diff --git a/db/migrate/20260821195123_add_url_segments_to_libraries_and_folders.co_plan.rb b/db/migrate/20260821195123_add_url_segments_to_libraries_and_folders.co_plan.rb
new file mode 100644
index 00000000..00c024cf
--- /dev/null
+++ b/db/migrate/20260821195123_add_url_segments_to_libraries_and_folders.co_plan.rb
@@ -0,0 +1,161 @@
+# This migration comes from co_plan (originally 20260821000000)
+class AddUrlSegmentsToLibrariesAndFolders < ActiveRecord::Migration[8.1]
+  # Gives libraries and folders the URL segments that make them browsable:
+  # /<handle>/<folder-slug>/<folder-slug>. Resolution walks these one
+  # segment at a time, so nothing stores a joined path and renaming a
+  # folder touches only its own row.
+  #
+  # Slug logic is inlined rather than calling CoPlan::Slug — a migration
+  # has to keep producing the same backfill years from now, even if the
+  # app's slug rules move on.
+  #
+  # Raw portable SQL throughout (select_all / quote), same reasoning as
+  # RequirePlanTypeOnCoplanPlans: this runs on MySQL and PostgreSQL hosts.
+  #
+  # Note on the unique indexes: MySQL treats NULLs as distinct, so the
+  # folder index does not actually constrain root folders (parent_id
+  # NULL). Real enforcement is the Rails validation, which scopes with
+  # IS NULL correctly — matching how `name` uniqueness already works on
+  # this table. The index is for lookup speed on the resolver's hot path.
+  def up
+    add_column :coplan_libraries, :handle, :string
+    add_column :coplan_folders, :slug, :string
+
+    backfill_library_handles
+    backfill_folder_slugs
+
+    change_column_null :coplan_libraries, :handle, false
+    change_column_null :coplan_folders, :slug, false
+    add_index :coplan_libraries, :handle, unique: true, name: "index_coplan_libraries_on_handle"
+    add_index :coplan_folders, [ :library_id, :parent_id, :slug ],
+      unique: true, name: "index_coplan_folders_on_library_and_parent_and_slug"
+  end
+
+  def down
+    remove_index :coplan_folders, name: "index_coplan_folders_on_library_and_parent_and_slug"
+    remove_index :coplan_libraries, name: "index_coplan_libraries_on_handle"
+    remove_column :coplan_folders, :slug
+    remove_column :coplan_libraries, :handle
+  end
+
+  private
+
+  # A personal library's handle comes from the owner's username (their
+  # ldap), falling back to the email local part and then the display
+  # name. Anything else — a team library — uses the library's own name.
+  #
+  # `taken` starts out holding the app's root-level addresses, so a person
+  # whose ldap is "settings" gets "settings-2" rather than a handle the app
+  # would refuse to save. Spelled out here for the same reason the slug
+  # rules are: a migration has to keep producing the same backfill.
+  def backfill_library_handles
+    rows = connection.select_all(<<~SQL)
+      SELECT l.id, l.name, l.owner_type, l.owner_id,
+             u.username AS owner_username, u.email AS owner_email, u.name AS owner_name
+      FROM coplan_libraries l
+      LEFT JOIN coplan_users u
+        ON l.owner_type = 'CoPlan::User' AND l.owner_id = u.id
+      ORDER BY l.created_at, l.id
+    SQL
+
+    taken = %w[
+      _ new edit all
+      plans people libraries library settings search notifications home welcome
+      api agent-instructions admin assets rails up sign_in sign_out integrations
+    ]
+    rows.each do |row|
+      source = row["owner_username"].presence ||
+        row["owner_email"].to_s.split("@").first.presence ||
+        row["owner_name"].presence ||
+        row["name"].presence ||
+        "library"
+      handle = unique_slug(ascii_slugify(source), taken, fallback: "library")
+      taken << handle
+      execute "UPDATE coplan_libraries SET handle = #{quote(handle)} WHERE id = #{quote(row['id'])}"
+    end
+
+    create_missing_user_libraries(taken)
+  end
+
+  # Libraries used to be materialized on first touch, so people who never
+  # loaded a page that needed one have no row. A library is a person's page
+  # now — /<handle> — so everyone needs theirs to exist, not just everyone
+  # who has filed something.
+  def create_missing_user_libraries(taken)
+    rows = connection.select_all(<<~SQL)
+      SELECT u.id, u.username, u.email, u.name
+      FROM coplan_users u
+      LEFT JOIN coplan_libraries l
+        ON l.owner_type = 'CoPlan::User' AND l.owner_id = u.id
+      WHERE l.id IS NULL
+      ORDER BY u.created_at, u.id
+    SQL
+
+    # Formatted rather than quoted: `quote` on a TimeWithZone writes a zone
+    # name into the literal, which strict MySQL refuses.
+    now = Time.current.utc.strftime("%Y-%m-%d %H:%M:%S")
+    rows.each do |row|
+      source = row["username"].presence ||
+        row["email"].to_s.split("@").first.presence ||
+        row["name"].presence ||
+        "library"
+      handle = unique_slug(ascii_slugify(source), taken, fallback: "library")
+      taken << handle
+      execute <<~SQL
+        INSERT INTO coplan_libraries (id, name, handle, owner_type, owner_id, created_at, updated_at)
+        VALUES (#{quote(SecureRandom.uuid_v7)}, 'Library', #{quote(handle)},
+                'CoPlan::User', #{quote(row['id'])}, #{quote(now)}, #{quote(now)})
+      SQL
+    end
+  end
+
+  # Folder slugs only have to be unique among siblings, so uniqueness is
+  # tracked per (library, parent). Deepest-last ordering isn't needed —
+  # a folder's slug depends on its own name alone.
+  def backfill_folder_slugs
+    rows = connection.select_all(<<~SQL)
+      SELECT id, library_id, parent_id, name
+      FROM coplan_folders
+      ORDER BY library_id, parent_id, created_at, id
+    SQL
+
+    taken = {}
+    rows.each do |row|
+      sibling_key = [ row["library_id"], row["parent_id"] ]
+      taken[sibling_key] ||= []
+      slug = unique_slug(slugify(row["name"]), taken[sibling_key], fallback: "folder")
+      taken[sibling_key] << slug
+      execute "UPDATE coplan_folders SET slug = #{quote(slug)} WHERE id = #{quote(row['id'])}"
+    end
+  end
+
+  # Mirrors CoPlan::Slug.call / .handle, inlined so this backfill keeps
+  # producing the same slugs if the app's rules move on. Folders keep
+  # Unicode letters — a folder named 設計 gets a segment that says so —
+  # while handles stay ASCII because they're typed and read aloud.
+  def slugify(text)
+    trim(text.to_s.unicode_normalize(:nfc).downcase.gsub(/[^[[:alnum:]]]+/, "-"))
+  end
+
+  def ascii_slugify(text)
+    trim(text.to_s.unicode_normalize(:nfkd).downcase.gsub(/[^a-z0-9]+/, "-"))
+  end
+
+  def trim(hyphenated)
+    hyphenated.gsub(/-{2,}/, "-").delete_prefix("-").delete_suffix("-")[0, 60].to_s
+      .delete_suffix("-")
+  end
+
+  # Existing data predates any slug rule, so collisions are expected —
+  # "Team EBT" and "team-ebt" both want the same segment. Numeric
+  # suffixes here are a backfill concession; new records get better
+  # disambiguation from the app.
+  def unique_slug(slug, taken, fallback:)
+    candidate = slug.presence || fallback
+    return candidate unless taken.include?(candidate)
+
+    suffix = 2
+    suffix += 1 while taken.include?("#{candidate}-#{suffix}")
+    "#{candidate}-#{suffix}"
+  end
+end
diff --git a/db/migrate/20260821200043_add_plan_slugs_and_url_aliases.co_plan.rb b/db/migrate/20260821200043_add_plan_slugs_and_url_aliases.co_plan.rb
new file mode 100644
index 00000000..c608d456
--- /dev/null
+++ b/db/migrate/20260821200043_add_plan_slugs_and_url_aliases.co_plan.rb
@@ -0,0 +1,52 @@
+# This migration comes from co_plan (originally 20260821000001)
+class AddPlanSlugsAndUrlAliases < ActiveRecord::Migration[8.1]
+  # The leaf segment of a browsable URL, plus the table that keeps old
+  # URLs resolving.
+  #
+  # `slug` is derived from the plan's title with redundancy stripped — a
+  # plan titled "LiveOrder Cart Roadmap" filed in "LiveOrder" is just
+  # "cart-roadmap", because the folder already said the rest.
+  # `slug_suffix` is set only when two plans in the same folder want the
+  # same slug, so it appears in a URL only where it earns something.
+  #
+  # No unique index on (slug, slug_suffix): a plan's uniqueness scope is
+  # the folder it's filed in, which lives in coplan_plan_placements, not
+  # here. Uniqueness is enforced on write against the canonical folder
+  # (Plans::AssignSlug). A real DB constraint becomes possible once a plan
+  # is filed in exactly one library — see the placements collapse.
+  #
+  # Backfill leaves slugs NULL and lets the app fill them in lazily, so
+  # this migration stays fast on a large table and doesn't have to
+  # reimplement the redundancy-stripping rules.
+  def up
+    add_column :coplan_plans, :slug, :string
+    add_column :coplan_plans, :slug_suffix, :string, limit: 8
+    add_index :coplan_plans, [ :slug, :slug_suffix ], name: "index_coplan_plans_on_slug_and_suffix"
+
+    create_table :coplan_url_aliases, id: { type: :string, limit: 36 } do |t|
+      # The stale path, library handle first and no leading slash:
+      # "orders/liveorder/cart-roadmap".
+      t.string :path, null: false, limit: 512
+      # "exact" matches one URL; "prefix" rewrites everything beneath it,
+      # which is how one row covers a renamed folder's whole subtree.
+      t.string :kind, null: false, default: "exact"
+      t.string :target_path, null: false, limit: 512
+      # Cheap eviction signal: rows nobody has ever followed are safe to
+      # drop, because plan_events / library_events can rebuild them.
+      t.integer :resolve_count, null: false, default: 0
+      t.timestamp :last_resolved_at
+      t.timestamps
+    end
+    add_index :coplan_url_aliases, [ :path, :kind ], unique: true,
+      name: "index_coplan_url_aliases_on_path_and_kind"
+    add_index :coplan_url_aliases, [ :kind, :resolve_count, :created_at ],
+      name: "index_coplan_url_aliases_for_pruning"
+  end
+
+  def down
+    drop_table :coplan_url_aliases
+    remove_index :coplan_plans, name: "index_coplan_plans_on_slug_and_suffix"
+    remove_column :coplan_plans, :slug_suffix
+    remove_column :coplan_plans, :slug
+  end
+end
diff --git a/db/migrate/20260821205749_collapse_plan_placements_to_one.co_plan.rb b/db/migrate/20260821205749_collapse_plan_placements_to_one.co_plan.rb
new file mode 100644
index 00000000..9e91b96d
--- /dev/null
+++ b/db/migrate/20260821205749_collapse_plan_placements_to_one.co_plan.rb
@@ -0,0 +1,68 @@
+# This migration comes from co_plan (originally 20260821000002)
+class CollapsePlanPlacementsToOne < ActiveRecord::Migration[8.1]
+  # A plan now lives in exactly one library. The old model let the same
+  # plan sit on many shelves at once — filing someone else's published
+  # plan into your own library was a "bookmark", separate from the
+  # author's copy. In practice nobody used it, and it cost us the one
+  # property a readable URL needs: a document having a single address.
+  #
+  # Collapses existing rows, keeping the author's own placement where
+  # there is one (that's the shelf URLs already resolved to) and
+  # otherwise the oldest, then makes more than one unrepresentable.
+  def up
+    ids = surplus_placement_ids
+    say "Dropping #{ids.size} non-canonical placement(s)" if ids.any?
+    ids.each_slice(500) do |batch|
+      execute <<~SQL.squish
+        DELETE FROM coplan_plan_placements
+        WHERE id IN (#{batch.map { |id| quote(id) }.join(",")})
+      SQL
+    end
+
+    # The new index subsumes index_..._on_plan_id_and_library_id, the old
+    # "one shelf per library" constraint. Added before the old one is
+    # dropped: MySQL requires an index on plan_id for its foreign key and
+    # refuses to drop the last one that satisfies it.
+    add_index :coplan_plan_placements, :plan_id, unique: true,
+      name: "index_coplan_plan_placements_on_plan_id"
+    remove_index :coplan_plan_placements, column: [ :plan_id, :library_id ]
+  end
+
+  def down
+    add_index :coplan_plan_placements, [ :plan_id, :library_id ], unique: true,
+      name: "index_coplan_plan_placements_on_plan_id_and_library_id"
+    remove_index :coplan_plan_placements, column: :plan_id
+  end
+
+  private
+
+  # Grouped in Ruby rather than SQL: picking a winner per plan needs a
+  # correlated "is this the author's library" test, and the portable
+  # forms of that are worse than reading the table. Placement counts are
+  # in the thousands at most.
+  def surplus_placement_ids
+    rows = connection.select_all(<<~SQL.squish).to_a
+      SELECT pp.id AS id, pp.plan_id AS plan_id, pp.created_at AS created_at,
+             lib.owner_type AS owner_type, lib.owner_id AS owner_id,
+             p.created_by_user_id AS author_id
+      FROM coplan_plan_placements pp
+      INNER JOIN coplan_plans p ON p.id = pp.plan_id
+      INNER JOIN coplan_libraries lib ON lib.id = pp.library_id
+    SQL
+
+    rows.group_by { |row| row["plan_id"] }.flat_map do |_plan_id, group|
+      next [] if group.size < 2
+
+      keeper = group.find { |row| authors_own?(row) } || group.min_by { |row| row["created_at"].to_s }
+      (group - [ keeper ]).map { |row| row["id"] }
+    end
+  end
+
+  def authors_own?(row)
+    row["owner_type"] == "CoPlan::User" && row["owner_id"].to_s == row["author_id"].to_s
+  end
+
+  def quote(value)
+    connection.quote(value)
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index c88391df..5322621f 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.1].define(version: 2026_08_20_195225) do
+ActiveRecord::Schema[8.1].define(version: 2026_08_21_205749) do
   create_table "active_admin_comments", id: { type: :string, limit: 36 }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.bigint "author_id"
     t.string "author_type"
@@ -176,19 +176,23 @@
     t.string "library_id", limit: 36, null: false
     t.string "name", null: false
     t.string "parent_id", limit: 36
+    t.string "slug", null: false
     t.datetime "updated_at", null: false
     t.index ["created_by_user_id"], name: "index_coplan_folders_on_created_by_user_id"
     t.index ["library_id", "parent_id", "name"], name: "index_coplan_folders_on_library_id_and_parent_id_and_name", unique: true
+    t.index ["library_id", "parent_id", "slug"], name: "index_coplan_folders_on_library_and_parent_and_slug", unique: true
     t.index ["library_id"], name: "index_coplan_folders_on_library_id"
     t.index ["parent_id"], name: "index_coplan_folders_on_parent_id"
   end
 
   create_table "coplan_libraries", id: { type: :string, limit: 36 }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.datetime "created_at", null: false
+    t.string "handle", null: false
     t.string "name", default: "Library", null: false
     t.string "owner_id", limit: 36, null: false
     t.string "owner_type", null: false
     t.datetime "updated_at", null: false
+    t.index ["handle"], name: "index_coplan_libraries_on_handle", unique: true
     t.index ["owner_type", "owner_id"], name: "index_coplan_libraries_on_owner_type_and_owner_id", unique: true
   end
 
@@ -272,7 +276,7 @@
     t.index ["library_id", "folder_id", "plan_id"], name: "index_coplan_placements_covering_folder_counts"
     t.index ["library_id"], name: "index_coplan_plan_placements_on_library_id"
     t.index ["placed_by_user_id"], name: "fk_rails_ef17324b42"
-    t.index ["plan_id", "library_id"], name: "index_coplan_plan_placements_on_plan_id_and_library_id", unique: true
+    t.index ["plan_id"], name: "index_coplan_plan_placements_on_plan_id", unique: true
   end
 
   create_table "coplan_plan_tags", id: { type: :string, limit: 36 }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
@@ -341,6 +345,8 @@
     t.json "metadata"
     t.string "plan_type_id", limit: 36, null: false
     t.text "search_text", size: :medium
+    t.string "slug"
+    t.string "slug_suffix", limit: 8
     t.text "summary"
     t.string "summary_content_sha256", limit: 64
     t.datetime "summary_generated_at"
@@ -353,6 +359,7 @@
     t.index ["current_plan_version_id"], name: "fk_rails_c401577583"
     t.index ["plan_type_id"], name: "index_coplan_plans_on_plan_type_id"
     t.index ["search_text"], name: "index_coplan_plans_on_search_text", type: :fulltext
+    t.index ["slug", "slug_suffix"], name: "index_coplan_plans_on_slug_and_suffix"
     t.index ["updated_at"], name: "index_coplan_plans_on_updated_at"
     t.index ["visibility", "updated_at"], name: "index_coplan_plans_on_visibility_and_updated_at"
     t.index ["visibility"], name: "index_coplan_plans_on_visibility"
@@ -389,6 +396,18 @@
     t.index ["name"], name: "index_coplan_tags_on_name", unique: true
   end
 
+  create_table "coplan_url_aliases", id: { type: :string, limit: 36 }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.datetime "created_at", null: false
+    t.string "kind", default: "exact", null: false
+    t.timestamp "last_resolved_at"
+    t.string "path", limit: 512, null: false
+    t.integer "resolve_count", default: 0, null: false
+    t.string "target_path", limit: 512, null: false
+    t.datetime "updated_at", null: false
+    t.index ["kind", "resolve_count", "created_at"], name: "index_coplan_url_aliases_for_pruning"
+    t.index ["path", "kind"], name: "index_coplan_url_aliases_on_path_and_kind", unique: true
+  end
+
   create_table "coplan_users", id: { type: :string, limit: 36 }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.boolean "admin", default: false, null: false
     t.string "avatar_url"
diff --git a/db/seeds/development.rb b/db/seeds/development.rb
index 7f21ed16..e11e19c0 100644
--- a/db/seeds/development.rb
+++ b/db/seeds/development.rb
@@ -28,6 +28,18 @@ module DevelopmentSeed
       { name: "Presentation", icon: "presentation", behavior: "presentation", description: "A markdown slide deck — `---` starts a new slide", default_tags: [] }
     ].freeze
 
+    # The browsable-URL showcase renames one folder and retitles one
+    # document, so a freshly seeded app has real aliases to follow at the root.
+    # Both steps are guarded on these values and no-op on re-seed.
+    RENAMED_FOLDER_FROM = "Order platform".freeze
+    RENAMED_FOLDER_TO = "LiveOrder".freeze
+    RETITLED_DOCUMENT_FROM = "LiveOrder pricing rules v1".freeze
+    RETITLED_DOCUMENT_TO = "LiveOrder pricing rules".freeze
+
+    # Left unfiled by DOCUMENTS so the agent organize run below has real
+    # work to do. See seed_agent_organization_run.
+    AGENT_ORGANIZED_KEYS = %w[agent-pick-metrics agent-pick-postmortem agent-pick-vendors].freeze
+
     DOCUMENTS = [
       {
         key: "one-line-decision", author: "alex", type: "ADR", title: "Use UUIDv7 identifiers",
@@ -93,6 +105,43 @@ module DevelopmentSeed
       {
         key: "launch-deck", author: "priya", type: "Presentation", title: "Shared workspaces launch — readout deck",
         tags: %w[collaboration launch], visibility: "published", folder: "Product/Launches/Shared workspace", fixture: :slideshow_deck
+      },
+      # A folder whose documents all repeat its name — the shape that makes
+      # a real library unreadable, and exactly what URL slugs strip. These
+      # land at /<handle>/liveorder/{cart-state-machine,…}, with
+      # "LiveOrder" appearing once, in the folder segment where it belongs.
+      {
+        key: "liveorder-cart", author: "sam", type: "Design Doc", title: "LiveOrder cart state machine",
+        tags: %w[orders design], visibility: "published", folder: RENAMED_FOLDER_TO
+      },
+      {
+        key: "liveorder-webhooks", author: "sam", type: "Design Doc", title: "LiveOrder fulfillment webhooks",
+        tags: %w[orders api], visibility: "published", folder: RENAMED_FOLDER_TO
+      },
+      # Collides with liveorder-pricing once that one is retitled: both
+      # strip to `pricing-rules`, so one picks up a ~suffix.
+      {
+        key: "pricing-rules", author: "sam", type: "General", title: "Pricing rules",
+        tags: %w[orders pricing], visibility: "published", folder: RENAMED_FOLDER_TO
+      },
+      {
+        key: "liveorder-pricing", author: "sam", type: "General", title: RETITLED_DOCUMENT_FROM,
+        tags: %w[orders pricing], visibility: "published", folder: RENAMED_FOLDER_TO
+      },
+      # No `folder:` — these sit loose at the root of Alex's library until
+      # the agent organize run files them (AGENT_ORGANIZED_KEYS). Root-level
+      # documents are also what /<handle> shows with no folder segment.
+      {
+        key: "agent-pick-metrics", author: "alex", type: "Research Note", title: "Activation metrics worth arguing about",
+        tags: %w[product data], visibility: "published", sections: 1
+      },
+      {
+        key: "agent-pick-postmortem", author: "alex", type: "Runbook", title: "Postmortem: the Tuesday cache stampede",
+        tags: %w[operations reliability], visibility: "published", sections: 1
+      },
+      {
+        key: "agent-pick-vendors", author: "alex", type: "General", title: "Vendor evaluation notes",
+        tags: %w[procurement], visibility: "published", sections: 1
       }
     ].freeze
 
@@ -371,8 +420,12 @@ def call
       with_reproducible_faker do
         users = seed_users
         plan_types = seed_plan_types
+        # Before the documents: this rename has to land on an empty folder,
+        # or seed_documents would create RENAMED_FOLDER_TO first and the
+        # rename would collide with it.
+        seed_renamed_folder(users)
         plans = seed_documents(users, plan_types)
-        seed_shared_library_examples(users, plans)
+        seed_retitled_document(plans)
         seed_folder_descriptions(users)
         seed_collaboration_showcase(users, plans)
         seed_agent_organization_run(users, plans)
@@ -433,7 +486,10 @@ def seed_documents(users, plan_types)
         end
 
         plan.tag_names = definition.fetch(:tags)
-        place(plan, definition.fetch(:folder), author)
+        # A definition with no folder stays at the library root — either
+        # because that's the point (root-level documents) or because
+        # something later files it (the agent organize run).
+        place(plan, definition[:folder], author) if definition[:folder]
         plan
       end.transform_keys { |definition| definition.fetch(:key) }
     end
@@ -448,11 +504,28 @@ def place(plan, path, user)
       raise result.error unless result.success?
     end
 
-    def seed_shared_library_examples(users, plans)
-      # Demonstrate that a published document can sit on someone else's shelf
-      # without changing the author's organization.
-      place(plans.fetch("api-gateway"), "Reading list/Security", users.fetch("noura"))
-      place(plans.fetch("experiment-results"), "Research to discuss", users.fetch("alex"))
+    # Renaming is where readable URLs earn their keep: the old address
+    # keeps resolving. One folder rename leaves a prefix alias covering
+    # every document under it, so /<handle>/order-platform/... still
+    # lands after the folder became "LiveOrder".
+    def seed_renamed_folder(users)
+      author = users.fetch("sam")
+      return if UrlAlias.exists?(path: "#{author.library.handle}/#{Slug.call(RENAMED_FOLDER_FROM)}")
+
+      folder = Folder.find_or_create_by_path!(RENAMED_FOLDER_FROM,
+        library: author.library, created_by_user: author)
+      folder.update!(name: RENAMED_FOLDER_TO)
+    end
+
+    # A retitle leaves an exact alias behind, so a document shared under
+    # its old name stays reachable — and this particular retitle makes the
+    # slug collide with a sibling, which is what puts a ~suffix on one of
+    # them. Skipped once the title has already moved.
+    def seed_retitled_document(plans)
+      document = plans.fetch("liveorder-pricing")
+      return unless document.title == RETITLED_DOCUMENT_FROM
+
+      document.update!(title: RETITLED_DOCUMENT_TO)
     end
 
     # Folder descriptions give agents (and readers) semantics a bare name
@@ -510,7 +583,13 @@ def seed_agent_edit(plan, author, token, related_plan:)
         "Facet counts may lag content by at most one minute.",
         "Facet counts may lag content by at most one minute — measured, not aspirational: the dark-read comparison in [§4](#section-4) enforces it."
       )
-      updated = "#{updated.rstrip}\n\n## 5. Related reading\n\n- [#{related_plan.title}](http://localhost:3000/plans/#{related_plan.id}) — the walkthrough whose ledger spot-check pattern [§4](#section-4) reuses.\n"
+      # Linked by its readable address, not its uuid — which is how an agent
+      # would write it now, and which is what gets recognized as a document
+      # reference rather than an outside link. If the organization run later
+      # files this plan somewhere else, the link still lands: the move leaves
+      # an alias behind.
+      related_url = "http://localhost:3000/#{related_plan.url_path.presence || "plans/#{related_plan.id}"}"
+      updated = "#{updated.rstrip}\n\n## 5. Related reading\n\n- [#{related_plan.title}](#{related_url}) — the walkthrough whose ledger spot-check pattern [§4](#section-4) reuses.\n"
       return if updated == content
 
       Plans::ReplaceContent.call(
@@ -631,15 +710,18 @@ def seeded_thread?(plan, body)
         .exists?(body_markdown: body)
     end
 
-    # A bulk organize run attributed to an agent: cross-library placements
-    # onto Alex's shelf, every audit event carrying the agent name, token
-    # provenance, and a shared run_id (visible via ?run_id= on the API).
+    # A bulk organize run attributed to an agent: three of Alex's loose
+    # documents swept into a folder, every audit event carrying the agent
+    # name, token provenance, and a shared run_id (visible via ?run_id= on
+    # the API). The documents start unfiled — DOCUMENTS gives them no
+    # folder — so the run is what puts them somewhere, and a re-seed finds
+    # them already there and logs nothing new.
     def seed_agent_organization_run(users, plans)
       curator = users.fetch("alex")
       token = seed_agent_token(curator)
       folder = Folder.find_or_create_by_path!("Reading list/Agent picks", library: curator.library, created_by_user: curator)
 
-      %w[collab-showcase mobile-checkout japanese-roadmap].each do |key|
+      AGENT_ORGANIZED_KEYS.each do |key|
         result = Plans::Place.call(
           plan: plans.fetch(key),
           folder: folder,
diff --git a/engine/app/assets/stylesheets/coplan/application.css b/engine/app/assets/stylesheets/coplan/application.css
index 1d0c2e2a..5c0a5f03 100644
--- a/engine/app/assets/stylesheets/coplan/application.css
+++ b/engine/app/assets/stylesheets/coplan/application.css
@@ -4764,13 +4764,6 @@ img.avatar {
   display: block;
 }
 
-/* The Save control (readers only): a labeled bookmark. Saved = filled
-   icon + accent, and clicking it opens the navigator to move or remove —
-   it never unsaves on the spot. */
-.plan-save--saved {
-  color: var(--color-primary);
-}
-
 /* Dropdown menu on the native Popover API — the toolbar's ⋯ overflow.
    Same glass as the pill it hangs from. Position is set inline by
    menu_controller (popovers open centered by default). */
diff --git a/engine/app/controllers/coplan/api/v1/libraries_controller.rb b/engine/app/controllers/coplan/api/v1/libraries_controller.rb
index c81e3d63..62c8bf8b 100644
--- a/engine/app/controllers/coplan/api/v1/libraries_controller.rb
+++ b/engine/app/controllers/coplan/api/v1/libraries_controller.rb
@@ -199,12 +199,11 @@ def subtree_totals(folders, counts)
           totals
         end
 
-        # The library owner's active plans not yet shelved in this library —
-        # only meaningful when the caller can write (i.e. it's their shelf).
+        # The library owner's active plans not filed in a folder anywhere —
+        # what the library shows at its root. Only meaningful when the
+        # caller can write (i.e. it's their library).
         def unfiled_plans
-          current_user.created_plans
-            .active
-            .where.not(id: @library.placements.select(:plan_id))
+          @library.unfiled_plans.active
         end
 
         def top_tags_json
diff --git a/engine/app/controllers/coplan/api/v1/plans_controller.rb b/engine/app/controllers/coplan/api/v1/plans_controller.rb
index 85e6bde3..3046b410 100644
--- a/engine/app/controllers/coplan/api/v1/plans_controller.rb
+++ b/engine/app/controllers/coplan/api/v1/plans_controller.rb
@@ -15,10 +15,10 @@ def index
           # (folder ids are global), and the plans themselves stay
           # viewer-filtered above.
           if params[:folder_id].present?
-            plans = plans.joins(:placements)
+            plans = plans.joins(:placement)
               .where(coplan_plan_placements: { folder_id: params[:folder_id] })
           end
-          @viewer_placements = current_user.library.placements
+          @placements = PlanPlacement.where(plan_id: plans.map(&:id))
             .includes(folder: { parent: :parent })
             .index_by(&:plan_id)
           render json: plans.map { |p| plan_json(p) }
@@ -83,7 +83,7 @@ def create
             if params[:references].is_a?(Array)
               params[:references].each do |ref_params|
                 next unless ref_params[:url].present?
-                ref_type = ref_params[:reference_type].presence || Reference.classify_url(ref_params[:url])
+                ref_type = ref_params[:reference_type].presence || Reference.classify_url(ref_params[:url], own_host: request.host)
                 ref = plan.references.find_or_initialize_by(url: ref_params[:url])
                 ref.assign_attributes(key: ref_params[:key], title: ref_params[:title], reference_type: ref_type, source: "explicit")
                 ref.save!
@@ -220,7 +220,7 @@ def update
           if params[:references].is_a?(Array)
             params[:references].each do |ref_params|
               next unless ref_params[:url].present?
-              ref_type = ref_params[:reference_type].presence || Reference.classify_url(ref_params[:url])
+              ref_type = ref_params[:reference_type].presence || Reference.classify_url(ref_params[:url], own_host: request.host)
               ref = @plan.references.find_or_initialize_by(url: ref_params[:url])
               # Only emit a "reference_added" event for genuinely new references;
               # existing-reference updates fall through silently for now.
@@ -250,11 +250,13 @@ def versions
           render json: versions.map { |v| version_json(v) }
         end
 
-        # Everywhere this plan is shelved — the reverse lookup of "what
-        # folder is this document actually in?", across every library
-        # (yours, other people's, and future team libraries).
+        # Where this plan is filed — "what folder is this document
+        # actually in?". Now that a plan lives in exactly one place this
+        # answers with at most one entry, but it stays an array: clients
+        # already iterate it, and an unfiled plan legitimately has none.
         def locations
-          placements = @plan.placements.includes(:placed_by_user, library: :owner, folder: { parent: :parent })
+          placements = PlanPlacement.where(plan_id: @plan.id)
+            .includes(:placed_by_user, library: :owner, folder: { parent: :parent })
           render json: placements.map { |placement|
             library = placement.library
             {
@@ -400,19 +402,20 @@ def resolve_folder_params
           end
         end
 
-        # folder_id/folder_path are viewer-relative: where *the caller*
-        # shelved this plan in their own library. One query per call — index
-        # batches placements up front via @viewer_placements.
-        def viewer_placement_for(plan)
-          if defined?(@viewer_placements) && @viewer_placements
-            @viewer_placements[plan.id]
+        # Where the plan lives. Used to be viewer-relative — the caller's
+        # own shelf — but a plan is filed in exactly one place now, so
+        # every caller gets the same answer. One query per call; index
+        # batches placements up front via @placements.
+        def placement_for(plan)
+          if defined?(@placements) && @placements
+            @placements[plan.id]
           else
-            current_user.library.placements.find_by(plan_id: plan.id)
+            plan.placement
           end
         end
 
         def plan_json(plan)
-          placement = viewer_placement_for(plan)
+          placement = placement_for(plan)
           {
             id: plan.id,
             title: plan.title,
diff --git a/engine/app/controllers/coplan/api/v1/references_controller.rb b/engine/app/controllers/coplan/api/v1/references_controller.rb
index 18cd8c3f..74bf3914 100644
--- a/engine/app/controllers/coplan/api/v1/references_controller.rb
+++ b/engine/app/controllers/coplan/api/v1/references_controller.rb
@@ -13,12 +13,11 @@ def index
         end
 
         def create
-          ref_type = params[:reference_type].presence || Reference.classify_url(params[:url])
-          target_plan_id = nil
-          if ref_type == "plan"
-            candidate_id = Reference.extract_target_plan_id(params[:url])
-            target_plan_id = candidate_id if candidate_id && candidate_id != @plan.id && Plan.exists?(candidate_id)
-          end
+          # A caller-supplied type wins, but the target is worked out either
+          # way: knowing which document a link points at is useful even when
+          # the caller wanted it filed under some other type.
+          detected_type, target_plan_id = Reference.resolve_link(params[:url], own_host: request.host, excluding: @plan.id)
+          ref_type = params[:reference_type].presence || detected_type
 
           ref = @plan.references.find_or_initialize_by(url: params[:url])
           ref.assign_attributes(
diff --git a/engine/app/controllers/coplan/application_controller.rb b/engine/app/controllers/coplan/application_controller.rb
index 911cd6c7..343413ee 100644
--- a/engine/app/controllers/coplan/application_controller.rb
+++ b/engine/app/controllers/coplan/application_controller.rb
@@ -16,6 +16,7 @@ def self.controller_path
     helper CoPlan::PlanEventsHelper
     helper CoPlan::AttachmentsHelper
     helper CoPlan::FoldersHelper
+    helper CoPlan::BrowseHelper
 
     # Skip host auth — CoPlan handles authentication internally via config.authenticate
     skip_before_action :authenticate_user!, raise: false
diff --git a/engine/app/controllers/coplan/attachments_controller.rb b/engine/app/controllers/coplan/attachments_controller.rb
index 2371145c..87d303a1 100644
--- a/engine/app/controllers/coplan/attachments_controller.rb
+++ b/engine/app/controllers/coplan/attachments_controller.rb
@@ -11,7 +11,7 @@ def create
       if files.empty?
         return respond_to do |format|
           format.turbo_stream { render turbo_stream: toast_stream("Choose at least one file to upload.", "alert") }
-          format.html { redirect_to plan_path(@plan, anchor: "footnote-attachments"), alert: "Choose at least one file to upload." }
+          format.html { redirect_to helpers.plan_browse_path(@plan, anchor: "footnote-attachments"), alert: "Choose at least one file to upload." }
         end
       end
 
@@ -30,7 +30,7 @@ def create
         # never bounce the reader to the top of the plan they're in.
         format.turbo_stream { render_attachments_update(notice: notice, alert: alert) }
         format.html do
-          redirect_to plan_path(@plan, anchor: "footnote-attachments"),
+          redirect_to helpers.plan_browse_path(@plan, anchor: "footnote-attachments"),
             { notice: notice, alert: alert }.compact
         end
       end
@@ -57,7 +57,7 @@ def destroy
       respond_to do |format|
         format.turbo_stream { render_attachments_update(notice: "Attachment removed.") }
         format.html do
-          redirect_to plan_path(@plan, anchor: "footnote-attachments"), notice: "Attachment removed."
+          redirect_to helpers.plan_browse_path(@plan, anchor: "footnote-attachments"), notice: "Attachment removed."
         end
       end
     end
diff --git a/engine/app/controllers/coplan/browse_controller.rb b/engine/app/controllers/coplan/browse_controller.rb
new file mode 100644
index 00000000..aee14907
--- /dev/null
+++ b/engine/app/controllers/coplan/browse_controller.rb
@@ -0,0 +1,64 @@
+module CoPlan
+  # Serves the browsable URLs — the canonical address of everything in a
+  # library, and of the person whose library it is.
+  #
+  #   /sam                             Sam, and Sam's library
+  #   /sam/liveorder                   a folder
+  #   /sam/liveorder/cart-roadmap      a document
+  #
+  # Every prefix is a real page, so trimming a segment off any URL walks
+  # you up the tree. One action serves all three because they are one
+  # thing — a place in a library — and which of the three a path names
+  # isn't knowable until the segments are resolved against the database.
+  #
+  # Inherits PlansController to reuse the workspace index and the document
+  # view wholesale rather than duplicating (or prematurely extracting)
+  # ~250 lines of interdependent loading. The action is named `browse`, not
+  # `show`, so the inherited `before_action :set_plan, only: [:show, ...]`
+  # doesn't fire on a path that has no plan id in it.
+  class BrowseController < PlansController
+    def browse
+      result = Urls::Resolve.call(handle: params[:handle], slug_path: params[:slug_path])
+      return head :not_found unless result.found?
+
+      # A stale-but-recognizable path: 301 so the address bar, and
+      # everything copied out of it, converges on the current URL.
+      if result.redirect_to_path.present?
+        return redirect_to path_to_url(result.redirect_to_path), status: :moved_permanently
+      end
+
+      result.plan ? render_plan(result.plan) : render_library(result.library, result.folder)
+    end
+
+    private
+
+    def render_plan(plan)
+      @plan = plan
+      authorize!(@plan, :show?)
+      show
+      render "coplan/plans/show" unless performed?
+    end
+
+    # Every library renders the same page. What you can do to what's in it
+    # is a question for the buttons — Library#writable_by?, surfaced to the
+    # views as @can_write — not a question of which view to render. A
+    # separate read-only page was the thing that made someone else's
+    # library feel like a different, lesser app: no filters, no folder
+    # counts, no "since you last looked".
+    #
+    # `index` reads the folder from params, so the resolved folder is
+    # handed over the same way the legacy ?folder=<id> form supplied it.
+    def render_library(library, folder)
+      authorize!(library, :show?)
+      @library = library
+      params[:folder] = folder&.id
+      index
+      render "coplan/plans/index" unless performed?
+    end
+
+    def path_to_url(path)
+      handle, _, rest = path.partition("/")
+      rest.present? ? browse_path(handle: handle, slug_path: rest) : browse_library_path(handle: handle)
+    end
+  end
+end
diff --git a/engine/app/controllers/coplan/comment_threads_controller.rb b/engine/app/controllers/coplan/comment_threads_controller.rb
index f3073cc0..638ebf52 100644
--- a/engine/app/controllers/coplan/comment_threads_controller.rb
+++ b/engine/app/controllers/coplan/comment_threads_controller.rb
@@ -110,7 +110,7 @@ def render_comment_error(message)
           render turbo_stream: turbo_stream.update("new-comment-form-error", message),
             status: :unprocessable_content
         end
-        format.html { redirect_to plan_path(@plan), alert: message }
+        format.html { redirect_to helpers.plan_browse_path(@plan), alert: message }
       end
     end
 
@@ -130,7 +130,7 @@ def set_thread
     def respond_with_stream_or_redirect(message, streams: [])
       respond_to do |format|
         format.turbo_stream { render turbo_stream: streams }
-        format.html { redirect_to plan_path(@plan), notice: message }
+        format.html { redirect_to helpers.plan_browse_path(@plan), notice: message }
       end
     end
 
diff --git a/engine/app/controllers/coplan/comments_controller.rb b/engine/app/controllers/coplan/comments_controller.rb
index e516efb9..869e2d80 100644
--- a/engine/app/controllers/coplan/comments_controller.rb
+++ b/engine/app/controllers/coplan/comments_controller.rb
@@ -37,7 +37,7 @@ def create
           html = render_to_string(partial: "coplan/comments/comment", locals: locals, formats: [ :html ])
           render turbo_stream: turbo_stream.append(target, html)
         end
-        format.html { redirect_to plan_path(@plan), notice: "Reply added." }
+        format.html { redirect_to helpers.plan_browse_path(@plan), notice: "Reply added." }
       end
     end
 
@@ -45,7 +45,7 @@ def destroy
       comment = @thread.comments.find(params[:id])
       policy = CommentPolicy.new(current_user, comment)
       unless policy.delete?
-        redirect_to plan_path(@plan), alert: "Not authorized to delete this comment." and return
+        redirect_to helpers.plan_browse_path(@plan), alert: "Not authorized to delete this comment." and return
       end
 
       Comments::SoftDelete.call(comment: comment, actor: current_user)
@@ -67,7 +67,7 @@ def destroy
       # other viewers (remove/replace are idempotent on echo).
       respond_to do |format|
         format.turbo_stream { render turbo_stream: inline_stream }
-        format.html { redirect_to plan_path(@plan), notice: "Comment deleted." }
+        format.html { redirect_to helpers.plan_browse_path(@plan), notice: "Comment deleted." }
       end
     end
 
diff --git a/engine/app/controllers/coplan/libraries_controller.rb b/engine/app/controllers/coplan/libraries_controller.rb
index 2b174588..cfc824fc 100644
--- a/engine/app/controllers/coplan/libraries_controller.rb
+++ b/engine/app/controllers/coplan/libraries_controller.rb
@@ -1,65 +1,66 @@
 module CoPlan
-  # Read-only folder navigation for someone else's library. Owners continue
-  # into their editable workspace; everyone else gets the same level-by-level
-  # folder model without drag, move, or create controls.
+  # The id-based entry points into library browsing, kept so old links keep
+  # working, plus the index of every library you can see.
+  #
+  # The canonical URLs are the browsable paths (/:handle/...) served by
+  # BrowseController; #show sends id-based links there with a 301 so the
+  # address bar — and anything copied out of it — says the readable form.
   class LibrariesController < ApplicationController
     def mine
-      redirect_to plans_path
+      redirect_to browse_library_path(handle: current_user.library.handle)
+    end
+
+    # Every library you can see, at /_/libraries. Not a place inside anyone's
+    # library — it's the list of them — so it lives under `_` rather than
+    # taking a top-level segment away from someone's handle.
+    def index
+      # Your own library first, so the list can't omit it. Libraries are
+      # materialized on first touch (User#library), and reading the table
+      # directly is exactly the path that skips that — a user who'd never
+      # loaded a page that links their library got a list without it.
+      current_user.library
+
+      @libraries = Library.includes(:owner).order(:handle).to_a
+      @plan_counts = plan_counts_for(@libraries)
     end
 
     def show
-      @library = Library.find(params[:id])
-      authorize!(@library, :show?)
+      library = Library.find(params[:id])
+      authorize!(library, :show?)
 
-      if @library.writable_by?(current_user)
-        redirect_to plans_path(folder: params[:folder].presence)
+      folder = params[:folder].present? ? library.folders.find_by(id: params[:folder]) : nil
+      if params[:folder].present? && folder.nil?
+        redirect_to browse_library_path(handle: library.handle), alert: "That folder no longer exists."
         return
       end
 
-      @owner = @library.owner
-      @folders = @library.folders.order(:name).to_a
-      @folders_by_id = @folders.index_by(&:id)
-      @folder_children = @folders.group_by(&:parent_id)
-      @folder = @folders_by_id[params[:folder]] if params[:folder].present?
-      if params[:folder].present? && @folder.nil?
-        redirect_to library_path(@library), alert: "That folder no longer exists."
-        return
-      end
+      redirect_to browse_url_for(library, folder), status: :moved_permanently
+    end
 
-      placements = @library.placements
-        .visible_to(current_user)
-        .where(plan: Plan.active)
-        .joins(:plan).order("coplan_plans.updated_at DESC")
-        .includes(:folder, plan: [ :created_by_user, :plan_type, :current_version_stub ])
-        .to_a
-      @placements_by_folder = placements.group_by(&:folder_id)
+    private
 
-      @root_plans = if @owner.is_a?(CoPlan::User)
-        Plan.visible_to(current_user).active
-          .where(created_by_user_id: @owner.id)
-          .where.not(id: @library.placements.select(:plan_id))
-          .order(updated_at: :desc)
-          .includes(:created_by_user, :plan_type, :current_version_stub)
-          .to_a
-      else
-        []
-      end
+    # What clicking the row will show you, which is both senses of "in this
+    # library": filed into one of its folders, and loose at its root. A
+    # plan at a library root has no placement row by design, so counting
+    # placements alone called a library of nothing but unfiled work
+    # "empty" — see Library#unfiled_plans.
+    def plan_counts_for(libraries)
+      visible = Plan.visible_to(current_user).active
+      counts = visible.joins(:placement).group("coplan_plan_placements.library_id").count
+      unfiled = visible.where.not(id: PlanPlacement.select(:plan_id)).group(:created_by_user_id).count
 
-      @breadcrumbs = []
-      node = @folder
-      while node
-        @breadcrumbs.unshift(node)
-        node = @folders_by_id[node.parent_id]
-      end
-      @subfolders = (@folder_children[@folder&.id] || []).sort_by { |folder| folder.name.downcase }
-      @plans = @folder ? (@placements_by_folder[@folder.id] || []).map(&:plan) : @root_plans
-      @plan_count = placements.size + @root_plans.size
+      libraries.each_with_object(counts) do |library, totals|
+        next unless library.owner_type == "CoPlan::User"
 
-      direct_counts = @placements_by_folder.transform_values(&:size)
-      count_folder = lambda do |folder|
-        direct_counts.fetch(folder.id, 0) + (@folder_children[folder.id] || []).sum { |child| count_folder.call(child) }
+        loose = unfiled[library.owner_id].to_i
+        totals[library.id] = totals[library.id].to_i + loose if loose.positive?
       end
-      @folder_counts = @folders.index_with { |folder| count_folder.call(folder) }.transform_keys(&:id)
+    end
+
+    def browse_url_for(library, folder)
+      return browse_library_path(handle: library.handle) if folder.nil?
+
+      browse_path(handle: library.handle, slug_path: folder.slug_path)
     end
   end
 end
diff --git a/engine/app/controllers/coplan/notifications_controller.rb b/engine/app/controllers/coplan/notifications_controller.rb
index e63f46d4..0cc3ebca 100644
--- a/engine/app/controllers/coplan/notifications_controller.rb
+++ b/engine/app/controllers/coplan/notifications_controller.rb
@@ -24,7 +24,7 @@ def show
       notification.mark_read!
       broadcast_badge_update
 
-      redirect_to plan_path(notification.plan, thread: notification.comment_thread_id)
+      redirect_to helpers.plan_browse_path(notification.plan, thread: notification.comment_thread_id)
     end
 
     def mark_read
diff --git a/engine/app/controllers/coplan/plans_controller.rb b/engine/app/controllers/coplan/plans_controller.rb
index 37981b89..ac249258 100644
--- a/engine/app/controllers/coplan/plans_controller.rb
+++ b/engine/app/controllers/coplan/plans_controller.rb
@@ -1,6 +1,11 @@
 module CoPlan
   class PlansController < ApplicationController
     before_action :set_plan, only: [ :show, :edit, :update, :publish, :hide, :archive, :unarchive, :move_to_folder, :toggle_checkbox, :history, :edit_content, :update_content, :preview ]
+    # /plans/<uuid> is the legacy address; the readable one is canonical.
+    # `only: [ :show ]` matters twice over — it's also why BrowseController,
+    # which calls `show` as a method from its own action, doesn't bounce
+    # the canonical URL straight back to itself.
+    before_action :redirect_to_canonical_url, only: [ :show ]
 
     PER_PAGE = 20
 
@@ -99,9 +104,9 @@ def index
     end
 
     # Web endpoint behind the sidebar drag-and-drop and the row-menu
-    # "Move to folder" fallback. Shelves the plan in the current user's own
-    # library — any visible plan can be shelved, not just your own
-    # (Plans::Place enforces both sides).
+    # "Move to folder" fallback. Moves the plan into a folder of the
+    # current user's library — it's a move, so it needs a claim on the
+    # plan as well as the destination (Plans::Place enforces both sides).
     def move_to_folder
       folder = nil
       if params[:folder_id].present?
@@ -142,12 +147,10 @@ def show
       # Old ?tab=history links: history is its own page now (the other
       # former tabs are same-page sections).
       return redirect_to history_plan_path(@plan) if params[:tab] == "history"
-      # Placements drive both the viewer-relative Save/Saved state and the
-      # compact jump up to the containing folder in the author's library.
-      @shelf_placements = @plan.placements
-        .includes(:library, folder: { parent: :parent })
-        .order(:created_at)
-      @author_placement = @shelf_placements.find { |placement| placement.library_id == @plan.created_by_user.library.id }
+      # Where the plan lives. One placement, the same for every reader —
+      # it drives the compact jump up to the containing folder.
+      @placement = PlanPlacement.includes(:library, folder: { parent: :parent })
+        .find_by(plan_id: @plan.id)
       @my_folders = current_user.library.folders.order(:name).to_a
       @threads = @plan.comment_threads.with_kept_comments.includes(:comments, :created_by_user).order(:created_at)
       # The reader view joins auto-extracted resources to their Markdown
@@ -185,7 +188,7 @@ def update
         tag_names: plan_params.key?(:tag_names) ? plan_params[:tag_names] : nil
       )
       broadcast_plan_update(@plan)
-      redirect_to plan_path(@plan), notice: "Plan updated."
+      redirect_to helpers.plan_browse_path(@plan), notice: "Plan updated."
     end
 
     def edit_content
@@ -237,9 +240,9 @@ def update_content
 
       if result[:no_op]
         notice = metadata_changed ? "Plan updated." : "No changes to save."
-        redirect_to plan_path(@plan), notice: notice
+        redirect_to helpers.plan_browse_path(@plan), notice: notice
       else
-        redirect_to plan_path(@plan), notice: "Plan updated."
+        redirect_to helpers.plan_browse_path(@plan), notice: "Plan updated."
       end
     rescue Plans::ReplaceContent::StaleRevisionError => e
       @draft_content = params[:content].to_s
@@ -287,7 +290,7 @@ def publish
         # broadcast can't reach this browser.
         format.turbo_stream { render turbo_stream: visibility_streams("Shared with everyone in the org.") }
         format.json { render json: { visibility: @plan.visibility } }
-        format.html { redirect_to plan_path(@plan), notice: "Plan published — everyone can see it now." }
+        format.html { redirect_to helpers.plan_browse_path(@plan), notice: "Plan published — everyone can see it now." }
       end
     end
 
@@ -315,7 +318,7 @@ def hide
       respond_to do |format|
         format.turbo_stream { render turbo_stream: visibility_streams("Private again — hidden from lists and search.") }
         format.json { render json: { visibility: @plan.visibility } }
-        format.html { redirect_to plan_path(@plan), notice: "Plan is private again — hidden from lists and search." }
+        format.html { redirect_to helpers.plan_browse_path(@plan), notice: "Plan is private again — hidden from lists and search." }
       end
     end
 
@@ -330,7 +333,7 @@ def archive
       Plans::LogEvent.call(plan: @plan, actor: current_user, event_type: "archived")
       respond_to do |format|
         format.turbo_stream { render turbo_stream: archive_streams("Archived — hidden from lists, still readable at this URL.") }
-        format.html { redirect_to plan_path(@plan), notice: "Plan archived. It's hidden from lists unless someone filters for archived plans." }
+        format.html { redirect_to helpers.plan_browse_path(@plan), notice: "Plan archived. It's hidden from lists unless someone filters for archived plans." }
       end
     end
 
@@ -341,7 +344,7 @@ def unarchive
       Plans::LogEvent.call(plan: @plan, actor: current_user, event_type: "unarchived")
       respond_to do |format|
         format.turbo_stream { render turbo_stream: archive_streams("Plan restored.") }
-        format.html { redirect_to plan_path(@plan), notice: "Plan restored." }
+        format.html { redirect_to helpers.plan_browse_path(@plan), notice: "Plan restored." }
       end
     end
 
@@ -451,7 +454,7 @@ def apply_workspace_filters(plans)
     # like files loose in Drive's root.
     def placed_directly_in(plans, folder)
       if folder
-        plans.joins(:placements)
+        plans.joins(:placement)
           .where(coplan_plan_placements: { library_id: @library.id, folder_id: folder.id })
       else
         plans.where.not(id: @library.placements.select(:plan_id))
@@ -465,7 +468,7 @@ def placed_directly_in(plans, folder)
     def in_folder_subtree(plans, folder)
       return plans unless folder
 
-      plans.joins(:placements)
+      plans.joins(:placement)
         .where(coplan_plan_placements: { folder_id: folder_subtree_ids(folder) })
     end
 
@@ -490,6 +493,10 @@ def folder_ancestry(folder)
     # PlanViewer.last_seen_at — recency against your own reading history,
     # not workflow state. Bounded: only the newest RECENT_CANDIDATES are
     # considered, and at most RECENT_LIMIT surface.
+    # Follows the active scope, so "mine" stays your own work. That means
+    # the "new to you" badge only fires under scope=all: it needs plans
+    # someone else wrote, and those used to reach your workspace by being
+    # filed onto your shelf. With one place per plan, they don't.
     def load_recently_updated
       candidates = scoped_plans_base.active
         .includes(:created_by_user)
@@ -547,27 +554,47 @@ def unread_counts_for(plans)
       unread_by_plan.slice(*plans.map(&:id))
     end
 
-    # The base relation for the active workspace scope. Used by both the
-    # main-pane plan lists and the sidebar counts so folder/tag counts
-    # always match what clicking through shows.
+    # The base relation for this view. Used by both the main-pane plan
+    # lists and the sidebar counts, so folder/tag counts always match what
+    # clicking through shows.
     def scoped_plans_base
-      if @scope == "mine"
-        # The workspace is your plans *and* your placements — a plan you
-        # shelved from someone else belongs on your operating surface too.
-        base = Plan.visible_to(current_user)
-        base.where(created_by_user_id: current_user.id)
-          .or(base.where(id: current_user.library.placements.select(:plan_id)))
-      else
-        # Draft plans are private — never show other users'.
-        Plan.visible_to(current_user)
-      end
+      # Everything you can see, wherever it lives — the one view that isn't
+      # a place. Reached by link (Home's tags), never from the sidebar.
+      return Plan.visible_to(current_user) if @scope == "all"
+
+      library_plans
     end
 
-    # One query for the viewer's whole library tree; everything else
-    # (children map, subtree ids, expanded state, aggregate counts) is
+    # Every document in the library being browsed, in either sense of "in":
+    # filed into one of its folders, or loose at its root — its owner's own
+    # work that isn't filed anywhere.
+    #
+    # Bounded by what the viewer may see, so someone else's private drafts
+    # never reach a list or a count. That's the only difference between
+    # browsing your library and browsing anyone else's: the same page, the
+    # same filters, fewer rows and fewer buttons.
+    def library_plans
+      visible = Plan.visible_to(current_user)
+      visible.where(id: @library.placements.select(:plan_id))
+        .or(visible.where(id: @library.unfiled_plans.select(:id)))
+    end
+
+    # One query for the browsed library's whole folder tree; everything
+    # else (children map, subtree ids, expanded state, aggregate counts) is
     # derived in memory.
+    #
+    # `@library` is whatever the route resolved to — BrowseController sets
+    # it before delegating here. Your own is the default, which is what
+    # /_/plans and the legacy /plans both mean.
     def load_folder_tree
-      @library = current_user.library
+      @library ||= current_user.library
+      @can_write = @library.writable_by?(current_user)
+      # A person and their library are one page now, so the header carries
+      # identity. Nil for a non-user owner (a future team library), and
+      # skipped for pagination frames, which never render the header —
+      # Directory.profile_for can reach out to the host's directory.
+      @owner = @library.owner
+      @profile = Directory.profile_for(@owner) if @owner.is_a?(User) && !turbo_frame_request?
       @folders = @library.folders.order(:name).to_a
       @folders_by_id = @folders.index_by(&:id)
       @folder_children = @folders.group_by(&:parent_id)
@@ -601,7 +628,7 @@ def load_workspace_sidebar
       count_base = filtered_plans(scoped_plans_base, @filter)
 
       direct_counts = apply_workspace_filters(count_base)
-        .joins(:placements)
+        .joins(:placement)
         .where(coplan_plan_placements: { library_id: @library.id })
         .group("coplan_plan_placements.folder_id")
         .count
@@ -697,6 +724,30 @@ def set_plan
       @plan = Plan.find(params[:id])
     end
 
+    # 301s /plans/<uuid> onto the document's readable address, so the
+    # address bar — and everything anyone copies out of it — converges
+    # there. Permanent rather than temporary: the id form isn't a
+    # redirect-of-the-day, it's the old name for this page.
+    #
+    # HTML GETs only. A Turbo Frame fetch or a JSON caller asked for this
+    # exact URL and should get a response, not a hop. A plan whose slug
+    # hasn't been backfilled yet has no readable address to go to, so it
+    # renders here.
+    def redirect_to_canonical_url
+      return unless request.get? && request.format.html?
+      return if turbo_frame_request?
+
+      canonical = helpers.plan_browse_path(@plan)
+      return if canonical == plan_path(@plan)
+
+      # The query string comes along: `?thread=<id>` deep-links a comment
+      # and `?tab=history` is itself a legacy hop onward. Dropping either
+      # would turn a working link into a plain document page.
+      canonical += "?#{request.query_string}" if request.query_string.present?
+
+      redirect_to canonical, status: :moved_permanently
+    end
+
     def broadcast_plan_update(plan)
       Broadcaster.replace_to(plan, target: "plan-header", partial: "coplan/plans/header", locals: { plan: plan })
       Broadcaster.replace_to(plan, target: "plan-nav-context", partial: "coplan/plans/nav_context", locals: { plan: plan })
diff --git a/engine/app/controllers/coplan/profiles_controller.rb b/engine/app/controllers/coplan/profiles_controller.rb
index 4f81237f..efb01d92 100644
--- a/engine/app/controllers/coplan/profiles_controller.rb
+++ b/engine/app/controllers/coplan/profiles_controller.rb
@@ -1,32 +1,17 @@
 module CoPlan
-  # A person's public face: identity (enriched by the host's directory
-  # adapter), their published plans, and their library shelves. Profiles
-  # are them-facing — they show only publicly listed work, so drafts and
-  # archived plans never appear here, not even on your own profile.
+  # A person's page and their library are the same page now: /<handle>,
+  # served by BrowseController. This is the old /people/:id address, kept so
+  # links written before the switch still land — and 301, so the address bar
+  # and everything copied out of it converges on the readable form.
+  #
+  # The identity this page used to carry (name, title, team, directory link)
+  # is the header of that page; the "Published plans" and "Library" columns
+  # are the level view underneath it, with the same filters and counts
+  # everyone gets.
   class ProfilesController < ApplicationController
     def show
-      @user = User.find_by(username: params[:id]) || User.find(params[:id])
-      @profile = Directory.profile_for(@user)
-      @library = @user.library
-
-      @plans = @user.created_plans
-        .publicly_listed
-        .includes(:plan_type, :tags)
-        .order(updated_at: :desc)
-
-      # Same shelf-tree ivars LibrariesController#show sets — the profile
-      # embeds the library rather than reimplementing it.
-      @folders = @library.folders.order(:name).to_a
-      @folder_children = @folders.group_by(&:parent_id)
-      @root_folders = @folder_children[nil] || []
-
-      placements = @library.placements
-        .where(plan: Plan.publicly_listed)
-        .joins(:plan).order("coplan_plans.updated_at DESC")
-        .includes(plan: [ :created_by_user, :plan_type ])
-        .to_a
-      @placements_by_folder = placements.group_by(&:folder_id)
-      @shelved_count = placements.size
+      user = User.find_by(username: params[:id]) || User.find(params[:id])
+      redirect_to browse_library_path(handle: user.library.handle), status: :moved_permanently
     end
   end
 end
diff --git a/engine/app/controllers/coplan/references_controller.rb b/engine/app/controllers/coplan/references_controller.rb
index 108a8359..1494a79a 100644
--- a/engine/app/controllers/coplan/references_controller.rb
+++ b/engine/app/controllers/coplan/references_controller.rb
@@ -9,12 +9,7 @@ def create
 
       reference_params = params.expect(reference: [ :url, :key, :title ])
       url = reference_params[:url]
-      ref_type = Reference.classify_url(url)
-      target_plan_id = nil
-      if ref_type == "plan"
-        candidate_id = Reference.extract_target_plan_id(url)
-        target_plan_id = candidate_id if candidate_id && candidate_id != @plan.id && Plan.exists?(candidate_id)
-      end
+      ref_type, target_plan_id = Reference.resolve_link(url, own_host: request.host, excluding: @plan.id)
 
       ref = @plan.references.find_or_initialize_by(url: url)
       was_new = ref.new_record?
@@ -39,12 +34,12 @@ def create
 
       respond_to do |format|
         format.turbo_stream { render_references_stream }
-        format.html { redirect_to plan_path(@plan, anchor: "footnote-references"), notice: "Reference added." }
+        format.html { redirect_to helpers.plan_browse_path(@plan, anchor: "footnote-references"), notice: "Reference added." }
       end
     rescue ActiveRecord::RecordInvalid => e
       respond_to do |format|
         format.turbo_stream { render_references_stream }
-        format.html { redirect_to plan_path(@plan, anchor: "footnote-references"), alert: e.message }
+        format.html { redirect_to helpers.plan_browse_path(@plan, anchor: "footnote-references"), alert: e.message }
       end
     end
 
@@ -67,7 +62,7 @@ def destroy
 
       respond_to do |format|
         format.turbo_stream { render_references_stream }
-        format.html { redirect_to plan_path(@plan, anchor: "footnote-references"), notice: "Reference removed." }
+        format.html { redirect_to helpers.plan_browse_path(@plan, anchor: "footnote-references"), notice: "Reference removed." }
       end
     end
 
diff --git a/engine/app/helpers/coplan/application_helper.rb b/engine/app/helpers/coplan/application_helper.rb
index d53b20ff..ddbc3d1b 100644
--- a/engine/app/helpers/coplan/application_helper.rb
+++ b/engine/app/helpers/coplan/application_helper.rb
@@ -45,13 +45,20 @@ def plan_og_description(plan)
       truncate([ preview.context, preview.description ].compact.join(" — "), length: 250, omission: "…")
     end
 
-    # Canonical URL for a user's profile — username when they have one
-    # (readable, stable), id otherwise.
+    # Where a person lives: their library, which is their page. Their handle
+    # is usually their username, but not always (collisions get a suffix),
+    # so it has to be read rather than derived.
+    #
+    # Memoized per request because list pages ask for the same few authors
+    # over and over — one lookup per distinct person, not per row. A library
+    # is materialized on first touch (User#library), so the first ask for
+    # someone who has never had one also creates it.
     def profile_path_for(user)
-      profile_path(user.username.presence || user.id)
+      handles = (@browse_handles ||= {})
+      browse_library_path(handle: handles[user.id] ||= user.library.handle)
     end
 
-    # Author names everywhere in the app link to profiles.
+    # Author names everywhere in the app link to their library.
     def profile_link(user, css_class: "profile-link")
       return "" unless user
       link_to user.name, profile_path_for(user), class: css_class
diff --git a/engine/app/helpers/coplan/browse_helper.rb b/engine/app/helpers/coplan/browse_helper.rb
new file mode 100644
index 00000000..14e322fe
--- /dev/null
+++ b/engine/app/helpers/coplan/browse_helper.rb
@@ -0,0 +1,51 @@
+module CoPlan
+  # Canonical URLs for the three browsable things. Views should link with
+  # these rather than the id-based helpers, so what a reader copies out of
+  # the address bar is already the readable form and no redirect is needed
+  # to get there.
+  module BrowseHelper
+    def library_browse_path(library, **options)
+      browse_library_path(handle: library.handle, **options)
+    end
+
+    def folder_browse_path(folder, **options)
+      browse_path(handle: folder.library.handle, slug_path: folder.slug_path, **options)
+    end
+
+    # Falls back to the id form for a plan whose slug hasn't been
+    # backfilled yet — the migration leaves them NULL and lets the app
+    # fill them in on the next save, so both forms have to work meanwhile.
+    #
+    # Extra options (`thread:`, `anchor:`) ride along either way, so
+    # deep links don't have to know which form they got.
+    #
+    # Built from the view's own route helpers rather than delegating to
+    # Urls::Canonical: a host that mounts the engine somewhere other than
+    # "/" gets the mount prefix from the request, and route helpers called
+    # outside a request have no way to know about it.
+    def plan_browse_path(plan, **options)
+      handle, slug_path = Urls::Canonical.split(plan.url_path)
+      return plan_path(plan, **options) if slug_path.blank?
+
+      browse_path(handle: handle, slug_path: slug_path, **options)
+    end
+
+    # Absolute form, for rel=canonical. Returns nil rather than falling
+    # back: a canonical tag pointing at the id form would be claiming the
+    # ugly URL is the real one.
+    def plan_browse_url(plan)
+      handle, slug_path = Urls::Canonical.split(plan.url_path)
+      slug_path && browse_url(handle: handle, slug_path: slug_path)
+    end
+
+    # Level-view link for either kind of row, so folder and plan lists
+    # don't each need to know which helper to reach for.
+    def browse_path_for(record)
+      case record
+      when CoPlan::Folder then folder_browse_path(record)
+      when CoPlan::Library then library_browse_path(record)
+      else plan_browse_path(record)
+      end
+    end
+  end
+end
diff --git a/engine/app/helpers/coplan/folders_helper.rb b/engine/app/helpers/coplan/folders_helper.rb
index e243d5d0..435bc57d 100644
--- a/engine/app/helpers/coplan/folders_helper.rb
+++ b/engine/app/helpers/coplan/folders_helper.rb
@@ -11,11 +11,13 @@ def folder_select_options
         .sort_by { |path, _id, _depth| path.downcase }
     end
 
-    # Where the current user shelved this plan in their own library (nil
-    # when unfiled). One placements query per request, not per row.
-    def viewer_folder_id(plan)
-      @_viewer_folder_ids ||= current_user.library.placements.pluck(:plan_id, :folder_id).to_h
-      @_viewer_folder_ids[plan.id]
+    # The folder this plan lives in, nil when unfiled. Read from the
+    # viewer's own library because that's the tree these rows draw from —
+    # a plan filed in some other library has no folder to mark here. One
+    # placements query per request, not per row.
+    def plan_folder_id(plan)
+      @_plan_folder_ids ||= current_user.library.placements.pluck(:plan_id, :folder_id).to_h
+      @_plan_folder_ids[plan.id]
     end
 
     def folder_paths_by_id
diff --git a/engine/app/helpers/coplan/markdown_helper.rb b/engine/app/helpers/coplan/markdown_helper.rb
index 62379539..d6602154 100644
--- a/engine/app/helpers/coplan/markdown_helper.rb
+++ b/engine/app/helpers/coplan/markdown_helper.rb
@@ -103,12 +103,16 @@ def transform_reference_anchors(html, numbered_sections: true)
       used_ids = doc.css("[id]").filter_map { |node| node["id"].presence }.to_set
       section_ids = Set.new
 
+      # `own_host` is what lets a readable CoPlan address be recognized
+      # here: /sam/liveorder/cart-roadmap is shaped like any other site's
+      # URL, so being on our own host is the whole distinction.
+      own_host = request&.host
       doc.css("a[href]").each do |anchor|
         next unless anchor["href"].match?(%r{\Ahttps?://}i)
 
         anchor["target"] = "_blank"
         anchor["rel"] = "noopener noreferrer"
-        anchor["data-reference-type"] = Reference.classify_url(anchor["href"])
+        anchor["data-reference-type"] = Reference.classify_url(anchor["href"], own_host: own_host)
       end
 
       if numbered_sections
diff --git a/engine/app/helpers/coplan/plans_helper.rb b/engine/app/helpers/coplan/plans_helper.rb
index a7cf2944..4efa08d1 100644
--- a/engine/app/helpers/coplan/plans_helper.rb
+++ b/engine/app/helpers/coplan/plans_helper.rb
@@ -4,18 +4,50 @@ module CoPlan
   module PlansHelper
     include MarkdownHelper
 
-    # Everything a workspace (plans index) link may carry. Filter links
-    # build on the current params via workspace_path so no call site has
-    # to re-list this whitelist — or remember which param to omit.
-    WORKSPACE_LINK_PARAMS = %i[scope filter plan_type tag folder updated].freeze
-
-    # A plans-index URL carrying the current filters with `overrides`
-    # applied; pass nil to clear a filter (blank values are dropped).
+    # The narrowing a workspace link may carry. Filter links build on the
+    # current params via workspace_path so no call site has to re-list this
+    # whitelist — or remember which param to omit.
+    #
+    # `folder` isn't in it: a folder names a place, so it travels as path
+    # segments rather than a query param. See workspace_path.
+    WORKSPACE_LINK_PARAMS = %i[scope filter plan_type tag updated].freeze
+
+    # A workspace URL for the library being browsed, carrying the current
+    # filters with `overrides` applied; pass nil to clear one.
+    #
+    # `folder:` says which folder the link points at, as a folder id —
+    # matching the ids the sidebar and the drag-and-drop controller already
+    # work in — and comes out as path segments, because a folder is a place
+    # and places have addresses. That's what keeps clicking a folder inside
+    # someone's library on that library's URL instead of bouncing back to
+    # your own workspace.
     def workspace_path(**overrides)
-      plans_path(
-        params.permit(*WORKSPACE_LINK_PARAMS).to_h.symbolize_keys
-          .merge(overrides).compact_blank
-      )
+      query = params.permit(*WORKSPACE_LINK_PARAMS).to_h.symbolize_keys
+        .merge(overrides.except(:folder)).compact_blank
+
+      folder = workspace_link_folder(overrides)
+      return folder_browse_path(folder, **query) if folder
+
+      library_browse_path(@library, **query)
+    end
+
+    # The breadcrumb and folder-tree root. "My Plans" when it's yours — the
+    # label people already know — and the owner's name otherwise, because
+    # the same crumb in someone else's library shouldn't claim to be yours.
+    def workspace_root_label
+      return "My Plans" if @can_write
+
+      "#{@profile&.name || @library.owner.try(:name) || @library.name}’s plans"
+    end
+
+    # The folder a workspace link points at: the override when one is given
+    # (nil clears it, back to the library root), otherwise wherever we
+    # already are. Resolved against the loaded tree, so it costs no query.
+    def workspace_link_folder(overrides)
+      id = overrides.key?(:folder) ? overrides[:folder] : @folder&.id
+      return nil if id.blank?
+
+      @folders_by_id&.[](id.to_s)
     end
 
     # DOM id of a plan row's unread-comment badge. Shared by the row that
diff --git a/engine/app/helpers/coplan/references_helper.rb b/engine/app/helpers/coplan/references_helper.rb
index 47ac591e..b32c5722 100644
--- a/engine/app/helpers/coplan/references_helper.rb
+++ b/engine/app/helpers/coplan/references_helper.rb
@@ -96,7 +96,8 @@ def build_plan_citation_back_matter(plan, references)
     end
 
     def decorate_citation_source(anchor, reference)
-      type = reference&.reference_type || anchor["data-reference-type"] || Reference.classify_url(anchor["href"])
+      type = reference&.reference_type || anchor["data-reference-type"] ||
+        Reference.classify_url(anchor["href"], own_host: request&.host)
       domain = reference_domain(anchor["href"])
       title = reference&.title.presence || anchor.text.squish.presence || domain || anchor["href"]
       metadata = [ reference_type_label(type, anchor["href"]), domain ].compact.join(" · ")
diff --git a/engine/app/javascript/coplan_service_worker.js b/engine/app/javascript/coplan_service_worker.js
index 01a5a074..824e4a93 100644
--- a/engine/app/javascript/coplan_service_worker.js
+++ b/engine/app/javascript/coplan_service_worker.js
@@ -63,8 +63,8 @@ self.addEventListener("notificationclick", (event) => {
     })
 
     // Prefer focusing an existing CoPlan tab and navigating it. We compare
-    // origins so a CoPlan tab on /plans/foo handles a notification for
-    // /plans/bar without spawning a new window.
+    // origins so a CoPlan tab on /aiko/one handles a notification for
+    // /sam/liveorder/two without spawning a new window.
     const targetUrlObj = new URL(targetUrl, self.location.origin)
     for (const client of allClients) {
       const clientUrl = new URL(client.url)
diff --git a/engine/app/models/concerns/coplan/broadcasts_library_changes.rb b/engine/app/models/concerns/coplan/broadcasts_library_changes.rb
new file mode 100644
index 00000000..1d54aa1e
--- /dev/null
+++ b/engine/app/models/concerns/coplan/broadcasts_library_changes.rb
@@ -0,0 +1,22 @@
+module CoPlan
+  # Live library listings. Anything that changes what a library's pages
+  # show — a document arriving, moving, being retitled or hidden; a folder
+  # created, renamed, moved or deleted — tells the library, and every
+  # browser watching it re-fetches its own view of it.
+  #
+  # In the models rather than the controllers on purpose. Most of what
+  # moves a library is an agent filing something through the API or a
+  # background job finishing, not a person clicking; a person watching in
+  # a browser should see those land either way.
+  module BroadcastsLibraryChanges
+    extend ActiveSupport::Concern
+
+    private
+
+    # Nil and duplicate libraries drop out, so a move that stays inside one
+    # library refreshes it once, and a plan with no library yet is a no-op.
+    def broadcast_library_refresh(*libraries)
+      libraries.compact.uniq.each { |library| Broadcaster.refresh_to(library) }
+    end
+  end
+end
diff --git a/engine/app/models/coplan/folder.rb b/engine/app/models/coplan/folder.rb
index de605c88..8ee44607 100644
--- a/engine/app/models/coplan/folder.rb
+++ b/engine/app/models/coplan/folder.rb
@@ -9,6 +9,8 @@ module CoPlan
   # access is the library's call (Library#writable_by?), which is what
   # lets a future team library reuse all of this unchanged.
   class Folder < ApplicationRecord
+    include BroadcastsLibraryChanges
+
     MAX_DEPTH = 3
 
     # "/" is reserved as the path separator for folder_path lookups
@@ -27,10 +29,39 @@ class Folder < ApplicationRecord
     # find_or_create_by_path!.
     normalizes :name, with: ->(name) { name.strip }
 
+    # The folder's URL segment, derived from its name. Nothing downstream
+    # stores it — a plan knows only its own slug — so renaming a folder
+    # updates this one row and no plan row at all.
+    #
+    # On both callbacks deliberately: before_validation so the uniqueness
+    # check sees the slug, before_save so a `save(validate: false)` still
+    # produces a NOT NULL-satisfying row. The method is idempotent.
+    before_validation :assign_slug
+    before_save :assign_slug
+    # A rename or a move leaves behind one prefix alias, which covers
+    # every plan and subfolder underneath — O(renames), not O(documents).
+    before_save :stash_previous_url_path
+    after_save :record_url_alias
+    # A folder arriving on a segment a plan was already using takes it —
+    # see #disambiguate_shadowed_plans.
+    after_save :disambiguate_shadowed_plans
+    # The folder tree and every count beside it are on screen for anyone
+    # browsing this library — a new shelf, a rename, a move or a deletion
+    # all change what they are looking at.
+    after_commit :broadcast_folder_change
+
     validates :name, presence: true,
       uniqueness: { scope: [ :library_id, :parent_id ], case_sensitive: false },
       format: { with: NAME_FORMAT, message: "cannot contain \"/\"" },
       length: { maximum: 100 }
+    # Siblings can share neither a name nor a slug: "Team EBT" and
+    # "Team-EBT" are distinct names claiming the same URL segment.
+    # Folders never take a disambiguating suffix the way plans do — a
+    # folder's segment appears in every URL beneath it, so it stays clean
+    # and the second folder is asked for a different name instead.
+    validates :slug, presence: true,
+      uniqueness: { scope: [ :library_id, :parent_id ], case_sensitive: false,
+                    message: "is already taken by a folder here" }
     # What belongs in this folder, in one line — read by agents (via the
     # library overview API) to organize by meaning, not just name.
     validates :description, length: { maximum: 255 }
@@ -64,11 +95,26 @@ def depth
       ancestors.length + 1
     end
 
-    # Human-readable location, e.g. "Team EBT/Q3".
+    # Human-readable location, e.g. "Team EBT/Q3". This is the shape the
+    # API's `folder_path` param speaks, and it stays display-cased — the
+    # URL form is #slug_path, which is a different string.
     def path
       (ancestors + [ self ]).map(&:name).join("/")
     end
 
+    # Library-relative URL path, e.g. "team-ebt/q3". Deliberately excludes
+    # the library handle so renaming a handle rewrites one library row
+    # rather than every folder underneath it.
+    def slug_path
+      (ancestors + [ self ]).map(&:slug).join("/")
+    end
+
+    # Handle-first path, the form URLs and aliases both speak:
+    # "orders/team-ebt/q3".
+    def url_path
+      [ library.handle, slug_path ].compact_blank.join("/")
+    end
+
     # Finds or creates the folder hierarchy for a "/"-separated path like
     # "Team EBT/Q3" inside one library. This is what lets an agent organize
     # a library without pre-creating folders. Raises
@@ -109,6 +155,21 @@ def self.find_by_path(path, library:)
       end
     end
 
+    # Walks a slug path — "team-ebt/q3" — one segment at a time, which is
+    # how every browsable URL resolves. Returns the deepest folder, or nil
+    # if any segment is missing. Stops at MAX_DEPTH so a long hostile path
+    # can't turn into an unbounded query loop.
+    def self.find_by_slug_path(slug_path, library:)
+      segments = slug_path.to_s.split("/").map(&:strip).reject(&:blank?)
+      return nil if segments.empty? || segments.length > MAX_DEPTH
+
+      segments.reduce(nil) do |parent, slug|
+        folder = library.folders.find_by(parent_id: parent&.id, slug: slug.downcase)
+        return nil unless folder
+        folder
+      end
+    end
+
     # Full "A/B/C" path for every given folder, keyed by id, computed from
     # the in-memory list (no per-folder queries). Shared by the folders API
     # and the folder-picker helper.
@@ -127,7 +188,7 @@ def self.paths_by_id(folders = order(:name).to_a)
     end
 
     def self.ransackable_attributes(_auth_object = nil)
-      %w[id name description library_id parent_id created_by_user_id created_at updated_at]
+      %w[id name slug description library_id parent_id created_by_user_id created_at updated_at]
     end
 
     def self.ransackable_associations(_auth_object = nil)
@@ -136,6 +197,68 @@ def self.ransackable_associations(_auth_object = nil)
 
     private
 
+    def broadcast_folder_change
+      broadcast_library_refresh(library)
+    end
+
+    # Follows the name. A rename is rare and its old URL keeps resolving
+    # via UrlAlias, so the segment tracking the current name is worth more
+    # than a frozen one.
+    def assign_slug
+      return if name.blank?
+      return unless slug.blank? || will_save_change_to_name?
+
+      self.slug = CoPlan::Slug.call(name).presence || "folder"
+    end
+
+    # Captured before the write, because afterwards `ancestors` walks the
+    # *new* parent chain and the old path is no longer reconstructible.
+    def stash_previous_url_path
+      @previous_url_path = nil
+      return if new_record?
+      return unless will_save_change_to_slug? || will_save_change_to_parent_id?
+
+      old_slug = slug_in_database
+      return if old_slug.blank?
+
+      old_parent = parent_id_in_database.present? ? Folder.find_by(id: parent_id_in_database) : nil
+      @previous_url_path = [ library.handle, old_parent&.slug_path, old_slug ].compact_blank.join("/")
+    end
+
+    def record_url_alias
+      return if @previous_url_path.blank?
+
+      UrlAlias.record!(from: @previous_url_path, to: url_path, kind: "prefix")
+      @previous_url_path = nil
+    end
+
+    # Urls::Resolve gives a folder the segment when a plan at the same
+    # level wants it too, so a folder created or renamed onto a plan's
+    # address would quietly make that document unreachable. The plan gets
+    # the disambiguating suffix it would have been given had the folder
+    # come first, and its old address keeps working through the alias
+    # AssignSlug records on the way past.
+    def disambiguate_shadowed_plans
+      return unless saved_change_to_slug? || saved_change_to_parent_id?
+
+      shadowed_plans.each do |plan|
+        Plans::AssignSlug.call(plan: plan)
+        plan.save!
+      end
+    end
+
+    # Plans addressed at this folder's own level: those filed in its
+    # parent, or the library's loose plans when it's a root folder.
+    def shadowed_plans
+      scope = if parent_id.present?
+        Plan.where(id: PlanPlacement.where(folder_id: parent_id).select(:plan_id))
+      else
+        library.unfiled_plans
+      end
+
+      scope.where(slug: slug, slug_suffix: nil)
+    end
+
     def parent_cannot_create_cycle
       return if parent_id.blank?
 
diff --git a/engine/app/models/coplan/library.rb b/engine/app/models/coplan/library.rb
index 12e36adf..e2048c5d 100644
--- a/engine/app/models/coplan/library.rb
+++ b/engine/app/models/coplan/library.rb
@@ -10,7 +10,33 @@ module CoPlan
   # not a new system — so no query or policy outside this class should
   # assume owner == user. Write policy lives here (`writable_by?`), which
   # is exactly where "who may file things into this library" belongs.
+  #
+  # `handle` is the library's URL segment, and it's a top-level one:
+  # everything in this library is browsable under /<handle>. It's the
+  # segment that carries the most weight in a shared link, so it stays
+  # short and typeable.
   class Library < ApplicationRecord
+    # A handle being a top-level segment makes this list the app's own
+    # root-level addresses. Two groups, and neither one grows:
+    #
+    #   - the legacy paths frozen in routes.rb, a closed set because
+    #     everything new goes under `_`
+    #   - `_` itself, plus the conventional host-app routes the engine sits
+    #     alongside when it's mounted at "/"
+    #
+    # Slug.handle can't produce `_`, but a handle can also be set by hand
+    # (admin, the API), so it's spelled out here as well.
+    #
+    # A host with its own root routes adds them via
+    # `config.reserved_handles` — the engine can't read the host's router.
+    RESERVED_HANDLES = %w[
+      _ new edit all
+      plans people libraries library settings search notifications home welcome
+      api agent-instructions admin assets rails up sign_in sign_out integrations
+    ].freeze
+    HANDLE_FORMAT = /\A[a-z0-9][a-z0-9-]*\z/
+    HANDLE_MAX_LENGTH = 60
+
     belongs_to :owner, polymorphic: true
     has_many :folders, class_name: "CoPlan::Folder", dependent: :destroy
     has_many :placements, class_name: "CoPlan::PlanPlacement", dependent: :destroy
@@ -18,15 +44,79 @@ class Library < ApplicationRecord
     # and the FK would otherwise block destroying the library.
     has_many :library_events, class_name: "CoPlan::LibraryEvent", dependent: :delete_all
 
+    # Assigned before validation so callers never have to supply one —
+    # `Library.for(owner)` keeps its one-argument shape.
+    before_validation :assign_handle, on: :create
+    # Renaming a handle is one prefix alias for the entire library, since
+    # no folder or plan stores the handle in its own path.
+    after_save :record_handle_alias, if: :saved_change_to_handle?
+
     validates :name, presence: true, length: { maximum: 100 }
     validates :owner_id, uniqueness: { scope: :owner_type }
+    validates :handle, presence: true, uniqueness: { case_sensitive: false },
+      length: { maximum: HANDLE_MAX_LENGTH },
+      format: { with: HANDLE_FORMAT, message: "may use only lowercase letters, numbers, and hyphens" }
+    validate :handle_not_reserved
+
+    class << self
+      def for(owner)
+        find_or_create_by!(owner: owner)
+      rescue ActiveRecord::RecordNotUnique
+        # Two requests materialized the same owner's library at once — the
+        # unique [owner_type, owner_id] index makes the loser retry the read.
+        find_by!(owner: owner)
+      end
+
+      def reserved_handles
+        RESERVED_HANDLES + Array(CoPlan.configuration.reserved_handles).map { |h| h.to_s.downcase }
+      end
+
+      # Case-insensitive so a pasted /Orders link still lands.
+      def find_by_handle(handle)
+        return nil if handle.blank?
+
+        find_by(handle: handle.to_s.downcase)
+      end
+
+      # First unclaimed handle at or after `base`, so handle assignment
+      # never fails on a collision.
+      def unclaimed_handle(base)
+        candidate = CoPlan::Slug.handle(base).presence || "library"
+        return candidate unless handle_claimed?(candidate)
+
+        suffix = 2
+        suffix += 1 while handle_claimed?("#{candidate}-#{suffix}")
+        "#{candidate}-#{suffix}"
+      end
+
+      def handle_claimed?(candidate)
+        reserved_handles.include?(candidate) || exists?(handle: candidate)
+      end
+
+      def ransackable_attributes(_auth_object = nil)
+        %w[id owner_type owner_id name handle created_at updated_at]
+      end
 
-    def self.for(owner)
-      find_or_create_by!(owner: owner)
-    rescue ActiveRecord::RecordNotUnique
-      # Two requests materialized the same owner's library at once — the
-      # unique [owner_type, owner_id] index makes the loser retry the read.
-      find_by!(owner: owner)
+      def ransackable_associations(_auth_object = nil)
+        %w[owner folders placements]
+      end
+    end
+
+    # What this library shows at its root: the owner's own work that isn't
+    # filed in a folder. These plans are addressed directly under the
+    # handle — /orders/some-plan — with no folder segment between.
+    #
+    # "Filed nowhere" rather than "not filed here": a plan sits in exactly
+    # one library, so one the owner moved into a *different* library
+    # belongs at that library's root, not this one's.
+    #
+    # Callers add their own visibility filter; this answers location, not
+    # who may see it.
+    def unfiled_plans
+      return Plan.none unless owner_type == "CoPlan::User"
+
+      Plan.where(created_by_user_id: owner_id)
+        .where.not(id: PlanPlacement.select(:plan_id))
     end
 
     # Only the owner writes to a personal library. A future team library
@@ -37,12 +127,36 @@ def writable_by?(user)
       owner_type == "CoPlan::User" && owner_id == user.id
     end
 
-    def self.ransackable_attributes(_auth_object = nil)
-      %w[id owner_type owner_id name created_at updated_at]
+    private
+
+    # A personal library takes its owner's username — their ldap — so the
+    # default handle is the name they already answer to. A team library
+    # uses the library's own name.
+    def assign_handle
+      return if handle.present?
+
+      self.handle = self.class.unclaimed_handle(handle_source)
     end
 
-    def self.ransackable_associations(_auth_object = nil)
-      %w[owner folders placements]
+    def handle_source
+      if owner.is_a?(CoPlan::User)
+        owner.username.presence || owner.email.to_s.split("@").first.presence || owner.name
+      else
+        name
+      end
+    end
+
+    def handle_not_reserved
+      return if handle.blank?
+
+      errors.add(:handle, "is reserved") if self.class.reserved_handles.include?(handle.downcase)
+    end
+
+    def record_handle_alias
+      previous, current = saved_change_to_handle
+      return if previous.blank? || current.blank?
+
+      UrlAlias.record!(from: previous, to: current, kind: "prefix")
     end
   end
 end
diff --git a/engine/app/models/coplan/plan.rb b/engine/app/models/coplan/plan.rb
index 0659db5d..48e5bbc2 100644
--- a/engine/app/models/coplan/plan.rb
+++ b/engine/app/models/coplan/plan.rb
@@ -1,5 +1,7 @@
 module CoPlan
   class Plan < ApplicationRecord
+    include BroadcastsLibraryChanges
+
     VISIBILITIES = %w[draft published].freeze
 
     # Legacy API compatibility: the pre-2026-07 five-state `status` field.
@@ -27,8 +29,8 @@ class Plan < ApplicationRecord
     belongs_to :current_version_stub, -> { select(:id, :content_sha256) },
       class_name: "PlanVersion", foreign_key: :current_plan_version_id, optional: true
     belongs_to :plan_type
-    has_many :placements, class_name: "CoPlan::PlanPlacement", inverse_of: :plan, dependent: :destroy
-    has_many :libraries, through: :placements
+    # At most one: a plan is filed in a single folder of a single library.
+    has_one :placement, class_name: "CoPlan::PlanPlacement", inverse_of: :plan, dependent: :destroy
     has_many :plan_versions, -> { order(revision: :asc) }, dependent: :destroy
     has_many :plan_events, dependent: :destroy
     has_many :plan_collaborators, dependent: :destroy
@@ -52,6 +54,12 @@ class Plan < ApplicationRecord
     # untyped rows stay unrepresentable.
     before_validation :assign_default_plan_type, on: :create
 
+    # The URL segment follows the title, so a shared link reads like the
+    # document it points at, and the old URL keeps resolving via UrlAlias.
+    # Drafts are exempt from the alias: they get retitled freely while
+    # being written and have no links in the wild worth preserving.
+    before_save :assign_url_slug, if: :url_slug_stale?
+
     validates :title, presence: true
     validates :visibility, presence: true, inclusion: { in: VISIBILITIES }
     validate :attachments_within_limits
@@ -82,6 +90,13 @@ class Plan < ApplicationRecord
 
     after_save_commit :refresh_search_text!, if: :search_text_needs_refresh?
 
+    # What a library row says about a document, and whether it says anything
+    # at all. Content edits aren't here: they don't change the row, and a
+    # refresh on every autosave would be a storm for one stale timestamp.
+    LISTED_ATTRIBUTES = %w[title slug slug_suffix visibility archived_at plan_type_id].freeze
+
+    after_commit :broadcast_listing_change, on: [ :create, :update ]
+
     # Sitewide search over a denormalized `search_text` column maintained by
     # `refresh_search_text!`. The matching strategy is adapter-specific but
     # the contract is not: tokens are AND-ed, each token matches as a prefix
@@ -177,13 +192,48 @@ def self.build_search_text(plan)
     end
 
     def self.ransackable_attributes(auth_object = nil)
-      %w[id title visibility archived_at plan_type_id created_by_user_id current_plan_version_id current_revision created_at updated_at]
+      %w[id title slug slug_suffix visibility archived_at plan_type_id created_by_user_id current_plan_version_id current_revision created_at updated_at]
     end
 
     def self.ransackable_associations(auth_object = nil)
       %w[plan_type created_by_user]
     end
 
+    # --- Where the plan lives ------------------------------------------
+    #
+    # One library, one folder, one address. A filed plan lives wherever
+    # its placement puts it; an unfiled one sits at the root of the
+    # library it was born into, which is its author's. Nothing here is
+    # viewer-relative — every reader of a plan sees the same location,
+    # because there is only one.
+
+    def library
+      placement&.library || created_by_user&.library
+    end
+
+
+    def folder
+      placement&.folder
+    end
+
+    def library_handle
+      library&.handle
+    end
+
+    # "orders/liveorder/cart-roadmap" — handle first, no leading slash,
+    # exactly what Urls::Resolve walks and what UrlAlias stores.
+    def url_path
+      return nil if slug.blank? || library_handle.blank?
+
+      [ library_handle, folder&.slug_path, leaf_segment ].compact_blank.join("/")
+    end
+
+    # The disambiguating suffix rides on the leaf and nowhere else, so
+    # every ancestor prefix of a plan's URL stays clean and browsable.
+    def leaf_segment
+      slug_suffix.present? ? "#{slug}~#{slug_suffix}" : slug
+    end
+
     def draft?
       visibility == "draft"
     end
@@ -196,13 +246,6 @@ def archived?
       archived_at.present?
     end
 
-    # A plan's containing location is the folder chosen by its author in
-    # their own library. Other people may save the same plan elsewhere, but
-    # those placements are personal organization rather than its home.
-    def author_placement
-      placements.find_by(library_id: created_by_user.library.id)
-    end
-
     # Legacy API compatibility (see LEGACY_STATUSES). Emits the closest
     # five-state equivalent of the current visibility/archival state.
     def legacy_status
@@ -270,10 +313,26 @@ def history_items
 
     private
 
+    def broadcast_listing_change
+      return unless previously_new_record? || (saved_changes.keys & LISTED_ATTRIBUTES).any?
+
+      broadcast_library_refresh(library)
+    end
+
     def assign_default_plan_type
       self.plan_type ||= PlanType.general
     end
 
+    def url_slug_stale?
+      slug.blank? || will_save_change_to_title?
+    end
+
+    # Drafts don't leave an alias behind: they're retitled repeatedly
+    # while being written, and nobody holds those links yet.
+    def assign_url_slug
+      Plans::AssignSlug.call(plan: self, record_alias: published?)
+    end
+
     # Backstop validation for attachment size/type. The primary check lives in
     # Plans::AddAttachment (which can reject before a blob is even created),
     # but this guarantees no code path can persist an oversized or disallowed
diff --git a/engine/app/models/coplan/plan_placement.rb b/engine/app/models/coplan/plan_placement.rb
index aa8a29d7..242985cc 100644
--- a/engine/app/models/coplan/plan_placement.rb
+++ b/engine/app/models/coplan/plan_placement.rb
@@ -1,25 +1,25 @@
 module CoPlan
-  # A placement shelves a plan in a library folder. It is the library
-  # owner's organization of the plan, not a property of the plan itself:
-  # the same plan can sit in many libraries at once, and shelving someone
-  # else's published plan is a first-class action — a placement, never a
-  # copy or a move.
+  # A placement files a plan in a library folder. A plan has at most one:
+  # it lives in exactly one place, the way a file does. Filing it
+  # somewhere else is a move, never a second copy — which is what lets a
+  # document have a single readable address (see Plan#url_path).
   #
   # Placements carry their own metadata (who placed it, when) — they're a
   # first-class attachment, not a bare join row. Visibility is inherited
   # from the plan: a placement is visible iff the underlying plan is
   # visible to the viewer (see .visible_to), whoever's library it sits in.
   class PlanPlacement < ApplicationRecord
-    belongs_to :plan, class_name: "CoPlan::Plan", inverse_of: :placements
+    include BroadcastsLibraryChanges
+
+    belongs_to :plan, class_name: "CoPlan::Plan", inverse_of: :placement
     belongs_to :folder, class_name: "CoPlan::Folder", inverse_of: :placements
     belongs_to :library, class_name: "CoPlan::Library", inverse_of: :placements
     belongs_to :placed_by_user, class_name: "CoPlan::User", optional: true
 
     before_validation :inherit_library_from_folder
 
-    # One spot per library: a plan sits in exactly one folder of a given
-    # library (re-shelving moves it, it doesn't duplicate it).
-    validates :plan_id, uniqueness: { scope: :library_id }
+    # One spot, period: re-filing a plan moves it, in or across libraries.
+    validates :plan_id, uniqueness: { message: "is already filed somewhere — move it instead" }
     validate :folder_must_belong_to_library
 
     # THE visibility rule for placements: defer entirely to the plan's
@@ -27,10 +27,33 @@ class PlanPlacement < ApplicationRecord
     # folder-jump, workspace) goes through this scope.
     scope :visible_to, ->(user) { where(plan: Plan.visible_to(user)) }
 
+    # Filing, moving and unfiling all change two listings at once: the
+    # document leaves one place and arrives in another. A cross-library
+    # move is the case that needs both libraries told, so this reads the
+    # previous library_id rather than assuming it didn't change.
+    after_commit :broadcast_placement_change
+
     private
 
-    # library_id is denormalized from the folder so "one spot per library"
-    # is enforceable with a unique index; callers only pick a folder.
+    def broadcast_placement_change
+      previous_id = library_id_previously_was
+      previous = previous_id.presence && previous_id != library_id ? Library.find_by(id: previous_id) : nil
+      broadcast_library_refresh(library, previous)
+
+      # The document's own page shows where it lives — the up-arrow beside
+      # the title — so a move has to land there too. Re-read the plan first:
+      # this row may be the one that just went away, and `plan.placement`
+      # would still hand it back.
+      fresh = Plan.find_by(id: plan_id)
+      return if fresh.nil?
+
+      Broadcaster.replace_to(fresh, target: "plan-nav-context",
+        partial: "coplan/plans/nav_context", locals: { plan: fresh })
+    end
+
+    # library_id is denormalized from the folder so library-scoped reads
+    # ("everything filed in this library") don't need the folder join;
+    # callers only ever pick a folder.
     def inherit_library_from_folder
       self.library_id ||= folder&.library_id
     end
diff --git a/engine/app/models/coplan/reference.rb b/engine/app/models/coplan/reference.rb
index 69ed1002..e2507428 100644
--- a/engine/app/models/coplan/reference.rb
+++ b/engine/app/models/coplan/reference.rb
@@ -15,13 +15,29 @@ class Reference < ApplicationRecord
     scope :extracted, -> { where(source: "extracted") }
     scope :explicit, -> { where(source: "explicit") }
 
-    def self.classify_url(url)
+    # `/plans/<uuid>` is self-identifying: nothing else on the web has that
+    # shape, so a path alone is proof. A readable address isn't — now that
+    # handles sit at the root, `/sam/liveorder/cart-roadmap` is shaped like
+    # any other site's URL, and matching it on shape would type half the
+    # links people paste as CoPlan documents.
+    #
+    # So the two forms are recognized by different means. The id form by
+    # pattern, anywhere. The readable form only when we know the URL is ours
+    # — either because the caller supplied our own host, or because the path
+    # actually resolves to a document (see .extract_target_plan_id).
+    PLAN_ID_PATH = %r{/plans/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})}
+    READABLE_PLAN_PATH = %r{\A/([a-z0-9][a-z0-9-]*)/([^?#]+)}
+
+    # `own_host` is the host CoPlan is being served from, when the caller
+    # knows it. Views do (`request.host`); background work generally
+    # doesn't, and gets the id form only.
+    def self.classify_url(url, own_host: nil)
       case url
       when %r{\Ahttps?://github\.com/[^/]+/[^/]+/pull/\d+}
         "pull_request"
       when %r{\Ahttps?://github\.com/[^/]+/[^/]+/?(\z|#|\?|/tree/|/blob/|/commit/)}
         "repository"
-      when %r{/plans/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}}
+      when PLAN_ID_PATH
         "plan"
       when %r{\Ahttps?://docs\.google\.com/}, %r{\Ahttps?://drive\.google\.com/}
         "document"
@@ -30,14 +46,90 @@ def self.classify_url(url)
       when %r{\Ahttps?://[^/]*confluence[^/]*/}
         "document"
       else
-        "link"
+        own_document?(url, own_host) ? "plan" : "link"
       end
     end
 
+    # Whether a URL is a readable address on our own host, deep enough to
+    # name something inside a library rather than the library itself.
+    def self.own_document?(url, own_host)
+      return false if own_host.blank?
+
+      uri = URI.parse(url.to_s)
+      return false unless uri.host&.casecmp?(own_host)
+
+      READABLE_PLAN_PATH.match?(uri.path.to_s)
+    rescue URI::InvalidURIError
+      false
+    end
+
+    # Type and target in one answer, because for a readable address they're
+    # the same question: a path that resolves to one of our documents *is* a
+    # plan reference, and the id it resolved to is what makes it one. A URL
+    # that classified as a plain "link" therefore still gets a resolution
+    # attempt, and is promoted if it lands.
+    #
+    # `excluding` is the citing plan's own id — a document linking to itself
+    # is a link, not a reference to another document.
+    #
+    # Returns [ reference_type, target_plan_id ].
+    def self.resolve_link(url, own_host: nil, excluding: nil)
+      type = classify_url(url, own_host: own_host)
+      return [ type, nil ] unless %w[plan link].include?(type)
+
+      id = extract_target_plan_id(url)
+      return [ type, nil ] if id.blank? || id == excluding || !Plan.exists?(id)
+
+      [ "plan", id ]
+    end
+
+    # The id of the document a link points at, so the References section
+    # can say which plan it is rather than just showing a URL.
+    #
+    # A readable path has to be resolved, since the id isn't in it. That
+    # walk goes through the alias table too, so a link written before a
+    # rename still finds the document it was always about — the same way
+    # following the link would.
+    #
+    # Resolution doubles as the is-this-ours test, which is why this is
+    # worth attempting on a URL that classified as a plain "link": if a
+    # handle we know owns a path we can walk, the link is ours. Callers
+    # promote the reference type when it comes back with an id.
     def self.extract_target_plan_id(url)
       return nil if url.blank?
-      match = url.match(%r{/plans/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})})
-      match&.[](1)
+
+      if (match = url.match(PLAN_ID_PATH))
+        return match[1]
+      end
+
+      match = readable_match(url)
+      return nil if match.nil?
+
+      resolve_readable(match[1], match[2])
+    end
+
+    # Cheap gate before the segment walk: the first path segment has to be a
+    # handle we actually have. Without it, every external link in a document
+    # would cost a folder-tree query.
+    def self.readable_match(url)
+      uri = URI.parse(url.to_s)
+      match = READABLE_PLAN_PATH.match(uri.path.to_s)
+      return nil unless match && Library.find_by_handle(match[1])
+
+      match
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    def self.resolve_readable(handle, slug_path)
+      result = Urls::Resolve.call(handle: handle, slug_path: slug_path)
+      return result.plan&.id if result.redirect_to_path.blank?
+
+      # A stale path the aliases recognized: walk the current one.
+      current_handle, _, rest = result.redirect_to_path.partition("/")
+      return nil if rest.blank?
+
+      Urls::Resolve.call(handle: current_handle, slug_path: rest).plan&.id
     end
 
     def self.ransackable_attributes(auth_object = nil)
diff --git a/engine/app/models/coplan/url_alias.rb b/engine/app/models/coplan/url_alias.rb
new file mode 100644
index 00000000..c34fbdb7
--- /dev/null
+++ b/engine/app/models/coplan/url_alias.rb
@@ -0,0 +1,118 @@
+module CoPlan
+  # Keeps an old URL working after the thing it named moved or was renamed.
+  #
+  # This table is a **cache, not the record**. Every rename is already
+  # written to PlanEvent (`title_changed`) and LibraryEvent
+  # (`folder_renamed`, `folder_moved`, `plan_moved`) with before/after
+  # values, append-only. So these rows can be rebuilt from scratch, which
+  # is what makes pruning safe: evicting one costs a slow resolve, never a
+  # dead link.
+  #
+  # Two kinds:
+  #
+  # - `exact`  — one URL to one URL. A retitled plan.
+  # - `prefix` — rewrites the head of a path, so a single row covers
+  #              everything beneath a renamed folder or library handle.
+  #              O(renames), not O(documents).
+  #
+  # Paths are library-handle-first with no leading slash, matching what
+  # the resolver walks: "orders/liveorder/cart-roadmap".
+  class UrlAlias < ApplicationRecord
+    KINDS = %w[exact prefix].freeze
+
+    validates :path, presence: true, length: { maximum: 512 },
+      uniqueness: { scope: :kind, case_sensitive: false }
+    validates :target_path, presence: true, length: { maximum: 512 }
+    validates :kind, presence: true, inclusion: { in: KINDS }
+
+    scope :exact, -> { where(kind: "exact") }
+    scope :prefix, -> { where(kind: "prefix") }
+
+    # Rewrites a stale path to its current form, or returns nil when
+    # nothing here knows about it.
+    #
+    # Exact matches win over prefix ones, and among prefixes the longest
+    # wins — so a rename of "orders/ebt/q3" beats an older rename of
+    # "orders/ebt" for a path under both. Follows chained renames (a
+    # folder renamed twice) up to MAX_HOPS, which also breaks any cycle
+    # that bad data could introduce.
+    MAX_HOPS = 5
+
+    def self.rewrite(path)
+      original = normalize(path)
+      return nil if original.blank?
+
+      current = original
+      MAX_HOPS.times do
+        row = match(current)
+        break if row.nil?
+
+        current = row.apply(current)
+        row.record_hit!
+      end
+
+      current == original ? nil : current
+    end
+
+    def self.match(path)
+      exact.find_by(path: path) || longest_prefix_match(path)
+    end
+
+    # Candidate prefixes are every ancestor path of the given path, so the
+    # lookup is one IN query rather than a LIKE scan.
+    #
+    # The path itself counts as one of its own prefixes: renaming a folder
+    # has to fix the link to the folder, not only the links to what's
+    # inside it. Without it a renamed library handle was never matched at
+    # all — a one-segment path has no ancestors.
+    def self.longest_prefix_match(path)
+      segments = path.split("/")
+      candidates = (1..segments.length).map { |n| segments.first(n).join("/") }
+
+      prefix.where(path: candidates).max_by { |row| row.path.length }
+    end
+
+    def self.normalize(path)
+      path.to_s.strip.delete_prefix("/").delete_suffix("/").downcase
+    end
+
+    # Records the rename of `from` to `to`. Idempotent, and skips the
+    # no-op case where a rename didn't actually change the URL (fixing
+    # capitalization, or editing a word the slug rules strip anyway).
+    def self.record!(from:, to:, kind: "exact")
+      from = normalize(from)
+      to = normalize(to)
+      return nil if from.blank? || to.blank? || from == to
+
+      row = find_or_initialize_by(path: from, kind: kind)
+      row.target_path = to
+      # A path that was itself a target now points somewhere new; resetting
+      # the counter keeps eviction honest about *this* alias.
+      row.resolve_count = 0 if row.persisted? && row.target_path_changed?
+      row.save!
+      row
+    end
+
+    def apply(path)
+      return target_path if kind == "exact"
+
+      target_path + path[self.path.length..].to_s
+    end
+
+    def record_hit!
+      # Throttled: a hot alias would otherwise write on every request.
+      # rubocop:disable Rails/SkipsModelValidations
+      return if last_resolved_at.present? && last_resolved_at > 1.day.ago
+
+      self.class.where(id: id).update_all(
+        resolve_count: self.class.arel_table[:resolve_count] + 1,
+        last_resolved_at: Time.current
+      )
+      # rubocop:enable Rails/SkipsModelValidations
+    end
+
+    def self.ransackable_attributes(_auth_object = nil)
+      %w[id path kind target_path resolve_count last_resolved_at created_at updated_at]
+    end
+  end
+end
diff --git a/engine/app/models/coplan/user.rb b/engine/app/models/coplan/user.rb
index 1577ac46..5c26f3d6 100644
--- a/engine/app/models/coplan/user.rb
+++ b/engine/app/models/coplan/user.rb
@@ -37,9 +37,17 @@ class User < ApplicationRecord
     after_initialize { self.metadata ||= {} }
     after_initialize { self.notification_preferences ||= {} }
 
-    # Every user always has a library — it's an invariant, materialized on
-    # first touch. Never read the association directly; this accessor is
-    # what guarantees "user without a library" isn't a state that exists.
+    # A library is a person's page now — it's what /<handle> addresses — so
+    # the row has to exist from the moment the person does. Materializing on
+    # first touch was enough while a library was only a filing cabinet; it
+    # isn't once someone can send you a link to a colleague who has never
+    # signed in.
+    after_create_commit :library
+
+    # Every user always has a library — it's an invariant. Never read the
+    # association directly; this accessor is what guarantees "user without a
+    # library" isn't a state that exists, including for the rows that
+    # predate the callback above.
     def library
       @library ||= Library.for(self)
     end
diff --git a/engine/app/services/coplan/broadcaster.rb b/engine/app/services/coplan/broadcaster.rb
index 5cfb8bd3..524b813e 100644
--- a/engine/app/services/coplan/broadcaster.rb
+++ b/engine/app/services/coplan/broadcaster.rb
@@ -30,6 +30,22 @@ def remove_to(streamable, target:)
         Turbo::StreamsChannel.broadcast_remove_to(streamable, target: target)
       end
 
+      # Tells every browser watching `streamable` to re-fetch its own page.
+      # Carries no content — just the news that there is some.
+      #
+      # That's the only correct shape for a library listing. What the page
+      # shows depends on the viewer (Plan.visible_to bounds every list and
+      # every count, so two people in the same folder see different numbers)
+      # and on where they are in it (current folder, active filters). There
+      # is no one fragment to render once and send to everyone, and the page
+      # carries forms, whose tokens are per-session.
+      #
+      # Turbo tags the stream with the acting request's id, so the browser
+      # that caused the change doesn't refresh on top of its own response.
+      def refresh_to(streamable)
+        Turbo::StreamsChannel.broadcast_refresh_to(streamable)
+      end
+
       # Broadcasts a custom turbo-stream action that the client may apply
       # conditionally. Used by live-content-update: the client checks for
       # unsaved drafts before swapping the body, otherwise shows a "reload"
diff --git a/engine/app/services/coplan/libraries/organize.rb b/engine/app/services/coplan/libraries/organize.rb
index 28325a4c..045dba44 100644
--- a/engine/app/services/coplan/libraries/organize.rb
+++ b/engine/app/services/coplan/libraries/organize.rb
@@ -11,10 +11,16 @@ module Libraries
     #   { op: "describe_folder", folder_path:|folder_id:, description: }
     #   { op: "move_folder",     folder_path:|folder_id:, new_parent_path:|new_parent_id: }  (blank → root)
     #   { op: "delete_folder",   folder_path:|folder_id: }                                   (must be empty)
-    #   { op: "move",            plan_id:, folder_path:|folder_id:, from_library_id: }       (blank dest → unfile)
-    #   { op: "move_many",       plan_ids: [...], folder_path:|folder_id:, from_library_id: }
+    #   { op: "move",            plan_id:, folder_path:|folder_id: }                         (blank dest → unfile)
+    #   { op: "move_many",       plan_ids: [...], folder_path:|folder_id: }
     #   { op: "move_by_tag",     tag:, folder_path:|folder_id:, scope: "library"|"visible" }
     #
+    # `from_library_id` on the move ops is accepted and ignored — old
+    # callers still send it. A plan is filed in exactly one place, so
+    # filing it somewhere new already takes it out of where it was; there
+    # is no source side to name. Plans::Place checks the authority that
+    # used to need naming (see its `may_move?`).
+    #
     # Each operation is atomic (a savepoint): a failed op rolls itself back
     # and reports an error while the rest of the batch proceeds. With
     # `dry_run: true` the whole batch runs inside a transaction that is
@@ -190,7 +196,6 @@ def move_plan(op)
         plan = find_visible_plan!(op[:plan_id])
         folder = resolve_destination(op)
         place!(plan, folder)
-        remove_from_source!(plan, op)
         ok(plan_id: plan.id, plan_title: plan.title, path: folder&.path)
       end
 
@@ -213,7 +218,6 @@ def move_many(op)
           ActiveRecord::Base.transaction(requires_new: true) do
             plan = find_visible_plan!(plan_id)
             place!(plan, folder)
-            remove_from_source!(plan, op)
             moved << { plan_id: plan.id, plan_title: plan.title }
           end
         rescue OpError => e
@@ -252,7 +256,7 @@ def plans_for_tag(op)
         if op[:scope].to_s == "visible"
           scoped.active
         else
-          scoped.joins(:placements).where(coplan_plan_placements: { library_id: @library.id })
+          scoped.joins(:placement).where(coplan_plan_placements: { library_id: @library.id })
         end
       end
 
@@ -266,25 +270,6 @@ def find_visible_plan!(plan_id)
         plan
       end
 
-      # Cross-library move: after shelving here, remove the placement from
-      # the source library. Both sides are gated by Library#writable_by?,
-      # and a failure raises out of the surrounding savepoint — never half
-      # a move.
-      def remove_from_source!(plan, op)
-        return if op[:from_library_id].blank? || op[:from_library_id] == @library.id
-
-        source = Library.find_by(id: op[:from_library_id])
-        raise OpError, "Source library not found" unless source
-
-        removal = Plans::Place.call(
-          plan: plan, folder: nil, actor: @actor, library: source,
-          actor_type: @actor_type, agent_name: @agent_name, api_token_id: @api_token_id, run_id: @run_id, event_metadata: event_metadata
-        )
-        unless removal.success?
-          raise OpError, "Could not remove from source library: #{removal.error}"
-        end
-      end
-
       def place!(plan, folder)
         result = Plans::Place.call(
           plan: plan, folder: folder, actor: @actor, library: @library,
diff --git a/engine/app/services/coplan/plans/assign_slug.rb b/engine/app/services/coplan/plans/assign_slug.rb
new file mode 100644
index 00000000..804d36e8
--- /dev/null
+++ b/engine/app/services/coplan/plans/assign_slug.rb
@@ -0,0 +1,160 @@
+module CoPlan
+  module Plans
+    # Works out a plan's URL segment and writes it, recording an alias for
+    # the old one.
+    #
+    # The rule is: **strip whatever the URL already says.** A plan titled
+    # "LiveOrder Cart Roadmap" filed in a folder called "LiveOrder" is
+    # just `cart-roadmap` — repeating the folder in the leaf is exactly
+    # the noise that makes a folder full of `liveorder-*` plans unreadable.
+    # Three sources of redundancy get stripped: the library handle, the
+    # folder name, and the plan type. Plus the word "plan" itself, which
+    # carries no information in an app where everything is a plan.
+    #
+    # Matching is hyphen-insensitive, so it works whether the folder was
+    # named "LiveOrder", "Live Order", or "live-order".
+    #
+    # Deliberately *not* implemented: stripping the common prefix across
+    # sibling plans. It would catch more cases, but one new plan without
+    # the prefix would silently change every sibling's URL.
+    class AssignSlug
+      # Unambiguous alphabet — no 0/o/1/l — for the disambiguating suffix.
+      SUFFIX_ALPHABET = "23456789abcdefghjkmnpqrstuvwxyz".freeze
+      SUFFIX_LENGTH = 4
+
+      def self.call(plan:, folder: :unset, previous_path: :unset, record_alias: true)
+        new(plan:, folder:, previous_path:, record_alias:).call
+      end
+
+      def initialize(plan:, folder: :unset, previous_path: :unset, record_alias: true)
+        @plan = plan
+        # Callers mid-move pass the destination folder explicitly, since
+        # the placement row may not be written yet.
+        @folder = folder == :unset ? plan.folder : folder
+        # A move has already changed the placement by the time we run, so
+        # the old URL can't be derived from the plan any more — the caller
+        # captures it beforehand and hands it over.
+        @previous_path = previous_path == :unset ? default_previous_path : previous_path
+        @record_alias = record_alias
+      end
+
+      def call
+        @plan.slug = derive
+        @plan.slug_suffix = contested? ? assign_suffix : nil
+
+        record_alias
+        @plan
+      end
+
+      private
+
+      def default_previous_path
+        @plan.slug.present? ? @plan.url_path : nil
+      end
+
+      # Full title slug, and the shortened form with everything the path
+      # already says removed. Falls back to the full form when stripping
+      # would leave nothing meaningful behind.
+      def derive
+        full = Slug.strip_noise(Slug.tokens(@plan.title))
+        return "untitled" if full.empty?
+
+        Slug.from_tokens(strip_redundancy(full))
+      end
+
+      # Repeats until nothing more comes off, so "Orders LiveOrder Cart"
+      # under /orders/liveorder loses both leading words regardless of
+      # the order they appear in.
+      def strip_redundancy(tokens)
+        kept = tokens
+        loop do
+          before = kept
+          redundant_phrases.each { |phrase| kept = strip_leading(kept, phrase) }
+          break if kept == before
+        end
+        kept.presence || tokens
+      end
+
+      # Everything the path already spells out: the handle, every folder
+      # on the way down (not just the immediate one — the URL says the
+      # whole chain), and the plan type.
+      def redundant_phrases
+        folder_names = @folder ? (@folder.ancestors + [ @folder ]).map(&:name) : []
+        [ @plan.library_handle, *folder_names, @plan.plan_type&.name ].compact_blank
+      end
+
+      # Drops the leading tokens that spell out `phrase`, hyphens ignored.
+      # Never strips everything — a plan titled exactly "LiveOrder" inside
+      # "LiveOrder" keeps its name rather than becoming empty.
+      def strip_leading(tokens, phrase)
+        key = Slug.compare_key(phrase)
+        return tokens if key.blank?
+
+        (1...tokens.length).each do |n|
+          return tokens.drop(n) if tokens.first(n).join == key
+        end
+        tokens
+      end
+
+      # Something else at this level already holds the segment. Checked
+      # against the folder's placements, which is the plan's real
+      # uniqueness scope — see the note in AddPlanSlugsAndUrlAliases about
+      # why this isn't a DB constraint yet.
+      #
+      # Sibling *folders* count too. Urls::Resolve hands the segment to a
+      # folder when both want it — mistaking a folder for a plan would
+      # break a whole subtree — so a plan sharing a folder's slug would
+      # have no reachable address at all. Folders never take a suffix;
+      # plans do, which makes the plan the one that moves.
+      def contested?
+        return true if sibling_folders.where(slug: @plan.slug).exists?
+
+        siblings.where(slug: @plan.slug, slug_suffix: nil).exists?
+      end
+
+      # The folders that sit at the same level of the URL as this plan: the
+      # children of the folder it's filed in, or the library's root folders
+      # when it's filed nowhere.
+      def sibling_folders
+        library = @folder&.library || @plan.library
+        return Folder.none if library.nil?
+
+        library.folders.where(parent_id: @folder&.id)
+      end
+
+      def siblings
+        scope = if @folder
+          Plan.where(id: @folder.placements.select(:plan_id))
+        else
+          Plan.where(id: unfiled_sibling_ids)
+        end
+        scope = scope.where.not(id: @plan.id) if @plan.persisted?
+        scope
+      end
+
+      # At a library root, a plan's siblings are the other plans its
+      # library shows there — the ones with no placement of their own.
+      def unfiled_sibling_ids
+        @plan.library&.unfiled_plans&.select(:id) || []
+      end
+
+      # Keeps trying until the pair is free. Random rather than sequential
+      # so the suffix says nothing about how many plans came before.
+      def assign_suffix
+        10.times do
+          candidate = SUFFIX_LENGTH.times.map { SUFFIX_ALPHABET[SecureRandom.random_number(SUFFIX_ALPHABET.length)] }.join
+          return candidate unless siblings.where(slug: @plan.slug, slug_suffix: candidate).exists?
+        end
+        SecureRandom.hex(4)
+      end
+
+      def record_alias
+        return unless @record_alias
+        return if @previous_path.blank?
+
+        current = @plan.url_path
+        UrlAlias.record!(from: @previous_path, to: current) if current.present?
+      end
+    end
+  end
+end
diff --git a/engine/app/services/coplan/plans/place.rb b/engine/app/services/coplan/plans/place.rb
index 5cc150c1..a1812981 100644
--- a/engine/app/services/coplan/plans/place.rb
+++ b/engine/app/services/coplan/plans/place.rb
@@ -1,13 +1,12 @@
 module CoPlan
   module Plans
-    # Shelves a plan in (or removes it from) one folder of a library —
-    # the single write path for placements, shared by the web workspace
-    # and the API so upsert semantics and the audit trail never diverge.
+    # Files a plan in (or removes it from) a folder — the single write
+    # path for placements, shared by the web workspace and the API so
+    # upsert semantics and the audit trail never diverge.
     #
-    # A plan sits in at most one folder per library: placing it again
-    # moves the placement; a nil folder unfiles it. Placing someone
-    # else's plan is first-class — the plan itself is untouched, only
-    # the actor's shelf changes.
+    # A plan sits in exactly one folder of one library, so this is always
+    # a move: filing it again relocates it, in or across libraries, and a
+    # nil folder drops it back to its author's library root.
     class Place
       Result = Struct.new(:placement, :error, keyword_init: true) do
         def success? = error.nil?
@@ -28,7 +27,10 @@ def initialize(plan:, folder:, actor:, library: nil, actor_type: nil,
         @plan = plan
         @folder = folder
         @actor = actor
-        @library = library || folder&.library || actor.library
+        # Filing means the destination; unfiling means wherever it is now.
+        # `plan.library` falls back to the author's library for a plan that
+        # isn't filed anywhere, so this is never nil.
+        @library = library || folder&.library || plan.library
         @actor_type = actor_type
         @agent_name = agent_name
         @api_token_id = api_token_id
@@ -38,59 +40,97 @@ def initialize(plan:, folder:, actor:, library: nil, actor_type: nil,
 
       def call
         unless @library.writable_by?(@actor)
-          return Result.new(error: "You can only organize your own library")
+          return Result.new(error: "You can only organize a library you own")
+        end
+        unless may_move?
+          return Result.new(error: "You can only move plans you wrote")
         end
         if @folder && @folder.library_id != @library.id
           return Result.new(error: "Folder belongs to a different library")
         end
-        placement = @library.placements.find_by(plan_id: @plan.id)
+        placement = @plan.placement
         old_path = placement&.folder&.path
+        # Captured before the write: afterwards the plan resolves through
+        # its new placement and the old path is gone.
+        old_url_path = @plan.url_path
 
-        # Removal is always allowed — you can take anything off your own
-        # shelf, even if the plan has since stopped being listable to you.
         if @folder.nil?
           return Result.new(placement: nil) if placement.nil?
 
           placement.destroy!
+          @plan.reload_placement
+          reslug(old_url_path, nil)
           log_move(old_path, nil)
           return Result.new(placement: nil)
         end
 
-        # Shelving requires the plan to be listable for you — an unlisted
-        # draft someone linked you can be read, but filing it onto a
-        # browsable shelf would surface what its author hasn't published.
+        # Filing requires the plan to be listable for you — an unlisted
+        # draft someone linked you can be read, but filing it into a
+        # browsable library would surface what its author hasn't published.
         unless PlanPolicy.new(@actor, @plan).listed?
-          return Result.new(error: "Only published plans (or your own drafts) can be shelved")
+          return Result.new(error: "Only published plans (or your own drafts) can be filed")
         end
 
         if placement
           return Result.new(placement:) if placement.folder_id == @folder.id
 
-          placement.update!(folder: @folder, placed_by_user: @actor)
+          placement.update!(folder: @folder, library: @folder.library, placed_by_user: @actor)
         else
           placement = @library.placements.create!(
             plan: @plan, folder: @folder, placed_by_user: @actor
           )
         end
+        @plan.reload_placement
+        reslug(old_url_path, @folder)
         log_move(old_path, @folder.path)
         Result.new(placement:)
       rescue ActiveRecord::RecordInvalid => e
         Result.new(error: e.record.errors.full_messages.join(", "))
       rescue ActiveRecord::RecordNotUnique
-        # Two concurrent shelves of the same plan raced past find_by; the
-        # unique [plan_id, library_id] index caught it. Retry once — the
-        # placement now exists, so this becomes a plain re-file.
+        # Two concurrent files of the same plan raced past the read; the
+        # unique plan_id index caught it. Retry once — the placement now
+        # exists, so this becomes a plain move.
         raise if @retried_unique
         @retried_unique = true
+        @plan.reload_placement
         retry
       end
 
       private
 
-      # Two audit trails, one write path. The plan-side event only fires for
-      # the author's own library — someone else curating their shelf isn't
-      # an event in the plan's history. The library-side event always fires:
-      # every rearrangement of a shelf is part of that library's audit log.
+      # Filing is a move of the document, not curation of a personal
+      # shelf, so it takes authority on both sides: write access to the
+      # destination library (checked above) and a claim on the plan where
+      # it sits now. Authors always qualify; otherwise you must control
+      # the library it's currently in — which is what will let a team
+      # reorganize its own library without letting anyone walk off with
+      # someone else's document.
+      def may_move?
+        return true if @plan.created_by_user_id == @actor.id
+
+        current = @plan.placement&.library
+        current.present? && current.writable_by?(@actor)
+      end
+
+      # A plan's slug depends on where it sits — "LiveOrder Cart Roadmap"
+      # is `cart-roadmap` inside "LiveOrder" and `liveorder-cart-roadmap`
+      # anywhere else — so a move re-derives it and leaves an alias at the
+      # old URL.
+      def reslug(old_url_path, folder)
+        AssignSlug.call(plan: @plan, folder: folder, previous_path: old_url_path,
+          record_alias: @plan.published?)
+        @plan.save! if @plan.changed?
+      end
+
+      # Two audit trails, one write path. The plan-side event only fires
+      # for the author — someone else reorganizing a shared library isn't
+      # an event in the plan's own history. The library-side event always
+      # fires: every rearrangement is part of that library's audit log.
+      #
+      # A move that crosses libraries logs only the destination. Not
+      # reachable today (one library per owner, so there's nowhere else to
+      # move to); when team libraries land, the source library wants its
+      # own "plan_removed" event here.
       def log_move(old_path, new_path)
         return if old_path == new_path
 
diff --git a/engine/app/services/coplan/references/extract_from_content.rb b/engine/app/services/coplan/references/extract_from_content.rb
index 7fca729f..dffc0d4c 100644
--- a/engine/app/services/coplan/references/extract_from_content.rb
+++ b/engine/app/services/coplan/references/extract_from_content.rb
@@ -19,21 +19,18 @@ def call
         # Remove extracted references for URLs no longer in content
         @plan.references.extracted.where.not(url: found_urls.keys).delete_all
 
-        # Batch-check plan existence for plan-type references
-        candidate_plan_ids = found_urls.keys
-          .select { |url| Reference.classify_url(url) == "plan" }
-          .filter_map { |url| Reference.extract_target_plan_id(url) }
-          .reject { |id| id == @plan.id }
-        existing_plan_ids = candidate_plan_ids.any? ? Plan.where(id: candidate_plan_ids).pluck(:id).to_set : Set.new
+        # Once per distinct URL, not once per mention: a readable address
+        # costs a segment walk to turn into an id, so a body full of
+        # cross-links to the same document pays for it once.
+        #
+        # No `own_host` — this runs from a model callback, with no request to
+        # ask. A readable address is recognized here by resolving, which is
+        # the stronger test anyway.
+        links = found_urls.keys.index_with { |url| Reference.resolve_link(url, excluding: @plan.id) }
 
         # Create or update references for found URLs
         found_urls.each do |url, meta|
-          ref_type = Reference.classify_url(url)
-          target_plan_id = nil
-          if ref_type == "plan"
-            candidate_id = Reference.extract_target_plan_id(url)
-            target_plan_id = candidate_id if candidate_id && existing_plan_ids.include?(candidate_id)
-          end
+          ref_type, target_plan_id = links[url]
 
           ref = @plan.references.find_or_initialize_by(url: url)
           # Don't overwrite explicit references
diff --git a/engine/app/services/coplan/slug.rb b/engine/app/services/coplan/slug.rb
new file mode 100644
index 00000000..6b18fdfa
--- /dev/null
+++ b/engine/app/services/coplan/slug.rb
@@ -0,0 +1,89 @@
+module CoPlan
+  # Turns human names into URL segments, and compares them loosely.
+  #
+  # Every browsable folder and plan segment goes through {call}. The rules
+  # are deliberately dull so a slug is predictable from the name that
+  # produced it: downcase, runs of punctuation and whitespace to hyphens,
+  # keep letters and digits. No camelCase splitting: "LiveOrder" is one
+  # word to a reader, so it stays "liveorder" rather than "live-order".
+  #
+  # "Letters and digits" means Unicode ones. A title in Japanese or Arabic
+  # keeps its own script — /aiko/信頼性向上ロードマップ-2027年前半 — because
+  # the alternative is a URL reading "untitled", which defeats the whole
+  # point of a readable link. Browsers percent-encode these on the wire
+  # and display them decoded, and Rails hands them back as UTF-8. Accents
+  # survive too: NFC, not NFKD, so "incorporación" doesn't come apart into
+  # a base letter and a stray combining mark.
+  #
+  # Library handles are the exception — see {handle}.
+  #
+  # {compare_key} is the fuzzy half. "LiveOrder", "Live Order" and
+  # "live-order" all reduce to the same key, which is what lets a plan
+  # titled "LiveOrder Cart Roadmap" recognize that the folder it sits in
+  # already said "LiveOrder" — see {Plans::AssignSlug}.
+  module Slug
+    # Long enough to stay readable, short enough to paste in Slack.
+    # Characters, not bytes — a CJK title gets the same 60 glyphs.
+    MAX_LENGTH = 60
+
+    # Everything in this app is a plan, so the word carries no
+    # information in a URL. Stripped as a leading or trailing token only
+    # — "plan-b-pricing" keeps its middle.
+    NOISE_TOKENS = %w[plan plans doc document].freeze
+
+    def self.call(text)
+      normalize(text.to_s.unicode_normalize(:nfc).downcase.gsub(/[^[[:alnum:]]]+/, "-"))
+    end
+
+    # ASCII-only variant for library handles. A handle is the root of
+    # every URL under it and gets typed, read aloud, and pasted into
+    # places that mangle non-ASCII, so it stays in the Latin alphabet
+    # even when the name it came from doesn't. Empty is a legitimate
+    # answer — callers fall back (see Library.unclaimed_handle).
+    def self.handle(text)
+      normalize(text.to_s.unicode_normalize(:nfkd).downcase.gsub(/[^a-z0-9]+/, "-"))
+    end
+
+    # Hyphen-insensitive form, for asking "do these two names say the
+    # same thing?" without caring how the writer spaced it.
+    def self.compare_key(text)
+      call(text).delete("-")
+    end
+
+    # Splits a slug into its tokens — the unit that redundancy stripping
+    # and truncation both work in.
+    def self.tokens(text)
+      call(text).split("-")
+    end
+
+    # Rejoins tokens into a slug, trimming to MAX_LENGTH on a token
+    # boundary so a URL never ends mid-word.
+    def self.from_tokens(tokens)
+      truncate(tokens.join("-"))
+    end
+
+    # Drops leading/trailing filler like "plan" and "doc". Never returns
+    # empty: a title that is nothing but noise keeps its tokens.
+    def self.strip_noise(tokens)
+      kept = tokens.dup
+      kept.shift while kept.size > 1 && NOISE_TOKENS.include?(kept.first)
+      kept.pop while kept.size > 1 && NOISE_TOKENS.include?(kept.last)
+      kept.presence || tokens
+    end
+
+    # Collapses hyphen runs and trims the ends, then truncates. Shared by
+    # {call} and {handle}, which differ only in what they keep.
+    def self.normalize(hyphenated)
+      truncate(hyphenated.gsub(/-{2,}/, "-").delete_prefix("-").delete_suffix("-"))
+    end
+
+    # Cuts at the last token boundary that fits, so "orders-api-
+    # migration-plan" truncates to "orders-api" rather than
+    # "orders-api-migrat".
+    def self.truncate(slug)
+      return slug if slug.length <= MAX_LENGTH
+
+      slug[0, MAX_LENGTH].rpartition("-").first.presence || slug[0, MAX_LENGTH]
+    end
+  end
+end
diff --git a/engine/app/services/coplan/urls/canonical.rb b/engine/app/services/coplan/urls/canonical.rb
new file mode 100644
index 00000000..a08fdfde
--- /dev/null
+++ b/engine/app/services/coplan/urls/canonical.rb
@@ -0,0 +1,38 @@
+module CoPlan
+  module Urls
+    # Builds the readable address of a document with no request in hand —
+    # background jobs, push payloads, anything with no view context to
+    # borrow route helpers from. A caller that *has* a request should go
+    # through `CoPlan::BrowseHelper` instead, which is mount-aware.
+    #
+    # Paths only, and mount-prefix-free: engine route helpers called outside
+    # a request can't know where the host mounted the engine. That's the
+    # same limitation every other non-request caller here lives with (see
+    # SlackNotificationJob, Api::V1::BaseController) and it costs nothing
+    # while the engine is mounted at "/".
+    #
+    # The absolute form needs a host, which only a request knows, so
+    # `browse_url` stays in the helper.
+    module Canonical
+      # `/<handle>/<folders>/<slug>`, or the id form for a plan whose
+      # slug hasn't been backfilled yet. Both have to work while slugs
+      # fill in, and `/plans/<uuid>` 301s here once one exists.
+      def self.plan_path(plan, **options)
+        routes = CoPlan::Engine.routes.url_helpers
+        handle, slug_path = split(plan.url_path)
+        return routes.plan_path(plan, **options) if slug_path.blank?
+
+        routes.browse_path(handle: handle, slug_path: slug_path, **options)
+      end
+
+      # Splits "handle/rest/of/path" into its two route segments. A path
+      # with no rest names a library, not a document.
+      def self.split(path)
+        return [ nil, nil ] if path.blank?
+
+        handle, _, rest = path.partition("/")
+        [ handle, rest.presence ]
+      end
+    end
+  end
+end
diff --git a/engine/app/services/coplan/urls/resolve.rb b/engine/app/services/coplan/urls/resolve.rb
new file mode 100644
index 00000000..e35543ef
--- /dev/null
+++ b/engine/app/services/coplan/urls/resolve.rb
@@ -0,0 +1,113 @@
+module CoPlan
+  module Urls
+    # Turns a browsable URL into the thing it points at.
+    #
+    #   /orders                            → library
+    #   /orders/liveorder                  → folder
+    #   /orders/liveorder/cart-roadmap     → plan
+    #
+    # Resolution walks one segment at a time — handle, then folder slug
+    # within the previous folder, then a plan slug in whatever folder we
+    # landed in. Nothing stores a joined path, which is why renaming a
+    # folder can't invalidate anything below it.
+    #
+    # The last segment is ambiguous by nature: it might be a subfolder or
+    # it might be a plan. Folders win. A folder has children hanging off
+    # it, so mistaking a folder for a plan would break a whole subtree,
+    # while the reverse breaks one document — and the plan can still be
+    # reached with its disambiguating suffix.
+    class Resolve
+      # `redirect_to_path` is set when the request arrived at a stale but
+      # recognizable path: the caller should 301 rather than render.
+      Result = Struct.new(:library, :folder, :plan, :redirect_to_path, keyword_init: true) do
+        def found? = library.present?
+
+        # What the URL actually addressed, for the caller to authorize.
+        def target = plan || folder || library
+      end
+
+      NOT_FOUND = Result.new.freeze
+
+      def self.call(handle:, slug_path: nil)
+        new(handle:, slug_path:).call
+      end
+
+      def initialize(handle:, slug_path: nil)
+        @handle = handle.to_s
+        @segments = slug_path.to_s.split("/").map { |segment| segment.strip.downcase }.reject(&:blank?)
+      end
+
+      def call
+        library = Library.find_by_handle(@handle)
+        return resolve_stale_handle if library.nil?
+        return Result.new(library: library) if @segments.empty?
+
+        walk(library)
+      end
+
+      private
+
+      # Descends as far as the folder tree goes, then asks whether the
+      # leftover segment names a plan.
+      def walk(library)
+        folder = nil
+        @segments.each_with_index do |segment, index|
+          child = library.folders.find_by(parent_id: folder&.id, slug: segment)
+          if child
+            folder = child
+            next
+          end
+
+          # Not a folder — only the final segment may be a plan.
+          return resolve_stale_path(library) unless index == @segments.length - 1
+
+          plan = find_plan(library, folder, segment)
+          return plan ? Result.new(library:, folder:, plan:) : resolve_stale_path(library)
+        end
+
+        Result.new(library:, folder:)
+      end
+
+      # Plans are addressed by slug within the folder they're filed in
+      # (or filed nowhere, at the library root). The optional `~suffix`
+      # disambiguates two plans whose titles slugify the same way.
+      def find_plan(library, folder, segment)
+        # rpartition puts the whole string in its *last* slot when the
+        # separator is absent, so the no-suffix case is split explicitly.
+        slug, suffix = if segment.include?("~")
+          head, _, tail = segment.rpartition("~")
+          [ head, tail ]
+        else
+          [ segment, nil ]
+        end
+
+        scope = if folder
+          Plan.where(id: library.placements.where(folder_id: folder.id).select(:plan_id))
+        else
+          # No folder segment: the plan sits at the library root, which
+          # means it has no placement row to find it by.
+          library.unfiled_plans
+        end
+
+        scope.find_by(slug: slug, slug_suffix: suffix.presence)
+      end
+
+      # A path we can't walk might still be a path we used to know.
+      def resolve_stale_path(library)
+        alias_redirect(File.join(library.handle, *@segments)) || NOT_FOUND
+      end
+
+      def resolve_stale_handle
+        alias_redirect(File.join(*[ @handle, *@segments ].compact_blank)) || NOT_FOUND
+      end
+
+      def alias_redirect(path)
+        rewritten = UrlAlias.rewrite(path)
+        return nil if rewritten.nil? || rewritten == path
+
+        Result.new(library: Library.find_by_handle(rewritten.split("/").first),
+          redirect_to_path: rewritten)
+      end
+    end
+  end
+end
diff --git a/engine/app/services/coplan/web_push/payload_for_notification.rb b/engine/app/services/coplan/web_push/payload_for_notification.rb
index 632908f2..6595e936 100644
--- a/engine/app/services/coplan/web_push/payload_for_notification.rb
+++ b/engine/app/services/coplan/web_push/payload_for_notification.rb
@@ -67,7 +67,7 @@ def body
       def url
         # Relative path is fine — the SW resolves against self.location.origin
         # when opening / focusing the notification target tab.
-        CoPlan::Engine.routes.url_helpers.plan_path(@plan, thread: @thread.id)
+        CoPlan::Urls::Canonical.plan_path(@plan, thread: @thread.id)
       end
 
       def actor_name
diff --git a/engine/app/views/coplan/comment_threads/_thread_popover.html.erb b/engine/app/views/coplan/comment_threads/_thread_popover.html.erb
index e9b7918e..926cf2cd 100644
--- a/engine/app/views/coplan/comment_threads/_thread_popover.html.erb
+++ b/engine/app/views/coplan/comment_threads/_thread_popover.html.erb
@@ -13,7 +13,7 @@
       <% if thread.out_of_date? %>
         <span class="badge badge--archived">out of date</span>
       <% end %>
-      <%= link_to plan_path(plan, thread: thread.id),
+      <%= link_to plan_browse_path(plan, thread: thread.id),
                   class: "thread-popover__permalink btn btn--secondary btn--sm",
                   title: "Copy link to this comment",
                   data: { action: "coplan--text-selection#copyThreadLink" } do %>
diff --git a/engine/app/views/coplan/home/show.html.erb b/engine/app/views/coplan/home/show.html.erb
index 0fbec17e..b8a343b1 100644
--- a/engine/app/views/coplan/home/show.html.erb
+++ b/engine/app/views/coplan/home/show.html.erb
@@ -28,7 +28,7 @@
               <div class="home__item-body">
                 <div class="home__item-line">
                   <%= plan_type_icon(plan, size: :sm) %>
-                  <%= link_to plan.title, plan_path(plan), class: "home__item-title" %>
+                  <%= link_to plan.title, plan_browse_path(plan), class: "home__item-title" %>
                   <% if item.summary_parts.any? %>
                     <span class="home__item-activity">
                       <% if item.published %>
diff --git a/engine/app/views/coplan/libraries/_shelf.html.erb b/engine/app/views/coplan/libraries/_shelf.html.erb
deleted file mode 100644
index 04712f06..00000000
--- a/engine/app/views/coplan/libraries/_shelf.html.erb
+++ /dev/null
@@ -1,33 +0,0 @@
-<%# One folder of a browsed library: its visible plans, then subfolders.
-    Uses @folder_children / @placements_by_folder from LibrariesController.
-    Open by default — a library page is for reading the whole shelf. %>
-<% placements = @placements_by_folder[folder.id] || [] %>
-<% children = (@folder_children[folder.id] || []).sort_by { |f| f.name.downcase } %>
-
-<details class="library-shelf library-shelf--depth-<%= depth %>" open id="folder-<%= folder.id %>">
-  <summary class="library-shelf__summary">
-    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z"/></svg>
-    <span class="library-shelf__name"><%= folder.name %></span>
-    <span class="library-shelf__count text-muted"><%= placements.size %></span>
-  </summary>
-
-  <% if placements.any? %>
-    <ul class="library-shelf__plans">
-      <% placements.each do |placement| %>
-        <% plan = placement.plan %>
-        <li class="library-shelf__plan">
-          <%= link_to plan.title, plan_path(plan), class: "library-shelf__plan-title" %><%= plan_state_badge(plan) %>
-          <span class="library-shelf__plan-meta text-muted">
-            by <%= profile_link(plan.created_by_user) %> · updated <%= time_ago_in_words(plan.updated_at) %> ago
-          </span>
-        </li>
-      <% end %>
-    </ul>
-  <% elsif children.empty? %>
-    <p class="library-shelf__empty text-muted text-sm">Empty shelf.</p>
-  <% end %>
-
-  <% children.each do |child| %>
-    <%= render "coplan/libraries/shelf", folder: child, depth: depth + 1 %>
-  <% end %>
-</details>
diff --git a/engine/app/views/coplan/libraries/index.html.erb b/engine/app/views/coplan/libraries/index.html.erb
new file mode 100644
index 00000000..5443f7ff
--- /dev/null
+++ b/engine/app/views/coplan/libraries/index.html.erb
@@ -0,0 +1,29 @@
+<% content_for :title, "Libraries" %>
+
+<div class="library">
+  <header class="library__header">
+    <div class="library__identity">
+      <div>
+        <h1 class="library__title">Libraries</h1>
+        <p class="library__subtitle text-muted">
+          <%= pluralize(@libraries.size, "library") %> you can browse
+        </p>
+      </div>
+    </div>
+  </header>
+
+  <% @libraries.each do |library| %>
+    <% owner = library.owner %>
+    <%= link_to library_browse_path(library), class: "folder-row", data: { turbo_prefetch: true } do %>
+      <span class="folder-row__icon" aria-hidden="true">
+        <svg width="17" height="17" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 21v-8a1 1 0 0 0-1-1h-4a1 1 0 0 0-1 1v8"/><path d="M3 10a2 2 0 0 1 .709-1.528l7-5.999a2 2 0 0 1 2.582 0l7 5.999A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/></svg>
+      </span>
+      <span class="folder-row__name">
+        <%= owner.respond_to?(:name) ? owner.name : library.name %>
+        <span class="text-muted">/<%= library.handle %></span>
+      </span>
+      <% count = @plan_counts[library.id].to_i %>
+      <span class="folder-row__count text-muted"><%= count.zero? ? "empty" : pluralize(count, "plan") %></span>
+    <% end %>
+  <% end %>
+</div>
diff --git a/engine/app/views/coplan/libraries/show.html.erb b/engine/app/views/coplan/libraries/show.html.erb
deleted file mode 100644
index 648c876e..00000000
--- a/engine/app/views/coplan/libraries/show.html.erb
+++ /dev/null
@@ -1,70 +0,0 @@
-<% owner_name = @owner.respond_to?(:name) ? @owner.name : @library.name %>
-
-<div class="library">
-  <header class="library__header">
-    <div class="library__identity">
-      <% if @owner.is_a?(CoPlan::User) %>
-        <%= user_avatar(@owner, size: "lg") %>
-      <% end %>
-      <div>
-        <h1 class="library__title"><%= owner_name %>’s library</h1>
-        <p class="library__subtitle text-muted">
-          <%= pluralize(@plan_count, "plan") %> across <%= pluralize(@folders.size, "folder") %>
-          <% if @owner.is_a?(CoPlan::User) %> · curated by <%= profile_link(@owner) %><% end %>
-        </p>
-      </div>
-    </div>
-  </header>
-
-  <nav class="workspace-crumbs" aria-label="Folder location">
-    <%= link_to library_path(@library),
-          class: "workspace-crumbs__crumb #{'workspace-crumbs__crumb--current' if @breadcrumbs.empty?}",
-          aria: @breadcrumbs.empty? ? { current: "location" } : {},
-          data: { turbo_prefetch: true } do %>
-      <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M15 21v-8a1 1 0 0 0-1-1h-4a1 1 0 0 0-1 1v8"/><path d="M3 10a2 2 0 0 1 .709-1.528l7-5.999a2 2 0 0 1 2.582 0l7 5.999A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/></svg>
-      <%= owner_name %>’s library
-    <% end %>
-    <% @breadcrumbs.each_with_index do |crumb, index| %>
-      <svg class="workspace-crumbs__sep" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m9 18 6-6-6-6"/></svg>
-      <% current = index == @breadcrumbs.size - 1 %>
-      <%= link_to crumb.name, library_path(@library, folder: crumb.id),
-            class: "workspace-crumbs__crumb #{'workspace-crumbs__crumb--current' if current}",
-            aria: current ? { current: "location" } : {},
-            data: { turbo_prefetch: true } %>
-    <% end %>
-  </nav>
-
-  <% @subfolders.each do |folder| %>
-    <%= link_to library_path(@library, folder: folder.id), class: "folder-row", data: { turbo_prefetch: true } do %>
-      <span class="folder-row__icon" aria-hidden="true">
-        <svg width="17" height="17" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z"/></svg>
-      </span>
-      <span class="folder-row__name"><%= folder.name %></span>
-      <% count = @folder_counts[folder.id] %>
-      <span class="folder-row__count text-muted"><%= count.zero? ? "empty" : pluralize(count, "item") %></span>
-    <% end %>
-  <% end %>
-
-  <% @plans.each do |plan| %>
-    <% summary = plan.try(:summary).presence || plan_content_preview(plan) %>
-    <article class="plan-row">
-      <span class="plan-row__icon"><%= plan_type_icon(plan, size: :lg) %></span>
-      <div class="plan-row__main">
-        <div class="plan-row__line">
-          <%= link_to plan.title, plan_path(plan), class: "plan-row__title", data: { turbo_prefetch: true } %><%= plan_state_badge(plan) %>
-        </div>
-        <% if summary.present? %><p class="plan-row__summary text-muted"><%= summary %></p><% end %>
-      </div>
-      <div class="plan-row__meta">
-        <span class="plan-row__time text-muted"><%= time_ago_in_words(plan.updated_at) %> ago</span>
-        <span class="plan-row__avatar"><%= link_to user_avatar(plan.created_by_user), profile_path_for(plan.created_by_user), title: plan.created_by_user.name %></span>
-      </div>
-    </article>
-  <% end %>
-
-  <% if @subfolders.empty? && @plans.empty? %>
-    <div class="library__empty">
-      <p>Nothing in this folder yet.</p>
-    </div>
-  <% end %>
-</div>
diff --git a/engine/app/views/coplan/plans/_header.html.erb b/engine/app/views/coplan/plans/_header.html.erb
index 666dc242..ae08e471 100644
--- a/engine/app/views/coplan/plans/_header.html.erb
+++ b/engine/app/views/coplan/plans/_header.html.erb
@@ -1,16 +1,17 @@
 <%# The plan's identity: type icon + title, then the byline. Everything
     here derives from the plan alone — this partial is broadcast-replaced
     (content commits, visibility changes, API edits) with no current_user,
-    so viewer-relative chrome (presence, the owner toolbar, Save) lives in
-    the masthead's side column next to this, never inside it. %>
-<% author_placement = local_assigns.fetch(:author_placement) { plan.author_placement } %>
+    so viewer-relative chrome (presence, the owner toolbar) lives in the
+    masthead's side column next to this, never inside it. The location
+    link is safe here: a plan lives in one place, the same for everyone. %>
+<% placement = local_assigns.fetch(:placement) { plan.placement } %>
 <div class="page-header page-header--plan" id="plan-header">
   <%= plan_type_icon(plan, size: :lg) %>
   <div class="page-header__text">
     <h1 class="page-header__title"><%= plan.title %></h1>
     <div class="page-header__byline text-sm text-muted">
       <%= user_avatar(plan.created_by_user) %> <%= profile_link(plan.created_by_user) %> · v<%= plan.current_revision %><%= plan_state_badge(plan) %>
-      <%= render "coplan/plans/location_link", plan: plan, placement: author_placement, location: :masthead %>
+      <%= render "coplan/plans/location_link", plan: plan, placement: placement, location: :masthead %>
     </div>
   </div>
 </div>
diff --git a/engine/app/views/coplan/plans/_library_header.html.erb b/engine/app/views/coplan/plans/_library_header.html.erb
new file mode 100644
index 00000000..adbedf99
--- /dev/null
+++ b/engine/app/views/coplan/plans/_library_header.html.erb
@@ -0,0 +1,36 @@
+<%# Whose library this is. A person and their library are one page, so the
+    identity that used to live on /people/:id sits at the top of it. Same
+    markup either way — your own library says your own name, which is what
+    a shared link says too. %>
+<header class="library-header">
+  <div class="library-header__identity">
+    <% if @profile %>
+      <% if @profile.avatar_url.present? %>
+        <img src="<%= @profile.avatar_url %>" alt="" class="avatar avatar--lg" loading="lazy">
+      <% else %>
+        <span class="avatar avatar--lg avatar--initials"><%= @profile.name.split.map { |w| w[0] }.first(2).join.upcase %></span>
+      <% end %>
+    <% end %>
+    <div class="library-header__text">
+      <h1 class="library-header__name"><%= @profile&.name || @library.name %></h1>
+      <p class="library-header__meta text-muted">
+        <% details = [ @profile&.title, @profile&.team ].compact_blank %>
+        <% if details.any? %><%= details.join(" · ") %> · <% end %>
+        <span class="library-header__handle">/<%= @library.handle %></span>
+        <% if @profile&.profile_url.present? %>
+          · <%= link_to "Directory ↗", @profile.profile_url, target: "_blank", rel: "noopener",
+                class: "library-header__directory-link" %>
+        <% end %>
+      </p>
+    </div>
+  </div>
+
+  <%# The one visible difference between your library and anyone else's:
+      what you're allowed to do to it. Everything else on this page — the
+      filters, the folder counts, the level view — is identical. %>
+  <% unless @can_write %>
+    <span class="library-header__badge" title="You can browse this library, but only <%= @profile&.name || @library.name %> can file things into it">
+      Read only
+    </span>
+  <% end %>
+</header>
diff --git a/engine/app/views/coplan/plans/_location_link.html.erb b/engine/app/views/coplan/plans/_location_link.html.erb
index 7be0f402..83765dd1 100644
--- a/engine/app/views/coplan/plans/_location_link.html.erb
+++ b/engine/app/views/coplan/plans/_location_link.html.erb
@@ -1,15 +1,15 @@
-<%# Go up from the document to its containing folder in the author's
-    library. An unfiled document goes to that library's root. %>
+<%# Go up from the document to the folder it lives in. An unfiled
+    document goes to its library's root. %>
 <% unless plan.archived? %>
-  <% library = plan.created_by_user.library %>
+  <% library = plan.library %>
   <% folder = placement&.folder %>
-  <% label = folder ? "Up to containing folder — #{folder.path}" : "Up to #{plan.created_by_user.name}’s library" %>
-  <%= link_to library_path(library, folder: folder&.id),
+  <% label = folder ? "Up to containing folder — #{folder.path}" : "Up to #{library.name}" %>
+  <%= link_to(folder ? folder_browse_path(folder) : library_browse_path(library),
         class: "plan-location-link plan-location-link--#{location}",
         title: label,
         aria: { label: label },
         tabindex: location == :nav ? -1 : nil,
-        data: { turbo_prefetch: true } do %>
+        data: { turbo_prefetch: true }) do %>
     <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
       <path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z"/>
       <path d="m14 13-2-2-2 2"/>
diff --git a/engine/app/views/coplan/plans/_nav_context.html.erb b/engine/app/views/coplan/plans/_nav_context.html.erb
index 88d37690..11e3e0c3 100644
--- a/engine/app/views/coplan/plans/_nav_context.html.erb
+++ b/engine/app/views/coplan/plans/_nav_context.html.erb
@@ -1,6 +1,6 @@
-<% author_placement = local_assigns.fetch(:author_placement) { plan.author_placement } %>
+<% placement = local_assigns.fetch(:placement) { plan.placement } %>
 <span id="plan-nav-context" class="site-nav__plan-context" data-controller="coplan--nav-title" aria-hidden="true">
-  <%= render "coplan/plans/location_link", plan: plan, placement: author_placement, location: :nav %>
+  <%= render "coplan/plans/location_link", plan: plan, placement: placement, location: :nav %>
   <a href="#plan-header" class="site-nav__doc-title" data-action="click->coplan--nav-title#scrollToTop" tabindex="-1">
     <%= plan_type_icon(plan, size: :sm) %>
     <span class="site-nav__doc-title-text"><%= plan.title %></span>
diff --git a/engine/app/views/coplan/plans/_plan_row.html.erb b/engine/app/views/coplan/plans/_plan_row.html.erb
index a45f9585..c759e88b 100644
--- a/engine/app/views/coplan/plans/_plan_row.html.erb
+++ b/engine/app/views/coplan/plans/_plan_row.html.erb
@@ -1,23 +1,22 @@
-<%# Compact plan row for the workspace index. Shelving is viewer-relative:
-    any row can be dragged into (or re-filed within) the current user's own
-    library, whoever wrote the plan — the folder shown is where *you* filed
-    it (server-rendered per viewer — this page doesn't broadcast).
+<%# Compact plan row for the workspace index. The folder shown is where
+    the plan actually lives — one place, the same for everyone — and
+    dragging a row moves it there rather than copying it onto a shelf.
 
     draggable="false" on every inner link/image: links are natively
     draggable, so without it a drag that starts on the title picks up the
     *link* payload instead of the row's — the "only works if you grab the
     right spot" bug. %>
 <% summary = plan.try(:summary).presence || plan_content_preview(plan) %>
-<% my_folder_id = viewer_folder_id(plan) %>
+<% folder_id = plan_folder_id(plan) %>
 
 <article class="plan-row<%= " plan-row--archived" if plan.archived? %>"
          data-plan-id="<%= plan.id %>"
-         data-plan-url="<%= plan_path(plan) %>"
+         data-plan-url="<%= plan_browse_path(plan) %>"
          data-visibility="<%= plan.visibility %>"
          data-coplan--workspace-keys-target="item"
          draggable="true"
          data-move-url="<%= move_to_folder_plan_path(plan) %>"
-         data-current-folder-id="<%= my_folder_id %>"
+         data-current-folder-id="<%= folder_id %>"
          data-action="dragstart->coplan--folder-dnd#dragStart dragend->coplan--folder-dnd#dragEnd">
   <%# The file icon spans both text rows — a Drive-style file entry, not an
       inline glyph. %>
@@ -28,13 +27,13 @@
           click anywhere navigates and a hover anywhere prefetches the plan
           (Turbo 8 hover prefetch) — native link semantics (middle/cmd
           click) included. Other links/buttons in the row sit above it. %>
-      <%= link_to plan.title, plan_path(plan), class: "plan-row__title", draggable: false,
+      <%= link_to plan.title, plan_browse_path(plan), class: "plan-row__title", draggable: false,
             data: { turbo_frame: "_top", turbo_prefetch: true } %><%= plan_state_badge(plan) %>
-      <% if my_folder_id && my_folder_id != local_assigns[:suppress_folder_id] %>
-        <%= link_to workspace_path(folder: my_folder_id),
+      <% if folder_id && folder_id != local_assigns[:suppress_folder_id] %>
+        <%= link_to workspace_path(folder: folder_id),
               class: "plan-row__folder", draggable: false, data: { turbo_frame: "_top" } do %>
           <svg width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z"/></svg>
-          <%= folder_paths_by_id[my_folder_id] %>
+          <%= folder_paths_by_id[folder_id] %>
         <% end %>
       <% end %>
       <% if unread > 0 %>
diff --git a/engine/app/views/coplan/plans/_sidebar.html.erb b/engine/app/views/coplan/plans/_sidebar.html.erb
index 7b057dae..056790f7 100644
--- a/engine/app/views/coplan/plans/_sidebar.html.erb
+++ b/engine/app/views/coplan/plans/_sidebar.html.erb
@@ -32,12 +32,9 @@
     <% end %>
 
     <div class="sidebar__section">
-      <%# The folder tree IS your library; its public face lives on your
-          profile, so there's no separate page to link to. %>
       <h3 class="sidebar__heading">Folders</h3>
-      <%# "My Plans" is the root of your library; every folder is its child,
-          the way a drive hangs everything off one root. (One day a "+" up
-          on the heading will add more libraries next to it.) %>
+      <%# The root of the library being browsed; every folder is its child,
+          the way a drive hangs everything off one root. %>
       <ul class="folder-tree folder-tree--rooted">
         <li class="folder-tree__node folder-tree__node--root">
           <%= link_to workspace_path(folder: nil),
@@ -46,7 +43,7 @@
                   folder_id: "",
                   action: "dragover->coplan--folder-dnd#dragOver dragleave->coplan--folder-dnd#dragLeave drop->coplan--folder-dnd#drop",
                 } do %>
-            <span class="folder-tree__name">My Plans</span>
+            <span class="folder-tree__name"><%= workspace_root_label %></span>
           <% end %>
           <% if @root_folders.any? %>
             <ul class="folder-tree folder-tree--nested">
@@ -58,7 +55,7 @@
         </li>
       </ul>
 
-      <% if @folders.empty? %>
+      <% if @folders.empty? && @can_write %>
         <p class="sidebar__hint text-muted text-sm">
           Folders keep related plans together — like a team folder with project subfolders. Create one with “New folder” above your plans.
         </p>
@@ -105,21 +102,25 @@
     <% end %>
 
     <div class="sidebar__section">
-      <%# No org-wide browsing here — the workspace is *your* stuff. Everyone
-          else's work is discovered via Home, search, and people's profiles
-          (?scope=all still works as a link target, e.g. from Home's tags). %>
+      <%# Every library you can see has its own address now (/<handle>), so
+          this section is only about what's tucked away inside *this* one.
+          (?scope=all still works as a link target, e.g. from Home's tags.) %>
       <h3 class="sidebar__heading">Hidden</h3>
       <ul class="sidebar__list">
-        <li>
-          <%# These read as reveals, not filters: private and archived plans
-              are excluded by default, and clicking opts IN to seeing them
-              ("show me my private plans"), click again to tuck them away. %>
-          <%# "Private" is visibility, not workflow: not shared with the org,
-              still readable by link. Stored as visibility=draft. %>
-          <%= link_to @filter == "draft" ? "Showing private" : "Show my private plans",
-                workspace_path(filter: @filter == "draft" ? nil : "private"),
-                class: "sidebar__item #{'sidebar__item--active' if @filter == 'draft'}" %>
-        </li>
+        <% if @can_write %>
+          <li>
+            <%# These read as reveals, not filters: private and archived plans
+                are excluded by default, and clicking opts IN to seeing them
+                ("show me my private plans"), click again to tuck them away. %>
+            <%# "Private" is visibility, not workflow: not shared with the org,
+                still readable by link. Stored as visibility=draft. %>
+            <%# Only offered in your own library: a private plan is unlisted to
+                everyone else, so the filter would always come back empty. %>
+            <%= link_to @filter == "draft" ? "Showing private" : "Show my private plans",
+                  workspace_path(filter: @filter == "draft" ? nil : "private"),
+                  class: "sidebar__item #{'sidebar__item--active' if @filter == 'draft'}" %>
+          </li>
+        <% end %>
         <li>
           <%# Archived plans are hidden everywhere else — this is the explicit
               opt-in view. %>
diff --git a/engine/app/views/coplan/plans/_toolbar.html.erb b/engine/app/views/coplan/plans/_toolbar.html.erb
index f606a4b9..c22bb512 100644
--- a/engine/app/views/coplan/plans/_toolbar.html.erb
+++ b/engine/app/views/coplan/plans/_toolbar.html.erb
@@ -8,25 +8,13 @@
       - can edit  → Edit (the primary action) + ⋯ menu (History, Move to
         folder…, visibility, Archive). Organizing your own library is a
         rare act, so it lives a level down — like Docs' move control.
-      - reading   → Save/Saved (file it in your library to find it again)
-        + ⋯ menu (History). %>
-<% my_placement = local_assigns[:my_placement] %>
-<% my_placement ||= plan.placements.includes(:library, :folder).detect { |p| p.library.writable_by?(current_user) } if current_user %>
+      - reading   → ⋯ menu (History). There used to be a Save button here
+        that filed someone else's plan onto your own shelf. A plan lives
+        in one place now, so reading one is just reading it; the way back
+        to it is the library you found it in. %>
+<% placement = local_assigns.fetch(:placement) { plan.placement } %>
 <% can_edit = allowed_to?(plan, :edit_content?) %>
 <div id="plan-toolbar" class="plan-actions" role="toolbar" aria-label="Plan actions">
-  <% if current_user && !can_edit %>
-    <button type="button"
-            class="btn btn--ghost btn--sm plan-save<%= " plan-save--saved" if my_placement %>"
-            data-action="coplan--folder-picker#open"
-            data-move-url="<%= move_to_folder_plan_path(plan) %>"
-            data-current-folder-id="<%= my_placement&.folder_id %>"
-            data-saved="<%= my_placement.present? %>"
-            data-plan-title="<%= plan.title %>"
-            title="<%= my_placement ? "Saved in #{my_placement.folder.path} — click to move or remove" : "Save to your library to find it again" %>">
-      <svg width="15" height="15" viewBox="0 0 24 24" fill="<%= my_placement ? "currentColor" : "none" %>" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m19 21-7-4-7 4V5a2 2 0 0 1 2-2h10a2 2 0 0 1 2 2v16z"/></svg>
-      <span><%= my_placement ? "Saved" : "Save" %></span>
-    </button>
-  <% end %>
   <% if can_edit %>
     <%= link_to edit_content_plan_path(plan), class: "btn btn--ghost btn--sm",
           title: "Edit this plan — content, title, and tags" do %>
@@ -50,8 +38,8 @@
         <button type="button" class="menu__item" role="menuitem"
                 data-action="coplan--menu#close coplan--folder-picker#open"
                 data-move-url="<%= move_to_folder_plan_path(plan) %>"
-                data-current-folder-id="<%= my_placement&.folder_id %>"
-                data-saved="<%= my_placement.present? %>"
+                data-current-folder-id="<%= placement&.folder_id %>"
+                data-saved="<%= placement.present? %>"
                 data-plan-title="<%= plan.title %>"
                 data-picker-heading="Move to folder"
                 data-remove-label="Remove from folder">
diff --git a/engine/app/views/coplan/plans/edit_content.html.erb b/engine/app/views/coplan/plans/edit_content.html.erb
index 0d1eb21d..5ad4df41 100644
--- a/engine/app/views/coplan/plans/edit_content.html.erb
+++ b/engine/app/views/coplan/plans/edit_content.html.erb
@@ -34,7 +34,7 @@
         so their change isn't lost by accident.
       </p>
       <p>
-        <%= link_to "Review the latest version", plan_path(@plan), target: "_blank", rel: "noopener" %>,
+        <%= link_to "Review the latest version", plan_browse_path(@plan), target: "_blank", rel: "noopener" %>,
         fold anything you want to keep into your draft below, then:
       </p>
       <%= button_tag "Save anyway — replace v#{@conflict_revision} with my draft",
@@ -92,7 +92,7 @@
 
   <div class="plan-form__actions">
     <%= submit_tag "Save new version", class: "btn btn--primary" %>
-    <%= link_to "Cancel", plan_path(@plan), class: "btn btn--secondary" %>
+    <%= link_to "Cancel", plan_browse_path(@plan), class: "btn btn--secondary" %>
     <span class="text-sm text-muted editor__hint"><kbd>⌘</kbd>+<kbd>Enter</kbd> to save</span>
   </div>
 <% end %>
diff --git a/engine/app/views/coplan/plans/history.html.erb b/engine/app/views/coplan/plans/history.html.erb
index 8e63d16e..89663b06 100644
--- a/engine/app/views/coplan/plans/history.html.erb
+++ b/engine/app/views/coplan/plans/history.html.erb
@@ -6,14 +6,14 @@
 <%# The plan's time machine: a full page, not a tab. Backspace (or the back
     link) returns to the document. %>
 <div data-controller="coplan--plan-keys"
-     data-coplan--plan-keys-fallback-url-value="<%= plan_path(@plan) %>">
+     data-coplan--plan-keys-fallback-url-value="<%= plan_browse_path(@plan) %>">
   <div class="page-header page-header--plan">
-    <%= link_to plan_path(@plan), class: "history-back", title: "Back to the document (Backspace)", aria: { label: "Back to #{@plan.title}" } do %>
+    <%= link_to plan_browse_path(@plan), class: "history-back", title: "Back to the document (Backspace)", aria: { label: "Back to #{@plan.title}" } do %>
       <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m12 19-7-7 7-7"/><path d="M19 12H5"/></svg>
     <% end %>
     <%= plan_type_icon(@plan, size: :lg) %>
     <div class="page-header__text">
-      <h1 class="page-header__title"><%= link_to @plan.title, plan_path(@plan), class: "history-title-link" %></h1>
+      <h1 class="page-header__title"><%= link_to @plan.title, plan_browse_path(@plan), class: "history-title-link" %></h1>
       <div class="page-header__byline text-sm text-muted">
         History — every version and change · <span class="section-count" id="history-count"><%= pluralize(@plan.plan_versions.count + @plan.plan_events.count, "entry") %></span>
       </div>
diff --git a/engine/app/views/coplan/plans/index.html.erb b/engine/app/views/coplan/plans/index.html.erb
index e2056402..d4b5b053 100644
--- a/engine/app/views/coplan/plans/index.html.erb
+++ b/engine/app/views/coplan/plans/index.html.erb
@@ -1,13 +1,32 @@
 <%# Turbo must not serve a cached snapshot of the workspace on back/forward:
     the "since you last looked" strip and unread badges depend on what you
-    just read, so a restoration visit re-fetches. %>
+    just read, so a restoration visit re-fetches.
+
+    Morph, not replace, for the refreshes broadcast below: a page you're
+    reading shouldn't blink, lose your scroll position, or close the popover
+    you just opened because someone else filed a document. %>
 <% content_for(:head) do %>
   <meta name="turbo-cache-control" content="no-cache">
+  <meta name="turbo-refresh-method" content="morph">
+  <meta name="turbo-refresh-scroll" content="preserve">
 <% end %>
 
+<%# Live library. Anything that changes what this page shows — a document
+    arriving, moving, being retitled or hidden, a folder created or renamed
+    — tells the library, and this re-fetches. Per library rather than per
+    folder: a rename high in the tree changes every listing beneath it, so
+    a folder-grained stream would have to fan out to all of them.
+
+    Subscribed for readers too, not just the owner: a filter you're looking
+    at is as stale as one you could edit. %>
+<%= turbo_stream_from @library %>
+
 <%# No folder picker here: rows file via drag & drop, and the plan page's
-    toolbar (Save / Move to folder…) covers the click path. %>
-<div class="workspace" data-controller="coplan--folder-dnd coplan--workspace-keys">
+    toolbar (Save / Move to folder…) covers the click path.
+
+    Drag-and-drop is only wired up where you can write — j/k navigation
+    works in anyone's library. %>
+<div class="workspace" data-controller="<%= "coplan--folder-dnd " if @can_write %>coplan--workspace-keys">
   <%= render "coplan/plans/sidebar" %>
 
   <%# The whole pane is a drop target for the folder you're looking at —
@@ -17,7 +36,9 @@
   <div class="workspace__main"
        data-folder-id="<%= @folder&.id %>"
        data-action="dragover->coplan--folder-dnd#dragOver dragleave->coplan--folder-dnd#dragLeave drop->coplan--folder-dnd#drop">
-    <%# Drive-style breadcrumb: where you are in your library. Segments are
+    <%= render "coplan/plans/library_header" %>
+
+    <%# Drive-style breadcrumb: where you are in this library. Segments are
         drop targets — drag a plan or folder onto one to move it up. %>
     <nav class="workspace-crumbs" aria-label="Folder location">
       <%= link_to workspace_path(folder: nil),
@@ -27,7 +48,7 @@
               action: "dragover->coplan--folder-dnd#dragOver dragleave->coplan--folder-dnd#dragLeave drop->coplan--folder-dnd#drop",
             } do %>
         <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M15 21v-8a1 1 0 0 0-1-1h-4a1 1 0 0 0-1 1v8"/><path d="M3 10a2 2 0 0 1 .709-1.528l7-5.999a2 2 0 0 1 2.582 0l7 5.999A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/></svg>
-        My Plans
+        <%= workspace_root_label %>
       <% end %>
       <% @breadcrumbs.each_with_index do |crumb, i| %>
         <svg class="workspace-crumbs__sep" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m9 18 6-6-6-6"/></svg>
@@ -41,31 +62,35 @@
               } %>
       <% end %>
       <span class="workspace-crumbs__spacer"></span>
-      <button type="button" class="btn btn--secondary btn--sm" popovertarget="new-folder-modal">
-        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 10v6"/><path d="M9 13h6"/><path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z"/></svg>
-        New folder
-      </button>
+      <% if @can_write %>
+        <button type="button" class="btn btn--secondary btn--sm" popovertarget="new-folder-modal">
+          <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 10v6"/><path d="M9 13h6"/><path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z"/></svg>
+          New folder
+        </button>
+      <% end %>
     </nav>
 
-    <%# Creates inside the folder you're looking at (changeable). %>
-    <%= render layout: "coplan/shared/add_modal", locals: { id: "new-folder-modal", title: "New folder" } do %>
-      <%# model: a fresh record — a bare scope: :folder would silently bind
-          the @folder being viewed and prefill its name. %>
-      <%= form_with model: CoPlan::Folder.new, url: folders_path, scope: :folder, method: :post, class: "add-modal__form" do |f| %>
-        <div class="form-group">
-          <%= f.label :name, "Name", for: "new_folder_name" %>
-          <%= f.text_field :name, id: "new_folder_name", required: true, maxlength: 100, autofocus: true,
-                placeholder: "e.g. Payments" %>
-        </div>
-        <div class="form-group">
-          <%= f.label :parent_id, "Inside", for: "new_folder_parent" %>
-          <%= f.select :parent_id,
-                options_for_select([["My Plans (top level)", ""]] + folder_select_options.map { |path, id, _| [path, id] }, @folder&.id),
-                {}, id: "new_folder_parent" %>
-        </div>
-        <div class="add-modal__actions">
-          <%= f.submit "Create folder", class: "btn btn--primary btn--sm" %>
-        </div>
+    <% if @can_write %>
+      <%# Creates inside the folder you're looking at (changeable). %>
+      <%= render layout: "coplan/shared/add_modal", locals: { id: "new-folder-modal", title: "New folder" } do %>
+        <%# model: a fresh record — a bare scope: :folder would silently bind
+            the @folder being viewed and prefill its name. %>
+        <%= form_with model: CoPlan::Folder.new, url: folders_path, scope: :folder, method: :post, class: "add-modal__form" do |f| %>
+          <div class="form-group">
+            <%= f.label :name, "Name", for: "new_folder_name" %>
+            <%= f.text_field :name, id: "new_folder_name", required: true, maxlength: 100, autofocus: true,
+                  placeholder: "e.g. Payments" %>
+          </div>
+          <div class="form-group">
+            <%= f.label :parent_id, "Inside", for: "new_folder_parent" %>
+            <%= f.select :parent_id,
+                  options_for_select([[ "#{workspace_root_label} (top level)", "" ]] + folder_select_options.map { |path, id, _| [ path, id ] }, @folder&.id),
+                  {}, id: "new_folder_parent" %>
+          </div>
+          <div class="add-modal__actions">
+            <%= f.submit "Create folder", class: "btn btn--primary btn--sm" %>
+          </div>
+        <% end %>
       <% end %>
     <% end %>
 
@@ -116,7 +141,7 @@
             <% @recent_updates.each do |entry| %>
               <% plan = entry[:plan] %>
               <li class="recent-updates__item">
-                <%= link_to plan.title, plan_path(plan), class: "recent-updates__link" %>
+                <%= link_to plan.title, plan_browse_path(plan), class: "recent-updates__link" %>
                 <span class="recent-updates__badge recent-updates__badge--<%= entry[:badge].parameterize %>"><%= entry[:badge] %></span>
                 <span class="recent-updates__meta text-muted">
                   <%= plan.created_by_user.name %> · <%= time_ago_in_words(plan.updated_at) %> ago
@@ -146,11 +171,13 @@
         <div class="empty-state card">
           <% if @folder %>
             <p>Nothing in <strong><%= @folder.name %></strong> yet.</p>
-            <p class="text-muted text-sm">Drag a plan here from another folder, or file one from its plan page.</p>
-          <% elsif @scope == "mine" %>
+            <% if @can_write %>
+              <p class="text-muted text-sm">Drag a plan here from another folder, or file one from its plan page.</p>
+            <% end %>
+          <% elsif @can_write %>
             <p>You haven't created any plans yet. Plans are created via the API.</p>
           <% else %>
-            <p>No plans yet. Plans are created via the API.</p>
+            <p>Nothing here yet.</p>
           <% end %>
         </div>
       <% end %>
diff --git a/engine/app/views/coplan/plans/show.html.erb b/engine/app/views/coplan/plans/show.html.erb
index ee3bffdd..b0f05517 100644
--- a/engine/app/views/coplan/plans/show.html.erb
+++ b/engine/app/views/coplan/plans/show.html.erb
@@ -1,5 +1,11 @@
 <% content_for(:title, "#{@plan.title} — CoPlan") %>
 <% content_for(:head) do %>
+  <%# One address per document. Anything that reaches this page by the
+      legacy /plans/<uuid> form (a link that predates slugs, an unslugged
+      plan) still says here which URL is the real one. %>
+  <% if (canonical = plan_browse_url(@plan)) %>
+    <link rel="canonical" href="<%= canonical %>">
+  <% end %>
   <meta property="og:title" content="<%= @plan.title %>">
   <meta property="og:description" content="<%= plan_og_description(@plan) %>">
   <meta property="og:type" content="article">
@@ -9,24 +15,23 @@
   <meta name="twitter:description" content="<%= plan_og_description(@plan) %>">
 <% end %>
 
-<% my_placement = current_user && @shelf_placements.find { |p| p.library.writable_by?(current_user) } %>
 <% reference_count = plan_reference_count(@plan, @references) %>
 
 <%# Fills the sticky nav's title slot (see layouts/coplan/application). The
     containing-folder control, icon, and title mirror the masthead;
     coplan--nav-title fades them in once #plan-header scrolls behind the bar. %>
 <% content_for :nav_title do %>
-  <%= render "coplan/plans/nav_context", plan: @plan, author_placement: @author_placement %>
+  <%= render "coplan/plans/nav_context", plan: @plan, placement: @placement %>
 <% end %>
 
 <%= turbo_stream_from @plan %>
 
 <%# plan-keys: Backspace goes back to wherever you came from; [ / ] jump
     between the document and its footnote sections. Cold opens (direct link,
-    new tab) have no history — fall back to where the plan lives in the
-    viewer's library, not the workspace root. %>
+    new tab) have no history — fall back to the folder the plan actually
+    lives in, not the workspace root. %>
 <div data-controller="coplan--plan-keys coplan--folder-picker"
-     data-coplan--plan-keys-fallback-url-value="<%= my_placement&.folder_id ? plans_path(folder: my_placement.folder_id) : plans_path %>">
+     data-coplan--plan-keys-fallback-url-value="<%= @placement ? folder_browse_path(@placement.folder) : library_browse_path(@plan.library) %>">
 
 <%# The masthead: the plan's identity (broadcast-replaced #plan-header)
     on the left, and the viewer-relative side column (presence + toolbar)
@@ -34,10 +39,10 @@
     broadcasts own the left, this request (and the visibility/archive
     stream responses) own the right, so neither can clobber the other. %>
 <div class="plan-masthead" data-controller="coplan--presence" data-coplan--presence-plan-id-value="<%= @plan.id %>" data-plan-section="top">
-  <%= render partial: "coplan/plans/header", locals: { plan: @plan, author_placement: @author_placement } %>
+  <%= render partial: "coplan/plans/header", locals: { plan: @plan, placement: @placement } %>
   <div class="plan-masthead__side">
     <%= render partial: "coplan/plans/viewers", locals: { viewers: CoPlan::PlanViewer.active_viewers_for(@plan), current_user: current_user } %>
-    <%= render partial: "coplan/plans/toolbar", locals: { plan: @plan, my_placement: my_placement } %>
+    <%= render partial: "coplan/plans/toolbar", locals: { plan: @plan, placement: @placement } %>
   </div>
 </div>
 
diff --git a/engine/app/views/coplan/profiles/show.html.erb b/engine/app/views/coplan/profiles/show.html.erb
deleted file mode 100644
index b1711312..00000000
--- a/engine/app/views/coplan/profiles/show.html.erb
+++ /dev/null
@@ -1,67 +0,0 @@
-<% content_for(:title, "#{@profile.name} — CoPlan") %>
-<% mine = @user == current_user %>
-
-<div class="profile">
-  <header class="profile__header">
-    <div class="profile__identity">
-      <% if @profile.avatar_url.present? %>
-        <img src="<%= @profile.avatar_url %>" alt="<%= @profile.name %>" class="avatar avatar--xl" loading="lazy">
-      <% else %>
-        <span class="avatar avatar--xl avatar--initials"><%= @profile.name.split.map { |w| w[0] }.first(2).join.upcase %></span>
-      <% end %>
-      <div>
-        <h1 class="profile__name"><%= @profile.name %></h1>
-        <p class="profile__meta text-muted">
-          <%= [@profile.title, @profile.team].compact_blank.join(" · ") %>
-          <% if @user.username.present? %>
-            <span class="profile__username">@<%= @user.username %></span>
-          <% end %>
-        </p>
-        <p class="profile__stats text-muted text-sm">
-          <%= pluralize(@plans.size, "published plan") %>
-          <% if @shelved_count.positive? %> · <%= pluralize(@shelved_count, "plan") %> on their shelves<% end %>
-          <% if @profile.profile_url.present? %>
-            · <%= link_to "View in directory ↗", @profile.profile_url, target: "_blank", rel: "noopener", class: "profile__directory-link" %>
-          <% end %>
-        </p>
-      </div>
-    </div>
-    <% if mine %>
-      <%= link_to "Your workspace", plans_path, class: "btn btn--secondary btn--sm" %>
-    <% end %>
-  </header>
-
-  <div class="profile__columns">
-    <section class="profile__plans">
-      <h2 class="profile__section-title">Published plans</h2>
-      <% if @plans.empty? %>
-        <p class="text-muted">Nothing published yet.</p>
-      <% else %>
-        <ul class="profile__plan-list">
-          <% @plans.each do |plan| %>
-            <li class="profile__plan">
-              <%= plan_type_icon(plan, size: :sm) %>
-              <%= link_to plan.title, plan_path(plan), class: "profile__plan-title" %>
-              <span class="profile__plan-meta text-muted">
-                updated <%= time_ago_in_words(plan.updated_at) %> ago
-              </span>
-            </li>
-          <% end %>
-        </ul>
-      <% end %>
-    </section>
-
-    <section class="profile__library">
-      <h2 class="profile__section-title">Library</h2>
-      <% if @root_folders.empty? %>
-        <p class="text-muted"><%= mine ? "You haven’t" : "#{@profile.name} hasn’t" %> organized any shelves yet.</p>
-      <% else %>
-        <div class="library__shelves">
-          <% @root_folders.sort_by { |f| f.name.downcase }.each do |folder| %>
-            <%= render "coplan/libraries/shelf", folder: folder, depth: 1 %>
-          <% end %>
-        </div>
-      <% end %>
-    </section>
-  </div>
-</div>
diff --git a/engine/app/views/coplan/search/_results.html.erb b/engine/app/views/coplan/search/_results.html.erb
index 9af2866e..9a57d898 100644
--- a/engine/app/views/coplan/search/_results.html.erb
+++ b/engine/app/views/coplan/search/_results.html.erb
@@ -44,7 +44,7 @@
       <ul class="search-modal__list" role="listbox">
         <% people.each do |person| %>
           <li>
-            <a href="<%= coplan.profile_path(person.username.presence || person.id) %>"
+            <a href="<%= profile_path_for(person) %>"
                class="search-modal__result search-modal__result--person"
                data-search-result
                role="option"
@@ -65,7 +65,7 @@
     <ul class="search-modal__list" role="listbox">
       <% results.each do |plan| %>
         <li>
-          <a href="<%= coplan.plan_path(plan) %>"
+          <a href="<%= plan_browse_path(plan) %>"
              class="search-modal__result search-modal__result--plan"
              data-search-result
              role="option"
diff --git a/engine/app/views/layouts/coplan/application.html.erb b/engine/app/views/layouts/coplan/application.html.erb
index 490b7598..45b0d4c7 100644
--- a/engine/app/views/layouts/coplan/application.html.erb
+++ b/engine/app/views/layouts/coplan/application.html.erb
@@ -26,10 +26,10 @@
   <body>
     <nav class="site-nav">
       <div class="site-nav__inner">
-        <%# The logo is the Workspace home — that's where signed-in work
+        <%# The logo goes to your library — that's where signed-in work
             lives, so there's no separate "Workspace" link. Signed-out
             visitors land on the public root instead. %>
-        <%= link_to(signed_in? ? coplan.plans_path : coplan.root_path, class: "site-nav__brand") do %>
+        <%= link_to(signed_in? ? profile_path_for(current_user) : coplan.root_path, class: "site-nav__brand") do %>
           <%= image_tag "coplan/coplan-logo-sm.png", alt: "CoPlan",
                 class: "site-nav__logo#{coplan_environment_logo_modifier}",
                 title: coplan_environment_logo_title %>
@@ -98,9 +98,10 @@
                       live by the dot on the ☰ button instead. %>
                 <% end %>
                 <div class="menu__separator" role="separator"></div>
-                <%= link_to coplan.profile_path(current_user.username.presence || current_user.id), class: "menu__item", role: "menuitem" do %>
+                <%# Your page and your library are the same place. %>
+                <%= link_to profile_path_for(current_user), class: "menu__item", role: "menuitem" do %>
                   <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>
-                  <span>Profile</span>
+                  <span>Your library</span>
                 <% end %>
                 <%= link_to coplan.settings_root_path, class: "menu__item", role: "menuitem" do %>
                   <svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83-2.83l.06-.06A1.65 1.65 0 0 0 4.68 15a1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 2.83-2.83l.06.06A1.65 1.65 0 0 0 9 4.68a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 2.83l-.06.06A1.65 1.65 0 0 0 19.4 9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z"/></svg>
diff --git a/engine/config/routes.rb b/engine/config/routes.rb
index 35cb7710..f2e2873b 100644
--- a/engine/config/routes.rb
+++ b/engine/config/routes.rb
@@ -1,56 +1,130 @@
 CoPlan::Engine.routes.draw do
-  resources :plans, only: [ :index, :show, :edit, :update ] do
-    patch :publish, on: :member
-    patch :hide, on: :member
-    patch :archive, on: :member
-    patch :unarchive, on: :member
-    patch :toggle_checkbox, on: :member
-    patch :move_to_folder, on: :member
-    get :history, on: :member
-    get :edit_content, on: :member
-    patch :update_content, on: :member
-    post :preview, on: :member
-    resources :versions, controller: "plan_versions", only: [ :show ] do
-      get :diff, on: :member
+  # --- The shape of this file ----------------------------------------
+  #
+  # People are the root namespace. A handle is a top-level segment, so a
+  # document's address reads like the person whose library it's in:
+  #
+  #   /sam                               Sam, and Sam's library
+  #   /sam/liveorder                     a folder
+  #   /sam/liveorder/cart-state-machine  a document
+  #
+  # Every prefix is a real page, so trimming a segment walks up the tree.
+  #
+  # Everything that isn't a place lives under `_`: settings, search, the
+  # id-based mutation endpoints, and whatever gets added next. That single
+  # character is the whole reservation — a handle can never *be* `_`,
+  # because slug rules strip non-alphanumerics (CoPlan::Slug), so the split
+  # is structural rather than a list someone has to remember to update.
+  # `_` is reserved inside a library too (/sam/_/…), by the same mechanism,
+  # so library-scoped pages have somewhere to go that can't collide with a
+  # folder name.
+  #
+  # The legacy block near the bottom is the one fixed list, frozen at the
+  # paths that shipped before this. It can shrink; it never has to grow.
+  #
+  # Order matters: the `:handle` routes at the very bottom are a catchall,
+  # so everything else has to be declared above them.
+
+  # Handles are ASCII slugs, so they never contain a dot. That's what keeps
+  # file-like root paths (llms.txt, the service worker) out of the catchall
+  # without needing to enumerate them.
+  handle = /[a-z0-9][a-z0-9-]*/
+
+  # A 301 that survives being mounted somewhere other than "/".
+  legacy = ->(to) { redirect(status: 301) { |_params, req| "#{req.script_name}#{to}" } }
+
+  # --- App machinery -------------------------------------------------
+  #
+  # Path-only scope: helper names stay unprefixed, so `settings_path`,
+  # `publish_plan_path` and the rest read the same at every call site.
+  scope "_" do
+    # Cross-library view: everything you can see, wherever it lives. The
+    # per-library view is /:handle — this is the one that spans them, which
+    # is why it isn't a place and lives here.
+    #
+    # The member routes are id-based mutations. A document's *address* is
+    # its readable path; these are the machinery behind the buttons on it.
+    resources :plans, only: [ :index, :show, :edit, :update ] do
+      patch :publish, on: :member
+      patch :hide, on: :member
+      patch :archive, on: :member
+      patch :unarchive, on: :member
+      patch :toggle_checkbox, on: :member
+      patch :move_to_folder, on: :member
+      get :history, on: :member
+      get :edit_content, on: :member
+      patch :update_content, on: :member
+      post :preview, on: :member
+      resources :versions, controller: "plan_versions", only: [ :show ] do
+        get :diff, on: :member
+      end
+      resources :references, controller: "references", only: [ :create, :destroy ]
+      resources :attachments, controller: "attachments", only: [ :create, :destroy ]
+      # Cleans up a spoken remark and works out which passage it was about;
+      # see DictationsController.
+      resources :dictations, only: [ :create ]
+      resources :comment_threads, only: [ :create ] do
+        member do
+          patch :resolve
+          patch :accept
+          patch :discard
+          patch :reopen
+        end
+        resources :comments, only: [ :create, :destroy ]
+      end
     end
-    resources :references, controller: "references", only: [ :create, :destroy ]
-    resources :attachments, controller: "attachments", only: [ :create, :destroy ]
-    # Cleans up a spoken remark and works out which passage it was about;
-    # see DictationsController.
-    resources :dictations, only: [ :create ]
-    resources :comment_threads, only: [ :create ] do
+
+    namespace :settings do
+      root "settings#index"
+      resources :tokens, only: [ :index, :create, :destroy ]
+      patch "theme", to: "settings#update_theme"
+      patch "voice_hotkey", to: "settings#update_voice_hotkey"
+    end
+
+    # Web folder creation (sidebar "New folder" input) and reparenting (drag
+    # a folder onto a folder). Rename/delete go through the API or admin for
+    # now.
+    resources :folders, only: [ :create, :update ]
+
+    # Every library you can see. Id-based library links land here too, and
+    # 301 onward to the handle form.
+    get "libraries", to: "libraries#index", as: :browse_root
+    resources :libraries, only: [ :show ]
+    get "library", to: "libraries#mine", as: :my_library
+
+    resources :users, only: [] do
+      get :search, on: :collection
+    end
+
+    resources :notifications, only: [ :index, :show ] do
       member do
-        patch :resolve
-        patch :accept
-        patch :discard
-        patch :reopen
+        patch :mark_read
+      end
+      collection do
+        post :mark_all_read
+        post :mark_plan_read
       end
-      resources :comments, only: [ :create, :destroy ]
     end
-  end
-
-  namespace :settings do
-    root "settings#index"
-    resources :tokens, only: [ :index, :create, :destroy ]
-    patch "theme", to: "settings#update_theme"
-    patch "voice_hotkey", to: "settings#update_voice_hotkey"
-  end
 
-  # Web folder creation (sidebar "New folder" input) and reparenting (drag
-  # a folder onto a folder). Rename/delete go through the API or admin for
-  # now.
-  resources :folders, only: [ :create, :update ]
+    # Web Push subscription management. Endpoint URLs come from the browser's
+    # PushManager and uniquely identify a (browser, device, app) tuple per user.
+    scope :web_push, module: "web_push", as: :web_push do
+      resource :subscription, only: [ :create, :destroy ], controller: "subscriptions"
+      # Turbo-frame target for the per-device list on the Settings page.
+      # Reloaded by the settings Stimulus controller after enable/disable so
+      # the list reflects the new browser without a full page refresh.
+      get "devices", to: "subscriptions#devices", as: :devices
+    end
 
-  # Read-only library browsing (folder-jump discovery). "library" without
-  # an id is the signed-in user's own — handy for nav links.
-  resources :libraries, only: [ :show ]
-  get "library", to: "libraries#mine", as: :my_library
+    get "home", to: "home#show", as: :home
+    get "welcome", to: "welcome#show", as: :welcome
+    get "search", to: "search#index", as: :search
+  end
 
-  # Profile pages — the front door to a person's library. :id is a
-  # username or user id; usernames may contain dots, so the constraint
-  # keeps Rails from peeling ".l" off "hampton.l" as a format.
-  get "people/:id", to: "profiles#show", as: :profile, constraints: { id: %r{[^/]+} }
+  # --- Root-level by necessity ---------------------------------------
 
+  # The agent API is an external contract with published paths; moving it
+  # under `_` would break every caller for no gain.
   namespace :api do
     namespace :v1 do
       resources :tags, only: [ :index ]
@@ -109,46 +183,68 @@
     end
   end
 
-  resources :users, only: [] do
-    get :search, on: :collection
-  end
-
-  resources :notifications, only: [ :index, :show ] do
-    member do
-      patch :mark_read
-    end
-    collection do
-      post :mark_all_read
-      post :mark_plan_read
-    end
-  end
-
-  get "llms.txt", to: "llms#show", as: :llms_txt
+  # The published entry point for agents — it's in every API response, in
+  # llms.txt, and in whatever config people have already pasted it into.
+  # Same argument as the API above: an external contract stays where it was.
   get "agent-instructions", to: "agent_instructions#show", as: :agent_instructions
   # Sub-instructions: the library-organizing guide, fetched on demand so the
   # main instructions stay small (agents only spend context when organizing).
   get "agent-instructions/organizing", to: "agent_instructions#organizing", as: :agent_instructions_organizing
 
-  # Service worker — served from a route (not the asset pipeline) so it has a
-  # stable URL the browser can update in place. Scope is whatever the engine
-  # is mounted at in the host app.
+  # Convention puts this at the root, like robots.txt.
+  get "llms.txt", to: "llms#show", as: :llms_txt
+
+  # Service worker — served from a route (not the asset pipeline) so it has
+  # a stable URL the browser can update in place. This one *has* to stay at
+  # the root: a worker's scope is the directory it's served from, and push
+  # notifications need to focus and navigate any tab, not just /_/*.
   get "coplan_service_worker.js", to: "service_workers#show", as: :service_worker
 
-  # Web Push subscription management. Endpoint URLs come from the browser's
-  # PushManager and uniquely identify a (browser, device, app) tuple per user.
-  scope :web_push, module: "web_push", as: :web_push do
-    resource :subscription, only: [ :create, :destroy ], controller: "subscriptions"
-    # Turbo-frame target for the per-device list on the Settings page.
-    # Reloaded by the settings Stimulus controller after enable/disable so
-    # the list reflects the new browser without a full page refresh.
-    get "devices", to: "subscriptions#devices", as: :devices
+  # --- Legacy paths --------------------------------------------------
+  #
+  # The addresses that shipped before people became the root namespace.
+  # This is the whole reserved list, and it's frozen: anything new goes
+  # under `_`, which costs no handle. The price is that nobody can have
+  # the handle "settings" or "plans", which seems survivable.
+  # Most of these reuse the controllers they always pointed at, because
+  # those already 301 onward — a document at /plans/<uuid> converges on its
+  # readable address whether you arrived by the old path or the new one.
+  scope as: :legacy do
+    # Your workspace was /plans. It's your library now.
+    get "plans", to: "libraries#mine"
+    get "library", to: "libraries#mine"
+    # PlansController#show 301s onto the readable address (and renders in
+    # place for a document with no slug yet).
+    get "plans/:id", to: "plans#show", as: :plan
+    # A person's page and their library are the same page now. :id is a
+    # username or a user id; usernames may contain dots, so the constraint
+    # keeps Rails from peeling ".l" off "hampton.l" as a format.
+    get "people/:id", to: "profiles#show", as: :person, constraints: { id: %r{[^/]+} }
+    # LibrariesController#show 301s onward, ?folder=<id> and all.
+    get "libraries/:id", to: "libraries#show", as: :library_by_id
+    get "libraries", to: legacy.call("/_/libraries"), as: :libraries
+
+    get "settings", to: legacy.call("/_/settings"), as: :settings
+    get "settings/*rest", to: redirect(status: 301) { |p, r| "#{r.script_name}/_/settings/#{p[:rest]}" }, as: :settings_page
+    get "search", to: legacy.call("/_/search"), as: :search
+    get "notifications", to: legacy.call("/_/notifications"), as: :notifications
+    get "notifications/*rest", to: redirect(status: 301) { |p, r| "#{r.script_name}/_/notifications/#{p[:rest]}" }, as: :notification_page
+    get "home", to: legacy.call("/_/home"), as: :home
+    get "welcome", to: legacy.call("/_/welcome"), as: :welcome
   end
 
-  get "home", to: "home#show", as: :home
-
-  get "welcome", to: "welcome#show", as: :welcome
-
-  get "search", to: "search#index", as: :search
-
   root "welcome#show"
+
+  # --- People, and everything in their libraries ----------------------
+  #
+  # The catchall. `format: false` on the glob, or a document slug like
+  # "pricing-v1.2" would have its tail parsed as a format.
+  #
+  # `/:handle/_/…` needs no route of its own: a folder can never be named
+  # `_` (CoPlan::Slug strips it), so the segment resolves to nothing and
+  # 404s. That's the reservation — library-scoped pages can be declared
+  # above this line whenever we have one, and nothing a user creates can
+  # ever be sitting there already.
+  get ":handle", to: "browse#browse", as: :browse_library, constraints: { handle: handle }
+  get ":handle/*slug_path", to: "browse#browse", as: :browse, format: false, constraints: { handle: handle }
 end
diff --git a/engine/db/migrate/20260821000000_add_url_segments_to_libraries_and_folders.rb b/engine/db/migrate/20260821000000_add_url_segments_to_libraries_and_folders.rb
new file mode 100644
index 00000000..a3dd0a3a
--- /dev/null
+++ b/engine/db/migrate/20260821000000_add_url_segments_to_libraries_and_folders.rb
@@ -0,0 +1,160 @@
+class AddUrlSegmentsToLibrariesAndFolders < ActiveRecord::Migration[8.1]
+  # Gives libraries and folders the URL segments that make them browsable:
+  # /<handle>/<folder-slug>/<folder-slug>. Resolution walks these one
+  # segment at a time, so nothing stores a joined path and renaming a
+  # folder touches only its own row.
+  #
+  # Slug logic is inlined rather than calling CoPlan::Slug — a migration
+  # has to keep producing the same backfill years from now, even if the
+  # app's slug rules move on.
+  #
+  # Raw portable SQL throughout (select_all / quote), same reasoning as
+  # RequirePlanTypeOnCoplanPlans: this runs on MySQL and PostgreSQL hosts.
+  #
+  # Note on the unique indexes: MySQL treats NULLs as distinct, so the
+  # folder index does not actually constrain root folders (parent_id
+  # NULL). Real enforcement is the Rails validation, which scopes with
+  # IS NULL correctly — matching how `name` uniqueness already works on
+  # this table. The index is for lookup speed on the resolver's hot path.
+  def up
+    add_column :coplan_libraries, :handle, :string
+    add_column :coplan_folders, :slug, :string
+
+    backfill_library_handles
+    backfill_folder_slugs
+
+    change_column_null :coplan_libraries, :handle, false
+    change_column_null :coplan_folders, :slug, false
+    add_index :coplan_libraries, :handle, unique: true, name: "index_coplan_libraries_on_handle"
+    add_index :coplan_folders, [ :library_id, :parent_id, :slug ],
+      unique: true, name: "index_coplan_folders_on_library_and_parent_and_slug"
+  end
+
+  def down
+    remove_index :coplan_folders, name: "index_coplan_folders_on_library_and_parent_and_slug"
+    remove_index :coplan_libraries, name: "index_coplan_libraries_on_handle"
+    remove_column :coplan_folders, :slug
+    remove_column :coplan_libraries, :handle
+  end
+
+  private
+
+  # A personal library's handle comes from the owner's username (their
+  # ldap), falling back to the email local part and then the display
+  # name. Anything else — a team library — uses the library's own name.
+  #
+  # `taken` starts out holding the app's root-level addresses, so a person
+  # whose ldap is "settings" gets "settings-2" rather than a handle the app
+  # would refuse to save. Spelled out here for the same reason the slug
+  # rules are: a migration has to keep producing the same backfill.
+  def backfill_library_handles
+    rows = connection.select_all(<<~SQL)
+      SELECT l.id, l.name, l.owner_type, l.owner_id,
+             u.username AS owner_username, u.email AS owner_email, u.name AS owner_name
+      FROM coplan_libraries l
+      LEFT JOIN coplan_users u
+        ON l.owner_type = 'CoPlan::User' AND l.owner_id = u.id
+      ORDER BY l.created_at, l.id
+    SQL
+
+    taken = %w[
+      _ new edit all
+      plans people libraries library settings search notifications home welcome
+      api agent-instructions admin assets rails up sign_in sign_out integrations
+    ]
+    rows.each do |row|
+      source = row["owner_username"].presence ||
+        row["owner_email"].to_s.split("@").first.presence ||
+        row["owner_name"].presence ||
+        row["name"].presence ||
+        "library"
+      handle = unique_slug(ascii_slugify(source), taken, fallback: "library")
+      taken << handle
+      execute "UPDATE coplan_libraries SET handle = #{quote(handle)} WHERE id = #{quote(row['id'])}"
+    end
+
+    create_missing_user_libraries(taken)
+  end
+
+  # Libraries used to be materialized on first touch, so people who never
+  # loaded a page that needed one have no row. A library is a person's page
+  # now — /<handle> — so everyone needs theirs to exist, not just everyone
+  # who has filed something.
+  def create_missing_user_libraries(taken)
+    rows = connection.select_all(<<~SQL)
+      SELECT u.id, u.username, u.email, u.name
+      FROM coplan_users u
+      LEFT JOIN coplan_libraries l
+        ON l.owner_type = 'CoPlan::User' AND l.owner_id = u.id
+      WHERE l.id IS NULL
+      ORDER BY u.created_at, u.id
+    SQL
+
+    # Formatted rather than quoted: `quote` on a TimeWithZone writes a zone
+    # name into the literal, which strict MySQL refuses.
+    now = Time.current.utc.strftime("%Y-%m-%d %H:%M:%S")
+    rows.each do |row|
+      source = row["username"].presence ||
+        row["email"].to_s.split("@").first.presence ||
+        row["name"].presence ||
+        "library"
+      handle = unique_slug(ascii_slugify(source), taken, fallback: "library")
+      taken << handle
+      execute <<~SQL
+        INSERT INTO coplan_libraries (id, name, handle, owner_type, owner_id, created_at, updated_at)
+        VALUES (#{quote(SecureRandom.uuid_v7)}, 'Library', #{quote(handle)},
+                'CoPlan::User', #{quote(row['id'])}, #{quote(now)}, #{quote(now)})
+      SQL
+    end
+  end
+
+  # Folder slugs only have to be unique among siblings, so uniqueness is
+  # tracked per (library, parent). Deepest-last ordering isn't needed —
+  # a folder's slug depends on its own name alone.
+  def backfill_folder_slugs
+    rows = connection.select_all(<<~SQL)
+      SELECT id, library_id, parent_id, name
+      FROM coplan_folders
+      ORDER BY library_id, parent_id, created_at, id
+    SQL
+
+    taken = {}
+    rows.each do |row|
+      sibling_key = [ row["library_id"], row["parent_id"] ]
+      taken[sibling_key] ||= []
+      slug = unique_slug(slugify(row["name"]), taken[sibling_key], fallback: "folder")
+      taken[sibling_key] << slug
+      execute "UPDATE coplan_folders SET slug = #{quote(slug)} WHERE id = #{quote(row['id'])}"
+    end
+  end
+
+  # Mirrors CoPlan::Slug.call / .handle, inlined so this backfill keeps
+  # producing the same slugs if the app's rules move on. Folders keep
+  # Unicode letters — a folder named 設計 gets a segment that says so —
+  # while handles stay ASCII because they're typed and read aloud.
+  def slugify(text)
+    trim(text.to_s.unicode_normalize(:nfc).downcase.gsub(/[^[[:alnum:]]]+/, "-"))
+  end
+
+  def ascii_slugify(text)
+    trim(text.to_s.unicode_normalize(:nfkd).downcase.gsub(/[^a-z0-9]+/, "-"))
+  end
+
+  def trim(hyphenated)
+    hyphenated.gsub(/-{2,}/, "-").delete_prefix("-").delete_suffix("-")[0, 60].to_s
+      .delete_suffix("-")
+  end
+
+  # Existing data predates any slug rule, so collisions are expected —
+  # "Team EBT" and "team-ebt" both want the same segment. Numeric
+  # suffixes here are a backfill concession; new records get better
+  # disambiguation from the app.
+  def unique_slug(slug, taken, fallback:)
+    candidate = slug.presence || fallback
+    return candidate unless taken.include?(candidate)
+
+    suffix = 2
+    suffix += 1 while taken.include?("#{candidate}-#{suffix}")
+    "#{candidate}-#{suffix}"
+  end
+end
diff --git a/engine/db/migrate/20260821000001_add_plan_slugs_and_url_aliases.rb b/engine/db/migrate/20260821000001_add_plan_slugs_and_url_aliases.rb
new file mode 100644
index 00000000..b90d64fa
--- /dev/null
+++ b/engine/db/migrate/20260821000001_add_plan_slugs_and_url_aliases.rb
@@ -0,0 +1,51 @@
+class AddPlanSlugsAndUrlAliases < ActiveRecord::Migration[8.1]
+  # The leaf segment of a browsable URL, plus the table that keeps old
+  # URLs resolving.
+  #
+  # `slug` is derived from the plan's title with redundancy stripped — a
+  # plan titled "LiveOrder Cart Roadmap" filed in "LiveOrder" is just
+  # "cart-roadmap", because the folder already said the rest.
+  # `slug_suffix` is set only when two plans in the same folder want the
+  # same slug, so it appears in a URL only where it earns something.
+  #
+  # No unique index on (slug, slug_suffix): a plan's uniqueness scope is
+  # the folder it's filed in, which lives in coplan_plan_placements, not
+  # here. Uniqueness is enforced on write against the canonical folder
+  # (Plans::AssignSlug). A real DB constraint becomes possible once a plan
+  # is filed in exactly one library — see the placements collapse.
+  #
+  # Backfill leaves slugs NULL and lets the app fill them in lazily, so
+  # this migration stays fast on a large table and doesn't have to
+  # reimplement the redundancy-stripping rules.
+  def up
+    add_column :coplan_plans, :slug, :string
+    add_column :coplan_plans, :slug_suffix, :string, limit: 8
+    add_index :coplan_plans, [ :slug, :slug_suffix ], name: "index_coplan_plans_on_slug_and_suffix"
+
+    create_table :coplan_url_aliases, id: { type: :string, limit: 36 } do |t|
+      # The stale path, library handle first and no leading slash:
+      # "orders/liveorder/cart-roadmap".
+      t.string :path, null: false, limit: 512
+      # "exact" matches one URL; "prefix" rewrites everything beneath it,
+      # which is how one row covers a renamed folder's whole subtree.
+      t.string :kind, null: false, default: "exact"
+      t.string :target_path, null: false, limit: 512
+      # Cheap eviction signal: rows nobody has ever followed are safe to
+      # drop, because plan_events / library_events can rebuild them.
+      t.integer :resolve_count, null: false, default: 0
+      t.timestamp :last_resolved_at
+      t.timestamps
+    end
+    add_index :coplan_url_aliases, [ :path, :kind ], unique: true,
+      name: "index_coplan_url_aliases_on_path_and_kind"
+    add_index :coplan_url_aliases, [ :kind, :resolve_count, :created_at ],
+      name: "index_coplan_url_aliases_for_pruning"
+  end
+
+  def down
+    drop_table :coplan_url_aliases
+    remove_index :coplan_plans, name: "index_coplan_plans_on_slug_and_suffix"
+    remove_column :coplan_plans, :slug_suffix
+    remove_column :coplan_plans, :slug
+  end
+end
diff --git a/engine/db/migrate/20260821000002_collapse_plan_placements_to_one.rb b/engine/db/migrate/20260821000002_collapse_plan_placements_to_one.rb
new file mode 100644
index 00000000..2b8f1ffa
--- /dev/null
+++ b/engine/db/migrate/20260821000002_collapse_plan_placements_to_one.rb
@@ -0,0 +1,67 @@
+class CollapsePlanPlacementsToOne < ActiveRecord::Migration[8.1]
+  # A plan now lives in exactly one library. The old model let the same
+  # plan sit on many shelves at once — filing someone else's published
+  # plan into your own library was a "bookmark", separate from the
+  # author's copy. In practice nobody used it, and it cost us the one
+  # property a readable URL needs: a document having a single address.
+  #
+  # Collapses existing rows, keeping the author's own placement where
+  # there is one (that's the shelf URLs already resolved to) and
+  # otherwise the oldest, then makes more than one unrepresentable.
+  def up
+    ids = surplus_placement_ids
+    say "Dropping #{ids.size} non-canonical placement(s)" if ids.any?
+    ids.each_slice(500) do |batch|
+      execute <<~SQL.squish
+        DELETE FROM coplan_plan_placements
+        WHERE id IN (#{batch.map { |id| quote(id) }.join(",")})
+      SQL
+    end
+
+    # The new index subsumes index_..._on_plan_id_and_library_id, the old
+    # "one shelf per library" constraint. Added before the old one is
+    # dropped: MySQL requires an index on plan_id for its foreign key and
+    # refuses to drop the last one that satisfies it.
+    add_index :coplan_plan_placements, :plan_id, unique: true,
+      name: "index_coplan_plan_placements_on_plan_id"
+    remove_index :coplan_plan_placements, column: [ :plan_id, :library_id ]
+  end
+
+  def down
+    add_index :coplan_plan_placements, [ :plan_id, :library_id ], unique: true,
+      name: "index_coplan_plan_placements_on_plan_id_and_library_id"
+    remove_index :coplan_plan_placements, column: :plan_id
+  end
+
+  private
+
+  # Grouped in Ruby rather than SQL: picking a winner per plan needs a
+  # correlated "is this the author's library" test, and the portable
+  # forms of that are worse than reading the table. Placement counts are
+  # in the thousands at most.
+  def surplus_placement_ids
+    rows = connection.select_all(<<~SQL.squish).to_a
+      SELECT pp.id AS id, pp.plan_id AS plan_id, pp.created_at AS created_at,
+             lib.owner_type AS owner_type, lib.owner_id AS owner_id,
+             p.created_by_user_id AS author_id
+      FROM coplan_plan_placements pp
+      INNER JOIN coplan_plans p ON p.id = pp.plan_id
+      INNER JOIN coplan_libraries lib ON lib.id = pp.library_id
+    SQL
+
+    rows.group_by { |row| row["plan_id"] }.flat_map do |_plan_id, group|
+      next [] if group.size < 2
+
+      keeper = group.find { |row| authors_own?(row) } || group.min_by { |row| row["created_at"].to_s }
+      (group - [ keeper ]).map { |row| row["id"] }
+    end
+  end
+
+  def authors_own?(row)
+    row["owner_type"] == "CoPlan::User" && row["owner_id"].to_s == row["author_id"].to_s
+  end
+
+  def quote(value)
+    connection.quote(value)
+  end
+end
diff --git a/engine/lib/coplan/configuration.rb b/engine/lib/coplan/configuration.rb
index c8db004b..c59c0a37 100644
--- a/engine/lib/coplan/configuration.rb
+++ b/engine/lib/coplan/configuration.rb
@@ -98,8 +98,19 @@ class Configuration
     #   }
     attr_accessor :directory_profile
 
+    # Library handles a host wants to keep out of user hands, on top of
+    # CoPlan::Library::RESERVED_HANDLES. Handles live under /<handle>,
+    # so they can't collide with the host's own routes — this is for
+    # names the host wants to claim for itself later, or keep off a
+    # public namespace.
+    #
+    # Example:
+    #   config.reserved_handles = %w[square block official]
+    attr_accessor :reserved_handles
+
     def initialize
       @authenticate = nil
+      @reserved_handles = []
       @ai_base_url = "https://api.openai.com/v1"
       @ai_api_key = nil
       @ai_model = "gpt-4o"
diff --git a/spec/models/coplan/reference_spec.rb b/spec/models/coplan/reference_spec.rb
index 0fbceb75..84744083 100644
--- a/spec/models/coplan/reference_spec.rb
+++ b/spec/models/coplan/reference_spec.rb
@@ -60,6 +60,28 @@
       expect(described_class.classify_url("https://coplan.example.com/plans/019d54a7-ea13-72d5-bc54-fc44cb9b939a")).to eq("plan")
     end
 
+    # The readable form is what anyone copies out of the address bar now, so
+    # it has to read as a plan link — but only once we know it's ours.
+    # /hampton/cart-roadmap is shaped like any other site's URL, so the host
+    # is the whole distinction, and callers who know it pass it in.
+    it "classifies readable CoPlan document URLs on our own host" do
+      host = "coplan.example.com"
+      expect(described_class.classify_url("https://coplan.example.com/hampton/cart-roadmap", own_host: host)).to eq("plan")
+      expect(described_class.classify_url("https://coplan.example.com/hampton/liveorder/q3/cart-roadmap", own_host: host)).to eq("plan")
+    end
+
+    # The reason the host check isn't optional: without it, every link with
+    # two path segments would file itself as one of our documents.
+    it "does not claim someone else's two-segment URL" do
+      expect(described_class.classify_url("https://wiki.example.com/team/onboarding", own_host: "coplan.example.com")).to eq("link")
+      expect(described_class.classify_url("https://coplan.example.com/hampton/cart-roadmap")).to eq("link")
+    end
+
+    # A bare library or a workspace path isn't a document.
+    it "does not classify a library root as a plan" do
+      expect(described_class.classify_url("https://coplan.example.com/hampton", own_host: "coplan.example.com")).to eq("link")
+    end
+
     it "classifies Google Docs URLs" do
       expect(described_class.classify_url("https://docs.google.com/document/d/abc123")).to eq("document")
       expect(described_class.classify_url("https://drive.google.com/file/d/abc123")).to eq("document")
@@ -88,6 +110,75 @@
     it "returns nil for non-plan URLs" do
       expect(described_class.extract_target_plan_id("https://example.com")).to be_nil
     end
+
+    context "readable document URLs" do
+      let(:author) { create(:coplan_user, username: "hampton") }
+      let(:folder) { create(:folder, name: "LiveOrder", created_by_user: author) }
+      let!(:plan) do
+        create(:plan, :published, created_by_user: author, title: "Cart Roadmap").tap do |p|
+          CoPlan::Plans::Place.call(plan: p, folder: folder, actor: author)
+        end
+      end
+
+      it "resolves the path to the document it names" do
+        expect(described_class.extract_target_plan_id("https://coplan.example.com/hampton/liveorder/cart-roadmap"))
+          .to eq(plan.id)
+      end
+
+      # An inline link written before a rename still points at the same
+      # document, so it should still name it — the alias walk is the same
+      # one that makes following the link work.
+      it "follows a rename through the alias table" do
+        plan.reload.update!(title: "Basket Roadmap")
+        expect(plan.reload.url_path).to eq("hampton/liveorder/basket-roadmap")
+
+        expect(described_class.extract_target_plan_id("https://coplan.example.com/hampton/liveorder/cart-roadmap"))
+          .to eq(plan.id)
+      end
+
+      it "returns nil for a path that names nothing" do
+        expect(described_class.extract_target_plan_id("https://coplan.example.com/hampton/nope/gone")).to be_nil
+      end
+
+      # No host needed here: resolving IS the is-this-ours test, and it's the
+      # stronger one. An external URL whose first segment isn't a handle we
+      # have never reaches the segment walk.
+      it "leaves an unrelated site's URL alone" do
+        expect(described_class.extract_target_plan_id("https://wiki.example.com/team/onboarding")).to be_nil
+      end
+    end
+  end
+
+  describe ".resolve_link" do
+    let(:author) { create(:coplan_user, username: "hampton") }
+    let!(:plan) { create(:plan, :published, created_by_user: author, title: "Cart Roadmap") }
+
+    # Type and target are one question for a readable address: a path that
+    # resolves to one of our documents is a plan reference, so a URL that
+    # classified as a plain "link" gets promoted when it lands.
+    it "promotes a resolvable readable link to a plan reference" do
+      expect(described_class.resolve_link("https://coplan.example.com/hampton/cart-roadmap"))
+        .to eq([ "plan", plan.id ])
+    end
+
+    it "leaves an unresolvable link a link" do
+      expect(described_class.resolve_link("https://wiki.example.com/team/onboarding"))
+        .to eq([ "link", nil ])
+    end
+
+    # A document linking to itself is a link, not a reference to another one.
+    it "drops the citing plan's own address" do
+      type, target = described_class.resolve_link(
+        "https://coplan.example.com/hampton/cart-roadmap", excluding: plan.id
+      )
+      expect(target).to be_nil
+      expect(type).to eq("link")
+    end
+
+    it "keeps a non-plan classification and skips resolution" do
+      expect(described_class.resolve_link("https://github.com/org/repo/pull/1"))
+        .to eq([ "pull_request", nil ])
+    end
   end
 
   describe "scopes" do
diff --git a/spec/models/plan_spec.rb b/spec/models/plan_spec.rb
index a3b4b446..519c4f3a 100644
--- a/spec/models/plan_spec.rb
+++ b/spec/models/plan_spec.rb
@@ -51,16 +51,28 @@
     expect(plan.current_content).to include("Plan Content")
   end
 
-  it "uses the author's own library placement as its containing location" do
-    author = create(:coplan_user)
-    viewer = create(:coplan_user)
-    plan = create(:plan, :published, created_by_user: author)
-    author_folder = create(:folder, created_by_user: author)
-    viewer_folder = create(:folder, created_by_user: viewer)
-    create(:plan_placement, plan: plan, folder: viewer_folder)
-    author_placement = create(:plan_placement, plan: plan, folder: author_folder)
-
-    expect(plan.author_placement).to eq(author_placement)
+  describe "where it lives" do
+    let(:author) { create(:coplan_user) }
+
+    it "is the folder it's filed in" do
+      plan = create(:plan, :published, created_by_user: author)
+      folder = create(:folder, created_by_user: author)
+      placement = create(:plan_placement, plan: plan, folder: folder)
+
+      expect(plan.placement).to eq(placement)
+      expect(plan.folder).to eq(folder)
+      expect(plan.library).to eq(author.library)
+    end
+
+    # Unfiled isn't homeless: the plan sits at the root of the library it
+    # was written in, which is what /<handle>/<slug> addresses.
+    it "falls back to the author's library when filed nowhere" do
+      plan = create(:plan, :published, created_by_user: author)
+
+      expect(plan.placement).to be_nil
+      expect(plan.folder).to be_nil
+      expect(plan.library).to eq(author.library)
+    end
   end
 
   # THE discovery predicate (mirrored by PlanPolicy#listed?). Everything a
@@ -183,8 +195,7 @@
     self.use_transactional_tests = false
 
     after do
-      truncate_tables(*%w[coplan_plan_tags coplan_tags coplan_plan_versions coplan_plans
-                          coplan_plan_types coplan_search_queries coplan_users])
+      truncate_plan_tables
     end
 
     let!(:author) { create(:coplan_user, name: "Tessa Engineer") }
diff --git a/spec/requests/analytics_instrumentation_spec.rb b/spec/requests/analytics_instrumentation_spec.rb
index 313b81a4..8ec65775 100644
--- a/spec/requests/analytics_instrumentation_spec.rb
+++ b/spec/requests/analytics_instrumentation_spec.rb
@@ -9,19 +9,30 @@
     it "tracks a page_view event on successful HTML GETs" do
       plan = create(:plan, :considering, created_by_user: user)
 
-      events = capture_analytics_events { get plan_path(plan) }
+      events = capture_analytics_events { get plan_page_path(plan) }
 
       page_views = events.select { |name, _| name == "page_view" }
       expect(page_views.length).to eq(1)
       _, payload = page_views.first
       expect(payload[:user_id]).to eq(user.id)
+      # A document is served by the browse controller now — that's the
+      # controller/action a page_view on a plan reports.
       expect(payload[:properties]).to include(
-        path: plan_path(plan),
-        controller: "coplan/plans",
-        action: "show"
+        path: plan_page_path(plan),
+        controller: "coplan/browse",
+        action: "browse"
       )
     end
 
+    it "does not track the 301 off the legacy /plans/<uuid> address" do
+      plan = create(:plan, :considering, created_by_user: user)
+
+      events = capture_analytics_events { get plan_path(plan) }
+
+      expect(response).to have_http_status(:moved_permanently)
+      expect(events.select { |name, _| name == "page_view" }).to be_empty
+    end
+
     it "does not track for turbo-frame requests" do
       create(:plan, :considering, created_by_user: user)
 
diff --git a/spec/requests/api/v1/folders_spec.rb b/spec/requests/api/v1/folders_spec.rb
index 10225c8a..01e97d71 100644
--- a/spec/requests/api/v1/folders_spec.rb
+++ b/spec/requests/api/v1/folders_spec.rb
@@ -26,7 +26,7 @@
     it "returns folders with paths and visible plan counts" do
       root = create(:folder, name: "Team EBT", created_by_user: alice)
       sub = create(:folder, name: "Q3", parent: root, created_by_user: alice)
-      plan = create(:plan, :considering, created_by_user: bob)
+      plan = create(:plan, :considering, created_by_user: alice)
       CoPlan::Plans::Place.call(plan: plan, folder: sub, actor: alice)
 
       get api_v1_folders_path, headers: headers
@@ -42,11 +42,11 @@
     it "does not count unlisted drafts for other viewers" do
       folder = create(:folder, created_by_user: alice)
       CoPlan::Plans::Place.call(plan: create(:plan, :draft, created_by_user: alice), folder: folder, actor: alice)
-      CoPlan::Plans::Place.call(plan: create(:plan, :published, created_by_user: bob), folder: folder, actor: alice)
+      CoPlan::Plans::Place.call(plan: create(:plan, :published, created_by_user: alice), folder: folder, actor: alice)
 
       get api_v1_folders_path, headers: headers
       counts = JSON.parse(response.body).find { |f| f["id"] == folder.id }
-      # Alice sees both: her own draft and Bob's published plan.
+      # Alice sees both of her own: the draft and the published plan.
       expect(counts["plans_count"]).to eq(2)
 
       # Bob browses Alice's library: her unlisted draft doesn't count.
diff --git a/spec/requests/api/v1/libraries_spec.rb b/spec/requests/api/v1/libraries_spec.rb
index be728bca..fe148465 100644
--- a/spec/requests/api/v1/libraries_spec.rb
+++ b/spec/requests/api/v1/libraries_spec.rb
@@ -82,7 +82,7 @@
   describe "GET /api/v1/library/contents" do
     it "returns one row per placement with summary, tags, and location" do
       folder = create(:folder, name: "Infra", created_by_user: alice)
-      plan = create(:plan, :published, created_by_user: bob, title: "Zonal failover")
+      plan = create(:plan, :published, created_by_user: alice, title: "Zonal failover")
       plan.update_columns(summary: "A plan about failover.")
       plan.tag_names = [ "infra" ]
       plan.save!
@@ -97,7 +97,7 @@
       expect(row["summary"]).to eq("A plan about failover.")
       expect(row["tags"]).to eq([ "infra" ])
       expect(row["folder_path"]).to eq("Infra")
-      expect(row["author"]).to eq(bob.name)
+      expect(row["author"]).to eq(alice.name)
     end
 
     it "filters by folder subtree with recursive=true" do
@@ -306,7 +306,10 @@
       expect(listed.first["actor_label"]).to eq(alice_token.name)
     end
 
-    it "moves a plan between libraries with from_library_id" do
+    # A plan lives in one library, so moving it into another takes it out
+    # of the first — nothing has to name the source. `from_library_id` is
+    # still accepted from older callers and ignored.
+    it "moves a plan between libraries, emptying the one it came from" do
       # Simulate a future team library by making bob's library writable to
       # alice — writable_by? is the only gate Organize consults.
       allow_any_instance_of(CoPlan::Library).to receive(:writable_by?).and_return(true)
diff --git a/spec/requests/api/v1/plans_spec.rb b/spec/requests/api/v1/plans_spec.rb
index 8e0e05f5..3f687605 100644
--- a/spec/requests/api/v1/plans_spec.rb
+++ b/spec/requests/api/v1/plans_spec.rb
@@ -490,27 +490,29 @@ def alice_placement
   end
 
   describe "GET /api/v1/plans/:id/locations" do
-    it "returns every library the plan is shelved in" do
+    # Still an array — a plan has one location or none, and clients
+    # already iterate it.
+    it "returns the one library the plan is filed in" do
       published = create(:plan, :considering, created_by_user: alice)
       alice_folder = create(:folder, name: "Mine", description: "Alice's shelf", created_by_user: alice)
-      carol_folder = create(:folder, name: "Reading List", created_by_user: carol)
       CoPlan::Plans::Place.call(plan: published, folder: alice_folder, actor: alice)
-      CoPlan::Plans::Place.call(plan: published, folder: carol_folder, actor: carol)
 
       get locations_api_v1_plan_path(published), headers: headers
       expect(response).to have_http_status(:success)
-      locations = JSON.parse(response.body)
-      expect(locations.size).to eq(2)
-
-      mine = locations.find { |l| l["library_id"] == alice.library.id }
-      theirs = locations.find { |l| l["library_id"] == carol.library.id }
-      expect(mine["folder_path"]).to eq("Mine")
-      expect(mine["folder_description"]).to eq("Alice's shelf")
-      expect(mine["writable"]).to be(true)
-      expect(mine["owner"]["name"]).to eq(alice.name)
-      expect(theirs["folder_path"]).to eq("Reading List")
-      expect(theirs["writable"]).to be(false)
-      expect(theirs["placed_by"]).to eq(carol.name)
+      location = JSON.parse(response.body).sole
+
+      expect(location["library_id"]).to eq(alice.library.id)
+      expect(location["folder_path"]).to eq("Mine")
+      expect(location["folder_description"]).to eq("Alice's shelf")
+      expect(location["writable"]).to be(true)
+      expect(location["owner"]["name"]).to eq(alice.name)
+      expect(location["placed_by"]).to eq(alice.name)
+    end
+
+    it "returns nothing for an unfiled plan" do
+      get locations_api_v1_plan_path(create(:plan, :considering, created_by_user: alice)),
+        headers: headers
+      expect(JSON.parse(response.body)).to be_empty
     end
 
     it "requires auth" do
diff --git a/spec/requests/attachments_spec.rb b/spec/requests/attachments_spec.rb
index 090d294a..378d4e09 100644
--- a/spec/requests/attachments_spec.rb
+++ b/spec/requests/attachments_spec.rb
@@ -16,7 +16,7 @@
       }.to change { plan.attachments_attachments.count }.by(2)
         .and change { plan.plan_events.where(event_type: "attachment_added").count }.by(2)
 
-      expect(response).to redirect_to(plan_path(plan, anchor: "footnote-attachments"))
+      expect(response).to redirect_to(plan_page_path(plan, anchor: "footnote-attachments"))
       follow_redirect!
       expect(flash[:notice]).to include("2 files uploaded")
 
@@ -52,7 +52,7 @@
         files: [ fixture_file_upload("sample.html", "text/html") ]
       }
 
-      expect(response).to redirect_to(plan_path(plan, anchor: "footnote-attachments"))
+      expect(response).to redirect_to(plan_page_path(plan, anchor: "footnote-attachments"))
       expect(flash[:alert]).to include("sample.html")
       expect(flash[:alert]).to include("not allowed")
       expect(plan.attachments.count).to eq(0)
@@ -67,7 +67,7 @@
         }
       }.to change { plan.attachments_attachments.count }.by(1)
 
-      expect(response).to redirect_to(plan_path(plan, anchor: "footnote-attachments"))
+      expect(response).to redirect_to(plan_page_path(plan, anchor: "footnote-attachments"))
       event = plan.plan_events.find_by(event_type: "attachment_added")
       expect(event.actor_id).to eq(viewer.id)
     end
@@ -100,7 +100,7 @@
         delete plan_attachment_path(plan, attachment)
       }.to change { plan.attachments_attachments.count }.by(-1)
 
-      expect(response).to redirect_to(plan_path(plan, anchor: "footnote-attachments"))
+      expect(response).to redirect_to(plan_page_path(plan, anchor: "footnote-attachments"))
       event = plan.plan_events.find_by(event_type: "attachment_removed")
       expect(event.before_value).to eq("sample.png")
     end
@@ -139,7 +139,7 @@
       )
 
       sign_in_as(viewer)
-      get plan_path(plan, anchor: "footnote-attachments")
+      get plan_page_path(plan, anchor: "footnote-attachments")
 
       expect(response).to have_http_status(:ok)
       expect(response.body).to include("diagram.png")
@@ -151,7 +151,7 @@
 
     it "shows the upload form to the plan author" do
       sign_in_as(author)
-      get plan_path(plan, anchor: "footnote-attachments")
+      get plan_page_path(plan, anchor: "footnote-attachments")
 
       expect(response).to have_http_status(:ok)
       expect(response.body).to include("attachments-upload")
diff --git a/spec/requests/browse_spec.rb b/spec/requests/browse_spec.rb
new file mode 100644
index 00000000..fe65e92d
--- /dev/null
+++ b/spec/requests/browse_spec.rb
@@ -0,0 +1,235 @@
+require "rails_helper"
+
+RSpec.describe "Browsable library URLs", type: :request do
+  let(:author) { create(:coplan_user, username: "hampton") }
+  let(:viewer) { create(:coplan_user, username: "viewer") }
+
+  def place(plan, folder, actor: author)
+    CoPlan::Plans::Place.call(plan: plan, folder: folder, actor: actor)
+    plan.reload
+  end
+
+  describe "every prefix is a real page" do
+    let!(:folder) { create(:folder, name: "LiveOrder", created_by_user: author) }
+    let!(:nested) { create(:folder, name: "Q3", parent: folder, created_by_user: author) }
+    let!(:plan) do
+      create(:plan, :published, created_by_user: author, title: "LiveOrder Cart Roadmap")
+        .tap { |p| place(p, nested) }
+    end
+
+    before { sign_in_as(viewer) }
+
+    it "serves the plan at its canonical path" do
+      get "/hampton/liveorder/q3/cart-roadmap"
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include("LiveOrder Cart Roadmap")
+    end
+
+    it "serves each ancestor of that path" do
+      [
+        "/hampton/liveorder/q3",
+        "/hampton/liveorder",
+        "/hampton",
+        "/_/libraries"
+      ].each do |path|
+        get path
+        expect(response).to have_http_status(:ok), "expected #{path} to be a real page"
+      end
+    end
+
+    it "404s a path that names nothing" do
+      get "/hampton/liveorder/nope"
+      expect(response).to have_http_status(:not_found)
+
+      get "/nobody"
+      expect(response).to have_http_status(:not_found)
+    end
+
+    it "does not treat a dotted slug tail as a format" do
+      versioned = create(:plan, :published, created_by_user: author, title: "Pricing v1.2")
+      place(versioned, folder)
+
+      get "/hampton/liveorder/#{versioned.slug}"
+
+      expect(response).to have_http_status(:ok)
+      expect(versioned.slug).to eq("pricing-v1-2")
+    end
+  end
+
+  describe "the owner's own library" do
+    let!(:folder) { create(:folder, name: "Team EBT", created_by_user: author) }
+
+    before { sign_in_as(author) }
+
+    it "renders the editable workspace at the browsable path" do
+      get "/hampton/team-ebt"
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include("Team EBT")
+    end
+  end
+
+  describe "stale paths" do
+    before { sign_in_as(viewer) }
+
+    it "301s to the new path after a folder is renamed" do
+      folder = create(:folder, name: "LiveOrder", created_by_user: author)
+      plan = create(:plan, :published, created_by_user: author, title: "Cart Roadmap")
+      place(plan, folder)
+
+      folder.update!(name: "Live Order Platform")
+
+      get "/hampton/liveorder/cart-roadmap"
+
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response.headers["Location"]).to end_with("/hampton/live-order-platform/cart-roadmap")
+    end
+
+    it "301s a whole renamed subtree with one alias" do
+      folder = create(:folder, name: "LiveOrder", created_by_user: author)
+      nested = create(:folder, name: "Q3", parent: folder, created_by_user: author)
+      plan = create(:plan, :published, created_by_user: author, title: "Cart Roadmap")
+      place(plan, nested)
+
+      expect { folder.update!(name: "Orders") }
+        .to change(CoPlan::UrlAlias, :count).by(1)
+
+      get "/hampton/liveorder/q3/cart-roadmap"
+
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response.headers["Location"]).to end_with("/hampton/orders/q3/cart-roadmap")
+    end
+
+    it "301s to the new path after a published plan is retitled" do
+      plan = create(:plan, :published, created_by_user: author, title: "Cart Roadmap")
+
+      plan.update!(title: "Basket Roadmap")
+
+      get "/hampton/cart-roadmap"
+
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response.headers["Location"]).to end_with("/hampton/basket-roadmap")
+    end
+
+    it "301s after a library handle is renamed" do
+      plan = create(:plan, :published, created_by_user: author, title: "Cart Roadmap")
+      author.library.update!(handle: "hampton-lc")
+
+      get "/hampton/cart-roadmap"
+
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response.headers["Location"]).to end_with("/hampton-lc/cart-roadmap")
+      expect(plan.reload.url_path).to eq("hampton-lc/cart-roadmap")
+    end
+
+    # The renamed thing's own address, not just the ones beneath it. A
+    # prefix alias has to match the whole path as well as its ancestors, or
+    # a rename fixes every link into a folder except the link to the folder.
+    it "301s the renamed folder's own path" do
+      folder = create(:folder, name: "LiveOrder", created_by_user: author)
+
+      folder.update!(name: "Orders")
+
+      get "/hampton/liveorder"
+
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response.headers["Location"]).to end_with("/hampton/orders")
+    end
+
+    it "301s the renamed library's own root" do
+      author.library.update!(handle: "hampton-lc")
+
+      get "/hampton"
+
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response.headers["Location"]).to end_with("/hampton-lc")
+    end
+  end
+
+  describe "legacy URLs" do
+    before { sign_in_as(viewer) }
+
+    it "301s an id-based library link to the browsable path" do
+      get "/libraries/#{author.library.id}"
+
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response.headers["Location"]).to end_with("/hampton")
+    end
+
+    it "301s an id-based folder link to the browsable path" do
+      folder = create(:folder, name: "Team EBT", created_by_user: author)
+
+      get "/libraries/#{author.library.id}?folder=#{folder.id}"
+
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response.headers["Location"]).to end_with("/hampton/team-ebt")
+    end
+
+    # /plans/<uuid> is the old name for the page, not a redirect-of-the-day:
+    # 301 so the address bar — and everything copied out of it — converges
+    # on the readable form.
+    describe "/plans/<uuid>" do
+      let!(:plan) { create(:plan, :published, created_by_user: author, title: "Cart Roadmap") }
+
+      it "301s onto the document's readable address" do
+        get "/plans/#{plan.id}"
+
+        expect(response).to have_http_status(:moved_permanently)
+        expect(response.headers["Location"]).to end_with("/hampton/cart-roadmap")
+      end
+
+      it "carries the query string over" do
+        get "/plans/#{plan.id}?thread=abc123"
+
+        expect(response.headers["Location"]).to end_with("/hampton/cart-roadmap?thread=abc123")
+      end
+
+      it "still names the readable URL as canonical when it does render" do
+        get "/hampton/cart-roadmap"
+
+        expect(response.body).to include(
+          %(<link rel="canonical" href="http://www.example.com/hampton/cart-roadmap">)
+        )
+      end
+
+      # A Turbo Frame fetch and a non-HTML caller asked for this exact URL
+      # and want a response, not a hop.
+      it "does not bounce a Turbo Frame fetch" do
+        get "/plans/#{plan.id}", headers: { "Turbo-Frame" => "plan-content" }
+
+        expect(response).to have_http_status(:ok)
+      end
+
+      # Nothing to converge on yet: both forms have to work while slugs
+      # backfill, so an unslugged plan renders at its id.
+      it "renders in place for a plan with no slug yet" do
+        plan.update_columns(slug: nil)
+
+        get "/plans/#{plan.id}"
+
+        expect(response).to have_http_status(:ok)
+        expect(response.body).to include("Cart Roadmap")
+      end
+    end
+  end
+
+  describe "drafts" do
+    before { sign_in_as(viewer) }
+
+    # Drafts are unlisted, not locked (PlanPolicy#show?), so a readable URL
+    # doesn't change who can reach one — access was never URL secrecy. What
+    # a draft withholds is discovery, and that stays with Plan.visible_to.
+    it "is readable by direct path but stays out of the library listing" do
+      plan = create(:plan, :draft, created_by_user: author, title: "Secret Roadmap")
+      expect(plan.reload.slug).to eq("secret-roadmap")
+
+      get "/hampton/secret-roadmap"
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include("Secret Roadmap")
+
+      get "/hampton"
+      expect(response.body).not_to include("Secret Roadmap")
+    end
+  end
+end
diff --git a/spec/requests/changed_sections_highlight_spec.rb b/spec/requests/changed_sections_highlight_spec.rb
index 3a8c75a0..a4963018 100644
--- a/spec/requests/changed_sections_highlight_spec.rb
+++ b/spec/requests/changed_sections_highlight_spec.rb
@@ -15,7 +15,7 @@ def keys_attr(body)
 
   it "sends no keys on a first-ever visit" do
     sign_in_as(viewer)
-    get plan_path(plan)
+    get plan_page_path(plan)
 
     expect(response).to have_http_status(:ok)
     expect(keys_attr(response.body)).to eq("[]")
@@ -30,18 +30,18 @@ def keys_attr(body)
     plan.update_columns(current_plan_version_id: v2.id, current_revision: 2)
 
     sign_in_as(viewer)
-    get plan_path(plan)
+    get plan_page_path(plan)
     expect(keys_attr(response.body)).to include("plan-content")
 
     # That request advanced last_seen_at — the highlight is spent.
-    get plan_path(plan)
+    get plan_page_path(plan)
     expect(keys_attr(response.body)).to eq("[]")
   end
 
   it "sends no keys when nothing changed since the last visit" do
     sign_in_as(viewer)
-    get plan_path(plan)
-    get plan_path(plan)
+    get plan_page_path(plan)
+    get plan_page_path(plan)
 
     expect(keys_attr(response.body)).to eq("[]")
   end
diff --git a/spec/requests/comment_threads_spec.rb b/spec/requests/comment_threads_spec.rb
index 73e8a69e..03b170df 100644
--- a/spec/requests/comment_threads_spec.rb
+++ b/spec/requests/comment_threads_spec.rb
@@ -25,7 +25,7 @@
         }
       }
     }.to change(CoPlan::CommentThread, :count).by(1).and change(CoPlan::Comment, :count).by(1)
-    expect(response).to redirect_to(plan_path(plan))
+    expect(response).to redirect_to(plan_page_path(plan))
     thread = CoPlan::CommentThread.last
     expect(thread.anchor_text).to eq("world domination")
     expect(thread.anchor_start).to be_present # resolved at the door
@@ -44,7 +44,7 @@
         }
       }.not_to change { [ CoPlan::CommentThread.count, CoPlan::Comment.count ] }
 
-      expect(response).to redirect_to(plan_path(plan))
+      expect(response).to redirect_to(plan_page_path(plan))
       expect(flash[:alert]).to include("nowhere to appear")
     end
 
@@ -97,7 +97,7 @@
   it "resolve thread" do
     thread = create(:comment_thread, plan: plan, plan_version: plan.current_plan_version, created_by_user: alice)
     patch resolve_plan_comment_thread_path(plan, thread)
-    expect(response).to redirect_to(plan_path(plan))
+    expect(response).to redirect_to(plan_page_path(plan))
     thread.reload
     expect(thread.status).to eq("resolved")
   end
diff --git a/spec/requests/comments_spec.rb b/spec/requests/comments_spec.rb
index 7283ed19..0895cd08 100644
--- a/spec/requests/comments_spec.rb
+++ b/spec/requests/comments_spec.rb
@@ -13,7 +13,7 @@
         comment: { body_markdown: "I agree with this." }
       }
     }.to change(CoPlan::Comment, :count).by(1)
-    expect(response).to redirect_to(plan_path(plan))
+    expect(response).to redirect_to(plan_page_path(plan))
     comment = CoPlan::Comment.last
     expect(comment.author_type).to eq("human")
     expect(comment.author_id).to eq(alice.id)
@@ -70,7 +70,7 @@
       expect {
         delete plan_comment_thread_comment_path(plan, thread_record, comment)
       }.to change { comment.reload.deleted_at }.from(nil)
-      expect(response).to redirect_to(plan_path(plan))
+      expect(response).to redirect_to(plan_page_path(plan))
     end
 
     it "redirects with alert when the user is not the comment author" do
diff --git a/spec/requests/libraries_spec.rb b/spec/requests/libraries_spec.rb
index 6023efc5..c3df7cef 100644
--- a/spec/requests/libraries_spec.rb
+++ b/spec/requests/libraries_spec.rb
@@ -5,55 +5,218 @@
 
   before { sign_in_as(alice) }
 
+  describe "GET /_/libraries" do
+    # A library exists from the moment its owner does — it's a person's page
+    # now, so a colleague who has never signed in is still browsable.
+    it "lists the libraries you can browse" do
+      create(:coplan_user, username: "bob")
+
+      get browse_root_path
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include(%(href="/alice"), %(href="/bob"))
+    end
+
+    # The eager row above is the invariant; `User#library` is the belt to its
+    # braces, for anything that removed a row out from under it.
+    it "includes your own library even when the row has gone missing" do
+      alice.library.destroy!
+
+      get browse_root_path
+
+      expect(response.body).to include(%(href="/alice"))
+    end
+
+    # The count has to say what clicking the row will show. A plan at a
+    # library root has no placement row by design, so counting placements
+    # alone called a library of nothing but loose work "empty".
+    it "counts the plans sitting loose at a library root" do
+      bob = create(:coplan_user, username: "bob")
+      create(:plan, :published, created_by_user: bob, title: "Loose plan")
+
+      get browse_root_path
+
+      expect(response.body).to include("1 plan")
+    end
+
+    it "counts filed and loose plans together" do
+      bob = create(:coplan_user, username: "bob")
+      folder = create(:folder, name: "Projects", created_by_user: bob)
+      filed = create(:plan, :published, created_by_user: bob, title: "Filed plan")
+      create(:plan_placement, plan: filed, folder: folder)
+      create(:plan, :published, created_by_user: bob, title: "Loose plan")
+
+      get browse_root_path
+
+      expect(response.body).to include("2 plans")
+    end
+  end
+
   describe "GET /library" do
-    it "redirects to the current user's editable workspace" do
+    it "redirects to the current user's browsable library root" do
       get my_library_path
-      expect(response).to redirect_to(plans_path)
+      expect(response).to redirect_to(browse_library_path(handle: "alice"))
     end
   end
 
+  # The id-based form is legacy: it 301s to the canonical browsable path so
+  # old links converge on the readable URL rather than living alongside it.
   describe "GET /libraries/:id" do
-    it "redirects the owner to the matching folder in their workspace" do
-      folder = create(:folder, created_by_user: alice)
+    it "301s a library link to its browsable path" do
+      get library_path(alice.library)
+
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response).to redirect_to(browse_library_path(handle: "alice"))
+    end
+
+    it "301s a folder link to its browsable path" do
+      folder = create(:folder, name: "Team EBT", created_by_user: alice)
 
       get library_path(alice.library, folder: folder.id)
 
-      expect(response).to redirect_to(plans_path(folder: folder.id))
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response).to redirect_to(browse_path(handle: "alice", slug_path: "team-ebt"))
     end
 
-    it "browses another user's library one folder level at a time" do
+    it "returns to the library root when the requested folder is gone" do
       bob = create(:coplan_user, username: "bob")
-      projects = create(:folder, name: "Projects", created_by_user: bob)
-      launches = create(:folder, name: "Launches", parent: projects, created_by_user: bob)
-      filed = create(:plan, :published, title: "Filed launch", created_by_user: bob)
-      loose = create(:plan, :published, title: "Loose plan", created_by_user: bob)
-      private_plan = create(:plan, :draft, title: "Private draft", created_by_user: bob)
+
+      get library_path(bob.library, folder: "missing")
+
+      expect(response).to redirect_to(browse_library_path(handle: "bob"))
+      expect(flash[:alert]).to eq("That folder no longer exists.")
+    end
+  end
+
+  describe "browsing another user's library" do
+    let(:bob) { create(:coplan_user, username: "bob") }
+    let!(:projects) { create(:folder, name: "Projects", created_by_user: bob) }
+    let!(:launches) { create(:folder, name: "Launches", parent: projects, created_by_user: bob) }
+    let!(:filed) { create(:plan, :published, title: "Filed launch", created_by_user: bob) }
+    let!(:loose) { create(:plan, :published, title: "Loose plan", created_by_user: bob) }
+    let!(:private_plan) { create(:plan, :draft, title: "Private draft", created_by_user: bob) }
+
+    before do
       create(:plan_placement, plan: filed, folder: launches)
       create(:plan_placement, plan: private_plan, folder: launches)
+    end
+
+    it "walks one folder level at a time" do
+      # The library root also carries a "since you last looked" strip, which
+      # would surface Bob's work wherever it's filed — so mark it read first
+      # and let this example be about the level listing alone. The strip has
+      # its own example below.
+      [ filed, loose ].each { |plan| CoPlan::PlanViewer.track(plan: plan, user: alice) }
 
-      get library_path(bob.library)
+      get "/bob"
       expect(response).to have_http_status(:ok)
       expect(response.body).to include("Projects", "Loose plan")
       expect(response.body).not_to include("Filed launch", "Private draft")
 
-      get library_path(bob.library, folder: projects.id)
+      get "/bob/projects"
       expect(response).to have_http_status(:ok)
       expect(response.body).to include("Projects", "Launches")
       expect(response.body).not_to include("Filed launch", "Loose plan")
 
-      get library_path(bob.library, folder: launches.id)
+      get "/bob/projects/launches"
       expect(response).to have_http_status(:ok)
       expect(response.body).to include("Projects", "Launches", "Filed launch")
       expect(response.body).not_to include("Loose plan", "Private draft")
     end
 
-    it "returns to the library root when the requested folder is gone" do
-      bob = create(:coplan_user)
+    # The same interface you get on your own library: filters, folder counts,
+    # and this. In someone else's library it answers "what's new in here",
+    # which is the question you came to their library with.
+    it "shows what's changed since you last looked" do
+      get "/bob"
 
-      get library_path(bob.library, folder: "missing")
+      expect(response.body).to include("Since you last looked", "new to you")
+    end
 
-      expect(response).to redirect_to(library_path(bob.library))
-      expect(flash[:alert]).to eq("That folder no longer exists.")
+    # Read-only, not read-a-different-page: the sidebar and its counts are
+    # the same ones the owner sees, bounded by what you're allowed to see.
+    it "offers the same filters, and no controls you can't use" do
+      get "/bob"
+
+      expect(response.body).to include("Filters &amp; folders", "Read only")
+      expect(response.body).to include(%(href="/bob?filter=archived"))
+      expect(response.body).not_to include("New folder")
+      expect(response.body).not_to include("Show my private plans")
+    end
+
+    # Folder navigation is a path, so clicking one inside someone's library
+    # stays inside it. Getting this wrong sent you back to your own workspace.
+    it "keeps folder links inside the library being browsed" do
+      get "/bob"
+
+      expect(response.body).to include(%(href="/bob/projects"))
+      expect(response.body).not_to include("/_/plans?folder=")
+    end
+  end
+
+  # A person's page and their library are one page, so the identity that
+  # used to live on /people/:id is the header of this one.
+  describe "the person at the top of their library" do
+    let!(:author) do
+      create(:coplan_user, name: "Ada Author", username: "ada", title: "Engineer", team: "Payments")
+    end
+
+    it "names the person, their role, and their handle" do
+      get "/ada"
+
+      expect(response.body).to include("Ada Author", "Engineer", "Payments", "/ada")
+    end
+
+    describe "directory adapter" do
+      after { CoPlan.configuration.directory_profile = nil }
+
+      it "overrides local fields and adds a directory link" do
+        CoPlan.configuration.directory_profile = ->(_user) {
+          { title: "Staff Engineer", profile_url: "https://people.example.com/ada" }
+        }
+
+        get "/ada"
+
+        expect(response.body).to include("Staff Engineer")
+        expect(response.body).not_to include(">Engineer<")
+        expect(response.body).to include("https://people.example.com/ada")
+      end
+
+      it "falls back to the local profile when the hook raises" do
+        reported = []
+        allow(CoPlan.configuration).to receive(:error_reporter).and_return(->(e, _ctx) { reported << e })
+        CoPlan.configuration.directory_profile = ->(_user) { raise "directory down" }
+
+        get "/ada"
+
+        expect(response).to have_http_status(:ok)
+        expect(response.body).to include("Ada Author", "Engineer")
+        expect(reported.size).to eq(1)
+      end
+    end
+
+    # Drafts are unlisted, not locked. Your own library shows yours — it's
+    # your workspace — and nobody else's library shows them to you.
+    it "lists a draft to its author and to no one else" do
+      create(:plan, :draft, created_by_user: author, title: "Secret Draft")
+
+      sign_in_as(author)
+      get "/ada"
+      expect(response.body).to include("Secret Draft")
+
+      sign_in_as(alice)
+      get "/ada"
+      expect(response.body).not_to include("Secret Draft")
+    end
+
+    it "hides an archived plan until someone asks for the archive" do
+      create(:plan, :published, created_by_user: author, title: "Old Work", archived_at: 1.day.ago)
+
+      get "/ada"
+      expect(response.body).not_to include("Old Work")
+
+      get "/ada?filter=archived"
+      expect(response.body).to include("Old Work")
     end
   end
 end
diff --git a/spec/requests/notifications_spec.rb b/spec/requests/notifications_spec.rb
index 2bbd8dab..d0b6c483 100644
--- a/spec/requests/notifications_spec.rb
+++ b/spec/requests/notifications_spec.rb
@@ -40,7 +40,7 @@
       notification = create(:notification, user: user, plan: plan, comment_thread: thread)
 
       get notification_path(notification)
-      expect(response).to redirect_to(plan_path(plan, thread: thread.id))
+      expect(response).to redirect_to(plan_page_path(plan, thread: thread.id))
 
       notification.reload
       expect(notification.read_at).to be_present
diff --git a/spec/requests/plan_content_editing_spec.rb b/spec/requests/plan_content_editing_spec.rb
index 3d7e20d3..2d15bb2f 100644
--- a/spec/requests/plan_content_editing_spec.rb
+++ b/spec/requests/plan_content_editing_spec.rb
@@ -36,7 +36,7 @@
         }
       }.to change(CoPlan::PlanVersion, :count).by(1)
 
-      expect(response).to redirect_to(plan_path(plan))
+      expect(response).to redirect_to(plan_page_path(plan))
       plan.reload
       expect(plan.current_content).to eq("# Plan\n\nEdited body.\n")
       version = plan.current_plan_version
@@ -60,7 +60,7 @@
           base_revision: plan.current_revision
         }
       }.not_to change(CoPlan::PlanVersion, :count)
-      expect(response).to redirect_to(plan_path(plan))
+      expect(response).to redirect_to(plan_page_path(plan))
     end
 
     it "re-renders the editor with the draft preserved on a stale base_revision" do
@@ -119,7 +119,7 @@
         }
       }.to change(CoPlan::PlanVersion, :count).by(1)
 
-      expect(response).to redirect_to(plan_path(plan))
+      expect(response).to redirect_to(plan_page_path(plan))
       expect(plan.reload.current_content).to eq("# Plan\n\nMy conflicting draft.\n")
     end
 
@@ -168,8 +168,9 @@
         plan: { title: "Renamed Plan", tag_names: "security, api-design" }
       }
 
-      expect(response).to redirect_to(plan_path(plan))
-      plan.reload
+      # Retitling reslugs the document — the redirect lands on its new
+      # address, not the one it had going in.
+      expect(response).to redirect_to(plan_page_path(plan.reload))
       expect(plan.title).to eq("Renamed Plan")
       expect(plan.tag_names).to contain_exactly("security", "api-design")
       expect(plan.current_content).to eq("# Plan\n\nEdited with metadata.\n")
@@ -184,9 +185,9 @@
         plan: { title: "Rename Only" }
       }
 
-      expect(response).to redirect_to(plan_path(plan))
+      expect(response).to redirect_to(plan_page_path(plan.reload))
       expect(flash[:notice]).to eq("Plan updated.")
-      expect(plan.reload.title).to eq("Rename Only")
+      expect(plan.title).to eq("Rename Only")
     end
 
     it "says 'No changes to save.' when nothing changed" do
@@ -196,7 +197,7 @@
         plan: { title: plan.title }
       }
 
-      expect(response).to redirect_to(plan_path(plan))
+      expect(response).to redirect_to(plan_page_path(plan))
       expect(flash[:notice]).to eq("No changes to save.")
     end
 
@@ -245,7 +246,7 @@
 
       patch plan_path(plan), params: { plan: { title: plan.title, tag_names: "security, api-design" } }
 
-      expect(response).to redirect_to(plan_path(plan))
+      expect(response).to redirect_to(plan_page_path(plan))
       expect(plan.reload.tag_names).to contain_exactly("security", "api-design")
       events = plan.plan_events.where(event_type: "tag_added")
       expect(events.map(&:after_value)).to include("api-design")
diff --git a/spec/requests/plans_spec.rb b/spec/requests/plans_spec.rb
index 1d723e6e..8154ab3c 100644
--- a/spec/requests/plans_spec.rb
+++ b/spec/requests/plans_spec.rb
@@ -63,18 +63,18 @@
     # Tags are workspace-side organization (sidebar filters, the editor) —
     # the plan page masthead stays two clean rows: title, then byline.
     plan.tag_names = [ "infra", "security" ]
-    get plan_path(plan)
+    get plan_page_path(plan)
     expect(response).to have_http_status(:success)
     expect(response.body).not_to include("badge--tag")
   end
 
   it "show plan renders successfully" do
-    get plan_path(plan)
+    get plan_page_path(plan)
     expect(response).to have_http_status(:success)
   end
 
   it "show plan renders plan content" do
-    get plan_path(plan)
+    get plan_page_path(plan)
     expect(response).to have_http_status(:success)
     expect(response.body).to include("plan-layout__content")
   end
@@ -82,7 +82,7 @@
   it "does not link archived plans to a library that omits them" do
     archived_plan = create(:plan, :archived, created_by_user: alice)
 
-    get plan_path(archived_plan)
+    get plan_page_path(archived_plan)
 
     expect(response).to have_http_status(:success)
     expect(response.body).not_to include("plan-location-link")
@@ -93,13 +93,13 @@
     comment = create(:comment, comment_thread: thread, author_type: "human", author_id: alice.id,
                      body_markdown: "Noted.[^1]\n\n[^1]: A comment footnote.")
 
-    get plan_path(plan)
+    get plan_page_path(plan)
     expect(response.body).to include(%(id="comment-#{comment.id}-fn-1"))
     expect(response.body).to include(%(href="#comment-#{comment.id}-fn-1"))
   end
 
   it "show plan renders content navigation sidebar" do
-    get plan_path(plan)
+    get plan_page_path(plan)
     expect(response).to have_http_status(:success)
     expect(response.body).to include('class="content-nav"')
     expect(response.body).to include('data-coplan--content-nav-target="sidebar"')
@@ -108,14 +108,14 @@
   end
 
   it "show plan wires up both text-selection and content-nav controllers" do
-    get plan_path(plan)
+    get plan_page_path(plan)
     expect(response).to have_http_status(:success)
     expect(response.body).to include('data-controller="coplan--text-selection coplan--content-nav coplan--checkbox coplan--changed-sections coplan--reference-preview"')
     expect(response.body).to include('data-coplan--reference-preview-target="popover"')
   end
 
   it "show plan shares content target between controllers" do
-    get plan_path(plan)
+    get plan_page_path(plan)
     expect(response).to have_http_status(:success)
     expect(response.body).to include('data-coplan--content-nav-target="content"')
     expect(response.body).to include('data-coplan--text-selection-target="content"')
@@ -124,14 +124,14 @@
   it "show plan without content does not render content nav sidebar" do
     empty_plan = create(:plan, :considering, created_by_user: alice)
     empty_plan.current_plan_version.update_columns(content_markdown: "", content_sha256: Digest::SHA256.hexdigest(""))
-    get plan_path(empty_plan)
+    get plan_page_path(empty_plan)
     expect(response).to have_http_status(:success)
     expect(response.body).to include("empty-state")
     expect(response.body).not_to include('class="content-nav"')
   end
 
   it "show plan includes Open Graph meta tags" do
-    get plan_path(plan)
+    get plan_page_path(plan)
     expect(response.body).to include('property="og:title"')
     expect(response.body).to include('property="og:description"')
     expect(response.body).to include('property="og:site_name"')
@@ -139,7 +139,7 @@
   end
 
   it "show plan includes turbo stream subscription" do
-    get plan_path(plan)
+    get plan_page_path(plan)
     expect(response).to have_http_status(:success)
     expect(response.body).to include("turbo-cable-stream-source")
   end
@@ -158,7 +158,7 @@
     }.not_to change(CoPlan::PlanVersion, :count)
     plan.reload
     expect(plan.title).to eq("Updated Title")
-    expect(response).to redirect_to(plan_path(plan))
+    expect(response).to redirect_to(plan_page_path(plan))
   end
 
   it "index hides other users brainstorm plans on the All scope" do
@@ -270,7 +270,10 @@
       get plans_path(folder: root.id)
 
       expect(response.body).to include('id="plans-level-page-2"')
-      expect(response.body).to include("folder=#{root.id}")
+      # The next-page frame still has to know which folder it's paging, and
+      # it names it the way the rest of the app does: in the path. A
+      # `?folder=<id>` here would be the last place that didn't.
+      expect(response.body).to include(browse_path(handle: alice.library.handle, slug_path: "team-ebt"))
     end
 
     it "serves level page fetches without leaking filed plans into the root" do
@@ -300,14 +303,12 @@
     end
   end
 
+  # The strip follows the active scope, so "mine" stays your own work.
   describe "since you last looked" do
     it "flags plans updated after the viewer's last visit" do
-      seen_plan = create(:plan, :published, created_by_user: bob, title: "Moved On")
+      seen_plan = create(:plan, :published, created_by_user: alice, title: "Moved On")
       create(:plan_viewer, plan: seen_plan, user: alice, last_seen_at: 2.days.ago)
       seen_plan.update!(updated_at: 1.hour.ago)
-      # Alice shelves it so it's part of her workspace scope.
-      root = create(:folder, name: "Reading", created_by_user: alice)
-      CoPlan::Plans::Place.call(plan: seen_plan, folder: root, actor: alice)
 
       get plans_path
 
@@ -315,12 +316,13 @@
       expect(response.body).to include("recent-updates__badge--updated")
     end
 
+    # Only under scope=all: "new to you" needs someone else's work, and
+    # the default workspace is yours alone now that a plan can't be filed
+    # onto two shelves.
     it "flags never-opened plans by other people as new to you" do
-      other = create(:plan, :published, created_by_user: bob, title: "Fresh From Bob")
-      root = create(:folder, name: "Reading", created_by_user: alice)
-      CoPlan::Plans::Place.call(plan: other, folder: root, actor: alice)
+      create(:plan, :published, created_by_user: bob, title: "Fresh From Bob")
 
-      get plans_path
+      get plans_path(scope: "all")
 
       expect(response.body).to include("recent-updates__badge--new-to-you")
       expect(response.body).to include("Fresh From Bob")
@@ -430,7 +432,7 @@
 
   it "can view brainstorm plan as non-author" do
     sign_in_as(bob)
-    get plan_path(brainstorm_plan)
+    get plan_page_path(brainstorm_plan)
     expect(response).to have_http_status(:ok)
   end
 
@@ -514,14 +516,13 @@
     it "combines folder with tag and scope filters" do
       root_plan.tag_names = [ "infra" ]
       sub_plan.tag_names = [ "frontend" ]
-      bobs_plan = create(:plan, :considering, created_by_user: bob, title: "Bobs Foldered Plan")
-      # Alice shelves Bob's plan in her own folder — it joins her workspace.
-      CoPlan::Plans::Place.call(plan: bobs_plan, folder: root, actor: alice)
-      bobs_plan.tag_names = [ "infra" ]
+      also_infra = create(:plan, :considering, created_by_user: alice, title: "Second Infra Plan")
+      CoPlan::Plans::Place.call(plan: also_infra, folder: root, actor: alice)
+      also_infra.tag_names = [ "infra" ]
 
       get plans_path(folder: root.id, tag: "infra", scope: "all")
       expect(response.body).to include("Root Level Plan")
-      expect(response.body).to include("Bobs Foldered Plan")
+      expect(response.body).to include("Second Infra Plan")
       expect(response.body).not_to include("Subfolder Plan")
     end
 
@@ -556,9 +557,9 @@
       expect(response.body).to include("Paged Plan 00")
       expect(response.body).not_to include("Root Level Plan")
       # The lazy next-page frame must carry the folder, or page 2 would
-      # silently fall back to the whole workspace.
+      # silently fall back to the whole workspace. It carries it in the path.
       expect(response.body).to include("page=2")
-      expect(response.body).to include("folder=#{root.id}")
+      expect(response.body).to include(browse_path(handle: alice.library.handle, slug_path: "team-ebt"))
 
       get plans_path(folder: root.id, group: "level", page: 2),
         headers: { "Turbo-Frame" => "plans-level-page-2" }
@@ -598,12 +599,10 @@
       expect(response.body).to match(%r{Secret Stash</span>\s*<span class="sidebar__count">1</span>})
     end
 
-    it "counts shelved plans in the viewer's workspace, whoever wrote them" do
+    it "counts the plans filed in a folder in both scopes" do
       folder = create(:folder, name: "My Corner", created_by_user: alice)
-      CoPlan::Plans::Place.call(plan: create(:plan, :considering, created_by_user: bob), folder: folder, actor: alice)
+      CoPlan::Plans::Place.call(plan: create(:plan, :considering, created_by_user: alice), folder: folder, actor: alice)
 
-      # A placement makes the plan part of alice's workspace even in the
-      # default "mine" scope — the shelf is hers.
       get plans_path
       expect(response.body).to match(%r{My Corner</span>\s*<span class="sidebar__count">1</span>})
 
@@ -641,7 +640,7 @@
     it "shows a New folder form" do
       get plans_path
       expect(response.body).to include("New folder")
-      expect(response.body).to include('action="/folders"')
+      expect(response.body).to include('action="/_/folders"')
     end
 
     it "scopes tag counts to the current folder" do
@@ -821,7 +820,7 @@
       first = create(:notification, user: alice, plan: plan, comment_thread: thread)
       second = create(:notification, user: alice, plan: plan, comment_thread: thread, reason: "agent_response")
 
-      get plan_path(plan)
+      get plan_page_path(plan)
 
       expect(response).to have_http_status(:success)
       expect(first.reload.read_at).to be_present
@@ -831,7 +830,7 @@
     it "renders the bell already cleared, not a stale count" do
       create(:notification, user: alice, plan: plan, comment_thread: thread)
 
-      get plan_path(plan)
+      get plan_page_path(plan)
 
       badge = Nokogiri::HTML(response.body).at_css("#inbox-badge")
       expect(badge.text).to eq("0")
@@ -843,7 +842,7 @@
       other_thread = create(:comment_thread, plan: other_plan, created_by_user: bob)
       other = create(:notification, user: alice, plan: other_plan, comment_thread: other_thread)
 
-      get plan_path(plan)
+      get plan_page_path(plan)
 
       expect(other.reload.read_at).to be_nil
     end
@@ -851,7 +850,7 @@
     it "leaves other people's rows for the same plan alone" do
       bobs = create(:notification, user: bob, plan: plan, comment_thread: thread)
 
-      get plan_path(plan)
+      get plan_page_path(plan)
 
       expect(bobs.reload.read_at).to be_nil
     end
@@ -869,14 +868,14 @@
     it "ignores a Turbo hover prefetch" do
       notification = create(:notification, user: alice, plan: plan, comment_thread: thread)
 
-      get plan_path(plan), headers: { "X-Sec-Purpose" => "prefetch" }
+      get plan_page_path(plan), headers: { "X-Sec-Purpose" => "prefetch" }
 
       expect(response).to have_http_status(:success)
       expect(notification.reload.read_at).to be_nil
     end
 
     it "does not advance the last-seen mark on a prefetch either" do
-      get plan_path(plan), headers: { "X-Sec-Purpose" => "prefetch" }
+      get plan_page_path(plan), headers: { "X-Sec-Purpose" => "prefetch" }
 
       expect(CoPlan::PlanViewer.where(plan: plan, user: alice)).not_to exist
     end
@@ -919,21 +918,18 @@ def alice_placement
       expect(alice_placement).to be_nil
     end
 
-    it "lets a non-author shelve a published plan in their own library" do
+    # A plan has one home, so filing someone else's published plan into
+    # your own library would be taking it, not bookmarking it.
+    it "refuses to move someone else's plan into your library" do
       bobs_folder = create(:folder, name: "Bobs Shelf", created_by_user: bob)
       sign_in_as(bob)
 
-      expect {
-        patch move_to_folder_plan_path(plan), params: { folder_id: bobs_folder.id }
-      }.not_to change(CoPlan::PlanEvent, :count) # curating someone else's shelf isn't a plan event
+      patch move_to_folder_plan_path(plan), params: { folder_id: bobs_folder.id }
 
-      placement = bob.library.placements.find_by(plan_id: plan.id)
-      expect(placement.folder).to eq(bobs_folder)
-      # Alice's own library is untouched.
-      expect(alice_placement).to be_nil
+      expect(CoPlan::PlanPlacement.where(plan_id: plan.id)).to be_empty
     end
 
-    it "refuses to shelve someone else's unlisted draft, even with the URL in hand" do
+    it "refuses to file someone else's unlisted draft, even with the URL in hand" do
       bobs_draft = create(:plan, :draft, created_by_user: bob)
 
       patch move_to_folder_plan_path(bobs_draft),
diff --git a/spec/requests/profiles_spec.rb b/spec/requests/profiles_spec.rb
index 575c240f..193bd495 100644
--- a/spec/requests/profiles_spec.rb
+++ b/spec/requests/profiles_spec.rb
@@ -1,97 +1,46 @@
 require "rails_helper"
 
+# A person's page and their library are one page: /<handle>. This file is
+# about the old /people/:id address still landing you there, and about
+# author links across the app pointing at it. What the page *shows* is
+# covered where it's rendered — see spec/requests/libraries_spec.rb.
 RSpec.describe "Profiles", type: :request do
   let(:viewer) { create(:coplan_user, name: "Vera Viewer") }
   let!(:author) { create(:coplan_user, name: "Ada Author", username: "ada.a", title: "Engineer", team: "Payments") }
 
-  before { sign_in_as(viewer) }
-
   describe "GET /people/:id" do
-    it "renders the profile by username, dots included" do
-      get profile_path("ada.a")
-      expect(response).to have_http_status(:ok)
-      expect(response.body).to include("Ada Author")
-      expect(response.body).to include("Engineer")
-      expect(response.body).to include("Payments")
-    end
-
-    it "renders the profile by user id" do
-      get profile_path(author.id)
-      expect(response).to have_http_status(:ok)
-      expect(response.body).to include("Ada Author")
-    end
-
-    it "404s for an unknown person" do
-      get profile_path("nobody-here")
-      expect(response).to have_http_status(:not_found)
-    end
-
-    it "lists published plans but never drafts or archived plans" do
-      create(:plan, :considering, created_by_user: author, title: "Public Work")
-      create(:plan, :draft, created_by_user: author, title: "Secret Draft")
-      create(:plan, :considering, created_by_user: author, title: "Old Work", archived_at: 1.day.ago)
+    before { sign_in_as(viewer) }
 
-      get profile_path(author.id)
-      expect(response.body).to include("Public Work")
-      expect(response.body).not_to include("Secret Draft")
-      expect(response.body).not_to include("Old Work")
-    end
-
-    it "hides your own drafts on your own profile too — a profile is a public shelf" do
-      create(:plan, :draft, created_by_user: viewer, title: "My Own Draft")
+    # A username can hold characters a handle can't — "ada.a" becomes the
+    # handle "ada-a" — so this is a translation, not a prefix trim.
+    it "301s a username link onto the person's library" do
+      get legacy_person_path("ada.a")
 
-      get profile_path(viewer.id)
-      expect(response.body).not_to include("My Own Draft")
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response).to redirect_to(browse_library_path(handle: "ada-a"))
     end
 
-    it "shows the library shelves with only publicly listed placements" do
-      folder = create(:folder, name: "Favorites", created_by_user: author)
-      shown = create(:plan, :considering, created_by_user: author, title: "Shelved Public")
-      hidden = create(:plan, :draft, created_by_user: author, title: "Shelved Draft")
-      CoPlan::Plans::Place.call(plan: shown, folder: folder, actor: author)
-      CoPlan::Plans::Place.call(plan: hidden, folder: folder, actor: author)
+    it "301s an id link onto the person's library" do
+      get legacy_person_path(author.id)
 
-      get profile_path(author.id)
-      expect(response.body).to include("Favorites")
-      expect(response.body).to include("Shelved Public")
-      expect(response.body).not_to include("Shelved Draft")
+      expect(response).to have_http_status(:moved_permanently)
+      expect(response).to redirect_to(browse_library_path(handle: "ada-a"))
     end
 
-    describe "directory adapter" do
-      after { CoPlan.configuration.directory_profile = nil }
-
-      it "overrides local fields and adds a directory link" do
-        CoPlan.configuration.directory_profile = ->(user) {
-          { title: "Staff Engineer", profile_url: "https://people.example.com/ada" }
-        }
-
-        get profile_path(author.id)
-        expect(response.body).to include("Staff Engineer")
-        expect(response.body).not_to include(">Engineer<")
-        expect(response.body).to include("https://people.example.com/ada")
-        expect(response.body).to include("View in directory")
-      end
-
-      it "falls back to the local profile when the hook raises" do
-        reported = []
-        allow(CoPlan.configuration).to receive(:error_reporter).and_return(->(e, ctx) { reported << e })
-        CoPlan.configuration.directory_profile = ->(user) { raise "directory down" }
-
-        get profile_path(author.id)
-        expect(response).to have_http_status(:ok)
-        expect(response.body).to include("Ada Author")
-        expect(response.body).to include("Engineer")
-        expect(reported.size).to eq(1)
-      end
+    it "404s for an unknown person" do
+      get legacy_person_path("nobody-here")
+      expect(response).to have_http_status(:not_found)
     end
   end
 
   describe "author links" do
-    it "links the plan header author name to their profile" do
+    before { sign_in_as(viewer) }
+
+    it "links the plan header author name to their library" do
       plan = create(:plan, :considering, created_by_user: author, title: "Linked Plan")
 
-      get plan_path(plan)
-      expect(response.body).to include(profile_path("ada.a"))
+      get plan_page_path(plan)
+      expect(response.body).to include(%(href="/ada-a"))
     end
   end
 end
diff --git a/spec/requests/search_spec.rb b/spec/requests/search_spec.rb
index 18dbd449..196432b6 100644
--- a/spec/requests/search_spec.rb
+++ b/spec/requests/search_spec.rb
@@ -8,8 +8,7 @@
   self.use_transactional_tests = false
 
   after do
-    truncate_tables(*%w[coplan_plan_tags coplan_tags coplan_plan_versions coplan_plans
-                        coplan_plan_types coplan_search_queries coplan_users])
+    truncate_plan_tables
   end
 
   let!(:alice) { create(:coplan_user, name: "Alice Searcher") }
@@ -74,12 +73,12 @@
         expect(response.body).to include("Nothing matches")
       end
 
-      it "finds people by name and links to their profile" do
+      it "finds people by name and links to their library" do
         create(:coplan_user, name: "Searchable Sam", username: "sam.s", title: "Designer")
 
         get search_path, params: { q: "searchable" }
         expect(response.body).to include("Searchable Sam")
-        expect(response.body).to include(profile_path("sam.s"))
+        expect(response.body).to include(%(href="/sam-s"))
         expect(response.body).to include("Designer")
       end
 
diff --git a/spec/services/coplan/plans/assign_slug_spec.rb b/spec/services/coplan/plans/assign_slug_spec.rb
new file mode 100644
index 00000000..63769d4b
--- /dev/null
+++ b/spec/services/coplan/plans/assign_slug_spec.rb
@@ -0,0 +1,180 @@
+require "rails_helper"
+
+RSpec.describe CoPlan::Plans::AssignSlug do
+  let(:author) { create(:coplan_user, username: "hampton") }
+  let(:library) { author.library }
+
+  def place(plan, folder)
+    CoPlan::Plans::Place.call(plan: plan, folder: folder, actor: author)
+    plan.reload
+  end
+
+  it "slugifies the title when there is nothing to strip" do
+    plan = create(:plan, :published, created_by_user: author, title: "Q3 Orders Roadmap")
+
+    expect(plan.slug).to eq("q3-orders-roadmap")
+    expect(plan.url_path).to eq("hampton/q3-orders-roadmap")
+  end
+
+  it "drops the folder name the URL has already said" do
+    folder = create(:folder, name: "LiveOrder", created_by_user: author)
+    plan = create(:plan, :published, created_by_user: author, title: "LiveOrder Cart Roadmap")
+
+    place(plan, folder)
+
+    expect(plan.slug).to eq("cart-roadmap")
+    expect(plan.url_path).to eq("hampton/liveorder/cart-roadmap")
+  end
+
+  it "matches the folder name regardless of how it was spaced" do
+    folder = create(:folder, name: "Live Order", created_by_user: author)
+    plan = create(:plan, :published, created_by_user: author, title: "LiveOrder Cart Roadmap")
+
+    place(plan, folder)
+
+    expect(plan.slug).to eq("cart-roadmap")
+  end
+
+  it "drops a trailing 'Plan', which says nothing in an app full of plans" do
+    plan = create(:plan, :published, created_by_user: author, title: "Fulfillment API Migration Plan")
+
+    expect(plan.slug).to eq("fulfillment-api-migration")
+  end
+
+  it "drops the library handle when the title repeats it" do
+    plan = create(:plan, :published, created_by_user: author, title: "Hampton Pricing Notes")
+
+    expect(plan.slug).to eq("pricing-notes")
+  end
+
+  it "keeps the full name rather than stripping to nothing" do
+    folder = create(:folder, name: "LiveOrder", created_by_user: author)
+    plan = create(:plan, :published, created_by_user: author, title: "LiveOrder")
+
+    place(plan, folder)
+
+    expect(plan.slug).to eq("liveorder")
+    expect(plan.url_path).to eq("hampton/liveorder/liveorder")
+  end
+
+  it "re-derives the slug when the plan moves into a folder that renames it" do
+    folder = create(:folder, name: "LiveOrder", created_by_user: author)
+    plan = create(:plan, :published, created_by_user: author, title: "LiveOrder Cart Roadmap")
+    expect(plan.slug).to eq("liveorder-cart-roadmap")
+
+    place(plan, folder)
+
+    expect(plan.slug).to eq("cart-roadmap")
+  end
+
+  describe "contested slugs" do
+    it "gives the second plan a suffix and leaves the first one clean" do
+      folder = create(:folder, name: "LiveOrder", created_by_user: author)
+      first = create(:plan, :published, created_by_user: author, title: "Cart Roadmap")
+      second = create(:plan, :published, created_by_user: author, title: "LiveOrder Cart Roadmap")
+
+      place(first, folder)
+      place(second, folder)
+
+      expect(first.slug_suffix).to be_nil
+      expect(first.url_path).to eq("hampton/liveorder/cart-roadmap")
+      expect(second.slug).to eq("cart-roadmap")
+      expect(second.slug_suffix).to be_present
+      expect(second.url_path).to match(%r{\Ahampton/liveorder/cart-roadmap~[a-z0-9]{4}\z})
+    end
+
+    it "leaves plans in different folders both clean" do
+      here = create(:folder, name: "Here", created_by_user: author)
+      there = create(:folder, name: "There", created_by_user: author)
+      first = create(:plan, :published, created_by_user: author, title: "Cart Roadmap")
+      second = create(:plan, :published, created_by_user: author, title: "Cart Roadmap")
+
+      place(first, here)
+      place(second, there)
+
+      expect(first.slug_suffix).to be_nil
+      expect(second.slug_suffix).to be_nil
+    end
+
+    # A folder wins the segment when both want it, so a plan sharing one
+    # would have no address at all. The plan is the one that moves.
+    it "steps around a sibling folder that already holds the segment" do
+      create(:folder, name: "Roadmap", created_by_user: author)
+      plan = create(:plan, :published, created_by_user: author, title: "Roadmap")
+
+      expect(plan.slug).to eq("roadmap")
+      expect(plan.slug_suffix).to be_present
+      expect(plan.url_path).to match(%r{\Ahampton/roadmap~[a-z0-9]{4}\z})
+    end
+
+    it "only steps around folders at its own level" do
+      parent = create(:folder, name: "Projects", created_by_user: author)
+      create(:folder, name: "Roadmap", parent: parent, created_by_user: author)
+      plan = create(:plan, :published, created_by_user: author, title: "Roadmap")
+
+      expect(plan.slug_suffix).to be_nil
+      expect(plan.url_path).to eq("hampton/roadmap")
+    end
+
+    # The other order: the plan was there first and the folder arrives. The
+    # segment changes hands — anyone following the old link lands on the
+    # folder that now owns that name, since a live page beats an alias —
+    # but the document keeps an address of its own instead of losing one.
+    it "re-slugs a plan a new folder would have shadowed" do
+      plan = create(:plan, :published, created_by_user: author, title: "Roadmap")
+      expect(plan.url_path).to eq("hampton/roadmap")
+
+      folder = create(:folder, name: "Roadmap", created_by_user: author)
+
+      expect(plan.reload.slug_suffix).to be_present
+      expect(plan.url_path).not_to eq(folder.url_path)
+      expect(CoPlan::Urls::Resolve.call(handle: "hampton", slug_path: plan.leaf_segment).plan).to eq(plan)
+    end
+
+    it "re-slugs a plan a folder rename would have shadowed" do
+      plan = create(:plan, :published, created_by_user: author, title: "Roadmap")
+      folder = create(:folder, name: "Plans", created_by_user: author)
+
+      folder.update!(name: "Roadmap")
+
+      expect(plan.reload.slug_suffix).to be_present
+    end
+
+    it "leaves a plan alone when the new folder is a level below it" do
+      parent = create(:folder, name: "Projects", created_by_user: author)
+      plan = create(:plan, :published, created_by_user: author, title: "Roadmap")
+
+      create(:folder, name: "Roadmap", parent: parent, created_by_user: author)
+
+      expect(plan.reload.slug_suffix).to be_nil
+    end
+  end
+
+  describe "aliases" do
+    it "records the old URL when a published plan is retitled" do
+      plan = create(:plan, :published, created_by_user: author, title: "Cart Roadmap")
+
+      plan.update!(title: "Basket Roadmap")
+
+      expect(CoPlan::UrlAlias.rewrite("hampton/cart-roadmap")).to eq("hampton/basket-roadmap")
+    end
+
+    it "does not record aliases for drafts nobody has linked yet" do
+      plan = create(:plan, :draft, created_by_user: author, title: "Cart Roadmap")
+
+      plan.update!(title: "Basket Roadmap")
+
+      expect(CoPlan::UrlAlias.rewrite("hampton/cart-roadmap")).to be_nil
+    end
+
+    it "records the old URL when a published plan moves" do
+      folder = create(:folder, name: "LiveOrder", created_by_user: author)
+      plan = create(:plan, :published, created_by_user: author, title: "Basket Roadmap")
+
+      place(plan, folder)
+
+      expect(CoPlan::UrlAlias.rewrite("hampton/basket-roadmap"))
+        .to eq("hampton/liveorder/basket-roadmap")
+    end
+  end
+end
diff --git a/spec/services/coplan/web_push/payload_for_notification_spec.rb b/spec/services/coplan/web_push/payload_for_notification_spec.rb
index 17bd63e6..1f6080a0 100644
--- a/spec/services/coplan/web_push/payload_for_notification_spec.rb
+++ b/spec/services/coplan/web_push/payload_for_notification_spec.rb
@@ -35,7 +35,13 @@ def notification_for(reason, comment_record: comment)
         title: "Alice replied on My Plan",
         tag: "comment-thread-#{thread.id}"
       )
-      expect(payload[:url]).to include("/plans/#{plan.id}").and include("thread=#{thread.id}")
+      # The document's readable address, with the thread deep link on it —
+      # a push notification is a link somebody keeps, so it gets the real
+      # URL rather than the legacy id form.
+      expect(payload[:url]).to eq(
+        CoPlan::Urls::Canonical.plan_path(plan, thread: thread.id)
+      )
+      expect(payload[:url]).to start_with("/#{plan.library.handle}/").and include("thread=#{thread.id}")
     end
 
     it "uses 'mentioned you' phrasing for mention notifications" do
diff --git a/spec/services/plans/place_spec.rb b/spec/services/plans/place_spec.rb
index 9789bc0e..354408a9 100644
--- a/spec/services/plans/place_spec.rb
+++ b/spec/services/plans/place_spec.rb
@@ -1,40 +1,39 @@
 require "rails_helper"
 
-# Plans::Place is the single write path for shelving — the web
+# Plans::Place is the single write path for filing — the web
 # drag-and-drop, the row menu, and the API all trust its guard rails.
 # The web move_to_folder endpoint has no authorize! of its own, so these
 # rejections ARE the security boundary.
+#
+# A plan lives in exactly one place, so every call here is a move.
 RSpec.describe CoPlan::Plans::Place do
   let(:author) { create(:coplan_user) }
   let(:other) { create(:coplan_user) }
   let(:folder) { create(:folder, created_by_user: author) }
 
   def place(plan:, folder:, actor:, library: nil)
-    described_class.call(plan: plan, folder: folder, actor: actor, library: library || actor.library)
+    described_class.call(plan: plan, folder: folder, actor: actor, library: library)
   end
 
-  it "shelves your own plan" do
+  it "files your own plan" do
     plan = create(:plan, :considering, created_by_user: author)
     result = place(plan: plan, folder: folder, actor: author)
     expect(result).to be_success
     expect(result.placement.folder).to eq(folder)
   end
 
-  it "shelves someone else's published plan (a placement, not a copy)" do
+  # The old model let you file someone else's published plan onto your own
+  # shelf — a second placement alongside the author's. There's only one
+  # place now, so doing that would take their document away from them.
+  it "refuses to move someone else's plan into your library" do
     plan = create(:plan, :published, created_by_user: other)
     result = place(plan: plan, folder: folder, actor: author)
-    expect(result).to be_success
-  end
-
-  it "refuses to shelve someone else's unlisted draft, even with the URL in hand" do
-    draft = create(:plan, :draft, created_by_user: other)
-    result = place(plan: draft, folder: folder, actor: author)
     expect(result).not_to be_success
-    expect(result.error).to include("shelved")
-    expect(author.library.placements.where(plan: draft)).to be_empty
+    expect(result.error).to include("plans you wrote")
+    expect(plan.reload.placement).to be_nil
   end
 
-  it "shelves your own draft (your library, your secret)" do
+  it "files your own draft (your library, your secret)" do
     draft = create(:plan, :draft, created_by_user: author)
     expect(place(plan: draft, folder: folder, actor: author)).to be_success
   end
@@ -43,40 +42,49 @@ def place(plan:, folder:, actor:, library: nil)
     plan = create(:plan, :considering, created_by_user: other)
     result = described_class.call(plan: plan, folder: folder, actor: other, library: author.library)
     expect(result).not_to be_success
-    expect(result.error).to include("your own library")
+    expect(result.error).to include("a library you own")
   end
 
   it "refuses a folder from a different library" do
     plan = create(:plan, :considering, created_by_user: author)
     foreign_folder = create(:folder, created_by_user: other)
-    result = place(plan: plan, folder: foreign_folder, actor: author)
+    result = described_class.call(plan: plan, folder: foreign_folder, actor: author,
+      library: author.library)
     expect(result).not_to be_success
     expect(result.error).to include("different library")
   end
 
-  it "always allows taking a plan off your own shelf, even if it stopped being listable" do
-    plan = create(:plan, :published, created_by_user: other)
+  it "lets you unfile your own plan even after it stopped being listable" do
+    plan = create(:plan, :published, created_by_user: author)
     place(plan: plan, folder: folder, actor: author)
 
-    # Simulate the plan later becoming unlisted to the shelver.
     plan.update_columns(visibility: "draft")
 
     result = place(plan: plan, folder: nil, actor: author)
     expect(result).to be_success
-    expect(author.library.placements.where(plan: plan)).to be_empty
+    expect(plan.reload.placement).to be_nil
   end
 
-  it "re-files rather than duplicating when the plan is already shelved" do
+  it "moves rather than duplicating when the plan is already filed" do
     plan = create(:plan, :considering, created_by_user: author)
     second_folder = create(:folder, created_by_user: author)
     place(plan: plan, folder: folder, actor: author)
     result = place(plan: plan, folder: second_folder, actor: author)
 
     expect(result).to be_success
-    expect(author.library.placements.where(plan: plan).count).to eq(1)
+    expect(CoPlan::PlanPlacement.where(plan: plan).count).to eq(1)
     expect(result.placement.folder).to eq(second_folder)
   end
 
+  it "cannot be filed in two places at once" do
+    plan = create(:plan, :considering, created_by_user: author)
+    place(plan: plan, folder: folder, actor: author)
+    second = build(:plan_placement, plan: plan, folder: create(:folder, created_by_user: author))
+
+    expect(second).not_to be_valid
+    expect(second.errors[:plan_id].join).to include("already filed")
+  end
+
   describe "library audit trail" do
     it "logs filed → moved → removed with paths and plan title" do
       plan = create(:plan, :considering, created_by_user: author, title: "Audited")
@@ -110,14 +118,6 @@ def place(plan:, folder:, actor:, library: nil)
       expect(plan.plan_events.sole.actor_type).to eq("local_agent")
     end
 
-    it "logs shelving someone else's plan in the library trail but not the plan's history" do
-      plan = create(:plan, :published, created_by_user: other)
-      place(plan: plan, folder: folder, actor: author)
-
-      expect(author.library.library_events.sole.event_type).to eq("plan_filed")
-      expect(plan.plan_events).to be_empty
-    end
-
     it "logs nothing when a re-file is a no-op" do
       plan = create(:plan, :considering, created_by_user: author)
       place(plan: plan, folder: folder, actor: author)
diff --git a/spec/support/browse_path_helpers.rb b/spec/support/browse_path_helpers.rb
new file mode 100644
index 00000000..0f677775
--- /dev/null
+++ b/spec/support/browse_path_helpers.rb
@@ -0,0 +1,20 @@
+module BrowsePathHelpers
+  # A plan's readable address — `/<handle>/<folders>/<slug>` — which is
+  # the document's URL now. `plan_path` still works and 301s here, so a
+  # spec that wants the page itself asks for this and skips the hop.
+  #
+  # Falls back to `plan_path` for a plan with no slug yet, matching what
+  # the app does: both forms have to work while slugs backfill.
+  def plan_page_path(plan, **options)
+    helpers = CoPlan::Engine.routes.url_helpers
+    path = plan.url_path
+    return helpers.plan_path(plan, **options) if path.blank?
+
+    handle, _, rest = path.partition("/")
+    helpers.browse_path(handle: handle, slug_path: rest, **options)
+  end
+end
+
+RSpec.configure do |config|
+  config.include BrowsePathHelpers
+end
diff --git a/spec/support/truncation_helpers.rb b/spec/support/truncation_helpers.rb
index a45cc057..7c651523 100644
--- a/spec/support/truncation_helpers.rb
+++ b/spec/support/truncation_helpers.rb
@@ -2,6 +2,32 @@
 # transactional fixtures (InnoDB FULLTEXT writes are invisible to
 # MATCH … AGAINST inside the same transaction) and so must clean up manually.
 module TruncationHelpers
+  # Everything a plan-and-author fixture touches, children before parents
+  # (only the SQLite branch below cares about the order).
+  #
+  # Libraries and folders belong here even though no such example reads
+  # them: a library handle is globally unique, so a leaked row keeps
+  # "alice" reserved and the *next* spec's alice quietly gets a different
+  # URL. Truncating users without them leaves exactly that orphan.
+  PLAN_TABLES = %w[
+    coplan_plan_tags
+    coplan_tags
+    coplan_plan_placements
+    coplan_plan_versions
+    coplan_plans
+    coplan_folders
+    coplan_library_events
+    coplan_libraries
+    coplan_url_aliases
+    coplan_plan_types
+    coplan_search_queries
+    coplan_users
+  ].freeze
+
+  def truncate_plan_tables
+    truncate_tables(*PLAN_TABLES)
+  end
+
   def truncate_tables(*tables)
     conn = ActiveRecord::Base.connection
     case conn.adapter_name
diff --git a/spec/system/comment_ux_spec.rb b/spec/system/comment_ux_spec.rb
index 38b142a9..846bd884 100644
--- a/spec/system/comment_ux_spec.rb
+++ b/spec/system/comment_ux_spec.rb
@@ -309,11 +309,11 @@ def create_anchored_thread(plan:, anchor_text:, body:, user:)
     it "opens a linked comment and exposes its permalink" do
       thread = create_anchored_thread(plan: plan, anchor_text: "microservices architecture", body: "Why not monolith?", user: reviewer)
 
-      visit plan_path(plan, thread: thread.id)
+      visit plan_page_path(plan, thread: thread.id)
 
       expect(page).to have_css(".thread-popover", visible: true)
       within(".thread-popover") do
-        expect(page).to have_link("Copy link", href: plan_path(plan, thread: thread.id))
+        expect(page).to have_link("Copy link", href: plan_page_path(plan, thread: thread.id))
         expect(page).to have_content("Why not monolith?")
         click_link "Copy link"
         expect(page).to have_link("Copied!")
@@ -334,7 +334,7 @@ def create_anchored_thread(plan:, anchor_text:, body:, user:)
         user: reviewer
       )
 
-      visit plan_path(plan, thread: thread.id)
+      visit plan_page_path(plan, thread: thread.id)
 
       expect(page).to have_css(".mermaid-diagram svg", wait: 10)
       expect(page).to have_css("#comment_thread_#{thread.id}_popover", visible: true)
diff --git a/spec/system/folders_workspace_spec.rb b/spec/system/folders_workspace_spec.rb
index 8582a43e..afd39133 100644
--- a/spec/system/folders_workspace_spec.rb
+++ b/spec/system/folders_workspace_spec.rb
@@ -63,22 +63,25 @@ def sign_in(user)
     end
 
     it "falls back to the plan's folder on Backspace after a cold open" do
-      # Direct visit = no in-app history. Backspace should land where the
-      # plan lives in the viewer's library, not the workspace root.
+      # Direct visit = no in-app history. Backspace should land on the
+      # folder the plan lives in — at its readable address, not the
+      # workspace root and not a folder-id query string.
       visit plan_path(foldered_plan)
       expect(page).to have_css("h1", text: "Q3 Launch Plan")
 
       find("body").send_keys(:backspace)
       expect(page).to have_css(".workspace-crumbs__crumb--current", text: "Q3")
-      expect(page).to have_current_path(plans_path(folder: q3.id))
+      expect(page).to have_current_path(browse_path(handle: author.library.handle, slug_path: q3.slug_path))
     end
 
     it "goes up to the plan's containing folder from the masthead and sticky nav" do
       foldered_plan.current_plan_version.update!(
         content_markdown: (1..30).map { |n| "## Section #{n}\n\nEnough content to scroll past the masthead." }.join("\n\n")
       )
-      location_path = library_path(author.library, folder: q3.id)
-      workspace_destination = plans_path(folder: q3.id)
+      # The masthead links straight at the canonical browsable path, so
+      # clicking it lands there with no redirect hop.
+      location_path = browse_path(handle: author.library.handle, slug_path: q3.slug_path)
+      workspace_destination = location_path
 
       visit plan_path(foldered_plan)
       masthead_location = find(".plan-location-link--masthead")
@@ -103,7 +106,9 @@ def sign_in(user)
       saved = create(:folder, name: "Saved by me", created_by_user: other)
       CoPlan::Plans::Place.call(plan: foldered_plan, folder: saved, actor: other)
       sign_in(other)
-      destination = library_path(author.library, folder: q3.id)
+      # The author's canonical path — a plan's location is where its author
+      # filed it, not where this viewer shelved it.
+      destination = browse_path(handle: author.library.handle, slug_path: q3.slug_path)
 
       visit plan_path(foldered_plan)
       location = find(".plan-location-link--masthead")
@@ -285,36 +290,21 @@ def sign_in(user)
       expect(author.library.placements.where(plan_id: developing_plan.id)).to be_empty
     end
 
-    it "saves and lets go of someone else's plan through the navigator, never a surprise toggle" do
+    # Reading someone else's plan offers no filing control at all: it lives
+    # in their library, and a plan has only the one home.
+    it "offers no way to file someone else's plan into your library" do
       other_plan = create(:plan, :considering, created_by_user: other, title: "Someone Elses Plan")
-      visit plans_path(scope: "all")
 
-      # The row drags into your library like any of your own…
-      row = find(".plan-row[data-plan-id='#{other_plan.id}']")
-      expect(row["draggable"]).to eq("true")
-
-      # …and the plan page offers a labeled Save that opens the navigator.
       visit plan_path(other_plan)
-      click_button "Save"
-      within("#folder-picker-modal") do
-        expect(page).to have_css("#folder-picker-title", text: "Save to library")
-        find(".folder-picker__option", text: "Infra").click
+      expect(page).to have_css("h1", text: "Someone Elses Plan")
+      within("#plan-toolbar") do
+        expect(page).not_to have_button("Save")
+        expect(page).not_to have_button("Saved")
       end
 
-      expect(page).to have_css(".flash--notice", text: "Infra", wait: 5)
-      expect(page).to have_button("Saved")
-      expect(author.library.placements.find_by(plan_id: other_plan.id).folder).to eq(infra)
-
-      # Clicking Saved re-opens the navigator — removal is a deliberate
-      # labeled choice inside it, not an instant unsave on the button.
-      click_button "Saved"
-      within("#folder-picker-modal") do
-        expect(page).to have_css(".folder-picker__option--current", text: "Infra")
-        click_button "Remove from library"
-      end
-
-      expect(page).to have_button("Save", wait: 5)
-      expect(author.library.placements.where(plan_id: other_plan.id)).to be_empty
+      find("#plan-toolbar button[aria-label='More actions']").click
+      within("#plan-menu") { expect(page).not_to have_button("Move to folder…") }
+      expect(CoPlan::PlanPlacement.where(plan_id: other_plan.id)).to be_empty
     end
   end
 
@@ -380,7 +370,7 @@ def fire_drag_event(element, type)
       expect(page).to have_css(".flash--notice", wait: 5)
       expect(author.library.placements.find_by(plan_id: developing_plan.id).folder).to eq(q3)
       # The drop leaves you where you dropped — inside Q3, for real.
-      expect(page).to have_current_path(plans_path(folder: q3.id), wait: 5)
+      expect(page).to have_current_path(browse_path(handle: author.library.handle, slug_path: q3.slug_path), wait: 5)
     end
 
     it "restores the original pane when a tunneled drag ends without a drop" do
diff --git a/spec/system/human_editing_spec.rb b/spec/system/human_editing_spec.rb
index c8ee0f9f..66dbb9c0 100644
--- a/spec/system/human_editing_spec.rb
+++ b/spec/system/human_editing_spec.rb
@@ -35,7 +35,7 @@ def sign_in(user)
     fill_in "change_summary", with: "Browser edit"
     click_button "Save new version"
 
-    expect(page).to have_current_path(plan_path(plan))
+    expect(page).to have_current_path(plan_page_path(plan))
     expect(page).to have_content("Plan updated.")
     expect(page).to have_content("Revised body from the browser.")
 
@@ -59,9 +59,9 @@ def sign_in(user)
     find("#plan_tag_field").send_keys("api-design", :enter)
     click_button "Save new version"
 
-    expect(page).to have_current_path(plan_path(plan))
     expect(page).to have_content("Plan updated.")
-    plan.reload
+    # Retitling reslugs the document, so its address moved with it.
+    expect(page).to have_current_path(plan_page_path(plan.reload))
     expect(plan.title).to eq("Renamed In Editor")
     expect(plan.tag_names).to contain_exactly("security", "api-design")
   end
@@ -140,9 +140,12 @@ def open_plan_menu
 
     visit plan_path(plan)
     expect(page).to have_content("Editable Plan")
+    # A reader gets the overflow menu and nothing else. There used to be a
+    # Save here that filed the plan onto their own shelf; a plan lives in
+    # one place now, so reading one is just reading it.
     within("#plan-toolbar") do
       expect(page).not_to have_link("Edit")
-      expect(page).to have_button("Save")
+      expect(page).not_to have_button("Save")
     end
     # The reader's overflow menu is History only — no state-changing actions.
     open_plan_menu