diff --git a/resources/views/user/channel.blade.php b/resources/views/user/channel.blade.php
index 67707b2..9b3e5f1 100644
--- a/resources/views/user/channel.blade.php
+++ b/resources/views/user/channel.blade.php
@@ -414,9 +414,9 @@ $headerSocialMap = [
         {{-- ── LEFT: composer + feed ── --}}
         <div>
 
-            {{-- Composer (owner only) --}}
+            {{-- Composer (owner only, hidden when previewing as a visitor) --}}
             @auth
-            @if(Auth::id() === $user->id)
+            @if(Auth::id() === $user->id && !$preview)
             <div class="ch-composer">
                 <form action="{{ route('posts.store', $user->id) }}" method="POST" enctype="multipart/form-data" id="postForm">
                     @csrf
diff --git a/routes/web.php b/routes/web.php
index c786a8f..6a490e0 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -185,6 +185,14 @@ Route::middleware(['auth', 'verified'])->group(function () {
 
 // Channel - public for viewing. {username} is the user's slug (non-sequential, safe to share).
 Route::get('/channel/{username?}', [UserController::class, 'channel'])->name('channel');
+// YouTube-style @handle alias. For now `handle` is just the existing
+// `username` slug — if the two ever diverge, flip the controller lookup
+// in UserController::channel() to prefer a dedicated `handle` column.
+// The {handle} segment must be url-encoded (e.g. /%40alice) OR plain `@alice`
+// — Laravel's router accepts both because `@` is allowed in URI path segments.
+Route::get('/@{handle}', [UserController::class, 'channel'])
+    ->where('handle', '[A-Za-z0-9][A-Za-z0-9._-]*')
+    ->name('channel.handle');
 
 // Post routes - auth required
 Route::middleware(['auth'])->group(function () {