collavre 0.24.0 → 0.25.0

data/app/services/collavre/comments/topic_command.rb

@@ -21,7 +21,7 @@ module Collavre
 
       attr_reader :comment, :user, :creative, :url_helpers
 
-      # /topic "topic name" @agent_name
+      # /topic "topic name" @agent_name:
       # /topic "topic name"
       COMMAND_PATTERN = /\A\/topic\b/i.freeze
 
@@ -53,12 +53,61 @@ module Collavre
         # Find existing topic or create new one
         existing_topic = Topic.find_by(creative: creative, name: data[:name])
 
+        if existing_topic&.session_id.present?
+          # A Claude Channel session topic carries its agent as session identity,
+          # not as a routing pin (see TopicsController#set_primary_agent). Neither
+          # reassigning nor releasing it is safe from a chat command.
+          return I18n.t("collavre.comments.topic_command.session_topic_locked",
+                        name: existing_topic.name)
+        end
+
+        # User.mentionable_for resolves every searchable agent — and, on an
+        # inbox, every agent holding a share there, which includes the user's own
+        # Claude Channel session agent. Pinning an agent Matcher will not route
+        # to silences the topic outright: the pin is exclusive
+        # (Matcher#match_by_primary_agent suppresses the other agents' ambient
+        # routing) while the pinned agent itself is filtered out and cannot
+        # answer either. Resolved against the topic being targeted, so the check
+        # is the same mirror of Matcher the REST paths apply.
+        rejection = primary_agent &&
+          Topic.primary_agent_rejection(creative, primary_agent, topic: existing_topic)
+        if rejection
+          key = if rejection == :session_agent_outside_session_topic
+                  "collavre.comments.topic_command.session_agent_not_assignable"
+          else
+                  "collavre.comments.topic_command.agent_no_creative_access"
+          end
+          return I18n.t(key, agent: primary_agent.display_name)
+        end
+
+        # Assigning or releasing a primary agent rewrites the topic's routing:
+        # the pin decides who may speak here and silences every other agent. The
+        # REST equivalents (TopicsController#set_primary_agent and #create, which
+        # also accepts agent_id) require :write, but CommentsController#create
+        # only authorizes the comment at :feedback, so the command has to apply
+        # the same gate itself — otherwise commenting access would be enough to
+        # decide a topic's routing. Checked before the new/existing split because
+        # `/topic "new name" @agent:` persists an exclusive assignment just as
+        # much as moving one on a topic that already exists.
+        if assigns_primary_agent?(existing_topic, primary_agent) &&
+           !creative.has_permission?(user, :write)
+          return I18n.t("collavre.comments.topic_command.not_authorized")
+        end
+
         if existing_topic
           if primary_agent
             set_primary_agent(existing_topic, primary_agent)
+            broadcast_topic_agent_updated(existing_topic, primary_agent)
             I18n.t("collavre.comments.topic_command.updated_agent",
                    name: existing_topic.name,
                    agent: primary_agent.name)
+          elsif existing_topic.primary_agent_id
+            # /topic "name" with no @mention on an already-assigned topic releases
+            # the assignment — the keyboard counterpart of clicking the avatar off.
+            set_primary_agent(existing_topic, nil)
+            broadcast_topic_agent_updated(existing_topic, nil)
+            I18n.t("collavre.comments.topic_command.cleared_agent",
+                   name: existing_topic.name)
           else
             I18n.t("collavre.comments.topic_command.already_exists",
                    name: existing_topic.name)
@@ -95,6 +144,17 @@ module Collavre
         TopicsChannel.broadcast_to(creative, data)
       end
 
+      # Push an assignment change on an existing topic to every connected client.
+      # :primary_agent is always present (nil when released) so the merge on the
+      # client can actually remove the avatar rather than keep a stale one.
+      def broadcast_topic_agent_updated(topic, agent)
+        data = { action: "updated", topic: topic.slice(:id, :name), user_id: user.id }
+        data[:topic][:primary_agent] = if agent
+          { id: agent.id, name: agent.display_name, avatar_url: resolve_avatar_url(agent) }
+        end
+        TopicsChannel.broadcast_to(creative, data)
+      end
+
       def resolve_avatar_url(agent)
         if agent.avatar.attached?
           Rails.application.routes.url_helpers.rails_blob_url(
@@ -110,6 +170,17 @@ module Collavre
       def set_primary_agent(topic, agent)
         topic.set_primary_agent!(agent)
       end
+
+      # True when the command would write primary_agent_id: a mention assigns
+      # (or moves) the pin on either a new or an existing topic, and a bare
+      # /topic on an already assigned topic releases it. `/topic "name"` with no
+      # mention writes no assignment — on an unassigned existing topic it only
+      # reports that it already exists, and on a new one it creates a topic with
+      # ambient routing intact — so both stay open to commenters, matching the
+      # pre-existing rule that /topic can create topics at :feedback.
+      def assigns_primary_agent?(topic, primary_agent)
+        primary_agent.present? || topic&.primary_agent_id.present?
+      end
     end
   end
 end

data/app/services/collavre/comments/topic_mutation.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Collavre
+  module Comments
+    module TopicMutation
+      module_function
+
+      def call(topic_id, creative_id)
+        applied = false
+        ActiveRecord::Base.transaction do
+          next unless Orchestration::TopicSlot.lock_matches_context?(topic_id, creative_id)
+
+          yield
+          applied = true
+        end
+        applied
+      end
+    end
+  end
+end

data/app/services/collavre/creatives/breadcrumb_resolver.rb

@@ -84,7 +84,7 @@ module Creatives
     end
 
     def ancestor_label(creative)
-      creative.effective_description(nil, false).to_s.gsub(/\s+/, " ").strip
+      Collavre::HtmlText.label(creative.effective_description(nil, true))
     end
   end
 end

data/app/services/collavre/creatives/comment_badge_index.rb

@@ -1,30 +1,66 @@
 module Collavre
 module Creatives
-  # Batches the browse tree's comment badge. Per node this was two queries — a
-  # read-pointer lookup and an unread COUNT — which is what made the badge cost
-  # scale with the size of the rendered tree.
+  # Resolves the unread and visible comment counts used by every comment badge.
+  # Per node this was two queries — a read-pointer lookup and an unread COUNT —
+  # which is what made the browse-tree badge cost scale with the rendered tree.
   #
   # Keyed by *origin*: a linked shell shows its origin's comments.
+  #
+  # The counts it hands out are display-ready: they include only comments the
+  # user can see and apply presence suppression in one cache round trip.
   class CommentBadgeIndex
+    # SQLite permits at most 1,000 expression nodes and commonly only 999 bound
+    # values. Keep the largest badge query well below both limits.
+    QUERY_BATCH_SIZE = 500
+
+    Badge = Struct.new(:unread_count, :visible_comments, keyword_init: true)
+
+    # The comment-created fanout has one origin and many recipients. Resolve
+    # each topic watermark with database COUNTs instead of materialising the
+    # comment history in Ruby. Joining every recipient to public history made
+    # one broadcast materialise recipients × comments rows before grouping.
+    def self.for_users(origin:, users:)
+      recipients = users.compact.uniq(&:id)
+      return {} if recipients.empty?
+
+      counts_by_user_id = counts_for_users(origin, recipients.map(&:id))
+      present_user_ids = CommentPresenceStore.list(origin.id)
+      viewing_topics_by_user_id = CommentPresenceStore.viewing_topics_for(origin.id, present_user_ids)
+      recipients.to_h do |user|
+        counts_by_topic = counts_by_user_id.fetch(user.id, {})
+        viewing_topics = viewing_topics_by_user_id.fetch(user.id, [])
+        unread_count = counts_by_topic.sum do |topic_id, counts|
+          topic_is_viewed?(topic_id, viewing_topics) ? 0 : counts.fetch(:unread)
+        end
+
+        [ user.id, Badge.new(
+          unread_count: unread_count,
+          visible_comments: counts_by_topic.values.sum { |counts| counts.fetch(:visible) }.positive?
+        ) ]
+      end
+    end
+
     def initialize(user:)
       @user = user
       @unread_by_origin_id = {}
+      @visible_by_origin_id = {}
     end
 
-    def index(origins)
+    # Tree rendering only needs unread totals. Callers that render a standalone
+    # badge also need visible-comment state to decide whether a zero is shown.
+    def index(origins, include_visible_counts: true)
       pending = origins.uniq(&:id).reject { |o| @unread_by_origin_id.key?(o.id) }
       return if pending.empty?
 
-      watermarks = read_watermarks(pending.map(&:id))
-
-      # No read pointer means nothing has been read yet, so every comment counts
-      # as unread — including private ones, matching the counter cache.
-      pending.each do |origin|
-        @unread_by_origin_id[origin.id] = origin.comments_count unless watermarks.key?(origin.id)
+      origin_ids = pending.map(&:id)
+      watermarks = read_watermarks(origin_ids)
+      unread_counts = unread_counts(origin_ids, watermarks)
+      origin_ids.each do |origin_id|
+        @unread_by_origin_id[origin_id] = unread_counts.fetch(origin_id, 0)
       end
+      @visible_by_origin_id.merge!(visible_counts(origin_ids)) if include_visible_counts
 
-      counts = unread_counts(watermarks)
-      watermarks.each_key { |origin_id| @unread_by_origin_id[origin_id] = counts.fetch(origin_id, 0) }
+      suppress_for_present_user(pending.map(&:id))
     end
 
     # nil when the origin was never indexed, which tells the caller to fall back
@@ -33,40 +69,276 @@ module Creatives
       @unread_by_origin_id[origin.id]
     end
 
+    def visible_comments?(origin)
+      @visible_by_origin_id[origin.id].to_i.positive?
+    end
+
+    # The topic strip needs the same display-ready unread state as the creative
+    # badge, split by topic. A topic watermark wins; a legacy creative-wide
+    # watermark is only the fallback for a topic without its own row.
+    def unread_counts_by_topic(origin)
+      counts = unread_counts_by_topic_without_presence(origin)
+      suppress_viewing_topics!(counts, origin) if user
+      counts
+    end
+
     private
 
     attr_reader :user
 
+    # One read_multi for the whole level. An anonymous visitor is never present.
+    def suppress_for_present_user(origin_ids)
+      return unless user
+
+      present_origin_ids = CommentPresenceStore.list_many(origin_ids).filter_map do |origin_id, present_user_ids|
+        origin_id if present_user_ids.include?(user.id)
+      end
+      viewing_topics_by_origin_id = CommentPresenceStore.viewing_topics_for_creatives(user.id, present_origin_ids)
+
+      present_origin_ids.each do |origin_id|
+        origin = Creative.find_by(id: origin_id)
+        next unless origin
+
+        all_counts = unread_counts_by_topic_without_presence(origin)
+        remaining_counts = all_counts.dup
+        suppress_viewing_topics!(remaining_counts, origin, viewing_topics: viewing_topics_by_origin_id.fetch(origin_id, []))
+        @unread_by_origin_id[origin_id] -= all_counts.values.sum - remaining_counts.values.sum
+      end
+    end
+
+    def suppress_viewing_topics!(counts, origin, viewing_topics: CommentPresenceStore.viewing_topics(origin.id, user.id))
+      if viewing_topics.include?(CommentPresenceStore::ALL_TOPICS)
+        # All Messages renders Main and the active-topic snapshot returned with
+        # its list. A topic restored after that response stays unread until the
+        # list is reloaded and reports it in a new snapshot.
+        counts.delete(nil) if viewing_topics.include?(CommentPresenceStore::LEGACY_TOPIC)
+      end
+
+      # Another subscription can be viewing an archived topic while this one is
+      # on All Messages. Suppress every explicitly rendered topic as well.
+      viewing_topics.excluding(CommentPresenceStore::ALL_TOPICS).each { |topic_id| counts.delete(topic_id) }
+    end
+
     # `user_id: nil` for an anonymous visitor is the lookup the un-batched path
     # made too, so the two agree on which pointer (if any) applies.
     def read_watermarks(origin_ids)
       return {} if origin_ids.empty?
 
-      CommentReadPointer
-        .where(user_id: user&.id, creative_id: origin_ids)
-        .where.not(last_read_comment_id: nil)
-        .pluck(:creative_id, :last_read_comment_id)
-        .to_h
+      origin_ids.each_slice(QUERY_BATCH_SIZE).each_with_object({}) do |origin_id_batch, watermarks|
+        watermarks.merge!(CommentReadPointer
+          .where(user_id: user&.id, creative_id: origin_id_batch)
+          .pluck(:creative_id, :topic_id, :last_read_comment_id)
+          .each_with_object({}) do |(creative_id, topic_id, last_read_id), rows|
+            (rows[creative_id] ||= {})[topic_id] = last_read_id || 0
+          end)
+      end
     end
 
     # One grouped COUNT for the whole level. Each origin carries its own read
     # watermark, so the thresholds are OR-ed together rather than shared. Built
     # from relations rather than a SQL fragment: a hand-built string here would
     # be safe (literal template, bound values) but unprovably so to a scanner.
-    def unread_counts(watermarks)
-      return {} if watermarks.empty?
+    def unread_counts(origin_ids, watermarks)
+      origin_ids.each_slice(QUERY_BATCH_SIZE).each_with_object({}) do |origin_id_batch, counts|
+        counts.merge!(unread_counts_for_batch(origin_id_batch, watermarks))
+      end
+    end
+
+    def unread_counts_for_batch(origin_ids, watermarks)
+      scopes = origin_ids.map { |origin_id| unread_scope(origin_id, watermarks.fetch(origin_id, {})) }
+      visible_comments.merge(scopes.reduce { |combined, scope| combined.or(scope) }).group(:creative_id).count
+    end
+
+    def unread_scope(origin_id, watermarks)
+      legacy_watermark = watermarks.fetch(nil, 0)
+      topic_watermarks = watermarks.except(nil)
+      return Comment.where(creative_id: origin_id).where(Comment.arel_table[:id].gt(legacy_watermark)) if topic_watermarks.empty?
+
+      comment_table = Comment.arel_table
+      topic_ids = topic_watermarks.keys
+      fallback_scope = Comment.where(creative_id: origin_id).where(comment_table[:id].gt(legacy_watermark))
+      fallback_scope = fallback_scope.where(topic_id: nil).or(fallback_scope.where.not(topic_id: topic_ids))
+      topic_scopes = topic_watermarks.map do |topic_id, last_read_id|
+        Comment.where(creative_id: origin_id, topic_id: topic_id).where(comment_table[:id].gt(last_read_id))
+      end
+
+      ([ fallback_scope ] + topic_scopes).reduce { |combined, scope| combined.or(scope) }
+    end
+
+    def unread_counts_by_topic_without_presence(origin)
+      watermarks = read_watermarks([ origin.id ]).fetch(origin.id, {})
+      visible_comments.merge(unread_scope(origin.id, watermarks)).group(:topic_id).count
+    end
 
-      newer_than_watermark = watermarks
-        .map { |origin_id, last_read_id| unread_scope(origin_id, last_read_id) }
-        .reduce { |combined, scope| combined.or(scope) }
+    def visible_counts(origin_ids)
+      origin_ids.each_slice(QUERY_BATCH_SIZE).each_with_object({}) do |origin_id_batch, counts|
+        counts.merge!(visible_comments.where(creative_id: origin_id_batch).group(:creative_id).count)
+      end
+    end
 
-      Comment.where(private: false).merge(newer_than_watermark).group(:creative_id).count
+    def visible_comments
+      user ? Comment.visible_to(user) : Comment.public_only
     end
 
-    def unread_scope(origin_id, last_read_id)
-      Comment
-        .where(creative_id: origin_id)
-        .where(Comment.arel_table[:id].gt(last_read_id))
+    class << self
+      private
+
+      # A comment broadcast can fan out to many people. Count only the suffix
+      # after each effective watermark in the database; loading all historical
+      # comment IDs for every broadcast made the cost grow with the full thread.
+      def counts_for_users(origin, user_ids)
+        watermarks_by_user_id = read_watermarks_for_users(origin, user_ids)
+        public_topic_ids = Comment.where(creative_id: origin.id, private: false).distinct.pluck(:topic_id)
+        private_topic_ids_by_user_id = private_topic_ids_for_users(origin, user_ids)
+        requests_by_user_id = requests_by_user(user_ids, public_topic_ids, private_topic_ids_by_user_id, watermarks_by_user_id)
+        public_unread_counts = public_unread_counts_for(origin, requests_by_user_id.values)
+        private_requests_by_user_id = private_requests_by_user(user_ids, private_topic_ids_by_user_id, watermarks_by_user_id)
+        private_counts = private_counts_for(origin, private_requests_by_user_id)
+
+        counts_by_user(user_ids, requests_by_user_id, public_unread_counts, private_counts, public_topic_ids.any?)
+      end
+
+      def requests_by_user(user_ids, public_topic_ids, private_topics_by_user, watermarks_by_user)
+        user_ids.to_h do |user_id|
+          topic_ids = public_topic_ids | private_topics_by_user.fetch(user_id, [])
+          [ user_id, requests_for_topics(topic_ids, watermarks_by_user[user_id]) ]
+        end
+      end
+
+      def private_requests_by_user(user_ids, private_topics_by_user, watermarks_by_user)
+        user_ids.to_h do |user_id|
+          [ user_id, requests_for_topics(private_topics_by_user.fetch(user_id, []), watermarks_by_user[user_id]) ]
+        end
+      end
+
+      def requests_for_topics(topic_ids, watermarks)
+        topic_ids.to_h { |topic_id| [ topic_id, watermark_for(watermarks, topic_id) ] }
+      end
+
+      def counts_by_user(user_ids, requests_by_user, public_counts, private_counts, public_comments_exist)
+        user_ids.to_h do |user_id|
+          [ user_id, counts_by_topic(user_id, requests_by_user.fetch(user_id), public_counts, private_counts, public_comments_exist) ]
+        end
+      end
+
+      def counts_by_topic(user_id, requests, public_counts, private_counts, public_comments_exist)
+        requests.to_h do |topic_id, watermark|
+          private_count = private_counts.fetch([ user_id, topic_id, watermark ], { unread: 0, visible: 0 })
+          [ topic_id, combined_counts(topic_id, watermark, public_counts, private_count, public_comments_exist) ]
+        end
+      end
+
+      def combined_counts(topic_id, watermark, public_counts, private_count, public_comments_exist)
+        {
+          unread: public_counts.fetch([ topic_id, watermark ], 0) + private_count.fetch(:unread),
+          visible: (public_comments_exist || private_count.fetch(:visible).positive?) ? 1 : 0
+        }
+      end
+
+      def private_topic_ids_for_users(origin, user_ids)
+        topic_ids_by_user_id = Hash.new { |hash, user_id| hash[user_id] = [] }
+        [ :user_id, :approver_id ].each do |recipient_column|
+          Comment.where(creative_id: origin.id, private: true, recipient_column => user_ids).distinct.pluck(recipient_column, :topic_id).each do |user_id, topic_id|
+            topic_ids_by_user_id[user_id] << topic_id
+          end
+        end
+        topic_ids_by_user_id.transform_values!(&:uniq)
+      end
+
+      def public_unread_counts_for(origin, requests_by_user_id)
+        requests = requests_by_user_id.flat_map(&:to_a).uniq
+        return {} if requests.empty?
+
+        zero_watermark_topic_ids = requests.select { |_, watermark| watermark.zero? }.map(&:first)
+        counts = public_counts_after(origin, zero_watermark_topic_ids.uniq, 0)
+        positive_requests = requests.reject { |_, watermark| watermark.zero? }
+        positive_requests.each_slice(QUERY_BATCH_SIZE) do |request_batch|
+          counts.merge!(counts_from_rows(public_count_rows(origin, request_batch)) do |row|
+            [ row.fetch("topic_id")&.to_i, row.fetch("watermark").to_i ]
+          end)
+        end
+        counts
+      end
+
+      def public_counts_after(origin, topic_ids, watermark)
+        return {} if topic_ids.empty?
+
+        Comment.where(creative_id: origin.id, private: false, topic_id: topic_ids)
+          .where(Comment.arel_table[:id].gt(watermark))
+          .group(:topic_id)
+          .count
+          .transform_keys { |topic_id| [ topic_id, watermark ] }
+      end
+
+      def private_counts_for(origin, requests_by_user_id)
+        requests = requests_by_user_id.flat_map do |user_id, requests_by_topic|
+          requests_by_topic.map { |topic_id, watermark| [ user_id, topic_id, watermark ] }
+        end
+        requests.each_slice(QUERY_BATCH_SIZE).each_with_object({}) do |request_batch, counts|
+          counts.merge!(private_count_rows(origin, request_batch).to_h do |row|
+            [ [ row.fetch("user_id").to_i, row.fetch("topic_id")&.to_i, row.fetch("watermark").to_i ], {
+              unread: row.fetch("unread_count").to_i,
+              visible: row.fetch("visible_count").to_i
+            } ]
+          end)
+        end
+      end
+
+      def public_count_rows(origin, requests)
+        count_rows(requests) do |topic_id, watermark|
+          [
+            "SELECT ? AS topic_id, ? AS watermark, COUNT(*) AS unread_count FROM comments " \
+            "WHERE creative_id = ? AND private = ? AND #{topic_condition(topic_id)} AND id > ?",
+            topic_id, watermark, origin.id, false, *topic_binds(topic_id), watermark
+          ]
+        end
+      end
+
+      def private_count_rows(origin, requests)
+        count_rows(requests) do |user_id, topic_id, watermark|
+          [
+            "SELECT ? AS user_id, ? AS topic_id, ? AS watermark, " \
+            "SUM(CASE WHEN id > ? THEN 1 ELSE 0 END) AS unread_count, COUNT(*) AS visible_count FROM comments " \
+            "WHERE creative_id = ? AND private = ? AND #{topic_condition(topic_id)} AND (user_id = ? OR approver_id = ?)",
+            user_id, topic_id, watermark, watermark, origin.id, true, *topic_binds(topic_id), user_id, user_id
+          ]
+        end
+      end
+
+      def count_rows(requests)
+        sql = requests.map { |request| Comment.sanitize_sql_array(yield(*request)) }.join(" UNION ALL ")
+        Comment.connection.select_all(sql).to_a
+      end
+
+      def counts_from_rows(rows)
+        rows.to_h { |row| [ yield(row), row.fetch("unread_count").to_i ] }
+      end
+
+      def topic_condition(topic_id)
+        topic_id.nil? ? "topic_id IS NULL" : "topic_id = ?"
+      end
+
+      def topic_binds(topic_id)
+        topic_id.nil? ? [] : [ topic_id ]
+      end
+
+      def read_watermarks_for_users(origin, user_ids)
+        CommentReadPointer.where(user_id: user_ids, creative_id: origin.id)
+          .pluck(:user_id, :topic_id, :last_read_comment_id)
+          .each_with_object(Hash.new { |hash, user_id| hash[user_id] = {} }) do |(user_id, topic_id, last_read_id), watermarks|
+            watermarks[user_id][topic_id] = last_read_id || 0
+          end
+      end
+
+      def watermark_for(watermarks, topic_id)
+        watermarks.fetch(topic_id, watermarks.fetch(nil, 0))
+      end
+
+      def topic_is_viewed?(topic_id, viewing_topics)
+        return viewing_topics.include?(topic_id) unless viewing_topics.include?(CommentPresenceStore::ALL_TOPICS)
+
+        topic_id.nil? ? viewing_topics.include?(CommentPresenceStore::LEGACY_TOPIC) : viewing_topics.include?(topic_id)
+      end
     end
   end
 end

data/app/services/collavre/creatives/reorderer.rb

@@ -26,7 +26,7 @@ module Creatives
     def reorder_multiple(dragged_ids:, target_id:, direction:)
       ids = Array(dragged_ids).map(&:presence).compact
       validate_direction!(direction)
-      raise Error, "Invalid creatives" if ids.empty?
+      raise Error, "Invalid creatives" if ids.empty? || ids.map(&:to_s).uniq.size != ids.size
 
       target = Creative.find_by(id: target_id)
       raise Error, "Invalid creatives" unless target
@@ -178,8 +178,20 @@ module Creatives
     end
 
     def resequence!(creatives)
-      creatives.each_with_index do |creative, idx|
-        creative.update_column(:sequence, idx)
+      return if creatives.empty?
+
+      table = Creative.arel_table
+      cases = Arel::Nodes::Case.new(table[Creative.primary_key])
+      creatives.each_with_index do |creative, index|
+        cases.when(creative.id).then(index)
+      end
+
+      Creative.where(id: creatives.map(&:id))
+        .update_all(sequence: cases)
+
+      creatives.each_with_index do |creative, index|
+        creative.write_attribute(:sequence, index)
+        creative.send(:clear_attribute_change, :sequence)
       end
     end
   end

data/app/services/collavre/creatives/tree_builder.rb

@@ -97,7 +97,7 @@ module Creatives
       visible = creatives.reject(&:archived?).select { |creative| can_feedback?(creative) }
       return if visible.empty?
 
-      comment_badge_index.index(visible.map(&:effective_origin))
+      comment_badge_index.index(visible.map(&:effective_origin), include_visible_counts: false)
     end
 
     def build_nodes(creatives, level:)

data/app/services/collavre/creatives/tree_formatter.rb

@@ -1,7 +1,7 @@
 module Collavre
   module Creatives
     # Compact markdown tree formatter for AI Agent consumption.
-    # Used by: creative_retrieval_service, GeminiParentRecommender, Agent context injection.
+    # Used by: creative_retrieval_service and agent context injection.
     #
     # Output format (header declared once, rows are values only):
     #   <!-- format: [id] description (progress%) -->
@@ -34,10 +34,10 @@ module Collavre
         lines.join("\n")
       end
 
-      # Extract plain text description from a creative (shared helper)
+      # Extract plain text description from a creative (shared helper).
+      # One creative must occupy exactly one row, so this collapses newlines.
       def self.plain_description(creative)
-        raw = creative.effective_description(nil, true)
-        ActionView::Base.full_sanitizer.sanitize(raw).strip
+        Collavre::HtmlText.label(creative.effective_description(nil, true))
       end
 
       private
@@ -53,7 +53,7 @@ module Collavre
 
         if @include_comments
           node.comments.order(created_at: :desc).limit(3).reverse_each do |comment|
-            comment_text = ActionView::Base.full_sanitizer.sanitize(comment.content).strip.truncate(100)
+            comment_text = Collavre::HtmlText.truncated_label(comment.content, 100)
             lines << "#{indent}    > #{comment_text}"
           end
         end
@@ -67,7 +67,6 @@ module Collavre
         if @use_permissions
           node.linked_children
         else
-          # When children are pre-set on association target (e.g. GeminiParentRecommender)
           node.children
         end
       end

data/app/services/collavre/creatives/workspace_path_resolver.rb

@@ -0,0 +1,50 @@
+module Collavre
+module Creatives
+  # Resolves the IDs that the persistent workspace tree can actually render for
+  # the current creative. Shared origin paths are re-rooted through the user's
+  # linked shell, and unreadable or archived ancestors are omitted.
+  class WorkspacePathResolver
+    def initialize(creative:, user:)
+      @creative = creative
+      @user = user
+    end
+
+    def call
+      return [] unless creative
+
+      return renderable_ids(local_path_ids) if creative.origin_id?
+
+      origin_path = local_path_ids
+      reveal = RevealPathResolver.new([ creative.id ], user: user).call[creative.id]
+      return renderable_ids(origin_path) if reveal.blank?
+
+      reveal_paths = origin_path.filter_map { |id| [ id, reveal.fetch(id) ] if reveal.key?(id) }
+      renderable_reveal_ids = renderable_ids(reveal_paths.flat_map(&:last).uniq).to_set
+      anchor = reveal_paths.reverse.find do |_id, path|
+        path.all? { |id| renderable_reveal_ids.include?(id) }
+      end
+      return renderable_ids(origin_path) unless anchor
+
+      anchor_id, reveal_path = anchor
+      anchor_index = origin_path.index(anchor_id)
+      reveal_path + renderable_ids(origin_path.drop(anchor_index + 1))
+    end
+
+    private
+
+    attr_reader :creative, :user
+
+    def local_path_ids
+      creative.ancestors.reverse.pluck(:id) + [ creative.id ]
+    end
+
+    def renderable_ids(ids)
+      return [] if ids.empty?
+
+      readable = PermissionFilter.new(user: user).readable_ids(ids).to_set
+      active = Creative.where(id: ids, archived_at: nil).pluck(:id).to_set
+      ids.select { |id| readable.include?(id) && active.include?(id) }
+    end
+  end
+end
+end