@promptowl/contextnest-community 1.14.0 → 1.15.0

package/dist/index.js

@@ -4,36 +4,45 @@ import {
   approve,
   canReadNode,
   cancelReview,
+  declineDeletion,
+  deletionTargetTitle,
   dispatchEvent,
+  dropDeletionRequest,
   edgeTypeRoutes,
   edgeTypeToResponse,
   envRoutes,
   envValues,
   filterAccessible,
+  getDeletionRequest,
+  getLatestDeletionRequest,
   getPendingReview,
   getReviewHistory,
   getReviewQueue,
   isSafeConnectorUrl,
+  listDeletionRequests,
   listNotifications,
   listWatchers,
   markNotificationsRead,
   nodeWriteKey,
+  notifyDeletionResolved,
   notifyNestEvent,
   notifyNestInvite,
   parseConditionSchema,
   reject,
   removeWatcher,
   repointPendingReview,
+  requestDeletion,
   requireWorkflowPlane,
   resolveCallerEmail,
   safeJson,
   safePublishDocument,
   seedDefaultEdgeTypes,
   sendTestNotification,
+  serializeNodeSafe,
   stripUndefinedDeep,
   submitForReview,
   withNodeWriteLock
-} from "./chunk-MZ4IR5KH.js";
+} from "./chunk-C4U75IUR.js";
 import {
   createGrant,
   deleteGrant,
@@ -42,7 +51,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-IHGPZ6NY.js";
+} from "./chunk-5IAKUUZF.js";
 import {
   generateApiKey,
   getKeyPrefix,
@@ -58,19 +67,35 @@ import {
   getCurrentVersion,
   getDisplayStatus,
   getVersions,
+  listMyDrafts,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-JP67WXLA.js";
+} from "./chunk-JWVZ3T35.js";
 import {
-  addMember,
-  buildTitleMap,
   canCreateInNest,
   canManageStewards,
   canUserAccess,
   canUserApprove,
   canUserEdit,
-  createNest,
   createStewardRecord,
+  getCollaboratorRole,
+  getStewardRolesForUser,
+  getStewardsForNest,
+  getStewardsForUser,
+  listStewards,
+  removeSteward,
+  resolveGrantRoles,
+  resolveStewardsForNode,
+  resolveStewardsWithFallback,
+  resolveUserRoles,
+  syncFromConfig,
+  updateSteward
+} from "./chunk-GWDOLYFJ.js";
+import {
+  addMember,
+  buildTitleMap,
+  canApproveWith,
+  createNest,
   createTeam,
   deleteNest,
   deleteTeam,
@@ -78,16 +103,14 @@ import {
   docLink,
   engineCache,
   findTeamByExternalId,
+  folderForNode,
   getAccessConfig,
-  getCollaboratorRole,
   getCurrentLicense,
   getNest,
-  getStewardRolesForUser,
-  getStewardsForNest,
-  getStewardsForUser,
   getSuspensionReason,
   getTeam,
   importNest,
+  insertOrIgnore,
   installLicenseKey,
   isConfigSuperAdmin,
   isLicenseAdminEmail,
@@ -101,7 +124,6 @@ import {
   listNests,
   listPublicNests,
   listSharedNests,
-  listStewards,
   listTeamsForUser,
   listVisibleNests,
   loadAccessConfig,
@@ -109,36 +131,37 @@ import {
   loadServerSettings,
   nestAllowsSelfApprove,
   nestName,
+  nestPrimeTags,
+  nestReviewsPrimeOnly,
   nestStorageRoot,
+  normalizeTag,
+  nowExpr,
   permissionLevel,
   persistSetting,
   removeMember,
-  removeSteward,
+  removeNodeFromTagIndex,
   renameNest,
   renameTeam,
   replaceTeamRoster,
-  resolveGrantRoles,
   resolveMemberIdentity,
   resolveNestPath,
   resolveNestPermission,
-  resolveStewardsForNode,
-  resolveStewardsWithFallback,
-  resolveUserRoles,
   sendEmailToRecipient,
   setAllowSelfApprove,
+  setPrimeOnlyReview,
+  setPrimeTags,
   setStewardshipEnabled,
   shareTeamWithNest,
   startLicenseSafetyPoll,
   startTelemetryLoop,
-  syncFromConfig,
+  syncNodeTags,
   trackEvent,
   uniqueNestName,
   unshareTeamFromNest,
   updateMemberRole,
-  updateSteward,
   validateLicense,
   verifySmtp
-} from "./chunk-KPK656BH.js";
+} from "./chunk-7BOG3S5H.js";
 import {
   AppError,
   ConflictError,
@@ -148,24 +171,20 @@ import {
   UnauthorizedError,
   ValidationError
 } from "./chunk-GUNJTORH.js";
-import {
-  normalizeEmail
-} from "./chunk-FRQJWGN3.js";
-import {
-  insertOrIgnore,
-  nowExpr
-} from "./chunk-XQ46F76G.js";
 import {
   config,
   getDb,
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-I5KYGMIT.js";
+} from "./chunk-BCFKLY4H.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID
 } from "./chunk-SLTQACJW.js";
+import {
+  normalizeEmail
+} from "./chunk-FRQJWGN3.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -393,6 +412,9 @@ function sweepStale(maxAgeMs = 10 * 6e4) {
 
 // src/auth/sso-token.ts
 import { createHmac, timingSafeEqual } from "crypto";
+function isValidTicketSub(sub) {
+  return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(sub) && sub.length <= 254;
+}
 function b64urlToBuffer(input) {
   const pad = input.length % 4 === 0 ? "" : "=".repeat(4 - input.length % 4);
   return Buffer.from(input.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64");
@@ -1215,6 +1237,7 @@ authRoutes.get("/sso", async (c) => {
   } catch {
     return ssoError("invalid_ticket");
   }
+  if ((claims.scope || "") === "mcp") return ssoError("invalid_ticket");
   const expectedAud = config.PUBLIC_BASE_URL;
   if (!expectedAud && !warnedMissingSsoAudience) {
     warnedMissingSsoAudience = true;
@@ -1227,7 +1250,7 @@ authRoutes.get("/sso", async (c) => {
     if (aud !== expectedAud) return ssoError("bad_audience");
   }
   const sub = (claims.sub || "").trim();
-  if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(sub) || sub.length > 254) {
+  if (!isValidTicketSub(sub)) {
     return ssoError("invalid_ticket");
   }
   if (!claims.jti) return ssoError("invalid_ticket");
@@ -1563,42 +1586,27 @@ import { streamText } from "hono/streaming";
 import {
   serializeDocument,
   parseDocument as parseDocument2,
-  normalizeStatus
+  normalizeStatus,
+  DocumentNotFoundError
 } from "@promptowl/contextnest-engine";
 import { rename, mkdir, rm } from "fs/promises";
 import { dirname, join as join2, basename } from "path";
 
-// src/governance/tag-index-service.ts
-function normalizeTag(raw) {
-  return raw.trim().replace(/^#+/, "").toLowerCase();
-}
-async function syncNodeTags(nestId, nodeId, tags) {
-  const db = getDb();
-  const normalized = Array.from(
-    new Set(
-      tags.filter((t) => typeof t === "string").map(normalizeTag).filter(Boolean)
-    )
-  );
-  const insertSql = insertOrIgnore(
-    db,
-    "INSERT INTO node_tag_index (nest_id, node_id, tag_name) VALUES (?, ?, ?)"
-  );
-  await db.transaction(async (tx) => {
-    await tx.run(
-      "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?",
-      [nestId, nodeId]
-    );
-    for (const tag of normalized) {
-      await tx.run(insertSql, [nestId, nodeId, tag]);
-    }
-  });
+// src/governance/prime-service.ts
+async function isPrimeDocument(nestId, tags, metadata) {
+  const flag = documentPrimeFlag(metadata);
+  if (flag !== void 0) return flag;
+  const primeTags = await nestPrimeTags(nestId);
+  if (!primeTags.length) return false;
+  const wanted = new Set(primeTags);
+  return (tags || []).some((t) => wanted.has(normalizeTag(String(t))));
 }
-async function removeNodeFromTagIndex(nestId, nodeId) {
-  const db = getDb();
-  await db.run(
-    "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?",
-    [nestId, nodeId]
-  );
+function documentPrimeFlag(metadata) {
+  const raw = metadata?.prime;
+  if (typeof raw === "boolean") return raw;
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  return void 0;
 }
 
 // src/governance/external-edit-service.ts
@@ -1784,7 +1792,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-FGL47APL.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-ECYCBVSE.js");
     await createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -1865,9 +1873,21 @@ async function userIdFromEmail(email) {
   return row?.id ?? ANON_USER_ID;
 }
 var normalizeTag2 = (t) => t.startsWith("#") ? t : `#${t}`;
+var MAX_TITLE_LENGTH = 120;
+function assertTitleLength(title) {
+  if (title.length > MAX_TITLE_LENGTH) {
+    throw new ValidationError(
+      `title must be at most ${MAX_TITLE_LENGTH} characters`
+    );
+  }
+}
 var slugify = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+function isIdUnderFolder(id, folder) {
+  return id.startsWith(`nodes/${folder}/`) || id.startsWith(`${folder}/`);
+}
 function folderToSegments(folder) {
   const segments = folder.split("/").map(slugify).filter(Boolean);
+  if (segments[0] === "nodes") segments.shift();
   if (segments.length > 8) {
     throw new ValidationError("folder may nest at most 8 levels deep");
   }
@@ -1928,7 +1948,8 @@ function toNodeResponse(node) {
     pendingChange: node.pendingChange ?? void 0,
     // Same YAML-coercion rule as title above: `schedule: 123` parses as a
     // number — normalize to string at the API boundary.
-    schedule: fm.metadata?.schedule != null ? String(fm.metadata.schedule) : void 0
+    schedule: fm.metadata?.schedule != null ? String(fm.metadata.schedule) : void 0,
+    prime: documentPrimeFlag(fm.metadata)
   };
 }
 async function resolveAuthorship(nestId, nodes) {
@@ -2069,17 +2090,29 @@ async function actorAutoPublishes(nestId, userEmail) {
   const roles = await resolveUserRoles(nestId, userEmail);
   return roles.includes("owner") || roles.includes("admin");
 }
+async function assertMayFlagPrime(nestId, userEmail) {
+  const roles = await resolveUserRoles(nestId, userEmail);
+  if (!roles.includes("owner") && !roles.includes("admin")) {
+    throw new ForbiddenError(
+      "Only the nest owner or an admin can change a document's prime flag."
+    );
+  }
+}
+async function autoPublishReason(nestId, userEmail, doc) {
+  if (!await isStewardshipEnabled(nestId)) return "no stewards configured";
+  if (await isPrimeDocument(nestId, doc.tags, doc.metadata)) return null;
+  if (await nestReviewsPrimeOnly(nestId)) {
+    return "prime-only review, document is not prime";
+  }
+  return await actorAutoPublishes(nestId, userEmail) ? "owner/admin self-approve" : null;
+}
 async function createNode(nestId, input, userEmail) {
   const { storage, versions: versionManager } = await engineCache.get(nestId);
-  const slug = slugify(input.title);
+  assertTitleLength(input.title);
+  const slug = slugify(input.title).slice(0, 100).replace(/-+$/, "");
   let id = input.id;
   if (!id) {
     const folderSegments = folderToSegments(input.folder ?? "");
-    if ([...folderSegments, slug].some((seg) => seg.length > 100)) {
-      throw new ValidationError(
-        "each folder or title segment must be at most 100 characters"
-      );
-    }
     id = folderSegments.length > 0 ? `nodes/${folderSegments.join("/")}/${slug}` : `nodes/${slug}`;
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -2098,72 +2131,75 @@ async function createNode(nestId, input, userEmail) {
       )})`
     );
   }
-  const deptTag = await departmentTagFor(userEmail);
-  if (deptTag && !tags.some((t) => t.toLowerCase() === deptTag)) {
-    tags.push(deptTag);
-  }
-  const hasStewards = await isStewardshipEnabled(nestId);
-  const autoPublish = !hasStewards || await actorAutoPublishes(nestId, userEmail);
-  const initialStatus = autoPublish ? "published" : "draft";
-  const initialVersion = autoPublish ? 0 : 1;
-  let node = {
-    id,
-    filePath: "",
-    frontmatter: {
-      title: input.title,
-      type: requestedType,
-      tags,
-      status: input.status || initialStatus,
-      version: initialVersion,
-      created_at: now,
-      updated_at: now,
-      metadata: {
-        owners: ["*"],
-        scope: input.scope || "team",
-        ...input.schedule ? { schedule: input.schedule } : {}
-      }
-    },
-    body: input.content,
-    rawContent: ""
-  };
-  await storage.writeDocument(id, serializeDocument(node));
-  await syncNodeTags(nestId, id, tags);
-  let savedVersion = 1;
-  if (!autoPublish) {
+  return withNodeWriteLock(nodeWriteKey(nestId, id), async () => {
+    let occupied = false;
     try {
-      await versionManager.createVersion(node, userEmail);
+      await storage.readDocument(id);
+      occupied = true;
     } catch (err) {
-      console.error("VersionManager.createVersion failed (node create)", err);
+      if (!(err instanceof DocumentNotFoundError)) throw err;
     }
-    await createVersion({
-      nestId,
-      nodeId: id,
-      version: 1,
-      content: input.content,
-      author: userEmail,
-      status: "draft",
-      tags
-    });
-  } else {
-    try {
-      const result = await safePublishDocument(storage, id, {
-        editedBy: userEmail,
-        note: hasStewards ? "Auto-published on create (owner/admin self-approve)" : "Auto-published on create (no stewards configured)"
-      });
-      savedVersion = result.node.frontmatter.version || 1;
-      await createVersion({
-        nestId,
-        nodeId: id,
-        version: savedVersion,
-        content: result.node.body || "",
-        author: userEmail,
-        status: "published",
-        tags
+    if (occupied) {
+      throw new ConflictError(
+        `A document already exists at ${id}. Update it, or create this one under a different folder or title.`
+      );
+    }
+    const db = getDb();
+    const orphan = await db.get(
+      "SELECT 1 AS present FROM node_versions WHERE nest_id = ? AND node_id = ? LIMIT 1",
+      [nestId, id]
+    );
+    if (orphan) {
+      console.warn(
+        `[nodes] clearing orphaned rows for ${id} \u2014 version history exists but no document does`
+      );
+      await db.transaction(async (tx) => {
+        await purgeNodeKeyedRows(tx, nestId, id);
       });
-      await setApprovedVersion(nestId, id, savedVersion, userEmail);
-      node = result.node;
-    } catch (err) {
-      console.error("publishDocument failed (node create auto-publish)", err);
+    }
+    const deptTag = await departmentTagFor(userEmail);
+    if (deptTag && !tags.some((t) => t.toLowerCase() === deptTag)) {
+      tags.push(deptTag);
+    }
+    if (input.prime !== void 0) await assertMayFlagPrime(nestId, userEmail);
+    const metadata = {
+      owners: ["*"],
+      scope: input.scope || "team",
+      ...input.schedule ? { schedule: input.schedule } : {},
+      ...input.prime === void 0 ? {} : { prime: input.prime }
+    };
+    const publishReason = await autoPublishReason(nestId, userEmail, {
+      tags,
+      metadata
+    });
+    const autoPublish = publishReason !== null;
+    const initialStatus = autoPublish ? "published" : "draft";
+    const initialVersion = autoPublish ? 0 : 1;
+    let node = {
+      id,
+      filePath: "",
+      frontmatter: {
+        title: input.title,
+        type: requestedType,
+        tags,
+        status: input.status || initialStatus,
+        version: initialVersion,
+        created_at: now,
+        updated_at: now,
+        metadata
+      },
+      body: input.content,
+      rawContent: ""
+    };
+    await storage.writeDocument(id, serializeDocument(node));
+    await syncNodeTags(nestId, id, tags);
+    let savedVersion = 1;
+    if (publishReason === null) {
+      try {
+        await versionManager.createVersion(node, userEmail);
+      } catch (err) {
+        console.error("VersionManager.createVersion failed (node create)", err);
+      }
       await createVersion({
         nestId,
         nodeId: id,
@@ -2173,10 +2209,42 @@ async function createNode(nestId, input, userEmail) {
         status: "draft",
         tags
       });
+    } else {
+      const publishNote = `Auto-published on create (${publishReason})`;
+      try {
+        const result = await safePublishDocument(storage, id, {
+          editedBy: userEmail,
+          note: publishNote
+        });
+        savedVersion = result.node.frontmatter.version || 1;
+        await createVersion({
+          nestId,
+          nodeId: id,
+          version: savedVersion,
+          content: result.node.body || "",
+          author: userEmail,
+          status: "published",
+          tags,
+          changeNote: publishNote
+        });
+        await setApprovedVersion(nestId, id, savedVersion, userEmail);
+        node = result.node;
+      } catch (err) {
+        console.error("publishDocument failed (node create auto-publish)", err);
+        await createVersion({
+          nestId,
+          nodeId: id,
+          version: 1,
+          content: input.content,
+          author: userEmail,
+          status: "draft",
+          tags
+        });
+      }
     }
-  }
-  await trackEvent("node.create", { nestId, nodeId: id });
-  return { node, version: savedVersion };
+    await trackEvent("node.create", { nestId, nodeId: id });
+    return { node, version: savedVersion };
+  });
 }
 function explicitFrontmatterStatus(raw) {
   const fm = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -2196,7 +2264,7 @@ async function resetImportedDocForPublish(storage, nestId, nodeId) {
   const fm = { ...node.frontmatter };
   delete fm.version;
   delete fm.checksum;
-  await storage.writeDocument(nodeId, serializeDocument({ ...node, frontmatter: fm }));
+  await storage.writeDocument(nodeId, serializeNodeSafe({ ...node, frontmatter: fm }));
 }
 async function registerImportedDocuments(nestId, userEmail, onProgress) {
   const { storage } = await engineCache.get(nestId);
@@ -2226,7 +2294,7 @@ async function registerImportedDocuments(nestId, userEmail, onProgress) {
     const title = doc.frontmatter?.title ?? (nodeId.split("/").pop() || nodeId);
     doc = { ...doc, frontmatter: { ...doc.frontmatter, title, author: userEmail } };
     try {
-      await storage.writeDocument(nodeId, serializeDocument(doc));
+      await storage.writeDocument(nodeId, serializeNodeSafe(doc));
     } catch (err) {
       console.error("import: failed to persist import metadata", nodeId, err);
     }
@@ -2338,6 +2406,9 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         };
       }
       if (patch.title) {
+        if (patch.title !== node.frontmatter.title) {
+          assertTitleLength(patch.title);
+        }
         node = {
           ...node,
           frontmatter: { ...node.frontmatter, title: patch.title }
@@ -2356,9 +2427,19 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         else metadata.schedule = patch.schedule;
         node = { ...node, frontmatter: { ...node.frontmatter, metadata } };
       }
+      if (patch.prime !== void 0) {
+        await assertMayFlagPrime(nestId, userEmail);
+        const metadata = { ...node.frontmatter.metadata };
+        if (patch.prime === null) delete metadata.prime;
+        else metadata.prime = patch.prime;
+        node = { ...node, frontmatter: { ...node.frontmatter, metadata } };
+      }
       const hasStewards = await isStewardshipEnabled(nestId);
-      const autoPublish = !hasStewards || await actorAutoPublishes(nestId, userEmail);
       const currentTags = node.frontmatter.tags || [];
+      const publishReason = await autoPublishReason(nestId, userEmail, {
+        tags: currentTags,
+        metadata: node.frontmatter.metadata
+      });
       const pendingReview = hasStewards ? await getPendingReview(nestId, nodeId) : null;
       const isAuthorEditingOwnReview = !!pendingReview && pendingReview.requestedBy.toLowerCase() === userEmail.toLowerCase();
       if (pendingReview && !isAuthorEditingOwnReview) {
@@ -2367,9 +2448,9 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         );
       }
       let responseVersion;
-      if (!autoPublish || isAuthorEditingOwnReview) {
+      if (publishReason === null || isAuthorEditingOwnReview) {
         const currentVersion = await getCurrentVersion(nestId, nodeId);
-        const newVersion = currentVersion + 1;
+        const newVersion = await versionManager.nextVersion(nodeId, currentVersion);
         node = {
           ...node,
           frontmatter: {
@@ -2422,10 +2503,11 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         await storage.writeDocument(nodeId, serializeDocument(node));
         await syncNodeTags(nestId, nodeId, currentTags);
         let publishedVersion = (node.frontmatter.version || 0) + 1;
+        const publishNote = patch.changeNote || `Auto-published on edit (${publishReason})`;
         try {
           const result = await safePublishDocument(storage, nodeId, {
             editedBy: userEmail,
-            note: patch.changeNote || (hasStewards ? "Auto-published on edit (owner/admin self-approve)" : "Auto-published on edit (no stewards)")
+            note: publishNote
           });
           publishedVersion = result.node.frontmatter.version || publishedVersion;
           node = result.node;
@@ -2444,7 +2526,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
           author: userEmail,
           status: "published",
           tags: currentTags,
-          changeNote: patch.changeNote
+          changeNote: publishNote
         });
         await setApprovedVersion(
           nestId,
@@ -2464,9 +2546,69 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
     }
   });
 }
+async function assertNotReviewLocked(nestId, nodeId, userEmail, action) {
+  if (!await isStewardshipEnabled(nestId)) return;
+  if (!await getPendingReview(nestId, nodeId)) return;
+  if (canApproveWith(await resolveUserRoles(nestId, userEmail, { nodeId }))) return;
+  throw new LockedError(
+    `This document is awaiting steward review and is locked. Approve or reject the pending review before ${action}, or ask a reviewer to.`
+  );
+}
 function derivedIdOf(sourceNodeId) {
   return `nodes/${sourceNodeId.replace(/^nodes\//, "")}--annotations`;
 }
+var NODE_KEYED_TABLES = [
+  ["node_versions", "node_id"],
+  ["review_requests", "node_id"],
+  ["deletion_requests", "node_id"],
+  ["approved_versions", "node_id"],
+  ["annotation_threads", "node_id"],
+  ["comments", "node_id"],
+  ["node_tag_index", "node_id"],
+  ["watchers", "node_id"],
+  ["schedules", "agent_node"],
+  // A live capability token bound to one agent node — deleting the agent must
+  // revoke it, or a later node at that id answers the old webhook.
+  ["trigger_hooks", "agent_node"],
+  ["edges", "from_node"],
+  ["edges", "to_node"]
+];
+async function purgeNodeKeyedRows(tx, nestId, nodeId) {
+  for (const [table, column] of NODE_KEYED_TABLES) {
+    await tx.run(`DELETE FROM ${table} WHERE nest_id = ? AND ${column} = ?`, [
+      nestId,
+      nodeId
+    ]);
+  }
+  await tx.run(
+    `DELETE FROM stewards
+     WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`,
+    [nestId, nodeId]
+  );
+  await tx.run(
+    `DELETE FROM grants
+     WHERE nest_id = ? AND target_type = 'document' AND target = ?`,
+    [nestId, nodeId]
+  );
+}
+async function rewriteNodeKeyedRows(tx, nestId, oldId, newId) {
+  for (const [table, column] of NODE_KEYED_TABLES) {
+    await tx.run(
+      `UPDATE ${table} SET ${column} = ? WHERE nest_id = ? AND ${column} = ?`,
+      [newId, nestId, oldId]
+    );
+  }
+  await tx.run(
+    `UPDATE stewards SET node_pattern = ?
+     WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`,
+    [newId, nestId, oldId]
+  );
+  await tx.run(
+    `UPDATE grants SET target = ?
+     WHERE nest_id = ? AND target_type = 'document' AND target = ?`,
+    [newId, nestId, oldId]
+  );
+}
 async function moveNode(nestId, nodeId, folder, userEmail) {
   const { storage } = await engineCache.get(nestId);
   let node;
@@ -2475,103 +2617,124 @@ async function moveNode(nestId, nodeId, folder, userEmail) {
   } catch {
     throw new NotFoundError(`Node not found: ${nodeId}`);
   }
-  if (await isStewardshipEnabled(nestId) && await getPendingReview(nestId, nodeId)) {
-    throw new LockedError(
-      "This document is awaiting steward review and is locked. Approve or reject the pending review before moving."
-    );
-  }
+  await assertNotReviewLocked(nestId, nodeId, userEmail, "moving");
   const leaf = nodeId.split("/").pop();
   const segments = folderToSegments(folder);
   const newId = segments.length > 0 ? `nodes/${segments.join("/")}/${leaf}` : `nodes/${leaf}`;
   if (newId === nodeId) return { node, previousId: nodeId };
-  try {
-    await storage.readDocument(newId);
-    throw new ConflictError(
-      `A document already exists at that location: ${newId}`
-    );
-  } catch (err) {
-    if (err instanceof ConflictError) throw err;
-  }
-  const moved = {
-    ...node,
-    id: newId,
-    frontmatter: {
-      ...node.frontmatter,
-      updated_at: (/* @__PURE__ */ new Date()).toISOString()
+  return withNodeWriteLock(nodeWriteKey(nestId, newId), async () => {
+    try {
+      await storage.readDocument(newId);
+      throw new ConflictError(
+        `A document already exists at that location: ${newId}`
+      );
+    } catch (err) {
+      if (err instanceof ConflictError) throw err;
+      if (!(err instanceof DocumentNotFoundError)) throw err;
     }
-  };
-  await storage.writeDocument(newId, serializeDocument(moved));
-  try {
-    const nestPath = resolveNestPath(nestId);
-    const oldChain = join2(nestPath, dirname(nodeId), ".versions", leaf);
-    const newChain = join2(nestPath, dirname(newId), ".versions", leaf);
-    if (oldChain !== newChain) {
-      await mkdir(dirname(newChain), { recursive: true });
-      await rename(oldChain, newChain);
+    const moved = {
+      ...node,
+      id: newId,
+      frontmatter: {
+        ...node.frontmatter,
+        updated_at: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    };
+    await storage.writeDocument(newId, serializeNodeSafe(moved));
+    try {
+      const nestPath = resolveNestPath(nestId);
+      const oldChain = join2(nestPath, dirname(nodeId), ".versions", leaf);
+      const newChain = join2(nestPath, dirname(newId), ".versions", leaf);
+      if (oldChain !== newChain) {
+        await mkdir(dirname(newChain), { recursive: true });
+        await rename(oldChain, newChain);
+      }
+    } catch {
     }
-  } catch {
-  }
-  await storage.deleteDocument(nodeId);
-  const oldDerived = derivedIdOf(nodeId);
-  const newDerived = derivedIdOf(newId);
-  const db = getDb();
-  await db.transaction(async (tx) => {
-    for (const [table, column] of [
-      ["node_versions", "node_id"],
-      ["review_requests", "node_id"],
-      ["approved_versions", "node_id"],
-      ["annotation_threads", "node_id"],
-      ["comments", "node_id"],
-      ["node_tag_index", "node_id"]
-    ]) {
+    await storage.deleteDocument(nodeId);
+    const oldDerived = derivedIdOf(nodeId);
+    const newDerived = derivedIdOf(newId);
+    const db = getDb();
+    await db.transaction(async (tx) => {
+      await rewriteNodeKeyedRows(tx, nestId, nodeId, newId);
+      await rewriteNodeKeyedRows(tx, nestId, oldDerived, newDerived);
       await tx.run(
-        `UPDATE ${table} SET ${column} = ? WHERE nest_id = ? AND ${column} = ?`,
+        "UPDATE runs SET agent_node = ? WHERE nest_id = ? AND agent_node = ?",
         [newId, nestId, nodeId]
       );
       await tx.run(
-        `UPDATE ${table} SET ${column} = ? WHERE nest_id = ? AND ${column} = ?`,
-        [newDerived, nestId, oldDerived]
+        `UPDATE run_steps SET node_id = ?
+         WHERE node_id = ? AND run_id IN (SELECT id FROM runs WHERE nest_id = ?)`,
+        [newId, nodeId, nestId]
+      );
+    });
+    try {
+      const derivedDoc = await storage.readDocument(oldDerived);
+      await storage.writeDocument(
+        newDerived,
+        serializeNodeSafe({ ...derivedDoc, id: newDerived })
       );
+      await storage.deleteDocument(oldDerived);
+    } catch {
     }
-    await tx.run(
-      `UPDATE stewards SET node_pattern = ?
-       WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`,
-      [newId, nestId, nodeId]
-    );
-    await tx.run(
-      `UPDATE grants SET target = ?
-       WHERE nest_id = ? AND target_type = 'document' AND target = ?`,
-      [newId, nestId, nodeId]
-    );
-    await tx.run(
-      "UPDATE edges SET from_node = ? WHERE nest_id = ? AND from_node = ?",
-      [newId, nestId, nodeId]
-    );
-    await tx.run(
-      "UPDATE edges SET to_node = ? WHERE nest_id = ? AND to_node = ?",
-      [newId, nestId, nodeId]
-    );
-    await tx.run(
-      "UPDATE runs SET agent_node = ? WHERE nest_id = ? AND agent_node = ?",
-      [newId, nestId, nodeId]
-    );
-    await tx.run(
-      `UPDATE run_steps SET node_id = ?
-       WHERE node_id = ? AND run_id IN (SELECT id FROM runs WHERE nest_id = ?)`,
-      [newId, nodeId, nestId]
-    );
+    await trackEvent("node.move", { nestId, nodeId, newId });
+    return { node: moved, previousId: nodeId };
   });
+}
+async function deleteNode(nestId, nodeId, userEmail) {
+  const { storage } = await engineCache.get(nestId);
+  await assertNotReviewLocked(nestId, nodeId, userEmail, "deleting");
   try {
-    const derivedDoc = await storage.readDocument(oldDerived);
-    await storage.writeDocument(
-      newDerived,
-      serializeDocument({ ...derivedDoc, id: newDerived })
-    );
-    await storage.deleteDocument(oldDerived);
+    await storage.deleteDocument(nodeId);
+  } catch {
+    throw new NotFoundError(`Node not found: ${nodeId}`);
+  }
+  await removeNodeFromTagIndex(nestId, nodeId);
+  const derivedId = derivedIdOf(nodeId);
+  try {
+    await storage.deleteDocument(derivedId);
+    await removeNodeFromTagIndex(nestId, derivedId);
   } catch {
   }
-  await trackEvent("node.move", { nestId, nodeId, newId });
-  return { node: moved, previousId: nodeId };
+  const db = getDb();
+  await db.transaction(async (tx) => {
+    await purgeNodeKeyedRows(tx, nestId, nodeId);
+    await purgeNodeKeyedRows(tx, nestId, derivedId);
+    await tx.run(
+      `INSERT INTO node_deletions (nest_id, node_id, deleted_by, deleted_at)
+       VALUES (?, ?, ?, ?)
+       ON CONFLICT(nest_id, node_id) DO UPDATE
+         SET deleted_by = excluded.deleted_by, deleted_at = excluded.deleted_at`,
+      [nestId, nodeId, userEmail, (/* @__PURE__ */ new Date()).toISOString()]
+    );
+  });
+  await trackEvent("node.delete", { nestId, nodeId });
+}
+async function deleteFolder(nestId, folder, userEmail) {
+  const segments = folderToSegments(folder);
+  if (segments.length === 0) {
+    throw new ValidationError("folder is required");
+  }
+  const rel = segments.join("/");
+  const { storage } = await engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const targets = docs.map((d) => d.id).filter((id) => isIdUnderFolder(id, rel));
+  if (targets.length === 0) {
+    throw new NotFoundError(`No documents found under folder: ${folder}`);
+  }
+  const deleted = [];
+  for (const id of targets) {
+    try {
+      await deleteNode(nestId, id, userEmail);
+      deleted.push(id);
+    } catch (err) {
+      const detail = deleted.length > 0 ? ` (${deleted.length} of ${targets.length} already deleted)` : "";
+      throw new Error(
+        `Failed to delete "${id}"${detail}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  return deleted;
 }
 
 // src/nests/unsynced-service.ts
@@ -3023,7 +3186,9 @@ nestRoutes.get("/:nestId/settings", async (c) => {
   }
   return c.json({
     stewardship_enabled: await isStewardshipEnabled(nestId),
-    allow_self_approve: await nestAllowsSelfApprove(nestId)
+    allow_self_approve: await nestAllowsSelfApprove(nestId),
+    prime_only_review: await nestReviewsPrimeOnly(nestId),
+    prime_tags: await nestPrimeTags(nestId)
   });
 });
 nestRoutes.patch("/:nestId/settings", async (c) => {
@@ -3059,9 +3224,20 @@ nestRoutes.patch("/:nestId/settings", async (c) => {
   if (typeof body.allow_self_approve === "boolean") {
     await setAllowSelfApprove(nestId, body.allow_self_approve);
   }
+  if (typeof body.prime_only_review === "boolean") {
+    await setPrimeOnlyReview(nestId, body.prime_only_review);
+  }
+  if (body.prime_tags !== void 0) {
+    await setPrimeTags(
+      nestId,
+      Array.isArray(body.prime_tags) ? body.prime_tags : [body.prime_tags]
+    );
+  }
   return c.json({
     stewardship_enabled: await isStewardshipEnabled(nestId),
     allow_self_approve: await nestAllowsSelfApprove(nestId),
+    prime_only_review: await nestReviewsPrimeOnly(nestId),
+    prime_tags: await nestPrimeTags(nestId),
     wiped
   });
 });
@@ -3732,294 +3908,6 @@ ${m[1]}
 ` : "";
 }
 
-// src/annotations/service.ts
-import { v4 as uuid5 } from "uuid";
-
-// src/annotations/projection.ts
-var MAX_CONTEXT_CHARS = 250;
-var MAX_QUOTE_CHARS = 1e3;
-function clampAnchor(raw) {
-  if (!raw) return null;
-  const quote = (raw.quote ?? "").trim().slice(0, MAX_QUOTE_CHARS);
-  if (!quote) return null;
-  const before = (raw.before ?? "").slice(-MAX_CONTEXT_CHARS);
-  const after = (raw.after ?? "").slice(0, MAX_CONTEXT_CHARS);
-  const line = typeof raw.line === "number" && Number.isFinite(raw.line) && raw.line > 0 ? Math.floor(raw.line) : void 0;
-  return { quote, before, after, ...line !== void 0 ? { line } : {} };
-}
-function oneLine(s) {
-  return s.replace(/\s+/g, " ").replace(/--+>/g, "-\u2192").trim();
-}
-function renderAnchor(anchor) {
-  if (!anchor) {
-    return "<!-- anchor: whole-artifact -->";
-  }
-  const linePart = anchor.line !== void 0 ? `line ${anchor.line} \xB7 ` : "";
-  const context = `\u2026${oneLine(anchor.before)}\u3008${oneLine(anchor.quote)}\u3009${oneLine(
-    anchor.after
-  )}\u2026`;
-  return `<!-- anchor: ${linePart}quote "${oneLine(anchor.quote)}" \xB7 context ${context} -->`;
-}
-function statusHeading(thread) {
-  if (thread.status === "resolved") {
-    const who = thread.resolvedBy ? `${thread.resolvedBy}, ` : "";
-    const when = thread.resolvedAt ? `${thread.resolvedAt}` : "";
-    const meta = who || when ? ` (${who}${when})` : "";
-    return `\u2705 RESOLVED${meta}`;
-  }
-  return "\u{1F7E0} OPEN";
-}
-function snapshotLabel(v) {
-  return v == null ? "Unpinned" : `Snapshot v${v}`;
-}
-function orderThreads(threads) {
-  return [...threads].sort((a, b) => {
-    if (a.status !== b.status) return a.status === "open" ? -1 : 1;
-    return a.createdAt.localeCompare(b.createdAt);
-  });
-}
-function projectThreadsToMarkdown(artifactTitle, threads) {
-  const lines = [];
-  lines.push(`# ${artifactTitle} \u2014 Annotations`);
-  lines.push("");
-  lines.push(
-    "> Auto-generated from review comments, grouped by the artifact snapshot each was anchored to. **Open** threads are unresolved feedback for the next iteration; **resolved** threads were already addressed (don't re-break them)."
-  );
-  lines.push("");
-  if (threads.length === 0) {
-    lines.push("_No annotations yet._");
-    lines.push("");
-    return lines.join("\n");
-  }
-  const buckets2 = /* @__PURE__ */ new Map();
-  for (const t of threads) {
-    const key = t.snapshotVersion ?? null;
-    (buckets2.get(key) ?? buckets2.set(key, []).get(key)).push(t);
-  }
-  const keys = [...buckets2.keys()].sort((a, b) => {
-    if (a == null) return 1;
-    if (b == null) return -1;
-    return b - a;
-  });
-  for (const key of keys) {
-    lines.push(`## ${snapshotLabel(key)}`);
-    lines.push("");
-    for (const thread of orderThreads(buckets2.get(key))) {
-      lines.push(`### Thread \xB7 ${statusHeading(thread)}`);
-      lines.push(renderAnchor(thread.anchor));
-      for (const comment of thread.comments) {
-        lines.push(
-          `- **${comment.author}** \xB7 ${comment.createdAt} \u2014 ${comment.body}`
-        );
-      }
-      lines.push("");
-    }
-  }
-  return lines.join("\n");
-}
-
-// src/annotations/service.ts
-async function loadComments(threadId) {
-  const db = getDb();
-  const rows = await db.all(
-    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, id ASC",
-    [threadId]
-  );
-  return rows.map((r) => ({
-    id: r.id,
-    author: r.author,
-    body: r.body,
-    createdAt: r.created_at
-  }));
-}
-async function rowToThread(row) {
-  let anchor = null;
-  if (row.anchor_json) {
-    try {
-      anchor = JSON.parse(row.anchor_json);
-    } catch {
-      anchor = null;
-    }
-  }
-  return {
-    id: row.id,
-    nestId: row.nest_id,
-    nodeId: row.node_id,
-    snapshotVersion: row.snapshot_version,
-    anchor,
-    status: row.status,
-    createdBy: row.created_by,
-    createdAt: row.created_at,
-    resolvedBy: row.resolved_by,
-    resolvedAt: row.resolved_at,
-    comments: await loadComments(row.id)
-  };
-}
-async function getThreadRow(threadId) {
-  return await getDb().get("SELECT * FROM annotation_threads WHERE id = ?", [threadId]);
-}
-async function countThreadsByNode(nestId) {
-  const rows = await getDb().all(
-    `SELECT node_id, CAST(COUNT(*) AS INTEGER) AS count, MAX(created_at) AS last_at
-         FROM annotation_threads
-        WHERE nest_id = ?
-        GROUP BY node_id`,
-    [nestId]
-  );
-  const out = {};
-  for (const r of rows) out[r.node_id] = { count: r.count, lastAt: r.last_at };
-  return out;
-}
-async function listThreads(nestId, nodeId) {
-  const rows = await getDb().all(
-    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, id ASC",
-    [nestId, nodeId]
-  );
-  return Promise.all(rows.map(rowToThread));
-}
-async function createThread(nestId, nodeId, input, authorEmail) {
-  const body = (input.body ?? "").trim();
-  if (!body) {
-    throw new Error("comment body is required");
-  }
-  const db = getDb();
-  const id = uuid5();
-  const anchor = clampAnchor(input.anchor);
-  const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
-  await db.transaction(async (tx) => {
-    await tx.run(
-      `INSERT INTO annotation_threads
-         (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by)
-       VALUES (?, ?, ?, ?, ?, 'open', ?)`,
-      [
-        id,
-        nestId,
-        nodeId,
-        snapshot,
-        anchor ? JSON.stringify(anchor) : null,
-        authorEmail
-      ]
-    );
-    await tx.run(
-      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
-      [uuid5(), id, authorEmail, body]
-    );
-  });
-  return rowToThread(await getThreadRow(id));
-}
-async function getScopedThreadRow(threadId, nestId, nodeId) {
-  const row = await getThreadRow(threadId);
-  if (!row || row.nest_id !== nestId || row.node_id !== nodeId) {
-    throw new NotFoundError(`Thread not found: ${threadId}`);
-  }
-  return row;
-}
-async function addComment(nestId, nodeId, threadId, authorEmail, body) {
-  const trimmed = (body ?? "").trim();
-  if (!trimmed) {
-    throw new Error("comment body is required");
-  }
-  await getScopedThreadRow(threadId, nestId, nodeId);
-  await getDb().run(
-    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
-    [uuid5(), threadId, authorEmail, trimmed]
-  );
-  return rowToThread(await getThreadRow(threadId));
-}
-async function setThreadStatus(nestId, nodeId, threadId, status, byEmail) {
-  await getScopedThreadRow(threadId, nestId, nodeId);
-  const db = getDb();
-  if (status === "resolved") {
-    await db.run(
-      `UPDATE annotation_threads SET status = 'resolved', resolved_by = ?, resolved_at = ${nowExpr(db)} WHERE id = ?`,
-      [byEmail, threadId]
-    );
-  } else {
-    await db.run(
-      "UPDATE annotation_threads SET status = 'open', resolved_by = NULL, resolved_at = NULL WHERE id = ?",
-      [threadId]
-    );
-  }
-  return rowToThread(await getThreadRow(threadId));
-}
-async function readArtifact(nestId, nodeId, version) {
-  const { storage, versions: versionManager } = await engineCache.get(nestId);
-  const target = version ?? await getApprovedVersion(nestId, nodeId) ?? null;
-  let title = nodeId;
-  let type = null;
-  let liveHtml = "";
-  let liveExists = true;
-  try {
-    const node = await storage.readDocument(nodeId);
-    title = node.frontmatter?.title || nodeId;
-    type = node.frontmatter?.type || null;
-    liveHtml = node.body || "";
-  } catch {
-    liveExists = false;
-  }
-  if (target != null) {
-    try {
-      const raw = await versionManager.reconstructVersion(nodeId, target);
-      return { title, html: bodyOnly(nodeId, raw), version: target, type };
-    } catch (err) {
-      console.warn(
-        `[annotations] reconstruct v${target} failed for ${nestId}/${nodeId}; falling back to live body:`,
-        err
-      );
-    }
-  }
-  if (!liveExists) {
-    throw new NotFoundError(`Artifact not found: ${nodeId}`);
-  }
-  return { title, html: liveHtml, version: target, type };
-}
-function derivedAnnotationsId(sourceNodeId) {
-  const base = sourceNodeId.replace(/^nodes\//, "");
-  return `nodes/${base}--annotations`;
-}
-async function syncAnnotationsNode(nestId, nodeId, userEmail) {
-  try {
-    let title = nodeId;
-    let type = null;
-    try {
-      const { storage } = await engineCache.get(nestId);
-      const node = await storage.readDocument(nodeId);
-      title = node.frontmatter?.title || nodeId;
-      type = node.frontmatter?.type || "document";
-    } catch {
-    }
-    if (type !== null && type !== "artifact") return;
-    const threads = await listThreads(nestId, nodeId);
-    const derivedTitle = `${title} \u2014 Annotations`;
-    const markdown = projectThreadsToMarkdown(title, threads);
-    const derivedId = derivedAnnotationsId(nodeId);
-    try {
-      await updateNode(nestId, derivedId, { content: markdown }, userEmail);
-    } catch (err) {
-      if (err instanceof NotFoundError) {
-        await createNode(
-          nestId,
-          {
-            id: derivedId,
-            title: derivedTitle,
-            content: markdown,
-            type: "document",
-            tags: ["annotations"]
-          },
-          userEmail
-        );
-      } else {
-        throw err;
-      }
-    }
-  } catch (err) {
-    console.warn(
-      `[annotations] failed to sync derived node for ${nestId}/${nodeId}:`,
-      err
-    );
-  }
-}
-
 // src/nodes/routes.ts
 var nodeRoutes = new Hono8();
 function nodeAsMarkdown(response, nodeId) {
@@ -4068,7 +3956,8 @@ nodeRoutes.post("/", async (c) => {
       scope: body.scope,
       status: body.status,
       schedule: body.schedule,
-      folder: body.folder
+      folder: body.folder,
+      prime: body.prime
     },
     authorEmail
   );
@@ -4085,7 +3974,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-G7IF7ZNP.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-FHJ2RBKN.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -4103,42 +3992,10 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
     ownerEmail
   });
 });
-nodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-FGL47APL.js");
-  const allVersions = await getVersions2(nestId, nodeId);
-  const approved = await getApprovedVersion2(nestId, nodeId);
-  const db = getDb();
-  const resolutions = await db.all(
-    `SELECT version, status, resolved_by, resolved_at
-         FROM review_requests
-        WHERE nest_id = ? AND node_id = ?
-          AND status IN ('approved', 'rejected')
-          AND resolved_by IS NOT NULL
-        ORDER BY resolved_at DESC`,
-    [nestId, nodeId]
-  );
-  const byVersion = /* @__PURE__ */ new Map();
-  for (const r of resolutions) {
-    if (!byVersion.has(r.version)) {
-      byVersion.set(r.version, { status: r.status, resolvedBy: r.resolved_by });
-    }
-  }
-  const enriched = allVersions.map((v) => {
-    const r = byVersion.get(v.version);
-    return r ? { ...v, resolvedBy: r.resolvedBy, resolutionStatus: r.status } : v;
-  });
-  return c.json({
-    versions: enriched,
-    approvedVersion: approved,
-    currentVersion: allVersions[0]?.version || 0
-  });
-});
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-6G7MVTY6.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-JUAFYB73.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -4304,6 +4161,10 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
     const pending = await getPendingReview(nestId, nodeId);
     response.pendingReviewBy = pending?.requestedBy ?? null;
   }
+  response.deletionRequest = await getLatestDeletionRequest(
+    nestId,
+    nodeId
+  );
   if (isRawFormat(c)) {
     return rawNodeBody(c, response, node.rawContent);
   }
@@ -4347,7 +4208,8 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
       title: body.title,
       status: body.status,
       changeNote: body.changeNote,
-      schedule: body.schedule
+      schedule: body.schedule,
+      prime: body.prime
     },
     authorEmail
   );
@@ -4356,84 +4218,307 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
 nodeRoutes.delete("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { storage } = await engineCache.get(nestId);
-  if (await isStewardshipEnabled(nestId) && await getPendingReview(nestId, nodeId)) {
-    throw new LockedError(
-      "This document is awaiting steward review and is locked. Approve or reject the pending review before deleting."
+  await deleteNode(nestId, nodeId, await getUserEmail(c));
+  return c.json({ deleted: true });
+});
+async function getUserEmail(c) {
+  const userId = c.get("userId");
+  const db = getDb();
+  const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
+  return user?.email || "anonymous@localhost";
+}
+
+// src/annotations/routes.ts
+import { Hono as Hono9 } from "hono";
+
+// src/annotations/service.ts
+import { v4 as uuid5 } from "uuid";
+
+// src/annotations/projection.ts
+var MAX_CONTEXT_CHARS = 250;
+var MAX_QUOTE_CHARS = 1e3;
+function clampAnchor(raw) {
+  if (!raw) return null;
+  const quote = (raw.quote ?? "").trim().slice(0, MAX_QUOTE_CHARS);
+  if (!quote) return null;
+  const before = (raw.before ?? "").slice(-MAX_CONTEXT_CHARS);
+  const after = (raw.after ?? "").slice(0, MAX_CONTEXT_CHARS);
+  const line = typeof raw.line === "number" && Number.isFinite(raw.line) && raw.line > 0 ? Math.floor(raw.line) : void 0;
+  return { quote, before, after, ...line !== void 0 ? { line } : {} };
+}
+function oneLine(s) {
+  return s.replace(/\s+/g, " ").replace(/--+>/g, "-\u2192").trim();
+}
+function renderAnchor(anchor) {
+  if (!anchor) {
+    return "<!-- anchor: whole-artifact -->";
+  }
+  const linePart = anchor.line !== void 0 ? `line ${anchor.line} \xB7 ` : "";
+  const context = `\u2026${oneLine(anchor.before)}\u3008${oneLine(anchor.quote)}\u3009${oneLine(
+    anchor.after
+  )}\u2026`;
+  return `<!-- anchor: ${linePart}quote "${oneLine(anchor.quote)}" \xB7 context ${context} -->`;
+}
+function statusHeading(thread) {
+  if (thread.status === "resolved") {
+    const who = thread.resolvedBy ? `${thread.resolvedBy}, ` : "";
+    const when = thread.resolvedAt ? `${thread.resolvedAt}` : "";
+    const meta = who || when ? ` (${who}${when})` : "";
+    return `\u2705 RESOLVED${meta}`;
+  }
+  return "\u{1F7E0} OPEN";
+}
+function snapshotLabel(v) {
+  return v == null ? "Unpinned" : `Snapshot v${v}`;
+}
+function orderThreads(threads) {
+  return [...threads].sort((a, b) => {
+    if (a.status !== b.status) return a.status === "open" ? -1 : 1;
+    return a.createdAt.localeCompare(b.createdAt);
+  });
+}
+function projectThreadsToMarkdown(artifactTitle, threads) {
+  const lines = [];
+  lines.push(`# ${artifactTitle} \u2014 Annotations`);
+  lines.push("");
+  lines.push(
+    "> Auto-generated from review comments, grouped by the artifact snapshot each was anchored to. **Open** threads are unresolved feedback for the next iteration; **resolved** threads were already addressed (don't re-break them)."
+  );
+  lines.push("");
+  if (threads.length === 0) {
+    lines.push("_No annotations yet._");
+    lines.push("");
+    return lines.join("\n");
+  }
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const t of threads) {
+    const key = t.snapshotVersion ?? null;
+    (buckets2.get(key) ?? buckets2.set(key, []).get(key)).push(t);
+  }
+  const keys = [...buckets2.keys()].sort((a, b) => {
+    if (a == null) return 1;
+    if (b == null) return -1;
+    return b - a;
+  });
+  for (const key of keys) {
+    lines.push(`## ${snapshotLabel(key)}`);
+    lines.push("");
+    for (const thread of orderThreads(buckets2.get(key))) {
+      lines.push(`### Thread \xB7 ${statusHeading(thread)}`);
+      lines.push(renderAnchor(thread.anchor));
+      for (const comment of thread.comments) {
+        lines.push(
+          `- **${comment.author}** \xB7 ${comment.createdAt} \u2014 ${comment.body}`
+        );
+      }
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/annotations/service.ts
+async function loadComments(threadId) {
+  const db = getDb();
+  const rows = await db.all(
+    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, id ASC",
+    [threadId]
+  );
+  return rows.map((r) => ({
+    id: r.id,
+    author: r.author,
+    body: r.body,
+    createdAt: r.created_at
+  }));
+}
+async function rowToThread(row) {
+  let anchor = null;
+  if (row.anchor_json) {
+    try {
+      anchor = JSON.parse(row.anchor_json);
+    } catch {
+      anchor = null;
+    }
+  }
+  return {
+    id: row.id,
+    nestId: row.nest_id,
+    nodeId: row.node_id,
+    snapshotVersion: row.snapshot_version,
+    anchor,
+    status: row.status,
+    createdBy: row.created_by,
+    createdAt: row.created_at,
+    resolvedBy: row.resolved_by,
+    resolvedAt: row.resolved_at,
+    comments: await loadComments(row.id)
+  };
+}
+async function getThreadRow(threadId) {
+  return await getDb().get("SELECT * FROM annotation_threads WHERE id = ?", [threadId]);
+}
+async function countThreadsByNode(nestId) {
+  const rows = await getDb().all(
+    `SELECT node_id, CAST(COUNT(*) AS INTEGER) AS count, MAX(created_at) AS last_at
+         FROM annotation_threads
+        WHERE nest_id = ?
+        GROUP BY node_id`,
+    [nestId]
+  );
+  const out = {};
+  for (const r of rows) out[r.node_id] = { count: r.count, lastAt: r.last_at };
+  return out;
+}
+async function listThreads(nestId, nodeId) {
+  const rows = await getDb().all(
+    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, id ASC",
+    [nestId, nodeId]
+  );
+  return Promise.all(rows.map(rowToThread));
+}
+async function createThread(nestId, nodeId, input, authorEmail) {
+  const body = (input.body ?? "").trim();
+  if (!body) {
+    throw new Error("comment body is required");
+  }
+  const db = getDb();
+  const id = uuid5();
+  const anchor = clampAnchor(input.anchor);
+  const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
+  await db.transaction(async (tx) => {
+    await tx.run(
+      `INSERT INTO annotation_threads
+         (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by)
+       VALUES (?, ?, ?, ?, ?, 'open', ?)`,
+      [
+        id,
+        nestId,
+        nodeId,
+        snapshot,
+        anchor ? JSON.stringify(anchor) : null,
+        authorEmail
+      ]
+    );
+    await tx.run(
+      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
+      [uuid5(), id, authorEmail, body]
+    );
+  });
+  return rowToThread(await getThreadRow(id));
+}
+async function getScopedThreadRow(threadId, nestId, nodeId) {
+  const row = await getThreadRow(threadId);
+  if (!row || row.nest_id !== nestId || row.node_id !== nodeId) {
+    throw new NotFoundError(`Thread not found: ${threadId}`);
+  }
+  return row;
+}
+async function addComment(nestId, nodeId, threadId, authorEmail, body) {
+  const trimmed = (body ?? "").trim();
+  if (!trimmed) {
+    throw new Error("comment body is required");
+  }
+  await getScopedThreadRow(threadId, nestId, nodeId);
+  await getDb().run(
+    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
+    [uuid5(), threadId, authorEmail, trimmed]
+  );
+  return rowToThread(await getThreadRow(threadId));
+}
+async function setThreadStatus(nestId, nodeId, threadId, status, byEmail) {
+  await getScopedThreadRow(threadId, nestId, nodeId);
+  const db = getDb();
+  if (status === "resolved") {
+    await db.run(
+      `UPDATE annotation_threads SET status = 'resolved', resolved_by = ?, resolved_at = ${nowExpr(db)} WHERE id = ?`,
+      [byEmail, threadId]
+    );
+  } else {
+    await db.run(
+      "UPDATE annotation_threads SET status = 'open', resolved_by = NULL, resolved_at = NULL WHERE id = ?",
+      [threadId]
     );
   }
+  return rowToThread(await getThreadRow(threadId));
+}
+async function readArtifact(nestId, nodeId, version) {
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
+  const target = version ?? await getApprovedVersion(nestId, nodeId) ?? null;
+  let title = nodeId;
+  let type = null;
+  let liveHtml = "";
+  let liveExists = true;
   try {
-    await storage.deleteDocument(nodeId);
+    const node = await storage.readDocument(nodeId);
+    title = node.frontmatter?.title || nodeId;
+    type = node.frontmatter?.type || null;
+    liveHtml = node.body || "";
   } catch {
-    throw new NotFoundError(`Node not found: ${nodeId}`);
+    liveExists = false;
   }
-  await removeNodeFromTagIndex(nestId, nodeId);
-  const derivedId = derivedAnnotationsId(nodeId);
-  try {
-    await storage.deleteDocument(derivedId);
-    await removeNodeFromTagIndex(nestId, derivedId);
-  } catch {
+  if (target != null) {
+    try {
+      const raw = await versionManager.reconstructVersion(nodeId, target);
+      return { title, html: bodyOnly(nodeId, raw), version: target, type };
+    } catch (err) {
+      console.warn(
+        `[annotations] reconstruct v${target} failed for ${nestId}/${nodeId}; falling back to live body:`,
+        err
+      );
+    }
   }
-  const db = getDb();
-  await db.transaction(async (tx) => {
-    await tx.run(
-      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?",
-      [nestId, nodeId]
-    );
-    await tx.run(
-      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?",
-      [nestId, nodeId]
-    );
-    await tx.run(
-      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?",
-      [nestId, nodeId]
-    );
-    await tx.run(
-      `DELETE FROM stewards
-       WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`,
-      [nestId, nodeId]
-    );
-    await tx.run(
-      "DELETE FROM annotation_threads WHERE nest_id = ? AND node_id = ?",
-      [nestId, nodeId]
-    );
-    await tx.run(
-      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?",
-      [nestId, derivedId]
-    );
-    await tx.run(
-      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?",
-      [nestId, derivedId]
-    );
-    await tx.run(
-      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?",
-      [nestId, derivedId]
-    );
-    await tx.run(
-      "DELETE FROM annotation_threads WHERE nest_id = ? AND node_id = ?",
-      [nestId, derivedId]
-    );
-    await tx.run(
-      `INSERT INTO node_deletions (nest_id, node_id, deleted_by, deleted_at)
-       VALUES (?, ?, ?, ?)
-       ON CONFLICT(nest_id, node_id) DO UPDATE
-         SET deleted_by = excluded.deleted_by, deleted_at = excluded.deleted_at`,
-      [nestId, nodeId, await getUserEmail(c), (/* @__PURE__ */ new Date()).toISOString()]
+  if (!liveExists) {
+    throw new NotFoundError(`Artifact not found: ${nodeId}`);
+  }
+  return { title, html: liveHtml, version: target, type };
+}
+function derivedAnnotationsId(sourceNodeId) {
+  const base = sourceNodeId.replace(/^nodes\//, "");
+  return `nodes/${base}--annotations`;
+}
+async function syncAnnotationsNode(nestId, nodeId, userEmail) {
+  try {
+    let title = nodeId;
+    let type = null;
+    try {
+      const { storage } = await engineCache.get(nestId);
+      const node = await storage.readDocument(nodeId);
+      title = node.frontmatter?.title || nodeId;
+      type = node.frontmatter?.type || "document";
+    } catch {
+    }
+    if (type !== null && type !== "artifact") return;
+    const threads = await listThreads(nestId, nodeId);
+    const derivedTitle = `${title.slice(0, 100)} \u2014 Annotations`;
+    const markdown = projectThreadsToMarkdown(title, threads);
+    const derivedId = derivedAnnotationsId(nodeId);
+    try {
+      await updateNode(nestId, derivedId, { content: markdown }, userEmail);
+    } catch (err) {
+      if (err instanceof NotFoundError) {
+        await createNode(
+          nestId,
+          {
+            id: derivedId,
+            title: derivedTitle,
+            content: markdown,
+            type: "document",
+            tags: ["annotations"]
+          },
+          userEmail
+        );
+      } else {
+        throw err;
+      }
+    }
+  } catch (err) {
+    console.warn(
+      `[annotations] failed to sync derived node for ${nestId}/${nodeId}:`,
+      err
     );
-  });
-  await trackEvent("node.delete", { nestId, nodeId });
-  return c.json({ deleted: true });
-});
-async function getUserEmail(c) {
-  const userId = c.get("userId");
-  const db = getDb();
-  const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
-  return user?.email || "anonymous@localhost";
+  }
 }
 
-// src/annotations/routes.ts
-import { Hono as Hono9 } from "hono";
-
 // src/annotations/types.ts
 var ARTIFACT_NODE_TYPE = "artifact";
 
@@ -6909,7 +6994,7 @@ var TOOL_DEFINITIONS = [
   },
   {
     name: "context_create",
-    description: "Create a new knowledge node in the vault.",
+    description: "Create a new knowledge node in the vault. The title must not already be in use \u2014 these tools resolve documents by title, so a duplicate is refused rather than filed as an unreachable twin. To change an existing document use context_update; to refile it use context_move.",
     inputSchema: {
       type: "object",
       properties: {
@@ -6930,7 +7015,7 @@ var TOOL_DEFINITIONS = [
         scope: { type: "string", description: "Visibility scope" },
         folder: {
           type: "string",
-          description: 'Folder path under nodes/ (e.g. "gtm/deals"); segments are slugified'
+          description: 'Folder path under nodes/ (e.g. "gtm/deals"); segments are slugified. A leading "nodes/" is accepted and not doubled, so "nodes/gtm/deals" and "gtm/deals" mean the same folder.'
         }
       },
       required: ["title", "content"]
@@ -6961,6 +7046,49 @@ var TOOL_DEFINITIONS = [
       required: ["title"]
     }
   },
+  {
+    name: "context_delete",
+    // Mirrors the engine's canonical `context_delete` operation (core
+    // namespace, alias delete_document): same name, same {id, title} input,
+    // same "deleted" semantics. The engine's `uri` field is omitted — this
+    // repo has no contextnest:// resolver on any surface, so accepting one
+    // would promise a resolution it can't do.
+    description: "Delete a node from the vault by title or id. Removes everything keyed to it: version history, review state, annotations, comments, watchers, schedules, trigger hooks, workflow edges, document grants, and any steward assignments scoped to it. Irreversible \u2014 the node must be recreated to come back, and it comes back clean: no history, no stewards, no shares. A node under open review is frozen unless you can approve it (owner, admin, or its reviewer).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of node to delete" },
+        id: {
+          type: "string",
+          description: 'Node id / path (e.g. "nodes/gtm/deals/win-loss-log"). Use instead of title when two nodes share a title or the title is unknown.'
+        }
+      }
+    }
+  },
+  {
+    name: "context_move",
+    // NOT in the engine's operation catalog — `move` is a community-edition
+    // concern (the id rewrite spans governance tables the engine doesn't own).
+    // This mirrors the existing REST POST /nodes/:id/move rather than adding a
+    // new concept, so the surfaces agree. If move is ever promoted to a core
+    // operation upstream, adopt that descriptor and drop this schema.
+    description: "Move a node to a different folder. The id changes; version history, review state, annotations, comments, watchers, schedules, links, and document grants all follow. The title and its [[wiki-link]] stay valid. A node under open review is frozen unless you can approve it (owner, admin, or its reviewer).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of node to move" },
+        id: {
+          type: "string",
+          description: 'Node id / path (e.g. "nodes/gtm/deals/win-loss-log"). Use instead of title when two nodes share a title or the title is unknown.'
+        },
+        folder: {
+          type: "string",
+          description: 'Destination folder under nodes/ (e.g. "gtm/deals"); segments are slugified. Use "" to move to the nest root.'
+        }
+      },
+      required: ["folder"]
+    }
+  },
   // ─── Governance Tools ───────────────────────────────────────────────
   {
     name: "context_stewards",
@@ -6975,6 +7103,73 @@ var TOOL_DEFINITIONS = [
       }
     }
   },
+  {
+    // Deletion requests, mirroring the REST + UI flow: anyone who can READ a
+    // thing may ask for it to be deleted; only an owner/admin resolves it.
+    // Not in the engine catalog (1.2.1) — deletion requests live in this
+    // repo's governance tables, which the engine doesn't own. Adopt an engine
+    // descriptor here if the operation is ever promoted upstream.
+    name: "context_request_deletion",
+    description: "Ask for something to be deleted when you can't delete it yourself. Flags a document, a folder (with everything in it), or the whole nest for a nest owner/admin to action. Nothing is removed by this call \u2014 it opens a request, and the person who resolves it either deletes the target or declines with a note. Use this instead of context_delete when that returns a permission error, or when the document belongs to someone else.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the document to flag" },
+        id: {
+          type: "string",
+          description: 'Document id / path (e.g. "nodes/gtm/deals/win-loss-log"). Use instead of title when two documents share a title.'
+        },
+        folder: {
+          type: "string",
+          description: 'Flag a whole folder instead of a document \u2014 the path, e.g. "gtm/deals". Every document under it goes if the request is honoured.'
+        },
+        nest: {
+          type: "boolean",
+          description: "Flag the ENTIRE nest for deletion. Only an owner/admin can honour it."
+        },
+        reason: {
+          type: "string",
+          description: "Why it should be deleted. Required \u2014 this is what the admin judges."
+        }
+      },
+      required: ["reason"]
+    }
+  },
+  {
+    name: "context_deletion_queue",
+    description: "Show deletion requests waiting on a nest owner/admin: what was flagged, who asked, and why. Use the request id with context_resolve_deletion to action one.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        status: {
+          type: "string",
+          description: "pending (default) or declined \u2014 declined shows past verdicts and their notes."
+        }
+      }
+    }
+  },
+  {
+    name: "context_resolve_deletion",
+    description: "Action a deletion request: delete the flagged document/folder/nest, or decline it with a note explaining why it stays. Owner/admin only. Declining tells the requester the verdict; deleting is irreversible.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        request_id: {
+          type: "string",
+          description: "Request id from context_deletion_queue"
+        },
+        action: {
+          type: "string",
+          description: '"delete" to honour it, "decline" to keep the target'
+        },
+        note: {
+          type: "string",
+          description: "Why you declined. Required when action is decline."
+        }
+      },
+      required: ["request_id", "action"]
+    }
+  },
   {
     name: "context_review_queue",
     description: "Show documents pending review. These need a steward to approve or reject them before they become available to AI.",
@@ -6988,6 +7183,14 @@ var TOOL_DEFINITIONS = [
       }
     }
   },
+  {
+    name: "context_my_drafts",
+    description: "List YOUR unsubmitted drafts in this nest \u2014 documents you wrote that were never submitted for review (plus any that came back rejected). These are invisible to the review queue and unreadable by AI queries until submitted and approved. Use context_submit_review to hand one to a steward.",
+    inputSchema: {
+      type: "object",
+      properties: {}
+    }
+  },
   {
     name: "context_submit_review",
     description: "Submit a node for steward review. The node will be marked as pending review and stewards will be notified.",
@@ -7140,6 +7343,24 @@ async function handleToolCall(toolName, args, ctx) {
     });
   }
 }
+async function resolveTargetNode(storage, args) {
+  if (!args.id && !args.title) return "Provide a title or an id.";
+  if (args.id) {
+    try {
+      return await storage.readDocument(args.id);
+    } catch {
+      return `Node not found: ${args.id}`;
+    }
+  }
+  const docs = await storage.discoverDocuments();
+  const matches = docs.filter(
+    (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
+  );
+  if (matches.length > 1) {
+    return `${matches.length} nodes share the title "${args.title}". Re-run with one of these ids instead: ${matches.map((n) => n.id).join(", ")}`;
+  }
+  return matches[0] ?? `Node not found: ${args.title}`;
+}
 async function runTool(toolName, args, ctx) {
   const { storage, queryEngine, versionManager, nestId, userId, userEmail } = ctx;
   switch (toolName) {
@@ -7373,19 +7594,29 @@ ${sections}`;
       if (!await canCreateInNest(nestId, userEmail)) {
         return "You don't have permission to create documents in this nest.";
       }
-      const { node } = await createNode(
-        nestId,
-        {
-          title: args.title,
-          content: args.content,
-          type: args.type,
-          tags: args.tags,
-          scope: args.scope,
-          folder: args.folder
-        },
-        userEmail
-      );
-      return `Created node: **${args.title}** (${node.id}) \u2014 status: ${node.frontmatter.status}`;
+      const wanted = String(args.title ?? "").toLowerCase();
+      return withNodeWriteLock(nodeWriteKey(nestId, "*create*"), async () => {
+        const existingDocs = await storage.discoverDocuments();
+        const twin = existingDocs.find(
+          (n) => String(n.frontmatter.title ?? "").toLowerCase() === wanted
+        );
+        if (twin) {
+          return `A node titled "${twin.frontmatter.title}" already exists (${twin.id}). Titles must be unique \u2014 MCP tools resolve documents by title, so a second one would be unreachable. Use context_update to change it, context_move to refile it, or create this one under a different title.`;
+        }
+        const { node } = await createNode(
+          nestId,
+          {
+            title: args.title,
+            content: args.content,
+            type: args.type,
+            tags: args.tags,
+            scope: args.scope,
+            folder: args.folder
+          },
+          userEmail
+        );
+        return `Created node: **${args.title}** (${node.id}) \u2014 status: ${node.frontmatter.status}`;
+      });
     }
     case "context_update": {
       const docs = await storage.discoverDocuments();
@@ -7409,6 +7640,39 @@ ${sections}`;
       );
       return `Updated node: **${updated.frontmatter.title}**`;
     }
+    case "context_delete": {
+      const node = await resolveTargetNode(storage, args);
+      if (typeof node === "string") return node;
+      const deleteCheck = await canUserEdit(nestId, node.id, userEmail);
+      if (!deleteCheck.allowed) {
+        return `You don't have permission to delete "${node.frontmatter.title}": ${deleteCheck.reason}
+
+Use context_request_deletion to ask a nest owner/admin to delete it, with a reason.`;
+      }
+      await deleteNode(nestId, node.id, userEmail);
+      return `Deleted node: **${node.frontmatter.title}** (${node.id})`;
+    }
+    case "context_move": {
+      if (typeof args.folder !== "string") {
+        return 'folder is required \u2014 a path like "gtm/deals", or "" for the nest root.';
+      }
+      const node = await resolveTargetNode(storage, args);
+      if (typeof node === "string") return node;
+      const moveCheck = await canUserEdit(nestId, node.id, userEmail);
+      if (!moveCheck.allowed) {
+        return `You don't have permission to move "${node.frontmatter.title}": ${moveCheck.reason}`;
+      }
+      const { node: moved, previousId } = await moveNode(
+        nestId,
+        node.id,
+        args.folder,
+        userEmail
+      );
+      if (previousId === moved.id) {
+        return `**${moved.frontmatter.title}** is already at \`${moved.id}\` \u2014 nothing to move.`;
+      }
+      return `Moved **${moved.frontmatter.title}**: \`${previousId}\` \u2192 \`${moved.id}\``;
+    }
     // ─── Governance Tool Handlers ──────────────────────────────────────
     case "context_stewards": {
       if (args.title) {
@@ -7435,18 +7699,138 @@ ${list}`;
       if (allStewards.length === 0) {
         return "No stewards configured. All changes are auto-approved.\n\nTo configure stewards, add a `stewards.yaml` file to the vault root, or use `context_assign_steward`.";
       }
-      const byScope = {};
-      for (const s of allStewards) {
-        const key = s.scope === "nest" ? "Nest-level" : s.scope === "tag" ? `Tag: ${s.tagName}` : `Document: ${s.nodeTitle || s.nodePattern}`;
-        (byScope[key] = byScope[key] || []).push(s);
+      const byScope = {};
+      for (const s of allStewards) {
+        const key = s.scope === "nest" ? "Nest-level" : s.scope === "tag" ? `Tag: ${s.tagName}` : `Document: ${s.nodeTitle || s.nodePattern}`;
+        (byScope[key] = byScope[key] || []).push(s);
+      }
+      const sections = Object.entries(byScope).map(
+        ([scope, stewards]) => `## ${scope}
+${stewards.map((s) => `- **${s.userEmail}** (${s.role})${s.role === "reviewer" ? " \u2014 can approve" : ""}`).join("\n")}`
+      ).join("\n\n");
+      return `# Data Stewards
+
+${sections}`;
+    }
+    case "context_request_deletion": {
+      const reason = typeof args.reason === "string" ? args.reason.trim() : "";
+      if (!reason) {
+        return "reason is required \u2014 say why it should be deleted; that is what the admin judges.";
+      }
+      if (args.nest === true) {
+        const request2 = await requestDeletion({
+          nestId,
+          nodeId: nestId,
+          targetType: "nest",
+          requestedBy: userEmail,
+          reason,
+          baseUrl: ctx.baseUrl
+        });
+        return `Requested deletion of the **entire nest**. A nest owner or admin will delete it or decline.
+Request id: \`${request2.id}\``;
+      }
+      if (typeof args.folder === "string" && args.folder.trim()) {
+        const folder = args.folder.trim().replace(/^\/+|\/+$/g, "").replace(/^nodes\//, "");
+        const docs = await storage.discoverDocuments();
+        const inside = docs.filter((d) => isIdUnderFolder(d.id, folder));
+        if (inside.length === 0) {
+          return `No folder "${folder}" \u2014 nothing is filed under it. Use context_list to see what exists.`;
+        }
+        const request2 = await requestDeletion({
+          nestId,
+          nodeId: folder,
+          targetType: "folder",
+          requestedBy: userEmail,
+          reason,
+          baseUrl: ctx.baseUrl
+        });
+        return `Requested deletion of folder **${folder}** (${inside.length} document(s) inside). A nest owner or admin will delete it or decline.
+Request id: \`${request2.id}\``;
+      }
+      const node = await resolveTargetNode(storage, args);
+      if (typeof node === "string") return node;
+      if (!await canReadNode(nestId, node.id, userId, userEmail)) {
+        return `Node not found: ${node.id}`;
+      }
+      const request = await requestDeletion({
+        nestId,
+        nodeId: node.id,
+        targetType: "document",
+        requestedBy: userEmail,
+        reason,
+        baseUrl: ctx.baseUrl
+      });
+      return `Requested deletion of **${node.frontmatter.title}**. A nest owner or admin will delete it or decline \u2014 nothing is removed yet.
+Request id: \`${request.id}\``;
+    }
+    case "context_deletion_queue": {
+      const status = args.status === "declined" ? "declined" : "pending";
+      const requests = await listDeletionRequests({ nestId, status });
+      if (requests.length === 0) {
+        return status === "pending" ? "No deletion requests waiting. All caught up!" : "No declined deletion requests.";
+      }
+      const list = requests.map((r, i) => {
+        const kind = r.targetType === "document" ? "" : `${r.targetType}: `;
+        const verdict = r.status === "declined" ? `
+   Declined by ${r.resolvedBy}: "${r.resolutionNote}"` : "";
+        return `${i + 1}. **${kind}${r.title || r.nodeId}**
+   Asked by ${r.requestedBy}: "${r.reason}"
+   Request id: \`${r.id}\`${verdict}`;
+      }).join("\n\n");
+      return `# Deletion requests (${status})
+**${requests.length} item(s)**
+
+${list}`;
+    }
+    case "context_resolve_deletion": {
+      const requestId = typeof args.request_id === "string" ? args.request_id : "";
+      const action = args.action === "delete" ? "delete" : args.action === "decline" ? "decline" : null;
+      if (!requestId || !action) {
+        return 'request_id and action are required \u2014 action is "delete" or "decline". Use context_deletion_queue to list request ids.';
+      }
+      const request = await getDeletionRequest(requestId);
+      if (!request || request.nestId !== nestId || request.status !== "pending") {
+        return `No pending deletion request with id ${requestId}.`;
+      }
+      const roles = await resolveUserRoles(nestId, userEmail);
+      if (!roles.includes("owner") && !roles.includes("admin")) {
+        return `You don't have permission to resolve deletion requests in this nest \u2014 only a nest owner or admin can. You can add to the discussion, but the verdict is theirs.`;
+      }
+      const label = await deletionTargetTitle(request);
+      if (action === "decline") {
+        const note = typeof args.note === "string" ? args.note.trim() : "";
+        if (!note) {
+          return "note is required when declining \u2014 the requester is told why it stays.";
+        }
+        await declineDeletion({
+          nestId,
+          id: requestId,
+          declinedBy: userEmail,
+          note,
+          baseUrl: ctx.baseUrl
+        });
+        return `Declined the deletion request for **${label}**. It stays, and ${request.requestedBy} has been told why.`;
       }
-      const sections = Object.entries(byScope).map(
-        ([scope, stewards]) => `## ${scope}
-${stewards.map((s) => `- **${s.userEmail}** (${s.role})${s.role === "reviewer" ? " \u2014 can approve" : ""}`).join("\n")}`
-      ).join("\n\n");
-      return `# Data Stewards
-
-${sections}`;
+      if (request.targetType === "nest") {
+        await deleteNest(nestId);
+      } else if (request.targetType === "folder") {
+        await deleteFolder(nestId, request.nodeId, userEmail);
+        await dropDeletionRequest(request.id);
+      } else {
+        await deleteNode(nestId, request.nodeId, userEmail);
+      }
+      await notifyDeletionResolved({
+        nestId,
+        nodeId: request.nodeId,
+        docTitle: label,
+        outcome: "deleted",
+        requestedBy: request.requestedBy,
+        resolvedBy: userEmail,
+        requestId: request.id,
+        targetType: request.targetType,
+        baseUrl: ctx.baseUrl
+      });
+      return `Deleted **${label}** \u2014 ${request.requestedBy}'s request was honoured. Irreversible.`;
     }
     case "context_review_queue": {
       const status = args.status || "pending";
@@ -7466,6 +7850,30 @@ ${sections}`;
 **${result.total} item(s)**
 
 ${list}`;
+    }
+    case "context_my_drafts": {
+      const { drafts, total } = await listMyDrafts({
+        authorEmail: userEmail,
+        nestIds: [ctx.nestId],
+        limit: 100
+      });
+      if (total === 0) {
+        return "No unsubmitted drafts \u2014 everything you've written here is in review or approved.";
+      }
+      const list = drafts.map(
+        (d, i) => `${i + 1}. **${d.title}** v${d.version} \u2014 ${d.status}
+   Path: ${d.nodeId}
+   Last edited: ${d.updatedAt}`
+      ).join("\n\n");
+      const more = total > drafts.length ? `
+
+_Showing the ${drafts.length} most recent of ${total}._` : "";
+      return `# My Drafts
+**${total} unsubmitted document(s)**
+
+${list}${more}
+
+Submit one with \`context_submit_review\`.`;
     }
     case "context_submit_review": {
       const docs = await storage.discoverDocuments();
@@ -7617,8 +8025,8 @@ ${list}`;
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-5ZFISCBH.js");
-        const db = (await import("./client-3MGIP57D.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-O4AO326A.js");
+        const db = (await import("./client-NFUHPLLM.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
@@ -8797,6 +9205,7 @@ import { Hono as Hono19 } from "hono";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { z as z2 } from "zod";
+var SERVER_WRITE_TOOLS = /* @__PURE__ */ new Set(["nest_create", "context_create"]);
 async function getUserEmail3(userId) {
   const db = getDb();
   const user = await db.get("SELECT email FROM users WHERE id = ?", [
@@ -8978,6 +9387,38 @@ var SERVER_TOOL_DEFINITIONS = [
       },
       required: ["nest", "selector"]
     }
+  },
+  {
+    name: "nest_create",
+    description: "Create a new nest owned by the caller. Returns the new nest's id \u2014 target it with the other tools afterwards.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "Nest name" },
+        description: { type: "string", description: "Optional description" }
+      },
+      required: ["name"]
+    }
+  },
+  {
+    name: "context_create",
+    description: "Create a new knowledge node (document) in a nest. Needs write permission on that nest. A `folder` path creates the folder implicitly \u2014 folders exist through the nodes placed in them.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...NEST_ARG,
+        title: { type: "string", description: "Descriptive title" },
+        content: { type: "string", description: "Markdown content body" },
+        type: { type: "string", description: "Node type (default: document)" },
+        tags: { type: "array", items: { type: "string" }, description: "Tags" },
+        scope: { type: "string", description: "Visibility scope" },
+        folder: {
+          type: "string",
+          description: 'Folder path under nodes/ (e.g. "gtm/deals"); segments are slugified'
+        }
+      },
+      required: ["nest", "title", "content"]
+    }
   }
 ];
 async function handleServerToolCall(toolName, args, userId, userEmail, nestScope, baseUrl) {
@@ -8986,6 +9427,31 @@ async function handleServerToolCall(toolName, args, userId, userEmail, nestScope
     if (!nests.length) return "No nests accessible with these credentials.";
     return renderNestIndexMarkdown(nests, baseUrl);
   }
+  if (SERVER_WRITE_TOOLS.has(toolName)) {
+    if (isSuspended()) {
+      const reason = getSuspensionReason();
+      return `This server is suspended by PromptOwl; writes are blocked${reason ? ` \u2014 ${reason}` : ""}. Contact support@promptowl.ai.`;
+    }
+    if (!getCurrentLicense()?.valid) {
+      return "This server has no valid PromptOwl license installed, so writes are disabled. Ask the server admin to install one (POST /license/install).";
+    }
+  }
+  if (toolName === "nest_create") {
+    if (nestScope) {
+      return "This credential is scoped to a single nest and cannot create new ones.";
+    }
+    try {
+      const nest2 = await createNest(
+        userId,
+        String(args.name ?? ""),
+        args.description ? String(args.description) : void 0
+      );
+      return `Created nest "${nest2.name}" (id: ${nest2.id}). Add documents with context_create, retrieve with the other tools.`;
+    } catch (err) {
+      if (err instanceof ValidationError) return err.message;
+      throw err;
+    }
+  }
   const inaccessible = `Nest not found or not accessible: "${args.nest}". Use nest_index to see what these credentials can read.`;
   const nest = await resolveNestRef(String(args.nest ?? ""), userId);
   if (!nest) return inaccessible;
@@ -9144,7 +9610,9 @@ Streamable HTTP, stateless. Two endpoints:
   Tools: \`nest_index\` (call first), then \`context_query\`, \`context_search\`,
   \`context_get\`, \`context_list\`, \`context_overview\`, \`context_resolve\` \u2014
   each takes a \`nest\` argument (id or exact name) plus the same
-  selector/hops/max_tokens parameters as the REST API. Read-only.
+  selector/hops/max_tokens parameters as the REST API. Two bootstrap writes:
+  \`nest_create\` (new nest owned by the caller) and \`context_create\`
+  (new document in a writable nest; a \`folder\` path creates the folder).
 - \`${B}/nests/<nest-id>/mcp\` \u2014 per-nest, full toolset including writes and
   governance (create/update, submit/approve/reject, stewards, sharing).
 
@@ -9737,6 +10205,123 @@ governanceRoutes.get("/review-queue", async (c) => {
   }
   return c.json({ ...result, requests });
 });
+function denyUnlessNestManager(c, what) {
+  const permission = c.get("nestPermission");
+  if (permission === "owner" || permission === "admin") return null;
+  return c.json(
+    {
+      error: `Only the nest owner or an admin can delete ${what}. Request its deletion instead, or ask an admin to action it.`
+    },
+    403
+  );
+}
+governanceRoutes.post("/delete-folder", async (c) => {
+  const nestId = c.req.param("nestId");
+  const denied = denyUnlessNestManager(c, "a folder");
+  if (denied) return denied;
+  const body = await c.req.json().catch(() => ({}));
+  if (!body.folder?.trim()) {
+    throw new ValidationError("folder is required");
+  }
+  const deleted = await deleteFolder(
+    nestId,
+    body.folder.trim(),
+    await getUserEmail4(c)
+  );
+  return c.json({ deleted: deleted.length, nodeIds: deleted });
+});
+governanceRoutes.post("/request-deletion", async (c) => {
+  const nestId = c.req.param("nestId");
+  const body = await c.req.json().catch(() => ({}));
+  const reason = body.reason?.trim();
+  if (!reason) {
+    throw new ValidationError("A reason for the deletion request is required");
+  }
+  if (body.targetType !== "folder" && body.targetType !== "nest") {
+    throw new ValidationError(
+      'targetType must be "folder" or "nest" \u2014 flag a single document via POST /nests/:nestId/nodes/:nodeId/request-deletion'
+    );
+  }
+  const target = body.targetType === "nest" ? nestId : (body.target || "").trim().replace(/^\/+|\/+$/g, "").replace(/^nodes\//, "");
+  if (body.targetType === "folder" && !target) {
+    throw new ValidationError("target (the folder path) is required");
+  }
+  if (body.targetType === "folder") {
+    const { storage } = await engineCache.get(nestId);
+    const docs = await storage.discoverDocuments();
+    if (!docs.some((d) => isIdUnderFolder(d.id, target))) {
+      return c.json({ error: `Folder not found: ${target}` }, 404);
+    }
+  }
+  const request = await requestDeletion({
+    nestId,
+    nodeId: target,
+    targetType: body.targetType,
+    requestedBy: await getUserEmail4(c),
+    reason,
+    baseUrl: requestBaseUrl(c.req.url)
+  });
+  return c.json({ request }, 201);
+});
+governanceRoutes.get("/deletion-requests", async (c) => {
+  const nestId = c.req.param("nestId");
+  const raw = c.req.query("status");
+  const status = raw === "declined" || raw === "all" ? raw : "pending";
+  const requests = await listDeletionRequests({ nestId, status });
+  return c.json({ requests, total: requests.length });
+});
+governanceRoutes.post("/deletion-requests/:id/delete", async (c) => {
+  const nestId = c.req.param("nestId");
+  const request = await getDeletionRequest(c.req.param("id"));
+  if (!request || request.nestId !== nestId || request.status !== "pending") {
+    return c.json({ error: "Deletion request not found" }, 404);
+  }
+  const actor = await getUserEmail4(c);
+  const docTitle = await deletionTargetTitle(request);
+  if (request.targetType === "nest" || request.targetType === "folder") {
+    const denied = denyUnlessNestManager(
+      c,
+      request.targetType === "nest" ? "a nest" : "a folder"
+    );
+    if (denied) return denied;
+  }
+  if (request.targetType === "nest") {
+    await deleteNest(nestId);
+  } else if (request.targetType === "folder") {
+    await deleteFolder(nestId, request.nodeId, actor);
+    await dropDeletionRequest(request.id);
+  } else {
+    await deleteNode(nestId, request.nodeId, actor);
+  }
+  await notifyDeletionResolved({
+    nestId,
+    nodeId: request.nodeId,
+    docTitle,
+    outcome: "deleted",
+    requestedBy: request.requestedBy,
+    resolvedBy: actor,
+    requestId: request.id,
+    targetType: request.targetType,
+    baseUrl: requestBaseUrl(c.req.url)
+  });
+  return c.json({ deleted: true, nodeId: request.nodeId });
+});
+governanceRoutes.post("/deletion-requests/:id/decline", async (c) => {
+  const nestId = c.req.param("nestId");
+  const body = await c.req.json().catch(() => ({}));
+  if (!body.note?.trim()) {
+    throw new ValidationError("A note is required when declining");
+  }
+  const request = await declineDeletion({
+    nestId,
+    id: c.req.param("id"),
+    declinedBy: await getUserEmail4(c),
+    note: body.note.trim(),
+    baseUrl: requestBaseUrl(c.req.url)
+  });
+  if (!request) return c.json({ error: "Deletion request not found" }, 404);
+  return c.json({ request });
+});
 governanceRoutes.get("/feed", async (c) => {
   const nestId = c.req.param("nestId");
   const filterRaw = c.req.query("filter");
@@ -9798,25 +10383,71 @@ governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 governanceNodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
   const allVersions = await getVersions(nestId, nodeId);
   const approved = await getApprovedVersion(nestId, nodeId);
   const { versions: versionManager } = await engineCache.get(nestId);
-  const withContent = await Promise.all(
+  const resolutions = await getDb().all(
+    `SELECT version, status, resolved_by
+       FROM review_requests
+      WHERE nest_id = ? AND node_id = ?
+        AND status IN ('approved', 'rejected')
+        AND resolved_by IS NOT NULL
+      ORDER BY resolved_at DESC`,
+    [nestId, nodeId]
+  );
+  const byVersion = /* @__PURE__ */ new Map();
+  for (const r of resolutions) {
+    if (!byVersion.has(r.version)) {
+      byVersion.set(r.version, { status: r.status, resolvedBy: r.resolved_by });
+    }
+  }
+  const enriched = await Promise.all(
     allVersions.map(async (v) => {
+      const r = byVersion.get(v.version);
+      const resolution = r ? { resolvedBy: r.resolvedBy, resolutionStatus: r.status } : {};
       try {
-        const raw = await versionManager.reconstructVersion(nodeId, v.version);
-        return { ...v, content: bodyOnly(nodeId, raw) };
+        const diff = await versionManager.getDiff(nodeId, v.version);
+        return { ...v, ...resolution, diff: diff ?? void 0 };
       } catch {
-        return v;
+        return { ...v, ...resolution };
       }
     })
   );
   return c.json({
-    versions: withContent,
+    versions: enriched,
     approvedVersion: approved,
     currentVersion: allVersions[0]?.version || 0
   });
 });
+governanceNodeRoutes.get("/:nodeId{.+}/versions/:version{[0-9]+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const version = Number(c.req.param("version"));
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
+  const { versions: versionManager } = await engineCache.get(nestId);
+  try {
+    const raw = await versionManager.reconstructVersion(nodeId, version);
+    return c.json({ version, content: bodyOnly(nodeId, raw) });
+  } catch (err) {
+    console.error("reconstructVersion failed", nestId, nodeId, version, err);
+    return c.json({ version, content: null }, 200);
+  }
+});
 governanceNodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -9929,6 +10560,33 @@ governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
     201
   );
 });
+governanceNodeRoutes.post("/:nodeId{.+}/request-deletion", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const body = await c.req.json().catch(() => ({}));
+  const reason = body.reason?.trim();
+  if (!reason) {
+    throw new ValidationError("A reason for the deletion request is required");
+  }
+  const userEmail = await getUserEmail4(c);
+  if (!await canReadNode(nestId, nodeId, c.get("userId"), userEmail)) {
+    return c.json({ error: `Node not found: ${nodeId}` }, 404);
+  }
+  const { storage } = await engineCache.get(nestId);
+  try {
+    await storage.readDocument(nodeId);
+  } catch {
+    return c.json({ error: `Node not found: ${nodeId}` }, 404);
+  }
+  const request = await requestDeletion({
+    nestId,
+    nodeId,
+    requestedBy: userEmail,
+    reason,
+    baseUrl: requestBaseUrl(c.req.url)
+  });
+  return c.json({ request }, 201);
+});
 governanceNodeRoutes.post(
   "/:nodeId{.+}/external-edits/:suggestionId/approve",
   async (c) => {
@@ -10162,6 +10820,49 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
   }
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
+function nestPathParts(path) {
+  return path.replace(/^\/nests\//, "").split("/").filter(Boolean);
+}
+var flexAuthWithPromptowlTicket = createMiddleware2(
+  async (c, next) => {
+    const header = c.req.header("Authorization") || "";
+    const token = header.startsWith("Bearer ") ? header.slice("Bearer ".length) : "";
+    const secret = config.OFFICIAL_COMMUNITY_SSO_SECRET;
+    const looksLikeJwt = !!token && !token.startsWith("cnst_") && token.split(".").length === 3;
+    if (!looksLikeJwt || !secret) return flexAuthMiddleware(c, next);
+    let claims;
+    try {
+      claims = verifySsoTicket(token, secret);
+    } catch {
+      return c.json({ error: "Invalid service ticket" }, 401);
+    }
+    if (claims.scope !== "mcp" || claims.jti) {
+      return c.json({ error: "Invalid service ticket" }, 401);
+    }
+    const expectedAud = config.PUBLIC_BASE_URL;
+    if (expectedAud && (claims.aud || "").replace(/\/$/, "") !== expectedAud) {
+      return c.json({ error: "Invalid service ticket" }, 401);
+    }
+    const sub = claims.sub.trim();
+    if (!isValidTicketSub(sub)) {
+      return c.json({ error: "Invalid service ticket" }, 401);
+    }
+    const db = getDb();
+    const user = await db.get(
+      "SELECT id FROM users WHERE LOWER(email) = LOWER(?)",
+      [sub]
+    );
+    if (!user) {
+      return c.json(
+        { error: "No ContextNest account exists for this PromptOwl user" },
+        404
+      );
+    }
+    c.set("userId", user.id);
+    c.set("nestScope", null);
+    return next();
+  }
+);
 var APPROVE_CACHE_TTL_MS = 3e4;
 var approveCache = /* @__PURE__ */ new Map();
 async function canApproveInNest(nestId, email) {
@@ -10837,6 +11538,25 @@ function createApp() {
       requested_at: r.requestedAt,
       priority: r.priority
     });
+    const deletions = await listDeletionRequests({
+      nestIds: [...nestName2.keys()],
+      status: "pending"
+    });
+    const toDeletionItem = (r) => ({
+      type: "deletion",
+      nest_id: r.nestId,
+      nest_name: nestName2.get(r.nestId),
+      node_id: r.nodeId,
+      title: r.title || r.nodeId,
+      requested_by: r.requestedBy,
+      requested_at: r.createdAt,
+      priority: "normal",
+      reason: r.reason,
+      request_id: r.id,
+      // node_id holds a folder path / nest id for those targets, so a client
+      // must not treat it as a document to open.
+      target_type: r.targetType
+    });
     const byNewest = (a, b) => a.requested_at < b.requested_at ? 1 : -1;
     const others = requests.filter((r) => r.requestedBy !== me);
     const nestApprove = new Map(
@@ -10849,8 +11569,27 @@ function createApp() {
         )
       )
     );
-    const items = others.filter((r) => nestApprove.get(r.nestId)).map(toItem).sort(byNewest);
-    const waiting = requests.filter((r) => r.requestedBy === me).map(toItem).sort(byNewest);
+    const items = others.filter((r) => nestApprove.get(r.nestId)).map(toItem);
+    const waiting = requests.filter((r) => r.requestedBy === me).map(toItem);
+    const othersDeletions = deletions.filter((r) => r.requestedBy !== me);
+    const nestManage = new Map(
+      await Promise.all(
+        [...new Set(othersDeletions.map((r) => r.nestId))].map(
+          async (nestId) => {
+            const roles = await resolveUserRoles(nestId, me);
+            return [nestId, roles.includes("owner") || roles.includes("admin")];
+          }
+        )
+      )
+    );
+    items.push(
+      ...othersDeletions.filter((r) => nestManage.get(r.nestId)).map(toDeletionItem)
+    );
+    items.sort(byNewest);
+    waiting.push(
+      ...deletions.filter((r) => r.requestedBy === me).map(toDeletionItem)
+    );
+    waiting.sort(byNewest);
     const notifications = await listNotifications(me, { unreadOnly: true, limit: 50 });
     return c.json({
       items,
@@ -10861,6 +11600,37 @@ function createApp() {
       pagination: { total, limit, offset, has_more: offset + requests.length < total }
     });
   });
+  app.get("/me/drafts", async (c) => {
+    const userId = c.get("userId");
+    const me = await resolveCallerEmail(userId);
+    const nestName2 = /* @__PURE__ */ new Map();
+    for (const n of await listVisibleNests(userId))
+      nestName2.set(n.id, n.name ?? n.id);
+    const limit = Math.min(Math.max(Number(c.req.query("limit")) || 25, 1), 100);
+    const offset = Math.max(Number(c.req.query("offset")) || 0, 0);
+    const { drafts, total } = await listMyDrafts({
+      authorEmail: me,
+      nestIds: [...nestName2.keys()],
+      limit,
+      offset
+    });
+    return c.json({
+      drafts: drafts.map((d) => ({
+        nest_id: d.nestId,
+        nest_name: nestName2.get(d.nestId),
+        node_id: d.nodeId,
+        title: d.title,
+        // Where it actually lives — the thing that was impossible to find.
+        folder: folderForNode(d.nodeId),
+        status: d.status,
+        version: d.version,
+        updated_at: d.updatedAt
+      })),
+      // has_more off the REQUESTED page size, not the returned row count: the
+      // existence filter can shorten a page, and that must not read as "last".
+      pagination: { total, limit, offset, has_more: offset + limit < total }
+    });
+  });
   app.get("/me/notifications", async (c) => {
     const me = await resolveCallerEmail(c.get("userId"));
     const unreadOnly = c.req.query("unread") === "true";
@@ -10900,15 +11670,18 @@ function createApp() {
   app.route("/runs", runDetailRoutes);
   app.route("/hooks", hookFireRoutes);
   app.route("/llms.txt", llmsTxtRoutes);
-  app.use("/index", flexAuthMiddleware);
+  app.use("/index", flexAuthWithPromptowlTicket);
   app.route("/index", nestIndexRoutes);
-  app.use("/mcp", flexAuthMiddleware);
+  app.use("/mcp", flexAuthWithPromptowlTicket);
   app.route("/mcp", serverMcpRoutes);
   const nestsApp = new Hono21();
-  nestsApp.use("*", flexAuthMiddleware);
   nestsApp.use("*", async (c, next) => {
-    const localPath = c.req.path.replace(/^\/nests\//, "");
-    const parts = localPath.split("/").filter(Boolean);
+    const parts = nestPathParts(c.req.path);
+    const ticketEligible = parts.length === 2 && (c.req.method === "POST" && parts[1] === "context" || c.req.method === "GET" && parts[1] === "nodes" || parts[1] === "mcp");
+    return ticketEligible ? flexAuthWithPromptowlTicket(c, next) : flexAuthMiddleware(c, next);
+  });
+  nestsApp.use("*", async (c, next) => {
+    const parts = nestPathParts(c.req.path);
     if (parts.length < 2) return next();
     if (parts[0] === "unsynced") return next();
     const nestId = parts[0];
@@ -10945,7 +11718,8 @@ function createApp() {
       const isCommentPath = /\/comments$/.test(path2) || /\/comments\/[^/]+\/resolve$/.test(path2);
       const isActivityPath = /\/activity$/.test(path2);
       const isFeedPath = parts.length === 2 && parts[1] === "feed";
-      const isGovernance = path2.includes("/stewards") || path2.includes("/review-queue") || path2.includes("/versions") || path2.includes("/reviews") || path2.includes("/submit-review") || path2.includes("/cancel-review") || path2.includes("/approve") || path2.includes("/reject") || path2.includes("/can-access") || path2.includes("/can-approve") || path2.includes("/can-edit") || isCommentPath || isActivityPath || isFeedPath;
+      const isDeletionQueuePath = parts.length === 2 && parts[1] === "deletion-requests";
+      const isGovernance = path2.includes("/stewards") || path2.includes("/review-queue") || path2.includes("/versions") || path2.includes("/reviews") || path2.includes("/submit-review") || path2.includes("/cancel-review") || path2.includes("/approve") || path2.includes("/reject") || path2.includes("/can-access") || path2.includes("/can-approve") || path2.includes("/can-edit") || isCommentPath || isActivityPath || isFeedPath || isDeletionQueuePath;
       const needsLicense = c.req.method !== "GET" || isGovernance;
       if (needsLicense) {
         const lic = getCurrentLicense();
@@ -10991,6 +11765,7 @@ function createApp() {
     const isStewardActionPath = path.includes("/approve") || path.includes("/reject") || path.includes("/submit-review") || path.includes("/cancel-review");
     const isAnnotationAction = /\/annotations$/.test(path) || /\/annotations\/[^/]+\/(comments|resolve|reopen)$/.test(path);
     const isCommentAction = /\/comments$/.test(path) || /\/comments\/[^/]+\/resolve$/.test(path);
+    const isDeletionRequestAction = /\/request-deletion$/.test(path);
     const isStewardRoster = path.includes("/stewards") && !path.includes("/nodes/");
     if (isStewardRoster && permission !== "owner" && permission !== "admin") {
       return c.json(
@@ -11009,7 +11784,7 @@ function createApp() {
       required = c.req.method === "GET" ? "write" : "admin";
     } else if (parts[1] === "hooks") {
       required = "write";
-    } else if (c.req.method !== "GET" && !isStewardActionPath && !isCommentAction && !isAnnotationAction && !isReadQuery && !isMcpTransport) {
+    } else if (c.req.method !== "GET" && !isStewardActionPath && !isCommentAction && !isDeletionRequestAction && !isAnnotationAction && !isReadQuery && !isMcpTransport) {
       required = "write";
     }
     const isNodeAction = c.req.method === "POST" && parts.length >= 4 && (parts[parts.length - 1] === "revert" || parts[parts.length - 1] === "move");
@@ -11289,6 +12064,111 @@ async function backfillNodeVersionsFromHistory(db) {
     `[backfill] node_versions: scanned ${totalDocs} docs across ${nests.length} nests, inserted ${totalInserted} rows`
   );
 }
+var NOTIFICATION_TITLES_MIGRATION_ID = "006_backfill_notification_titles";
+async function backfillNotificationTitles(db) {
+  const already = await db.get(
+    "SELECT id FROM schema_migrations WHERE id = ?",
+    [NOTIFICATION_TITLES_MIGRATION_ID]
+  );
+  if (already) return;
+  const rows = await db.all(
+    "SELECT id, nest_id, message FROM notifications WHERE message LIKE '%nodes/%'"
+  );
+  let rewritten = 0;
+  if (rows.length > 0) {
+    const titlesByNest = /* @__PURE__ */ new Map();
+    for (const nestId of new Set(rows.map((r) => r.nest_id))) {
+      titlesByNest.set(nestId, await buildTitleMap(nestId));
+    }
+    for (const row of rows) {
+      const titles = titlesByNest.get(row.nest_id) ?? /* @__PURE__ */ new Map();
+      const next = row.message.replace(
+        /"([^"]*nodes\/[^"]*)"/g,
+        (whole, id) => {
+          const label = describeNodeWith(titles, id);
+          return `"${label.replace(/"/g, "")}"`;
+        }
+      );
+      if (next === row.message) continue;
+      await db.run("UPDATE notifications SET message = ? WHERE id = ?", [
+        next,
+        row.id
+      ]);
+      rewritten++;
+    }
+  }
+  await db.run(
+    insertOrIgnore(db, "INSERT INTO schema_migrations (id) VALUES (?)"),
+    [NOTIFICATION_TITLES_MIGRATION_ID]
+  );
+  console.log(
+    `[backfill] notifications: rewrote ${rewritten} of ${rows.length} message(s) carrying a node id`
+  );
+}
+function describeNodeWith(titles, nodeId) {
+  const at = nodeId.indexOf("nodes/");
+  const normalized = at > 0 ? nodeId.slice(at) : nodeId;
+  const title = titles.get(nodeId) || titles.get(normalized) || normalized.split("/").pop() || nodeId;
+  const folder = folderForNode(normalized);
+  return folder ? `${title} (in ${folder})` : title;
+}
+
+// src/db/repair-version-chains.ts
+var MIGRATION_ID2 = "010_repair_grafted_version_chains";
+async function repairGraftedVersionChains(db) {
+  const already = await db.get("SELECT id FROM schema_migrations WHERE id = ?", [
+    MIGRATION_ID2
+  ]);
+  if (already) return;
+  const nests = await db.all("SELECT id FROM nests");
+  let scanned = 0;
+  let repaired = 0;
+  let externalized = 0;
+  for (const { id: nestId } of nests) {
+    let storage;
+    let versions;
+    try {
+      ({ storage, versions } = await engineCache.get(nestId));
+    } catch (err) {
+      console.warn(
+        `[repair] engine unavailable for nest ${nestId}:`,
+        err.message
+      );
+      continue;
+    }
+    let docs;
+    try {
+      docs = await storage.discoverDocuments();
+    } catch (err) {
+      console.warn(
+        `[repair] discoverDocuments failed for nest ${nestId}:`,
+        err.message
+      );
+      continue;
+    }
+    for (const doc of docs) {
+      scanned += 1;
+      try {
+        if (await versions.repairLatestVersion(doc.id)) {
+          repaired += 1;
+          console.log(`[repair] re-anchored version chain: ${nestId}/${doc.id}`);
+        }
+        externalized += await versions.externalizeDiffs(doc.id);
+      } catch (err) {
+        console.warn(
+          `[repair] could not repair ${nestId}/${doc.id}:`,
+          err.message
+        );
+      }
+    }
+  }
+  await db.run(insertOrIgnore(db, "INSERT INTO schema_migrations (id) VALUES (?)"), [
+    MIGRATION_ID2
+  ]);
+  console.log(
+    `[repair] version chains: scanned ${scanned} docs across ${nests.length} nests, re-anchored ${repaired}, externalized ${externalized} inline change log(s)`
+  );
+}
 
 // src/workflow/scheduler.ts
 import { v4 as uuid15 } from "uuid";
@@ -11366,6 +12246,16 @@ async function main() {
   } catch (err) {
     console.error("[backfill] node_versions backfill failed:", err);
   }
+  try {
+    await repairGraftedVersionChains(db);
+  } catch (err) {
+    console.error("[repair] version chain repair failed:", err);
+  }
+  try {
+    await backfillNotificationTitles(db);
+  } catch (err) {
+    console.error("[backfill] notification title backfill failed:", err);
+  }
   const accessCfg = loadAccessConfig();
   if (accessCfg) {
     console.log(`  Loaded access.yaml (mode: ${accessCfg.mode || "open"})`);