@promptowl/contextnest-community 1.22.0 → 1.24.0

package/dist/index.js

@@ -18,6 +18,7 @@ import {
   getPendingReview,
   getReviewHistory,
   getReviewQueue,
+  hasAnyConnector,
   isNestTarget,
   isSafeConnectorUrl,
   listDeletionRequests,
@@ -37,7 +38,7 @@ import {
   submitForReview,
   withNodeWriteLock,
   withdrawDeletionRequest
-} from "./chunk-OQXZ43HG.js";
+} from "./chunk-5EZOPA47.js";
 import {
   canCreateInNest,
   canManageStewards,
@@ -57,7 +58,7 @@ import {
   resolveUserRoles,
   syncFromConfig,
   updateSteward
-} from "./chunk-PX3P4FTU.js";
+} from "./chunk-2TPQTN4Y.js";
 import {
   createGrant,
   deleteGrant,
@@ -66,7 +67,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-MY4JIWQD.js";
+} from "./chunk-I3CSD6CK.js";
 import {
   generateApiKey,
   getKeyPrefix,
@@ -92,7 +93,7 @@ import {
   listMyDrafts,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-6WESEA75.js";
+} from "./chunk-ZTT4U4NE.js";
 import {
   approveExternalEdit,
   getExternalEditDetail,
@@ -104,12 +105,13 @@ import {
   scanDocumentForDrift,
   scanNestForDrift,
   startDriftScanner
-} from "./chunk-ZAV4QUZA.js";
+} from "./chunk-XUIWAWDO.js";
 import {
   addMember,
   addWatcher,
   archiveNest,
   assertSafeNodeId,
+  buildDocContext,
   buildTitleMap,
   canApproveWith,
   canEditWith,
@@ -119,7 +121,6 @@ import {
   createTeam,
   deleteNest,
   deleteTeam,
-  describeNode,
   disableStewardshipAndWipeGovernance,
   docLink,
   engineApi,
@@ -169,6 +170,7 @@ import {
   normalizeTag,
   notifyNestInvite,
   nowExpr,
+  nowMsExpr,
   opContext,
   parseSharedTeams,
   permissionLevel,
@@ -200,6 +202,7 @@ import {
   shareTeamWithNest,
   startLicenseSafetyPoll,
   startTelemetryLoop,
+  suffixOf,
   syncNodeTags,
   trackEvent,
   uniqueNestName,
@@ -208,7 +211,7 @@ import {
   updateMemberRole,
   validateLicense,
   verifySmtp
-} from "./chunk-W5ILNGPD.js";
+} from "./chunk-KIAAEHWL.js";
 import {
   AppError,
   ConflictError,
@@ -226,7 +229,7 @@ import {
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-J2OQ3MEB.js";
+} from "./chunk-LA3VTQ22.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
@@ -240,7 +243,7 @@ import {
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono23 } from "hono";
+import { Hono as Hono25 } from "hono";
 import { LinearRouter } from "hono/router/linear-router";
 import { createMiddleware as createMiddleware2 } from "hono/factory";
 import { cors } from "hono/cors";
@@ -270,7 +273,7 @@ function applyArtifactSandboxHeaders(c) {
 
 // src/auth/routes.ts
 import { Hono as Hono2 } from "hono";
-import { v4 as uuid3 } from "uuid";
+import { v4 as uuid4 } from "uuid";
 
 // src/auth/middleware.ts
 import { createMiddleware } from "hono/factory";
@@ -565,10 +568,89 @@ function verifySsoTicket(token, secret, nowSec = Math.floor(Date.now() / 1e3)) {
   return claims;
 }
 
+// src/auth/community-sites.ts
+import { v4 as uuid } from "uuid";
+function rowToSite(row) {
+  return { ...row, is_active: !!row.is_active };
+}
+var SELECT_COLUMNS = "id, name, url, secret, is_active, created_at, updated_at";
+var activeSitesCache = [];
+async function loadActiveCommunitySites() {
+  const rows = await getDb().all(
+    `SELECT ${SELECT_COLUMNS} FROM community_sites WHERE is_active = 1 ORDER BY name`
+  );
+  activeSitesCache = rows.map(rowToSite);
+}
+function getActiveCommunitySites() {
+  return activeSitesCache;
+}
+async function listCommunitySites() {
+  const rows = await getDb().all(
+    `SELECT ${SELECT_COLUMNS} FROM community_sites ORDER BY name`
+  );
+  return rows.map(rowToSite);
+}
+async function getCommunitySite(id) {
+  const row = await getDb().get(
+    `SELECT ${SELECT_COLUMNS} FROM community_sites WHERE id = ?`,
+    [id]
+  );
+  return row ? rowToSite(row) : null;
+}
+async function createCommunitySite(input) {
+  const id = uuid();
+  await getDb().run(
+    `INSERT INTO community_sites (id, name, url, secret, is_active) VALUES (?, ?, ?, ?, ?)`,
+    [id, input.name, input.url, input.secret, input.is_active ? 1 : 0]
+  );
+  const site = await getCommunitySite(id);
+  if (!site) throw new Error("Failed to create community site");
+  return site;
+}
+async function updateCommunitySite(id, patch) {
+  const existing = await getCommunitySite(id);
+  if (!existing) return null;
+  const next = {
+    name: patch.name ?? existing.name,
+    url: patch.url ?? existing.url,
+    secret: patch.secret ?? existing.secret,
+    is_active: patch.is_active ?? existing.is_active
+  };
+  const db = getDb();
+  await db.run(
+    `UPDATE community_sites
+        SET name = ?, url = ?, secret = ?, is_active = ?, updated_at = ${nowExpr(db)}
+      WHERE id = ?`,
+    [next.name, next.url, next.secret, next.is_active ? 1 : 0, id]
+  );
+  return getCommunitySite(id);
+}
+async function deleteCommunitySite(id) {
+  const result = await getDb().run("DELETE FROM community_sites WHERE id = ?", [
+    id
+  ]);
+  return result.changes > 0;
+}
+function legacyCandidate() {
+  const secret = config.OFFICIAL_COMMUNITY_SSO_SECRET;
+  if (!secret) return null;
+  return { id: "legacy", label: "legacy", secret, url: config.PUBLIC_BASE_URL };
+}
+function ssoCandidates() {
+  const fromDb = getActiveCommunitySites().map((s) => ({
+    id: s.id,
+    label: s.name,
+    secret: s.secret,
+    url: s.url.replace(/\/$/, "")
+  }));
+  const legacy = legacyCandidate();
+  return legacy ? [...fromDb, legacy] : fromDb;
+}
+
 // src/auth/oidc.ts
 import { Hono } from "hono";
 import { createHash, randomBytes as randomBytes2 } from "crypto";
-import { v4 as uuid } from "uuid";
+import { v4 as uuid2 } from "uuid";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 
 // src/shared/base-url.ts
@@ -824,8 +906,8 @@ oidcRoutes.get("/callback", async (c) => {
     );
     if (!user) {
       if (!config.OIDC_AUTO_PROVISION) return bounce("not_invited");
-      const userId = uuid();
-      const placeholderHash = await hashPassword(uuid());
+      const userId = uuid2();
+      const placeholderHash = await hashPassword(uuid2());
       try {
         await db.run(
           "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
@@ -897,7 +979,7 @@ oidcRoutes.get("/logout", async (c) => {
 });
 
 // src/auth/token-exchange.ts
-import { v4 as uuid2 } from "uuid";
+import { v4 as uuid3 } from "uuid";
 import { jwtVerify as jwtVerify2 } from "jose";
 var TX_LIMIT = { max: 60, windowMs: 15 * 6e4 };
 var ExchangeError = class extends Error {
@@ -984,8 +1066,8 @@ async function resolveUser(email, name, department) {
   if (!config.OIDC_AUTO_PROVISION || config.OIDC_ALLOWED_DOMAINS.length === 0) {
     throw new ExchangeError("no_account", 403);
   }
-  const userId = uuid2();
-  const placeholderHash = await hashPassword(uuid2());
+  const userId = uuid3();
+  const placeholderHash = await hashPassword(uuid3());
   try {
     await db.run(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
@@ -1161,8 +1243,8 @@ async function provisionPromptowlUser(c, rawEmail, rawName) {
     [meEmail]
   );
   if (!user) {
-    const userId = uuid3();
-    const placeholderHash = await hashPassword(uuid3());
+    const userId = uuid4();
+    const placeholderHash = await hashPassword(uuid4());
     await db.run(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
       [userId, meEmail, rawName || null, placeholderHash]
@@ -1235,7 +1317,7 @@ authRoutes.post("/register", async (c) => {
     }
     throw new ValidationError("Email already registered");
   }
-  const userId = uuid3();
+  const userId = uuid4();
   const passwordHash = await hashPassword(body.password);
   await db.run(
     "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
@@ -1337,7 +1419,7 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
   });
   if (!check.ok) return c.json({ error: check.error }, check.status);
   const apiKey = generateApiKey();
-  const keyId = uuid3();
+  const keyId = uuid4();
   await db.run(
     "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)",
     [
@@ -1366,7 +1448,7 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   if (!check.ok) return c.json({ error: check.error }, check.status);
   const prior = check.key;
   const apiKey = generateApiKey();
-  const keyId = uuid3();
+  const keyId = uuid4();
   const nestScope = "nest_id" in body ? body.nest_id || null : prior.nest_id;
   const replaced = await db.transaction(async (tx) => {
     const removed = await tx.run(
@@ -1520,25 +1602,30 @@ authRoutes.post("/promptowl", async (c) => {
 });
 authRoutes.get("/sso", async (c) => {
   const ssoError = (code) => c.redirect(`/?sso_error=${code}`, 302);
-  const secret = config.OFFICIAL_COMMUNITY_SSO_SECRET;
-  if (!secret) return ssoError("not_supported");
+  const candidates = ssoCandidates();
+  if (candidates.length === 0) return ssoError("not_supported");
   if (!tryConsume(`sso:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
     return ssoError("rate_limited");
   }
   const ticket = c.req.query("ticket");
   if (!ticket) return ssoError("missing_ticket");
   let claims;
-  try {
-    claims = verifySsoTicket(ticket, secret);
-  } catch {
-    return ssoError("invalid_ticket");
+  let matched;
+  for (const candidate of candidates) {
+    try {
+      claims = verifySsoTicket(ticket, candidate.secret);
+      matched = candidate;
+      break;
+    } catch {
+    }
   }
+  if (!claims || !matched) return ssoError("invalid_ticket");
   if ((claims.scope || "") === "mcp") return ssoError("invalid_ticket");
   const expectedAud = config.PUBLIC_BASE_URL;
   if (!expectedAud && !warnedMissingSsoAudience) {
     warnedMissingSsoAudience = true;
     console.warn(
-      "[sso] OFFICIAL_COMMUNITY_SSO_SECRET is set but PUBLIC_BASE_URL is empty \u2014 ticket audience binding is DISABLED. Set PUBLIC_BASE_URL so a ticket minted for another server cannot be replayed against this one."
+      `[sso] site "${matched.label}" has a secret but PUBLIC_BASE_URL is unset \u2014 ticket audience binding is DISABLED. Set PUBLIC_BASE_URL to this deployment's own URL so a ticket minted for another deployment cannot be replayed against this one.`
     );
   }
   if (expectedAud) {
@@ -1609,6 +1696,15 @@ authRoutes.get("/admin-status", async (c) => {
     me
   });
 });
+authRoutes.patch("/profile", authMiddleware, async (c) => {
+  const userId = c.get("userId");
+  const body = await c.req.json();
+  if (typeof body.name !== "string") throw new ValidationError("name is required");
+  const name = body.name.trim();
+  if (name.length > 80) throw new ValidationError("name must be 80 characters or fewer");
+  await getDb().run("UPDATE users SET name = ? WHERE id = ?", [name || null, userId]);
+  return c.json({ ok: true, name: name || null });
+});
 authRoutes.post("/password", authMiddleware, async (c) => {
   const body = await c.req.json();
   if (!body.current || !body.next) {
@@ -1674,7 +1770,7 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
   if (supplied !== void 0) {
     assertValidPassword(supplied);
   }
-  const generated = supplied ? null : uuid3().replace(/-/g, "").slice(0, 16);
+  const generated = supplied ? null : uuid4().replace(/-/g, "").slice(0, 16);
   const newPassword = supplied ?? generated;
   const newHash = await hashPassword(newPassword);
   await db.transaction(async (tx) => {
@@ -1789,7 +1885,7 @@ authRoutes.post("/invite", async (c) => {
       409
     );
   }
-  const tempPassword = uuid3().replace(/-/g, "").slice(0, 16);
+  const tempPassword = uuid4().replace(/-/g, "").slice(0, 16);
   const passwordHash = await hashPassword(tempPassword);
   let userId;
   if (existing) {
@@ -1799,7 +1895,7 @@ authRoutes.post("/invite", async (c) => {
       userId
     ]);
   } else {
-    userId = uuid3();
+    userId = uuid4();
     await db.run(
       "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
       [userId, email, null, passwordHash]
@@ -1939,7 +2035,43 @@ function documentPrimeFlag(metadata) {
 }
 
 // src/governance/mention-notify.ts
-import { v4 as uuid4 } from "uuid";
+import { v4 as uuid5 } from "uuid";
+
+// src/shared/mentions.ts
+var MENTION = /(?:^|\s)@(?:\(([^)]+)\)|([a-zA-Z0-9._@-]+))/g;
+function stripCode(markdown2) {
+  return markdown2.replace(/```[\s\S]*?```/g, " ").replace(/`[^`\n]*`/g, " ");
+}
+function extractMentions(markdown2) {
+  const names = [];
+  const seen = /* @__PURE__ */ new Set();
+  const text = stripCode(markdown2 || "");
+  let match;
+  MENTION.lastIndex = 0;
+  while ((match = MENTION.exec(text)) !== null) {
+    const name = (match[1] || match[2] || "").trim();
+    const key = name.toLowerCase();
+    if (!name || seen.has(key)) continue;
+    seen.add(key);
+    names.push(name);
+  }
+  return names;
+}
+function newMentions(previous, next) {
+  const before = new Set(extractMentions(previous).map((n) => n.toLowerCase()));
+  return extractMentions(next).filter((n) => !before.has(n.toLowerCase()));
+}
+var MAX_MENTION_RECIPIENTS = 25;
+function resolveMention(people, name) {
+  const n = name.trim().toLowerCase();
+  if (!n) return void 0;
+  const exact = people.find((p) => p.email.toLowerCase() === n);
+  if (exact) return exact;
+  const matches = people.filter(
+    (p) => p.email.toLowerCase().split("@")[0] === n || (p.name || "").toLowerCase() === n
+  );
+  return matches.length === 1 ? matches[0] : void 0;
+}
 
 // src/nests/people-service.ts
 var PERSON_SOURCES = [
@@ -2003,40 +2135,129 @@ async function listNestPeople(nestId) {
   }
   return people;
 }
-
-// src/shared/mentions.ts
-var MENTION = /(?:^|\s)@(?:\(([^)]+)\)|([a-zA-Z0-9._@-]+))/g;
-function stripCode(markdown2) {
-  return markdown2.replace(/```[\s\S]*?```/g, " ").replace(/`[^`\n]*`/g, " ");
-}
-function extractMentions(markdown2) {
-  const names = [];
-  const seen = /* @__PURE__ */ new Set();
-  const text = stripCode(markdown2 || "");
-  let match;
-  MENTION.lastIndex = 0;
-  while ((match = MENTION.exec(text)) !== null) {
-    const name = (match[1] || match[2] || "").trim();
-    const key = name.toLowerCase();
-    if (!name || seen.has(key)) continue;
-    seen.add(key);
-    names.push(name);
+async function withDirectory(roster) {
+  if (!config.PEOPLE_SUGGEST_ALL_USERS) return roster;
+  const seen = new Set(roster.map((p) => p.email.toLowerCase()));
+  const rows = await getDb().all(
+    "SELECT id, email, name FROM users WHERE id != ? ORDER BY email LIMIT ?",
+    [ANON_USER_ID, SUGGEST_FETCH]
+  );
+  const extra = [];
+  for (const r of rows) {
+    const email = (r.email || "").trim();
+    if (!email || seen.has(email.toLowerCase())) continue;
+    extra.push({ email, name: r.name ?? null, userId: r.id, source: "directory" });
   }
-  return names;
+  return [...roster, ...extra];
 }
-function newMentions(previous, next) {
-  const before = new Set(extractMentions(previous).map((n) => n.toLowerCase()));
-  return extractMentions(next).filter((n) => !before.has(n.toLowerCase()));
-}
-function resolveMention(people, name) {
+async function findDirectoryPerson(name) {
+  if (!config.PEOPLE_SUGGEST_ALL_USERS) return void 0;
   const n = name.trim().toLowerCase();
   if (!n) return void 0;
-  const exact = people.find((p) => p.email.toLowerCase() === n);
-  if (exact) return exact;
-  const matches = people.filter(
-    (p) => p.email.toLowerCase().split("@")[0] === n || (p.name || "").toLowerCase() === n
-  );
-  return matches.length === 1 ? matches[0] : void 0;
+  const rows = await getDb().all(
+    `SELECT id, email, name FROM users
+      WHERE id != ?
+        AND (LOWER(email) = ? OR LOWER(email) LIKE ? ESCAPE '\\' OR LOWER(COALESCE(name, '')) = ?)`,
+    [ANON_USER_ID, n, `${escapeLike(n)}@%`, n]
+  );
+  return resolveMention(
+    rows.map((r) => ({ email: r.email, name: r.name ?? null, userId: r.id, source: "directory" })),
+    name
+  );
+}
+var SUGGEST_LIMIT = 20;
+var SUGGEST_FETCH = 200;
+function matchesQuery(person, q) {
+  if (!q) return true;
+  return person.email.toLowerCase().includes(q) || (person.name || "").toLowerCase().includes(q);
+}
+var escapeLike = (s) => s.replace(/([\\%_])/g, "\\$1");
+function queryFilter(q) {
+  if (!q) return { sql: "", args: [] };
+  const pattern = `%${escapeLike(q)}%`;
+  return {
+    sql: " AND (LOWER(u.email) LIKE ? ESCAPE '\\' OR LOWER(COALESCE(u.name, '')) LIKE ? ESCAPE '\\')",
+    args: [pattern, pattern]
+  };
+}
+async function suggestPeopleForUser(callerUserId, query = "", limit = SUGGEST_LIMIT) {
+  const db = getDb();
+  const q = query.trim().toLowerCase();
+  const cap = Math.min(Math.max(limit, 1), SUGGEST_LIMIT);
+  const caller = await db.get("SELECT email FROM users WHERE id = ?", [
+    callerUserId
+  ]);
+  const callerEmail = (caller?.email || "").toLowerCase();
+  const filter = queryFilter(q);
+  const wholeDirectory = config.PEOPLE_SUGGEST_ALL_USERS || await isServerAdminUserId(callerUserId);
+  const rows = await (async () => {
+    if (wholeDirectory) {
+      return await db.all(
+        `SELECT u.id AS user_id, u.email AS email, u.name AS name, 'directory' AS source
+           FROM users u
+          WHERE u.id != ? AND u.id != ?${filter.sql}
+          ORDER BY u.email
+          LIMIT ?`,
+        [callerUserId, ANON_USER_ID, ...filter.args, SUGGEST_FETCH]
+      );
+    }
+    const args = [callerUserId, ANON_USER_ID];
+    const myNests = () => {
+      args.push(callerUserId, callerUserId);
+      return `SELECT id FROM nests WHERE user_id = ?
+              UNION SELECT nest_id FROM nest_collaborators WHERE user_id = ?`;
+    };
+    const ownedNests = myNests();
+    const collabNests = myNests();
+    const stewardNests = myNests();
+    const sql = `SELECT u.id AS user_id, u.email AS email, u.name AS name, 'nest' AS source
+         FROM users u
+        WHERE u.id != ? AND u.id != ?
+          AND (u.id IN (SELECT user_id FROM nests WHERE id IN (${ownedNests}))
+               OR u.id IN (SELECT user_id FROM nest_collaborators
+                            WHERE nest_id IN (${collabNests}))
+               OR LOWER(u.email) IN (SELECT LOWER(user_email) FROM stewards
+                                      WHERE is_active = 1
+                                        AND nest_id IN (${stewardNests})))${filter.sql}
+        ORDER BY u.email
+        LIMIT ?`;
+    args.push(...filter.args, SUGGEST_FETCH);
+    return await db.all(sql, args);
+  })();
+  const byEmail = /* @__PURE__ */ new Map();
+  const add = (email, name, source) => {
+    const addr = (email || "").trim();
+    const key = addr.toLowerCase();
+    if (!addr || !key || key === callerEmail || byEmail.has(key)) return;
+    const person = { email: addr, name: name ?? null, source };
+    if (!matchesQuery(person, q)) return;
+    byEmail.set(key, person);
+  };
+  for (const r of rows) add(r.email, r.name, r.source);
+  const teamEmails = /* @__PURE__ */ new Set();
+  for (const team of wholeDirectory ? [] : await listTeamsForUser(callerUserId)) {
+    for (const member of team.members ?? []) {
+      const key = (member.email || "").trim().toLowerCase();
+      if (key && key !== callerEmail && !byEmail.has(key)) teamEmails.add(key);
+    }
+  }
+  if (teamEmails.size > 0) {
+    const list = [...teamEmails].slice(0, SUGGEST_FETCH);
+    const named = await db.all(
+      `SELECT email, name FROM users
+        WHERE LOWER(email) IN (${list.map(() => "?").join(",")})`,
+      list
+    );
+    const nameOf = new Map(
+      named.map((u) => [u.email.toLowerCase(), u.name ?? null])
+    );
+    for (const email of list) add(email, nameOf.get(email) ?? null, "team");
+  }
+  return [...byEmail.values()].sort(
+    (a, b) => (a.name || a.email).localeCompare(b.name || b.email, void 0, {
+      sensitivity: "base"
+    })
+  ).slice(0, cap);
 }
 
 // src/governance/mention-notify.ts
@@ -2047,48 +2268,172 @@ async function canOpenNode(nestId, nodeId, userId, email) {
   }
   return canReadNode(nestId, nodeId, userId, email);
 }
+async function resolveRecipients(params) {
+  const { nestId, nodeId, names, actorEmail } = params;
+  if (names.length === 0) return [];
+  const roster = await listNestPeople(nestId);
+  const actor = actorEmail.toLowerCase();
+  const candidates = /* @__PURE__ */ new Map();
+  const outsiders = [];
+  for (const name of names) {
+    const member = resolveMention(roster, name);
+    const person = member ?? await findDirectoryPerson(name);
+    if (!person?.userId) continue;
+    const key = person.email.toLowerCase();
+    if (key === actor || candidates.has(key)) continue;
+    const r = { email: person.email, userId: person.userId };
+    candidates.set(key, r);
+    if (!member) outsiders.push(r);
+    if (candidates.size >= MAX_MENTION_RECIPIENTS) break;
+  }
+  if (outsiders.length) await inviteMentioned(nestId, actorEmail, outsiders);
+  const checked = await Promise.all(
+    [...candidates.values()].map(async (r) => ({
+      r,
+      allowed: await canOpenNode(nestId, nodeId, r.userId, r.email)
+    }))
+  );
+  return checked.filter((c) => c.allowed).map((c) => c.r);
+}
+async function inviteMentioned(nestId, actorEmail, outsiders) {
+  const db = getDb();
+  const actor = await db.get("SELECT id FROM users WHERE LOWER(email) = LOWER(?)", [
+    actorEmail
+  ]);
+  if (!actor) return;
+  const access = await resolveNestAccess(nestId, actor.id);
+  if (permissionLevel(access.permission) < permissionLevel("write")) return;
+  for (const r of outsiders) {
+    await db.run(
+      `INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by)
+       SELECT ?, ?, ?, 'read', ?
+        WHERE NOT EXISTS (SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?)`,
+      [uuid5(), nestId, r.userId, actor.id, nestId, r.userId]
+    );
+  }
+}
+async function insertInboxRows(params) {
+  const db = getDb();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  let created = 0;
+  for (const r of params.recipients) {
+    await db.run(
+      `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
+       VALUES (?, ?, ?, 'mention', ?, ?, ?)`,
+      [uuid5(), params.nestId, r.email.toLowerCase(), params.nodeId, params.message, now]
+    );
+    created++;
+  }
+  return created;
+}
+async function deliverMentionMessages(params) {
+  const { nestId, nodeId, recipients, channelMessage, actorEmail, excerpt: excerpt2, ctx } = params;
+  let throttled = 0;
+  const channelReachable = await hasAnyConnector(nestId, "mention");
+  if (channelReachable && canDeliver("channel", nestId, actorEmail)) {
+    void dispatchEvent({
+      kind: "mention",
+      nestId,
+      subjectId: nodeId,
+      actor: actorEmail,
+      message: channelMessage
+    });
+  } else if (channelReachable) {
+    throttled++;
+  }
+  for (const r of isEmailConfigured() ? recipients : []) {
+    if (!canDeliver("email", nestId, actorEmail)) {
+      throttled++;
+      continue;
+    }
+    void sendEmailToRecipient(r.email, {
+      status: "mention",
+      docTitle: ctx.docTitle,
+      path: ctx.path,
+      link: ctx.link,
+      actor: actorEmail,
+      note: excerpt2 || null
+    });
+  }
+  if (throttled > 0) {
+    console.warn(
+      `[notify] mention delivery budget exhausted for ${actorEmail} in ${nestId} \u2014 ${throttled} outbound message(s) skipped; inbox rows unaffected`
+    );
+  }
+}
+var MENTION_DELIVERY_BUDGET = { max: 50, windowMs: 5 * 6e4 };
+var MENTION_CHANNEL_BUDGET = { max: 25, windowMs: 5 * 6e4 };
+function canDeliver(kind, nestId, actorEmail) {
+  return tryConsume(
+    `mention-${kind}:${nestId}:${actorEmail.toLowerCase()}`,
+    kind === "email" ? MENTION_DELIVERY_BUDGET : MENTION_CHANNEL_BUDGET
+  );
+}
+function channelSentence(actorEmail, recipients, where) {
+  const names = recipients.map((r) => r.email).join(", ");
+  return `${actorEmail} mentioned ${names} ${where}`;
+}
+function excerptOf(body, max = 140) {
+  const s = (body || "").replace(/\s+/g, " ").trim();
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
 async function notifyMentions(params) {
-  const { nestId, nodeId, previousBody, nextBody, actorEmail } = params;
+  const { nestId, nodeId, previousBody, nextBody, actorEmail, baseUrl } = params;
   try {
     const names = newMentions(previousBody, nextBody);
-    if (names.length === 0) return 0;
-    const people = await listNestPeople(nestId);
-    const actor = actorEmail.toLowerCase();
-    const recipients = /* @__PURE__ */ new Map();
-    for (const name of names) {
-      const person = resolveMention(people, name);
-      if (!person?.userId) continue;
-      const key = person.email.toLowerCase();
-      if (key === actor || recipients.has(key)) continue;
-      recipients.set(key, { email: person.email, userId: person.userId });
-    }
-    if (recipients.size === 0) return 0;
-    const label = await describeNode(nestId, nodeId);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const db = getDb();
-    let created = 0;
-    for (const { email, userId } of recipients.values()) {
-      if (!await canOpenNode(nestId, nodeId, userId, email)) continue;
-      await db.run(
-        `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
-         VALUES (?, ?, ?, 'mention', ?, ?, ?)`,
-        [
-          uuid4(),
-          nestId,
-          email.toLowerCase(),
-          nodeId,
-          `${actorEmail} mentioned you in "${label}"`,
-          now
-        ]
-      );
-      created++;
-    }
+    const recipients = await resolveRecipients({ nestId, nodeId, names, actorEmail });
+    if (recipients.length === 0) return 0;
+    const ctx = await buildDocContext(nestId, nodeId, baseUrl);
+    const message = `${actorEmail} mentioned you in "${ctx.label}"`;
+    const created = await insertInboxRows({ nestId, nodeId, recipients, message });
+    await deliverMentionMessages({
+      nestId,
+      nodeId,
+      recipients,
+      channelMessage: channelSentence(
+        actorEmail,
+        recipients,
+        `in *${ctx.label}*`
+      ),
+      actorEmail,
+      excerpt: "",
+      ctx
+    });
     return created;
   } catch (err) {
     console.error("[notify] mention fan-out failed", nestId, nodeId, err);
     return 0;
   }
 }
+async function notifyCommentMentions(params) {
+  const { nestId, nodeId, body, actorEmail, baseUrl } = params;
+  try {
+    const names = extractMentions(body || "");
+    const recipients = await resolveRecipients({ nestId, nodeId, names, actorEmail });
+    if (recipients.length === 0) return 0;
+    const ctx = await buildDocContext(nestId, nodeId, baseUrl);
+    const excerpt2 = excerptOf(body);
+    const message = `${actorEmail} mentioned you in a comment on "${ctx.label}"`;
+    const created = await insertInboxRows({ nestId, nodeId, recipients, message });
+    await deliverMentionMessages({
+      nestId,
+      nodeId,
+      recipients,
+      channelMessage: channelSentence(
+        actorEmail,
+        recipients,
+        `in a comment on *${ctx.label}*`
+      ),
+      actorEmail,
+      excerpt: excerpt2,
+      ctx
+    });
+    return created;
+  } catch (err) {
+    console.error("[notify] comment mention fan-out failed", nestId, nodeId, err);
+    return 0;
+  }
+}
 
 // src/nodes/service.ts
 async function userIdFromEmail(email) {
@@ -2223,6 +2568,19 @@ var ACCEPTED_NODE_TYPES = /* @__PURE__ */ new Set([
   "artifact",
   "table"
 ]);
+function assertAcceptedType(type) {
+  if (type === "artifact" && !config.TYPE_ARTIFACT_ENABLED) {
+    throw new ValidationError("Artifact nodes are disabled on this server");
+  }
+  if (type === "table" && !config.TYPE_TABLE_ENABLED) {
+    throw new ValidationError("Table nodes are disabled on this server");
+  }
+  if (!ACCEPTED_NODE_TYPES.has(type)) {
+    throw new ValidationError(
+      `unknown node type "${type}"; allowed: ${[...ACCEPTED_NODE_TYPES].sort().join(", ")}`
+    );
+  }
+}
 function toNodeResponse(node) {
   const fm = node.frontmatter;
   const title = fm.title === void 0 || fm.title === null ? "" : String(fm.title);
@@ -2312,8 +2670,9 @@ function engineScopesFolders() {
   }
   return folderScopeSupported;
 }
+var DERIVED_ANNOTATIONS_SUFFIX = "--annotations";
 function isDerivedAnnotationsNode(id) {
-  return id.endsWith("--annotations");
+  return id.endsWith(DERIVED_ANNOTATIONS_SUFFIX);
 }
 async function getNodeForCaller(nestId, selector, userId, userEmail, opts = {}) {
   if (selector.id && !await canReadNode(nestId, selector.id, userId, userEmail)) {
@@ -2647,11 +3006,11 @@ async function autoPublishReason(nestId, userEmail, doc) {
   }
   return await actorAutoPublishes(nestId, userEmail) ? "owner/admin self-approve" : null;
 }
-async function createNode(nestId, input, userEmail) {
+async function createNode(nestId, input, userEmail, opts = {}) {
   const generatedId = !input.id && !slugify(input.title);
   for (let attempt = 0; ; attempt++) {
     try {
-      return await createNodeOnce(nestId, input, userEmail);
+      return await createNodeOnce(nestId, input, userEmail, opts);
     } catch (err) {
       if (!generatedId || attempt >= 3 || !(err instanceof ConflictError)) {
         throw err;
@@ -2659,7 +3018,7 @@ async function createNode(nestId, input, userEmail) {
     }
   }
 }
-async function createNodeOnce(nestId, input, userEmail) {
+async function createNodeOnce(nestId, input, userEmail, opts = {}) {
   const { storage } = await engineCache.get(nestId);
   assertTitleLength(input.title);
   assertTitleReadable(input.title);
@@ -2672,17 +3031,7 @@ async function createNodeOnce(nestId, input, userEmail) {
   }
   const tags = requireTags(input.tags);
   const requestedType = input.type || "document";
-  if (requestedType === "artifact" && !config.TYPE_ARTIFACT_ENABLED) {
-    throw new ValidationError("Artifact nodes are disabled on this server");
-  }
-  if (requestedType === "table" && !config.TYPE_TABLE_ENABLED) {
-    throw new ValidationError("Table nodes are disabled on this server");
-  }
-  if (!ACCEPTED_NODE_TYPES.has(requestedType)) {
-    throw new ValidationError(
-      `unknown node type "${requestedType}"; allowed: ${[...ACCEPTED_NODE_TYPES].sort().join(", ")}`
-    );
-  }
+  assertAcceptedType(requestedType);
   if (input.schedule !== void 0 && !isRunnableType(input.type)) {
     throw new ValidationError(
       `schedule is only valid for runnable node types (${RUNNABLE_NODE_TYPES.join(
@@ -2792,13 +3141,15 @@ async function createNodeOnce(nestId, input, userEmail) {
       });
     }
     await trackEvent("node.create", { nestId, nodeId: id });
-    await notifyMentions({
-      nestId,
-      nodeId: id,
-      previousBody: "",
-      nextBody: node.body || "",
-      actorEmail: userEmail
-    });
+    if (opts.notifyMentions !== false) {
+      await notifyMentions({
+        nestId,
+        nodeId: id,
+        previousBody: "",
+        nextBody: node.body || "",
+        actorEmail: userEmail
+      });
+    }
     return { node, version: savedVersion };
   });
 }
@@ -2892,7 +3243,7 @@ async function registerImportedDocuments(nestId, userEmail) {
   await trackEvent("nest.import.documents", { nestId, registered: docs.length });
   return docs.length;
 }
-async function updateNode(nestId, nodeId, patch, userEmail) {
+async function updateNode(nestId, nodeId, patch, userEmail, opts = {}) {
   return withNodeWriteLock(nodeWriteKey(nestId, nodeId), async () => {
     try {
       const { storage, versions: versionManager } = await engineCache.get(
@@ -2943,6 +3294,20 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         };
         opInput.title = patch.title;
       }
+      if (patch.type !== void 0 && patch.type !== node.frontmatter.type) {
+        assertAcceptedType(patch.type);
+        if (patch.type === "skill") {
+          opInput.trigger = `when asked to ${String(node.frontmatter.title || nodeId).toLowerCase()}`;
+        }
+        if (isRunnableType(node.frontmatter.type) && !isRunnableType(patch.type)) {
+          const metadata = { ...node.frontmatter.metadata };
+          delete metadata.schedule;
+          node = { ...node, frontmatter: { ...node.frontmatter, metadata } };
+          opInput.metadata = { ...opInput.metadata, schedule: null };
+        }
+        node = { ...node, frontmatter: { ...node.frontmatter, type: patch.type } };
+        opInput.type = patch.type;
+      }
       if (patch.schedule !== void 0) {
         if (!isRunnableType(node.frontmatter.type)) {
           throw new ValidationError(
@@ -3044,13 +3409,15 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         );
         responseVersion = publishedVersion;
       }
-      await notifyMentions({
-        nestId,
-        nodeId,
-        previousBody,
-        nextBody: node.body || "",
-        actorEmail: userEmail
-      });
+      if (opts.notifyMentions !== false) {
+        await notifyMentions({
+          nestId,
+          nodeId,
+          previousBody,
+          nextBody: node.body || "",
+          actorEmail: userEmail
+        });
+      }
       return { node, version: responseVersion };
     } catch (err) {
       throw toSafeError(
@@ -3632,8 +3999,13 @@ nestRoutes.get("/", async (c) => {
   }
   const out = await Promise.all(deduped.map(annotate));
   const docRows = await db.all(
-    `SELECT nest_id, COUNT(DISTINCT node_id) AS c, MAX(created_at) AS last_activity
-       FROM node_versions GROUP BY nest_id`
+    `SELECT nest_id,
+            COUNT(DISTINCT CASE
+              WHEN ${suffixOf(db, "node_id", DERIVED_ANNOTATIONS_SUFFIX.length)} <> ?
+              THEN node_id END) AS c,
+            MAX(created_at) AS last_activity
+       FROM node_versions GROUP BY nest_id`,
+    [DERIVED_ANNOTATIONS_SUFFIX]
   );
   const docByNest = new Map(docRows.map((r) => [r.nest_id, Number(r.c)]));
   const activityByNest = new Map(docRows.map((r) => [r.nest_id, r.last_activity]));
@@ -3675,6 +4047,7 @@ nestRoutes.get("/", async (c) => {
     );
     for (const r of rows) {
       const targets = grantTargetsByNest.get(r.nest_id) ?? [];
+      if (isDerivedAnnotationsNode(r.node_id)) continue;
       if (grantCoversNode(targets, r.node_id)) {
         grantedDocsByNest.set(r.nest_id, (grantedDocsByNest.get(r.nest_id) ?? 0) + 1);
       }
@@ -3960,7 +4333,7 @@ nestRoutes.patch("/:nestId/settings", async (c) => {
 import { Hono as Hono4 } from "hono";
 
 // src/nests/sharing-service.ts
-import { v4 as uuid5 } from "uuid";
+import { v4 as uuid6 } from "uuid";
 var VALID_PERMISSIONS = ["read", "write", "admin"];
 async function addCollaborator(params) {
   const { nestId } = params;
@@ -3987,10 +4360,10 @@ async function addCollaborator(params) {
       userId = existing.id;
     } else {
       const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-      userId = uuid5();
+      userId = uuid6();
       await db.run(
         "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-        [userId, email, null, await hashPassword2(uuid5())]
+        [userId, email, null, await hashPassword2(uuid6())]
       );
     }
   }
@@ -4028,7 +4401,7 @@ async function addCollaborator(params) {
     [params.grantedByEmail]
   ))?.id : void 0;
   const granterId = params.grantedByUserId || granterByEmail || ownerRow.user_id;
-  const collabId = uuid5();
+  const collabId = uuid6();
   await db.run(
     "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)",
     [collabId, nestId, userId, params.permission, granterId]
@@ -4101,7 +4474,7 @@ sharingRoutes.get("/collaborators", async (c) => {
   }
   return c.json({
     collaborators: enriched,
-    people: await listNestPeople(nestId)
+    people: await withDirectory(await listNestPeople(nestId))
   });
 });
 sharingRoutes.post("/collaborators", async (c) => {
@@ -4145,6 +4518,22 @@ sharingRoutes.delete("/collaborators/:collabId", async (c) => {
   }
   return c.json({ removed: true });
 });
+sharingRoutes.get("/mentionable", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const people = await listNestPeople(nestId);
+  const callerEmail = (await resolveCallerEmail(userId)).toLowerCase();
+  const onRoster = people.some((p) => p.email.toLowerCase() === callerEmail);
+  if (!onRoster) {
+    const access = await resolveNestAccess(nestId, userId);
+    if (permissionLevel(access.permission) < permissionLevel("write")) {
+      throw new ForbiddenError("Only people on this nest can see its roster");
+    }
+  }
+  return c.json({
+    people: (await withDirectory(people)).map((p) => ({ email: p.email, name: p.name }))
+  });
+});
 sharingRoutes.patch("/visibility", async (c) => {
   const body = await c.req.json();
   if (!body.visibility || !["private", "org", "public"].includes(body.visibility)) {
@@ -4176,10 +4565,14 @@ sharingRoutes.patch("/visibility", async (c) => {
 });
 sharingRoutes.patch("/reader-mode", async (c) => {
   const userId = c.get("userId");
+  const nestId = c.req.param("nestId");
   if (config.AUTH_MODE !== "open" && !await isServerAdminUserId(userId)) {
-    throw new ForbiddenError(
-      "Only the server admin can configure reader mode"
-    );
+    const access = await resolveNestAccess(nestId, userId);
+    if (permissionLevel(access.permission) < permissionLevel("admin")) {
+      throw new ForbiddenError(
+        "Only the nest owner, a nest admin, or the server admin can configure reader mode"
+      );
+    }
   }
   const body = await c.req.json();
   if (body.enabled !== void 0 && typeof body.enabled !== "boolean") {
@@ -4202,7 +4595,6 @@ sharingRoutes.patch("/reader-mode", async (c) => {
     );
   }
   const db = getDb();
-  const nestId = c.req.param("nestId");
   const exists = await db.get("SELECT id FROM nests WHERE id = ?", [
     nestId
   ]);
@@ -4222,14 +4614,21 @@ sharingRoutes.patch("/reader-mode", async (c) => {
 
 // src/nests/grant-routes.ts
 import { Hono as Hono5 } from "hono";
-import { v4 as uuid6 } from "uuid";
+import { v4 as uuid7 } from "uuid";
 var grantRoutes = new Hono5();
-async function requireManage(c, nestId) {
-  if (!await canManageStewards(nestId, c.get("userId"))) {
+async function requireManage(c, nestId, opts = {}) {
+  if (config.AUTH_MODE === "open") return;
+  const access = await resolveNestAccess(nestId, c.get("userId"));
+  if (access.rawPermission !== "owner" && access.rawPermission !== "admin") {
     throw new ForbiddenError(
       "Only a nest admin, the nest owner, or the server admin can manage sharing."
     );
   }
+  if (access.archived && !opts.readOnly) {
+    throw new ForbiddenError(
+      "This nest is archived, so it is read-only. Restore it to change sharing."
+    );
+  }
 }
 async function resolveGrantee(email) {
   const db = getDb();
@@ -4237,10 +4636,10 @@ async function resolveGrantee(email) {
   const existing = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
   if (existing) return existing.id;
   const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-  const id = uuid6();
+  const id = uuid7();
   await db.run(
     "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-    [id, e, null, await hashPassword2(uuid6())]
+    [id, e, null, await hashPassword2(uuid7())]
   );
   return id;
 }
@@ -4319,7 +4718,7 @@ grantRoutes.post("/", async (c) => {
 });
 grantRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
-  await requireManage(c, nestId);
+  await requireManage(c, nestId, { readOnly: true });
   const grants = await listGrants(nestId);
   const db = getDb();
   const withEmail = await Promise.all(
@@ -4342,7 +4741,7 @@ grantRoutes.delete("/:id", async (c) => {
 import { Hono as Hono6 } from "hono";
 
 // src/nests/publish-service.ts
-import { v4 as uuid7 } from "uuid";
+import { v4 as uuid8 } from "uuid";
 import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
 var MODES = ["public", "email", "code", "invite"];
 var LINK_TTL_SECONDS = 60 * 60;
@@ -4411,7 +4810,7 @@ async function createPublish(params) {
     );
   }
   const db = getDb();
-  const id = uuid7();
+  const id = uuid8();
   const slug = newSlug();
   const created = nowIso();
   const codeHash = mode === "code" && params.code ? await hashPassword(params.code.trim()) : null;
@@ -4442,7 +4841,7 @@ async function createPublish(params) {
       await db.run(
         `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
          VALUES (?, ?, 'invite', ?, NULL, NULL, NULL, ?)`,
-        [uuid7(), id, email, created]
+        [uuid8(), id, email, created]
       );
     }
   }
@@ -4497,7 +4896,7 @@ async function mintMagicLink(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'link', ?, ?, ?, NULL, ?)`,
-    [uuid7(), publishId, e, sha256Hex(token), expires, nowIso()]
+    [uuid8(), publishId, e, sha256Hex(token), expires, nowIso()]
   );
   return token;
 }
@@ -4527,7 +4926,7 @@ async function createSession2(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'session', ?, ?, ?, NULL, ?)`,
-    [uuid7(), publishId, email, sha256Hex(token), expires, nowIso()]
+    [uuid8(), publishId, email, sha256Hex(token), expires, nowIso()]
   );
   return token;
 }
@@ -4544,7 +4943,7 @@ async function logView(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'view', ?, NULL, NULL, NULL, ?)`,
-    [uuid7(), publishId, email, nowIso()]
+    [uuid8(), publishId, email, nowIso()]
   );
 }
 async function listAllowlist(publishId) {
@@ -4637,7 +5036,7 @@ import { Hono as Hono7 } from "hono";
 import MarkdownIt from "markdown-it";
 
 // src/annotations/service.ts
-import { v4 as uuid8 } from "uuid";
+import { v4 as uuid9 } from "uuid";
 
 // src/annotations/projection.ts
 var MAX_CONTEXT_CHARS = 250;
@@ -4762,6 +5161,10 @@ async function rowToThread(row) {
 async function getThreadRow(threadId) {
   return await getDb().get("SELECT * FROM annotation_threads WHERE id = ?", [threadId]);
 }
+async function getThread(threadId) {
+  const row = await getThreadRow(threadId);
+  return row ? await rowToThread(row) : null;
+}
 async function countThreadsByNode(nestId) {
   const rows = await getDb().all(
     `SELECT node_id, CAST(COUNT(*) AS INTEGER) AS count, MAX(created_at) AS last_at
@@ -4787,14 +5190,14 @@ async function createThread(nestId, nodeId, input, authorEmail) {
     throw new Error("comment body is required");
   }
   const db = getDb();
-  const id = uuid8();
+  const id = uuid9();
   const anchor = clampAnchor(input.anchor);
   const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
   await db.transaction(async (tx) => {
     await tx.run(
       `INSERT INTO annotation_threads
-         (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by)
-       VALUES (?, ?, ?, ?, ?, 'open', ?)`,
+         (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by, created_at)
+       VALUES (?, ?, ?, ?, ?, 'open', ?, ${nowMsExpr(db)})`,
       [
         id,
         nestId,
@@ -4805,8 +5208,9 @@ async function createThread(nestId, nodeId, input, authorEmail) {
       ]
     );
     await tx.run(
-      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
-      [uuid8(), id, authorEmail, body]
+      `INSERT INTO annotation_comments (id, thread_id, author, body, created_at)
+       VALUES (?, ?, ?, ?, ${nowMsExpr(db)})`,
+      [uuid9(), id, authorEmail, body]
     );
   });
   return rowToThread(await getThreadRow(id));
@@ -4824,9 +5228,11 @@ async function addComment(nestId, nodeId, threadId, authorEmail, body) {
     throw new Error("comment body is required");
   }
   await getScopedThreadRow(threadId, nestId, nodeId);
-  await getDb().run(
-    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
-    [uuid8(), threadId, authorEmail, trimmed]
+  const db = getDb();
+  await db.run(
+    `INSERT INTO annotation_comments (id, thread_id, author, body, created_at)
+     VALUES (?, ?, ?, ?, ${nowMsExpr(db)})`,
+    [uuid9(), threadId, authorEmail, trimmed]
   );
   return rowToThread(await getThreadRow(threadId));
 }
@@ -4913,7 +5319,13 @@ async function syncAnnotationsNode(nestId, nodeId, userEmail) {
     const markdown2 = projectThreadsToMarkdown(title, threads);
     const derivedId = derivedAnnotationsId(nodeId);
     try {
-      await updateNode(nestId, derivedId, { content: markdown2 }, userEmail);
+      await updateNode(
+        nestId,
+        derivedId,
+        { content: markdown2 },
+        userEmail,
+        { notifyMentions: false }
+      );
     } catch (err) {
       if (err instanceof NotFoundError) {
         await createNode(
@@ -4925,7 +5337,8 @@ async function syncAnnotationsNode(nestId, nodeId, userEmail) {
             type: "document",
             tags: ["annotations"]
           },
-          userEmail
+          userEmail,
+          { notifyMentions: false }
         );
       } else {
         throw err;
@@ -5350,8 +5763,19 @@ nestTeamRoutes.delete("/:teamId", async (c) => {
   return c.json({ teams });
 });
 
-// src/governance/team-routes.ts
+// src/nests/people-routes.ts
 import { Hono as Hono9 } from "hono";
+var peopleRoutes = new Hono9();
+peopleRoutes.get("/suggest", async (c) => {
+  const userId = c.get("userId");
+  const q = c.req.query("q") ?? "";
+  const rawLimit = Number(c.req.query("limit"));
+  const limit = Number.isFinite(rawLimit) && rawLimit > 0 ? rawLimit : void 0;
+  return c.json({ people: await suggestPeopleForUser(userId, q, limit) });
+});
+
+// src/governance/team-routes.ts
+import { Hono as Hono10 } from "hono";
 
 // src/governance/promptowl-teams.ts
 var PROMPTOWL_SOURCE = "promptowl";
@@ -5498,7 +5922,7 @@ async function desiredRoster(poTeam, callerEmail) {
 }
 
 // src/governance/team-routes.ts
-var teamRoutes = new Hono9();
+var teamRoutes = new Hono10();
 var PROMPTOWL_LIMIT = { max: 10, windowMs: 15 * 6e4 };
 var CONNECT_REQUIRED = "promptowl_connect_required";
 var CONNECT_REQUIRED_STATUS = 428;
@@ -5683,7 +6107,7 @@ function toSearchHit(node, query) {
 }
 
 // src/nodes/routes.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono11 } from "hono";
 
 // src/nodes/markdown-export.ts
 import { parseDocument as parseDocument2 } from "@promptowl/contextnest-engine";
@@ -5735,7 +6159,7 @@ ${m[1]}
 }
 
 // src/nodes/routes.ts
-var nodeRoutes = new Hono10();
+var nodeRoutes = new Hono11();
 function nodeAsMarkdown(response, nodeId) {
   return nodeToMarkdown({
     id: nodeId,
@@ -5817,7 +6241,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-5HBQGDMK.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-4DHNRULG.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -5838,7 +6262,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-XFWTENTN.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-HHGOTO6P.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -5977,7 +6401,8 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
     }
   }
   response.myGrant = await resolveNodeGrant(nestId, userId, nodeId);
-  if (publicReader) {
+  const approvedOnly = c.req.query("approved_only") === "1" || c.req.query("approved_only") === "true";
+  if (publicReader || approvedOnly) {
     const approved = await getApprovedVersion(nestId, nodeId);
     if (approved != null) {
       let approvedRaw = "";
@@ -6008,6 +6433,9 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
       }
       return c.json({ node: response });
     }
+    if (approvedOnly) {
+      throw new NotFoundError("This document has no approved version yet.");
+    }
   }
   response.status = node.pendingChange ? "external_edit_pending" : await getDisplayStatus(nestId, nodeId);
   if (response.status === "pending_review") {
@@ -6032,6 +6460,9 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const body = await c.req.json();
+  if (body.type !== void 0 && typeof body.type !== "string") {
+    throw new ValidationError("type must be a string");
+  }
   const baseVersionHeader = c.req.header("X-Base-Version");
   if (baseVersionHeader) {
     const baseVersion = parseInt(baseVersionHeader, 10);
@@ -6062,7 +6493,8 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
       status: body.status,
       changeNote: body.changeNote,
       schedule: body.schedule,
-      prime: body.prime
+      prime: body.prime,
+      type: body.type
     },
     authorEmail
   );
@@ -6082,13 +6514,13 @@ async function getUserEmail(c) {
 }
 
 // src/annotations/routes.ts
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono12 } from "hono";
 
 // src/annotations/types.ts
 var ARTIFACT_NODE_TYPE = "artifact";
 
 // src/annotations/routes.ts
-var annotationRoutes = new Hono11();
+var annotationRoutes = new Hono12();
 function getNodeId(c) {
   const raw = c.req.param("nodeId");
   try {
@@ -6129,6 +6561,13 @@ annotationRoutes.post("/:nodeId{.+}/annotations", async (c) => {
     },
     userEmail
   );
+  await notifyCommentMentions({
+    nestId,
+    nodeId,
+    body: input.body,
+    actorEmail: userEmail,
+    baseUrl: requestBaseUrl(c.req.url)
+  });
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread }, 201);
 });
@@ -6144,6 +6583,13 @@ async function handleAnnotationReply(c, nodeId, threadId) {
     throw new ValidationError("body is required");
   }
   const thread = await addComment(nestId, nodeId, threadId, userEmail, input.body);
+  await notifyCommentMentions({
+    nestId,
+    nodeId,
+    body: input.body,
+    actorEmail: userEmail,
+    baseUrl: requestBaseUrl(c.req.url)
+  });
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread });
 }
@@ -6202,7 +6648,7 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
 });
 
 // src/nodes/query-routes.ts
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono13 } from "hono";
 
 // src/tables/service.ts
 function splitCsvLine(line) {
@@ -6552,7 +6998,18 @@ var STOPWORDS = /* @__PURE__ */ new Set([
   "ok",
   "please",
   "thanks",
-  "thank"
+  "thank",
+  // Greetings and fillers a chat turn opens with — never a topic.
+  "hello",
+  "hi",
+  "hey",
+  "there",
+  "good",
+  "morning",
+  "afternoon",
+  "evening",
+  "bye",
+  "cheers"
 ]);
 function tokenizePrompt(prompt) {
   const words = prompt.toLowerCase().split(/[^a-z0-9_-]+/).filter(Boolean).filter((w) => w.length >= 3 && !STOPWORDS.has(w));
@@ -6594,6 +7051,34 @@ async function compilePrompt(prompt, nestId, titles) {
     unmatched
   };
 }
+function scorePrompt(doc, tokens) {
+  if (tokens.length === 0) return { score: 0, via: null };
+  const title = doc.frontmatter.title || "";
+  const tags = (doc.frontmatter.tags || []).map(normalizeTag);
+  const body = (doc.body || "").toLowerCase();
+  let sum = 0;
+  let via = null;
+  for (const t of tokens) {
+    const inTitle = titleScore(title, t);
+    if (inTitle > 0) {
+      sum += inTitle;
+      via = "title";
+    } else if (tags.some((tag) => tag.startsWith(t))) {
+      sum += 2;
+      if (via !== "title") via = "tag";
+    } else if (startsWord(body, t)) {
+      sum += 1;
+      via ??= "fulltext";
+    }
+  }
+  return { score: sum / (4 * tokens.length), via };
+}
+function startsWord(text, term) {
+  for (let i = text.indexOf(term); i !== -1; i = text.indexOf(term, i + 1)) {
+    if (i === 0 || !/[a-z0-9]/.test(text[i - 1])) return true;
+  }
+  return false;
+}
 
 // src/nodes/readable-body.ts
 async function resolveReadableBody(nestId, nodeId, userId, workingBody) {
@@ -6836,7 +7321,7 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
 }
 
 // src/nodes/query-routes.ts
-var queryRoutes = new Hono12();
+var queryRoutes = new Hono13();
 queryRoutes.get("/changes", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -6988,7 +7473,8 @@ queryRoutes.post("/context", async (c) => {
   const baseUrl = requestBaseUrl(c.req.url);
   const { query: queryEngine, storage } = await engineCache.get(nestId);
   const maxTokens = Math.max(50, body.max_tokens ?? 4e3);
-  const hops = body.hops ?? 2;
+  const promptPath = !body.selector?.trim() && !!body.prompt;
+  const hops = body.hops ?? (promptPath ? 0 : 2);
   const includeDrafts = body.include_drafts === true;
   const isVisible = (d) => includeDrafts || d.frontmatter.status === "published";
   let selector = body.selector?.trim() || null;
@@ -7022,7 +7508,7 @@ queryRoutes.post("/context", async (c) => {
         compileDetail.matchedTitles.map((t) => t.toLowerCase())
       );
       titleMatches = allDocs.filter(
-        (d) => matchedLower.has(d.frontmatter.title.toLowerCase())
+        (d) => matchedLower.has(d.frontmatter.title.toLowerCase()) && isVisible(d)
       );
     }
   }
@@ -7086,6 +7572,27 @@ queryRoutes.post("/context", async (c) => {
       }
     }
   }
+  const relevance = /* @__PURE__ */ new Map();
+  let fallback = null;
+  if (compileDetail) {
+    const tokens = tokenizePrompt(body.prompt);
+    const compiled = new Set(documents.map((d) => d.id));
+    for (const d of allDocs) {
+      const { score, via } = scorePrompt(d, tokens);
+      if (compiled.has(d.id)) relevance.set(d.id, { score, via: via ?? "hop" });
+      else if (score > 0 && isVisible(d)) {
+        relevance.set(d.id, { score, via });
+        documents.push(d);
+      }
+    }
+    if (compiled.size === 0 && documents.length > 0) fallback = "fulltext";
+    const top = Math.max(0, ...documents.map((d) => relevance.get(d.id).score));
+    documents = documents.filter((d) => {
+      const r = relevance.get(d.id);
+      return compiled.has(d.id) || r.via === "hop" || r.score >= top / 2;
+    });
+    documents.sort((a, b) => relevance.get(b.id).score - relevance.get(a.id).score);
+  }
   const userId = c.get("userId");
   const userEmail = await resolveCallerEmail(userId);
   const beforePermission = documents.length;
@@ -7103,10 +7610,14 @@ queryRoutes.post("/context", async (c) => {
   for (const doc of readable) {
     const block = formatContextBlock(doc, doc.url);
     const blockTokens = approxTokens(block);
-    if (tokenCount + blockTokens > maxTokens && included.length > 0) break;
+    if (tokenCount + blockTokens > maxTokens) continue;
     included.push(doc);
     tokenCount += blockTokens;
   }
+  if (included.length === 0 && readable.length > 0) {
+    included.push(readable[0]);
+    tokenCount = approxTokens(formatContextBlock(readable[0], readable[0].url));
+  }
   const truncatedByBudget = accessible.length - included.length;
   const contextMarkdown = included.map((n) => formatContextBlock(n, n.url)).join("\n\n---\n\n");
   trackEvent("context.resolve", {
@@ -7123,7 +7634,8 @@ queryRoutes.post("/context", async (c) => {
       title: n.frontmatter.title,
       url: n.url,
       tags: n.frontmatter.tags || [],
-      type: n.frontmatter.type || "document"
+      type: n.frontmatter.type || "document",
+      ...relevance.get(n.id)
     })),
     trace: {
       selector_used: selector,
@@ -7131,7 +7643,8 @@ queryRoutes.post("/context", async (c) => {
       compiled: compileDetail ? {
         matched_tags: compileDetail.matchedTags,
         matched_titles: compileDetail.matchedTitles,
-        unmatched_tokens: compileDetail.unmatched
+        unmatched_tokens: compileDetail.unmatched,
+        fallback
       } : null,
       total_matched: documents.length,
       permission_filtered: permissionFiltered,
@@ -7316,11 +7829,11 @@ queryRoutes.get("/export", async (c) => {
     let tokens = 0;
     for (const f of fields) {
       const t = approxTokens(nodeToMarkdown(f));
-      if (tokens + t > maxTokens && kept.length > 0) break;
+      if (tokens + t > maxTokens) continue;
       kept.push(f);
       tokens += t;
     }
-    included = kept;
+    included = kept.length > 0 ? kept : fields.slice(0, 1);
   }
   trackEvent("nest.export", {
     nestId,
@@ -7398,7 +7911,7 @@ queryRoutes.post("/publish", async (c) => {
 });
 
 // src/mcp/routes.ts
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono15 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
@@ -7478,10 +7991,10 @@ async function listTraceEvents(filters = {}) {
 }
 
 // src/mcp/workflow-tools.ts
-import { v4 as uuid11 } from "uuid";
+import { v4 as uuid12 } from "uuid";
 
 // src/workflow/run-service.ts
-import { v4 as uuid9 } from "uuid";
+import { v4 as uuid10 } from "uuid";
 var RUNNABLE_TYPES = ["agent", "skill"];
 async function flowSubgraph(nestId, agentNode) {
   const db = getDb();
@@ -7611,7 +8124,7 @@ async function triggerRun(opts) {
   }
   const edges = await flowSubgraph(nestId, agentNode);
   const definitions = await referencedDefinitions(nestId, edges);
-  const id = `run_${uuid9()}`;
+  const id = `run_${uuid10()}`;
   const db = getDb();
   await db.transaction(async (tx) => {
     if (parentRunId) {
@@ -7797,8 +8310,8 @@ async function listRuns(nestId, opts) {
 }
 
 // src/workflow/edge-routes.ts
-import { Hono as Hono13 } from "hono";
-import { v4 as uuid10 } from "uuid";
+import { Hono as Hono14 } from "hono";
+import { v4 as uuid11 } from "uuid";
 function toResponse(e, t) {
   return {
     id: e.id,
@@ -7859,7 +8372,9 @@ async function validateCondition(nestId, mode, condition) {
 async function assertNoFlowCycle(db, nestId, fromNode, toNode) {
   if (fromNode === toNode) {
     throw new ConflictError(
-      `This step loops back on itself: ${await nodeTrail(db, nestId, [fromNode])}. A flow can't return to a step it already ran.`
+      `This step loops back on itself: ${await nodeTrail(db, nestId, [fromNode])}.
+
+A flow can't return to a step it already ran.`
     );
   }
   const rows = await db.all(
@@ -7888,7 +8403,9 @@ async function assertNoFlowCycle(db, nestId, fromNode, toNode) {
       }
       path.reverse().push(toNode);
       throw new ConflictError(
-        `These steps loop back on each other: ${await nodeTrail(db, nestId, path)}. A flow can't return to a step it already ran.`
+        `These steps loop back on each other: ${await nodeTrail(db, nestId, path)}.
+
+A flow can't return to a step it already ran.`
       );
     }
     for (const nb of adj.get(cur) ?? []) {
@@ -7912,7 +8429,7 @@ async function assertNoDuplicateEdge(db, nestId, fromNode, toNode, type, exclude
     );
   }
 }
-var edgeRoutes = new Hono13();
+var edgeRoutes = new Hono14();
 edgeRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -7980,7 +8497,7 @@ edgeRoutes.post("/", requireWorkflowPlane, async (c) => {
   );
   const metadata = body.metadata === void 0 || body.metadata === null ? null : JSON.stringify(body.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid10();
+  const id = uuid11();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -8381,7 +8898,7 @@ async function createEdge(ctx, args) {
   );
   const metadata = args.metadata === void 0 || args.metadata === null ? null : JSON.stringify(args.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid11();
+  const id = uuid12();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, ctx.nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -8445,7 +8962,7 @@ async function upsertEdgeType(ctx, args) {
         `INSERT INTO edge_types
            (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        [uuid11(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
+        [uuid12(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
       );
     }
   });
@@ -8654,6 +9171,43 @@ var TOOL_DEFINITIONS = [
       }
     }
   },
+  {
+    name: "context_comment",
+    description: "Leave a comment on a document \u2014 the same threads the web UI's comments panel shows. Omit `thread` to open a new one; pass a thread id (from context_comments) to reply to it. Use this to answer feedback you were given, or to raise something you noticed while working. Anyone who can read the document may comment; `@name` in the body notifies that person.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the node" },
+        id: { type: "string", description: "ID of the node" },
+        body: { type: "string", description: "The comment text" },
+        thread: {
+          type: "string",
+          description: "Thread id to reply to (from context_comments). Omit to open a new thread on the document."
+        }
+      },
+      required: ["body"]
+    }
+  },
+  {
+    name: "context_resolve_comment",
+    description: "Mark a comment thread resolved once you have addressed it, or reopen one that was closed too early. Records you as the resolver, exactly as the web UI does. Resolve only threads you actually acted on.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the node" },
+        id: { type: "string", description: "ID of the node" },
+        thread: {
+          type: "string",
+          description: "Thread id, from context_comments"
+        },
+        reopen: {
+          type: "boolean",
+          description: "Reopen the thread instead of resolving it"
+        }
+      },
+      required: ["thread"]
+    }
+  },
   {
     name: "context_create",
     description: "Create a new knowledge node in the vault. The title must not already be in use \u2014 these tools resolve documents by title, so a duplicate is refused rather than filed as an unreachable twin. To change an existing document use context_update; to refile it use context_move.",
@@ -9359,8 +9913,8 @@ ${parts.join(
         node = docs.find((n) => n.id === args.id);
       }
       if (!node) return `Node not found: ${args.title || args.id}`;
-      if (await resolveLlmBody(ctx, node) === null) {
-        return `Node "${node.frontmatter.title}" has no approved version yet \u2014 not available to AI.`;
+      if (!await canReadNode(nestId, node.id, ctx.userId, userEmail)) {
+        return `Node not found: ${args.title || args.id}`;
       }
       const threads = await listThreads(nestId, node.id);
       if (!threads.length)
@@ -9379,6 +9933,89 @@ ${quote}${comments}`;
 
 ${sections}`;
     }
+    // ── Comments: write half of context_comments ──────────────────────────
+    //
+    // Both cases target the annotation store the UI's comments panel uses, so
+    // an agent's comment and a human's are the same object, and both carry the
+    // side effects the REST routes carry: the @mention fan-out and the derived
+    // `— Annotations` projection an artifact's agents read back.
+    //
+    // PRIMARY permission gate, like context_create's: the /mcp middleware
+    // admits read-tier callers (the transport is always POST), so the check
+    // here is the real one. Commenting is READ-tier — the same rule REST
+    // applies in app.ts (isAnnotationAction) — so canReadNode is the bar, not
+    // write access. Deliberately NOT gated on an approved version: a reviewer
+    // comments on a draft, and unlike reading a thread, writing one discloses
+    // nothing (the caller supplies the text).
+    case "context_comment":
+    case "context_resolve_comment": {
+      const body = String(args.body ?? "");
+      const isResolve = toolName === "context_resolve_comment";
+      if (!isResolve && !body.trim()) {
+        return "body is required \u2014 the comment text.";
+      }
+      const threadId = args.thread ? String(args.thread) : "";
+      if (isResolve && !threadId) {
+        return "thread is required \u2014 the id from context_comments.";
+      }
+      const docs = await storage.discoverDocuments();
+      let node;
+      if (args.title) {
+        node = docs.find(
+          (n) => n.frontmatter.title.toLowerCase() === String(args.title).toLowerCase()
+        );
+      } else if (args.id) {
+        node = docs.find((n) => n.id === String(args.id));
+      }
+      if (!node) {
+        return toolError(
+          `Node not found: ${args.title || args.id || "(no title or id given)"}`,
+          "DOCUMENT_NOT_FOUND"
+        );
+      }
+      if (!await canReadNode(nestId, node.id, ctx.userId, userEmail)) {
+        return toolError(
+          `Node not found: ${args.title || args.id}`,
+          "DOCUMENT_NOT_FOUND"
+        );
+      }
+      const label = node.frontmatter.title || node.id;
+      if (threadId) {
+        const existing = await getThread(threadId);
+        if (!existing || existing.nodeId !== node.id || existing.nestId !== nestId) {
+          return toolError(
+            `Thread ${threadId} is not a thread on "${label}". Call context_comments to list its threads.`,
+            "DOCUMENT_NOT_FOUND"
+          );
+        }
+      }
+      if (isResolve) {
+        const reopen = args.reopen === true;
+        const thread2 = await setThreadStatus(
+          nestId,
+          node.id,
+          threadId,
+          reopen ? "open" : "resolved",
+          userEmail
+        );
+        await syncAnnotationsNode(nestId, node.id, userEmail);
+        return reopen ? `Reopened the thread on "${label}". It is back in the open list for whoever picks it up.` : `Resolved the thread on "${label}", recorded against ${thread2.resolvedBy}.`;
+      }
+      const thread = threadId ? await addComment(nestId, node.id, threadId, userEmail, body) : await createThread(nestId, node.id, { body, anchor: null }, userEmail);
+      await notifyCommentMentions({
+        nestId,
+        nodeId: node.id,
+        body,
+        actorEmail: userEmail,
+        // Without this the notification still reaches the person, but its
+        // "Open document" link falls back to PUBLIC_BASE_URL and comes out
+        // empty when that isn't configured — every other notifying tool in
+        // this file passes it, and the REST route passes requestBaseUrl.
+        baseUrl: ctx.baseUrl
+      });
+      await syncAnnotationsNode(nestId, node.id, userEmail);
+      return threadId ? `Replied on "${label}", in thread ${thread.id}.` : `Commented on "${label}" \u2014 opened thread ${thread.id}. Reply to it by passing that id as \`thread\`.`;
+    }
     case "context_create": {
       if (!await canCreateInNest(nestId, userEmail)) {
         return toolError(
@@ -9727,21 +10364,20 @@ ${list}${more}
 Submit one with \`context_submit_review\`.`;
     }
     case "context_submit_review": {
-      const docs = await storage.discoverDocuments();
-      const node = docs.find(
-        (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
-      );
-      if (!node) return toolError(`Node not found: ${args.title}`, "DOCUMENT_NOT_FOUND");
+      const resolved = await resolveTargetNode(storage, args);
+      if (typeof resolved === "string") return toolError(resolved, "DOCUMENT_NOT_FOUND");
+      const node = resolved;
+      const nodeLabel = args.title || args.id;
       const submitCheck = await canUserEdit(ctx.nestId, node.id, userEmail);
       if (!submitCheck.allowed) {
         return toolError(
-          `You don't have permission to submit "${args.title}" for review: ${submitCheck.reason}`,
+          `You don't have permission to submit "${nodeLabel}" for review: ${submitCheck.reason}`,
           "UNAUTHORIZED_ACTION"
         );
       }
       const currentVersion = await getCurrentVersion(ctx.nestId, node.id);
       if (currentVersion === 0)
-        return toolError(`No versions found for "${args.title}"`, "VERSION_NOT_FOUND");
+        return toolError(`No versions found for "${nodeLabel}"`, "VERSION_NOT_FOUND");
       try {
         const request = await submitForReview({
           nestId: ctx.nestId,
@@ -9752,16 +10388,16 @@ Submit one with \`context_submit_review\`.`;
           priority: args.priority,
           baseUrl: ctx.baseUrl
         });
-        const resolved = await resolveStewardsForNode(
+        const resolved2 = await resolveStewardsForNode(
           ctx.nestId,
           node.id
         );
-        const stewardList = resolved.length > 0 ? `
+        const stewardList = resolved2.length > 0 ? `
 
 **Stewards who can review:**
-${resolved.map((r) => `- ${r.steward.userEmail} (${r.source})`).join("\n")}` : "";
+${resolved2.map((r) => `- ${r.steward.userEmail} (${r.source})`).join("\n")}` : "";
         return {
-          text: `Submitted "${args.title}" v${currentVersion} for review (${request.priority} priority).${stewardList}`,
+          text: `Submitted "${nodeLabel}" v${currentVersion} for review (${request.priority} priority).${stewardList}`,
           // No catalog shape to conform to — `context_submit_review` is a
           // governance-namespace operation and that namespace is declared but
           // unimplemented in the engine (`api/index.ts`, NAMESPACES). So this
@@ -9782,7 +10418,7 @@ ${resolved.map((r) => `- ${r.steward.userEmail} (${r.source})`).join("\n")}` : "
               requested_by: request.requestedBy,
               requested_at: request.requestedAt
             },
-            reviewers: resolved.map((r) => r.steward.userEmail)
+            reviewers: resolved2.map((r) => r.steward.userEmail)
           }
         };
       } catch (err) {
@@ -9927,19 +10563,19 @@ ${list}`,
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-UZ2MGDO5.js");
-        const db = (await import("./client-CSCHXUNX.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-UT3EQ3R7.js");
+        const db = (await import("./client-KEY4PYJH.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
         let row = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
         if (!row) {
           const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-          const { v4: uuid19 } = await import("uuid");
-          const id = uuid19();
+          const { v4: uuid20 } = await import("uuid");
+          const id = uuid20();
           await db.run(
             "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-            [id, e, null, await hashPassword2(uuid19())]
+            [id, e, null, await hashPassword2(uuid20())]
           );
           row = { id };
         }
@@ -9994,7 +10630,7 @@ ${list}`;
 
 // src/mcp/routes.ts
 import { z } from "zod";
-var mcpRoutes = new Hono14();
+var mcpRoutes = new Hono15();
 async function getUserEmail2(userId) {
   const db = getDb();
   const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
@@ -10060,8 +10696,8 @@ mcpRoutes.all("/", async (c) => {
 });
 
 // src/workflow/run-routes.ts
-import { Hono as Hono15 } from "hono";
-import { v4 as uuid12 } from "uuid";
+import { Hono as Hono16 } from "hono";
+import { v4 as uuid13 } from "uuid";
 var RUNNABLE_TYPES2 = ["agent", "skill"];
 var safeJson2 = (s) => {
   if (!s) return null;
@@ -10179,7 +10815,7 @@ async function buildRunBundle(nestId, agentNode) {
     definitions
   };
 }
-var runTriggerRoutes = new Hono15();
+var runTriggerRoutes = new Hono16();
 async function resolveParentRun2(nestId, parentRunId, childAgent) {
   if (!config.FEATURE_SUBAGENT_RUNS) {
     throw new ValidationError(
@@ -10258,7 +10894,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
   }
   const bundle = await buildRunBundle(nestId, agentNode);
   const triggeredBy = await resolveCallerEmail(c.get("userId"));
-  const id = `run_${uuid12()}`;
+  const id = `run_${uuid13()}`;
   await getDb().run(
     `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
      VALUES (?, ?, ?, ?, 'running', ?, ?, ?, ?)`,
@@ -10287,7 +10923,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
     201
   );
 });
-var runListRoutes = new Hono15();
+var runListRoutes = new Hono16();
 runListRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -10319,7 +10955,7 @@ runListRoutes.get("/", requireWorkflowPlane, async (c) => {
     }))
   });
 });
-var runDetailRoutes = new Hono15();
+var runDetailRoutes = new Hono16();
 async function loadRunWithPermission(c, runId, required) {
   const run = await getDb().get("SELECT * FROM runs WHERE id = ?", [
     runId
@@ -10470,8 +11106,8 @@ runDetailRoutes.get("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/workflow/schedule-routes.ts
-import { Hono as Hono16 } from "hono";
-import { v4 as uuid13 } from "uuid";
+import { Hono as Hono17 } from "hono";
+import { v4 as uuid14 } from "uuid";
 var RUNNABLE_TYPES3 = ["agent", "skill"];
 var MIN_EVERY = 5;
 var MAX_EVERY = 7 * 24 * 60;
@@ -10508,7 +11144,7 @@ function parseEvery(v) {
   }
   return n;
 }
-var scheduleRoutes = new Hono16();
+var scheduleRoutes = new Hono17();
 scheduleRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -10549,7 +11185,7 @@ scheduleRoutes.post("/", requireWorkflowPlane, async (c) => {
     );
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `sch_${uuid13()}`;
+  const id = `sch_${uuid14()}`;
   await db.run(
     `INSERT INTO schedules (id, nest_id, agent_node, every_minutes, enabled, last_run_at, max_runs, runs_created, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, NULL, ?, 0, ?, ?, ?)`,
@@ -10604,13 +11240,14 @@ scheduleRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/notify/connector-routes.ts
-import { Hono as Hono17 } from "hono";
-import { v4 as uuid14 } from "uuid";
+import { Hono as Hono18 } from "hono";
+import { v4 as uuid15 } from "uuid";
 var KNOWN_EVENTS = [
   "review_requested",
   "review_approved",
   "review_rejected",
-  "run_failed"
+  "run_failed",
+  "mention"
 ];
 var CHANNELS = ["slack", "teams", "webhook"];
 function toResponse3(r) {
@@ -10651,7 +11288,7 @@ function parseUrl(v) {
     'url must be a public https:// URL (loopback/private/metadata hosts are refused) or an env reference like "env:SLACK_WEBHOOK"'
   );
 }
-var connectorRoutes = new Hono17();
+var connectorRoutes = new Hono18();
 connectorRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -10670,7 +11307,7 @@ connectorRoutes.post("/", async (c) => {
   const url = parseUrl(body.url);
   const events = parseEvents(body.events);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `con_${uuid14()}`;
+  const id = `con_${uuid15()}`;
   await getDb().run(
     `INSERT INTO connectors (id, nest_id, channel, url, events, enabled, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?)`,
@@ -10713,7 +11350,7 @@ connectorRoutes.delete("/:id", async (c) => {
 });
 
 // src/workflow/hook-routes.ts
-import { Hono as Hono18 } from "hono";
+import { Hono as Hono19 } from "hono";
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2, randomUUID } from "crypto";
 var PRESETS = ["slack", "teams", "webhook"];
 var RUNNABLE_TYPES4 = ["agent", "skill"];
@@ -10736,7 +11373,7 @@ function toResponse4(c, r, opts = {}) {
     created_at: r.created_at
   };
 }
-var hookNestRoutes = new Hono18();
+var hookNestRoutes = new Hono19();
 hookNestRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const agent = c.req.query("agent");
@@ -10810,7 +11447,7 @@ function teamsSignatureValid(secret, authHeader, rawBody) {
 function stripMentions(text) {
   return text.replace(/<@[^>]+>/g, "").replace(/<at>[^<]*<\/at>/gi, "").trim();
 }
-var hookFireRoutes = new Hono18();
+var hookFireRoutes = new Hono19();
 hookFireRoutes.post("/:token", async (c) => {
   const token = c.req.param("token");
   if (!tryConsume("hook:*", { max: 120, windowMs: 6e4 })) {
@@ -10912,9 +11549,9 @@ hookFireRoutes.post("/:token", async (c) => {
 });
 
 // src/definitions/routes.ts
-import { Hono as Hono19 } from "hono";
-import { v4 as uuid15 } from "uuid";
-var definitionRoutes = new Hono19();
+import { Hono as Hono20 } from "hono";
+import { v4 as uuid16 } from "uuid";
+var definitionRoutes = new Hono20();
 definitionRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -10993,7 +11630,7 @@ definitionRoutes.post("/", async (c) => {
       await applyUpdate(tx, existing.id);
       targetId = existing.id;
     } else {
-      targetId = uuid15();
+      targetId = uuid16();
       wasCreated = true;
       await tx.run(
         `INSERT INTO definitions (id, nest_id, term, definition, linked_tag, defined_by, created_at, updated_at)
@@ -11022,11 +11659,11 @@ definitionRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/asset-routes.ts
-import { Hono as Hono20 } from "hono";
-import { v4 as uuid16 } from "uuid";
+import { Hono as Hono21 } from "hono";
+import { v4 as uuid17 } from "uuid";
 import { mkdir as mkdir2, readFile, writeFile } from "fs/promises";
 import { join as join4 } from "path";
-var assetRoutes = new Hono20();
+var assetRoutes = new Hono21();
 var CONTENT_TYPES = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -11072,7 +11709,7 @@ assetRoutes.post("/", async (c) => {
       `${isVideo ? "video" : "image"} too large (${(file.size / (1024 * 1024)).toFixed(1)} MB, max ${maxBytes / (1024 * 1024)} MB for ${isVideo ? "video" : "images"})`
     );
   }
-  const name = `${uuid16()}.${ext === "jpeg" ? "jpg" : ext}`;
+  const name = `${uuid17()}.${ext === "jpeg" ? "jpg" : ext}`;
   const dir = join4(resolveNestPath(nestId), "assets");
   await mkdir2(dir, { recursive: true });
   await writeFile(join4(dir, name), Buffer.from(await file.arrayBuffer()));
@@ -11112,12 +11749,125 @@ assetRoutes.get("/:file", async (c) => {
   });
 });
 
+// src/auth/community-sites-routes.ts
+import { Hono as Hono22 } from "hono";
+var serverAdminAllowed = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
+var isHttpUrl = (v) => /^https?:\/\/\S+$/i.test(v);
+var serializeSite = (site) => ({
+  id: site.id,
+  name: site.name,
+  url: site.url,
+  secret_set: !!site.secret,
+  is_active: site.is_active,
+  created_at: site.created_at,
+  updated_at: site.updated_at
+});
+var communitySiteRoutes = new Hono22();
+communitySiteRoutes.get("/", async (c) => {
+  if (!await serverAdminAllowed(c))
+    return c.json({ error: "Only the server admin can view this." }, 403);
+  const sites = await listCommunitySites();
+  return c.json({ community_sites: sites.map(serializeSite) });
+});
+communitySiteRoutes.post("/", async (c) => {
+  if (!await serverAdminAllowed(c))
+    return c.json({ error: "Only the server admin can add a community site." }, 403);
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  const name = typeof body.name === "string" ? body.name.trim() : "";
+  const url = typeof body.url === "string" ? body.url.trim().replace(/\/$/, "") : "";
+  const secret = typeof body.secret === "string" ? body.secret.trim() : "";
+  const is_active = body.is_active === void 0 ? true : !!body.is_active;
+  if (!name) return c.json({ error: "A name is required." }, 400);
+  if (!url || !isHttpUrl(url))
+    return c.json({ error: "A valid http(s) site URL is required." }, 400);
+  if (!secret || secret.length < 16)
+    return c.json({ error: "A secret of at least 16 characters is required." }, 400);
+  try {
+    const site = await createCommunitySite({ name, url, secret, is_active });
+    await loadActiveCommunitySites();
+    return c.json(serializeSite(site), 201);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/unique|duplicate/i.test(msg))
+      return c.json({ error: "A community site with this URL already exists." }, 409);
+    throw err;
+  }
+});
+communitySiteRoutes.patch("/:id", async (c) => {
+  if (!await serverAdminAllowed(c))
+    return c.json({ error: "Only the server admin can edit a community site." }, 403);
+  const id = c.req.param("id");
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  const patch = {};
+  if ("name" in body) {
+    const v = typeof body.name === "string" ? body.name.trim() : "";
+    if (!v) return c.json({ error: "A name is required." }, 400);
+    patch.name = v;
+  }
+  if ("url" in body) {
+    const v = typeof body.url === "string" ? body.url.trim().replace(/\/$/, "") : "";
+    if (!v || !isHttpUrl(v))
+      return c.json({ error: "A valid http(s) site URL is required." }, 400);
+    patch.url = v;
+  }
+  if ("secret" in body) {
+    const v = typeof body.secret === "string" ? body.secret.trim() : "";
+    if (!v || v.length < 16)
+      return c.json({ error: "A secret of at least 16 characters is required." }, 400);
+    patch.secret = v;
+  }
+  if ("is_active" in body) patch.is_active = !!body.is_active;
+  try {
+    const site = await updateCommunitySite(id, patch);
+    if (!site) return c.json({ error: "Community site not found." }, 404);
+    await loadActiveCommunitySites();
+    return c.json(serializeSite(site));
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/unique|duplicate/i.test(msg))
+      return c.json({ error: "A community site with this URL already exists." }, 409);
+    throw err;
+  }
+});
+communitySiteRoutes.delete("/:id", async (c) => {
+  if (!await serverAdminAllowed(c))
+    return c.json({ error: "Only the server admin can remove a community site." }, 403);
+  const id = c.req.param("id");
+  const removed = await deleteCommunitySite(id);
+  if (!removed) return c.json({ error: "Community site not found." }, 404);
+  await loadActiveCommunitySites();
+  return c.json({ ok: true, id });
+});
+
 // src/mcp/server-routes.ts
-import { Hono as Hono21 } from "hono";
+import { Hono as Hono23 } from "hono";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { z as z2 } from "zod";
-var SERVER_WRITE_TOOLS = /* @__PURE__ */ new Set(["nest_create", "context_create"]);
+var SERVER_WRITE_TOOLS = /* @__PURE__ */ new Set([
+  "nest_create",
+  "context_create",
+  "context_update",
+  "context_delete",
+  "context_move",
+  "context_submit_review"
+]);
+var FANOUT_READ_TOOLS = /* @__PURE__ */ new Set([
+  "context_search",
+  "context_list",
+  "context_query",
+  "context_overview"
+]);
 async function getUserEmail3(userId) {
   const db = getDb();
   const user = await db.get("SELECT email FROM users WHERE id = ?", [
@@ -11173,7 +11923,9 @@ async function buildNestIndex(userId, nestScope) {
       let document_count = null;
       try {
         const { storage } = await engineCache.get(n.id);
-        document_count = (await storage.discoverDocuments()).length;
+        document_count = (await storage.discoverDocuments()).filter(
+          (d) => !isDerivedAnnotationsNode(d.id)
+        ).length;
       } catch {
       }
       return {
@@ -11215,77 +11967,83 @@ var NEST_ARG = {
     description: "Target nest \u2014 id, or exact name/slug (case-insensitive)"
   }
 };
+var NEST_ARG_OPTIONAL = {
+  nest: {
+    type: "string",
+    description: "Target nest \u2014 id or name. Omit to search/list across ALL accessible nests."
+  }
+};
 var SERVER_TOOL_DEFINITIONS = [
   {
     name: "nest_index",
-    description: "Grounded index of every nest these credentials can read: name, id, permission, document count. Call this FIRST, then target a nest with the other tools.",
+    description: "Grounded index of every nest these credentials can read: name, id, permission, document count. Call this FIRST.",
     inputSchema: { type: "object", properties: {} }
   },
+  // ─── Fan-out reads (nest optional) ─────────────────────────────────────
   {
     name: "context_query",
-    description: "Run a structured selector query against one nest. Selector grammar: #tag, type:X, [[Title]], scope:X, combined with +AND, |OR, -NOT.",
+    description: "Run a structured selector query. Omit `nest` to query ALL accessible nests. Selector: #tag, type:X, [[Title]], scope:X, +AND, |OR, -NOT.",
     inputSchema: {
       type: "object",
       properties: {
-        ...NEST_ARG,
+        ...NEST_ARG_OPTIONAL,
         query: { type: "string", description: "Selector query" },
         hops: {
           type: "number",
           description: "Graph traversal depth from the matches (default: 2)"
         }
       },
-      required: ["nest", "query"]
+      required: ["query"]
     }
   },
   {
     name: "context_search",
-    description: "Full-text keyword search across one nest \u2014 the same index-backed match as REST GET /search. Returns `count` (everything found) and the first `limit` hits.",
+    description: "Full-text keyword search. Omit `nest` to search ALL accessible nests. Returns count and first `limit` hits.",
     inputSchema: {
       type: "object",
       properties: {
-        ...NEST_ARG,
+        ...NEST_ARG_OPTIONAL,
         query: { type: "string", description: "Search terms" },
         limit: {
           type: "number",
           description: "Max hits to return (default 20, max 200)"
         }
       },
-      required: ["nest", "query"]
-    }
-  },
-  {
-    name: "context_get",
-    description: "Get the FULL content of a node in a nest by title or id.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        ...NEST_ARG,
-        title: { type: "string", description: "Title of the node" },
-        id: { type: "string", description: "ID of the node" }
-      },
-      required: ["nest"]
+      required: ["query"]
     }
   },
   {
     name: "context_list",
-    description: "Browse one nest's contents with optional type, tag, or limit filters.",
+    description: "Browse contents with optional type, tag, or limit filters. Omit `nest` to list ALL accessible nests.",
     inputSchema: {
       type: "object",
       properties: {
-        ...NEST_ARG,
+        ...NEST_ARG_OPTIONAL,
         type: { type: "string", description: "Filter by node type" },
         tag: { type: "string", description: "Filter by tag" },
         limit: { type: "number", description: "Max nodes to return" }
-      },
-      required: ["nest"]
+      }
     }
   },
   {
     name: "context_overview",
-    description: "Map of one nest: node count, types, tags, title+snippet per node.",
+    description: "Map of nests: node count, types, tags, title+snippet per node. Omit `nest` for ALL accessible nests.",
+    inputSchema: {
+      type: "object",
+      properties: { ...NEST_ARG_OPTIONAL }
+    }
+  },
+  // ─── Targeted reads (nest required) ────────────────────────────────────
+  {
+    name: "context_get",
+    description: "Get the FULL content of a node in a nest by title or id.",
     inputSchema: {
       type: "object",
-      properties: { ...NEST_ARG },
+      properties: {
+        ...NEST_ARG,
+        title: { type: "string", description: "Title of the node" },
+        id: { type: "string", description: "ID of the node" }
+      },
       required: ["nest"]
     }
   },
@@ -11309,6 +12067,22 @@ var SERVER_TOOL_DEFINITIONS = [
       required: ["nest", "selector"]
     }
   },
+  {
+    // Read-only, so it belongs on this endpoint: an agent reading a nest's
+    // documents across nests also needs the feedback left on them. Writing a
+    // comment stays on the per-nest endpoint with the other write tools.
+    name: "context_comments",
+    description: "Get the review comments/annotations on a document in a nest \u2014 anchored quotes, threaded replies, and open/resolved status. Use to pull human feedback into context before acting on a document.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        nest: { type: "string", description: "Nest name or id (see nest_index)" },
+        title: { type: "string", description: "Title of the node" },
+        id: { type: "string", description: "ID of the node" }
+      },
+      required: ["nest"]
+    }
+  },
   {
     name: "nest_create",
     description: "Create a new nest owned by the caller. Returns the new nest's id \u2014 target it with the other tools afterwards.",
@@ -11321,9 +12095,10 @@ var SERVER_TOOL_DEFINITIONS = [
       required: ["name"]
     }
   },
+  // ─── Writes (nest required) ────────────────────────────────────────────
   {
     name: "context_create",
-    description: "Create a new knowledge node (document) in a nest. Needs write permission on that nest. A `folder` path creates the folder implicitly \u2014 folders exist through the nodes placed in them.",
+    description: "Create a new document in a nest. Needs write permission. A `folder` path creates the folder implicitly.",
     inputSchema: {
       type: "object",
       properties: {
@@ -11340,6 +12115,66 @@ var SERVER_TOOL_DEFINITIONS = [
       },
       required: ["nest", "title", "content"]
     }
+  },
+  {
+    name: "context_update",
+    description: "Update an existing node by title or id. Needs write permission. Use `content` to replace, `append` to add.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...NEST_ARG,
+        title: { type: "string", description: "Title of node to update" },
+        id: { type: "string", description: "Node id (use when title is ambiguous)" },
+        content: { type: "string", description: "New content (replaces)" },
+        append: { type: "string", description: "Content to append" },
+        tags: { type: "array", items: { type: "string" }, description: "Tags to add" },
+        status: { type: "string", description: "New status: draft|pending_review|approved|published" },
+        changeNote: { type: "string", description: "Why this changed \u2014 recorded in history" }
+      },
+      required: ["nest"]
+    }
+  },
+  {
+    name: "context_delete",
+    description: "Delete a node by title or id. Needs write permission. Irreversible.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...NEST_ARG,
+        title: { type: "string", description: "Title of node to delete" },
+        id: { type: "string", description: "Node id (use when title is ambiguous)" }
+      },
+      required: ["nest"]
+    }
+  },
+  {
+    name: "context_move",
+    description: "Move a node to a different folder. The id changes; history and links follow. Needs write permission.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...NEST_ARG,
+        title: { type: "string", description: "Title of node to move" },
+        id: { type: "string", description: "Node id (use when title is ambiguous)" },
+        folder: { type: "string", description: 'Destination folder (e.g. "gtm/deals"); "" for root' }
+      },
+      required: ["nest", "folder"]
+    }
+  },
+  {
+    name: "context_submit_review",
+    description: "Submit a node for steward review. Stewards will be notified. Use on governed nests.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...NEST_ARG,
+        title: { type: "string", description: "Title of node to submit" },
+        id: { type: "string", description: "Node id (use when title is ambiguous)" },
+        note: { type: "string", description: "Note for the reviewer" },
+        priority: { type: "string", description: "Priority: low, normal, high, urgent" }
+      },
+      required: ["nest"]
+    }
   }
 ];
 async function handleServerToolCall(toolName, args, userId, userEmail, nestScope, baseUrl) {
@@ -11373,8 +12208,49 @@ async function handleServerToolCall(toolName, args, userId, userEmail, nestScope
       throw err;
     }
   }
-  const inaccessible = `Nest not found or not accessible: "${args.nest}". Use nest_index to see what these credentials can read.`;
-  const nest = await resolveNestRef(String(args.nest ?? ""), userId);
+  const nestArg = args.nest;
+  if (!nestArg && FANOUT_READ_TOOLS.has(toolName)) {
+    const nests = await buildNestIndex(userId, nestScope);
+    if (!nests.length) return "No nests accessible with these credentials.";
+    const nonEmpty = nests.filter((n) => (n.document_count ?? 0) > 0);
+    if (!nonEmpty.length) {
+      return "All accessible nests are empty. Use context_create to add documents first.";
+    }
+    const results = await Promise.allSettled(
+      nonEmpty.map(async (n) => {
+        const engine2 = await engineCache.get(n.id);
+        const result = await handleToolCall(toolName, args, {
+          storage: engine2.storage,
+          queryEngine: engine2.query,
+          versionManager: engine2.versions,
+          nestId: n.id,
+          userId,
+          userEmail,
+          baseUrl
+        });
+        return { nest: n, result };
+      })
+    );
+    const parts = [];
+    for (const r of results) {
+      if (r.status === "fulfilled") {
+        const { nest: n, result } = r.value;
+        const text = typeof result === "string" ? result : result.text;
+        parts.push(`## ${n.name} (${n.id})
+
+${text}`);
+      }
+    }
+    if (!parts.length) {
+      return "No results found across any accessible nests.";
+    }
+    return parts.join("\n\n---\n\n");
+  }
+  const inaccessible = `Nest not found or not accessible: "${nestArg}". Use nest_index to see what these credentials can read.`;
+  if (!nestArg) {
+    return "This tool requires a `nest` argument. Use nest_index to see available nests.";
+  }
+  const nest = await resolveNestRef(String(nestArg), userId);
   if (!nest) return inaccessible;
   if (nestScope && nest.id !== nestScope) return inaccessible;
   if (!await canRead(nest.id, userId)) return inaccessible;
@@ -11421,7 +12297,7 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl) {
   }
   return server;
 }
-var serverMcpRoutes = new Hono21();
+var serverMcpRoutes = new Hono23();
 serverMcpRoutes.all("/", async (c) => {
   const userId = c.get("userId");
   const userEmail = await getUserEmail3(userId);
@@ -11443,7 +12319,7 @@ serverMcpRoutes.all("/", async (c) => {
     await server.server.close();
   }
 });
-var nestIndexRoutes = new Hono21();
+var nestIndexRoutes = new Hono23();
 nestIndexRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const nests = await buildNestIndex(userId, c.get("nestScope"));
@@ -11516,26 +12392,47 @@ Other read endpoints (all under \`${B}/nests/<nest-id>\`):
 - \`GET /nodes/<node-id>?format=raw\` \u2014 direct consumption path: the node BODY as plain text (no JSON envelope; add \`&frontmatter=1\` for the stored YAML block)
 - \`GET /export?format=markdown\` \u2014 whole nest as one markdown file (optional \`selector\`, \`max_tokens\`)
 - \`GET /graph\` \u2014 ontology graph (nodes, links, tags, stewards)
+- \`GET /folders\` \u2014 folder tree; \`GET /nodes?folder=<path>\` \u2014 one folder level
+- \`POST /table-query\` \u2014 exact rows from a table node: \`{ "table": "[[Title]]", "query": "where <col> <op> <value> [select cols] [limit N]" }\`
+- \`GET /nodes/<node-id>/versions\` \u2014 history (who, when, approval state); \`/versions/<n>\` \u2014 one version
+- \`GET /nodes/<node-id>/comments\` \u2014 review threads (anchored quotes, replies, open/resolved)
 
 Write endpoints (need write permission):
 - \`POST /nodes\` \u2014 \`{ "title", "content", "tags"?, "type"?, "folder"? }\`
 - \`PATCH /nodes/<node-id>\` \u2014 \`{ "content"? , "append"?, "tags"?, "title"? }\`
-- \`DELETE /nodes/<node-id>\`
-- Governance: \`POST /nodes/<id>/submit-review\`, \`/approve\`, \`/reject\`
+- \`DELETE /nodes/<node-id>\`; \`POST /nodes/<id>/request-deletion\` when you lack delete rights
+- \`POST /nodes/<id>/move\` \u2014 \`{ "folder" }\`; history and comments follow
+- \`POST /nodes/<id>/revert\` \u2014 \`{ "targetVersion" }\` restores a past version as a new one
+- \`POST /nodes/<id>/comments\` \u2014 leave or reply to a review comment
+- Governance: \`POST /nodes/<id>/submit-review\`, \`/approve\`, \`/reject\`, \`/cancel-review\`
+- \`GET /review-queue\` \u2014 what is waiting on a steward in this nest
+
+## Your inbox (server-level)
+
+- \`GET ${B}/me/work\` \u2014 reviews waiting on you and handoffs, across every nest
+- \`GET ${B}/me/drafts\` \u2014 your documents never submitted for review
+- \`GET ${B}/me/notifications\` \u2014 watcher and review notifications
 
 ## MCP (Model Context Protocol)
 
 Streamable HTTP, stateless. Two endpoints:
 
-- \`${B}/mcp\` \u2014 server-level, one connection for everything readable.
-  Tools: \`nest_index\` (call first), then \`context_query\`, \`context_search\`,
-  \`context_get\`, \`context_list\`, \`context_overview\`, \`context_resolve\` \u2014
-  each takes a \`nest\` argument (id or exact name) plus the same
-  selector/hops/max_tokens parameters as the REST API. Two bootstrap writes:
-  \`nest_create\` (new nest owned by the caller) and \`context_create\`
-  (new document in a writable nest; a \`folder\` path creates the folder).
-- \`${B}/nests/<nest-id>/mcp\` \u2014 per-nest, full toolset including writes and
-  governance (create/update, submit/approve/reject, stewards, sharing).
+- \`${B}/mcp\` \u2014 server-level, one connection for everything.
+  Tools: \`nest_index\` (call first), then:
+  - Fan-out reads (omit \`nest\` to search/list ALL nests): \`context_search\`,
+    \`context_list\`, \`context_query\`, \`context_overview\`
+  - Targeted reads (\`nest\` required): \`context_get\`, \`context_resolve\`, \`context_comments\`
+  - Writes (\`nest\` required): \`nest_create\`, \`context_create\`, \`context_update\`,
+    \`context_delete\`, \`context_move\`, \`context_submit_review\`
+- \`${B}/nests/<nest-id>/mcp\` \u2014 per-nest, the full toolset. Same names as the
+  server-level tools without the \`nest\` argument, plus:
+  - read: \`context_init\` (operating instructions \u2014 call first), \`context_export\`, \`context_table_query\`, \`context_versions\`
+  - write: \`context_update\`, \`context_delete\`, \`context_move\`, \`context_request_deletion\`
+  - review: \`context_submit_review\`, \`context_approve\`, \`context_reject\`, \`context_review_queue\`, \`context_my_drafts\`
+  - comments: \`context_comment\`, \`context_resolve_comment\`
+  - people: \`context_stewards\`, \`context_assign_steward\`, \`context_share_nest\`, \`context_grant\`
+  - admin: \`context_deletion_queue\`, \`context_resolve_deletion\`, \`context_unsynced_list\`, \`context_sync_folder\`
+  - \`workflow_*\` (runs, edges, edge types) when the nest's workflow plane is on
   Sharing a slice is one call: \`context_grant\` with
   \`{ "email", "target_type": "document" | "folder", "target", "role": "read" | "write" }\`
   \u2014 \`target\` is a node id (\`nodes/win-loss-log\`) or a folder prefix
@@ -11582,14 +12479,14 @@ is \`ctx push --server ${B} --nest <nest-id>\` with the same env var set.
   through steward review before they become AI-visible.
 `;
 }
-var llmsTxtRoutes = new Hono21();
+var llmsTxtRoutes = new Hono23();
 llmsTxtRoutes.get("/", (c) => {
   const md = renderLlmsTxt(requestBaseUrl(c.req.url));
   return c.text(md, 200, { "Content-Type": "text/markdown; charset=utf-8" });
 });
 
 // src/governance/routes.ts
-import { Hono as Hono22 } from "hono";
+import { Hono as Hono24 } from "hono";
 
 // src/governance/feed-service.ts
 var SNIPPET_CHARS = 200;
@@ -11720,7 +12617,7 @@ async function getNestFeed(params) {
 }
 
 // src/governance/comment-service.ts
-import { v4 as uuid17 } from "uuid";
+import { v4 as uuid18 } from "uuid";
 async function createComment(params) {
   const db = getDb();
   const body = (params.body ?? "").trim();
@@ -11736,7 +12633,7 @@ async function createComment(params) {
       throw new Error("Parent comment not found on this node");
     }
   }
-  const id = uuid17();
+  const id = uuid18();
   await db.run(
     `INSERT INTO comments
        (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
@@ -12021,7 +12918,7 @@ function parseLimit(raw, def = 100, max = 1e3) {
   if (Number.isNaN(n) || n < 1) return def;
   return Math.min(n, max);
 }
-var governanceRoutes = new Hono22();
+var governanceRoutes = new Hono24();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -12374,6 +13271,7 @@ governanceRoutes.get("/external-edits", async (c) => {
     await scanNestForDrift(nestId, "user:refresh");
   }
   const entries = await listNestExternalEdits(nestId);
+  if (c.req.query("count") === "1") return c.json({ total: entries.length });
   return c.json({ entries, total: entries.length });
 });
 governanceRoutes.post("/external-edits/scan", async (c) => {
@@ -12388,7 +13286,7 @@ governanceRoutes.get("/activity", async (c) => {
   const activity = await getActivity({ nestId, limit });
   return c.json({ activity });
 });
-var governanceNodeRoutes = new Hono22();
+var governanceNodeRoutes = new Hono24();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -12520,8 +13418,9 @@ governanceNodeRoutes.post("/:nodeId{.+}/comments", async (c) => {
   }
   const body = await c.req.json();
   const author = await getUserEmail4(c);
+  let comment;
   try {
-    const comment = await createComment({
+    comment = await createComment({
       nestId,
       nodeId,
       author,
@@ -12530,12 +13429,19 @@ governanceNodeRoutes.post("/:nodeId{.+}/comments", async (c) => {
       anchor: body.anchor,
       parentId: body.parentId
     });
-    return c.json({ comment }, 201);
   } catch (err) {
     throw new ValidationError(
       err instanceof Error ? err.message : String(err)
     );
   }
+  await notifyCommentMentions({
+    nestId,
+    nodeId,
+    body: comment.body,
+    actorEmail: author,
+    baseUrl: requestBaseUrl(c.req.url)
+  });
+  return c.json({ comment }, 201);
 });
 governanceNodeRoutes.post(
   "/:nodeId{.+}/comments/:commentId/resolve",
@@ -12832,6 +13738,21 @@ async function ensureAnonymousUser() {
   return ANON_USER_ID;
 }
 
+// src/shared/posthog-key.ts
+var POSTHOG_KEY_MIN_TOKEN = 20;
+function posthogKeyError(value) {
+  const v = value.trim();
+  if (!v) return null;
+  if (!v.startsWith("phc_"))
+    return "PostHog project key must start with phc_ \u2014 copy the project API key from PostHog settings.";
+  const token = v.slice(4);
+  if (!/^[A-Za-z0-9]*$/.test(token))
+    return "PostHog project key may only contain letters and digits after phc_ \u2014 check for spaces or punctuation.";
+  if (token.length < POSTHOG_KEY_MIN_TOKEN)
+    return `PostHog project key looks too short \u2014 a real key is about 47 characters long (phc_ plus ${POSTHOG_KEY_MIN_TOKEN}+ letters and digits). Copy the whole key from PostHog settings.`;
+  return null;
+}
+
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
@@ -12953,7 +13874,7 @@ async function canApproveInNest(nestId, email) {
   return ok;
 }
 function createApp() {
-  const app = new Hono23({ router: new LinearRouter() });
+  const app = new Hono25({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -13134,7 +14055,7 @@ function createApp() {
       return c.json({ error: msg }, 500);
     }
   });
-  const serverAdminAllowed = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
+  const serverAdminAllowed2 = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
   app.use("/admin/settings", flexAuthMiddleware);
   app.use("/admin/settings/*", flexAuthMiddleware);
   const currentServerSettings = () => ({
@@ -13163,6 +14084,7 @@ function createApp() {
     oidc_allowed_domains: config.OIDC_ALLOWED_DOMAINS.join(", "),
     oidc_auto_provision: config.OIDC_AUTO_PROVISION,
     oidc_department_tagging: config.OIDC_DEPARTMENT_TAGGING,
+    people_suggest_all_users: config.PEOPLE_SUGGEST_ALL_USERS,
     // Agent SSO / token-exchange. MCP_SIGNING_SECRET is WRITE-ONLY — only its
     // presence is reported, never the value (same discipline as the OIDC secret).
     sso_token_exchange_enabled: config.SSO_TOKEN_EXCHANGE_ENABLED,
@@ -13187,12 +14109,12 @@ function createApp() {
     notify_email_to: config.NOTIFY_EMAIL_TO ?? ""
   });
   app.get("/admin/settings", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can view this." }, 403);
     return c.json(currentServerSettings());
   });
   app.post("/admin/settings/test-notification", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can do this." }, 403);
     let body;
     try {
@@ -13206,7 +14128,7 @@ function createApp() {
     return result.ok ? c.json({ ok: true }) : c.json({ error: result.error }, 502);
   });
   app.patch("/admin/settings", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can change this." }, 403);
     let body;
     try {
@@ -13244,7 +14166,9 @@ function createApp() {
     }
     if ("posthog_key" in body) {
       const v = String(body.posthog_key ?? "").trim();
-      pending.push({ name: "POSTHOG_KEY", value: v || null });
+      const keyError = posthogKeyError(v);
+      if (keyError) addError("posthog_key", keyError);
+      else pending.push({ name: "POSTHOG_KEY", value: v || null });
     }
     if ("posthog_host" in body) {
       const v = String(body.posthog_host ?? "").trim().replace(/\/$/, "");
@@ -13383,6 +14307,12 @@ function createApp() {
         value: body.oidc_department_tagging ? "true" : null
       });
     }
+    if ("people_suggest_all_users" in body) {
+      pending.push({
+        name: "PEOPLE_SUGGEST_ALL_USERS",
+        value: body.people_suggest_all_users ? "true" : null
+      });
+    }
     if ("sso_token_exchange_enabled" in body) {
       pending.push({
         name: "SSO_TOKEN_EXCHANGE_ENABLED",
@@ -13551,7 +14481,7 @@ function createApp() {
   });
   app.use("/admin/trace", flexAuthMiddleware);
   app.get("/admin/trace", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can view this." }, 403);
     const limitRaw = Number(c.req.query("limit"));
     const offsetRaw = Number(c.req.query("offset"));
@@ -13569,7 +14499,7 @@ function createApp() {
   app.use("/admin/super-admins", flexAuthMiddleware);
   app.use("/admin/super-admins/*", flexAuthMiddleware);
   app.get("/admin/super-admins", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can view this." }, 403);
     const callerEmail = (await resolveCallerEmail(c.get("userId"))).toLowerCase();
     const byEmail = /* @__PURE__ */ new Map();
@@ -13595,7 +14525,7 @@ function createApp() {
     return c.json({ super_admins: [...byEmail.values()] });
   });
   app.post("/admin/super-admins", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can grant superadmin." }, 403);
     let body;
     try {
@@ -13640,7 +14570,7 @@ function createApp() {
     return c.json({ email, source: "granted", granted_by: grantedBy }, 201);
   });
   app.delete("/admin/super-admins/:email", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can revoke superadmin." }, 403);
     const email = c.req.param("email").trim().toLowerCase();
     const callerEmail = (await resolveCallerEmail(c.get("userId"))).toLowerCase();
@@ -13681,9 +14611,14 @@ function createApp() {
     await loadGrantedSuperAdmins();
     return c.json({ ok: true, email });
   });
+  app.use("/admin/community-sites", flexAuthMiddleware);
+  app.use("/admin/community-sites/*", flexAuthMiddleware);
+  app.route("/admin/community-sites", communitySiteRoutes);
   app.use("/teams/*", flexAuthMiddleware);
   app.use("/teams", flexAuthMiddleware);
   app.route("/teams", teamRoutes);
+  app.use("/people/*", flexAuthMiddleware);
+  app.route("/people", peopleRoutes);
   app.use("/me/*", flexAuthMiddleware);
   app.get("/me/work", async (c) => {
     const userId = c.get("userId");
@@ -13827,7 +14762,9 @@ function createApp() {
     for (const nest of visibleNests) {
       try {
         const { storage } = await engineCache.get(nest.id);
-        const docs = await storage.discoverDocuments();
+        const docs = (await storage.discoverDocuments()).filter(
+          (d) => !isDerivedAnnotationsNode(d.id)
+        );
         documents += (await filterAccessible(nest.id, userId, userEmail, docs)).length;
       } catch {
       }
@@ -13882,7 +14819,7 @@ function createApp() {
   app.route("/index", nestIndexRoutes);
   app.use("/mcp", flexAuthWithPromptowlTicket);
   app.route("/mcp", serverMcpRoutes);
-  const nestsApp = new Hono23();
+  const nestsApp = new Hono25();
   nestsApp.use("*", async (c, next) => {
     const parts = nestPathParts(c.req.path);
     const ticketEligible = parts.length === 2 && (c.req.method === "POST" && parts[1] === "context" || c.req.method === "GET" && parts[1] === "nodes" || parts[1] === "mcp");
@@ -13996,7 +14933,7 @@ function createApp() {
     const isCommentAction = /\/comments$/.test(path) || /\/comments\/[^/]+\/resolve$/.test(path);
     const isDeletionRequestAction = /\/request-deletion$/.test(path) || /\/deletion-requests\/[^/]+\/withdraw$/.test(path);
     const isStewardRoster = path.includes("/stewards") && !path.includes("/nodes/");
-    if (isStewardRoster && permission !== "owner" && permission !== "admin") {
+    if (isStewardRoster && access.rawPermission !== "owner" && access.rawPermission !== "admin") {
       return c.json(
         {
           error: "You don't have permission to manage stewards. Only a nest admin, the nest owner, or the server admin can do this."
@@ -14004,6 +14941,13 @@ function createApp() {
         403
       );
     }
+    if (isStewardRoster && access.archived && c.req.method !== "GET") {
+      return deny(
+        403,
+        "This nest is archived, so it is read-only. Restore it to change stewards.",
+        { archived: true }
+      );
+    }
     const resource = parts[1];
     if (resource === "visibility" || resource === "reader-mode") {
       required = "admin";
@@ -14042,6 +14986,13 @@ function createApp() {
     const grantLevel = grantRole ? permissionLevel(grantRole) : grantNestVisible ? permissionLevel("read") : 0;
     const effectiveLevel = Math.max(permissionLevel(permission), grantLevel);
     if (!stewardEditorBypass && effectiveLevel < permissionLevel(required)) {
+      if (access.archived && permissionLevel(access.rawPermission) >= permissionLevel(required)) {
+        return deny(
+          403,
+          "This nest is archived, so it is read-only. Restore it to make changes.",
+          { archived: true }
+        );
+      }
       return deny(
         403,
         `You don't have access to perform this action on this nest. Required permission: '${required}', your permission: '${permission}'. Ask the nest owner or a server admin to grant you ${required} access.`,
@@ -14414,7 +15365,7 @@ async function repairGraftedVersionChains(db) {
 }
 
 // src/workflow/scheduler.ts
-import { v4 as uuid18 } from "uuid";
+import { v4 as uuid19 } from "uuid";
 function isDue(s, now) {
   if (!s.last_run_at) return true;
   const last = Date.parse(s.last_run_at);
@@ -14442,7 +15393,7 @@ async function schedulerTick(now = Date.now()) {
         );
         continue;
       }
-      const id = `run_${uuid18()}`;
+      const id = `run_${uuid19()}`;
       const nowIso2 = new Date(now).toISOString();
       await db.run(
         `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
@@ -14512,6 +15463,11 @@ async function main() {
   } catch (err) {
     console.error("[access] failed to load DB-granted superadmins:", err);
   }
+  try {
+    await loadActiveCommunitySites();
+  } catch (err) {
+    console.error("[sso] failed to load community sites:", err);
+  }
   const license = await validateLicense();
   if (!license.valid) {
     console.warn(`