diff --git a/src/aphront/configuration/AphrontApplicationConfiguration.php b/src/aphront/configuration/AphrontApplicationConfiguration.php
index 50b8c123fd..b48ea3be13 100644
--- a/src/aphront/configuration/AphrontApplicationConfiguration.php
+++ b/src/aphront/configuration/AphrontApplicationConfiguration.php
@@ -1,635 +1,642 @@
 <?php
 
 /**
  * @task routing URI Routing
  * @task response Response Handling
  * @task exception Exception Handling
  */
 abstract class AphrontApplicationConfiguration extends Phobject {
 
   private $request;
   private $host;
   private $path;
   private $console;
 
   abstract public function buildRequest();
   abstract public function build404Controller();
   abstract public function buildRedirectController($uri, $external);
 
   final public function setRequest(AphrontRequest $request) {
     $this->request = $request;
     return $this;
   }
 
   final public function getRequest() {
     return $this->request;
   }
 
   final public function getConsole() {
     return $this->console;
   }
 
   final public function setConsole($console) {
     $this->console = $console;
     return $this;
   }
 
   final public function setHost($host) {
     $this->host = $host;
     return $this;
   }
 
   final public function getHost() {
     return $this->host;
   }
 
   final public function setPath($path) {
     $this->path = $path;
     return $this;
   }
 
   final public function getPath() {
     return $this->path;
   }
 
   public function willBuildRequest() {}
 
 
   /**
    * @phutil-external-symbol class PhabricatorStartup
    */
   public static function runHTTPRequest(AphrontHTTPSink $sink) {
     PhabricatorStartup::beginStartupPhase('multimeter');
     $multimeter = MultimeterControl::newInstance();
     $multimeter->setEventContext('<http-init>');
     $multimeter->setEventViewer('<none>');
 
     // Build a no-op write guard for the setup phase. We'll replace this with a
     // real write guard later on, but we need to survive setup and build a
     // request object first.
     $write_guard = new AphrontWriteGuard('id');
 
     PhabricatorStartup::beginStartupPhase('env.init');
     PhabricatorEnv::initializeWebEnvironment();
 
     $multimeter->setSampleRate(
       PhabricatorEnv::getEnvConfig('debug.sample-rate'));
 
     $debug_time_limit = PhabricatorEnv::getEnvConfig('debug.time-limit');
     if ($debug_time_limit) {
       PhabricatorStartup::setDebugTimeLimit($debug_time_limit);
     }
 
     // This is the earliest we can get away with this, we need env config first.
     PhabricatorStartup::beginStartupPhase('log.access');
     PhabricatorAccessLog::init();
     $access_log = PhabricatorAccessLog::getLog();
     PhabricatorStartup::setAccessLog($access_log);
     $access_log->setData(
       array(
         'R' => AphrontRequest::getHTTPHeader('Referer', '-'),
         'r' => idx($_SERVER, 'REMOTE_ADDR', '-'),
         'M' => idx($_SERVER, 'REQUEST_METHOD', '-'),
       ));
 
     DarkConsoleXHProfPluginAPI::hookProfiler();
 
     // We just activated the profiler, so we don't need to keep track of
     // startup phases anymore: it can take over from here.
     PhabricatorStartup::beginStartupPhase('startup.done');
 
     DarkConsoleErrorLogPluginAPI::registerErrorHandler();
 
     $response = PhabricatorSetupCheck::willProcessRequest();
     if ($response) {
       PhabricatorStartup::endOutputCapture();
       $sink->writeResponse($response);
       return;
     }
 
     $host = AphrontRequest::getHTTPHeader('Host');
     $path = $_REQUEST['__path__'];
 
     switch ($host) {
       default:
         $config_key = 'aphront.default-application-configuration-class';
         $application = PhabricatorEnv::newObjectFromConfig($config_key);
         break;
     }
 
     $application->setHost($host);
     $application->setPath($path);
     $application->willBuildRequest();
     $request = $application->buildRequest();
 
     // Now that we have a request, convert the write guard into one which
     // actually checks CSRF tokens.
     $write_guard->dispose();
     $write_guard = new AphrontWriteGuard(array($request, 'validateCSRF'));
 
     // Build the server URI implied by the request headers. If an administrator
     // has not configured "phabricator.base-uri" yet, we'll use this to generate
     // links.
 
     $request_protocol = ($request->isHTTPS() ? 'https' : 'http');
     $request_base_uri = "{$request_protocol}://{$host}/";
     PhabricatorEnv::setRequestBaseURI($request_base_uri);
 
     $access_log->setData(
       array(
         'U' => (string)$request->getRequestURI()->getPath(),
       ));
 
     $processing_exception = null;
     try {
       $response = $application->processRequest(
         $request,
         $access_log,
         $sink,
         $multimeter);
       $response_code = $response->getHTTPResponseCode();
     } catch (Exception $ex) {
       $processing_exception = $ex;
       $response_code = 500;
     }
 
     $write_guard->dispose();
 
     $access_log->setData(
       array(
         'c' => $response_code,
         'T' => PhabricatorStartup::getMicrosecondsSinceStart(),
       ));
 
     $multimeter->newEvent(
       MultimeterEvent::TYPE_REQUEST_TIME,
       $multimeter->getEventContext(),
       PhabricatorStartup::getMicrosecondsSinceStart());
 
     $access_log->write();
 
     $multimeter->saveEvents();
 
     DarkConsoleXHProfPluginAPI::saveProfilerSample($access_log);
 
     // Add points to the rate limits for this request.
     if (isset($_SERVER['REMOTE_ADDR'])) {
       $user_ip = $_SERVER['REMOTE_ADDR'];
 
       // The base score for a request allows users to make 30 requests per
       // minute.
       $score = (1000 / 30);
 
       // If the user was logged in, let them make more requests.
       if ($request->getUser() && $request->getUser()->getPHID()) {
         $score = $score / 5;
       }
 
       PhabricatorStartup::addRateLimitScore($user_ip, $score);
     }
 
     if ($processing_exception) {
       throw $processing_exception;
     }
   }
 
 
   public function processRequest(
     AphrontRequest $request,
     PhutilDeferredLog $access_log,
     AphrontHTTPSink $sink,
     MultimeterControl $multimeter) {
 
     $this->setRequest($request);
 
     list($controller, $uri_data) = $this->buildController();
 
     $controller_class = get_class($controller);
     $access_log->setData(
       array(
         'C' => $controller_class,
       ));
     $multimeter->setEventContext('web.'.$controller_class);
 
     $request->setController($controller);
     $request->setURIMap($uri_data);
 
     $controller->setRequest($request);
 
     // If execution throws an exception and then trying to render that
     // exception throws another exception, we want to show the original
     // exception, as it is likely the root cause of the rendering exception.
     $original_exception = null;
     try {
       $response = $controller->willBeginExecution();
 
       if ($request->getUser() && $request->getUser()->getPHID()) {
         $access_log->setData(
           array(
             'u' => $request->getUser()->getUserName(),
             'P' => $request->getUser()->getPHID(),
           ));
         $multimeter->setEventViewer('user.'.$request->getUser()->getPHID());
       }
 
       if (!$response) {
         $controller->willProcessRequest($uri_data);
         $response = $controller->handleRequest($request);
         $this->validateControllerResponse($controller, $response);
       }
     } catch (Exception $ex) {
       $original_exception = $ex;
       $response = $this->handleException($ex);
     }
 
     try {
       $response = $this->produceResponse($request, $response);
       $response = $controller->willSendResponse($response);
       $response->setRequest($request);
 
       $unexpected_output = PhabricatorStartup::endOutputCapture();
       if ($unexpected_output) {
         $unexpected_output = pht(
           "Unexpected output:\n\n%s",
           $unexpected_output);
 
         phlog($unexpected_output);
 
         if ($response instanceof AphrontWebpageResponse) {
           echo phutil_tag(
             'div',
             array(
               'style' =>
                 'background: #eeddff;'.
                 'white-space: pre-wrap;'.
                 'z-index: 200000;'.
                 'position: relative;'.
                 'padding: 8px;'.
                 'font-family: monospace',
             ),
             $unexpected_output);
         }
       }
 
       $sink->writeResponse($response);
     } catch (Exception $ex) {
       if ($original_exception) {
         throw $original_exception;
       }
       throw $ex;
     }
 
     return $response;
   }
 
 
 /* -(  URI Routing  )-------------------------------------------------------- */
 
 
   /**
    * Build a controller to respond to the request.
    *
    * @return pair<AphrontController,dict> Controller and dictionary of request
    *                                      parameters.
    * @task routing
    */
   final private function buildController() {
     $request = $this->getRequest();
 
     // If we're configured to operate in cluster mode, reject requests which
     // were not received on a cluster interface.
     //
     // For example, a host may have an internal address like "170.0.0.1", and
     // also have a public address like "51.23.95.16". Assuming the cluster
     // is configured on a range like "170.0.0.0/16", we want to reject the
     // requests received on the public interface.
     //
     // Ideally, nodes in a cluster should only be listening on internal
     // interfaces, but they may be configured in such a way that they also
     // listen on external interfaces, since this is easy to forget about or
     // get wrong. As a broad security measure, reject requests received on any
     // interfaces which aren't on the whitelist.
 
     $cluster_addresses = PhabricatorEnv::getEnvConfig('cluster.addresses');
     if ($cluster_addresses) {
       $server_addr = idx($_SERVER, 'SERVER_ADDR');
       if (!$server_addr) {
         if (php_sapi_name() == 'cli') {
           // This is a command line script (probably something like a unit
           // test) so it's fine that we don't have SERVER_ADDR defined.
         } else {
           throw new AphrontMalformedRequestException(
             pht('No %s', 'SERVER_ADDR'),
             pht(
               'Phabricator is configured to operate in cluster mode, but '.
               '%s is not defined in the request context. Your webserver '.
               'configuration needs to forward %s to PHP so Phabricator can '.
               'reject requests received on external interfaces.',
               'SERVER_ADDR',
               'SERVER_ADDR'));
         }
       } else {
         if (!PhabricatorEnv::isClusterAddress($server_addr)) {
           throw new AphrontMalformedRequestException(
             pht('External Interface'),
             pht(
               'Phabricator is configured in cluster mode and the address '.
               'this request was received on ("%s") is not whitelisted as '.
               'a cluster address.',
               $server_addr));
         }
       }
     }
 
     $site = $this->buildSiteForRequest($request);
 
     if ($site->shouldRequireHTTPS()) {
       if (!$request->isHTTPS()) {
         $https_uri = $request->getRequestURI();
         $https_uri->setDomain($request->getHost());
         $https_uri->setProtocol('https');
 
         // In this scenario, we'll be redirecting to HTTPS using an absolute
         // URI, so we need to permit an external redirect.
         return $this->buildRedirectController($https_uri, true);
       }
     }
 
     $maps = $site->getRoutingMaps();
     $path = $request->getPath();
 
     $result = $this->routePath($maps, $path);
     if ($result) {
       return $result;
     }
 
     // If we failed to match anything but don't have a trailing slash, try
     // to add a trailing slash and issue a redirect if that resolves.
 
     // NOTE: We only do this for GET, since redirects switch to GET and drop
     // data like POST parameters.
     if (!preg_match('@/$@', $path) && $request->isHTTPGet()) {
       $result = $this->routePath($maps, $path.'/');
       if ($result) {
         $slash_uri = $request->getRequestURI()->setPath($path.'/');
+
+        // We need to restore URI encoding because the webserver has
+        // interpreted it. For example, this allows us to redirect a path
+        // like `/tag/aa%20bb` to `/tag/aa%20bb/`, which may eventually be
+        // resolved meaningfully by an application.
+        $slash_uri = phutil_escape_uri($slash_uri);
+
         $external = strlen($request->getRequestURI()->getDomain());
         return $this->buildRedirectController($slash_uri, $external);
       }
     }
 
     return $this->build404Controller();
   }
 
   /**
    * Map a specific path to the corresponding controller. For a description
    * of routing, see @{method:buildController}.
    *
    * @param list<AphrontRoutingMap> List of routing maps.
    * @param string Path to route.
    * @return pair<AphrontController,dict> Controller and dictionary of request
    *                                      parameters.
    * @task routing
    */
   private function routePath(array $maps, $path) {
     foreach ($maps as $map) {
       $result = $map->routePath($path);
       if ($result) {
         return array($result->getController(), $result->getURIData());
       }
     }
   }
 
   private function buildSiteForRequest(AphrontRequest $request) {
     $sites = PhabricatorSite::getAllSites();
 
     $site = null;
     foreach ($sites as $candidate) {
       $site = $candidate->newSiteForRequest($request);
       if ($site) {
         break;
       }
     }
 
     if (!$site) {
       $path = $request->getPath();
       $host = $request->getHost();
       throw new AphrontMalformedRequestException(
         pht('Site Not Found'),
         pht(
           'This request asked for "%s" on host "%s", but no site is '.
           'configured which can serve this request.',
           $path,
           $host),
         true);
     }
 
     $request->setSite($site);
 
     return $site;
   }
 
 
 /* -(  Response Handling  )-------------------------------------------------- */
 
 
   /**
    * Tests if a response is of a valid type.
    *
    * @param wild Supposedly valid response.
    * @return bool True if the object is of a valid type.
    * @task response
    */
   private function isValidResponseObject($response) {
     if ($response instanceof AphrontResponse) {
       return true;
     }
 
     if ($response instanceof AphrontResponseProducerInterface) {
       return true;
     }
 
     return false;
   }
 
 
   /**
    * Verifies that the return value from an @{class:AphrontController} is
    * of an allowed type.
    *
    * @param AphrontController Controller which returned the response.
    * @param wild Supposedly valid response.
    * @return void
    * @task response
    */
   private function validateControllerResponse(
     AphrontController $controller,
     $response) {
 
     if ($this->isValidResponseObject($response)) {
       return;
     }
 
     throw new Exception(
       pht(
         'Controller "%s" returned an invalid response from call to "%s". '.
         'This method must return an object of class "%s", or an object '.
         'which implements the "%s" interface.',
         get_class($controller),
         'handleRequest()',
         'AphrontResponse',
         'AphrontResponseProducerInterface'));
   }
 
 
   /**
    * Verifies that the return value from an
    * @{class:AphrontResponseProducerInterface} is of an allowed type.
    *
    * @param AphrontResponseProducerInterface Object which produced
    *   this response.
    * @param wild Supposedly valid response.
    * @return void
    * @task response
    */
   private function validateProducerResponse(
     AphrontResponseProducerInterface $producer,
     $response) {
 
     if ($this->isValidResponseObject($response)) {
       return;
     }
 
     throw new Exception(
       pht(
         'Producer "%s" returned an invalid response from call to "%s". '.
         'This method must return an object of class "%s", or an object '.
         'which implements the "%s" interface.',
         get_class($producer),
         'produceAphrontResponse()',
         'AphrontResponse',
         'AphrontResponseProducerInterface'));
   }
 
 
   /**
    * Verifies that the return value from an
    * @{class:AphrontRequestExceptionHandler} is of an allowed type.
    *
    * @param AphrontRequestExceptionHandler Object which produced this
    *  response.
    * @param wild Supposedly valid response.
    * @return void
    * @task response
    */
   private function validateErrorHandlerResponse(
     AphrontRequestExceptionHandler $handler,
     $response) {
 
     if ($this->isValidResponseObject($response)) {
       return;
     }
 
     throw new Exception(
       pht(
         'Exception handler "%s" returned an invalid response from call to '.
         '"%s". This method must return an object of class "%s", or an object '.
         'which implements the "%s" interface.',
         get_class($handler),
         'handleRequestException()',
         'AphrontResponse',
         'AphrontResponseProducerInterface'));
   }
 
 
   /**
    * Resolves a response object into an @{class:AphrontResponse}.
    *
    * Controllers are permitted to return actual responses of class
    * @{class:AphrontResponse}, or other objects which implement
    * @{interface:AphrontResponseProducerInterface} and can produce a response.
    *
    * If a controller returns a response producer, invoke it now and produce
    * the real response.
    *
    * @param AphrontRequest Request being handled.
    * @param AphrontResponse|AphrontResponseProducerInterface Response, or
    *   response producer.
    * @return AphrontResponse Response after any required production.
    * @task response
    */
   private function produceResponse(AphrontRequest $request, $response) {
     $original = $response;
 
     // Detect cycles on the exact same objects. It's still possible to produce
     // infinite responses as long as they're all unique, but we can only
     // reasonably detect cycles, not guarantee that response production halts.
 
     $seen = array();
     while (true) {
       // NOTE: It is permissible for an object to be both a response and a
       // response producer. If so, being a producer is "stronger". This is
       // used by AphrontProxyResponse.
 
       // If this response is a valid response, hand over the request first.
       if ($response instanceof AphrontResponse) {
         $response->setRequest($request);
       }
 
       // If this isn't a producer, we're all done.
       if (!($response instanceof AphrontResponseProducerInterface)) {
         break;
       }
 
       $hash = spl_object_hash($response);
       if (isset($seen[$hash])) {
         throw new Exception(
           pht(
             'Failure while producing response for object of class "%s": '.
             'encountered production cycle (identical object, of class "%s", '.
             'was produced twice).',
             get_class($original),
             get_class($response)));
       }
 
       $seen[$hash] = true;
 
       $new_response = $response->produceAphrontResponse();
       $this->validateProducerResponse($response, $new_response);
       $response = $new_response;
     }
 
     return $response;
   }
 
 
 /* -(  Error Handling  )----------------------------------------------------- */
 
 
   /**
    * Convert an exception which has escaped the controller into a response.
    *
    * This method delegates exception handling to available subclasses of
    * @{class:AphrontRequestExceptionHandler}.
    *
    * @param Exception Exception which needs to be handled.
    * @return wild Response or response producer, or null if no available
    *   handler can produce a response.
    * @task exception
    */
   private function handleException(Exception $ex) {
     $handlers = AphrontRequestExceptionHandler::getAllHandlers();
 
     $request = $this->getRequest();
     foreach ($handlers as $handler) {
       if ($handler->canHandleRequestException($request, $ex)) {
         $response = $handler->handleRequestException($request, $ex);
         $this->validateErrorHandlerResponse($handler, $response);
         return $response;
       }
     }
 
     throw $ex;
   }
 
 
 }
diff --git a/src/applications/project/controller/PhabricatorProjectViewController.php b/src/applications/project/controller/PhabricatorProjectViewController.php
index 45329285df..bfc9827ab5 100644
--- a/src/applications/project/controller/PhabricatorProjectViewController.php
+++ b/src/applications/project/controller/PhabricatorProjectViewController.php
@@ -1,56 +1,90 @@
 <?php
 
 final class PhabricatorProjectViewController
   extends PhabricatorProjectController {
 
   public function shouldAllowPublic() {
     return true;
   }
 
   public function handleRequest(AphrontRequest $request) {
     $request = $this->getRequest();
     $viewer = $request->getViewer();
 
     $query = id(new PhabricatorProjectQuery())
       ->setViewer($viewer)
       ->needMembers(true)
       ->needWatchers(true)
       ->needImages(true)
       ->needSlugs(true);
     $id = $request->getURIData('id');
     $slug = $request->getURIData('slug');
     if ($slug) {
       $query->withSlugs(array($slug));
     } else {
       $query->withIDs(array($id));
     }
     $project = $query->executeOne();
     if (!$project) {
+
+      // If this request corresponds to a project but just doesn't have the
+      // slug quite right, redirect to the proper URI.
+      $uri = $this->getNormalizedURI($slug);
+      if ($uri !== null) {
+        return id(new AphrontRedirectResponse())->setURI($uri);
+      }
+
       return new Aphront404Response();
     }
 
-
     $columns = id(new PhabricatorProjectColumnQuery())
       ->setViewer($viewer)
       ->withProjectPHIDs(array($project->getPHID()))
       ->execute();
     if ($columns) {
       $controller = 'board';
     } else {
       $controller = 'profile';
     }
 
     switch ($controller) {
       case 'board':
         $controller_object = new PhabricatorProjectBoardViewController();
         break;
       case 'profile':
       default:
         $controller_object = new PhabricatorProjectProfileController();
         break;
     }
 
     return $this->delegateToController($controller_object);
   }
 
+  private function getNormalizedURI($slug) {
+    if (!strlen($slug)) {
+      return null;
+    }
+
+    $normal = PhabricatorSlug::normalizeProjectSlug($slug);
+    if ($normal === $slug) {
+      return null;
+    }
+
+    $viewer = $this->getViewer();
+
+    // Do execute() instead of executeOne() here so we canonicalize before
+    // raising a policy exception. This is a little more polished than letting
+    // the user hit the error on any variant of the slug.
+
+    $projects = id(new PhabricatorProjectQuery())
+      ->setViewer($viewer)
+      ->withSlugs(array($normal))
+      ->execute();
+    if (!$projects) {
+      return null;
+    }
+
+    return "/tag/{$normal}/";
+  }
+
 }
diff --git a/src/applications/project/editor/PhabricatorProjectTransactionEditor.php b/src/applications/project/editor/PhabricatorProjectTransactionEditor.php
index c5253da956..ecd2d5119f 100644
--- a/src/applications/project/editor/PhabricatorProjectTransactionEditor.php
+++ b/src/applications/project/editor/PhabricatorProjectTransactionEditor.php
@@ -1,518 +1,516 @@
 <?php
 
 final class PhabricatorProjectTransactionEditor
   extends PhabricatorApplicationTransactionEditor {
 
   public function getEditorApplicationClass() {
     return 'PhabricatorProjectApplication';
   }
 
   public function getEditorObjectsDescription() {
     return pht('Projects');
   }
 
   public function getTransactionTypes() {
     $types = parent::getTransactionTypes();
 
     $types[] = PhabricatorTransactions::TYPE_EDGE;
     $types[] = PhabricatorTransactions::TYPE_VIEW_POLICY;
     $types[] = PhabricatorTransactions::TYPE_EDIT_POLICY;
     $types[] = PhabricatorTransactions::TYPE_JOIN_POLICY;
 
     $types[] = PhabricatorProjectTransaction::TYPE_NAME;
     $types[] = PhabricatorProjectTransaction::TYPE_SLUGS;
     $types[] = PhabricatorProjectTransaction::TYPE_STATUS;
     $types[] = PhabricatorProjectTransaction::TYPE_IMAGE;
     $types[] = PhabricatorProjectTransaction::TYPE_ICON;
     $types[] = PhabricatorProjectTransaction::TYPE_COLOR;
     $types[] = PhabricatorProjectTransaction::TYPE_LOCKED;
 
     return $types;
   }
 
   protected function getCustomTransactionOldValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorProjectTransaction::TYPE_NAME:
         return $object->getName();
       case PhabricatorProjectTransaction::TYPE_SLUGS:
         $slugs = $object->getSlugs();
         $slugs = mpull($slugs, 'getSlug', 'getSlug');
         unset($slugs[$object->getPrimarySlug()]);
         return array_keys($slugs);
       case PhabricatorProjectTransaction::TYPE_STATUS:
         return $object->getStatus();
       case PhabricatorProjectTransaction::TYPE_IMAGE:
         return $object->getProfileImagePHID();
       case PhabricatorProjectTransaction::TYPE_ICON:
         return $object->getIcon();
       case PhabricatorProjectTransaction::TYPE_COLOR:
         return $object->getColor();
       case PhabricatorProjectTransaction::TYPE_LOCKED:
         return (int)$object->getIsMembershipLocked();
     }
 
     return parent::getCustomTransactionOldValue($object, $xaction);
   }
 
   protected function getCustomTransactionNewValue(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorProjectTransaction::TYPE_NAME:
       case PhabricatorProjectTransaction::TYPE_SLUGS:
       case PhabricatorProjectTransaction::TYPE_STATUS:
       case PhabricatorProjectTransaction::TYPE_IMAGE:
       case PhabricatorProjectTransaction::TYPE_ICON:
       case PhabricatorProjectTransaction::TYPE_COLOR:
       case PhabricatorProjectTransaction::TYPE_LOCKED:
         return $xaction->getNewValue();
     }
 
     return parent::getCustomTransactionNewValue($object, $xaction);
   }
 
   protected function applyCustomInternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorProjectTransaction::TYPE_NAME:
         $object->setName($xaction->getNewValue());
         // TODO - this is really "setPrimarySlug"
         $object->setPhrictionSlug($xaction->getNewValue());
         return;
       case PhabricatorProjectTransaction::TYPE_SLUGS:
         return;
       case PhabricatorProjectTransaction::TYPE_STATUS:
         $object->setStatus($xaction->getNewValue());
         return;
       case PhabricatorProjectTransaction::TYPE_IMAGE:
         $object->setProfileImagePHID($xaction->getNewValue());
         return;
       case PhabricatorProjectTransaction::TYPE_ICON:
         $object->setIcon($xaction->getNewValue());
         return;
       case PhabricatorProjectTransaction::TYPE_COLOR:
         $object->setColor($xaction->getNewValue());
         return;
       case PhabricatorProjectTransaction::TYPE_LOCKED:
         $object->setIsMembershipLocked($xaction->getNewValue());
         return;
     }
 
     return parent::applyCustomInternalTransaction($object, $xaction);
   }
 
   protected function applyCustomExternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     $old = $xaction->getOldValue();
     $new = $xaction->getNewValue();
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorProjectTransaction::TYPE_NAME:
         // First, add the old name as a secondary slug; this is helpful
         // for renames and generally a good thing to do.
         if ($old !== null) {
           $this->addSlug($object, $old);
         }
         $this->addSlug($object, $new);
 
         return;
       case PhabricatorProjectTransaction::TYPE_SLUGS:
         $old = $xaction->getOldValue();
         $new = $xaction->getNewValue();
         $add = array_diff($new, $old);
         $rem = array_diff($old, $new);
 
         if ($add) {
           $add_slug_template = id(new PhabricatorProjectSlug())
             ->setProjectPHID($object->getPHID());
           foreach ($add as $add_slug_str) {
             $add_slug = id(clone $add_slug_template)
               ->setSlug($add_slug_str)
               ->save();
           }
         }
         if ($rem) {
           $rem_slugs = id(new PhabricatorProjectSlug())
             ->loadAllWhere('slug IN (%Ls)', $rem);
           foreach ($rem_slugs as $rem_slug) {
             $rem_slug->delete();
           }
         }
 
         return;
       case PhabricatorProjectTransaction::TYPE_STATUS:
       case PhabricatorProjectTransaction::TYPE_IMAGE:
       case PhabricatorProjectTransaction::TYPE_ICON:
       case PhabricatorProjectTransaction::TYPE_COLOR:
       case PhabricatorProjectTransaction::TYPE_LOCKED:
         return;
      }
 
     return parent::applyCustomExternalTransaction($object, $xaction);
   }
 
   protected function applyBuiltinExternalTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorTransactions::TYPE_EDGE:
         $edge_type = $xaction->getMetadataValue('edge:type');
         switch ($edge_type) {
           case PhabricatorProjectProjectHasMemberEdgeType::EDGECONST:
           case PhabricatorObjectHasWatcherEdgeType::EDGECONST:
             $old = $xaction->getOldValue();
             $new = $xaction->getNewValue();
 
             // When adding members or watchers, we add subscriptions.
             $add = array_keys(array_diff_key($new, $old));
 
             // When removing members, we remove their subscription too.
             // When unwatching, we leave subscriptions, since it's fine to be
             // subscribed to a project but not be a member of it.
             $edge_const = PhabricatorProjectProjectHasMemberEdgeType::EDGECONST;
             if ($edge_type == $edge_const) {
               $rem = array_keys(array_diff_key($old, $new));
             } else {
               $rem = array();
             }
 
             // NOTE: The subscribe is "explicit" because there's no implicit
             // unsubscribe, so Join -> Leave -> Join doesn't resubscribe you
             // if we use an implicit subscribe, even though you never willfully
             // unsubscribed. Not sure if adding implicit unsubscribe (which
             // would not write the unsubscribe row) is justified to deal with
             // this, which is a fairly weird edge case and pretty arguable both
             // ways.
 
             // Subscriptions caused by watches should also clearly be explicit,
             // and that case is unambiguous.
 
             id(new PhabricatorSubscriptionsEditor())
               ->setActor($this->requireActor())
               ->setObject($object)
               ->subscribeExplicit($add)
               ->unsubscribe($rem)
               ->save();
 
             if ($rem) {
               // When removing members, also remove any watches on the project.
               $edge_editor = new PhabricatorEdgeEditor();
               foreach ($rem as $rem_phid) {
                 $edge_editor->removeEdge(
                   $object->getPHID(),
                   PhabricatorObjectHasWatcherEdgeType::EDGECONST,
                   $rem_phid);
               }
               $edge_editor->save();
             }
             break;
         }
         break;
     }
 
     return parent::applyBuiltinExternalTransaction($object, $xaction);
   }
 
   protected function validateTransaction(
     PhabricatorLiskDAO $object,
     $type,
     array $xactions) {
 
     $errors = parent::validateTransaction($object, $type, $xactions);
 
     switch ($type) {
       case PhabricatorProjectTransaction::TYPE_NAME:
         $missing = $this->validateIsEmptyTextField(
           $object->getName(),
           $xactions);
 
         if ($missing) {
           $error = new PhabricatorApplicationTransactionValidationError(
             $type,
             pht('Required'),
             pht('Project name is required.'),
             nonempty(last($xactions), null));
 
           $error->setIsMissingFieldError(true);
           $errors[] = $error;
         }
 
         if (!$xactions) {
           break;
         }
 
         $name = last($xactions)->getNewValue();
         $name_used_already = id(new PhabricatorProjectQuery())
           ->setViewer($this->getActor())
           ->withNames(array($name))
           ->executeOne();
         if ($name_used_already &&
            ($name_used_already->getPHID() != $object->getPHID())) {
           $error = new PhabricatorApplicationTransactionValidationError(
             $type,
             pht('Duplicate'),
             pht('Project name is already used.'),
             nonempty(last($xactions), null));
           $errors[] = $error;
         }
 
         $slug_builder = clone $object;
         $slug_builder->setPhrictionSlug($name);
         $slug = $slug_builder->getPrimarySlug();
         $slug_used_already = id(new PhabricatorProjectSlug())
           ->loadOneWhere('slug = %s', $slug);
         if ($slug_used_already &&
             $slug_used_already->getProjectPHID() != $object->getPHID()) {
           $error = new PhabricatorApplicationTransactionValidationError(
             $type,
             pht('Duplicate'),
             pht('Project name can not be used due to hashtag collision.'),
             nonempty(last($xactions), null));
           $errors[] = $error;
         }
         break;
       case PhabricatorProjectTransaction::TYPE_SLUGS:
         if (!$xactions) {
           break;
         }
 
         $slug_xaction = last($xactions);
         $new = $slug_xaction->getNewValue();
 
         if ($new) {
           $slugs_used_already = id(new PhabricatorProjectSlug())
             ->loadAllWhere('slug IN (%Ls)', $new);
         } else {
           // The project doesn't have any extra slugs.
           $slugs_used_already = array();
         }
 
         $slugs_used_already = mgroup($slugs_used_already, 'getProjectPHID');
         foreach ($slugs_used_already as $project_phid => $used_slugs) {
           $used_slug_strs = mpull($used_slugs, 'getSlug');
           if ($project_phid == $object->getPHID()) {
             if (in_array($object->getPrimarySlug(), $used_slug_strs)) {
               $error = new PhabricatorApplicationTransactionValidationError(
                 $type,
                 pht('Invalid'),
                 pht(
                   'Project hashtag %s is already the primary hashtag.',
                   $object->getPrimarySlug()),
                 $slug_xaction);
               $errors[] = $error;
             }
             continue;
           }
 
           $error = new PhabricatorApplicationTransactionValidationError(
             $type,
             pht('Invalid'),
             pht(
               '%d project hashtag(s) are already used: %s.',
               count($used_slug_strs),
               implode(', ', $used_slug_strs)),
             $slug_xaction);
           $errors[] = $error;
         }
 
         break;
 
     }
 
     return $errors;
   }
 
 
   protected function requireCapabilities(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorProjectTransaction::TYPE_NAME:
       case PhabricatorProjectTransaction::TYPE_STATUS:
       case PhabricatorProjectTransaction::TYPE_IMAGE:
       case PhabricatorProjectTransaction::TYPE_ICON:
       case PhabricatorProjectTransaction::TYPE_COLOR:
         PhabricatorPolicyFilter::requireCapability(
           $this->requireActor(),
           $object,
           PhabricatorPolicyCapability::CAN_EDIT);
         return;
       case PhabricatorProjectTransaction::TYPE_LOCKED:
         PhabricatorPolicyFilter::requireCapability(
           $this->requireActor(),
           newv($this->getEditorApplicationClass(), array()),
           ProjectCanLockProjectsCapability::CAPABILITY);
         return;
       case PhabricatorTransactions::TYPE_EDGE:
         switch ($xaction->getMetadataValue('edge:type')) {
           case PhabricatorProjectProjectHasMemberEdgeType::EDGECONST:
             $old = $xaction->getOldValue();
             $new = $xaction->getNewValue();
 
             $add = array_keys(array_diff_key($new, $old));
             $rem = array_keys(array_diff_key($old, $new));
 
             $actor_phid = $this->requireActor()->getPHID();
 
             $is_join = (($add === array($actor_phid)) && !$rem);
             $is_leave = (($rem === array($actor_phid)) && !$add);
 
             if ($is_join) {
               // You need CAN_JOIN to join a project.
               PhabricatorPolicyFilter::requireCapability(
                 $this->requireActor(),
                 $object,
                 PhabricatorPolicyCapability::CAN_JOIN);
             } else if ($is_leave) {
               // You usually don't need any capabilities to leave a project.
               if ($object->getIsMembershipLocked()) {
                 // you must be able to edit though to leave locked projects
                 PhabricatorPolicyFilter::requireCapability(
                   $this->requireActor(),
                   $object,
                   PhabricatorPolicyCapability::CAN_EDIT);
               }
             } else {
               // You need CAN_EDIT to change members other than yourself.
               PhabricatorPolicyFilter::requireCapability(
                 $this->requireActor(),
                 $object,
                 PhabricatorPolicyCapability::CAN_EDIT);
             }
             return;
         }
         break;
     }
 
     return parent::requireCapabilities($object, $xaction);
   }
 
   protected function willPublish(PhabricatorLiskDAO $object, array $xactions) {
     $member_phids = PhabricatorEdgeQuery::loadDestinationPHIDs(
       $object->getPHID(),
       PhabricatorProjectProjectHasMemberEdgeType::EDGECONST);
     $object->attachMemberPHIDs($member_phids);
 
     return $object;
   }
 
   protected function shouldSendMail(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return true;
   }
 
   protected function getMailSubjectPrefix() {
     return pht('[Project]');
   }
 
   protected function getMailTo(PhabricatorLiskDAO $object) {
     return $object->getMemberPHIDs();
   }
 
   protected function getMailCC(PhabricatorLiskDAO $object) {
     $all = parent::getMailCC($object);
     return array_diff($all, $object->getMemberPHIDs());
   }
 
   public function getMailTagsMap() {
     return array(
       PhabricatorProjectTransaction::MAILTAG_METADATA =>
         pht('Project name, hashtags, icon, image, or color changes.'),
       PhabricatorProjectTransaction::MAILTAG_MEMBERS =>
         pht('Project membership changes.'),
       PhabricatorProjectTransaction::MAILTAG_WATCHERS =>
         pht('Project watcher list changes.'),
       PhabricatorProjectTransaction::MAILTAG_SUBSCRIBERS =>
         pht('Project subscribers change.'),
       PhabricatorProjectTransaction::MAILTAG_OTHER =>
         pht('Other project activity not listed above occurs.'),
     );
   }
 
   protected function buildReplyHandler(PhabricatorLiskDAO $object) {
     return id(new ProjectReplyHandler())
       ->setMailReceiver($object);
   }
 
   protected function buildMailTemplate(PhabricatorLiskDAO $object) {
     $id = $object->getID();
     $name = $object->getName();
 
     return id(new PhabricatorMetaMTAMail())
       ->setSubject("{$name}")
       ->addHeader('Thread-Topic', "Project {$id}");
   }
 
   protected function buildMailBody(
     PhabricatorLiskDAO $object,
     array $xactions) {
 
     $body = parent::buildMailBody($object, $xactions);
 
     $uri = '/project/profile/'.$object->getID().'/';
     $body->addLinkSection(
       pht('PROJECT DETAIL'),
       PhabricatorEnv::getProductionURI($uri));
 
     return $body;
   }
 
   protected function shouldPublishFeedStory(
     PhabricatorLiskDAO $object,
     array $xactions) {
     return true;
   }
 
   protected function supportsSearch() {
     return true;
   }
 
   protected function extractFilePHIDsFromCustomTransaction(
     PhabricatorLiskDAO $object,
     PhabricatorApplicationTransaction $xaction) {
 
     switch ($xaction->getTransactionType()) {
       case PhabricatorProjectTransaction::TYPE_IMAGE:
         $new = $xaction->getNewValue();
         if ($new) {
           return array($new);
         }
         break;
     }
 
     return parent::extractFilePHIDsFromCustomTransaction($object, $xaction);
   }
 
   private function addSlug(
     PhabricatorLiskDAO $object,
     $name) {
 
-    $object = (clone $object);
-    $object->setPhrictionSlug($name);
-    $slug = $object->getPrimarySlug();
+    $slug = PhabricatorSlug::normalizeProjectSlug($name);
 
     $slug_object = id(new PhabricatorProjectSlug())->loadOneWhere(
       'slug = %s',
       $slug);
 
     if ($slug_object) {
       return;
     }
 
     $new_slug = id(new PhabricatorProjectSlug())
       ->setSlug($slug)
       ->setProjectPHID($object->getPHID())
       ->save();
   }
 }
diff --git a/src/infrastructure/util/PhabricatorSlug.php b/src/infrastructure/util/PhabricatorSlug.php
index 53330391b1..fdac30a094 100644
--- a/src/infrastructure/util/PhabricatorSlug.php
+++ b/src/infrastructure/util/PhabricatorSlug.php
@@ -1,86 +1,92 @@
 <?php
 
 final class PhabricatorSlug extends Phobject {
 
+  public static function normalizeProjectSlug($slug) {
+    $slug = str_replace('/', ' ', $slug);
+    $slug = self::normalize($slug);
+    return rtrim($slug, '/');
+  }
+
   public static function normalize($slug) {
     $slug = preg_replace('@/+@', '/', $slug);
     $slug = trim($slug, '/');
     $slug = phutil_utf8_strtolower($slug);
     $slug = preg_replace("@[\\x00-\\x19#%&+=\\\\?<> ]+@", '_', $slug);
     $slug = preg_replace('@_+@', '_', $slug);
 
     // Remove leading and trailing underscores from each component, if the
     // component has not been reduced to a single underscore. For example, "a?"
     // converts to "a", but "??" converts to "_".
     $parts = explode('/', $slug);
     foreach ($parts as $key => $part) {
       if ($part != '_') {
         $parts[$key] = trim($part, '_');
       }
     }
     $slug = implode('/', $parts);
 
     // Specifically rewrite these slugs. It's OK to have a slug like "a..b",
     // but not a slug which is only "..".
 
     // NOTE: These are explicitly not pht()'d, because they should be stable
     // across languages.
 
     $replace = array(
       '.'   => 'dot',
       '..'  => 'dotdot',
     );
 
     foreach ($replace as $pattern => $replacement) {
       $pattern = preg_quote($pattern, '@');
       $slug = preg_replace(
         '@(^|/)'.$pattern.'(\z|/)@',
         '\1'.$replacement.'\2', $slug);
     }
 
     return $slug.'/';
   }
 
   public static function getDefaultTitle($slug) {
     $parts = explode('/', trim($slug, '/'));
     $default_title = end($parts);
     $default_title = str_replace('_', ' ', $default_title);
     $default_title = phutil_utf8_ucwords($default_title);
     $default_title = nonempty($default_title, pht('Untitled Document'));
     return $default_title;
   }
 
   public static function getAncestry($slug) {
     $slug = self::normalize($slug);
 
     if ($slug == '/') {
       return array();
     }
 
     $ancestors = array(
       '/',
     );
 
     $slug = explode('/', $slug);
     array_pop($slug);
     array_pop($slug);
 
     $accumulate = '';
     foreach ($slug as $part) {
       $accumulate .= $part.'/';
       $ancestors[] = $accumulate;
     }
 
     return $ancestors;
   }
 
   public static function getDepth($slug) {
     $slug = self::normalize($slug);
     if ($slug == '/') {
       return 0;
     } else {
       return substr_count($slug, '/');
     }
   }
 
 }