diff --git a/package.json b/package.json
index 84430d3..c83f57d 100644
--- a/package.json
+++ b/package.json
@@ -12,6 +12,7 @@
     "prebuild": "npm run gen:llms",
     "build": "tsc -b && vite build",
     "lint": "eslint .",
+    "test": "node --test \"src/**/*.test.ts\"",
     "preview": "vite preview",
     "sync:thinly": "node scripts/sync-to-thinly.mjs",
     "build:thinly": "npm run build && npm run sync:thinly"
diff --git a/src/levelcode/next.test.ts b/src/levelcode/next.test.ts
new file mode 100644
index 0000000..d73733b
--- /dev/null
+++ b/src/levelcode/next.test.ts
@@ -0,0 +1,216 @@
+// node --test (npm test). `next`: which pages a sign-in may land on, and which it ignores.
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { loginRoute, NEXT_MAX, safeNext, signedInDestination, type WebEditorAnswer } from "./next.ts";
+
+describe("safeNext", () => {
+  const accepted: Array<[string, string]> = [
+    ["/ai/account", "an auth-gated page"],
+    ["/ai/admin/referrals", "a nested page"],
+    ["/ai/pricing?plan=pro", "a query is kept"],
+    ["/ai/account?checkout=changed&x=1", "a query with several keys"],
+    ["/ai/docs/cloud", "a docs page"],
+    ["/ai/x", "the shortest: one character after /ai/"],
+    ["/ai/docs/a.b", "a dot inside a name is not a dot segment"],
+    ["/ai/docs/...", "three dots are a name, not a dot segment"],
+    ["/ai/docs?q=a%20b", "a percent escape that is not a separator"],
+    ["/ai/pricing?next=/ai/account", "a single slash inside the query"],
+    ["/ai/%252F%252Fevil.example", "double-encoded: a literal path under /ai/; nothing after /ai/ can make it start //"],
+    ["/ai/" + "a".repeat(NEXT_MAX - 4), "exactly the longest"],
+    ["/ai/csrfx", "a name that starts like an endpoint's is not that endpoint"],
+    ["/ai/docs/auth", "an endpoint's name further down is a page's"],
+  ];
+  for (const [raw, why] of accepted) {
+    test(`takes ${JSON.stringify(raw.length > 40 ? raw.slice(0, 40) + "…" : raw)}: ${why}`, () => {
+      assert.equal(safeNext(raw), raw);
+      // What a browser makes of it: a page of this site, under /ai/.
+      const url = new URL(raw, "https://levelcode.ai");
+      assert.equal(url.origin, "https://levelcode.ai");
+      assert.ok(url.pathname.startsWith("/ai/"), url.pathname);
+    });
+  }
+
+  const refused: Array<[unknown, string]> = [
+    // Not a string, or nothing
+    [null, "absent"],
+    [undefined, "absent"],
+    [42, "a number"],
+    [["/ai/account"], "an array (a repeated query key)"],
+    [{ toString: () => "/ai/account" }, "an object that stringifies to a page"],
+    ["", "empty"],
+    // Not under /ai/
+    ["/ai/", "the prefix alone"],
+    ["/ai", "the landing without its slash"],
+    ["/ai?x=1", "the landing's query"],
+    ["/aisle", "a lookalike prefix"],
+    ["/other/path", "another part of the site"],
+    ["/", "the root"],
+    ["ai/account", "relative"],
+    ["account", "relative"],
+    // Another origin, in any spelling
+    ["//evil.example", "protocol-relative"],
+    ["//evil.example/ai/account", "protocol-relative, with an /ai/ path"],
+    ["https://evil.example/ai/account", "absolute, another host"],
+    ["https://levelcode.ai/ai/account", "absolute, even this host: a next is a path"],
+    ["javascript:alert(1)", "a script URL"],
+    ["/\\evil.example", "a backslash is a slash to a browser"],
+    ["/ai/\\evil.example", "a backslash after the prefix"],
+    ["/ai\\account", "a backslash in place of the slash"],
+    // Doubled slashes anywhere
+    ["/ai//x", "doubled after the prefix"],
+    ["/ai/x//y", "doubled further in"],
+    ["/ai/pricing?u=//evil.example", "doubled in the query"],
+    // Percent-encoded separators
+    ["/ai/%2F%2Fevil", "encoded slashes"],
+    ["/ai/%2f%2fevil", "encoded slashes, lower case"],
+    ["/ai/%2Fx", "one encoded slash"],
+    ["/ai/x?u=%2F%2Fevil", "encoded slashes in the query"],
+    ["/ai/%5Cevil", "an encoded backslash"],
+    ["/ai/%5cevil", "an encoded backslash, lower case"],
+    // Dot segments, plain or encoded: a browser resolves them
+    ["/ai/../account", "a parent segment"],
+    ["/ai/./account", "a current segment"],
+    ["/ai/docs/..", "a trailing parent segment"],
+    ["/ai/docs/../../x", "climbing out of /ai/"],
+    ["/ai/%2e%2e/account", "an encoded parent segment"],
+    ["/ai/%2E%2E/account", "an encoded parent segment, upper case"],
+    ["/ai/.%2e/account", "half encoded"],
+    ["/ai/%2e/account", "an encoded current segment"],
+    // The server's own endpoints: not pages — in every spelling its router answers
+    ["/ai/auth/handoff?code=x", "the editor's account hand-off"],
+    ["/ai/auth/oauth/github", "an OAuth start"],
+    ["/ai/csrf", "the CSRF token endpoint"],
+    ["/ai/csrf.json", "the endpoint with a format suffix (Rails routes take one)"],
+    ["/ai/csrf/", "the endpoint with a trailing slash"],
+    ["/ai/csrf?x=1", "the endpoint with a query"],
+    ["/ai/%63srf", "the endpoint with an encoded letter"],
+    ["/ai/CSRF", "the endpoint in capitals"],
+    ["/ai/auth.json/handoff", "auth with a format suffix"],
+    ["/ai/%61uth/handoff?code=x", "auth with an encoded letter"],
+    ["/ai/checkout%A9", "an endpoint's name before an escape that does not decode"],
+    ["/ai/authorize_editor", "a POST endpoint"],
+    ["/ai/checkout", "a POST endpoint"],
+    ["/ai/billing", "a POST endpoint"],
+    ["/ai/signout", "a POST endpoint"],
+    // Fragments
+    ["/ai/account#billing", "a fragment"],
+    ["/ai/account#", "an empty fragment"],
+    // Whitespace and control characters
+    ["/ai/acc ount", "a space"],
+    ["/ai/account\t", "a tab"],
+    ["/ai/account\n", "a newline"],
+    ["/ai/account\r\nSet-Cookie: x=1", "a header-injection attempt"],
+    ["/ai/a\u0000", "NUL"],
+    ["/ai/a\u007f", "DEL"],
+    ["/ai/a\u0085", "a C1 control"],
+    ["/ai/a\u00a0", "a no-break space"],
+    ["/ai/a\u2028", "a line separator"],
+    ["/ai/a\u200b", "a zero-width space"],
+    ["/ai/a\u202e", "a right-to-left override"],
+    [" /ai/account", "leading whitespace"],
+    // Characters RFC 3986 does not allow unescaped, and broken escapes
+    ["/ai/\u00e9", "non-ASCII"],
+    ["/ai/<script>", "angle brackets"],
+    ['/ai/"x"', "quotes"],
+    ["/ai/a|b", "a pipe"],
+    ["/ai/{x}", "braces"],
+    ["/ai/%zz", "a broken escape"],
+    ["/ai/%2", "a truncated escape"],
+    // Too long
+    ["/ai/" + "a".repeat(NEXT_MAX - 3), "one character over the limit"],
+  ];
+  for (const [raw, why] of refused) {
+    const shown = typeof raw === "string" ? JSON.stringify(raw.length > 40 ? raw.slice(0, 40) + "…" : raw) : String(raw);
+    test(`ignores ${shown}: ${why}`, () => {
+      assert.equal(safeNext(raw), null);
+    });
+  }
+});
+
+describe("loginRoute", () => {
+  /** The `next` the login page will read from a route loginRoute built. */
+  const nextOf = (route: string) => new URL(route, "https://levelcode.ai/ai/").searchParams.get("next");
+
+  test("a plain sign-in carries no next", () => {
+    assert.equal(loginRoute(), "/login");
+    assert.equal(loginRoute(null), "/login");
+  });
+
+  test("a page comes back to the login page exactly as it went in", () => {
+    for (const page of ["/ai/account", "/ai/pricing?plan=pro", "/ai/admin/referrals", "/ai/account?checkout=changed&x=1"]) {
+      const route = loginRoute(page);
+      assert.ok(route.startsWith("/login?next="), route);
+      assert.equal(nextOf(route), page);
+    }
+  });
+
+  test("a page that is not a valid next is dropped", () => {
+    for (const page of ["/ai/", "/ai//x", "/ai/%2F%2Fevil", "/ai/account#billing", "/web", ""]) {
+      assert.equal(loginRoute(page), "/login", page);
+    }
+  });
+});
+
+describe("signedInDestination", () => {
+  const EDITOR_URL = "https://app.levelcode.example/?signin=1";
+  const ON: WebEditorAnswer = { enabled: true, url: EDITOR_URL, loading: false };
+  const OFF: WebEditorAnswer = { enabled: false, url: null, loading: false };
+  const LOADING: WebEditorAnswer = { enabled: false, url: null, loading: true };
+
+  test("an editor signing in wins over next and the browser edition", () => {
+    for (const webEditor of [ON, OFF, LOADING]) {
+      for (const next of [null, "/ai/pricing"]) {
+        assert.deepEqual(signedInDestination({ editorSigningIn: true, next, webEditor }), { kind: "editor" });
+      }
+    }
+  });
+
+  test("next wins over the browser edition, as a route under the /ai basename", () => {
+    for (const webEditor of [ON, OFF]) {
+      assert.deepEqual(signedInDestination({ editorSigningIn: false, next: "/ai/pricing?plan=pro", webEditor }), {
+        kind: "route",
+        to: "/pricing?plan=pro",
+      });
+    }
+  });
+
+  test("next does not wait for the browser edition's answer", () => {
+    assert.deepEqual(signedInDestination({ editorSigningIn: false, next: "/ai/account", webEditor: LOADING }), {
+      kind: "route",
+      to: "/account",
+    });
+  });
+
+  test("with no next, it waits for the browser edition's answer", () => {
+    assert.deepEqual(signedInDestination({ editorSigningIn: false, next: null, webEditor: LOADING }), { kind: "wait" });
+  });
+
+  test("with no next and the browser edition on, it is the editor's address as given", () => {
+    assert.deepEqual(signedInDestination({ editorSigningIn: false, next: null, webEditor: ON }), {
+      kind: "href",
+      to: EDITOR_URL,
+    });
+  });
+
+  test("with no next and the browser edition off, it is the account page", () => {
+    assert.deepEqual(signedInDestination({ editorSigningIn: false, next: null, webEditor: OFF }), {
+      kind: "route",
+      to: "/account",
+    });
+  });
+
+  test("enabled with no address counts as off", () => {
+    const webEditor = { enabled: true, url: null, loading: false };
+    assert.deepEqual(signedInDestination({ editorSigningIn: false, next: null, webEditor }), {
+      kind: "route",
+      to: "/account",
+    });
+  });
+
+  test("a next that is not valid counts as absent", () => {
+    for (const next of ["//evil.example", "https://evil.example/", "/ai/%2F%2Fevil", "/other"]) {
+      assert.deepEqual(signedInDestination({ editorSigningIn: false, next, webEditor: ON }), { kind: "href", to: EDITOR_URL }, next);
+      assert.deepEqual(signedInDestination({ editorSigningIn: false, next, webEditor: OFF }), { kind: "route", to: "/account" }, next);
+    }
+  });
+});
diff --git a/src/levelcode/next.ts b/src/levelcode/next.ts
new file mode 100644
index 0000000..99218bd
--- /dev/null
+++ b/src/levelcode/next.ts
@@ -0,0 +1,140 @@
+// Where a sign-in on this site lands, and `next`: the page of this site a visitor asked for before
+// being sent to sign in.
+//
+// A sign-in that is not an editor's lands on (the backend decides, POST /ai/auth/verify and the
+// OAuth callback; this file is the SPA's side of the same contract):
+//   1. `next`, when it is a valid page of this site (safeNext);
+//   2. else the browser edition, when it is switched on (useWebEditor's address, `?signin=1`);
+//   3. else /ai/account.
+// An editor signing in (redirect_uri + code_challenge) always wins, and `next` is not sent with it.
+//
+// This module imports nothing, so `node --test` can load it as it is (see next.test.ts).
+
+const SITE = "https://levelcode.ai";
+const PREFIX = "/ai/";
+
+/** The longest `next` that is taken. The backend uses the same bound. */
+export const NEXT_MAX = 512;
+
+// The characters RFC 3986 allows in a path and a query, and nothing else: letters, digits,
+// - . _ ~ ! $ & ' ( ) * + , ; = : @ / ? and a percent escape. That alone keeps out whitespace,
+// control characters, a backslash, a fragment (#) and anything outside ASCII.
+const PATH_AND_QUERY = /^(?:[A-Za-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9A-Fa-f]{2})+$/;
+
+// A percent-encoded / or \. Its only use in a `next` is to get a separator past a check: any layer
+// that decodes the value once would turn `/ai/%2F%2Fevil.example` into `/ai///evil.example`.
+const ENCODED_SEPARATOR = /%2f|%5c/i;
+
+// What the backend serves under /ai/ itself (thin.ly config/routes.rb, the "ai" scope): not pages to land on.
+// Rails answers each with a format suffix (`.json`) and a trailing slash too, so a name is compared after
+// decoding it, in lower case, and cut at the first character a route name does not have.
+const SERVER_NAMES = new Set(["auth", "authorize_editor", "checkout", "billing", "signout", "csrf"]);
+
+/**
+ * `raw` if it is a page of this site to land on after signing in, else null (treated as absent).
+ *
+ * Valid: a string of 5 to 512 characters that starts with `/ai/` and is a plain path, optionally
+ * with a query (`/ai/pricing?plan=pro`). Refused: anything else, including
+ *   - another origin in any spelling: `https://…`, `//host`, `/\host`, `javascript:…`;
+ *   - `//` anywhere, a backslash, a fragment (`#…`), whitespace or a control character;
+ *   - a character RFC 3986 does not allow unescaped (`<`, `"`, `|`, non-ASCII, …) or a broken `%` escape;
+ *   - a percent-encoded slash or backslash (`%2F`, `%5C`, any case);
+ *   - a dot segment, plain or percent-encoded (`/ai/../x`, `/ai/%2e%2e/x`): a browser resolves both,
+ *     and the page would no longer be the one under /ai/ that was checked;
+ *   - the server's own endpoints (SERVER_NAMES), in any spelling its router answers: /ai/csrf, /ai/csrf.json,
+ *     /ai/csrf/, /ai/%63srf, /ai/CSRF, /ai/auth/…: they are not pages (the backend refuses them too).
+ * A double-encoded value such as `/ai/%252F` is accepted: it is a literal path under /ai/, and since
+ * the value must begin with the literal `/ai/`, no decoding of what follows can make it start `//`.
+ */
+export function safeNext(raw: unknown): string | null {
+  if (typeof raw !== "string") return null;
+  if (raw.length <= PREFIX.length || raw.length > NEXT_MAX) return null;
+  if (!raw.startsWith(PREFIX)) return null;
+  if (!PATH_AND_QUERY.test(raw)) return null;
+  if (raw.includes("//") || ENCODED_SEPARATOR.test(raw)) return null;
+
+  const path = raw.split("?", 1)[0];
+  if (path.split("/").some((segment) => isDotSegment(segment))) return null;
+  if (isServerName(path.split("/")[2] ?? "")) return null;
+
+  // The contract's own words: parsed against this site, it stays on this site, under /ai/. The rules above
+  // already make that so (a literal /ai/ prefix, no //, backslash or dot segment); this guards them.
+  let url: URL;
+  try {
+    url = new URL(raw, SITE);
+  } catch {
+    return null;
+  }
+  if (url.origin !== SITE || !url.pathname.startsWith(PREFIX)) return null;
+
+  return raw;
+}
+
+/** Is this first segment after /ai/ one of the backend's own endpoints, as written or decoded? A name is read as
+ *  the router would: in lower case, up to the first character that is not a letter, digit or underscore
+ *  (`csrf.json` and `csrf;x` are `csrf`). Read both ways, `%63srf` and `checkout%A9` are endpoints too. */
+function isServerName(segment: string): boolean {
+  const name = (s: string) => (/^[a-z0-9_]*/.exec(s.toLowerCase()) ?? [""])[0];
+  if (SERVER_NAMES.has(name(segment))) return true;
+  try {
+    return SERVER_NAMES.has(name(decodeURIComponent(segment)));
+  } catch {
+    return false; // not decodable: it is read as written, above
+  }
+}
+
+function isDotSegment(segment: string): boolean {
+  const s = segment.replace(/%2e/gi, ".");
+  return s === "." || s === "..";
+}
+
+/** The page the visitor is on now, as a `next` would name it (`/ai/account?checkout=changed`). */
+export function currentPage(): string {
+  return window.location.pathname + window.location.search;
+}
+
+/**
+ * The sign-in page's route (relative to the router's /ai basename), bringing the visitor back to
+ * `page` afterwards. A `page` that is not a valid `next` is dropped, and the visitor lands wherever
+ * any sign-in does. Leave `page` out for a plain "Sign in".
+ */
+export function loginRoute(page?: string | null): string {
+  const next = safeNext(page);
+  return next ? `/login?${new URLSearchParams({ next })}` : "/login";
+}
+
+export type WebEditorAnswer = { enabled: boolean; url: string | null; loading: boolean };
+
+export type SignedInDestination =
+  /** An editor is signing in: mint it a code (the login page's existing flow). */
+  | { kind: "editor" }
+  /** Not known yet: the browser edition's answer is still loading. */
+  | { kind: "wait" }
+  /** A page of this app, as a route relative to the /ai basename. */
+  | { kind: "route"; to: string }
+  /** The browser edition, on its own origin: a full-page navigation. */
+  | { kind: "href"; to: string };
+
+/**
+ * Where the login page sends a visitor who is ALREADY signed in, in the same order as a sign-in
+ * lands (see the top of this file). `webEditor` is useWebEditor's answer, which has already refused
+ * any address it would not link to.
+ */
+export function signedInDestination({
+  editorSigningIn,
+  next,
+  webEditor,
+}: {
+  editorSigningIn: boolean;
+  next: string | null;
+  webEditor: WebEditorAnswer;
+}): SignedInDestination {
+  if (editorSigningIn) return { kind: "editor" };
+
+  const page = safeNext(next);
+  if (page) return { kind: "route", to: page.slice(PREFIX.length - 1) };
+
+  if (webEditor.loading) return { kind: "wait" };
+  if (webEditor.enabled && webEditor.url) return { kind: "href", to: webEditor.url };
+  return { kind: "route", to: "/account" };
+}
diff --git a/src/levelcode/pages/AccountPage.tsx b/src/levelcode/pages/AccountPage.tsx
index 4b52d96..e0e25fe 100644
--- a/src/levelcode/pages/AccountPage.tsx
+++ b/src/levelcode/pages/AccountPage.tsx
@@ -5,10 +5,12 @@ import { useSession } from "../auth";
 import ClassicShell from "../components/classic/ClassicShell";
 import ContributionsHeatmap from "./ContributionsHeatmap";
 import { fmtCredits, fmtCreditAmount, toCredits, LOCALE } from "../credits";
+import { currentPage, loginRoute } from "../next";
 import { useWebEditor } from "../useWebEditor";
 
 // Usage dashboard (SPEC §8 / §3 GET /account/usage). Session-gated: redirects to
-// /ai/login when the Devise session probe comes back empty.
+// /ai/login when the Devise session probe comes back empty, with `next` naming this
+// page so the sign-in comes back here.
 export default function AccountPage() {
   const navigate = useNavigate();
   const { loading: sessionLoading, profile } = useSession();
@@ -20,7 +22,7 @@ export default function AccountPage() {
   const [error, setError] = useState<string | null>(null);
 
   useEffect(() => {
-    if (!sessionLoading && !profile) navigate("/login", { replace: true });
+    if (!sessionLoading && !profile) navigate(loginRoute(currentPage()), { replace: true });
   }, [sessionLoading, profile, navigate]);
 
   useEffect(() => {
@@ -85,7 +87,7 @@ export default function AccountPage() {
     } catch {
       /* ignore — clear locally regardless */
     }
-    navigate("/login", { replace: true });
+    navigate("/login", { replace: true }); // a plain sign-in page: no `next` back to the account just left
   }
 
   // While the session resolves (or is absent, pre-redirect), keep the frame.
diff --git a/src/levelcode/pages/AdminPage.tsx b/src/levelcode/pages/AdminPage.tsx
index dac0d40..38773af 100644
--- a/src/levelcode/pages/AdminPage.tsx
+++ b/src/levelcode/pages/AdminPage.tsx
@@ -3,6 +3,7 @@ import { Link, useNavigate } from "react-router-dom";
 import { api, type AdminSummary, type AdminUsers } from "../api";
 import { useSession } from "../auth";
 import ClassicShell from "../components/classic/ClassicShell";
+import { currentPage, loginRoute } from "../next";
 
 type SortKey = "input" | "output" | "requests" | "cost" | "auth_attempts" | "auth_failures" | "last_seen" | "email" | "plan";
 
@@ -25,7 +26,7 @@ export default function AdminPage() {
   // Non-admins (or signed-out) never see this surface.
   useEffect(() => {
     if (sessionLoading) return;
-    if (!profile) navigate("/login", { replace: true });
+    if (!profile) navigate(loginRoute(currentPage()), { replace: true });
     else if (!isAdmin) navigate("/account", { replace: true });
   }, [sessionLoading, profile, isAdmin, navigate]);
 
diff --git a/src/levelcode/pages/EmailSignIn.tsx b/src/levelcode/pages/EmailSignIn.tsx
index bf08f75..8ba200f 100644
--- a/src/levelcode/pages/EmailSignIn.tsx
+++ b/src/levelcode/pages/EmailSignIn.tsx
@@ -1,18 +1,23 @@
 import { useState } from "react";
 import { api, ApiError, navigateTo } from "../api";
 import { getAttribution } from "../attribution";
+import { verifyBody } from "../signInRequests";
 
 // Passwordless email + one-time-code sign-in (OpenRouter/Cursor style):
 //   1. enter email → POST /ai/auth/email        (Rails emails a 6-digit code)
-//   2. enter code  → POST /ai/auth/verify → { redirect }  (editor deep-link or /ai/account)
+//   2. enter code  → POST /ai/auth/verify → { redirect }
+//      (an editor signing in: its callback; otherwise where a web sign-in lands — see next.ts)
 // redirectUri + codeChallenge (from the editor) are threaded through so the
-// one-time handoff code is bound to the editor's PKCE verifier.
+// one-time handoff code is bound to the editor's PKCE verifier. `next` is the
+// page the visitor asked for; it is sent only on a web sign-in, and only when valid.
 export default function EmailSignIn({
   redirectUri,
   codeChallenge,
+  next,
 }: {
   redirectUri?: string;
   codeChallenge?: string;
+  next?: string | null;
 }) {
   const [step, setStep] = useState<"email" | "code">("email");
   const [email, setEmail] = useState("");
@@ -40,15 +45,15 @@ export default function EmailSignIn({
     setError(null);
     try {
       const d = await api<{ redirect?: string }>("/ai/auth/verify", {
-        // attribution: first-touch campaign channel (null for organic sign-ins) so the backend can record
-        // which channel acquired a new account. Harmless if the backend doesn't consume it yet.
-        body: { email, code, redirect_uri: redirectUri, code_challenge: codeChallenge, attribution: getAttribution() },
+        body: verifyBody(email, code, { redirectUri, codeChallenge, next }, getAttribution()),
       });
       if (!d.redirect) throw new ApiError(422, "That code is invalid or has expired.");
 
-      // A path (/ai/account) → in-app navigation; an http(s) address is the browser edition's callback page
-      // (the tab simply goes there and the editor is back in it); anything else is the desktop editor's
-      // custom-scheme deep-link (levelcode://…) — scheme-agnostic so it survives the editor's urlProtocol rename.
+      // A path is a page of this site (`next`, or /ai/account). An http(s) address is the browser edition, on
+      // its own origin: its callback page when it is the editor signing in, or the editor itself (`?signin=1`)
+      // after a web sign-in while the edition is on. Either way the tab simply goes there. Anything else is the
+      // desktop editor's custom-scheme deep-link (levelcode://…) — scheme-agnostic so it survives the editor's
+      // urlProtocol rename.
       if (!d.redirect.startsWith("/") && !/^https?:\/\//i.test(d.redirect)) {
         // Editor deep-link (custom scheme): navigating to it is a no-op if the
         // editor isn't installed on this device — arm a fallback so the button
@@ -63,7 +68,7 @@ export default function EmailSignIn({
         return;
       }
 
-      navigateTo(d.redirect); // web: full-page nav to /ai/account (session cookie now set)
+      navigateTo(d.redirect); // a page of this site or the browser edition: full-page nav (session cookie now set)
     } catch (err) {
       setError(err instanceof ApiError ? err.message : "That code is invalid or has expired.");
       setBusy(false);
diff --git a/src/levelcode/pages/LandingPage.tsx b/src/levelcode/pages/LandingPage.tsx
index 12cac3b..f0a5e3b 100644
--- a/src/levelcode/pages/LandingPage.tsx
+++ b/src/levelcode/pages/LandingPage.tsx
@@ -206,7 +206,7 @@ export default function LandingPage() {
                 {isMac ? (
                   <PrimaryAction isMac profile={profile} fullWidth />
                 ) : (
-                  // Signing in does not get anyone the editor, so on a device that cannot run it
+                  // Signing in does not install the editor, so on a device that cannot run the Mac app
                   // this card points at how to get started rather than repeating the hero's action.
                   <Link to="/docs/quickstart" className="lp-cta lp-cta--quiet w-full">
                     Read the quickstart
diff --git a/src/levelcode/pages/LoginPage.tsx b/src/levelcode/pages/LoginPage.tsx
index d5d0a36..619d3e5 100644
--- a/src/levelcode/pages/LoginPage.tsx
+++ b/src/levelcode/pages/LoginPage.tsx
@@ -3,6 +3,8 @@ import { Link, useNavigate, useSearchParams } from "react-router-dom";
 import { api, navigateTo } from "../api";
 import { useSession } from "../auth";
 import ClassicShell, { ChevronMark } from "../components/classic/ClassicShell";
+import { safeNext, signedInDestination } from "../next";
+import { useWebEditor } from "../useWebEditor";
 import EmailSignIn from "./EmailSignIn";
 import ProviderSignIn from "./ProviderSignIn";
 
@@ -27,11 +29,21 @@ export default function LoginPage() {
   const fromEditor = !!editorHandoff;
   // The browser edition's callback is a page in this very tab; the desktop editor's is a deep link to an app.
   const toBrowserEditor = !!editorHandoff && /^https?:\/\//i.test(editorHandoff.redirectUri);
+  // The page of this site the visitor asked for before being sent here (an auth-gated page, a checkout).
+  // Anything that is not a valid one is treated as absent, and an editor signing in ignores it.
+  const next = safeNext(params.get("next"));
 
   const { loading: sessionLoading, profile } = useSession();
+  const webEditor = useWebEditor();
   // idle: probing session / about to redirect · completing: minting an editor code · form: show sign-in.
   const [phase, setPhase] = useState<"idle" | "completing" | "form">("idle");
 
+  // Where a visitor who is already signed in goes (see next.ts). Taken apart into plain values for the
+  // effect below: while an editor is signing in they never change, so the code it mints is minted once.
+  const destination = signedInDestination({ editorSigningIn: fromEditor, next, webEditor });
+  const destinationKind = destination.kind;
+  const destinationTo = "to" in destination ? destination.to : null;
+
   useEffect(() => {
     if (sessionLoading) return;
 
@@ -63,9 +75,13 @@ export default function LoginPage() {
       };
     }
 
-    // Signed in on a plain web visit → the login page is pointless; go straight to the dashboard.
-    navigate("/account", { replace: true });
-  }, [sessionLoading, profile, redirectUri, codeChallenge, navigate]);
+    // Signed in on a plain web visit → the login page is pointless. Go to the page they asked for, else to
+    // the browser edition when it is on, else to the dashboard. The browser edition is another origin: a
+    // full-page navigation that replaces this page, so Back does not land here and bounce again. Until its
+    // answer is in ("wait"), the blank frame stays.
+    if (destinationKind === "route" && destinationTo) navigate(destinationTo, { replace: true });
+    else if (destinationKind === "href" && destinationTo) window.location.replace(destinationTo);
+  }, [sessionLoading, profile, redirectUri, codeChallenge, destinationKind, destinationTo, navigate]);
 
   if (phase === "completing") {
     return (
@@ -85,8 +101,10 @@ export default function LoginPage() {
   }
 
   // Idle — probing the session, or redirecting an already-signed-in user — keep a blank frame so the
-  // sign-in form never flashes before the redirect.
-  if (phase !== "form") {
+  // sign-in form never flashes before the redirect. The form also waits for the browser edition's answer
+  // when the line under its heading depends on it (no editor signing in, no `next`).
+  const landingKnown = fromEditor || !!next || !webEditor.loading;
+  if (phase !== "form" || !landingKnown) {
     return (
       <ClassicShell>
         <main className="mx-auto flex min-h-[60vh] max-w-5xl flex-col px-5 py-24" />
@@ -108,7 +126,9 @@ export default function LoginPage() {
             <p className="mt-2 text-[15px] pretty">
               {fromEditor
                 ? "Connect the editor to your account — you'll be sent back to LevelCode when you're done."
-                : "Manage your plan, keys, and usage."}
+                : !next && webEditor.enabled
+                  ? "LevelCode opens in this tab when you're done."
+                  : "Manage your plan, keys, and usage."}
             </p>
           </div>
 
@@ -124,6 +144,7 @@ export default function LoginPage() {
             <ProviderSignIn
               redirectUri={editorHandoff?.redirectUri}
               codeChallenge={editorHandoff?.codeChallenge}
+              next={next}
             />
 
             <div className="my-5 flex items-center gap-3 text-[var(--c-text3)]" aria-hidden="true">
@@ -135,6 +156,7 @@ export default function LoginPage() {
             <EmailSignIn
               redirectUri={editorHandoff?.redirectUri}
               codeChallenge={editorHandoff?.codeChallenge}
+              next={next}
             />
           </div>
 
diff --git a/src/levelcode/pages/PricingCards.tsx b/src/levelcode/pages/PricingCards.tsx
index b019be8..bc4035e 100644
--- a/src/levelcode/pages/PricingCards.tsx
+++ b/src/levelcode/pages/PricingCards.tsx
@@ -1,6 +1,7 @@
 import { useState } from "react";
 import { useNavigate } from "react-router-dom";
 import { api, ApiError, navigateTo, type PricingTier } from "../api";
+import { currentPage, loginRoute } from "../next";
 
 // 4-card grid. Checkout goes through /ai/checkout (CSRF-protected, session-authed).
 // tier.key IS the Stripe lookup_key (server truth) — send it verbatim. The server
@@ -32,7 +33,9 @@ export default function PricingCards({
   async function checkout(tier: PricingTier) {
     setErr(null);
     if (!authed) {
-      navigate("/login");
+      // Sign in, then back to these plans to choose one. Nothing is bought on the way back: the visitor
+      // presses the button again (a link must never be able to start a checkout or a plan change).
+      navigate(loginRoute(currentPage()));
       return;
     }
     setBusy(tier.key);
diff --git a/src/levelcode/pages/ProviderSignIn.tsx b/src/levelcode/pages/ProviderSignIn.tsx
index 35d0c25..849c46b 100644
--- a/src/levelcode/pages/ProviderSignIn.tsx
+++ b/src/levelcode/pages/ProviderSignIn.tsx
@@ -1,6 +1,7 @@
 import type { ReactNode } from "react";
 import { API_BASE } from "../api";
 import { getAttribution } from "../attribution";
+import { oauthStartUrl, type SignInContext } from "../signInRequests";
 
 // Social sign-in for the LevelCode Cloud login: Google + GitHub.
 //
@@ -10,21 +11,16 @@ import { getAttribution } from "../attribution";
 // to open in a new tab, works without JS.
 //
 // The editor's redirect_uri + code_challenge are a PKCE PAIR, forwarded only when BOTH are present (see
-// oauthStartUrl) so a partial handoff never reaches the backend. Both providers share the exact same
-// oauth_start/oauth_callback path — the callback dispatches on the stashed provider.
-export default function ProviderSignIn({
-  redirectUri,
-  codeChallenge,
-}: {
-  redirectUri?: string;
-  codeChallenge?: string;
-}) {
+// oauthStartUrl in signInRequests.ts) so a partial handoff never reaches the backend. Both providers share
+// the exact same oauth_start/oauth_callback path — the callback dispatches on the stashed provider.
+// `next`, the page the visitor asked for, rides the link only on a web sign-in and only when valid.
+export default function ProviderSignIn(context: SignInContext) {
   return (
     <div className="flex flex-col gap-3">
-      <ProviderLink provider="google" label="Continue with Google" redirectUri={redirectUri} codeChallenge={codeChallenge}>
+      <ProviderLink provider="google" label="Continue with Google" context={context}>
         <GoogleG />
       </ProviderLink>
-      <ProviderLink provider="github" label="Continue with GitHub" redirectUri={redirectUri} codeChallenge={codeChallenge}>
+      <ProviderLink provider="github" label="Continue with GitHub" context={context}>
         <GitHubMark />
       </ProviderLink>
     </div>
@@ -34,19 +30,17 @@ export default function ProviderSignIn({
 function ProviderLink({
   provider,
   label,
-  redirectUri,
-  codeChallenge,
+  context,
   children,
 }: {
   provider: string;
   label: string;
-  redirectUri?: string;
-  codeChallenge?: string;
+  context: SignInContext;
   children: ReactNode;
 }) {
   return (
     <a
-      href={oauthStartUrl(provider, redirectUri, codeChallenge)}
+      href={oauthStartUrl(API_BASE, provider, context, getAttribution())}
       className="classic-button--quiet w-full gap-2.5"
     >
       {children}
@@ -55,42 +49,6 @@ function ProviderLink({
   );
 }
 
-function oauthStartUrl(provider: string, redirectUri?: string, codeChallenge?: string): string {
-  const qs = new URLSearchParams();
-  // Both or neither — a lone redirect_uri has no PKCE binding and must not be forwarded (defensive; the
-  // login page already pairs them, but this component shouldn't trust its caller to).
-  if (redirectUri && codeChallenge) {
-    qs.set("redirect_uri", redirectUri);
-    qs.set("code_challenge", codeChallenge);
-  }
-  // First-touch campaign attribution. The email flow posts this in the verify body; OAuth is a top-level
-  // navigation with no body, so it rides the query string — oauth_start moves it straight into the session
-  // (like the CSRF `state`), and oauth_callback stamps it on the user IF this sign-in creates one. Without
-  // it every GitHub/Google signup is attributed to nothing, which quietly undercounts whichever channel
-  // sends the most developers.
-  //
-  // Only the fields the funnel actually uses are carried, as an explicit allowlist rather than the whole
-  // record. A query string ends up in browser history and server access logs, and `referrer` is the one
-  // attribution field that can itself be a third-party URL carrying its own query params — so it stays out
-  // of the URL entirely. Listing the fields (instead of deleting one) also means a field added to
-  // Attribution later cannot silently start appearing in logs.
-  const attribution = getAttribution();
-  if (attribution) {
-    qs.set(
-      "attribution",
-      JSON.stringify({
-        source: attribution.source,
-        params: attribution.params,
-        landing: attribution.landing,
-        ts: attribution.ts,
-      }),
-    );
-  }
-
-  const q = qs.toString();
-  return `${API_BASE}/ai/auth/oauth/${provider}${q ? `?${q}` : ""}`;
-}
-
 function GoogleG() {
   return (
     <svg width="18" height="18" viewBox="0 0 18 18" aria-hidden="true" className="shrink-0">
diff --git a/src/levelcode/pages/ReferralsPage.tsx b/src/levelcode/pages/ReferralsPage.tsx
index e062f24..cb40403 100644
--- a/src/levelcode/pages/ReferralsPage.tsx
+++ b/src/levelcode/pages/ReferralsPage.tsx
@@ -3,6 +3,7 @@ import { Link, useNavigate } from "react-router-dom";
 import { api, type ReferralFunnel } from "../api";
 import { useSession } from "../auth";
 import ClassicShell from "../components/classic/ClassicShell";
+import { currentPage, loginRoute } from "../next";
 
 // Admin-only referral funnel: clicks -> signups -> paid, per marketing channel.
 //
@@ -70,7 +71,7 @@ export default function ReferralsPage() {
   // Non-admins (or signed-out) never see this surface. Enforced server-side too.
   useEffect(() => {
     if (sessionLoading) return;
-    if (!profile) navigate("/login", { replace: true });
+    if (!profile) navigate(loginRoute(currentPage()), { replace: true });
     else if (!isAdmin) navigate("/account", { replace: true });
   }, [sessionLoading, profile, isAdmin, navigate]);
 
diff --git a/src/levelcode/signInRequests.test.ts b/src/levelcode/signInRequests.test.ts
new file mode 100644
index 0000000..e70511a
--- /dev/null
+++ b/src/levelcode/signInRequests.test.ts
@@ -0,0 +1,110 @@
+// node --test (npm test). What the two requests that finish a sign-in carry.
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import type { Attribution } from "./attribution";
+import { oauthStartUrl, verifyBody } from "./signInRequests.ts";
+
+const EDITOR = { redirectUri: "levelcode://levelcode.levelcode-ai/auth/callback", codeChallenge: "challenge-abc" };
+
+const ATTRIBUTION: Attribution = {
+  source: "linkedin",
+  params: { linkedin: "someone" },
+  landing: "/ai",
+  referrer: "https://www.linkedin.example/feed?trk=1",
+  ts: "2026-10-17T00:00:00.000Z",
+};
+
+/** The query of an OAuth start link, as the backend will read it. */
+function query(url: string): URLSearchParams {
+  return new URL(url, "https://levelcode.ai").searchParams;
+}
+
+describe("oauthStartUrl", () => {
+  test("a plain sign-in is the bare provider path", () => {
+    assert.equal(oauthStartUrl("", "github", {}, null), "/ai/auth/oauth/github");
+  });
+
+  test("the API base is put in front", () => {
+    assert.equal(oauthStartUrl("https://api.example.test", "google", {}, null), "https://api.example.test/ai/auth/oauth/google");
+  });
+
+  test("an editor's redirect_uri and code_challenge go together", () => {
+    const q = query(oauthStartUrl("", "github", EDITOR, null));
+    assert.equal(q.get("redirect_uri"), EDITOR.redirectUri);
+    assert.equal(q.get("code_challenge"), EDITOR.codeChallenge);
+  });
+
+  test("half of the pair is forwarded as neither", () => {
+    for (const context of [{ redirectUri: EDITOR.redirectUri }, { codeChallenge: EDITOR.codeChallenge }]) {
+      const q = query(oauthStartUrl("", "github", context, null));
+      assert.equal(q.has("redirect_uri"), false);
+      assert.equal(q.has("code_challenge"), false);
+    }
+  });
+
+  test("attribution rides the query, without the referrer", () => {
+    const raw = query(oauthStartUrl("", "github", {}, ATTRIBUTION)).get("attribution");
+    assert.deepEqual(JSON.parse(raw ?? "null"), {
+      source: "linkedin",
+      params: { linkedin: "someone" },
+      landing: "/ai",
+      ts: "2026-10-17T00:00:00.000Z",
+    });
+    assert.equal(oauthStartUrl("", "github", {}, ATTRIBUTION).includes("linkedin.example"), false);
+  });
+
+  test("a valid next rides a web sign-in", () => {
+    const q = query(oauthStartUrl("", "github", { next: "/ai/pricing?plan=pro" }, null));
+    assert.equal(q.get("next"), "/ai/pricing?plan=pro");
+  });
+
+  test("a next that is not valid is left out", () => {
+    for (const next of ["//evil.example", "/ai//x", "https://evil.example/ai/", "/ai/%2F%2Fevil", "/other/path", ""]) {
+      assert.equal(query(oauthStartUrl("", "github", { next }, null)).has("next"), false, next);
+    }
+  });
+
+  test("an editor signing in never carries next", () => {
+    const q = query(oauthStartUrl("", "github", { ...EDITOR, next: "/ai/account" }, null));
+    assert.equal(q.has("next"), false);
+    assert.equal(q.get("redirect_uri"), EDITOR.redirectUri);
+  });
+
+  test("half an editor pair is a web sign-in, so next rides it", () => {
+    const q = query(oauthStartUrl("", "github", { redirectUri: EDITOR.redirectUri, next: "/ai/account" }, null));
+    assert.equal(q.get("next"), "/ai/account");
+    assert.equal(q.has("redirect_uri"), false);
+  });
+});
+
+describe("verifyBody", () => {
+  test("a plain sign-in sends the email, the code and the attribution", () => {
+    const body = verifyBody("a@example.test", "123456", {}, ATTRIBUTION);
+    assert.deepEqual(JSON.parse(JSON.stringify(body)), {
+      email: "a@example.test",
+      code: "123456",
+      attribution: JSON.parse(JSON.stringify(ATTRIBUTION)),
+    });
+  });
+
+  test("an editor sign-in sends its redirect_uri and code_challenge", () => {
+    const body = verifyBody("a@example.test", "123456", EDITOR, null);
+    assert.equal(body.redirect_uri, EDITOR.redirectUri);
+    assert.equal(body.code_challenge, EDITOR.codeChallenge);
+    assert.equal(body.attribution, null);
+  });
+
+  test("a valid next is sent on a web sign-in", () => {
+    assert.equal(verifyBody("a@example.test", "123456", { next: "/ai/account" }, null).next, "/ai/account");
+  });
+
+  test("a next that is not valid is left out", () => {
+    for (const next of ["//evil.example", "/ai//x", "javascript:alert(1)", "/ai/%2F%2Fevil", "/ai/account#x", null, undefined]) {
+      assert.equal("next" in verifyBody("a@example.test", "123456", { next }, null), false, String(next));
+    }
+  });
+
+  test("an editor signing in never sends next", () => {
+    assert.equal("next" in verifyBody("a@example.test", "123456", { ...EDITOR, next: "/ai/account" }, null), false);
+  });
+});
diff --git a/src/levelcode/signInRequests.ts b/src/levelcode/signInRequests.ts
new file mode 100644
index 0000000..7853a53
--- /dev/null
+++ b/src/levelcode/signInRequests.ts
@@ -0,0 +1,99 @@
+import type { Attribution } from "./attribution";
+// With its extension so `node --test` can load this file as it is (signInRequests.test.ts).
+import { safeNext } from "./next.ts";
+
+// The two requests that finish a sign-in, built in one place so what they carry can be tested:
+// the OAuth start link (ProviderSignIn) and the email-code verify body (EmailSignIn).
+// Nothing here touches the page or the network; the components pass in what they read.
+
+/** What the login page knows about this sign-in. */
+export type SignInContext = {
+  /** The editor's callback; meaningful only together with its code_challenge (a PKCE pair). */
+  redirectUri?: string;
+  codeChallenge?: string;
+  /** The page to land on afterwards (see next.ts). Sent only when valid, and never with an editor sign-in. */
+  next?: string | null;
+};
+
+/**
+ * `next` as a request should carry it: only on a web sign-in (an editor signing in wins, and the backend
+ * ignores `next` then), and only a valid one.
+ */
+function nextFor({ redirectUri, codeChallenge, next }: SignInContext): string | null {
+  if (redirectUri && codeChallenge) return null;
+  return safeNext(next);
+}
+
+/**
+ * GET /ai/auth/oauth/:provider, the link each provider button is.
+ *
+ * The editor's redirect_uri + code_challenge are a PKCE PAIR, forwarded only when BOTH are present so a
+ * partial handoff never reaches the backend (defensive; the login page already pairs them, but this
+ * shouldn't trust its caller to).
+ */
+export function oauthStartUrl(
+  base: string,
+  provider: string,
+  context: SignInContext,
+  attribution: Attribution | null,
+): string {
+  const { redirectUri, codeChallenge } = context;
+  const qs = new URLSearchParams();
+  if (redirectUri && codeChallenge) {
+    qs.set("redirect_uri", redirectUri);
+    qs.set("code_challenge", codeChallenge);
+  }
+  // The page to land on after a web sign-in; oauth_start keeps it in the session across the provider
+  // round-trip, like the CSRF `state`.
+  const next = nextFor(context);
+  if (next) qs.set("next", next);
+  // First-touch campaign attribution. The email flow posts this in the verify body; OAuth is a top-level
+  // navigation with no body, so it rides the query string — oauth_start moves it straight into the session
+  // (like the CSRF `state`), and oauth_callback stamps it on the user IF this sign-in creates one. Without
+  // it every GitHub/Google signup is attributed to nothing, which quietly undercounts whichever channel
+  // sends the most developers.
+  //
+  // Only the fields the funnel actually uses are carried, as an explicit allowlist rather than the whole
+  // record. A query string ends up in browser history and server access logs, and `referrer` is the one
+  // attribution field that can itself be a third-party URL carrying its own query params — so it stays out
+  // of the URL entirely. Listing the fields (instead of deleting one) also means a field added to
+  // Attribution later cannot silently start appearing in logs.
+  if (attribution) {
+    qs.set(
+      "attribution",
+      JSON.stringify({
+        source: attribution.source,
+        params: attribution.params,
+        landing: attribution.landing,
+        ts: attribution.ts,
+      }),
+    );
+  }
+
+  const q = qs.toString();
+  return `${base}/ai/auth/oauth/${provider}${q ? `?${q}` : ""}`;
+}
+
+/**
+ * The body of POST /ai/auth/verify. redirect_uri and code_challenge go as the login page passed them
+ * (it pairs them); `next` only on a web sign-in, and only when valid. `attribution` is the first-touch
+ * campaign channel (null for organic sign-ins) so the backend can record which channel acquired a new
+ * account; harmless if the backend doesn't consume it.
+ */
+export function verifyBody(
+  email: string,
+  code: string,
+  context: SignInContext,
+  attribution: Attribution | null,
+): Record<string, unknown> {
+  const body: Record<string, unknown> = {
+    email,
+    code,
+    redirect_uri: context.redirectUri,
+    code_challenge: context.codeChallenge,
+    attribution,
+  };
+  const next = nextFor(context);
+  if (next) body.next = next;
+  return body;
+}