18 @@ func TestDashboardScopeChipRendersOnTilesOnly(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, tiles := get(t, h, "/dashboard")
+	_, tiles := get(t, h, "/views/dashboard")
 	if !strings.Contains(tiles, `class="dash-scope-chip"`) {
 		t.Errorf("Tiles view should render the scope chip")
 	}
 	if !strings.Contains(tiles, "◇ current") {
 		t.Errorf("default scope chip should show '◇ current'")
 	}
-	_, tasks := get(t, h, "/dashboard?view=tasks")
+	_, tasks := get(t, h, "/views/dashboard?view=tasks")
 	if strings.Contains(tasks, `class="dash-scope-chip"`) {
 		t.Errorf("Tasks view should NOT render the scope chip")
 	}
-	_, events := get(t, h, "/dashboard?view=events")
+	_, events := get(t, h, "/views/dashboard?view=events")
 	if strings.Contains(events, `class="dash-scope-chip"`) {
 		t.Errorf("Events view should NOT render the scope chip")
 	}
@@ -218,7 +218,7 @@ func TestDashboardScopeAllChipFlipsLabel(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard?scope=all")
+	_, body := get(t, h, "/views/dashboard?scope=all")
 	if !strings.Contains(body, "○ all") {
 		t.Errorf("scope=all should render '○ all' chip label")
 	}
@@ -234,7 +234,7 @@ func TestDashboardScopeAllHidesQuietFold(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard?scope=all")
+	_, body := get(t, h, "/views/dashboard?scope=all")
 	if strings.Contains(body, `class="dash-quiet"`) {
 		t.Errorf("scope=all should NOT render the Quiet fold — everything is in the primary grid")
 	}
@@ -246,12 +246,12 @@ func TestDashboardScopeChipURLFlips(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, defaultBody := get(t, h, "/dashboard")
-	if !strings.Contains(defaultBody, `href="/dashboard?scope=all"`) {
+	_, defaultBody := get(t, h, "/views/dashboard")
+	if !strings.Contains(defaultBody, `href="/views/dashboard?scope=all"`) {
 		t.Errorf("default scope chip should link to ?scope=all")
 	}
-	_, allBody := get(t, h, "/dashboard?scope=all")
-	if !strings.Contains(allBody, `href="/dashboard"`) {
+	_, allBody := get(t, h, "/views/dashboard?scope=all")
+	if !strings.Contains(allBody, `href="/views/dashboard"`) {
 		t.Errorf("scope=all chip should link back to /dashboard (scope=current is default+elided)")
 	}
 }

web/gitea.go

@@ -162,7 +162,7 @@ func (s *Server) detailIssues(ctx context.Context, item *store.Item) ([]repoIssu
 	if s.Gitea == nil {
 		return nil, nil
 	}
-	links, err := s.Store.LinksByType(ctx, item.ID, refTypeGiteaRepo)
+	links, err := s.Items.LinksByType(ctx, item.ID, refTypeGiteaRepo)
 	if err != nil {
 		return nil, err
 	}

web/gitea_writeback.go

@@ -22,7 +22,7 @@ func (s *Server) handleIssueAction(w http.ResponseWriter, r *http.Request, path,
 		http.Error(w, "gitea not configured", http.StatusServiceUnavailable)
 		return
 	}
-	it, err := s.Store.GetByPath(r.Context(), path)
+	it, err := s.Items.GetByPath(r.Context(), path)
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -135,7 +135,7 @@ func (s *Server) renderIssuesSection(w http.ResponseWriter, r *http.Request, it
 // to this item via a gitea-repo item_link. Prevents form-crafted writeback
 // against unrelated repos.
 func (s *Server) repoLinkedToItem(ctx context.Context, itemID, repoRef string) bool {
-	links, err := s.Store.LinksByType(ctx, itemID, refTypeGiteaRepo)
+	links, err := s.Items.LinksByType(ctx, itemID, refTypeGiteaRepo)
 	if err != nil {
 		return false
 	}

web/graph.go

@@ -41,7 +41,7 @@ type graphPayload struct {
 }
 
 func (s *Server) handleGraph(w http.ResponseWriter, r *http.Request) {
-	items, err := s.Store.ListAll(r.Context())
+	items, err := s.Items.ListAll(r.Context())
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -51,7 +51,7 @@ func (s *Server) handleGraph(w http.ResponseWriter, r *http.Request) {
 		s.fail(w, r, err)
 		return
 	}
-	allTags, err := s.Store.AllTags(r.Context())
+	allTags, err := s.Items.AllTags(r.Context())
 	if err != nil {
 		s.fail(w, r, err)
 		return

web/graph_test.go

@@ -16,7 +16,7 @@ func TestGraphPageRenders(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	code, body := get(t, h, "/graph")
+	code, body := get(t, h, "/views/graph")
 	if code != 200 {
 		t.Fatalf("GET /graph → %d body=%s", code, body)
 	}
@@ -42,7 +42,7 @@ func TestGraphFilterDimsNonMatching(t *testing.T) {
 	h := srv.Routes()
 
 	// Use a definitely-unused tag to force every node to mismatch.
-	code, body := get(t, h, "/graph?tag=ZZZZ-unused-tag")
+	code, body := get(t, h, "/views/graph?tag=ZZZZ-unused-tag")
 	if code != 200 {
 		t.Fatalf("GET /graph?tag=ZZZ → %d", code)
 	}
@@ -83,7 +83,7 @@ func TestGraphIsolateHidesNonMatching(t *testing.T) {
 	}
 	defer pool.Exec(context.Background(), `delete from projax.items where id=$1`, id)
 
-	code, body := get(t, h, "/graph?tag="+tag+"&isolate=1")
+	code, body := get(t, h, "/views/graph?tag="+tag+"&isolate=1")
 	if code != 200 {
 		t.Fatalf("GET /graph?isolate → %d", code)
 	}
@@ -102,7 +102,7 @@ func TestGraphSVGDownload(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	req := httptest.NewRequest(http.MethodGet, "/graph?download=svg", nil)
+	req := httptest.NewRequest(http.MethodGet, "/views/graph?download=svg", nil)
 	w := httptest.NewRecorder()
 	h.ServeHTTP(w, req)
 	if w.Result().StatusCode != 200 {

web/icons.go

@@ -0,0 +1,43 @@
+package web
+
+import "html/template"
+
+// Phase 5j slice G — icon registry per m's Q6 pick (2026-05-29). The
+// curated set of keys mirrors the editor's <select> options so the round-
+// trip works: editor save persists the key string, layout renders the SVG
+// at look-up time. Unknown / empty keys fall back to the default folder
+// glyph.
+//
+// Stored as html/template.HTML so layout.tmpl can emit the markup
+// directly without html-escaping the angle brackets. Each SVG is sized
+// to 18px square and inherits currentColor like the existing nav-icon
+// glyphs.
+
+var iconRegistry = map[string]template.HTML{
+	"folder":    template.HTML(`<svg class="nav-icon user-view-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"/></svg>`),
+	"clock":     template.HTML(`<svg class="nav-icon user-view-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="10"/><polyline points="12 6 12 12 16 14"/></svg>`),
+	"star":      template.HTML(`<svg class="nav-icon user-view-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polygon points="12 2 15.09 8.26 22 9.27 17 14.14 18.18 21.02 12 17.77 5.82 21.02 7 14.14 2 9.27 8.91 8.26 12 2"/></svg>`),
+	"tag":       template.HTML(`<svg class="nav-icon user-view-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20.59 13.41 13.42 20.58a2 2 0 0 1-2.83 0L2 12V2h10l8.59 8.59a2 2 0 0 1 0 2.82z"/><line x1="7" y1="7" x2="7.01" y2="7"/></svg>`),
+	"inbox":     template.HTML(`<svg class="nav-icon user-view-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="22 12 16 12 14 15 10 15 8 12 2 12"/><path d="M5.45 5.11 2 12v6a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-6l-3.45-6.89A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z"/></svg>`),
+	"box":       template.HTML(`<svg class="nav-icon user-view-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21 8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"/><polyline points="3.27 6.96 12 12.01 20.73 6.96"/><line x1="12" y1="22.08" x2="12" y2="12"/></svg>`),
+	"file-text": template.HTML(`<svg class="nav-icon user-view-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="16" y1="13" x2="8" y2="13"/><line x1="16" y1="17" x2="8" y2="17"/></svg>`),
+}
+
+// RenderViewIcon returns the SVG for an icon key, falling back to the
+// folder default for nil or unknown keys. Template-callable so
+// layout.tmpl can emit `{{renderIcon .Icon}}`.
+func RenderViewIcon(icon *string) template.HTML {
+	key := "folder"
+	if icon != nil && *icon != "" {
+		if _, ok := iconRegistry[*icon]; ok {
+			key = *icon
+		}
+	}
+	return iconRegistry[key]
+}
+
+// IconRegistryKeys returns the available icon keys in display order, for
+// the editor's <select>. The first key (folder) is the default.
+func IconRegistryKeys() []string {
+	return []string{"folder", "clock", "star", "tag", "inbox", "box", "file-text"}
+}

web/layout_test.go

@@ -13,18 +13,18 @@ func TestLayoutSidebarOnDesktop(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard")
+	_, body := get(t, h, "/views/dashboard")
 	if !strings.Contains(body, `<aside class="projax-sidebar"`) {
 		t.Fatalf("expected <aside class=\"projax-sidebar\"> in body, got: %s", truncate(body, 400))
 	}
 	for _, want := range []struct {
 		href, label string
 	}{
-		{`/`, "Tree"},
-		{`/dashboard`, "Dashboard"},
-		{`/calendar`, "Calendar"},
-		{`/timeline`, "Timeline"},
-		{`/graph`, "Graph"},
+		{`/views/tree`, "Tree"},
+		{`/views/dashboard`, "Dashboard"},
+		{`/views/calendar`, "Calendar"},
+		{`/views/timeline`, "Timeline"},
+		{`/views/graph`, "Graph"},
 		{`/admin`, "Admin"},
 	} {
 		if !strings.Contains(body, `href="`+want.href+`"`) {
@@ -43,12 +43,12 @@ func TestLayoutActiveClass(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard")
+	_, body := get(t, h, "/views/dashboard")
 	// Dashboard item should be active.
 	if !strings.Contains(body, `class="nav-item active" title="Dashboard"`) {
 		t.Errorf("expected Dashboard nav-item to carry .active on /dashboard, body: %s", truncate(body, 400))
 	}
-	// Tree item (href="/") must NOT be active on the /dashboard page.
+	// Tree item (href="/views/tree") must NOT be active on the /dashboard page.
 	// The Tree anchor opens with the exact-path active match; on /dashboard
 	// the substring `class="nav-item" title="Tree"` should be present and
 	// not its `active` sibling.
@@ -68,7 +68,7 @@ func TestLayoutCollapseScript(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard")
+	_, body := get(t, h, "/views/dashboard")
 	// Pre-paint restore script.
 	if !strings.Contains(body, `localStorage.getItem('projax.sidebar.collapsed')`) {
 		t.Errorf("expected pre-paint localStorage restore script in layout")
@@ -93,7 +93,7 @@ func TestLayoutNoTopHeader(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard")
+	_, body := get(t, h, "/views/dashboard")
 	// Slice out the region between <body> and <main> — that's where the
 	// pre-5g top header lived. Inside <main> belongs to content templates.
 	chrome := body
@@ -116,17 +116,17 @@ func TestLayoutBottomNavMarkup(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard")
+	_, body := get(t, h, "/views/dashboard")
 	if !strings.Contains(body, `<nav class="projax-bottom-nav"`) {
 		t.Fatalf("expected <nav class=\"projax-bottom-nav\"> in body, got: %s", truncate(body, 400))
 	}
 	// 5-slot anchors / details element.
 	for _, want := range []string{
-		`<a href="/" class="bottom-nav-item`,
-		`<a href="/dashboard" class="bottom-nav-item`,
+		`<a href="/views/tree" class="bottom-nav-item`,
+		`<a href="/views/dashboard" class="bottom-nav-item`,
 		`<a href="/new" class="bottom-nav-item capture-btn"`,
 		`class="capture-circle"`,
-		`<a href="/calendar" class="bottom-nav-item`,
+		`<a href="/views/calendar" class="bottom-nav-item`,
 		`<details class="projax-mobile-drawer"`,
 	} {
 		if !strings.Contains(body, want) {
@@ -135,8 +135,8 @@ func TestLayoutBottomNavMarkup(t *testing.T) {
 	}
 	// Drawer overflow items: Timeline, Graph, Admin, theme toggle, sign-out.
 	for _, want := range []string{
-		`<a href="/timeline" class="drawer-item`,
-		`<a href="/graph" class="drawer-item`,
+		`<a href="/views/timeline" class="drawer-item`,
+		`<a href="/views/graph" class="drawer-item`,
 		`<a href="/admin" class="drawer-item`,
 		`id="theme-toggle-drawer"`,
 		`<form method="post" action="/logout" class="drawer-form">`,
@@ -154,11 +154,11 @@ func TestLayoutBottomNavActiveClass(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/calendar")
-	if !strings.Contains(body, `<a href="/calendar" class="bottom-nav-item active"`) {
+	_, body := get(t, h, "/views/calendar")
+	if !strings.Contains(body, `<a href="/views/calendar" class="bottom-nav-item active"`) {
 		t.Errorf("expected Calendar bottom-nav-item to carry .active on /calendar")
 	}
-	if strings.Contains(body, `<a href="/" class="bottom-nav-item active"`) {
+	if strings.Contains(body, `<a href="/views/tree" class="bottom-nav-item active"`) {
 		t.Errorf("Tree bottom-nav-item should NOT be active on /calendar")
 	}
 }
@@ -171,7 +171,7 @@ func TestLayoutThemeToggleBoundToBothButtons(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard")
+	_, body := get(t, h, "/views/dashboard")
 	// Both buttons present.
 	if !strings.Contains(body, `id="theme-toggle"`) {
 		t.Errorf("sidebar theme-toggle button missing")

web/links.go

@@ -15,7 +15,7 @@ import (
 // note, event_date (YYYY-MM-DD). Anti-forgery isn't a concern at v1 since the
 // trust model is Tailscale-only + cookie auth.
 func (s *Server) handleLinksAdd(w http.ResponseWriter, r *http.Request, path string) {
-	it, err := s.Store.GetByPath(r.Context(), path)
+	it, err := s.Items.GetByPath(r.Context(), path)
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -57,7 +57,7 @@ func (s *Server) handleLinksAdd(w http.ResponseWriter, r *http.Request, path str
 
 // handleLinksRemove processes POST /i/{path}/links/remove.
 func (s *Server) handleLinksRemove(w http.ResponseWriter, r *http.Request, path string) {
-	it, err := s.Store.GetByPath(r.Context(), path)
+	it, err := s.Items.GetByPath(r.Context(), path)
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -106,7 +106,7 @@ func (s *Server) renderDocumentsSection(w http.ResponseWriter, r *http.Request,
 		http.Redirect(w, r, "/i/"+it.PrimaryPath()+"#documents-section", http.StatusSeeOther)
 		return
 	}
-	docs, err := s.Store.DatedLinks(r.Context(), it.ID)
+	docs, err := s.Items.DatedLinks(r.Context(), it.ID)
 	if err != nil {
 		s.fail(w, r, err)
 		return

web/public_listing_test.go

@@ -245,14 +245,14 @@ func TestTreeFilterPublicNarrows(t *testing.T) {
 	// filter.
 	pubLink := `href="/i/dev.` + pubSlug + `"`
 	prvLink := `href="/i/dev.` + prvSlug + `"`
-	_, yesBody := get(t, h, "/?public=1")
+	_, yesBody := get(t, h, "/views/tree?public=1")
 	if !strings.Contains(yesBody, pubLink) {
 		t.Errorf("?public=1 should show pub-filt-yes row")
 	}
 	if strings.Contains(yesBody, prvLink) {
 		t.Errorf("?public=1 should hide pub-filt-no row")
 	}
-	_, noBody := get(t, h, "/?public=0")
+	_, noBody := get(t, h, "/views/tree?public=0")
 	if strings.Contains(noBody, pubLink) {
 		t.Errorf("?public=0 should hide pub-filt-yes row")
 	}

web/pwa_test.go

@@ -81,7 +81,7 @@ func TestLayoutHasManifestAndAppleTouchIcon(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard")
+	_, body := get(t, h, "/views/dashboard")
 	for _, want := range []string{
 		`rel="manifest"`,
 		`/static/manifest.webmanifest`,

web/server.go

@@ -75,7 +75,13 @@ var staticFS embed.FS
 
 // Server bundles handlers, templates, and the store.
 type Server struct {
-	Store       *store.Store
+	Store *store.Store
+	// Items is the read-path adapter every UI handler / MCP read tool /
+	// aggregator depends on. Phase 6 Slice B introduces it: today the
+	// concrete *Store satisfies the ItemReader interface (legacy path);
+	// after the mBrian backend rollout PROJAX_BACKEND=mbrian wires
+	// *store.MBrianReader here. Writes still flow through Store.
+	Items       store.ItemReader
 	pages       map[string]*template.Template
 	Logger      *slog.Logger
 	Auth        *AuthConfig // nil → no auth (local dev / tests)
@@ -133,6 +139,10 @@ func New(s *store.Store, logger *slog.Logger) (*Server, error) {
 		"addF": func(a, b any) float64 { return toFloat(a) + toFloat(b) },
 		"subF": func(a, b any) float64 { return toFloat(a) - toFloat(b) },
 		"mulF": func(a, b any) float64 { return toFloat(a) * toFloat(b) },
+		// Phase 5j slice G — sidebar icon registry. layout.tmpl calls
+		// `renderIcon .View.Icon` to emit the matching SVG, falling back to
+		// the folder default for nil / unknown keys.
+		"renderIcon": RenderViewIcon,
 		"tagToggleURL": func(active []string, tag string, isActive bool) string {
 			next := []string{}
 			if isActive {
@@ -152,7 +162,7 @@ func New(s *store.Store, logger *slog.Logger) (*Server, error) {
 		},
 	}
 	pages := map[string]*template.Template{}
-	for _, name := range []string{"new", "classify", "caldav_admin", "caldav_disabled", "error", "views", "view_edit"} {
+	for _, name := range []string{"new", "classify", "caldav_admin", "caldav_disabled", "error", "views_landing", "view_editor"} {
 		t, err := template.New(name).Funcs(funcs).ParseFS(templatesFS,
 			"templates/layout.tmpl",
 			"templates/"+name+".tmpl",
@@ -189,6 +199,21 @@ func New(s *store.Store, logger *slog.Logger) (*Server, error) {
 		return nil, fmt.Errorf("parse tree_section: %w", err)
 	}
 	pages["tree_section"] = treeSection
+	// Phase 5j view-render template bundles the tree-section partials so a
+	// rendered view at /views/{slug} can use the same dispatch (list / card
+	// / kanban via .ViewType).
+	viewRender, err := template.New("view_render").Funcs(funcs).ParseFS(templatesFS,
+		"templates/layout.tmpl",
+		"templates/view_render.tmpl",
+		"templates/tree_section.tmpl",
+		"templates/tree_card.tmpl",
+		"templates/tree_kanban.tmpl",
+		"templates/project_chip.tmpl",
+	)
+	if err != nil {
+		return nil, fmt.Errorf("parse view_render: %w", err)
+	}
+	pages["view_render"] = viewRender
 	// detail bundles the shared tasks-section + issues-section partials so
 	// HTMX swaps and the initial page render hit the same template definitions.
 	detailTmpl, err := template.New("detail").Funcs(funcs).ParseFS(templatesFS,
@@ -348,7 +373,10 @@ func New(s *store.Store, logger *slog.Logger) (*Server, error) {
 	pages["bulk_chip_mgmt"] = bulkChipMgmt
 
 	return &Server{
-		Store:       s,
+		Store: s,
+		// Default Items satisfier is *Store itself. main.go can override
+		// post-construction (e.g. PROJAX_BACKEND=mbrian → MBrianReader).
+		Items:       s,
 		pages:       pages,
 		Logger:      logger,
 		dashboard:   cache.NewTTL[*dashboardPayload](dashboardCacheTTL),
@@ -362,17 +390,26 @@ func New(s *store.Store, logger *slog.Logger) (*Server, error) {
 func (s *Server) Routes() http.Handler {
 	mux := http.NewServeMux()
 
-	mux.HandleFunc("GET /", s.handleTree)
+	// Phase 5j slice C — full URL migration. The five legacy pages live at
+	// /views/{system-slug} now; the old top-level URLs 301-redirect to
+	// their new home (with the legacy ?view=<uuid> param resolved through
+	// the old uuid → new slug if it still maps to a row).
+	mux.HandleFunc("GET /views/tree", s.handleTree)
+	mux.HandleFunc("GET /views/dashboard", s.handleDashboard)
+	mux.HandleFunc("GET /views/timeline", s.handleTimeline)
+	mux.HandleFunc("GET /views/calendar", s.handleCalendar)
+	mux.HandleFunc("GET /views/graph", s.handleGraph)
+	mux.HandleFunc("GET /", s.legacyRedirect("tree"))
+	mux.HandleFunc("GET /dashboard", s.legacyRedirect("dashboard"))
+	mux.HandleFunc("GET /timeline", s.legacyRedirect("timeline"))
+	mux.HandleFunc("GET /calendar", s.legacyRedirect("calendar"))
+	mux.HandleFunc("GET /graph", s.legacyRedirect("graph"))
 	mux.HandleFunc("GET /i/", s.handleDetail)
 	mux.HandleFunc("POST /i/", s.handleDetailWrite)
 	mux.HandleFunc("GET /new", s.handleNewForm)
 	mux.HandleFunc("POST /new", s.handleNewSubmit)
 	mux.HandleFunc("GET /admin", s.handleAdminIndex)
 	mux.HandleFunc("GET /admin/classify", s.handleClassify)
-	mux.HandleFunc("GET /dashboard", s.handleDashboard)
-	mux.HandleFunc("GET /timeline", s.handleTimeline)
-	mux.HandleFunc("GET /calendar", s.handleCalendar)
-	mux.HandleFunc("GET /graph", s.handleGraph)
 	mux.HandleFunc("POST /dashboard/task/done", s.handleDashboardTaskDone)
 	mux.HandleFunc("POST /dashboard/task/edit", s.handleDashboardTaskEdit)
 	mux.HandleFunc("POST /dashboard/task/delete", s.handleDashboardTaskDelete)
@@ -383,11 +420,18 @@ func (s *Server) Routes() http.Handler {
 	mux.HandleFunc("GET /admin/caldav", s.handleCalDAVAdmin)
 	mux.HandleFunc("POST /admin/caldav/link", s.handleCalDAVLink)
 	mux.HandleFunc("POST /admin/caldav/unlink", s.handleCalDAVUnlink)
-	mux.HandleFunc("GET /views", s.handleViewsIndex)
+	// Phase 5j paliad-shape views routes (slice B). /views = MRU landing
+	// or onboarding shell; /views/{slug} = render the saved view as its
+	// own page; /views/new + /views/{slug}/edit = editor. POST CRUD
+	// rounds out the family; reorder is wired now for slice G's drag UI.
+	mux.HandleFunc("GET /views", s.handleViewsLanding)
 	mux.HandleFunc("POST /views", s.handleViewCreate)
-	mux.HandleFunc("GET /views/{id}/edit", s.handleViewEdit)
-	mux.HandleFunc("GET /views/", s.handleViewRedirect)
-	mux.HandleFunc("POST /views/", s.handleViewWrite)
+	mux.HandleFunc("POST /views/reorder", s.handleViewReorder)
+	mux.HandleFunc("GET /views/new", s.handleViewEditor)
+	mux.HandleFunc("GET /views/{slug}", s.handleViewRender)
+	mux.HandleFunc("GET /views/{slug}/edit", s.handleViewEditor)
+	mux.HandleFunc("POST /views/{slug}", s.handleViewUpdate)
+	mux.HandleFunc("POST /views/{slug}/delete", s.handleViewDelete)
 	mux.HandleFunc("GET /login", s.handleLoginForm)
 	mux.HandleFunc("POST /login", s.handleLoginSubmit)
 	mux.HandleFunc("POST /logout", s.handleLogout)
@@ -430,16 +474,15 @@ type treeNode struct {
 }
 
 func (s *Server) handleTree(w http.ResponseWriter, r *http.Request) {
-	if r.URL.Path != "/" {
-		http.NotFound(w, r)
-		return
-	}
-	items, err := s.Store.ListAll(r.Context())
+	// Phase 5j slice C: handleTree is reached at /views/tree (system view)
+	// only. The legacy / route 301-redirects via legacyRedirect — see
+	// Routes(). Any 404-on-unknown-path responsibility moved with it.
+	items, err := s.Items.ListAll(r.Context())
 	if err != nil {
 		s.fail(w, r, err)
 		return
 	}
-	tags, err := s.Store.AllTags(r.Context())
+	tags, err := s.Items.AllTags(r.Context())
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -452,32 +495,16 @@ func (s *Server) handleTree(w http.ResponseWriter, r *http.Request) {
 	filter := ParseTreeFilter(r.URL.Query())
 	viewSet := PageViewTypes("/")
 	view := ParseViewType(r.URL.Query(), viewSet)
-	var defaultBanner *store.View
-	// Phase 5i Slice D: ?view=<uuid> resolves a saved view's filter +
-	// view_type into the current request, overriding URL-only chip state.
-	// Resolution failure (deleted view, malformed payload) is logged and
-	// silently falls back to the URL-derived filter — the page stays
-	// renderable rather than 500ing.
-	if saved, err := s.applySavedView(r, &filter, &view); err == nil && saved != nil {
-		// Re-validate view_type against the route catalog so a saved
-		// kanban-view URL opened on / (before slice C ships kanban) lands on
-		// the default with the chip showing the wanted view as locked.
-		view = viewSet.Resolve(view)
-	} else if err != nil {
-		s.Logger.Warn("applySavedView", "id", r.URL.Query().Get("view"), "err", err)
-	} else {
-		// Phase 5i Slice E: no explicit ?view= → check for a page default.
-		// applyDefaultView returns nil unless the URL is "clean" (no chip
-		// state) AND a default exists for this page.
-		if def, err := s.applyDefaultView(r, "tree", &filter, &view); err == nil && def != nil {
-			view = viewSet.Resolve(view)
-			defaultBanner = def
-		} else if err != nil {
-			s.Logger.Warn("applyDefaultView", "page", "tree", "err", err)
-		}
-	}
+	// Phase 5j: ?view= overlay + is_default_for resolution deleted with the
+	// 5i shape. /views/{slug} (slice B+) renders saved views as their own
+	// pages; legacy ?view=<uuid> URLs are 302-redirected from a dedicated
+	// handler (slice C). handleTree stays focused on the tree-as-tree
+	// surface and no longer hijacks itself based on a query param.
 	roots, orphans, total, orphanN, matched := applyTreeFilter(items, filter, linkKinds)
-	counts := computeChipCounts(items, filter, linkKinds, tags)
+	// Phase 5j slice C: tree lives at /views/tree now. Chip URLs need to
+	// anchor on the new base so chip clicks stay on this page.
+	const treeBase = "/views/tree"
+	counts := computeChipCounts(items, filter, linkKinds, tags, treeBase)
 	// Phase 5i Slice B: the card view renders a flat grid of matched items
 	// (no tree structure). Build from items + filter directly rather than
 	// reusing the post-prune `roots` (which still keeps ancestors).
@@ -485,7 +512,7 @@ func (s *Server) handleTree(w http.ResponseWriter, r *http.Request) {
 	// Phase 5i Slice C: kanban groups the same matched set into columns.
 	groupBy := ParseGroupBy(r.URL.Query())
 	kanban := BuildKanbanBoard(cardItems, groupBy)
-	groupByChips := GroupByChips("/", filter, groupBy)
+	groupByChips := GroupByChips(treeBase, filter, groupBy)
 	data := map[string]any{
 		"Title":             "tree",
 		"Roots":             roots,
@@ -497,15 +524,14 @@ func (s *Server) handleTree(w http.ResponseWriter, r *http.Request) {
 		"Filter":            filter,
 		"Counts":            counts,
 		"Projects":          parentOptionsFromItems(items),
-		"BasePath":          "/",
+		"BasePath":          treeBase,
 		"ProjectChipTarget": "#tree-section",
 		"ViewType":          view,
-		"ViewTypeChips":     ViewTypeChips("/", filter, view),
+		"ViewTypeChips":     ViewTypeChips(treeBase, filter, view),
 		"CardItems":         cardItems,
 		"Kanban":            kanban,
 		"GroupBy":           groupBy,
 		"GroupByChips":      groupByChips,
-		"DefaultBanner":     defaultBanner,
 		// ActiveTags kept for backwards-compat with the old template path; removed
 		// after the template migrates fully.
 		"ActiveTags": filter.Tags,
@@ -526,7 +552,7 @@ func (s *Server) handleTree(w http.ResponseWriter, r *http.Request) {
 func (s *Server) linkKindsByItem(ctx context.Context) (map[string]map[string]struct{}, error) {
 	out := map[string]map[string]struct{}{}
 	for _, t := range []string{"caldav-list", "gitea-repo"} {
-		links, err := s.Store.LinksByRefType(ctx, t)
+		links, err := s.Items.LinksByRefType(ctx, t)
 		if err != nil {
 			return nil, err
 		}
@@ -551,11 +577,11 @@ func (s *Server) handleDetail(w http.ResponseWriter, r *http.Request) {
 	// PER URL resolution: try the full path first; if it 404s and the trailing
 	// segment looks like YYMMDD, retry against the shorter path and surface
 	// the date as a render hint to scroll/highlight the matching row.
-	it, err := s.Store.GetByPath(r.Context(), path)
+	it, err := s.Items.GetByPath(r.Context(), path)
 	var highlight *time.Time
 	if errors.Is(err, store.ErrNotFound) {
 		if base, d := parsePER(path); d != nil {
-			if it2, err2 := s.Store.GetByPath(r.Context(), base); err2 == nil {
+			if it2, err2 := s.Items.GetByPath(r.Context(), base); err2 == nil {
 				it, err, highlight = it2, nil, d
 			}
 		}
@@ -579,7 +605,7 @@ func (s *Server) handleDetail(w http.ResponseWriter, r *http.Request) {
 	// are non-fatal — the section falls back to its pre-5j shape.
 	var availableCalendars []caldav.Calendar
 	if s.CalDAV != nil {
-		caldavLinks, lerr := s.Store.LinksByType(r.Context(), it.ID, refTypeCalDAV)
+		caldavLinks, lerr := s.Items.LinksByType(r.Context(), it.ID, refTypeCalDAV)
 		if lerr != nil {
 			s.Logger.Warn("detail caldav links", "path", it.PrimaryPath(), "err", lerr)
 		}
@@ -597,7 +623,7 @@ func (s *Server) handleDetail(w http.ResponseWriter, r *http.Request) {
 	for _, ri := range issues {
 		openTotal += ri.OpenCount
 	}
-	docs, err := s.Store.DatedLinks(r.Context(), it.ID)
+	docs, err := s.Items.DatedLinks(r.Context(), it.ID)
 	if err != nil {
 		s.Logger.Warn("detail docs", "path", it.PrimaryPath(), "err", err)
 	}
@@ -652,7 +678,7 @@ func (s *Server) handleDetailWrite(w http.ResponseWriter, r *http.Request) {
 		s.handleLinksRemove(w, r, base)
 		return
 	}
-	it, err := s.Store.GetByPath(r.Context(), path)
+	it, err := s.Items.GetByPath(r.Context(), path)
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -720,7 +746,7 @@ func (s *Server) handleDetailWrite(w http.ResponseWriter, r *http.Request) {
 // a root mai-managed item under a chosen parent without touching other fields.
 // HTMX-friendly: returns a fragment when HX-Request is set.
 func (s *Server) handleReparent(w http.ResponseWriter, r *http.Request, path string) {
-	it, err := s.Store.GetByPath(r.Context(), path)
+	it, err := s.Items.GetByPath(r.Context(), path)
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -875,7 +901,7 @@ func (s *Server) handleNewForm(w http.ResponseWriter, r *http.Request) {
 	parentPath := r.URL.Query().Get("parent")
 	var parent *store.Item
 	if parentPath != "" {
-		p, err := s.Store.GetByPath(r.Context(), parentPath)
+		p, err := s.Items.GetByPath(r.Context(), parentPath)
 		if err != nil {
 			s.fail(w, r, err)
 			return
@@ -950,7 +976,7 @@ func (s *Server) handleNewSubmit(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) handleClassify(w http.ResponseWriter, r *http.Request) {
-	orphans, err := s.Store.MaiOrphans(r.Context())
+	orphans, err := s.Items.MaiOrphans(r.Context())
 	if err != nil {
 		s.fail(w, r, err)
 		return
@@ -976,7 +1002,7 @@ type ParentOption struct {
 }
 
 func (s *Server) parentOptions(ctx context.Context) ([]ParentOption, error) {
-	items, err := s.Store.ListAll(ctx)
+	items, err := s.Items.ListAll(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -1026,6 +1052,49 @@ func (s *Server) render(w http.ResponseWriter, r *http.Request, name string, dat
 	if _, set := data["Path"]; !set {
 		data["Path"] = r.URL.Path
 	}
+	// Phase 5j slice E: layout's "Views" sidebar section lists every
+	// user view. Lookup is one indexed query per render — at m's scale
+	// (≤30 saved views) the cost is negligible and dwarfed by the
+	// dashboard/timeline aggregation cards. The login page bypasses the
+	// layout entirely so we don't fetch for it; stub servers without a
+	// configured store also skip cleanly.
+	if _, set := data["UserViews"]; !set && name != "login" && s.Store != nil {
+		if uv, err := s.Store.ListViews(r.Context()); err == nil {
+			data["UserViews"] = uv
+			// Phase 5j slice G — show_count badges. For every view with
+			// ShowCount=true, run its persisted filter against ListAll and
+			// pass a slug→count map to the template. Caching is one
+			// ListAll per render shared across all show-count views.
+			counts := map[string]int{}
+			needsCount := false
+			for _, v := range uv {
+				if v.ShowCount {
+					needsCount = true
+					break
+				}
+			}
+			if needsCount {
+				items, err := s.Items.ListAll(r.Context())
+				if err == nil {
+					linkKinds, _ := s.linkKindsByItem(r.Context())
+					for _, v := range uv {
+						if !v.ShowCount {
+							continue
+						}
+						f, _, _ := decodeViewSpec(v.FilterJSON)
+						n := 0
+						for _, it := range items {
+							if f.Matches(it, linkKinds[it.ID]) {
+								n++
+							}
+						}
+						counts[v.Slug] = n
+					}
+				}
+			}
+			data["UserViewCounts"] = counts
+		}
+	}
 	entry := "layout"
 	switch name {
 	case "login":

web/server_test.go

@@ -81,9 +81,9 @@ func TestTreeRenders(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	code, body := get(t, h, "/")
+	code, body := get(t, h, "/views/tree")
 	if code != 200 {
-		t.Fatalf("GET / status %d body=%s", code, body)
+		t.Fatalf("GET /views/tree status %d body=%s", code, body)
 	}
 	// /admin/classify used to live in the nav; Phase 3o consolidated all
 	// admin links under the new /admin index. Assert /admin instead.
@@ -102,7 +102,7 @@ func TestLayoutHasViewportMeta(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	for _, path := range []string{"/", "/dashboard", "/calendar", "/graph", "/admin/bulk", "/admin/classify", "/new", "/login"} {
+	for _, path := range []string{"/views/tree", "/views/dashboard", "/views/calendar", "/views/graph", "/admin/bulk", "/admin/classify", "/new", "/login"} {
 		_, body := get(t, h, path)
 		if !strings.Contains(body, `name="viewport"`) {
 			t.Errorf("GET %s: missing <meta name=\"viewport\">", path)
@@ -302,7 +302,7 @@ func TestTreeRendersKanbanWhenViewTypeIsKanban(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/?view_type=kanban")
+	_, body := get(t, h, "/views/tree?view_type=kanban")
 	if !strings.Contains(body, `class="kanban-board"`) {
 		t.Error("?view_type=kanban should render the kanban board")
 	}
@@ -324,7 +324,7 @@ func TestTreeRendersCardGridWhenViewTypeIsCard(t *testing.T) {
 	defer pool.Close()
 	h := srv.Routes()
 	// List view (default): forest markup expected; tree-card-grid absent.
-	_, listBody := get(t, h, "/")
+	_, listBody := get(t, h, "/views/tree")
 	if !strings.Contains(listBody, `<ul class="forest">`) {
 		t.Error("default GET / should render the tree forest")
 	}
@@ -335,7 +335,7 @@ func TestTreeRendersCardGridWhenViewTypeIsCard(t *testing.T) {
 		t.Error("view-type chip strip should appear on every view")
 	}
 	// Card view: card grid present, forest absent.
-	_, cardBody := get(t, h, "/?view_type=card")
+	_, cardBody := get(t, h, "/views/tree?view_type=card")
 	if !strings.Contains(cardBody, `class="tree-card-grid"`) {
 		t.Error("GET /?view_type=card should render the card grid")
 	}
@@ -343,7 +343,7 @@ func TestTreeRendersCardGridWhenViewTypeIsCard(t *testing.T) {
 		t.Error("GET /?view_type=card should not render the tree forest")
 	}
 	// Unknown view_type falls back to list.
-	_, unknownBody := get(t, h, "/?view_type=junk")
+	_, unknownBody := get(t, h, "/views/tree?view_type=junk")
 	if !strings.Contains(unknownBody, `<ul class="forest">`) {
 		t.Error("unknown view_type should fall back to list")
 	}
@@ -393,7 +393,7 @@ func TestProjectFilterScopesTreeToDescendants(t *testing.T) {
 	siblingLink := `href="/i/dev.` + siblingSlug + `"`
 
 	// Descendants on (default): parent + child visible, sibling hidden.
-	_, withDesc := get(t, h, "/?project="+parentPath)
+	_, withDesc := get(t, h, "/views/tree?project="+parentPath)
 	if !strings.Contains(withDesc, parentLink) {
 		t.Errorf("?project=%s should show parent row", parentPath)
 	}
@@ -405,7 +405,7 @@ func TestProjectFilterScopesTreeToDescendants(t *testing.T) {
 	}
 
 	// Descendants off: only the picked item, no children.
-	_, noDesc := get(t, h, "/?project="+parentPath+"&project_descendants=0")
+	_, noDesc := get(t, h, "/views/tree?project="+parentPath+"&project_descendants=0")
 	if !strings.Contains(noDesc, parentLink) {
 		t.Errorf("?project_descendants=0 should still show the picked parent row")
 	}

web/static/style.css

@@ -1211,6 +1211,23 @@ html[data-sidebar-collapsed="true"] .projax-sidebar .brand-label {
   border-left: 2px solid var(--accent);
   padding-left: 14px;
 }
+/* Phase 5j slice E — Views sub-section: user-view entries sit below the
+   main nav items, slightly indented + smaller, so the system rows stay
+   visually anchored. The Views section header (the "Views" main entry)
+   is unchanged; this just styles the per-saved-view rows. */
+.projax-sidebar .sidebar-user-views { display: flex; flex-direction: column; gap: 2px; padding: 4px 0; }
+.projax-sidebar .nav-item-user-view { font-size: 0.92em; padding-left: 24px; }
+.projax-sidebar .nav-item-user-view.active { padding-left: 22px; }
+.projax-sidebar .user-view-icon { width: 1em; text-align: center; }
+.projax-sidebar .nav-item-new-view { color: var(--muted); }
+.projax-sidebar .nav-badge {
+  margin-left: auto; font-size: 0.78em; color: var(--muted);
+  background: var(--surface); border: 1px solid var(--border);
+  border-radius: 10px; padding: 0 6px;
+}
+.projax-sidebar .nav-item-user-view.active .nav-badge {
+  color: var(--accent); border-color: var(--accent);
+}
 .projax-sidebar .nav-icon {
   width: 18px;
   height: 18px;

web/system_views.go

@@ -0,0 +1,87 @@
+package web
+
+import (
+	"net/http"
+	"strings"
+)
+
+// Phase 5j Slice C — system views. Per m's Q1 pick (b) (2026-05-29):
+// FULL MIGRATION of the legacy pages into the /views/{slug} family.
+// /, /dashboard, /calendar, /timeline, /graph all 301-redirect to their
+// /views/{system-slug} counterparts; the handlers stay (now reachable
+// under the new URL).
+//
+// System views are code-resident — they never appear as rows in
+// projax.views. Their slugs are reserved at the validator level (see
+// store.IsReservedViewSlug) so user-created views can't shadow them.
+
+// SystemView is a code-resident view definition. The sidebar's Views
+// section (slice E) lists every entry returned by AllSystemViews
+// alongside user views. The render path for system slugs goes directly
+// to the legacy handler (handleTree / handleDashboard / …); the struct
+// here is metadata for navigation, not a render spec.
+type SystemView struct {
+	Slug string
+	Name string
+	Icon string
+	URL  string // /views/{slug}
+}
+
+// AllSystemViews returns every code-resident view in display order. Used
+// by the sidebar (slice E) and the reserved-slug validation (slice A
+// already pre-seeded the same slugs in store.IsReservedViewSlug — keep
+// in sync with this list).
+func AllSystemViews() []SystemView {
+	return []SystemView{
+		{Slug: "tree", Name: "Tree", Icon: "tree", URL: "/views/tree"},
+		{Slug: "dashboard", Name: "Dashboard", Icon: "dashboard", URL: "/views/dashboard"},
+		{Slug: "calendar", Name: "Calendar", Icon: "calendar", URL: "/views/calendar"},
+		{Slug: "timeline", Name: "Timeline", Icon: "clock", URL: "/views/timeline"},
+		{Slug: "graph", Name: "Graph", Icon: "graph", URL: "/views/graph"},
+	}
+}
+
+// LookupSystemView returns the SystemView matching slug, or nil. Used by
+// handleViewRender's fallback path and by tests that need to assert
+// metadata.
+func LookupSystemView(slug string) *SystemView {
+	for _, sv := range AllSystemViews() {
+		if sv.Slug == slug {
+			s := sv
+			return &s
+		}
+	}
+	return nil
+}
+
+// legacyRedirect returns a handler that 301s the legacy URL onto its
+// /views/{system-slug} counterpart. Per m's Q3 pick (b): when the
+// request carries a legacy `?view=<uuid>` param (the 5i overlay scheme)
+// the redirect resolves the uuid → current slug so old bookmarks land
+// on the user view they pointed at. A miss falls through to the system
+// slug.
+func (s *Server) legacyRedirect(systemSlug string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		// /  is a path-prefix in Go's mux; only redirect when the request
+		// path is exactly "/". Any other root-relative path that fell
+		// through to GET / (e.g. "/some-unknown") gets a 404.
+		if systemSlug == "tree" && r.URL.Path != "/" {
+			http.NotFound(w, r)
+			return
+		}
+		target := "/views/" + systemSlug
+		if id := strings.TrimSpace(r.URL.Query().Get("view")); id != "" {
+			if v, err := s.Store.GetViewByID(r.Context(), id); err == nil && v != nil {
+				target = "/views/" + v.Slug
+			}
+		}
+		// Preserve any non-`view` query params so existing bookmarks
+		// carrying ?tag=… etc. still narrow the redirected view.
+		q := r.URL.Query()
+		q.Del("view")
+		if encoded := q.Encode(); encoded != "" {
+			target += "?" + encoded
+		}
+		http.Redirect(w, r, target, http.StatusMovedPermanently)
+	}
+}

web/system_views_test.go

@@ -0,0 +1,175 @@
+package web_test
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/m/projax/web"
+)
+
+// TestSystemViewLookup verifies the code-resident lookup returns the
+// expected slugs in display order, and that LookupSystemView round-trips
+// each entry.
+func TestSystemViewLookup(t *testing.T) {
+	all := web.AllSystemViews()
+	wantSlugs := []string{"tree", "dashboard", "calendar", "timeline", "graph"}
+	if len(all) != len(wantSlugs) {
+		t.Fatalf("AllSystemViews len = %d, want %d", len(all), len(wantSlugs))
+	}
+	for i, sv := range all {
+		if sv.Slug != wantSlugs[i] {
+			t.Errorf("position %d: slug = %q, want %q", i, sv.Slug, wantSlugs[i])
+		}
+		if sv.URL != "/views/"+sv.Slug {
+			t.Errorf("position %d: URL = %q, want /views/%s", i, sv.URL, sv.Slug)
+		}
+		round := web.LookupSystemView(sv.Slug)
+		if round == nil || round.Slug != sv.Slug {
+			t.Errorf("LookupSystemView(%q) round-trip failed", sv.Slug)
+		}
+	}
+	if web.LookupSystemView("not-a-system-slug") != nil {
+		t.Error("LookupSystemView should return nil for unknown slugs")
+	}
+}
+
+// TestLegacyRedirects verifies the slice C URL migration: each legacy
+// route 301-redirects to its /views/{slug} counterpart with chip params
+// preserved.
+func TestLegacyRedirects(t *testing.T) {
+	srv, pool := mustServer(t)
+	defer pool.Close()
+	h := srv.Routes()
+	cases := []struct {
+		path, want string
+	}{
+		{"/", "/views/tree"},
+		{"/dashboard", "/views/dashboard"},
+		{"/calendar", "/views/calendar"},
+		{"/timeline", "/views/timeline"},
+		{"/graph", "/views/graph"},
+		// chip params survive the redirect:
+		{"/dashboard?tag=work", "/views/dashboard?tag=work"},
+		{"/timeline?from=2026-05-01", "/views/timeline?from=2026-05-01"},
+	}
+	for _, tc := range cases {
+		code, body := get(t, h, tc.path)
+		if code != 301 {
+			t.Errorf("GET %s status=%d body=%q, want 301", tc.path, code, body)
+		}
+		if !strings.Contains(body, `href="`+tc.want+`"`) {
+			t.Errorf("GET %s body=%q, want redirect to %q", tc.path, body, tc.want)
+		}
+	}
+}
+
+// TestSidebarListsUserViews — slice E: every chrome-bearing page renders
+// the saved-view list under the main nav. Each entry links to
+// /views/{slug} with the name as the label. Active state fires when the
+// current URL matches.
+func TestSidebarListsUserViews(t *testing.T) {
+	srv, pool := mustServer(t)
+	defer pool.Close()
+	h := srv.Routes()
+	ctx := context.Background()
+	stamp := strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
+	slug := "p5j-e-sidebar-" + stamp
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug = $1`, slug)
+	if _, err := pool.Exec(ctx, `
+INSERT INTO projax.views (slug, name, filter_json)
+VALUES ($1, 'P5jE Sidebar', '{"view_type":"list"}'::jsonb)`, slug); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	_, body := get(t, h, "/views/tree")
+	if !strings.Contains(body, `href="/views/`+slug+`"`) {
+		t.Error("sidebar should list saved view as /views/<slug>")
+	}
+	if !strings.Contains(body, "P5jE Sidebar") {
+		t.Error("sidebar should show saved view's display name")
+	}
+	if !strings.Contains(body, `href="/views/new"`) {
+		t.Error("sidebar Views section should include a + New view link")
+	}
+	// Active state when the URL matches.
+	_, onView := get(t, h, "/views/"+slug)
+	if !strings.Contains(onView, `class="nav-item nav-item-user-view active"`) {
+		t.Error("user-view nav-item should carry .active when its URL is current")
+	}
+}
+
+// TestSidebarShowCountBadge — slice G: a saved view with show_count=true
+// renders a row-count badge in the sidebar reflecting the filter's match
+// count against ListAll().
+func TestSidebarShowCountBadge(t *testing.T) {
+	srv, pool := mustServer(t)
+	defer pool.Close()
+	h := srv.Routes()
+	ctx := context.Background()
+	stamp := strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
+	slug := "p5j-g-badge-" + stamp
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug = $1`, slug)
+	// Seed a view scoped to dev → its count = count of items under dev that
+	// match status=active (default).
+	if _, err := pool.Exec(ctx, `
+INSERT INTO projax.views (slug, name, filter_json, show_count)
+VALUES ($1, 'P5jG Badge', '{"view_type":"list","project_path":"dev"}'::jsonb, true)`,
+		slug); err != nil {
+		t.Fatalf("seed view: %v", err)
+	}
+	_, body := get(t, h, "/views/tree")
+	if !strings.Contains(body, `class="nav-badge"`) {
+		t.Error("show_count view should render a nav-badge in the sidebar")
+	}
+}
+
+// TestSidebarIconRenders — slice G: a view with an icon key emits the
+// SVG from the registry; missing key falls back to folder default.
+func TestSidebarIconRenders(t *testing.T) {
+	srv, pool := mustServer(t)
+	defer pool.Close()
+	h := srv.Routes()
+	ctx := context.Background()
+	stamp := strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
+	slug := "p5j-g-icon-" + stamp
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug = $1`, slug)
+	if _, err := pool.Exec(ctx, `
+INSERT INTO projax.views (slug, name, filter_json, icon)
+VALUES ($1, 'P5jG Icon', '{"view_type":"list"}'::jsonb, 'star')`, slug); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	_, body := get(t, h, "/views/tree")
+	// The star icon's SVG path includes its distinctive 5-point polygon.
+	if !strings.Contains(body, `polygon points="12 2 15.09 8.26`) {
+		t.Error("sidebar should render the star icon SVG for icon=star")
+	}
+}
+
+// TestLegacyViewUUIDRedirect — when a legacy URL carries the 5i overlay
+// `?view=<uuid>` param, the redirect resolves the uuid to the current
+// slug (per m's Q3 pick), so old bookmarks land on the right user view.
+func TestLegacyViewUUIDRedirect(t *testing.T) {
+	srv, pool := mustServer(t)
+	defer pool.Close()
+	h := srv.Routes()
+	ctx := context.Background()
+	stamp := strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
+	slug := "p5j-c-legacy-" + stamp
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug = $1`, slug)
+	var id string
+	if err := pool.QueryRow(ctx, `
+INSERT INTO projax.views (slug, name, filter_json)
+VALUES ($1, 'Legacy', '{"view_type":"list"}'::jsonb)
+RETURNING id`, slug).Scan(&id); err != nil {
+		t.Fatalf("seed view: %v", err)
+	}
+	// Old-style URL: /?view=<uuid>
+	code, body := get(t, h, "/?view="+id)
+	if code != 301 {
+		t.Fatalf("GET /?view=<uuid> status=%d body=%q want 301", code, body)
+	}
+	if !strings.Contains(body, "/views/"+slug) {
+		t.Errorf("redirect should resolve uuid → slug; got body=%q", body)
+	}
+}

web/templates/calendar.tmpl

@@ -3,9 +3,9 @@
   <header class="calendar-header">
     <h1>{{.P.MonthLabel}}</h1>
     <nav class="calendar-nav" aria-label="Monatsnavigation">
-      <a class="prev" href="/calendar?month={{.P.PrevMonth}}{{with .Filter.QueryString}}&amp;{{.}}{{end}}">&lt; {{.P.PrevMonth}}</a>
-      <a class="today" href="/calendar{{with .Filter.QueryString}}?{{.}}{{end}}">heute</a>
-      <a class="next" href="/calendar?month={{.P.NextMonth}}{{with .Filter.QueryString}}&amp;{{.}}{{end}}">{{.P.NextMonth}} &gt;</a>
+      <a class="prev" href="/views/calendar?month={{.P.PrevMonth}}{{with .Filter.QueryString}}&amp;{{.}}{{end}}">&lt; {{.P.PrevMonth}}</a>
+      <a class="today" href="/views/calendar{{with .Filter.QueryString}}?{{.}}{{end}}">heute</a>
+      <a class="next" href="/views/calendar?month={{.P.NextMonth}}{{with .Filter.QueryString}}&amp;{{.}}{{end}}">{{.P.NextMonth}} &gt;</a>
     </nav>
   </header>
   {{template "calendar-section" .}}

web/templates/calendar_section.tmpl

@@ -3,7 +3,7 @@
 
   <section class="tagbar" id="calendar-filterbar">
     <form id="calendar-filter" class="search"
-          hx-get="/calendar"
+          hx-get="/views/calendar"
           hx-target="#calendar-section"
           hx-swap="outerHTML"
           hx-trigger="change from:select"
@@ -39,7 +39,7 @@
       </label>
       {{if .Filter.ProjectPath}}<input type="hidden" name="project" value="{{.Filter.ProjectPath}}">{{end}}
       {{if and .Filter.ProjectPath (not .Filter.IncludeDescendants)}}<input type="hidden" name="project_descendants" value="0">{{end}}
-      {{if .Filter.Active}}<a class="clear" href="/calendar?month={{.P.MonthKey}}">clear filters</a>{{end}}
+      {{if .Filter.Active}}<a class="clear" href="/views/calendar?month={{.P.MonthKey}}">clear filters</a>{{end}}
     </form>
 
     {{template "view-project-chip" .}}
@@ -83,7 +83,7 @@
                 </ul>
               {{end}}
               {{if gt .ExtraCount 0}}
-                <a class="cell-more muted" href="/timeline?from={{.DateKey}}&amp;to={{.DateKey}}">+{{.ExtraCount}} more</a>
+                <a class="cell-more muted" href="/views/timeline?from={{.DateKey}}&amp;to={{.DateKey}}">+{{.ExtraCount}} more</a>
               {{end}}
             </td>
           {{end}}

web/templates/dashboard_section.tmpl

@@ -3,7 +3,7 @@
 
   <section class="tagbar" id="dashboard-filterbar">
     <form id="dashboard-filter" class="search"
-          hx-get="/dashboard{{if ne .View "tiles"}}?view={{.View}}{{end}}"
+          hx-get="/views/dashboard{{if ne .View "tiles"}}?view={{.View}}{{end}}"
           hx-target="#dashboard-section"
           hx-swap="outerHTML"
           hx-trigger="change from:select"
@@ -32,7 +32,7 @@
       {{if ne .View "tiles"}}<input type="hidden" name="view" value="{{.View}}">{{end}}
       {{if .Filter.ProjectPath}}<input type="hidden" name="project" value="{{.Filter.ProjectPath}}">{{end}}
       {{if and .Filter.ProjectPath (not .Filter.IncludeDescendants)}}<input type="hidden" name="project_descendants" value="0">{{end}}
-      {{if .Filter.Active}}<a class="clear" href="/dashboard{{if ne .View "tiles"}}?view={{.View}}{{end}}">clear filters</a>{{end}}
+      {{if .Filter.Active}}<a class="clear" href="/views/dashboard{{if ne .View "tiles"}}?view={{.View}}{{end}}">clear filters</a>{{end}}
     </form>
 
     {{template "view-project-chip" .}}

web/templates/detail.tmpl

@@ -122,7 +122,7 @@
     <summary class="proj-section-summary">Timeline behaviour {{if .Item.TimelineExclude}}<small class="muted">(hiding {{len .Item.TimelineExclude}})</small>{{end}}</summary>
     <fieldset class="timeline-exclude">
       <legend class="visually-hidden">Timeline behaviour</legend>
-      <p class="muted">Check a kind to hide it from <a href="/timeline">/timeline</a>. Items remain visible on this detail page either way; the toggle only affects the aggregated chronological spine. Use <a href="/timeline?include_excluded=1">?include_excluded=1</a> to peek at everything anyway.</p>
+      <p class="muted">Check a kind to hide it from <a href="/views/timeline">/timeline</a>. Items remain visible on this detail page either way; the toggle only affects the aggregated chronological spine. Use <a href="/views/timeline?include_excluded=1">?include_excluded=1</a> to peek at everything anyway.</p>
       {{$ex := .Item.TimelineExclude}}
       <label class="checkbox"><input type="checkbox" name="timeline_exclude" value="todos"    {{if contains $ex "todos"}}checked{{end}}> exclude todos (VTODOs from linked calendars)</label>
       <label class="checkbox"><input type="checkbox" name="timeline_exclude" value="events"   {{if contains $ex "events"}}checked{{end}}> exclude events (VEVENTs from linked calendars)</label>
@@ -133,7 +133,7 @@
 
   <div class="actions">
     <button type="submit">Save</button>
-    <a class="cancel" href="/">Cancel</a>
+    <a class="cancel" href="/views/tree">Cancel</a>
   </div>
 </form>
 

web/templates/error.tmpl

@@ -1,5 +1,5 @@
 {{define "content"}}
 <h1>Error</h1>
 <p class="error">{{.Message}}</p>
-<p><a href="/">Back to tree</a></p>
+<p><a href="/views/tree">Back to tree</a></p>
 {{end}}

web/templates/graph.tmpl

@@ -3,7 +3,7 @@
 
 <section class="tagbar" id="graph-filterbar">
   <form id="graph-filter" class="search"
-        hx-get="/graph"
+        hx-get="/views/graph"
         hx-target="main"
         hx-select="main"
         hx-swap="outerHTML"
@@ -29,8 +29,8 @@
       <input type="checkbox" name="isolate" value="1" {{if .Isolate}}checked{{end}}>
       isolate (hide non-matches)
     </label>
-    {{if .Filter.Active}}<a class="clear" href="/graph">clear filters</a>{{end}}
-    <a class="download" href="/graph?download=svg">download SVG</a>
+    {{if .Filter.Active}}<a class="clear" href="/views/graph">clear filters</a>{{end}}
+    <a class="download" href="/views/graph?download=svg">download SVG</a>
   </form>
 </section>
 

web/templates/layout.tmpl

@@ -42,38 +42,38 @@
 {{$path := .Path}}
 <aside class="projax-sidebar" aria-label="Primary navigation">
   <div class="sidebar-top">
-    <a href="/" class="brand" title="projax">
+    <a href="/views/tree" class="brand" title="projax">
       <span class="brand-icon" aria-hidden="true">▦</span>
       <strong class="brand-label">projax</strong>
     </a>
   </div>
   <nav class="sidebar-nav">
-    <a href="/" class="nav-item{{if eq $path "/"}} active{{end}}" title="Tree">
+    <a href="/views/tree" class="nav-item{{if eq $path "/views/tree"}} active{{end}}" title="Tree">
       <svg class="nav-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
         <line x1="8" y1="6" x2="21" y2="6"/><line x1="8" y1="12" x2="21" y2="12"/><line x1="8" y1="18" x2="21" y2="18"/>
         <line x1="3" y1="6" x2="3.01" y2="6"/><line x1="3" y1="12" x2="3.01" y2="12"/><line x1="3" y1="18" x2="3.01" y2="18"/>
       </svg>
       <span class="nav-label">Tree</span>
     </a>
-    <a href="/dashboard" class="nav-item{{if eq $path "/dashboard"}} active{{end}}" title="Dashboard">
+    <a href="/views/dashboard" class="nav-item{{if eq $path "/views/dashboard"}} active{{end}}" title="Dashboard">
       <svg class="nav-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
         <rect x="3" y="3" width="7" height="9"/><rect x="14" y="3" width="7" height="5"/><rect x="14" y="12" width="7" height="9"/><rect x="3" y="16" width="7" height="5"/>
       </svg>
       <span class="nav-label">Dashboard</span>
     </a>
-    <a href="/calendar" class="nav-item{{if eq $path "/calendar"}} active{{end}}" title="Calendar">
+    <a href="/views/calendar" class="nav-item{{if eq $path "/views/calendar"}} active{{end}}" title="Calendar">
       <svg class="nav-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
         <rect x="3" y="4" width="18" height="18" rx="2" ry="2"/><line x1="16" y1="2" x2="16" y2="6"/><line x1="8" y1="2" x2="8" y2="6"/><line x1="3" y1="10" x2="21" y2="10"/>
       </svg>
       <span class="nav-label">Calendar</span>
     </a>
-    <a href="/timeline" class="nav-item{{if eq $path "/timeline"}} active{{end}}" title="Timeline">
+    <a href="/views/timeline" class="nav-item{{if eq $path "/views/timeline"}} active{{end}}" title="Timeline">
       <svg class="nav-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
         <circle cx="12" cy="12" r="10"/><polyline points="12 6 12 12 16 14"/>
       </svg>
       <span class="nav-label">Timeline</span>
     </a>
-    <a href="/graph" class="nav-item{{if eq $path "/graph"}} active{{end}}" title="Graph">
+    <a href="/views/graph" class="nav-item{{if eq $path "/views/graph"}} active{{end}}" title="Graph">
       <svg class="nav-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
         <circle cx="18" cy="5" r="3"/><circle cx="6" cy="12" r="3"/><circle cx="18" cy="19" r="3"/>
         <line x1="8.59" y1="13.51" x2="15.42" y2="17.49"/><line x1="15.41" y1="6.51" x2="8.59" y2="10.49"/>
@@ -89,6 +89,25 @@
       </svg>
       <span class="nav-label">Views</span>
     </a>
+    {{if .UserViews}}
+    {{$counts := .UserViewCounts}}
+    <div class="sidebar-user-views" aria-label="Saved views">
+      {{range .UserViews}}
+        {{$slug := .Slug}}
+        <a href="/views/{{.Slug}}"
+           class="nav-item nav-item-user-view{{if eq $path (printf "/views/%s" .Slug)}} active{{end}}"
+           title="{{.Name}}">
+          {{renderIcon .Icon}}
+          <span class="nav-label">{{.Name}}</span>
+          {{if .ShowCount}}<span class="nav-badge" aria-label="Item count">{{index $counts $slug}}</span>{{end}}
+        </a>
+      {{end}}
+      <a href="/views/new" class="nav-item nav-item-user-view nav-item-new-view" title="New view">
+        <span class="nav-icon" aria-hidden="true">＋</span>
+        <span class="nav-label">New view</span>
+      </a>
+    </div>
+    {{end}}
     <a href="/admin" class="nav-item{{if eq $path "/admin"}} active{{end}}" title="Admin">
       <svg class="nav-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
         <circle cx="12" cy="12" r="3"/>
@@ -124,14 +143,14 @@
 {{template "content" .}}
 </main>
 <nav class="projax-bottom-nav" aria-label="Mobile navigation">
-  <a href="/" class="bottom-nav-item{{if eq $path "/"}} active{{end}}" aria-label="Tree">
+  <a href="/views/tree" class="bottom-nav-item{{if eq $path "/views/tree"}} active{{end}}" aria-label="Tree">
     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" width="22" height="22" aria-hidden="true">
       <line x1="8" y1="6" x2="21" y2="6"/><line x1="8" y1="12" x2="21" y2="12"/><line x1="8" y1="18" x2="21" y2="18"/>
       <line x1="3" y1="6" x2="3.01" y2="6"/><line x1="3" y1="12" x2="3.01" y2="12"/><line x1="3" y1="18" x2="3.01" y2="18"/>
     </svg>
     <span>Tree</span>
   </a>
-  <a href="/dashboard" class="bottom-nav-item{{if eq $path "/dashboard"}} active{{end}}" aria-label="Dashboard">
+  <a href="/views/dashboard" class="bottom-nav-item{{if eq $path "/views/dashboard"}} active{{end}}" aria-label="Dashboard">
     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" width="22" height="22" aria-hidden="true">
       <rect x="3" y="3" width="7" height="9"/><rect x="14" y="3" width="7" height="5"/><rect x="14" y="12" width="7" height="9"/><rect x="3" y="16" width="7" height="5"/>
     </svg>
@@ -144,7 +163,7 @@
       </svg>
     </span>
   </a>
-  <a href="/calendar" class="bottom-nav-item{{if eq $path "/calendar"}} active{{end}}" aria-label="Calendar">
+  <a href="/views/calendar" class="bottom-nav-item{{if eq $path "/views/calendar"}} active{{end}}" aria-label="Calendar">
     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" width="22" height="22" aria-hidden="true">
       <rect x="3" y="4" width="18" height="18" rx="2" ry="2"/><line x1="16" y1="2" x2="16" y2="6"/><line x1="8" y1="2" x2="8" y2="6"/><line x1="3" y1="10" x2="21" y2="10"/>
     </svg>
@@ -158,13 +177,13 @@
       <span>Menu</span>
     </summary>
     <div class="drawer-sheet" role="menu">
-      <a href="/timeline" class="drawer-item{{if eq $path "/timeline"}} active{{end}}" role="menuitem">
+      <a href="/views/timeline" class="drawer-item{{if eq $path "/views/timeline"}} active{{end}}" role="menuitem">
         <svg class="drawer-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
           <circle cx="12" cy="12" r="10"/><polyline points="12 6 12 12 16 14"/>
         </svg>
         <span>Timeline</span>
       </a>
-      <a href="/graph" class="drawer-item{{if eq $path "/graph"}} active{{end}}" role="menuitem">
+      <a href="/views/graph" class="drawer-item{{if eq $path "/views/graph"}} active{{end}}" role="menuitem">
         <svg class="drawer-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
           <circle cx="18" cy="5" r="3"/><circle cx="6" cy="12" r="3"/><circle cx="18" cy="19" r="3"/>
           <line x1="8.59" y1="13.51" x2="15.42" y2="17.49"/><line x1="15.41" y1="6.51" x2="8.59" y2="10.49"/>

web/templates/timeline_section.tmpl

@@ -3,7 +3,7 @@
 
   <section class="tagbar" id="timeline-filterbar">
     <form id="timeline-filter" class="search"
-          hx-get="/timeline"
+          hx-get="/views/timeline"
           hx-target="#timeline-section"
           hx-swap="outerHTML"
           hx-trigger="change from:select"
@@ -45,7 +45,7 @@
       </label>
       {{if .Filter.ProjectPath}}<input type="hidden" name="project" value="{{.Filter.ProjectPath}}">{{end}}
       {{if and .Filter.ProjectPath (not .Filter.IncludeDescendants)}}<input type="hidden" name="project_descendants" value="0">{{end}}
-      {{if .Filter.Active}}<a class="clear" href="/timeline">clear filters</a>{{end}}
+      {{if .Filter.Active}}<a class="clear" href="/views/timeline">clear filters</a>{{end}}
     </form>
 
     {{template "view-project-chip" .}}
@@ -62,7 +62,7 @@
         <li class="spine-day{{if .Sticky}} sticky-{{.Sticky}}{{end}}" data-date="{{.DateKey}}">
           <header class="day-header">
             {{if .Sticky}}<span class="sticky-pill">{{.Sticky}}</span>{{end}}
-            <h2><a class="muted" href="/timeline?from={{.DateKey}}&amp;to={{.DateKey}}">{{.Label}}</a> <small class="muted">({{len .Rows}})</small></h2>
+            <h2><a class="muted" href="/views/timeline?from={{.DateKey}}&amp;to={{.DateKey}}">{{.Label}}</a> <small class="muted">({{len .Rows}})</small></h2>
           </header>
           <ul class="day-rows">
             {{range .Rows}}

web/templates/tree_card.tmpl

@@ -22,7 +22,7 @@ the visual difference is layout, not data shape.
     </article>
   {{else}}
     <div class="tree-card-empty">
-      <em>No items match. Try fewer filters or <a href="/">clear all</a>.</em>
+      <em>No items match. Try fewer filters or <a href="/views/tree">clear all</a>.</em>
     </div>
   {{end}}
 </div>

web/templates/tree_kanban.tmpl

@@ -40,7 +40,7 @@ set surfaces a friendly empty-state message.
 </div>
 {{else}}
 <div class="kanban-empty muted">
-  <em>No items match. Try fewer filters or <a href="/?view_type=kanban">clear filters</a>.</em>
+  <em>No items match. Try fewer filters or <a href="/views/tree?view_type=kanban">clear filters</a>.</em>
 </div>
 {{end}}
 {{end}}

web/templates/tree_section.tmpl

@@ -1,16 +1,9 @@
 {{define "tree-section"}}
 <section id="tree-section" class="tree-section">
-  {{if .DefaultBanner}}
-    <p class="default-banner muted">
-      Showing default view: <strong>{{.DefaultBanner.Name}}</strong> ·
-      <a href="/?nodefault=1"
-         hx-get="/?nodefault=1" hx-target="#tree-section" hx-swap="outerHTML" hx-push-url="true">clear</a>
-    </p>
-  {{end}}
   <p class="counts">
     <strong>{{.Matched}}</strong> / <strong>{{.Total}}</strong> items match
     {{if .OrphanN}} · <strong>{{.OrphanN}}</strong> unclassified mai-managed roots <a href="/admin/classify">→ classify</a>{{end}}
-    {{if .Filter.Active}} · <a class="clear" href="/">clear filters</a>{{end}}
+    {{if .Filter.Active}} · <a class="clear" href="/views/tree">clear filters</a>{{end}}
   </p>
 
   <section class="tagbar" id="tree-filterbar">
@@ -100,7 +93,7 @@
           {{template "children" .}}
         </li>
       {{else}}
-        <li class="empty"><em>No items match. Try fewer filters or <a href="/">clear all</a>.</em></li>
+        <li class="empty"><em>No items match. Try fewer filters or <a href="/views/tree">clear all</a>.</em></li>
       {{end}}
     </ul>
   </section>

web/templates/view_edit.tmpl

@@ -1,42 +0,0 @@
-{{define "content"}}
-<h1>Edit view</h1>
-<p class="muted"><a href="/views">← back to views</a></p>
-
-<section class="views-create">
-  <form method="post" action="/views/{{.View.ID}}">
-    <label>Name <input type="text" name="name" required maxlength="80" value="{{.View.Name}}"></label>
-    <label>Description <input type="text" name="description" maxlength="200" value="{{.View.Description}}"></label>
-    <label>View type
-      <select name="view_type" required>
-        {{$cur := .View.ViewType}}
-        {{range .AllViewTypes}}<option value="{{.}}"{{if eq . $cur}} selected{{end}}>{{.}}</option>{{end}}
-      </select>
-    </label>
-    <label>Default for
-      <select name="is_default_for">
-        {{$d := deref .View.IsDefaultFor}}
-        {{range .DefaultForOptions}}<option value="{{.}}"{{if eq . $d}} selected{{end}}>{{if eq . ""}}—{{else}}{{.}}{{end}}</option>{{end}}
-      </select>
-    </label>
-    <label>Group by
-      <select name="group_by">
-        {{$g := deref .View.GroupBy}}
-        {{range .GroupByOptions}}<option value="{{.}}"{{if eq . $g}} selected{{end}}>{{if eq . ""}}—{{else}}{{.}}{{end}}</option>{{end}}
-      </select>
-    </label>
-    <label>Sort field <input type="text" name="sort_field" placeholder="title / updated_at / start_time" maxlength="40" value="{{deref .View.SortField}}"></label>
-    <label>Sort dir
-      <select name="sort_dir">
-        {{$sd := deref .View.SortDir}}
-        {{range .SortDirOptions}}<option value="{{.}}"{{if eq . $sd}} selected{{end}}>{{if eq . ""}}—{{else}}{{.}}{{end}}</option>{{end}}
-      </select>
-    </label>
-    <label><input type="checkbox" name="pinned" value="1"{{if .View.Pinned}} checked{{end}}> Pinned</label>
-    <label>Filter (URL query form)
-      <input type="text" name="filter_query" placeholder="tag=work&mgmt=mai" value="{{.FilterQuery}}">
-    </label>
-    <button type="submit">Save changes</button>
-    <a class="muted" href="/views">cancel</a>
-  </form>
-</section>
-{{end}}

web/templates/view_editor.tmpl

@@ -0,0 +1,49 @@
+{{define "content"}}
+<h1>{{if .View}}Edit {{.View.Name}}{{else}}New view{{end}}</h1>
+<p class="muted"><a href="/views">← back to views</a></p>
+
+<form class="view-editor"
+      method="post"
+      action="{{if .View}}/views/{{.View.Slug}}{{else}}/views{{end}}">
+  <label>Name <input type="text" name="name" required maxlength="80" value="{{if .View}}{{.View.Name}}{{end}}"></label>
+  <label>Slug
+    <input type="text" name="slug" required maxlength="63"
+           pattern="^[a-z0-9][a-z0-9-]{0,62}$"
+           value="{{if .View}}{{.View.Slug}}{{end}}">
+    <small class="muted">lowercase letters, digits, dashes. No reserved system slugs.</small>
+  </label>
+  <label>Icon
+    <select name="icon">
+      {{$cur := ""}}
+      {{if and .View .View.Icon}}{{$cur = deref .View.Icon}}{{end}}
+      {{range .IconKeys}}
+        <option value="{{.}}"{{if eq . $cur}} selected{{end}}>{{.}}</option>
+      {{end}}
+    </select>
+  </label>
+  <fieldset class="view-type-radios">
+    <legend>View type</legend>
+    {{range .ViewTypes}}
+      <label><input type="radio" name="view_type" value="{{.}}" {{if eq . $.CurrentVT}}checked{{end}}> {{.}}</label>
+    {{end}}
+  </fieldset>
+  <label>Group by
+    <select name="group_by">
+      {{range .GroupByOptions}}<option value="{{.}}">{{if eq . ""}}—{{else}}{{.}}{{end}}</option>{{end}}
+    </select>
+  </label>
+  <label>Sort field <input type="text" name="sort_field" placeholder="title / updated_at" maxlength="40"></label>
+  <label>Sort dir
+    <select name="sort_dir">
+      {{range .SortDirOptions}}<option value="{{.}}">{{if eq . ""}}—{{else}}{{.}}{{end}}</option>{{end}}
+    </select>
+  </label>
+  <label><input type="checkbox" name="show_count" value="1"
+           {{if and .View .View.ShowCount}}checked{{end}}> Show row-count badge in sidebar</label>
+  <label>Filter (URL query form)
+    <input type="text" name="filter_query" placeholder="tag=work&mgmt=mai" value="{{.FilterQuery}}">
+  </label>
+  <button type="submit">{{if .View}}Save changes{{else}}Create view{{end}}</button>
+  <a class="muted" href="/views">cancel</a>
+</form>
+{{end}}

web/templates/view_render.tmpl

@@ -0,0 +1,14 @@
+{{define "content"}}
+<section class="view-header">
+  <h1>{{.View.Name}}</h1>
+  <p class="muted view-meta">
+    <code>/views/{{.View.Slug}}</code> ·
+    <a href="/views/{{.View.Slug}}/edit">edit</a> ·
+    <form method="post" action="/views/{{.View.Slug}}/delete" style="display:inline">
+      <button type="submit" class="link-button" onclick="return confirm('Delete view {{.View.Name}}?')">delete</button>
+    </form>
+  </p>
+</section>
+
+{{template "tree-section" .}}
+{{end}}

web/templates/views.tmpl

@@ -1,70 +0,0 @@
-{{define "content"}}
-<h1>Views</h1>
-
-<p class="muted">Saved bundles of (filter + view_type + sort + group_by). Page-agnostic — open one to render the saved set on the matching page.</p>
-
-<section class="views-list">
-  {{if .Views}}
-  <table>
-    <thead>
-      <tr>
-        <th>★</th><th>Name</th><th>Type</th><th>Default for</th><th>Group by</th><th></th>
-      </tr>
-    </thead>
-    <tbody>
-      {{range .Views}}
-      <tr>
-        <td>{{if .Pinned}}★{{end}}</td>
-        <td><a href="/views/{{.ID}}">{{.Name}}</a>{{if .Description}}<br><small class="muted">{{.Description}}</small>{{end}}</td>
-        <td>{{.ViewType}}</td>
-        <td>{{if .IsDefaultFor}}{{deref .IsDefaultFor}}{{else}}<span class="muted">—</span>{{end}}</td>
-        <td>{{if .GroupBy}}{{deref .GroupBy}}{{else}}<span class="muted">—</span>{{end}}</td>
-        <td>
-          <a href="/views/{{.ID}}/edit">edit</a>
-          <form method="post" action="/views/{{.ID}}/delete" style="display:inline">
-            <button type="submit" class="link-button" onclick="return confirm('Delete view {{.Name}}?')">delete</button>
-          </form>
-        </td>
-      </tr>
-      {{end}}
-    </tbody>
-  </table>
-  {{else}}
-  <p class="empty muted"><em>No saved views yet. Create one with the form below or via the "Save view…" link on any Views-supporting page.</em></p>
-  {{end}}
-</section>
-
-<section class="views-create">
-  <h2>New view</h2>
-  <form method="post" action="/views">
-    <label>Name <input type="text" name="name" required maxlength="80"></label>
-    <label>Description <input type="text" name="description" maxlength="200"></label>
-    <label>View type
-      <select name="view_type" required>
-        {{range .AllViewTypes}}<option value="{{.}}">{{.}}</option>{{end}}
-      </select>
-    </label>
-    <label>Default for
-      <select name="is_default_for">
-        {{range .DefaultForOptions}}<option value="{{.}}">{{if eq . ""}}—{{else}}{{.}}{{end}}</option>{{end}}
-      </select>
-    </label>
-    <label>Group by
-      <select name="group_by">
-        {{range .GroupByOptions}}<option value="{{.}}">{{if eq . ""}}—{{else}}{{.}}{{end}}</option>{{end}}
-      </select>
-    </label>
-    <label>Sort field <input type="text" name="sort_field" placeholder="title / updated_at / start_time" maxlength="40"></label>
-    <label>Sort dir
-      <select name="sort_dir">
-        {{range .SortDirOptions}}<option value="{{.}}">{{if eq . ""}}—{{else}}{{.}}{{end}}</option>{{end}}
-      </select>
-    </label>
-    <label><input type="checkbox" name="pinned" value="1"> Pinned</label>
-    <label>Filter (URL query form, e.g. <code>tag=work&amp;mgmt=mai</code>)
-      <input type="text" name="filter_query" placeholder="tag=work&mgmt=mai" value="{{.Prefill.filter}}">
-    </label>
-    <button type="submit">Create view</button>
-  </form>
-</section>
-{{end}}

web/templates/views_landing.tmpl

@@ -0,0 +1,26 @@
+{{define "content"}}
+<h1>Views</h1>
+
+<p class="muted">First-class saved pages. Each view has its own URL and renders on its own.</p>
+
+{{if .Views}}
+<section class="views-list">
+  <ul class="views-list-grid">
+    {{range .Views}}
+    <li>
+      <a class="view-card" href="/views/{{.Slug}}">
+        <span class="view-card-name">{{.Name}}</span>
+        <span class="view-card-slug muted">/views/{{.Slug}}</span>
+      </a>
+    </li>
+    {{end}}
+  </ul>
+</section>
+{{else}}
+<section class="views-empty">
+  <p class="muted"><em>No saved views yet.</em></p>
+</section>
+{{end}}
+
+<p><a class="view-create-link" href="/views/new">+ New view</a></p>
+{{end}}

web/theme_test.go

@@ -14,9 +14,9 @@ func TestThemeDefaultIsDark(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	code, body := get(t, h, "/")
+	code, body := get(t, h, "/views/tree")
 	if code != 200 {
-		t.Fatalf("GET / → %d", code)
+		t.Fatalf("GET /views/tree → %d", code)
 	}
 	for _, want := range []string{
 		`<html lang="en" data-theme="dark">`,
@@ -42,7 +42,7 @@ func TestThemeCookieRoundTrips(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req := httptest.NewRequest(http.MethodGet, "/views/tree", nil)
 	req.AddCookie(&http.Cookie{Name: "projax_theme", Value: "light"})
 	w := httptest.NewRecorder()
 	h.ServeHTTP(w, req)
@@ -66,7 +66,7 @@ func TestThemeCookieUnknownFallsBackToDark(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req := httptest.NewRequest(http.MethodGet, "/views/tree", nil)
 	req.AddCookie(&http.Cookie{Name: "projax_theme", Value: "neon-puke"})
 	w := httptest.NewRecorder()
 	h.ServeHTTP(w, req)
@@ -94,7 +94,7 @@ func TestThemeTogglePagesShareSameTheme(t *testing.T) {
 		body, _ := io.ReadAll(w.Result().Body)
 		return string(body)
 	}
-	for _, path := range []string{"/", "/dashboard", "/timeline", "/graph", "/admin", "/admin/bulk", "/admin/classify"} {
+	for _, path := range []string{"/views/tree", "/views/dashboard", "/views/timeline", "/views/graph", "/admin", "/admin/bulk", "/admin/classify"} {
 		dark := probe(path, "")
 		light := probe(path, "light")
 		if !strings.Contains(dark, `data-theme="dark"`) {
@@ -112,7 +112,7 @@ func TestThemeToggleScriptPresent(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	_, body := get(t, h, "/dashboard")
+	_, body := get(t, h, "/views/dashboard")
 	for _, want := range []string{
 		"document.cookie = 'projax_theme=",
 		`getElementById('theme-toggle')`,
@@ -132,7 +132,7 @@ func TestThemeColorMetaHelper(t *testing.T) {
 	defer pool.Close()
 	// Indirect: render a fragment with a Theme override to confirm injection
 	// does not double-write the meta when caller already populates it.
-	req := httptest.NewRequest(http.MethodGet, "/dashboard", nil)
+	req := httptest.NewRequest(http.MethodGet, "/views/dashboard", nil)
 	req.AddCookie(&http.Cookie{Name: "projax_theme", Value: "light"})
 	w := httptest.NewRecorder()
 	srv.Routes().ServeHTTP(w, req)

web/timeline.go

@@ -199,7 +199,7 @@ func (s *Server) handleTimeline(w http.ResponseWriter, r *http.Request) {
 		"Query":             q,
 		"Now":               now,
 		"Projects":          projects,
-		"BasePath":          "/timeline",
+		"BasePath":          "/views/timeline",
 		"ProjectChipTarget": "#timeline-section",
 	}
 	if r.Header.Get("HX-Request") == "true" {
@@ -212,7 +212,7 @@ func (s *Server) handleTimeline(w http.ResponseWriter, r *http.Request) {
 // buildTimeline gathers every dated source, applies the kind/filter narrowing,
 // and groups rows by day in the requested order.
 func (s *Server) buildTimeline(ctx context.Context, q TimelineQuery, now time.Time) (*TimelinePayload, error) {
-	items, err := s.Store.ListAll(ctx)
+	items, err := s.Items.ListAll(ctx)
 	if err != nil {
 		return nil, err
 	}

web/timeline_exclude_test.go

@@ -108,13 +108,13 @@ END:VCALENDAR`
 	}
 
 	h := srv.Routes()
-	_, body := get(t, h, "/timeline")
+	_, body := get(t, h, "/views/timeline")
 	if strings.Contains(body, "Shopping list item") {
 		t.Errorf("/timeline should NOT include excluded todo summary; body contained it")
 	}
 
 	// Override: ?include_excluded=1 brings it back.
-	_, peekBody := get(t, h, "/timeline?include_excluded=1")
+	_, peekBody := get(t, h, "/views/timeline?include_excluded=1")
 	if !strings.Contains(peekBody, "Shopping list item") {
 		t.Errorf("?include_excluded=1 should surface the excluded todo; body lacked it")
 	}

web/timeline_test.go

@@ -20,7 +20,7 @@ func TestTimelineRendersEmpty(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	code, body := get(t, h, "/timeline")
+	code, body := get(t, h, "/views/timeline")
 	if code != 200 {
 		t.Fatalf("GET /timeline → %d body=%s", code, body)
 	}
@@ -67,7 +67,7 @@ func TestTimelineSurfacesDatedDocs(t *testing.T) {
 		t.Fatalf("seed link: %v", err)
 	}
 
-	code, body := get(t, h, "/timeline")
+	code, body := get(t, h, "/views/timeline")
 	if code != 200 {
 		t.Fatalf("GET /timeline → %d", code)
 	}
@@ -115,7 +115,7 @@ func TestTimelineFilterByKindNarrowsRows(t *testing.T) {
 	}
 
 	// Unfiltered: both the creation marker and the dated doc should be present.
-	_, allBody := get(t, h, "/timeline")
+	_, allBody := get(t, h, "/views/timeline")
 	if !strings.Contains(allBody, "added <a class=\"proj\" href=\"/i/dev."+slug) {
 		t.Errorf("expected creation marker in unfiltered timeline body")
 	}
@@ -124,7 +124,7 @@ func TestTimelineFilterByKindNarrowsRows(t *testing.T) {
 	}
 
 	// kind=doc only: the doc row stays; the creation marker drops.
-	_, docOnly := get(t, h, "/timeline?kind=doc")
+	_, docOnly := get(t, h, "/views/timeline?kind=doc")
 	if strings.Contains(docOnly, "added <a class=\"proj\" href=\"/i/dev."+slug) {
 		t.Errorf("kind=doc should hide creation marker")
 	}
@@ -171,7 +171,7 @@ func TestTimelineOrderToggleReversesDays(t *testing.T) {
 	older := "dev." + slug + "." + time.Now().UTC().AddDate(0, 0, -3).Format("060102")
 	newer := "dev." + slug + "." + time.Now().UTC().AddDate(0, 0, 5).Format("060102")
 
-	_, desc := get(t, h, "/timeline")
+	_, desc := get(t, h, "/views/timeline")
 	idxNewerDesc := strings.Index(desc, newer)
 	idxOlderDesc := strings.Index(desc, older)
 	if idxNewerDesc < 0 || idxOlderDesc < 0 {
@@ -181,7 +181,7 @@ func TestTimelineOrderToggleReversesDays(t *testing.T) {
 		t.Errorf("default order should be desc (newest first); newer at %d, older at %d", idxNewerDesc, idxOlderDesc)
 	}
 
-	_, asc := get(t, h, "/timeline?order=asc")
+	_, asc := get(t, h, "/views/timeline?order=asc")
 	idxNewerAsc := strings.Index(asc, newer)
 	idxOlderAsc := strings.Index(asc, older)
 	if !(idxOlderAsc < idxNewerAsc) {
@@ -277,7 +277,7 @@ END:VCALENDAR`
 	}
 
 	h := srv.Routes()
-	code, body := get(t, h, "/timeline")
+	code, body := get(t, h, "/views/timeline")
 	if code != 200 {
 		t.Fatalf("GET /timeline → %d", code)
 	}
@@ -337,7 +337,7 @@ func TestTimelineFilterByTagAppliesAcrossKinds(t *testing.T) {
 	defer pool.Exec(context.Background(), `delete from projax.items where id in ($1, $2)`, devID, homeID)
 
 	tag := "tl-tag-work-" + stamp
-	_, body := get(t, h, "/timeline?tag="+tag)
+	_, body := get(t, h, "/views/timeline?tag="+tag)
 	// Phase 5i Slice A: the project picker renders every item path as a
 	// <select> option, so a naive substring match also sees filtered-out
 	// items inside the dropdown. Anchor on the timeline-row link instead.

web/tree_filter.go

@@ -26,12 +26,6 @@ type TreeFilter struct {
 	// exposes an explicit on/off toggle.
 	ProjectPath        string
 	IncludeDescendants bool
-	// Phase 5i fix-shift — saved-view anchor. When set, the URL was
-	// `?view=<uuid>`; chip clicks need to round-trip the value so the user
-	// stays inside the saved view while narrowing further. Not a "filter"
-	// dimension in the matching sense — Matches ignores it — but it lives
-	// in the URL state and on the struct so QueryString preserves it.
-	ViewID string
 }
 
 // Active reports whether any filter dimension is set to something other than
@@ -70,7 +64,6 @@ func ParseTreeFilter(q url.Values) TreeFilter {
 		ShowArchived:       q.Get("show-archived") == "1",
 		ProjectPath:        strings.TrimSpace(q.Get("project")),
 		IncludeDescendants: true,
-		ViewID:             strings.TrimSpace(q.Get("view")),
 	}
 	if v := strings.TrimSpace(q.Get("public")); v != "" {
 		// Treat 1/true/yes/on as true; 0/false/no/off as false; anything else nil.
@@ -132,9 +125,6 @@ func (f TreeFilter) QueryString() string {
 			v.Set("project_descendants", "0")
 		}
 	}
-	if f.ViewID != "" {
-		v.Set("view", f.ViewID)
-	}
 	return v.Encode()
 }
 
@@ -489,7 +479,10 @@ type ChipCounts struct {
 // see what they're filtered down to). For an inactive chip the count is what
 // they'd get if they added it. At m's scale (≤100 items × ≤30 chips) this is
 // trivially cheap; no caching needed.
-func computeChipCounts(items []*store.Item, current TreeFilter, linkKinds map[string]map[string]struct{}, allTags []string) ChipCounts {
+func computeChipCounts(items []*store.Item, current TreeFilter, linkKinds map[string]map[string]struct{}, allTags []string, base string) ChipCounts {
+	if base == "" {
+		base = "/"
+	}
 	count := func(f TreeFilter) int {
 		// Branch-keep semantics aren't relevant for chip counts — we want a
 		// raw "how many items match this filter directly" so the chip number
@@ -507,7 +500,7 @@ func computeChipCounts(items []*store.Item, current TreeFilter, linkKinds map[st
 		next := current.ToggleTag(tag)
 		out.Tags = append(out.Tags, ChipCount{
 			Label:  tag,
-			URL:    next.URL(),
+			URL:    next.URLOn(base),
 			Count:  count(next),
 			Active: contains(current.Tags, tag),
 		})
@@ -516,7 +509,7 @@ func computeChipCounts(items []*store.Item, current TreeFilter, linkKinds map[st
 		next := current.ToggleManagement(mode)
 		out.Management = append(out.Management, ChipCount{
 			Label:  mode,
-			URL:    next.URL(),
+			URL:    next.URLOn(base),
 			Count:  count(next),
 			Active: contains(current.Management, mode),
 		})
@@ -525,7 +518,7 @@ func computeChipCounts(items []*store.Item, current TreeFilter, linkKinds map[st
 		next := current.ToggleStatus(st)
 		out.Status = append(out.Status, ChipCount{
 			Label:  st,
-			URL:    next.URL(),
+			URL:    next.URLOn(base),
 			Count:  count(next),
 			Active: contains(current.Status, st),
 		})
@@ -534,7 +527,7 @@ func computeChipCounts(items []*store.Item, current TreeFilter, linkKinds map[st
 		next := current.ToggleHas(h)
 		out.Has = append(out.Has, ChipCount{
 			Label:  h,
-			URL:    next.URL(),
+			URL:    next.URLOn(base),
 			Count:  count(next),
 			Active: contains(current.HasLinks, h),
 		})
@@ -543,7 +536,7 @@ func computeChipCounts(items []*store.Item, current TreeFilter, linkKinds map[st
 		next := current.ToggleShowArchived()
 		out.ShowArchived = ChipCount{
 			Label:  "show archived",
-			URL:    next.URL(),
+			URL:    next.URLOn(base),
 			Count:  count(next),
 			Active: current.ShowArchived,
 		}

web/tree_filter_test.go

@@ -177,7 +177,7 @@ func TestComputeChipCountsTagCounts(t *testing.T) {
 	both := &store.Item{ID: "x", Slug: "x", Title: "X", Tags: []string{"work", "dev"}, Status: "active"}
 	items := []*store.Item{work, dev, both}
 	f := TreeFilter{Status: []string{"active"}}
-	counts := computeChipCounts(items, f, map[string]map[string]struct{}{}, []string{"work", "dev"})
+	counts := computeChipCounts(items, f, map[string]map[string]struct{}{}, []string{"work", "dev"}, "/views/tree")
 	if len(counts.Tags) != 2 {
 		t.Fatalf("expected 2 tag chips, got %d", len(counts.Tags))
 	}

web/view_type.go

@@ -63,13 +63,13 @@ func (s ViewTypeSet) Resolve(vt string) string {
 // this. The narrow tree/dashboard set is the seed; slices C–E grow it.
 func PageViewTypes(route string) ViewTypeSet {
 	switch route {
-	case "/", "tree":
+	case "/", "/views/tree", "tree":
 		return ViewTypeSet{
 			Default: ViewTypeList,
 			// Slice B: list + card. Slice C: kanban joins.
 			Allowed: []string{ViewTypeList, ViewTypeCard, ViewTypeKanban},
 		}
-	case "/dashboard", "dashboard":
+	case "/dashboard", "/views/dashboard", "dashboard":
 		// Dashboard is locked to its Phase 5h tabbed-tiles surface in slice B.
 		// The view_type chip is informational only here; switching templates
 		// for card vs list on /dashboard is a follow-up slice (the tabbed
@@ -79,12 +79,12 @@ func PageViewTypes(route string) ViewTypeSet {
 			Default: ViewTypeCard,
 			Allowed: []string{ViewTypeCard},
 		}
-	case "/timeline", "timeline":
+	case "/timeline", "/views/timeline", "timeline":
 		return ViewTypeSet{
 			Default: ViewTypeTimeline,
 			Allowed: []string{ViewTypeTimeline},
 		}
-	case "/calendar", "calendar":
+	case "/calendar", "/views/calendar", "calendar":
 		return ViewTypeSet{
 			Default: ViewTypeCalendar,
 			Allowed: []string{ViewTypeCalendar},

web/view_type_test.go

@@ -18,10 +18,10 @@ func TestParseViewTypeFallsBackOnUnknown(t *testing.T) {
 		{"/", "list", ViewTypeList},                 // explicit default
 		{"/", "kanban", ViewTypeKanban},             // unlocked in slice C
 		{"/", "junk", ViewTypeList},                 // unknown → default
-		{"/dashboard", "", ViewTypeCard},            // default for dashboard
-		{"/dashboard", "list", ViewTypeCard},        // not allowed in slice B → default
-		{"/timeline", "card", ViewTypeTimeline},     // locked
-		{"/calendar", "kanban", ViewTypeCalendar},   // locked
+		{"/views/dashboard", "", ViewTypeCard},            // default for dashboard
+		{"/views/dashboard", "list", ViewTypeCard},        // not allowed in slice B → default
+		{"/views/timeline", "card", ViewTypeTimeline},     // locked
+		{"/views/calendar", "kanban", ViewTypeCalendar},   // locked
 	}
 	for _, tc := range cases {
 		set := PageViewTypes(tc.route)

web/views.go

@@ -11,39 +11,197 @@ import (
 	"github.com/m/projax/store"
 )
 
-// Phase 5i Slice D — saved views handlers. Page-agnostic: a view bundles a
-// filter + view_type + sort/group_by and renders on any page that supports
-// that view_type. The sidebar in layout.tmpl lists every saved view; the
-// /views index lets m manage them.
+// Phase 5j paliad-shape views handlers. Slice B introduces the route
+// family; slices C–G evolve the render, editor, system-views, sidebar,
+// and polish layers.
+//
+// Route table:
+//   GET  /views                  → handleViewsLanding   (MRU 302 or shell)
+//   GET  /views/{slug}           → handleViewRender     (saved or system)
+//   GET  /views/new              → handleViewEditor     (blank)
+//   GET  /views/{slug}/edit      → handleViewEditor     (existing)
+//   POST /views                  → handleViewCreate
+//   POST /views/{slug}           → handleViewUpdate
+//   POST /views/{slug}/delete    → handleViewDelete
+//   POST /views/reorder          → handleViewReorder    (slice G — wired now,
+//                                                        used in v2)
 
-// handleViewsIndex renders the list + create-form page.
-func (s *Server) handleViewsIndex(w http.ResponseWriter, r *http.Request) {
+// handleViewsLanding implements m's Q5 pick: 302 to the most-recently-used
+// view if any, else render the onboarding shell listing every saved view.
+func (s *Server) handleViewsLanding(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Query().Get("nodefault") != "1" {
+		mr, err := s.Store.MostRecentView(r.Context())
+		if err != nil {
+			s.Logger.Warn("views landing: mru", "err", err)
+		} else if mr != nil {
+			http.Redirect(w, r, "/views/"+mr.Slug, http.StatusFound)
+			return
+		}
+	}
 	views, err := s.Store.ListViews(r.Context())
 	if err != nil {
 		s.fail(w, r, err)
 		return
 	}
-	// Prefill: a save-from-page link can pass ?prefill_filter=<encoded TreeFilter
-	// URL query>&prefill_view_type=<vt>&prefill_page=<route> so the form opens
-	// with the user's current state already typed in.
-	prefill := map[string]string{
-		"filter":    r.URL.Query().Get("prefill_filter"),
-		"view_type": r.URL.Query().Get("prefill_view_type"),
-		"page":      r.URL.Query().Get("prefill_page"),
-	}
-	s.render(w, r, "views", map[string]any{
-		"Title":   "views",
-		"Views":   views,
-		"Prefill": prefill,
-		// Catalog of selectable values for the form selects.
-		"AllViewTypes":      allViewTypes,
-		"DefaultForOptions": []string{"", "tree", "dashboard", "calendar", "timeline"},
-		"SortDirOptions":    []string{"", "asc", "desc"},
-		"GroupByOptions":    []string{"", "status", "area", "tag", "management"},
+	s.render(w, r, "views_landing", map[string]any{
+		"Title": "views",
+		"Views": views,
 	})
 }
 
-// handleViewCreate accepts the create-view form POST.
+// handleViewRender resolves a slug into either a user view (Slice A
+// schema) or a system view (Slice C), then renders the appropriate
+// template. The render path also fire-and-forgets a TouchView so the
+// view climbs the MRU ladder for the next /views landing redirect.
+//
+// Slice B implementation: only user views are wired; system views
+// resolve via LookupSystemView (added in Slice C) and 404 in this slice
+// when the slug is unknown.
+func (s *Server) handleViewRender(w http.ResponseWriter, r *http.Request) {
+	slug := r.PathValue("slug")
+	if slug == "" {
+		http.NotFound(w, r)
+		return
+	}
+	v, err := s.Store.GetView(r.Context(), slug)
+	if errors.Is(err, store.ErrViewNotFound) {
+		http.NotFound(w, r)
+		return
+	}
+	if err != nil {
+		s.fail(w, r, err)
+		return
+	}
+	if err := s.Store.TouchView(r.Context(), slug); err != nil {
+		s.Logger.Warn("touch view", "slug", slug, "err", err)
+	}
+
+	// Parse the saved spec.
+	filter, viewType, groupBy := decodeViewSpec(v.FilterJSON)
+	// Allow URL chip overlay so chip clicks inside a saved view narrow
+	// further. The page chip URLs round-trip ?view= via the URL anchor
+	// added in slice E's sidebar wiring; here we just respect anything
+	// the user typed in the query.
+	urlFilter := ParseTreeFilter(r.URL.Query())
+	overlayURLOntoSavedFilter(&filter, urlFilter, r.URL.Query())
+	if raw := strings.TrimSpace(r.URL.Query().Get("view_type")); raw != "" {
+		viewType = raw
+	}
+	if raw := strings.TrimSpace(r.URL.Query().Get("group_by")); raw != "" {
+		groupBy = raw
+	}
+
+	s.renderViewPage(w, r, v, filter, viewType, groupBy)
+}
+
+// renderViewPage runs the shared render path for a resolved view (user
+// view or future system view). Slice B reuses the tree handler's
+// rendering pieces — list / card / kanban share the tree-section
+// dispatch shape. Calendar / timeline view_types fall back to list in
+// slice B; slice D wires their dedicated templates.
+func (s *Server) renderViewPage(w http.ResponseWriter, r *http.Request, v *store.View, filter TreeFilter, viewType, groupBy string) {
+	items, err := s.Items.ListAll(r.Context())
+	if err != nil {
+		s.fail(w, r, err)
+		return
+	}
+	tags, err := s.Items.AllTags(r.Context())
+	if err != nil {
+		s.fail(w, r, err)
+		return
+	}
+	linkKinds, err := s.linkKindsByItem(r.Context())
+	if err != nil {
+		s.fail(w, r, err)
+		return
+	}
+	viewSet := PageViewTypes("/")
+	if viewType == "" {
+		viewType = viewSet.Default
+	}
+	viewType = viewSet.Resolve(viewType)
+	roots, orphans, total, orphanN, matched := applyTreeFilter(items, filter, linkKinds)
+	base := "/views/" + v.Slug
+	counts := computeChipCounts(items, filter, linkKinds, tags, base)
+	cardItems := flatMatchedItems(items, filter, linkKinds)
+	if groupBy == "" {
+		groupBy = ParseGroupBy(r.URL.Query())
+	}
+	kanban := BuildKanbanBoard(cardItems, groupBy)
+	groupByChips := GroupByChips(base, filter, groupBy)
+	data := map[string]any{
+		"Title":             v.Name,
+		"View":              v,
+		"Roots":             roots,
+		"Orphans":           orphans,
+		"Total":             total,
+		"OrphanN":           orphanN,
+		"Matched":           matched,
+		"AllTags":           tags,
+		"Filter":            filter,
+		"Counts":            counts,
+		"Projects":          parentOptionsFromItems(items),
+		"BasePath":          base,
+		"ProjectChipTarget": "#tree-section",
+		"ViewType":          viewType,
+		"ViewTypeChips":     ViewTypeChips(base, filter, viewType),
+		"CardItems":         cardItems,
+		"Kanban":            kanban,
+		"GroupBy":           groupBy,
+		"GroupByChips":      groupByChips,
+		"ActiveTags":        filter.Tags,
+	}
+	if r.Header.Get("HX-Request") == "true" {
+		s.render(w, r, "tree_section", data)
+		return
+	}
+	s.render(w, r, "view_render", data)
+}
+
+// handleViewEditor renders the create / edit form. Slice B ships a
+// minimal placeholder; Slice D rebuilds the form with the chip strip
+// + slug derivation + icon picker.
+func (s *Server) handleViewEditor(w http.ResponseWriter, r *http.Request) {
+	slug := r.PathValue("slug")
+	var (
+		view  *store.View
+		err   error
+		title = "new view"
+	)
+	if slug != "" {
+		view, err = s.Store.GetView(r.Context(), slug)
+		if errors.Is(err, store.ErrViewNotFound) {
+			http.NotFound(w, r)
+			return
+		}
+		if err != nil {
+			s.fail(w, r, err)
+			return
+		}
+		title = "edit " + view.Name
+	}
+	filterQuery := ""
+	currentViewType := "list"
+	if view != nil {
+		f, vt, _ := decodeViewSpec(view.FilterJSON)
+		filterQuery = f.QueryString()
+		if vt != "" {
+			currentViewType = vt
+		}
+	}
+	s.render(w, r, "view_editor", map[string]any{
+		"Title":          title,
+		"View":           view,
+		"FilterQuery":    filterQuery,
+		"ViewTypes":      []string{ViewTypeList, ViewTypeCard, ViewTypeKanban},
+		"CurrentVT":      currentViewType,
+		"GroupByOptions": []string{"", "status", "area", "tag", "management"},
+		"SortDirOptions": []string{"", "asc", "desc"},
+		"IconKeys":       IconRegistryKeys(),
+	})
+}
+
+// handleViewCreate accepts the create form POST.
 func (s *Server) handleViewCreate(w http.ResponseWriter, r *http.Request) {
 	if err := r.ParseForm(); err != nil {
 		s.fail(w, r, err)
@@ -56,69 +214,15 @@ func (s *Server) handleViewCreate(w http.ResponseWriter, r *http.Request) {
 	}
 	v, err := s.Store.CreateView(r.Context(), in)
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		s.writeViewError(w, err)
 		return
 	}
-	http.Redirect(w, r, "/views/"+v.ID, http.StatusSeeOther)
+	http.Redirect(w, r, "/views/"+v.Slug, http.StatusSeeOther)
 }
 
-// handleViewEdit renders the edit form for an existing view, pre-populated
-// with the row's current values. Submit posts back to /views/<id>.
-func (s *Server) handleViewEdit(w http.ResponseWriter, r *http.Request) {
-	id := strings.TrimSuffix(strings.TrimPrefix(r.URL.Path, "/views/"), "/edit")
-	if id == "" {
-		http.NotFound(w, r)
-		return
-	}
-	v, err := s.Store.GetView(r.Context(), id)
-	if err != nil {
-		if errors.Is(err, store.ErrViewNotFound) {
-			http.NotFound(w, r)
-			return
-		}
-		s.fail(w, r, err)
-		return
-	}
-	filterQuery, err := filterJSONToQuery(v.FilterJSON)
-	if err != nil {
-		s.Logger.Warn("filterJSONToQuery", "id", id, "err", err)
-	}
-	s.render(w, r, "view_edit", map[string]any{
-		"Title":             "edit view",
-		"View":              v,
-		"FilterQuery":       filterQuery,
-		"AllViewTypes":      allViewTypes,
-		"DefaultForOptions": []string{"", "tree", "dashboard", "calendar", "timeline"},
-		"SortDirOptions":    []string{"", "asc", "desc"},
-		"GroupByOptions":    []string{"", "status", "area", "tag", "management"},
-	})
-}
-
-// filterJSONToQuery rebuilds a URL-query representation of a stored
-// filter_json so the edit form can pre-populate the `filter_query` input
-// field. Inverse of filterQueryToJSON.
-func filterJSONToQuery(filterJSON []byte) (string, error) {
-	if len(filterJSON) == 0 {
-		return "", nil
-	}
-	payload := map[string]any{}
-	if err := json.Unmarshal(filterJSON, &payload); err != nil {
-		return "", err
-	}
-	f := filterFromJSONPayload(payload)
-	// QueryString re-emits the canonical URL query form; that's exactly the
-	// shape the form's `filter_query` input expects on round-trip.
-	return f.QueryString(), nil
-}
-
-// handleViewWrite dispatches the /views/<id> POST routes: bare path is
-// update; /views/<id>/delete is soft-delete.
-func (s *Server) handleViewWrite(w http.ResponseWriter, r *http.Request) {
-	path := strings.TrimPrefix(r.URL.Path, "/views/")
-	if base, ok := strings.CutSuffix(path, "/delete"); ok {
-		s.handleViewDelete(w, r, base)
-		return
-	}
+// handleViewUpdate accepts the edit form POST.
+func (s *Server) handleViewUpdate(w http.ResponseWriter, r *http.Request) {
+	slug := r.PathValue("slug")
 	if err := r.ParseForm(); err != nil {
 		s.fail(w, r, err)
 		return
@@ -128,48 +232,23 @@ func (s *Server) handleViewWrite(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, err.Error(), http.StatusBadRequest)
 		return
 	}
-	if _, err := s.Store.UpdateView(r.Context(), path, in); err != nil {
-		if errors.Is(err, store.ErrViewNotFound) {
-			http.NotFound(w, r)
-			return
-		}
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
-	}
-	http.Redirect(w, r, "/views", http.StatusSeeOther)
-}
-
-// handleViewDelete soft-deletes by id.
-func (s *Server) handleViewDelete(w http.ResponseWriter, r *http.Request, id string) {
-	if err := s.Store.SoftDeleteView(r.Context(), id); err != nil {
-		if errors.Is(err, store.ErrViewNotFound) {
-			http.NotFound(w, r)
-			return
-		}
-		s.fail(w, r, err)
-		return
-	}
-	http.Redirect(w, r, "/views", http.StatusSeeOther)
-}
-
-// handleViewRedirect resolves /views/<uuid> GET into a redirect to the
-// appropriate Views-supporting page with ?view=<uuid> appended. The target
-// page resolves the saved filter+view_type at render time via
-// applySavedView. /views/<id>/edit is dispatched separately via the more
-// specific route registered first; this handler ignores the edit suffix
-// defensively when the routing pattern doesn't match for some reason.
-func (s *Server) handleViewRedirect(w http.ResponseWriter, r *http.Request) {
-	id := strings.TrimPrefix(r.URL.Path, "/views/")
-	if id == "" {
-		http.NotFound(w, r)
-		return
-	}
-	if strings.HasSuffix(id, "/edit") {
-		s.handleViewEdit(w, r)
-		return
-	}
-	v, err := s.Store.GetView(r.Context(), id)
+	v, err := s.Store.UpdateView(r.Context(), slug, in)
 	if err != nil {
+		if errors.Is(err, store.ErrViewNotFound) {
+			http.NotFound(w, r)
+			return
+		}
+		s.writeViewError(w, err)
+		return
+	}
+	http.Redirect(w, r, "/views/"+v.Slug, http.StatusSeeOther)
+}
+
+// handleViewDelete soft-… nope. New schema is hard-delete (no
+// deleted_at). One POST removes the row.
+func (s *Server) handleViewDelete(w http.ResponseWriter, r *http.Request) {
+	slug := r.PathValue("slug")
+	if err := s.Store.DeleteView(r.Context(), slug); err != nil {
 		if errors.Is(err, store.ErrViewNotFound) {
 			http.NotFound(w, r)
 			return
@@ -177,64 +256,89 @@ func (s *Server) handleViewRedirect(w http.ResponseWriter, r *http.Request) {
 		s.fail(w, r, err)
 		return
 	}
-	target := targetRouteForViewType(v.ViewType)
-	q := url.Values{}
-	q.Set("view", v.ID)
-	http.Redirect(w, r, target+"?"+q.Encode(), http.StatusSeeOther)
+	http.Redirect(w, r, "/views", http.StatusSeeOther)
 }
 
-// targetRouteForViewType picks a sensible landing route given the view's
-// view_type. card/list/kanban land on /; calendar on /calendar; timeline on
-// /timeline. Slice E will let `is_default_for` override.
-func targetRouteForViewType(vt string) string {
-	switch vt {
-	case ViewTypeCalendar:
-		return "/calendar"
-	case ViewTypeTimeline:
-		return "/timeline"
-	case ViewTypeCard, ViewTypeList, ViewTypeKanban:
-		return "/"
+// handleViewReorder takes a comma-separated slug list and applies new
+// sort_order values. Wired now so slice G's drag UI has a target.
+func (s *Server) handleViewReorder(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		s.fail(w, r, err)
+		return
 	}
-	return "/"
+	raw := strings.TrimSpace(r.PostForm.Get("slugs"))
+	if raw == "" {
+		http.Error(w, "slugs is required", http.StatusBadRequest)
+		return
+	}
+	slugs := strings.Split(raw, ",")
+	for i, slug := range slugs {
+		slugs[i] = strings.TrimSpace(slug)
+	}
+	if err := s.Store.ReorderViews(r.Context(), slugs); err != nil {
+		s.fail(w, r, err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
 }
 
-// viewInputFromForm decodes the create/update form. filter_json is accepted
-// as either raw JSON (textarea) OR as an encoded query string under
-// `filter_query` so the save-from-page workflow can prefill from a TreeFilter
-// the user assembled via chips.
+// writeViewError maps the typed store errors to friendly HTTP status +
+// banner copy. Falls back to 400 for anything else.
+func (s *Server) writeViewError(w http.ResponseWriter, err error) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	switch {
+	case errors.Is(err, store.ErrViewSlugFormat):
+		http.Error(w, "slug must match ^[a-z0-9][a-z0-9-]{0,62}$ (lowercase, no underscores, no leading dash)", http.StatusBadRequest)
+	case errors.Is(err, store.ErrViewSlugReserved):
+		http.Error(w, "slug is reserved (system views and top-level routes shadow it)", http.StatusBadRequest)
+	case errors.Is(err, store.ErrViewSlugTaken):
+		http.Error(w, "slug already exists — pick a different one", http.StatusConflict)
+	default:
+		http.Error(w, err.Error(), http.StatusBadRequest)
+	}
+}
+
+// viewInputFromForm decodes the create/edit form. Slug + name are
+// required; the rest defaults sensibly. filter_query is optional and
+// canonicalises into filter_json on save (URL-query form is what the
+// editor's chip strip emits in slice D).
 func viewInputFromForm(form url.Values) (store.ViewInput, error) {
 	in := store.ViewInput{
-		Name:         strings.TrimSpace(form.Get("name")),
-		Description:  strings.TrimSpace(form.Get("description")),
-		ViewType:     strings.TrimSpace(form.Get("view_type")),
-		SortField:    strings.TrimSpace(form.Get("sort_field")),
-		SortDir:      strings.TrimSpace(form.Get("sort_dir")),
-		GroupBy:      strings.TrimSpace(form.Get("group_by")),
-		Pinned:       form.Get("pinned") == "1",
-		IsDefaultFor: strings.TrimSpace(form.Get("is_default_for")),
+		Slug:      strings.TrimSpace(form.Get("slug")),
+		Name:      strings.TrimSpace(form.Get("name")),
+		SortField: strings.TrimSpace(form.Get("sort_field")),
+		SortDir:   strings.TrimSpace(form.Get("sort_dir")),
+		GroupBy:   strings.TrimSpace(form.Get("group_by")),
+		ShowCount: form.Get("show_count") == "1",
 	}
-	// Prefer filter_query when present; otherwise fall back to filter_json.
-	if fq := strings.TrimSpace(form.Get("filter_query")); fq != "" {
-		filterJSON, err := filterQueryToJSON(fq)
-		if err != nil {
-			return in, fmt.Errorf("filter_query: %w", err)
-		}
-		in.FilterJSON = filterJSON
-	} else if fj := strings.TrimSpace(form.Get("filter_json")); fj != "" {
-		in.FilterJSON = []byte(fj)
+	if iconRaw := strings.TrimSpace(form.Get("icon")); iconRaw != "" {
+		in.Icon = &iconRaw
 	}
+	viewType := strings.TrimSpace(form.Get("view_type"))
+	if viewType == "" {
+		viewType = ViewTypeList
+	}
+	fq := strings.TrimSpace(form.Get("filter_query"))
+	filterJSON, err := encodeFilterToJSON(fq, viewType)
+	if err != nil {
+		return in, fmt.Errorf("filter_query: %w", err)
+	}
+	in.FilterJSON = filterJSON
 	return in, nil
 }
 
-// filterQueryToJSON parses a TreeFilter URL query and returns the canonical
-// JSON shape stored in `filter_json`. Mirrors the design doc §2 keys.
-func filterQueryToJSON(query string) ([]byte, error) {
+// encodeFilterToJSON turns a URL-query-form filter + view_type into the
+// canonical filter_json shape stored on the view. view_type lives inside
+// the JSON per m's Q2 pick.
+func encodeFilterToJSON(query, viewType string) ([]byte, error) {
 	q, err := url.ParseQuery(strings.TrimPrefix(query, "?"))
 	if err != nil {
 		return nil, err
 	}
 	f := ParseTreeFilter(q)
-	payload := map[string]any{}
+	payload := map[string]any{
+		"view_type": viewType,
+	}
 	if f.Q != "" {
 		payload["q"] = f.Q
 	}
@@ -265,82 +369,65 @@ func filterQueryToJSON(query string) ([]byte, error) {
 	return json.Marshal(payload)
 }
 
-// applyDefaultView resolves the saved view marked is_default_for=<page>
-// when the request URL carries no filter/view-specific params and the user
-// has not opted out via ?nodefault=1. Returns the applied view (for banner
-// labelling) or nil when no default exists / was applied.
-//
-// Per design.md §7 Slice E: defaults are a polish layer. They only kick in
-// on a "clean" landing — the moment the user types a chip click, the URL
-// gains a filter param and the default no longer auto-applies. Same with
-// an explicit ?view=<uuid>.
-func (s *Server) applyDefaultView(r *http.Request, page string, filter *TreeFilter, viewType *string) (*store.View, error) {
-	q := r.URL.Query()
-	if q.Get("nodefault") == "1" {
-		return nil, nil
+// decodeViewSpec parses filter_json into a TreeFilter + view_type +
+// group_by. Inverse of encodeFilterToJSON.
+func decodeViewSpec(filterJSON []byte) (TreeFilter, string, string) {
+	f := TreeFilter{
+		Status:             []string{"active"},
+		IncludeDescendants: true,
 	}
-	// Any filter-affecting param means "user is driving" — skip the default.
-	for _, key := range []string{"q", "tag", "mgmt", "status", "has", "show-archived", "public", "project", "project_id", "project_descendants", "view", "view_type", "group_by"} {
-		if q.Get(key) != "" {
-			return nil, nil
-		}
-	}
-	v, err := s.Store.DefaultViewFor(r.Context(), page)
-	if err != nil || v == nil {
-		return v, err
+	viewType := ""
+	groupBy := ""
+	if len(filterJSON) == 0 {
+		return f, viewType, groupBy
 	}
 	payload := map[string]any{}
-	if len(v.FilterJSON) > 0 {
-		if err := json.Unmarshal(v.FilterJSON, &payload); err != nil {
-			return v, fmt.Errorf("decode default filter_json: %w", err)
+	if err := json.Unmarshal(filterJSON, &payload); err != nil {
+		return f, viewType, groupBy
+	}
+	if v, ok := payload["view_type"].(string); ok {
+		viewType = v
+	}
+	if v, ok := payload["group_by"].(string); ok {
+		groupBy = v
+	}
+	if v, ok := payload["q"].(string); ok {
+		f.Q = v
+	}
+	if v, ok := payload["tags"].([]any); ok {
+		f.Tags = anySliceToStrings(v)
+	}
+	if v, ok := payload["management"].([]any); ok {
+		f.Management = anySliceToStrings(v)
+	}
+	if v, ok := payload["status"].([]any); ok {
+		f.Status = anySliceToStrings(v)
+		if len(f.Status) == 0 {
+			f.Status = []string{"active"}
 		}
 	}
-	*filter = filterFromJSONPayload(payload)
-	*viewType = v.ViewType
-	return v, nil
+	if v, ok := payload["has_links"].([]any); ok {
+		f.HasLinks = anySliceToStrings(v)
+	}
+	if v, ok := payload["public"].(bool); ok {
+		f.Public = &v
+	}
+	if v, ok := payload["show_archived"].(bool); ok && v {
+		f.ShowArchived = true
+	}
+	if v, ok := payload["project_path"].(string); ok {
+		f.ProjectPath = v
+	}
+	if v, ok := payload["include_descendants"].(bool); ok {
+		f.IncludeDescendants = v
+	}
+	return f, viewType, groupBy
 }
 
-// applySavedView resolves a `?view=<uuid>` reference and folds the persisted
-// filter + view_type back into the supplied TreeFilter + view-type slot.
-// URL chip params OVERLAY the saved filter — a saved view scoped to
-// `dev` with `?tag=work` added narrows further. Transient overlays don't
-// auto-save back to the view (the URL is bookmarkable, but to persist the
-// drift the user opens /views/<id>/edit).
-//
-// Returns the saved view (for chip labelling) or nil when no `?view=` was
-// given. Errors are logged + returned (handlers can choose to ignore).
-func (s *Server) applySavedView(r *http.Request, filter *TreeFilter, viewType *string) (*store.View, error) {
-	id := strings.TrimSpace(r.URL.Query().Get("view"))
-	if id == "" {
-		return nil, nil
-	}
-	v, err := s.Store.GetView(r.Context(), id)
-	if err != nil {
-		return nil, err
-	}
-	payload := map[string]any{}
-	if len(v.FilterJSON) > 0 {
-		if err := json.Unmarshal(v.FilterJSON, &payload); err != nil {
-			return v, fmt.Errorf("decode filter_json: %w", err)
-		}
-	}
-	saved := filterFromJSONPayload(payload)
-	saved.ViewID = id
-	q := r.URL.Query()
-	overlayURLFields(&saved, *filter, q)
-	*filter = saved
-	// view_type: URL wins when explicitly set, otherwise the saved value.
-	if strings.TrimSpace(q.Get("view_type")) == "" {
-		*viewType = v.ViewType
-	}
-	return v, nil
-}
-
-// overlayURLFields lets URL-provided chip values override the saved-view
-// baseline. The URL filter is the parsed-from-query TreeFilter; q is the
-// raw url.Values so we can detect "field was set in the URL" distinct from
-// "field's value happens to equal the zero value".
-func overlayURLFields(base *TreeFilter, urlFilter TreeFilter, q url.Values) {
+// overlayURLOntoSavedFilter applies URL-query chip values on top of the
+// saved-view baseline. Same pattern the 5i fix-shift had (URL overrides
+// saved); slice B reintroduces it here on the /views/{slug} render path.
+func overlayURLOntoSavedFilter(base *TreeFilter, urlFilter TreeFilter, q url.Values) {
 	if q.Get("q") != "" {
 		base.Q = urlFilter.Q
 	}
@@ -370,47 +457,6 @@ func overlayURLFields(base *TreeFilter, urlFilter TreeFilter, q url.Values) {
 	}
 }
 
-// filterFromJSONPayload is the inverse of filterQueryToJSON. Keys absent
-// from the payload land at their TreeFilter zero value (Status defaults to
-// ["active"] to match ParseTreeFilter).
-func filterFromJSONPayload(p map[string]any) TreeFilter {
-	f := TreeFilter{
-		Status:             []string{"active"},
-		IncludeDescendants: true,
-	}
-	if v, ok := p["q"].(string); ok {
-		f.Q = v
-	}
-	if v, ok := p["tags"].([]any); ok {
-		f.Tags = anySliceToStrings(v)
-	}
-	if v, ok := p["management"].([]any); ok {
-		f.Management = anySliceToStrings(v)
-	}
-	if v, ok := p["status"].([]any); ok {
-		f.Status = anySliceToStrings(v)
-		if len(f.Status) == 0 {
-			f.Status = []string{"active"}
-		}
-	}
-	if v, ok := p["has_links"].([]any); ok {
-		f.HasLinks = anySliceToStrings(v)
-	}
-	if v, ok := p["public"].(bool); ok {
-		f.Public = &v
-	}
-	if v, ok := p["show_archived"].(bool); ok && v {
-		f.ShowArchived = true
-	}
-	if v, ok := p["project_path"].(string); ok {
-		f.ProjectPath = v
-	}
-	if v, ok := p["include_descendants"].(bool); ok {
-		f.IncludeDescendants = v
-	}
-	return f
-}
-
 func anySliceToStrings(in []any) []string {
 	out := make([]string, 0, len(in))
 	for _, v := range in {

web/views_test.go

@@ -2,183 +2,152 @@ package web_test
 
 import (
 	"context"
-	"encoding/json"
 	"net/url"
 	"strings"
 	"testing"
 	"time"
 )
 
-// TestViewsCRUDRoundTrip covers create → list → open (redirect to scoped page) →
-// delete, end-to-end. Requires DB. Slice D — projax.views table CRUD.
-func TestViewsCRUDRoundTrip(t *testing.T) {
+// TestViewsLandingOnboarding asserts that GET /views with no views and no
+// MRU renders the onboarding shell ("No saved views yet" + "+ New view").
+func TestViewsLandingOnboarding(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-
-	stamp := strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
-	name := "p5i-D-view-" + stamp
-
-	defer pool.Exec(context.Background(),
-		`UPDATE projax.views SET deleted_at = now() WHERE name = $1 AND deleted_at IS NULL`, name)
-
-	// Create.
-	form := url.Values{}
-	form.Set("name", name)
-	form.Set("view_type", "card")
-	form.Set("filter_query", "tag=work&mgmt=mai")
-	code, _ := post(t, h, "/views", form)
-	if code != 303 {
-		t.Fatalf("POST /views status=%d, want 303", code)
+	// Clear any leftover touched views from prior runs so the MRU 302
+	// doesn't fire and steal the response.
+	if _, err := pool.Exec(context.Background(),
+		`UPDATE projax.views SET last_used_at = NULL`); err != nil {
+		t.Fatalf("reset mru: %v", err)
+	}
+	// Also clear ALL views so the onboarding shell renders (othewise the
+	// landing still ListViews-displays them).
+	if _, err := pool.Exec(context.Background(), `DELETE FROM projax.views`); err != nil {
+		t.Fatalf("clear views: %v", err)
 	}
-
-	// List page lists the new view.
 	code, body := get(t, h, "/views")
 	if code != 200 {
-		t.Fatalf("GET /views status=%d", code)
+		t.Fatalf("GET /views status=%d body=%q", code, body)
 	}
-	if !strings.Contains(body, name) {
-		t.Errorf("GET /views body missing %q", name)
+	if !strings.Contains(body, "No saved views yet") {
+		t.Error("onboarding shell should surface the no-views nudge")
 	}
-
-	// Fetch row to grab the id (and validate filter_json round-trip).
-	var (
-		id         string
-		filterJSON []byte
-		viewType   string
-	)
-	if err := pool.QueryRow(context.Background(),
-		`SELECT id, filter_json, view_type FROM projax.views WHERE name=$1 AND deleted_at IS NULL`,
-		name,
-	).Scan(&id, &filterJSON, &viewType); err != nil {
-		t.Fatalf("fetch row: %v", err)
-	}
-	if viewType != "card" {
-		t.Errorf("view_type = %q, want 'card'", viewType)
-	}
-	var payload map[string]any
-	if err := json.Unmarshal(filterJSON, &payload); err != nil {
-		t.Fatalf("filter_json unmarshal: %v", err)
-	}
-	if got, _ := payload["tags"].([]any); len(got) != 1 || got[0] != "work" {
-		t.Errorf("filter_json tags = %v, want [work]", payload["tags"])
-	}
-	if got, _ := payload["management"].([]any); len(got) != 1 || got[0] != "mai" {
-		t.Errorf("filter_json management = %v, want [mai]", payload["management"])
-	}
-
-	// GET /views/<id> redirects to the right page with ?view=<id>.
-	code, _ = get(t, h, "/views/"+id)
-	if code != 303 {
-		t.Errorf("GET /views/<id> status=%d, want 303 redirect", code)
-	}
-
-	// Soft delete.
-	code, _ = post(t, h, "/views/"+id+"/delete", url.Values{})
-	if code != 303 {
-		t.Errorf("POST delete status=%d, want 303", code)
-	}
-	var deletedAt *time.Time
-	if err := pool.QueryRow(context.Background(),
-		`SELECT deleted_at FROM projax.views WHERE id=$1`, id,
-	).Scan(&deletedAt); err != nil {
-		t.Fatalf("post-delete read: %v", err)
-	}
-	if deletedAt == nil {
-		t.Error("expected deleted_at to be set after POST /views/<id>/delete")
+	if !strings.Contains(body, `href="/views/new"`) {
+		t.Error("onboarding shell should link to /views/new")
 	}
 }
 
-// TestViewEditFlow exercises the fix for m's bug "we cant edit views yet".
-// GET /views/<id>/edit renders the pre-filled form; POST /views/<id> updates
-// the row in place. Verifies name + view_type + filter_json round-trip.
-func TestViewEditFlow(t *testing.T) {
+// TestViewsLandingMRURedirects asserts that GET /views 302s to the most
+// recently used view when one exists.
+func TestViewsLandingMRURedirects(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
-	ctx := context.Background()
-
 	stamp := strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
-	name := "p5i-fix-edit-" + stamp
-	defer pool.Exec(context.Background(),
-		`UPDATE projax.views SET deleted_at = now() WHERE name = $1 AND deleted_at IS NULL OR name = $2`,
-		name, name+"-renamed")
+	slug := "p5j-b-landing-" + stamp
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug = $1`, slug)
+	// Seed + touch.
+	if _, err := pool.Exec(context.Background(), `
+INSERT INTO projax.views (slug, name, filter_json, last_used_at)
+VALUES ($1, 'P5j B Landing', '{"view_type":"list"}'::jsonb, now())`, slug); err != nil {
+		t.Fatalf("seed view: %v", err)
+	}
+	code, body := get(t, h, "/views")
+	if code != 302 {
+		t.Errorf("GET /views status=%d (want 302 to MRU); body=%q", code, body)
+	}
+}
 
-	var id string
-	if err := pool.QueryRow(ctx, `
-INSERT INTO projax.views (name, view_type, filter_json)
-VALUES ($1, 'list', $2::jsonb)
-RETURNING id`, name, []byte(`{"tags":["dev"]}`)).Scan(&id); err != nil {
+// TestViewRenderShowsSavedView asserts that GET /views/{slug} renders the
+// view's name + slug in the header and the tree-section body.
+func TestViewRenderShowsSavedView(t *testing.T) {
+	srv, pool := mustServer(t)
+	defer pool.Close()
+	h := srv.Routes()
+	stamp := strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
+	slug := "p5j-b-render-" + stamp
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug = $1`, slug)
+	if _, err := pool.Exec(context.Background(), `
+INSERT INTO projax.views (slug, name, filter_json)
+VALUES ($1, 'P5j B Render', '{"view_type":"card"}'::jsonb)`, slug); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
-
-	// GET /views/<id>/edit renders the pre-filled form (not the redirect).
-	code, body := get(t, h, "/views/"+id+"/edit")
+	code, body := get(t, h, "/views/"+slug)
 	if code != 200 {
-		t.Fatalf("GET /views/<id>/edit status=%d, want 200", code)
+		t.Fatalf("GET /views/<slug> status=%d body=%q", code, body)
 	}
-	if !strings.Contains(body, `value="`+name+`"`) {
-		t.Error("edit form should pre-fill the name input")
+	if !strings.Contains(body, "P5j B Render") {
+		t.Error("render should surface the view's name")
 	}
-	if !strings.Contains(body, `value="tag=dev"`) {
-		t.Error("edit form should pre-fill filter_query from filter_json")
+	if !strings.Contains(body, `/views/`+slug) {
+		t.Error("render should surface the view's slug in the header")
 	}
-
-	// Index page now shows an edit link per row.
-	_, idx := get(t, h, "/views")
-	if !strings.Contains(idx, `/views/`+id+`/edit`) {
-		t.Error("/views should expose an edit link per row")
-	}
-
-	// POST /views/<id> updates the row.
-	form := url.Values{}
-	form.Set("name", name+"-renamed")
-	form.Set("view_type", "card")
-	form.Set("filter_query", "tag=work&mgmt=mai")
-	code, _ = post(t, h, "/views/"+id, form)
-	if code != 303 {
-		t.Fatalf("POST /views/<id> status=%d, want 303", code)
-	}
-
-	var newName, newType string
-	var newFilter []byte
-	if err := pool.QueryRow(ctx,
-		`SELECT name, view_type, filter_json FROM projax.views WHERE id = $1`, id,
-	).Scan(&newName, &newType, &newFilter); err != nil {
-		t.Fatalf("post-update read: %v", err)
-	}
-	if newName != name+"-renamed" {
-		t.Errorf("name = %q, want %q", newName, name+"-renamed")
-	}
-	if newType != "card" {
-		t.Errorf("view_type = %q, want 'card'", newType)
-	}
-	payload := map[string]any{}
-	_ = json.Unmarshal(newFilter, &payload)
-	tags, _ := payload["tags"].([]any)
-	if len(tags) != 1 || tags[0] != "work" {
-		t.Errorf("filter_json tags = %v, want [work] post-update", payload["tags"])
+	if !strings.Contains(body, `class="tree-card-grid"`) {
+		t.Error("view_type=card should render the card grid")
 	}
 }
 
-// TestSavedViewPageFilterApply exercises the fix for m's bug "the filters on
-// custom views dont seem to work". A request to /?view=<id>&tag=work narrows
-// the saved view further by overlaying the URL chip onto the persisted
-// filter_json. Previously the saved filter clobbered the URL chips
-// wholesale.
-func TestSavedViewPageFilterApply(t *testing.T) {
+// TestViewRender404OnUnknownSlug — an unknown slug returns 404, not a
+// silent fallback to the tree.
+func TestViewRender404OnUnknownSlug(t *testing.T) {
+	srv, pool := mustServer(t)
+	defer pool.Close()
+	h := srv.Routes()
+	code, _ := get(t, h, "/views/this-slug-does-not-exist-anywhere-9876")
+	if code != 404 {
+		t.Errorf("unknown slug should 404, got %d", code)
+	}
+}
+
+// TestViewCreateAndDelete — POST /views creates; POST /views/<slug>/delete
+// removes. Verifies the slug-format error path too.
+func TestViewCreateAndDelete(t *testing.T) {
+	srv, pool := mustServer(t)
+	defer pool.Close()
+	h := srv.Routes()
+	stamp := strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
+	slug := "p5j-b-crud-" + stamp
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug = $1`, slug)
+
+	form := url.Values{}
+	form.Set("slug", slug)
+	form.Set("name", "P5j B CRUD")
+	form.Set("view_type", "list")
+	form.Set("filter_query", "tag=work")
+	code, _ := post(t, h, "/views", form)
+	if code != 303 {
+		t.Fatalf("create status=%d want 303", code)
+	}
+
+	// Reserved-slug 400.
+	form2 := url.Values{}
+	form2.Set("slug", "dashboard")
+	form2.Set("name", "Should be rejected")
+	form2.Set("view_type", "list")
+	code, body := post(t, h, "/views", form2)
+	if code != 400 {
+		t.Errorf("reserved-slug create should 400, got %d body=%q", code, body)
+	}
+
+	// Delete.
+	code, _ = post(t, h, "/views/"+slug+"/delete", url.Values{})
+	if code != 303 {
+		t.Errorf("delete status=%d want 303", code)
+	}
+}
+
+// TestSavedViewFilterOverlay — chip params on /views/<slug>?tag=x narrow
+// the saved filter. Verifies the slice B render-path overlay.
+func TestSavedViewFilterOverlay(t *testing.T) {
 	srv, pool := mustServer(t)
 	defer pool.Close()
 	h := srv.Routes()
 	ctx := context.Background()
-
 	stamp := strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
-	name := "p5i-fix-overlay-" + stamp
-	devSlug := "p5i-fix-overlay-d-" + stamp
-	homeSlug := "p5i-fix-overlay-h-" + stamp
-
-	defer pool.Exec(context.Background(),
-		`UPDATE projax.views SET deleted_at = now() WHERE name = $1 AND deleted_at IS NULL`, name)
+	slug := "p5j-b-overlay-" + stamp
+	devSlug := "p5j-b-overlay-d-" + stamp
+	homeSlug := "p5j-b-overlay-h-" + stamp
+	defer pool.Exec(context.Background(), `DELETE FROM projax.views WHERE slug = $1`, slug)
 
 	var dev, home string
 	if err := pool.QueryRow(ctx, `select id from projax.items where slug='dev' and cardinality(parent_ids)=0`).Scan(&dev); err != nil {
@@ -190,138 +159,39 @@ func TestSavedViewPageFilterApply(t *testing.T) {
 	var devID, homeID string
 	if err := pool.QueryRow(ctx, `
 INSERT INTO projax.items (kind, title, slug, parent_ids, tags)
-VALUES (array['project']::text[], 'Fix Dev', $1, ARRAY[$2]::uuid[], ARRAY['work'])
+VALUES (array['project']::text[], 'P5jB Dev', $1, ARRAY[$2]::uuid[], ARRAY['work'])
 RETURNING id`, devSlug, dev).Scan(&devID); err != nil {
 		t.Fatalf("seed dev item: %v", err)
 	}
 	if err := pool.QueryRow(ctx, `
 INSERT INTO projax.items (kind, title, slug, parent_ids, tags)
-VALUES (array['project']::text[], 'Fix Home', $1, ARRAY[$2]::uuid[], ARRAY['home'])
+VALUES (array['project']::text[], 'P5jB Home', $1, ARRAY[$2]::uuid[], ARRAY['home'])
 RETURNING id`, homeSlug, home).Scan(&homeID); err != nil {
 		t.Fatalf("seed home item: %v", err)
 	}
-	defer pool.Exec(context.Background(), `delete from projax.items where id in ($1,$2)`, devID, homeID)
+	defer pool.Exec(context.Background(), `DELETE FROM projax.items WHERE id IN ($1,$2)`, devID, homeID)
 
-	// Saved view with view_type=list and NO tag filter — both items should pass.
-	var id string
-	if err := pool.QueryRow(ctx, `
-INSERT INTO projax.views (name, view_type, filter_json)
-VALUES ($1, 'list', '{}'::jsonb)
-RETURNING id`, name).Scan(&id); err != nil {
+	if _, err := pool.Exec(ctx, `
+INSERT INTO projax.views (slug, name, filter_json)
+VALUES ($1, 'P5jB Overlay', '{"view_type":"list"}'::jsonb)`, slug); err != nil {
 		t.Fatalf("seed view: %v", err)
 	}
 
 	devLink := `href="/i/dev.` + devSlug + `"`
 	homeLink := `href="/i/home.` + homeSlug + `"`
 
-	// Open view alone — both rows should appear.
-	_, baseBody := get(t, h, "/?view="+id)
-	if !strings.Contains(baseBody, devLink) {
-		t.Error("saved view without tag filter should show dev row")
+	_, base := get(t, h, "/views/"+slug)
+	if !strings.Contains(base, devLink) {
+		t.Error("saved view without tag should show dev row")
 	}
-	if !strings.Contains(baseBody, homeLink) {
-		t.Error("saved view without tag filter should show home row")
+	if !strings.Contains(base, homeLink) {
+		t.Error("saved view without tag should show home row")
 	}
-
-	// Overlay ?tag=work — home row should disappear; dev should remain.
-	_, narrowedBody := get(t, h, "/?view="+id+"&tag=work")
-	if !strings.Contains(narrowedBody, devLink) {
-		t.Error("?view=<id>&tag=work should still show dev row (work-tagged)")
+	_, narrowed := get(t, h, "/views/"+slug+"?tag=work")
+	if !strings.Contains(narrowed, devLink) {
+		t.Error("URL chip tag=work should keep dev (work-tagged)")
 	}
-	if strings.Contains(narrowedBody, homeLink) {
-		t.Error("?view=<id>&tag=work should hide home row — URL chip must overlay saved filter")
-	}
-
-	// Chip URLs inside the saved view must round-trip the view= param so
-	// chip clicks don't strip the saved view.
-	if !strings.Contains(narrowedBody, "view="+id) {
-		t.Error("chip URLs inside a saved view should carry view=<id> forward")
-	}
-}
-
-// TestDefaultViewAppliedOnCleanURL verifies the Slice E behaviour: when /
-// is requested with no chip params and a default view exists for the page,
-// the saved filter + view_type apply and a "Showing default view: …"
-// banner renders. Adding any chip param (?tag=…) bypasses the default.
-// ?nodefault=1 is the explicit opt-out.
-func TestDefaultViewAppliedOnCleanURL(t *testing.T) {
-	srv, pool := mustServer(t)
-	defer pool.Close()
-	h := srv.Routes()
-	ctx := context.Background()
-
-	stamp := strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
-	name := "p5i-E-default-" + stamp
-	defer pool.Exec(context.Background(),
-		`UPDATE projax.views SET deleted_at = now() WHERE name = $1 AND deleted_at IS NULL`, name)
-
-	if _, err := pool.Exec(ctx, `
-INSERT INTO projax.views (name, view_type, filter_json, is_default_for)
-VALUES ($1, 'card', $2::jsonb, 'tree')`,
-		name, []byte(`{"tags":["work"]}`)); err != nil {
-		t.Fatalf("seed default view: %v", err)
-	}
-
-	// Clean URL: default applies → card view + banner.
-	_, body := get(t, h, "/")
-	if !strings.Contains(body, `class="tree-card-grid"`) {
-		t.Error("clean / should auto-apply default view (card grid expected)")
-	}
-	if !strings.Contains(body, `default-banner`) {
-		t.Error("default-banner should render when a default applies")
-	}
-	if !strings.Contains(body, name) {
-		t.Error("banner should name the applied default view")
-	}
-
-	// Any chip param bypasses the default → list view (no banner).
-	_, withChip := get(t, h, "/?tag=dev")
-	if strings.Contains(withChip, `default-banner`) {
-		t.Error("default banner should disappear once user types a chip")
-	}
-	if !strings.Contains(withChip, `<ul class="forest">`) {
-		t.Error("?tag=dev should render the forest (default not applied)")
-	}
-
-	// Explicit opt-out via ?nodefault=1.
-	_, optOut := get(t, h, "/?nodefault=1")
-	if strings.Contains(optOut, `default-banner`) {
-		t.Error("?nodefault=1 should suppress the default banner")
-	}
-	if !strings.Contains(optOut, `<ul class="forest">`) {
-		t.Error("?nodefault=1 should render the forest (default suppressed)")
-	}
-}
-
-// TestSavedViewAppliedOnQueryParam verifies that opening / with ?view=<uuid>
-// re-applies the saved filter+view_type. We seed a view tagged work=patents
-// and assert the rendered tree has the right ProjectChip / chip-on state.
-func TestSavedViewAppliedOnQueryParam(t *testing.T) {
-	srv, pool := mustServer(t)
-	defer pool.Close()
-	h := srv.Routes()
-	ctx := context.Background()
-
-	stamp := strings.ReplaceAll(time.Now().UTC().Format("150405.000"), ".", "")
-	name := "p5i-D-saved-" + stamp
-	defer pool.Exec(context.Background(),
-		`UPDATE projax.views SET deleted_at = now() WHERE name = $1 AND deleted_at IS NULL`, name)
-
-	// Seed directly via SQL so the assertion focuses on the resolver, not the
-	// form flow tested above.
-	var id string
-	if err := pool.QueryRow(ctx, `
-INSERT INTO projax.views (name, view_type, filter_json)
-VALUES ($1, 'card', $2::jsonb)
-RETURNING id`, name, []byte(`{"project_path":"dev","include_descendants":true}`)).Scan(&id); err != nil {
-		t.Fatalf("seed view: %v", err)
-	}
-
-	_, body := get(t, h, "/?view="+id)
-	if !strings.Contains(body, `class="tree-card-grid"`) {
-		t.Error("?view= should override view_type → card view should render")
-	}
-	if !strings.Contains(body, `class="proj-chip chip-on"`) {
-		t.Error("?view= should apply project filter chip → proj-chip should be on")
+	if strings.Contains(narrowed, homeLink) {
+		t.Error("URL chip tag=work should hide home")
 	}
 }